@bongos/core 1.24.90 → 1.24.92

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.90",
-  "core_contract": "1.24.90",
-  "source_commit": "8b084c190e038c91f0cd34788d09ef2aaaf11a22",
+  "core_version": "1.24.92",
+  "core_contract": "1.24.92",
+  "source_commit": "5c483e2ab47fc0cca7356e60e6cc00e055dba066",
   "source_ref": "HEAD",
-  "built_at": "2026-11-12T12:22:11.337Z",
+  "built_at": "2026-11-12T20:04:52.110Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 650,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3964,
+    "functional_verbatim": 3965,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4647,
-  "tree_sha256": "904d7883071b44b177146ffb3f7ac3b50033d6f3a86d5b162f91c48e1f5e397b",
+  "file_count": 4648,
+  "tree_sha256": "4efb5396f6e0daf17115f129bef70f7f252a5ba802e08886aa949d036aab5353",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -82,7 +82,7 @@
     {
       "path": ".claude/skills/builder-reauth/SKILL.md",
       "mode": "0000644",
-      "sha256": "87914427956d7dd7d947e56fc3aaa0029c53aae738469470782ed7b3b397c8fc"
+      "sha256": "66a2755314dbf7e4ede87854b8a47730f0603196ab79498f85b5a8ba175e155d"
     },
     {
       "path": ".claude/skills/builder-redteam/SKILL.md",
@@ -352,7 +352,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "f9f0e9f4f0d7f87abffa4d19cd4a25d4ab1d9bd6403c50e739acd37383aa2db9"
+      "sha256": "61118835fbddfe0f7a64113ccc4b9e2f79ea095b4c7bef0b079250a83871f652"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2442,7 +2442,7 @@
     {
       "path": "docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md",
       "mode": "0000644",
-      "sha256": "7c13a3f082ab91435a181f8b197f1e46708cc1b24a9ad80463c74f3726280d70"
+      "sha256": "fc77036762aa8daa9820f22f0d75dfaa63c1de282efe9124cfbc31fdc2d45cf7"
     },
     {
       "path": "docs/adr/0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md",
@@ -2487,12 +2487,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "65f7628372fca1bb6fd5feb7199e68fddac624f3d8541a77ebd5828b7fdf0a9a"
+      "sha256": "dd3ab48cc4735ba7af87f656b299ede977c38623318350b6b32191538c6f8b52"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "335d23581fe7d06ff91aa155b70edb69c0195c46a49aaa8959db0d707b4abf19"
+      "sha256": "8004732e03a7d1cead9cba35155c8336015e23f509fcd2b1ef13fbf887a549ec"
     },
     {
       "path": "docs/architecture.md",
@@ -2517,12 +2517,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "c37bd90219c6e760347c3cc48f3647a0f255b4ae084edbb010ec5a33f7ea04dc"
+      "sha256": "daec3c74bc27e603c5ded55ed72be5e4c82cd31efc5b9363a7755eb91b97f56c"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "f493610562231d36902d6f4b8c0842574ac19f960a58a59812cec7bd04048073"
+      "sha256": "2a1347d59793c3b152b0179523fbcff57a5edacb3ac043bfad321d50d38f7bc4"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -3037,7 +3037,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "40c2f5de03f98c8bcbf0f169f0bb1d6066803f6ab96171ddf29b9cf4491abad6"
+      "sha256": "88e6ca24e358d295f74a7dd741f610062d3f44043b617d5a06c83f55164090d7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3122,7 +3122,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "10f19956b0f3c1b7e14f5433b40f417ce54a8f4291f4194fb98163522f9a83fd"
+      "sha256": "46fa6c491c705c13c961d1efbe3453ca2afd1d56f0b230f6024435f6b605f072"
     },
     {
       "path": "docs/project-context.template.md",
@@ -6222,7 +6222,7 @@
     {
       "path": "modules/hall-ui/public/city.css",
       "mode": "0000644",
-      "sha256": "33056c156e2ec8a8ad008c1e268b82e7445f3e1471e79e572c3054cfdf56d474"
