@bongos/core 1.24.91 → 1.24.92

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.91",
-  "core_contract": "1.24.91",
-  "source_commit": "a22021565f291899e091258dc39071e4b3261e2e",
+  "core_version": "1.24.92",
+  "core_contract": "1.24.92",
+  "source_commit": "5c483e2ab47fc0cca7356e60e6cc00e055dba066",
   "source_ref": "HEAD",
-  "built_at": "2026-11-12T12:41:58.407Z",
+  "built_at": "2026-11-12T20:04:52.110Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 650,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3964,
+    "functional_verbatim": 3965,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4647,
-  "tree_sha256": "195792ff38f7ebbfcfcb39423492588ebbf36563eccdbadb90f4207164f06fad",
+  "file_count": 4648,
+  "tree_sha256": "4efb5396f6e0daf17115f129bef70f7f252a5ba802e08886aa949d036aab5353",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -82,7 +82,7 @@
     {
       "path": ".claude/skills/builder-reauth/SKILL.md",
       "mode": "0000644",
-      "sha256": "87914427956d7dd7d947e56fc3aaa0029c53aae738469470782ed7b3b397c8fc"
+      "sha256": "66a2755314dbf7e4ede87854b8a47730f0603196ab79498f85b5a8ba175e155d"
     },
     {
       "path": ".claude/skills/builder-redteam/SKILL.md",
@@ -352,7 +352,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "f9f0e9f4f0d7f87abffa4d19cd4a25d4ab1d9bd6403c50e739acd37383aa2db9"
+      "sha256": "61118835fbddfe0f7a64113ccc4b9e2f79ea095b4c7bef0b079250a83871f652"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2442,7 +2442,7 @@
     {
       "path": "docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md",
       "mode": "0000644",
-      "sha256": "7c13a3f082ab91435a181f8b197f1e46708cc1b24a9ad80463c74f3726280d70"
+      "sha256": "fc77036762aa8daa9820f22f0d75dfaa63c1de282efe9124cfbc31fdc2d45cf7"
     },
     {
       "path": "docs/adr/0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md",
@@ -2487,12 +2487,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "65f7628372fca1bb6fd5feb7199e68fddac624f3d8541a77ebd5828b7fdf0a9a"
+      "sha256": "dd3ab48cc4735ba7af87f656b299ede977c38623318350b6b32191538c6f8b52"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "335d23581fe7d06ff91aa155b70edb69c0195c46a49aaa8959db0d707b4abf19"
+      "sha256": "8004732e03a7d1cead9cba35155c8336015e23f509fcd2b1ef13fbf887a549ec"
     },
     {
       "path": "docs/architecture.md",
@@ -2517,12 +2517,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "290386a7922531e1b30de4adcd4fb541880a94b3ff7db78d72ac10f6bcff314b"
+      "sha256": "daec3c74bc27e603c5ded55ed72be5e4c82cd31efc5b9363a7755eb91b97f56c"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "611c4618f066d69b80124ad51138927337aa64401fe566eddbd5f2f7f329591d"
+      "sha256": "2a1347d59793c3b152b0179523fbcff57a5edacb3ac043bfad321d50d38f7bc4"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -3037,7 +3037,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "cd252fd841709bd269f9925c659e02876523dbf626959f4e3bd3feb1c88745d4"
+      "sha256": "88e6ca24e358d295f74a7dd741f610062d3f44043b617d5a06c83f55164090d7"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3122,7 +3122,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "e793384169510479355b6d08b5d937d3d3b907a244c37bb2af6f03d1615d57bb"
