@bongos/core 1.24.91 → 1.24.92

package/modules/hall-ui/public/city.js

@@ -411,6 +411,7 @@
       start.setAttribute('href', model.cta.href);
       start.setAttribute('aria-label', model.cta.aria);
     }
+    if (model.cta) registerScene(model.cta);
     drawPlaque(model.plaque || null);
     if (openKey) renderCard(openKey);
     return model;
@@ -759,6 +760,47 @@
   window.GovCityPage.ready = boot();
   // task 1005148: the Governor City as the visor's scene. No camera until R13, so no movement
   // actions (ADR 0399 §2.2); the card's own keys are listed for the sheet.
-  window.__visorScene = { name: 'city', place: 'Governor city', keys: [{ label: 'On a card: answer', key: '1–9' }, { label: 'On a card: next', key: '← →' }] };
-  if (window.OTBVisor) window.OTBVisor.scene(window.__visorScene);
+  // task 1005209 (ADR 0403): in game mode the city's door and its two archived links are the
+  // visor's. The door is the lead action, on the glass as a key hint with D; the archived
+  // links are in the sheet's "This place" list. city.css takes them off the scene under
+  // html.visor-on; in classic mode they stay where they were and these do nothing new.
+  function doorLabel(cta) { return cta && cta.label ? String(cta.label) : 'start governing'; }
+  function sceneFor(cta) {
+    var label = doorLabel(cta);
+    return {
+      name: 'city', place: 'Governor city',
+      actions: [
+        { label: label.charAt(0).toUpperCase() + label.slice(1), key: 'd', bind: true, lead: true, run: function () {
+          if (window.GovCityDecide && window.GovDeck) openDecide(null);
+          else if (window.location) window.location.hash = '#decide';
+        } },
+      ].concat(archivedActions()),
+      keys: [{ label: 'On a card: answer', key: '1–9' }, { label: 'On a card: next', key: '← →' }],
+    };
+  }
+  // The archived links, read off the page's own line (city.html), so the sheet says and opens
+  // exactly what the line does: "Archived: Street", "Archived: Building Level Views".
+  function archivedActions() {
+    var line = document.querySelector ? document.querySelector('.city-archived') : null;
+    var links = line && line.querySelectorAll ? Array.prototype.slice.call(line.querySelectorAll('a[href]')) : [];
+    return links.map(function (a) {
+      var href = a.getAttribute('href');
+      return { label: 'Archived: ' + a.textContent, run: function () { window.location.assign(href); } };
+    });
+  }
+  // Registered once per door label: draw() calls this on every poll, and only a new label
+  // (a different streak, say) rebuilds the scene and reads the archived links again.
+  // Order matters here: boot() ran above and its first draw() has normally registered
+  // already, with the real door label. sceneLabel deliberately has no initial value, so the
+  // line after this function only registers the fallback when that draw did not register.
+  var sceneLabel;
+  function registerScene(cta) {
+    var label = doorLabel(cta);
+    if (label === sceneLabel) return;
+    sceneLabel = label;
+    var next = sceneFor(cta);
+    window.__visorScene = next;
+    if (window.OTBVisor) window.OTBVisor.scene(next);
+  }
+  if (sceneLabel == null) registerScene(null);
 }());