+      "sha256": "4696bb120ec74640555ad747711986e96dea49c658e782f77f1042b9f70a0ecd"
     },
     {
       "path": "modules/hall-ui/public/city.html",
@@ -6232,7 +6232,7 @@
     {
       "path": "modules/hall-ui/public/city.js",
       "mode": "0000644",
-      "sha256": "e0800a150b163e23a233dbf0fd05a67fdf7af0eff71d2f5b519d74ebc4d347af"
+      "sha256": "3ad52ec95501913a0a4bbb8378c33e3e1f8459d4b233b96c88db012d1f68a66b"
     },
     {
       "path": "modules/hall-ui/public/city.states.json",
@@ -7172,12 +7172,12 @@
     {
       "path": "modules/hall-ui/public/shell-game.css",
       "mode": "0000644",
-      "sha256": "b6f73cbe50b30b8660ca61f4cc837d2ce14b621591d5fff1363361120cb638df"
+      "sha256": "72c68b09d2736d3d7c844eca2766dee3fa22e65531c6ad2d9ebb5e10fc74c307"
     },
     {
       "path": "modules/hall-ui/public/shell-game.js",
       "mode": "0000644",
-      "sha256": "560f0a68b1b88e5e12170bf1b222022617d678c523a76859acffc6f383d167f8"
+      "sha256": "8bdeb71a631a2e303608dfa45a7d38ed083c6b25aad14e55024e6b8ba534897f"
     },
     {
       "path": "modules/hall-ui/public/shell-trail.js",
@@ -7442,7 +7442,7 @@
     {
       "path": "modules/hall-ui/public/visor.js",
       "mode": "0000644",
-      "sha256": "7c3dec2c81435516e15a35d4245557215c84d809f76ac9b49f95529a935518ec"
+      "sha256": "862ab2d430e0fc42bed3e757af5a07e672022803f098c3acc7582a62592f5ac1"
     },
     {
       "path": "modules/hall-ui/public/vote-control.js",
@@ -7732,7 +7732,7 @@
     {
       "path": "modules/hall-ui/records/start-screen.md",
       "mode": "0000644",
-      "sha256": "8153647e56554759a233900191c1772ae42aef8578ebc626b34280b0b91ae1ea"
+      "sha256": "974f95a4486cfa02b77d59c537332759bb3beea9facd208ab7b0f565f3c731b4"
     },
     {
       "path": "modules/hall-ui/records/studio.md",
@@ -7752,7 +7752,7 @@
     {
       "path": "modules/hall-ui/records/visor.md",
       "mode": "0000644",
-      "sha256": "515c6e31880265d11477e723fd0307d49409b6c04d5e53aa6579ef809c88269b"
+      "sha256": "a8d42170b6a0b27e8f75f3866c936c72f06c35a8ef44ae2bc7d034c213736d26"
     },
     {
       "path": "modules/hall-ui/records/welcome-tower.md",
@@ -12102,12 +12102,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "7cd685f627a16c373b7c02c103aa377c1978526abdd4551c1dfe2b4e73b7eed4"
+      "sha256": "0991d22207637a766189c9d741ee4e8c166d315554259886978355b181da37be"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "b1a500b3e515779422782bf3f0e36f3c33ec5616170ceecdcb1b58650ab43aee"
+      "sha256": "1de1dbdb758d263abd1d822870f785231ec5f9dae3e115345741911f5c325a17"
     },
     {
       "path": "public-docs/index.html",
@@ -12127,7 +12127,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "9c99264a25217b3386e20b6a4151551200345eb1b7d3d9bb55a03dd0c259bef7"
+      "sha256": "28d81c1f519f6dcfdf35231190bf317d97a1920e15930f92a98fafcc20e47027"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12417,7 +12417,7 @@
     {
       "path": "scripts/bongos/cli-lib.js",
       "mode": "0000644",
-      "sha256": "7f00d2ce761ee775341e21cce68e64b8346f2f2c4bcd5cd41b16b9e8404f926e"
+      "sha256": "49a35fbc1523b75e922ed79ff473e833a8cae915d46d36981b8993eb522571be"
     },
     {
       "path": "scripts/bongos/client-baseurl-guard.js",
@@ -12937,7 +12937,7 @@
     {
       "path": "scripts/bongos/login.js",
       "mode": "0000644",
-      "sha256": "0a13005b8a73dd31b46bdb6f7762f483654e85e060f37eb8e78d9a6088f7245c"
+      "sha256": "c6e9232bae6700d8e4bebfd11796b00ee850ae78da5ae689dcc109366bb46600"
     },
     {
       "path": "scripts/bongos/main-audit.js",
@@ -13127,7 +13127,7 @@