+      "sha256": "46fa6c491c705c13c961d1efbe3453ca2afd1d56f0b230f6024435f6b605f072"
     },
     {
       "path": "docs/project-context.template.md",
@@ -6222,7 +6222,7 @@
     {
       "path": "modules/hall-ui/public/city.css",
       "mode": "0000644",
-      "sha256": "33056c156e2ec8a8ad008c1e268b82e7445f3e1471e79e572c3054cfdf56d474"
+      "sha256": "4696bb120ec74640555ad747711986e96dea49c658e782f77f1042b9f70a0ecd"
     },
     {
       "path": "modules/hall-ui/public/city.html",
@@ -6232,7 +6232,7 @@
     {
       "path": "modules/hall-ui/public/city.js",
       "mode": "0000644",
-      "sha256": "e0800a150b163e23a233dbf0fd05a67fdf7af0eff71d2f5b519d74ebc4d347af"
+      "sha256": "3ad52ec95501913a0a4bbb8378c33e3e1f8459d4b233b96c88db012d1f68a66b"
     },
     {
       "path": "modules/hall-ui/public/city.states.json",
@@ -7442,7 +7442,7 @@
     {
       "path": "modules/hall-ui/public/visor.js",
       "mode": "0000644",
-      "sha256": "7c3dec2c81435516e15a35d4245557215c84d809f76ac9b49f95529a935518ec"
+      "sha256": "862ab2d430e0fc42bed3e757af5a07e672022803f098c3acc7582a62592f5ac1"
     },
     {
       "path": "modules/hall-ui/public/vote-control.js",
@@ -7752,7 +7752,7 @@
     {
       "path": "modules/hall-ui/records/visor.md",
       "mode": "0000644",
-      "sha256": "515c6e31880265d11477e723fd0307d49409b6c04d5e53aa6579ef809c88269b"
+      "sha256": "a8d42170b6a0b27e8f75f3866c936c72f06c35a8ef44ae2bc7d034c213736d26"
     },
     {
       "path": "modules/hall-ui/records/welcome-tower.md",
@@ -12102,12 +12102,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ab7441e6cc38edc40acce9d7090d25016f42420246eaf6ed7e2f37eab0200024"
+      "sha256": "0991d22207637a766189c9d741ee4e8c166d315554259886978355b181da37be"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eb582572ac4dd9fa60fe3275a450b9aa4599edc45600a1f8bf066e15d9a341b3"
+      "sha256": "1de1dbdb758d263abd1d822870f785231ec5f9dae3e115345741911f5c325a17"
     },
     {
       "path": "public-docs/index.html",
@@ -12127,7 +12127,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "c44e40bf773cc25fdb58b9bae2081fb6fa18132e915649a6acf05a18a74412d6"
+      "sha256": "28d81c1f519f6dcfdf35231190bf317d97a1920e15930f92a98fafcc20e47027"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12417,7 +12417,7 @@
     {
       "path": "scripts/bongos/cli-lib.js",
       "mode": "0000644",
-      "sha256": "7f00d2ce761ee775341e21cce68e64b8346f2f2c4bcd5cd41b16b9e8404f926e"
+      "sha256": "49a35fbc1523b75e922ed79ff473e833a8cae915d46d36981b8993eb522571be"
     },
     {
       "path": "scripts/bongos/client-baseurl-guard.js",
@@ -12937,7 +12937,7 @@
     {
       "path": "scripts/bongos/login.js",
       "mode": "0000644",
-      "sha256": "0a13005b8a73dd31b46bdb6f7762f483654e85e060f37eb8e78d9a6088f7245c"
+      "sha256": "c6e9232bae6700d8e4bebfd11796b00ee850ae78da5ae689dcc109366bb46600"
     },
     {
       "path": "scripts/bongos/main-audit.js",
@@ -13127,7 +13127,7 @@
     {
       "path": "scripts/bongos/plain-cards.js",
       "mode": "0000644",