package/modules/hall-ui/public/visor.js

@@ -133,12 +133,18 @@
   var scene = null;
   // A scene says what it is and, if it has a camera, the actions that move it (ADR 0399
   // §2.2). `keys` are lines for the sheet's "this place" list: keys the scene already binds.
+  // An action's `key` is a key the scene already binds, shown beside it; with `bind: true`
+  // the visor binds it instead (in game mode, after the character's keys), for a scene button
+  // that had no key of its own. `lead: true` puts the action on the glass as the first key
+  // hint (ADR 0403: in game mode the scene's buttons are the visor's; task 1005209).
   function registerScene(s) {
     if (!s || typeof s !== 'object') return;
     scene = {
       name: String(s.name || ''),
       place: String(s.place || ''),
-      actions: (Array.isArray(s.actions) ? s.actions : []).filter(function (a) { return a && a.label && typeof a.run === 'function'; }),
+      actions: (Array.isArray(s.actions) ? s.actions : []).filter(function (a) { return a && a.label && typeof a.run === 'function'; }).map(function (a) {
+        return { label: String(a.label), key: a.key ? String(a.key).toLowerCase() : '', bind: !!a.bind, lead: !!a.lead, run: a.run };
+      }),
       keys: (Array.isArray(s.keys) ? s.keys : []).filter(function (k) { return k && k.label && k.key; }),
     };
     render();
@@ -174,6 +180,10 @@
   function hintHtml(a) {
     return '<a class="visor__hint" data-visor-act="' + esc(a.id) + '" ' + actionAttrs(a) + '>' + keyHtml(a.key) + '<span>' + esc(a.label) + '</span></a>';
   }
+  // The scene's lead action, as the first quiet hint (task 1005209).
+  function placeHintHtml(a, i) {
+    return '<button class="visor__hint visor__hint--place" type="button" data-visor-scene="' + i + '">' + (a.key ? keyHtml(a.key) : '') + '<span>' + esc(a.label) + '</span></button>';
+  }
   function actionAttrs(a) {
     return a.href ? 'href="' + esc(hallHref(a.href)) + '"' : 'href="#" role="button"';
   }
@@ -192,7 +202,7 @@
         '</div>' +
         '<a class="visor__main" data-visor-act="' + esc(main.id) + '" ' + actionAttrs(main) + '>' +
           '<span>' + esc(main.label) + '</span>' + keyHtml(main.key) + '</a>' +
-        '<div class="visor__hints">' + acts.slice(1).map(hintHtml).join('') +
+        '<div class="visor__hints">' + scene.actions.map(function (a, i) { return a.lead ? placeHintHtml(a, i) : ''; }).join('') + acts.slice(1).map(hintHtml).join('') +
           '<button class="visor__hint visor__hint--sheet" type="button" data-visor-sheet aria-expanded="false" aria-controls="visor-sheet">' +
             '<span class="visor__dots" aria-hidden="true"></span>' + keyHtml(SHEET_KEY) + '<span>Actions</span></button>' +
           '<a class="visor__hint visor__hint--options" href="' + esc(hallHref('/settings')) + '">' + keyHtml('Esc') + '<span>Options</span></a>' +
@@ -297,6 +307,7 @@
   // ---------- running an action ----------
   function run(a) {
     if (!a) return;
+    if (typeof a.run === 'function') { a.run(); return; }
     if (a.tool) {
       var C = craft();
       if (C && typeof C.openTool === 'function') C.openTool(a.tool);
@@ -342,11 +353,15 @@
     if (k === SHEET_KEY) return 'sheet';
     var acts = actionsFor(id);
     for (var i = 0; i < acts.length; i++) if (acts[i].key === k) return acts[i];
+    // then the keys the visor binds for the place (task 1005209); the character's win a clash
+    var own = scene ? scene.actions : [];
+    for (var j = 0; j < own.length; j++) if (own[j].bind && own[j].key === k) return own[j];
     return null;
   }
   // Bubble, on window: a scene or pop-up that used the key has called preventDefault by now.
   function onKey(e) {
-    if (!shown() || inField(e.target) || busy()) return;
+    // The glass is game mode's alone (visor.css); outside it, its keys are not bound either.
+    if (!shown() || document.documentElement.dataset.game !== 'on' || inField(e.target) || busy()) return;
     var hit = keyFor(character(), e);
     if (!hit) return;
     e.preventDefault();

package/modules/hall-ui/records/visor.md

@@ -4,7 +4,13 @@ Covers: `visor.js` + `visor.css`, loaded on Home, `/city`, `/goal-map` and `/thi
 