     {
       "path": "scripts/bongos/plain-cards.js",
       "mode": "0000644",
-      "sha256": "2fc62830cab07c3536eeb531429de39b1726657e5fd6862b9bf3b6d76e93e56d"
+      "sha256": "755fdb4f7596c114a888fbdaf540e82bccd184b6ae7b4bf01d8163b3f0b9ed0e"
     },
     {
       "path": "scripts/bongos/portability-smoke-art.sh",
@@ -13292,7 +13292,7 @@
     {
       "path": "scripts/bongos/reauth.js",
       "mode": "0000644",
-      "sha256": "2e790186eebf403037e61a499bd865a9ebdfb8fe6e9958d95a4cd078f7b521fa"
+      "sha256": "5d62a84e7f2e35ab6fa37c5fd7b37bd9baf48b7bc984591a01c8850665746f88"
     },
     {
       "path": "scripts/bongos/recall.js",
@@ -15912,7 +15912,7 @@
     {
       "path": "src/bongos/routes/auth-google.js",
       "mode": "0000644",
-      "sha256": "f7531eefb5d958f4924aff1e0e1bf8bf258f82cc676d7bdb0f26e6235a181ae4"
+      "sha256": "7d42cf2a68ebf6d852cc63fdfb8774867221b880025669d5f9a29ac20f26bd9d"
     },
     {
       "path": "src/bongos/routes/auth-link.js",
@@ -15922,7 +15922,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "5dac69f518fb0933f111d3df4dfc400e1573ffd2849abe7599ed16bd0ab63d58"
+      "sha256": "438f7feeb87eb85b4aaca2bf20e0304d95822a8e77c92f9c2a042a90dd0bb03d"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -16062,7 +16062,7 @@
     {
       "path": "src/bongos/sign-in-pages.js",
       "mode": "0000644",
-      "sha256": "cfd8a09da90e8f2a176e94c960736bbb295c216a1d6bf1f8027f7f0ce1ceacc8"
+      "sha256": "8f93a2b576e4f2b2bdaf8feec2a8c6c4b23f31be4c071f119a4ca56f39e5fa6c"
     },
     {
       "path": "src/bongos/software-update.js",
@@ -16132,7 +16132,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "3f89e6652915fa721adbcd8cdb5d45d62aa319df8928f03f8684d01c303a3064"
+      "sha256": "d01b0c8ee350427a447cb9f10713e5abbf76d49f57702e7dee8942a8c2de39e1"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -17174,6 +17174,11 @@
       "mode": "0000644",
       "sha256": "79c57041a871f9700682ac96cebf5d07fe393cc274b5549e8659cad34f44cee1"
     },
+    {
+      "path": "tests/cli_reauth_browser.mjs",
+      "mode": "0000644",
+      "sha256": "758964ef9d4d5d1921162aab1e86a4fb07fe7347aca5866391c8dd33ce67d94d"
+    },
     {
       "path": "tests/cli_sessions.mjs",
       "mode": "0000644",
@@ -19027,7 +19032,7 @@
     {
       "path": "tests/hall_city.mjs",
       "mode": "0000644",
-      "sha256": "781ad77857a1c04165bdd98d033a0776f036feff0752a49b033a4a1bc8179f13"
+      "sha256": "5483169cd2c06f4782662148aa8bd7381db888c6c2052f63b92582d8c80677ac"
     },
     {
       "path": "tests/hall_city_card_words.mjs",
@@ -19037,7 +19042,7 @@
     {
       "path": "tests/hall_city_living.mjs",
       "mode": "0000644",
-      "sha256": "1b6744e38a44f486978a1f3ecf275fa260a6d79b0779242fdd4827980b14593d"
+      "sha256": "a8d7ef26e5f647dac6fb03d3759968585ef0146a03de6c8e2897c0943c6db1ee"
     },
     {
       "path": "tests/hall_city_rewording.mjs",
@@ -19307,7 +19312,7 @@
     {
       "path": "tests/hall_start_screen.mjs",
       "mode": "0000644",
-      "sha256": "de4af84ee48502b60a05e8a86c6052d88032278499b47c1838d65269036272c8"
+      "sha256": "2bd3eb149849acd71eb004177e6afd0541157e274453951c4903b21e9d61f5b5"
     },
     {
       "path": "tests/hall_states_regex_escapes.mjs",
@@ -19387,7 +19392,7 @@
     {
       "path": "tests/hall_visor.mjs",
       "mode": "0000644",
-      "sha256": "055de4ac3afe4e7883be6cb462e00879bafc4c7593186ae7d728dbd5ee13f6f6"
+      "sha256": "059033debd304e748ec9b79b127ff3c188b474d7e81570c8cbe8dea9a8cec1b6"
     },
     {
       "path": "tests/hall_work_history_id.mjs",