-      "sha256": "2fc62830cab07c3536eeb531429de39b1726657e5fd6862b9bf3b6d76e93e56d"
+      "sha256": "755fdb4f7596c114a888fbdaf540e82bccd184b6ae7b4bf01d8163b3f0b9ed0e"
     },
     {
       "path": "scripts/bongos/portability-smoke-art.sh",
@@ -13292,7 +13292,7 @@
     {
       "path": "scripts/bongos/reauth.js",
       "mode": "0000644",
-      "sha256": "2e790186eebf403037e61a499bd865a9ebdfb8fe6e9958d95a4cd078f7b521fa"
+      "sha256": "5d62a84e7f2e35ab6fa37c5fd7b37bd9baf48b7bc984591a01c8850665746f88"
     },
     {
       "path": "scripts/bongos/recall.js",
@@ -15912,7 +15912,7 @@
     {
       "path": "src/bongos/routes/auth-google.js",
       "mode": "0000644",
-      "sha256": "f7531eefb5d958f4924aff1e0e1bf8bf258f82cc676d7bdb0f26e6235a181ae4"
+      "sha256": "7d42cf2a68ebf6d852cc63fdfb8774867221b880025669d5f9a29ac20f26bd9d"
     },
     {
       "path": "src/bongos/routes/auth-link.js",
@@ -15922,7 +15922,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "5dac69f518fb0933f111d3df4dfc400e1573ffd2849abe7599ed16bd0ab63d58"
+      "sha256": "438f7feeb87eb85b4aaca2bf20e0304d95822a8e77c92f9c2a042a90dd0bb03d"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -16062,7 +16062,7 @@
     {
       "path": "src/bongos/sign-in-pages.js",
       "mode": "0000644",
-      "sha256": "cfd8a09da90e8f2a176e94c960736bbb295c216a1d6bf1f8027f7f0ce1ceacc8"
+      "sha256": "8f93a2b576e4f2b2bdaf8feec2a8c6c4b23f31be4c071f119a4ca56f39e5fa6c"
     },
     {
       "path": "src/bongos/software-update.js",
@@ -16132,7 +16132,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "95d86d1e9db626680711ac8e0f79e6458c5e20b0af7343640c6cf0d4e5e6cadd"
+      "sha256": "d01b0c8ee350427a447cb9f10713e5abbf76d49f57702e7dee8942a8c2de39e1"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -17174,6 +17174,11 @@
       "mode": "0000644",
       "sha256": "79c57041a871f9700682ac96cebf5d07fe393cc274b5549e8659cad34f44cee1"
     },
+    {
+      "path": "tests/cli_reauth_browser.mjs",
+      "mode": "0000644",
+      "sha256": "758964ef9d4d5d1921162aab1e86a4fb07fe7347aca5866391c8dd33ce67d94d"
+    },
     {
       "path": "tests/cli_sessions.mjs",
       "mode": "0000644",
@@ -19027,7 +19032,7 @@
     {
       "path": "tests/hall_city.mjs",
       "mode": "0000644",
-      "sha256": "781ad77857a1c04165bdd98d033a0776f036feff0752a49b033a4a1bc8179f13"
+      "sha256": "5483169cd2c06f4782662148aa8bd7381db888c6c2052f63b92582d8c80677ac"
     },
     {
       "path": "tests/hall_city_card_words.mjs",
@@ -19037,7 +19042,7 @@
     {
       "path": "tests/hall_city_living.mjs",
       "mode": "0000644",
-      "sha256": "1b6744e38a44f486978a1f3ecf275fa260a6d79b0779242fdd4827980b14593d"
+      "sha256": "a8d7ef26e5f647dac6fb03d3759968585ef0146a03de6c8e2897c0943c6db1ee"
     },
     {
       "path": "tests/hall_city_rewording.mjs",
@@ -19387,7 +19392,7 @@
     {
       "path": "tests/hall_visor.mjs",
       "mode": "0000644",
-      "sha256": "055de4ac3afe4e7883be6cb462e00879bafc4c7593186ae7d728dbd5ee13f6f6"
+      "sha256": "059033debd304e748ec9b79b127ff3c188b474d7e81570c8cbe8dea9a8cec1b6"
     },
     {
       "path": "tests/hall_work_history_id.mjs",

package/.claude/skills/builder-reauth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: builder-reauth
 description: >-
-  Refresh an expired Bongos CLI session, UI-first. Triggers: "/builder-reauth", "re-auth", "refresh my session", "my Bongos session expired", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
+  Sign the CLI back in with one browser click. Triggers: "/builder-reauth", "re-auth", "sign me back in", "refresh my session", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
 plain: >-
   Signs your assistant back in when its sign-in to the project has expired.
 reach-for: >-
@@ -10,7 +10,7 @@ cost: >-
   Free. It replaces your saved sign-in and changes nothing else.
 ---
 
-You are refreshing the current builder's Bongos CLI session. CLI bearer tokens **do not expire** — since [ADR 0294](../../../docs/adr/0294-cli-sessions-do-not-expire.md) a session lasts until it is revoked. So a rejected token means something killed it: the builder (or an Archon) revoked it, a demotion swept it, or an auth-changing deploy invalidated it. This skill is the **fast path back in**: browser clicks plus a single copy/paste, instead of the slower terminal Device Flow.
+You are signing the current builder's command line back in to Bongos. CLI sessions **do not expire** — since [ADR 0294](../../../docs/adr/0294-cli-sessions-do-not-expire.md) a session lasts until it is revoked. So a rejected session means something killed it: the builder (or an Archon) revoked it, a demotion swept it, or an auth-changing deploy invalidated it. This skill gets them back in with **one Approve click in their browser** — nothing to copy, nothing to paste, and the token never passes through the chat (task 1005118).
 
 ## Why there is no expiry (so you can explain it if asked)
 
@@ -18,42 +18,40 @@ There used to be a 24h idle TTL, for auth-token hygiene (GDS-V3 criterion **C9**
 
 What actually bounds a leaked token is **revocation**, and it is faster than any clock: the builder kills it themselves from Settings → Active sessions or "Sign out everywhere" ([ADR 0206](../../../docs/adr/0206-own-scoped-session-revocation-no-absolute-ceiling.md)). Rank changes were never the TTL's job either — demotion calls `revokeAllSessionsForBuilder` synchronously and rank is read fresh from the DB on every request ([ADR 0016](../../../docs/adr/0016-trust-boundary-server-enforced-permissions.md)).
 
-## The flow (guided paste)
+## The flow (one click)
 
-1. **Detect.** Run the helper — it checks whether the existing session is still valid and, if not, opens the hall:
+1. **Say what is about to happen, in one line**, before running anything: a page will open in their browser; they check the code and click **Approve**, and you carry on by yourself.
+
+2. **Run the helper with a long timeout** — it waits for the click (up to ten minutes):
    ```bash
    node scripts/bongos/reauth.js
    ```
-   - **Exit 0** → the session is already valid. Relay who they're signed in as and stop — there is nothing to do. Do NOT re-auth a working session.
-   - **Exit 10** → re-auth is needed. The helper has opened (or printed) the builders' hall URL and the click-path. Continue to step 2.
-   - **Exit 2** → the API was unreachable (network). Relay that, and let them retry once they're back online. The session may be fine.
+   Give the Bash call `timeout: 600000`. The helper checks the current session first; if it is broken it asks the instance for its own approval page (`approve_in_browser`), opens it with the code filled in, waits for the click, and saves the new session itself.
+   - **Exit 0** → signed in. Either the session was already working (say so — do NOT re-sign-in a working session) or the approval just landed. Relay who they are signed in as, then re-run whatever `/builder-*` command they were trying.
+   - **Exit 10** → not signed in: they pressed Cancel, the page ran out, or the account is not let in. The helper says which and prints the fallback below. Offer to run it again once; if that also fails, use the fallback.
+   - **Exit 2** → the instance was unreachable (network). The session may be fine; let them retry once they are back online.
 
-2. **Relay the click-path verbatim.** The helper prints the exact steps; pass them to the user clearly (don't paraphrase the URL):
-   - Open `https://example.com/builders/settings` (the helper tries to open it automatically; if not, give them the link).
-   - They are already signed in there via the browser cookie. Under the **"CLI Access"** section, click **"Re-issue CLI token"**.
-   - Click **"Copy"** — it copies a one-line command of the form `bongos paste-token <token>`.
-   - Ask them to **paste that one line back into the chat**.
+3. **If the page says they are not signed in** in the browser, it shows a **Continue with GitHub** button (and Google where the instance offers it). They sign in there and land straight back on the Approve page — the helper is still waiting.
 
-3. **Run the pasted command.** When the user pastes `bongos paste-token <token>`, run it exactly as given. `paste-token.js` verifies the token against `/api/bongos/me` **before** touching the session file (a bad paste leaves the existing session intact) and preserves any `gemini_api_key`. On success it prints the builder login, rank, and confirms the session file was written.
+## Fallback — the copied line (no browser on this machine)
 
-4. **Confirm.** Relay the authenticated identity + rank back to the user, and tell them they can now re-run whatever `/builder-*` command they were trying.
+Only when the one-click path cannot work — a remote/SSH machine with no browser, or the click path failed twice — run `node scripts/bongos/reauth.js --paste` and relay its click-path: Settings → **CLI Access** → **Re-issue CLI token** → **Copy**, then paste the `bongos paste-token <token>` line back into the chat and run it exactly as given. `paste-token.js` verifies the token before writing and preserves `gemini_api_key`. This path puts the token in the chat, so never echo it beyond running that one command, and never write it anywhere yourself.
 