package/.claude/skills/builder-reauth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: builder-reauth
 description: >-
-  Refresh an expired Bongos CLI session, UI-first. Triggers: "/builder-reauth", "re-auth", "refresh my session", "my Bongos session expired", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
+  Sign the CLI back in with one browser click. Triggers: "/builder-reauth", "re-auth", "sign me back in", "refresh my session", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
 plain: >-
   Signs your assistant back in when its sign-in to the project has expired.
 reach-for: >-
@@ -10,7 +10,7 @@ cost: >-
   Free. It replaces your saved sign-in and changes nothing else.
 ---
 
-You are refreshing the current builder's Bongos CLI session. CLI bearer tokens **do not expire** — since [ADR 0294](../../../docs/adr/0294-cli-sessions-do-not-expire.md) a session lasts until it is revoked. So a rejected token means something killed it: the builder (or an Archon) revoked it, a demotion swept it, or an auth-changing deploy invalidated it. This skill is the **fast path back in**: browser clicks plus a single copy/paste, instead of the slower terminal Device Flow.
+You are signing the current builder's command line back in to Bongos. CLI sessions **do not expire** — since [ADR 0294](../../../docs/adr/0294-cli-sessions-do-not-expire.md) a session lasts until it is revoked. So a rejected session means something killed it: the builder (or an Archon) revoked it, a demotion swept it, or an auth-changing deploy invalidated it. This skill gets them back in with **one Approve click in their browser** — nothing to copy, nothing to paste, and the token never passes through the chat (task 1005118).
 
 ## Why there is no expiry (so you can explain it if asked)
 
@@ -18,42 +18,40 @@ There used to be a 24h idle TTL, for auth-token hygiene (GDS-V3 criterion **C9**
 
 What actually bounds a leaked token is **revocation**, and it is faster than any clock: the builder kills it themselves from Settings → Active sessions or "Sign out everywhere" ([ADR 0206](../../../docs/adr/0206-own-scoped-session-revocation-no-absolute-ceiling.md)). Rank changes were never the TTL's job either — demotion calls `revokeAllSessionsForBuilder` synchronously and rank is read fresh from the DB on every request ([ADR 0016](../../../docs/adr/0016-trust-boundary-server-enforced-permissions.md)).
 
-## The flow (guided paste)
+## The flow (one click)
 
-1. **Detect.** Run the helper — it checks whether the existing session is still valid and, if not, opens the hall:
+1. **Say what is about to happen, in one line**, before running anything: a page will open in their browser; they check the code and click **Approve**, and you carry on by yourself.
+
+2. **Run the helper with a long timeout** — it waits for the click (up to ten minutes):
    ```bash
    node scripts/bongos/reauth.js
    ```
-   - **Exit 0** → the session is already valid. Relay who they're signed in as and stop — there is nothing to do. Do NOT re-auth a working session.
-   - **Exit 10** → re-auth is needed. The helper has opened (or printed) the builders' hall URL and the click-path. Continue to step 2.
-   - **Exit 2** → the API was unreachable (network). Relay that, and let them retry once they're back online. The session may be fine.
+   Give the Bash call `timeout: 600000`. The helper checks the current session first; if it is broken it asks the instance for its own approval page (`approve_in_browser`), opens it with the code filled in, waits for the click, and saves the new session itself.
+   - **Exit 0** → signed in. Either the session was already working (say so — do NOT re-sign-in a working session) or the approval just landed. Relay who they are signed in as, then re-run whatever `/builder-*` command they were trying.
+   - **Exit 10** → not signed in: they pressed Cancel, the page ran out, or the account is not let in. The helper says which and prints the fallback below. Offer to run it again once; if that also fails, use the fallback.
+   - **Exit 2** → the instance was unreachable (network). The session may be fine; let them retry once they are back online.
 
-2. **Relay the click-path verbatim.** The helper prints the exact steps; pass them to the user clearly (don't paraphrase the URL):
-   - Open `https://example.com/builders/settings` (the helper tries to open it automatically; if not, give them the link).
-   - They are already signed in there via the browser cookie. Under the **"CLI Access"** section, click **"Re-issue CLI token"**.
-   - Click **"Copy"** — it copies a one-line command of the form `bongos paste-token <token>`.
-   - Ask them to **paste that one line back into the chat**.
+3. **If the page says they are not signed in** in the browser, it shows a **Continue with GitHub** button (and Google where the instance offers it). They sign in there and land straight back on the Approve page — the helper is still waiting.
 