 ## Edge cases
 
-- **"You are not signed in" / `cookie_required`.** The re-issue endpoint mints CLI bearers from a browser *cookie*, not a bearer — a leaked CLI token can't extend its own life. If the Settings page shows them logged out, they sign in at `https://example.com/builders` first, then return to `/builders/settings` and click Re-issue. Once signed in the button works.
-- **No session file at all (fresh machine).** The helper still guides them to the Settings page; if they've never authed on this machine, the hall sign-in + Settings → CLI Access → Re-issue path still works. The terminal Device Flow (`node scripts/bongos/setup.js`) remains the fallback for a brand-new builder with no browser session anywhere.
-- **Browser can't open automatically** (headless / SSH). The helper prints the URL; relay it so they can open it on whatever machine has their browser, then paste the one-liner back.
-- **Fallback — terminal Device Flow.** If the browser path is unavailable for any reason, `node scripts/bongos/setup.js --force` re-auths via GitHub Device Flow (terminal code entry). Slower and not UI-first; use only when the hall route can't be used.
+- **An instance older than task 1005118** ignores the browser-approval ask and answers GitHub's own device flow: the helper prints a code and opens github.com/login/device. Relay the code; the person types it there and approves. It still finishes by itself.
+- **No session file at all (fresh machine).** The helper runs the same browser approval. A brand-new builder who has never signed in anywhere uses `/builder-setup` instead.
+- **Several projects on one machine.** The helper signs in to the project the active session names (or `BONGOS_API_BASE`). Saving goes through the per-instance store (ADR 0269), so other projects' sign-ins are kept.
 
 ## Constraints
 
-- **The token briefly transits the chat — that's the known cost of guided-paste.** The user pastes `bongos paste-token <token>` into the conversation, so the bearer appears in the chat (and any log/context that captures it). That's the accepted trade-off Lars chose; the deferred zero-paste loopback flow removes it. So: treat the session log as sensitive, **never echo the token beyond running that one pasted command**, and never write it to any file other than `~/.config/otb/gds-session.json` (`paste-token.js` is the only thing that should write it — let it do the write). The token rotates whenever the builder clicks Re-issue again, so re-running this flow invalidates an exposed paste's usefulness for an attacker who lacks the browser cookie.
-- **Don't re-auth a valid session.** If `reauth.js` exits 0, stop.
-- **`GDS_API_BASE`** overrides the endpoint (default `https://example.com`); for local dev `GDS_API_BASE=http://localhost:3000`.
+- **Don't re-sign-in a working session.** If the helper says the sign-in is working, stop.
+- **Never ask for or accept a token in chat** on the one-click path — there is none to handle. Only the fallback carries one.
+- **`BONGOS_API_BASE`** overrides the instance (for local dev `BONGOS_API_BASE=http://localhost:3000`).
 
 ## Files this skill touches
 
-- Runs: `node scripts/bongos/reauth.js` (detect + open browser + print click-path)
-- Runs: `bongos paste-token <token>` (verify + write the new session)
-- Reads/Writes (via paste-token.js): `~/.config/otb/gds-session.json`
-- Calls: `GET /api/bongos/me`; the Settings page (CLI Access) calls `POST /api/bongos/auth/cli-token/issue`
+- Runs: `node scripts/bongos/reauth.js` (detect, browser approval, save) — `--paste` for the fallback
+- Runs (fallback only): `bongos paste-token <token>`
+- Writes (via `saveSession`): the active session file and the per-instance store under `~/.config/cloudbongos/`
+- Calls: `GET /api/bongos/me`, `POST /api/bongos/auth/device/start` + `/auth/device/poll`; the browser page is `/api/bongos/auth/device`

package/clients/bongos-client/index.d.ts

@@ -322,6 +322,7 @@ export interface PostAuthDeviceApproveRequest { user_code: string; decision: "ap
 export interface PostAuthDeviceExchangeRequest { assertion: string }
 export interface PostAuthDeviceExchangeResponse { token: unknown; builder: unknown }
 export interface PostAuthDevicePollRequest { device_code: string }
+export interface PostAuthDeviceStartRequest { approve_in_browser?: boolean }
 export interface PostAuthDiscordUnlinkResponse { ok: boolean; unlinked: unknown }
 export interface PostAuthLogoutResponse { ok: boolean }
 export interface PostAuthRevokeAllRequest { builder_id?: StringifiableId }
@@ -839,7 +840,7 @@ export interface BongosClient {
     /** POST /auth/device/poll — rank: public */
     postAuthDevicePoll(args: RequestArgs & { body: PostAuthDevicePollRequest }): Promise<ApiResponse>;
     /** POST /auth/device/start — rank: public */
-    postAuthDeviceStart(args?: RequestArgs): Promise<ApiResponse>;
+    postAuthDeviceStart(args?: RequestArgs & { body?: PostAuthDeviceStartRequest }): Promise<ApiResponse>;
     /** GET /auth/discord/callback — rank: any-builder */
     getAuthDiscordCallback(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /auth/discord/start — rank: any-builder */

package/docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md

@@ -58,3 +58,11 @@ Credits, ranks and community pages needed no change: the hub's check-in and roll
 - **Removing.** Never the last way in. And never GitHub from an account born with it: that account's key is its GitHub id, so a GitHub sign-in would still reach it and the removal would be a lie. A person who joined with Google may remove a linked GitHub, and then shows their stand-in again from their next sign-in.
 - **Every GitHub sign-in on the hub finds the person first** (the ADR 0393 carry-over, closed): the web and device sign-ins ask the hub who the GitHub id reaches and use that key. A project's command-line sign-in (`/sso/device/poll`) cannot tell whether the project takes a minted key, so for a GitHub account linked to someone who joined with Google it says to sign in in the browser.
 - **Matching emails suggest, never join.** This amends decision 3's "emails are never looked up" in one place only: on a first Google sign-in, if another account's GitHub way in shows the address Google verified, the person is offered "Sign in with GitHub" (then link Google from the account page) or "Make a new account with Google". Only the provider's name crosses; no account is named or joined. The hub keeps the GitHub address it sees at sign-in (GitHub's public address) for this alone.
+
+## Amendment — every re-sign-in is approved in the browser (task 1005118)
+
+Decision 6 sent the terminal to the approval page only where Google is offered. A returning builder whose CLI session was revoked then had a four-step way back on every other instance: Settings → Re-issue CLI token → Copy → paste a `bongos paste-token <token>` line into the chat, which put a live bearer in the chat history.
+
+So `/auth/device/start` now also answers with the approval page when the CLI asks for it (`{ "approve_in_browser": true }`), Google or not, and `scripts/bongos/reauth.js` asks. The browser is usually already signed in, so the way back is one Approve click and the token never leaves the server-to-terminal poll. On a GitHub-only instance the page's sign-in step offers GitHub alone.
+
+A plain start is unchanged: a first sign-in on a GitHub-only instance keeps GitHub's device flow, because its `not_approved` answer is what `bongos login` turns into an access request. An older instance ignores the ask and answers GitHub's flow, which the CLI runs as before. The paste path stays as the fallback for a machine with no browser (`reauth.js --paste`).

package/docs/api/openapi.json

@@ -2040,12 +2040,23 @@
         "description": "/auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/auth.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAuthDeviceStartRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
         "responses": {
           "200": {
             "description": "Success."
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
           }
         },
         "security": []
@@ -36584,6 +36595,15 @@
         ],
         "additionalProperties": false
       },
+      "PostAuthDeviceStartRequest": {
+        "type": "object",
+        "properties": {
+          "approve_in_browser": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
       "PostAuthDiscordUnlinkResponse": {
         "type": "object",
         "properties": {
@@ -43542,7 +43562,7 @@
     }
   },
   "x-endpoint-count": 696,
-  "x-schema-count": 730,
+  "x-schema-count": 731,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 462,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"