-3. **Run the pasted command.** When the user pastes `bongos paste-token <token>`, run it exactly as given. `paste-token.js` verifies the token against `/api/bongos/me` **before** touching the session file (a bad paste leaves the existing session intact) and preserves any `gemini_api_key`. On success it prints the builder login, rank, and confirms the session file was written.
+## Fallback — the copied line (no browser on this machine)
 
-4. **Confirm.** Relay the authenticated identity + rank back to the user, and tell them they can now re-run whatever `/builder-*` command they were trying.
+Only when the one-click path cannot work — a remote/SSH machine with no browser, or the click path failed twice — run `node scripts/bongos/reauth.js --paste` and relay its click-path: Settings → **CLI Access** → **Re-issue CLI token** → **Copy**, then paste the `bongos paste-token <token>` line back into the chat and run it exactly as given. `paste-token.js` verifies the token before writing and preserves `gemini_api_key`. This path puts the token in the chat, so never echo it beyond running that one command, and never write it anywhere yourself.
 
 ## Edge cases
 
-- **"You are not signed in" / `cookie_required`.** The re-issue endpoint mints CLI bearers from a browser *cookie*, not a bearer — a leaked CLI token can't extend its own life. If the Settings page shows them logged out, they sign in at `https://example.com/builders` first, then return to `/builders/settings` and click Re-issue. Once signed in the button works.
-- **No session file at all (fresh machine).** The helper still guides them to the Settings page; if they've never authed on this machine, the hall sign-in + Settings → CLI Access → Re-issue path still works. The terminal Device Flow (`node scripts/bongos/setup.js`) remains the fallback for a brand-new builder with no browser session anywhere.
-- **Browser can't open automatically** (headless / SSH). The helper prints the URL; relay it so they can open it on whatever machine has their browser, then paste the one-liner back.
-- **Fallback — terminal Device Flow.** If the browser path is unavailable for any reason, `node scripts/bongos/setup.js --force` re-auths via GitHub Device Flow (terminal code entry). Slower and not UI-first; use only when the hall route can't be used.
+- **An instance older than task 1005118** ignores the browser-approval ask and answers GitHub's own device flow: the helper prints a code and opens github.com/login/device. Relay the code; the person types it there and approves. It still finishes by itself.
+- **No session file at all (fresh machine).** The helper runs the same browser approval. A brand-new builder who has never signed in anywhere uses `/builder-setup` instead.
+- **Several projects on one machine.** The helper signs in to the project the active session names (or `BONGOS_API_BASE`). Saving goes through the per-instance store (ADR 0269), so other projects' sign-ins are kept.
 
 ## Constraints
 
-- **The token briefly transits the chat — that's the known cost of guided-paste.** The user pastes `bongos paste-token <token>` into the conversation, so the bearer appears in the chat (and any log/context that captures it). That's the accepted trade-off Lars chose; the deferred zero-paste loopback flow removes it. So: treat the session log as sensitive, **never echo the token beyond running that one pasted command**, and never write it to any file other than `~/.config/otb/gds-session.json` (`paste-token.js` is the only thing that should write it — let it do the write). The token rotates whenever the builder clicks Re-issue again, so re-running this flow invalidates an exposed paste's usefulness for an attacker who lacks the browser cookie.
-- **Don't re-auth a valid session.** If `reauth.js` exits 0, stop.
-- **`GDS_API_BASE`** overrides the endpoint (default `https://example.com`); for local dev `GDS_API_BASE=http://localhost:3000`.
+- **Don't re-sign-in a working session.** If the helper says the sign-in is working, stop.
+- **Never ask for or accept a token in chat** on the one-click path — there is none to handle. Only the fallback carries one.
+- **`BONGOS_API_BASE`** overrides the instance (for local dev `BONGOS_API_BASE=http://localhost:3000`).
 
 ## Files this skill touches
 
-- Runs: `node scripts/bongos/reauth.js` (detect + open browser + print click-path)
-- Runs: `bongos paste-token <token>` (verify + write the new session)
-- Reads/Writes (via paste-token.js): `~/.config/otb/gds-session.json`
-- Calls: `GET /api/bongos/me`; the Settings page (CLI Access) calls `POST /api/bongos/auth/cli-token/issue`
+- Runs: `node scripts/bongos/reauth.js` (detect, browser approval, save) — `--paste` for the fallback
+- Runs (fallback only): `bongos paste-token <token>`
+- Writes (via `saveSession`): the active session file and the per-instance store under `~/.config/cloudbongos/`
+- Calls: `GET /api/bongos/me`, `POST /api/bongos/auth/device/start` + `/auth/device/poll`; the browser page is `/api/bongos/auth/device`

package/clients/bongos-client/index.d.ts

@@ -322,6 +322,7 @@ export interface PostAuthDeviceApproveRequest { user_code: string; decision: "ap
 export interface PostAuthDeviceExchangeRequest { assertion: string }
 export interface PostAuthDeviceExchangeResponse { token: unknown; builder: unknown }
 export interface PostAuthDevicePollRequest { device_code: string }
+export interface PostAuthDeviceStartRequest { approve_in_browser?: boolean }
 export interface PostAuthDiscordUnlinkResponse { ok: boolean; unlinked: unknown }
 export interface PostAuthLogoutResponse { ok: boolean }
 export interface PostAuthRevokeAllRequest { builder_id?: StringifiableId }
@@ -839,7 +840,7 @@ export interface BongosClient {
     /** POST /auth/device/poll — rank: public */
     postAuthDevicePoll(args: RequestArgs & { body: PostAuthDevicePollRequest }): Promise<ApiResponse>;
     /** POST /auth/device/start — rank: public */
-    postAuthDeviceStart(args?: RequestArgs): Promise<ApiResponse>;
+    postAuthDeviceStart(args?: RequestArgs & { body?: PostAuthDeviceStartRequest }): Promise<ApiResponse>;
     /** GET /auth/discord/callback — rank: any-builder */
     getAuthDiscordCallback(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /auth/discord/start — rank: any-builder */

package/docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md

@@ -58,3 +58,11 @@ Credits, ranks and community pages needed no change: the hub's check-in and roll
 - **Removing.** Never the last way in. And never GitHub from an account born with it: that account's key is its GitHub id, so a GitHub sign-in would still reach it and the removal would be a lie. A person who joined with Google may remove a linked GitHub, and then shows their stand-in again from their next sign-in.
 - **Every GitHub sign-in on the hub finds the person first** (the ADR 0393 carry-over, closed): the web and device sign-ins ask the hub who the GitHub id reaches and use that key. A project's command-line sign-in (`/sso/device/poll`) cannot tell whether the project takes a minted key, so for a GitHub account linked to someone who joined with Google it says to sign in in the browser.
 - **Matching emails suggest, never join.** This amends decision 3's "emails are never looked up" in one place only: on a first Google sign-in, if another account's GitHub way in shows the address Google verified, the person is offered "Sign in with GitHub" (then link Google from the account page) or "Make a new account with Google". Only the provider's name crosses; no account is named or joined. The hub keeps the GitHub address it sees at sign-in (GitHub's public address) for this alone.
+
+## Amendment — every re-sign-in is approved in the browser (task 1005118)
+
+Decision 6 sent the terminal to the approval page only where Google is offered. A returning builder whose CLI session was revoked then had a four-step way back on every other instance: Settings → Re-issue CLI token → Copy → paste a `bongos paste-token <token>` line into the chat, which put a live bearer in the chat history.
+
+So `/auth/device/start` now also answers with the approval page when the CLI asks for it (`{ "approve_in_browser": true }`), Google or not, and `scripts/bongos/reauth.js` asks. The browser is usually already signed in, so the way back is one Approve click and the token never leaves the server-to-terminal poll. On a GitHub-only instance the page's sign-in step offers GitHub alone.
+
+A plain start is unchanged: a first sign-in on a GitHub-only instance keeps GitHub's device flow, because its `not_approved` answer is what `bongos login` turns into an access request. An older instance ignores the ask and answers GitHub's flow, which the CLI runs as before. The paste path stays as the fallback for a machine with no browser (`reauth.js --paste`).

package/docs/api/openapi.json

@@ -2040,12 +2040,23 @@
         "description": "/auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/auth.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAuthDeviceStartRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
         "responses": {
           "200": {
             "description": "Success."
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
           }
         },
         "security": []
@@ -36584,6 +36595,15 @@
         ],
         "additionalProperties": false
       },
+      "PostAuthDeviceStartRequest": {
+        "type": "object",
+        "properties": {
+          "approve_in_browser": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
       "PostAuthDiscordUnlinkResponse": {
         "type": "object",
         "properties": {
@@ -43542,7 +43562,7 @@
     }
   },
   "x-endpoint-count": 696,
-  "x-schema-count": 730,
+  "x-schema-count": 731,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 462,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"