package/docs/api-reference.md

@@ -88,7 +88,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/auth/device/approve` | `any-builder` | `user_code`, `decision` | (own identity only) — mints a CLI session for the signed-in person themselves, from their browser cookie, never from a bearer (the /auth/… |
 | POST | `/api/bongos/auth/device/exchange` | `public` | `assertion` | POST /auth/device/exchange — CLI federation (ADR 0141 §1). |
 | POST | `/api/bongos/auth/device/poll` | `public` | `device_code` | auth flow; the device code itself is the bearer. |
-| POST | `/api/bongos/auth/device/start` | `public` | — | /auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization. |
+| POST | `/api/bongos/auth/device/start` | `public` | `approve_in_browser` | /auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization. |
 | GET | `/api/bongos/auth/discord/callback` | `any-builder` | — | completes the link to the caller's own identity. |
 | GET | `/api/bongos/auth/discord/start` | `any-builder` | — | /auth/discord — account-linking OAuth (Phase 3 F2, ADR 0033 §2). |
 | POST | `/api/bongos/auth/discord/unlink` | `any-builder` | — | unlink your OWN Discord. |

package/docs/copy-inventory.md

@@ -316,7 +316,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4df46e2be815` | certain | Clear the key? | `modules/hall-ui/public/market-watch-settings.js:218` |
 | `593dda3178eb` | certain | Click to copy | `modules/hall-ui/public/copy-on-click.js:137` |
 | `34624d39ff29` | certain | Clone the project to your machine and run | `modules/hall-ui/public/setup-gate.js:34` |
-| `3a426bad2c49` | certain | Close actions | `modules/hall-ui/public/visor.js:222` |
+| `3a426bad2c49` | certain | Close actions | `modules/hall-ui/public/visor.js:232` |
 | `70f6a704d504` | certain | Close it | `modules/hall-ui/public/copy-desk.html:140` |
 | `053e576ba9a3` | certain | Close options | `modules/hall-ui/public/shell-game.js:454` |
 | `d12a2fb5730d` | certain | Close this flag | `modules/hall-ui/public/copy-desk.html:116` |
@@ -1486,7 +1486,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:237` |
 | `e7a289134dc3` | certain | This page shows no words the reader could find. | `modules/hall-ui/public/tweak-editor.js:246` |
 | `d4b3b5556986` | certain | This page's reference docs | `modules/hall-ui/public/page-notes.js:166` |
-| `79e4a934b434` | certain | This place | `modules/hall-ui/public/visor.js:224` |
+| `79e4a934b434` | certain | This place | `modules/hall-ui/public/visor.js:234` |
 | `5bdcbec770dd` | certain | This project has no slash commands yet. | `modules/hall-ui/public/commands.js:37` |
 | `f53b83bfbe54` | certain | This project has no watch rules yet. | `modules/hall-ui/public/market-watch-rules.js:62` |
 | `e97b2d549f10` | certain | This project is hosted on {…}, and that is where it is taken offline or removed. Both links below open this pr | `modules/hall-ui/public/project-settings.js:412` |