package/docs/api-reference.md

@@ -88,7 +88,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/auth/device/approve` | `any-builder` | `user_code`, `decision` | (own identity only) — mints a CLI session for the signed-in person themselves, from their browser cookie, never from a bearer (the /auth/… |
 | POST | `/api/bongos/auth/device/exchange` | `public` | `assertion` | POST /auth/device/exchange — CLI federation (ADR 0141 §1). |
 | POST | `/api/bongos/auth/device/poll` | `public` | `device_code` | auth flow; the device code itself is the bearer. |
-| POST | `/api/bongos/auth/device/start` | `public` | — | /auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization. |
+| POST | `/api/bongos/auth/device/start` | `public` | `approve_in_browser` | /auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization. |
 | GET | `/api/bongos/auth/discord/callback` | `any-builder` | — | completes the link to the caller's own identity. |
 | GET | `/api/bongos/auth/discord/start` | `any-builder` | — | /auth/discord — account-linking OAuth (Phase 3 F2, ADR 0033 §2). |
 | POST | `/api/bongos/auth/discord/unlink` | `any-builder` | — | unlink your OWN Discord. |

package/docs/copy-inventory.md

@@ -316,9 +316,9 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4df46e2be815` | certain | Clear the key? | `modules/hall-ui/public/market-watch-settings.js:218` |
 | `593dda3178eb` | certain | Click to copy | `modules/hall-ui/public/copy-on-click.js:137` |
 | `34624d39ff29` | certain | Clone the project to your machine and run | `modules/hall-ui/public/setup-gate.js:34` |
-| `3a426bad2c49` | certain | Close actions | `modules/hall-ui/public/visor.js:222` |
+| `3a426bad2c49` | certain | Close actions | `modules/hall-ui/public/visor.js:232` |
 | `70f6a704d504` | certain | Close it | `modules/hall-ui/public/copy-desk.html:140` |
-| `053e576ba9a3` | certain | Close options | `modules/hall-ui/public/shell-game.js:453` |
+| `053e576ba9a3` | certain | Close options | `modules/hall-ui/public/shell-game.js:454` |
 | `d12a2fb5730d` | certain | Close this flag | `modules/hall-ui/public/copy-desk.html:116` |
 | `9b9c2abeae90` | certain | Close this stage | `modules/hall-ui/public/genesis-home.js:220` |
 | `e6f1842afde1` | certain | Close transcript | `modules/hall-ui/public/watch.html:222` |
@@ -603,7 +603,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `6dd3c797943b` | certain | How Claude should engage you in it | `modules/hall-ui/public/speciality-tools.js:614` |
 | `d50901b479f6` | certain | How Claude talks to you, wandering, session cards and your specialities are set on | `modules/hall-ui/public/settings.html:304` |
 | `5c442fe0f174` | certain | How do you want to pay? | `modules/hall-ui/public/ai-studio.js:351` |
-| `1e8da0baf421` | certain | How do you want to see it? | `modules/hall-ui/public/shell-game.js:164` |
+| `1e8da0baf421` | certain | How do you want to see it? | `modules/hall-ui/public/shell-game.js:165` |
 | `0bab9286ea38` | certain | How each builder's shipped work has been graded over the past thirty days. | `modules/hall-ui/public/watch.html:75` |
 | `fb7489e8b67c` | certain | How it has changed | `modules/hall-ui/public/government.js:1017` |
 | `1afadcefd6ea` | certain | How many passes | `modules/hall-ui/public/genesis-home.js:116` |
@@ -699,7 +699,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `7d6eaa8d4514` | certain | Kinds of work shipped | `modules/hall-ui/public/profile-own.js:366` |
 | `81f62e066dbf` | certain | Last 14 days: {…} / 10 average across {…} graded work{…} ({…} passed). | `modules/hall-ui/public/profile-own.js:186` |
 | `13bae4dfb28e` | certain | Last claimed by | `modules/hall-ui/public/task.js:694` |
-| `352e1a9eb78e` | certain | Last time | `modules/hall-ui/public/shell-game.js:146` |
+| `352e1a9eb78e` | certain | Last time | `modules/hall-ui/public/shell-game.js:147` |
 | `165c5f26ef60` | certain | Last try | `modules/hall-ui/public/money.js:90` |
 | `9e8828d602bc` | certain | Lay your thoughts over the project map. | `modules/hall-ui/public/goal-map.html:76` |
 | `0f467c1359d7` | certain | Leaderboard place | `modules/hall-ui/public/hall-render.js:470` |
@@ -1410,7 +1410,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `74bc22f38140` | certain | The platform confirmed this request came from the account it names. | `modules/hall-ui/public/watch.js:411` |
 | `6c3d88de42de` | certain | The primer | `modules/hall-ui/public/primer.html:37` |
 | `dea378cd4837` | certain | The primer did not load | `modules/hall-ui/public/primer.html:83` |
-| `08ec02eb31fb` | certain | The project city building up, week by week | `modules/hall-ui/public/shell-game.js:180` |
+| `08ec02eb31fb` | certain | The project city building up, week by week | `modules/hall-ui/public/shell-game.js:181` |
 | `ca10fbab561e` | certain | The project this week | `modules/hall-ui/public/home-city.js:324` |
 | `dc2d6fd0350a` | certain | The project’s life so far | `modules/hall-ui/public/genesis-home.js:156` |
 | `169a03d777a1` | certain | The rank above yours is {…}. | `modules/hall-ui/public/profile-own.js:101` |
@@ -1486,7 +1486,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:237` |
 | `e7a289134dc3` | certain | This page shows no words the reader could find. | `modules/hall-ui/public/tweak-editor.js:246` |
 | `d4b3b5556986` | certain | This page's reference docs | `modules/hall-ui/public/page-notes.js:166` |
-| `79e4a934b434` | certain | This place | `modules/hall-ui/public/visor.js:224` |
+| `79e4a934b434` | certain | This place | `modules/hall-ui/public/visor.js:234` |
 | `5bdcbec770dd` | certain | This project has no slash commands yet. | `modules/hall-ui/public/commands.js:37` |
 | `f53b83bfbe54` | certain | This project has no watch rules yet. | `modules/hall-ui/public/market-watch-rules.js:62` |
 | `e97b2d549f10` | certain | This project is hosted on {…}, and that is where it is taken offline or removed. Both links below open this pr | `modules/hall-ui/public/project-settings.js:412` |
@@ -1689,7 +1689,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `beba7e576ea8` | certain | Your agents | `modules/hall-ui/public/settings.html:303` |
 | `7d26333b5fb0` | certain | Your asks | `modules/hall-ui/public/collab.html:79` |
 | `2e699f8709b5` | certain | Your balance is under {…}. | `modules/hall-ui/public/ai-studio.js:348` |
-| `a1f290d92800` | certain | Your browser kept this tab open. Close it to quit. | `modules/hall-ui/public/shell-game.js:294` |
+| `a1f290d92800` | certain | Your browser kept this tab open. Close it to quit. | `modules/hall-ui/public/shell-game.js:295` |
 | `3812b4d8106f` | certain | Your changes to this page | `modules/hall-ui/public/paintbrush.js:150` |
 | `7e5697ffbfc4` | certain | Your character | `modules/hall-ui/public/craft-mode.js:660` |
 | `791f72bb7b35` | certain | Your character could not be saved. Reload and try again. | `modules/hall-ui/public/craft-mode.js:928` |

package/docs/copy-registry.json

@@ -5208,7 +5208,7 @@
       "surface": "builders-hall",
       "text": "Close actions",
       "file": "modules/hall-ui/public/visor.js",
-      "line": 222,
+      "line": 232,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5226,7 +5226,7 @@
       "surface": "builders-hall",
       "text": "Close options",
       "file": "modules/hall-ui/public/shell-game.js",
-      "line": 453,
+      "line": 454,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7791,7 +7791,7 @@
       "surface": "builders-hall",
       "text": "How do you want to see it?",
       "file": "modules/hall-ui/public/shell-game.js",
-      "line": 164,
+      "line": 165,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8655,7 +8655,7 @@
       "surface": "builders-hall",
       "text": "Last time",
       "file": "modules/hall-ui/public/shell-game.js",
-      "line": 146,
+      "line": 147,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15054,7 +15054,7 @@
       "surface": "builders-hall",
       "text": "The project city building up, week by week",
       "file": "modules/hall-ui/public/shell-game.js",
-      "line": 180,
+      "line": 181,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15738,7 +15738,7 @@
       "surface": "builders-hall",
       "text": "This place",
       "file": "modules/hall-ui/public/visor.js",
-      "line": 224,
+      "line": 234,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -17565,7 +17565,7 @@
       "surface": "builders-hall",
       "text": "Your browser kept this tab open. Close it to quit.",
       "file": "modules/hall-ui/public/shell-game.js",
-      "line": 294,
+      "line": 295,
       "origin": "js-text-assign",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3430,5 +3430,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.88 with no explicit bump. run 43213545598. (task 1002620)
   1.24.90 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.89 with no explicit bump. run 43217068783. (task 1002620)
+  1.24.92 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.90 with no explicit bump. run 43296447627. (task 1002620)
 ---------------------------------------------------------------------------
 ```