package/docs/copy-registry.json

@@ -5208,7 +5208,7 @@
       "surface": "builders-hall",
       "text": "Close actions",
       "file": "modules/hall-ui/public/visor.js",
-      "line": 222,
+      "line": 232,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15738,7 +15738,7 @@
       "surface": "builders-hall",
       "text": "This place",
       "file": "modules/hall-ui/public/visor.js",
-      "line": 224,
+      "line": 234,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3430,7 +3430,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.88 with no explicit bump. run 43213545598. (task 1002620)
   1.24.90 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.89 with no explicit bump. run 43217068783. (task 1002620)
-  1.24.91 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.24.90 with no explicit bump. run 43220126363. (task 1002620)
+  1.24.92 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.90 with no explicit bump. run 43296447627. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -283,7 +283,7 @@
       "surface": "builders",
       "title": "The city",
       "states_read": ["city","fullscreen","focus","pins","living","card","card-ask"],
-      "files_hash": "43c2a3f5444895d6",
+      "files_hash": "2b261787034bce4e",
       "reading_hash": "277096d903879a57",
       "counts": {"lines":26,"placed":9,"shared":6,"unplaced":11},
       "omitted": {"data":7},
@@ -613,7 +613,7 @@
       "surface": "builders",
       "title": "The sky",
       "states_read": ["tour","sky","wells","ledger","full","full-back","out"],
-      "files_hash": "ca4e9b0498d510b8",
+      "files_hash": "0e5090070ad1a630",
       "reading_hash": "4a879397a84631e3",
       "counts": {"lines":50,"placed":25,"shared":6,"unplaced":19},
       "omitted": {"data":10},
@@ -954,8 +954,8 @@
       "surface": "builders",
       "title": "Builders' Hall",
       "states_read": ["home","out","founding","genesis","decide","demo"],
-      "files_hash": "0091ac704ef9996f",
-      "reading_hash": "67b29854aad1bffe",
+      "files_hash": "8f04eab06feba493",
+      "reading_hash": "42901560779fc4d1",
       "counts": {"lines":32,"placed":12,"shared":8,"unplaced":12},
       "omitted": {"data":5},
       "notes": ["founding: an action failed (page.focus: Timeout 6000ms exceeded.); read as it stood"],
@@ -977,7 +977,7 @@
         {"key":"L0015","section":"Needs your attention13","text":"Ideas awaiting triage","placement":"placed","file":"modules/hall-ui/public/builders.js","line":320,"string_id":"e181637c5a5e"},
         {"key":"L0016","section":"Needs your attention13","text":"Requires project {…} fix","placement":"unplaced"},
         {"key":"L0017","section":"footer","text":"Sign out","placement":"shared","file":"modules/hall-ui/public/shell.js","line":514,"string_id":"1883ad7f07fc"},
-        {"key":"L0018","section":"Needs your attention13","text":"core 1.24.89","placement":"unplaced"},
+        {"key":"L0018","section":"Needs your attention13","text":"core 1.24.90","placement":"unplaced"},
         {"key":"L0019","section":"Needs your attention13","text":"Skip","placement":"unplaced"},
         {"key":"L0020","section":"Needs your attention13","text":"Built on","placement":"placed","file":"modules/hall-ui/public/welcome-boot.js","line":183,"string_id":"fef59346ffee"},
         {"key":"L0021","section":"Needs your attention13","text":"cloudbongos.com","placement":"unplaced"},
@@ -3159,7 +3159,7 @@
       "surface": "builders",
       "title": "Your thinking",
       "states_read": ["tour","sky","list","simple","full-idea","full","full-list","full-back","out"],
-      "files_hash": "3e3d0ce3f938dfc4",
+      "files_hash": "5b659820f85a7141",
       "reading_hash": "b73f848b46b0f9b8",
       "counts": {"lines":50,"placed":25,"shared":6,"unplaced":19},
       "omitted": {"data":10},

package/modules/hall-ui/public/city.css

@@ -88,8 +88,12 @@ html:has(body[data-page="city"]) { height: 100%; }
    the home above and below measures from the stage instead of the window. */
 .city-main { position: fixed; top: var(--topbar-h, 56px); left: var(--sidebar-w-rail, 64px); right: 0; bottom: 0; max-width: none; margin: 0; contain: layout paint; z-index: 1; }
 html[data-fullscreen="on"] .city-main { top: 0; left: 0; }
-/* tasks 1005148 and 1005195: with the visor up (game mode), the door rises clear of its foot row, whose one button is centred too. */
-html.visor-on .city-door { bottom: 150px; }
+/* tasks 1005148, 1005195 and 1005209: with the visor up (game mode), the door (now its line alone) rises clear of the
+   foot row, whose one button is centred too, even when the key hints wrap onto a second line. */
+html.visor-on .city-door { bottom: 224px; }
+/* task 1005209 (ADR 0403): with the visor up the door's button and the archived links are the
+   visor's (D on the glass, the rest in its Actions sheet), so the scene carries none of its own. */
+html.visor-on .city-start, html.visor-on .city-archived { display: none; }
 @media (max-width: 768px) { .city-main { left: 0; } }
 /* The full-screen switch floats top right over the stage, where the sun/moon
    switch sits; the strip steps in by the button's width so nothing sits under it.