 ## The rule every game page keeps (ADR 0403, owner 2026-11-11)
 
-The visor is the control and the scene is the view: every main call to action in game mode is on the glass (the accent button, the key hints, the Actions sheet), and a scene carries none of its own. A scene that has something to do registers it with `OTBVisor.scene({ actions, keys })`. ADR 0403 §3 lists the scenes that do not keep it yet.
+The visor is the control and the scene is the view: every main call to action in game mode is on the glass (the accent button, the key hints, the Actions sheet), and a scene carries none of its own. A scene that has something to do registers it with `OTBVisor.scene({ actions, keys })`. ADR 0403 §3 lists the scenes that do not keep it yet; the Governor City keeps it since task 1005209 (below).
+
+## A place's own buttons on the glass (task 1005209, the Governor City first)
+
+- **The scene contract grew two flags.** A scene action's `key` is still a key the scene binds itself, shown beside it in the sheet. With `bind: true` the visor binds that key instead, after the character's keys (a clash goes to the character), for a scene button that had no key of its own. With `lead: true` the action is also the first quiet key hint on the glass (`.visor__hint--place`). Every scene action is still a row under "This place" in the sheet.
+- **The glass binds keys in game mode only.** `onKey` now returns unless `html[data-game="on"]`: the glass was never drawn outside game mode, so its keys no longer act there either (before, a held character's letter keys still ran on a classic page).
+- **The Governor City keeps ADR 0403.** In game mode (`html.visor-on`) the door's button (`#cityStart`) and the archived Street links leave the scene (`city.css`). The door is the lead action, on D, in the door's own words ("Decide 37 in a row", or "Start governing"); it re-registers only when those words change. The archived links are rows in the sheet ("Archived: Street", "Archived: Building Level Views"), read off the page's own archived line so the words and the addresses cannot drift; reached by A and the keyboard. The city line stays on the scene as words, raised to `bottom: 224px` because the extra hint wraps the hints onto a second line at a desk width and the centred accent button rises with it. A building's card is a pop-up, not the scene, and keeps its own buttons and keys. Classic mode is as it was.
 
 ## The minimal visor (Helm look 3, task 1005195)
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.91",
+  "version": "1.24.92",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.91",
+      "version": "1.24.92",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.91",
+  "version": "1.24.92",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11644,7 +11644,15 @@
       "text": "In the game view the Artist's feedback tab no longer sits on the screen; the Artist opens the feedback sheet from the visor, and only the Artist can open it."
     }
   ],
-  "1.24.91": [
+  "1.24.92": [
+    {
+      "id": "1005209",
+      "text": "In game mode the Governor City no longer has a button of its own: \"Decide N in a row\" is now on the visor (press D), and the archived Street links are in the visor's Actions list. Classic mode is unchanged."
+    },
+    {
+      "id": "1005118",
+      "text": "Signing the command line back in is now one Approve click in the browser — no copying, no pasting, and the sign-in key never appears in the chat."
+    },
     {
       "id": "1005206",
       "text": "The screen you land on after signing in, where you pick Game or Classic, now looks like the V3 game start menu: your usual choice is the bright salmon bar with its Enter key, the other a quiet row."

package/scripts/bongos/cli-lib.js

@@ -567,15 +567,16 @@ function printUnauthGuidanceAndExit() {
   console.error('');
   if (isTerminalSurface()) {
     // No checkout here, so `node scripts/bongos/*.js` is not a path this reader has (task 1003730).
-    console.error(`  Recover the fast (UI-first) way — run ${surfaceAction('reauth')}`);
-    console.error('  (opens your Settings page; under "CLI Access" click "Re-issue CLI');
-    console.error('   token", copy the one-liner, paste it back — no terminal Device Flow.)');
+    console.error(`  Sign back in — run ${surfaceAction('reauth')}`);
+    console.error('  (a page opens in your browser: click "Approve" and you are back in.');
+    console.error('   Nothing to copy or paste.)');
     console.error('  Fallback (browser sign-in): npx bongos login <instance-url>');
   } else {
-    console.error('  Recover the fast (UI-first) way — run /builder-reauth, or:');
+    // Task 1005118: one Approve click in the browser. Claude runs it when asked.
+    console.error('  Sign back in — ask Claude to "sign me back in" (/builder-reauth), or run:');
     console.error('    node scripts/bongos/reauth.js');
-    console.error('  (opens your Settings page; under "CLI Access" click "Re-issue CLI');
-    console.error('   token", copy the one-liner, paste it back — no terminal Device Flow.)');
+    console.error('  (a page opens in your browser: click "Approve" and you are back in.');
+    console.error('   Nothing to copy or paste.)');
     console.error('  Fallback (terminal Device Flow): node scripts/bongos/setup.js --force');
   }
   console.error('');

package/scripts/bongos/login.js

@@ -104,14 +104,19 @@ const { sleep } = require('../../src/sleep'); // the one shared sleep (task 1004
 // instance's /auth/device/exchange — a hosted instance has no GitHub app of its own.
 // The instance's OWN admission gate runs at poll (direct) or exchange (federated),
 // so the stranger path is identical for both.
-async function runDeviceFlow(base, { log, idp = null }) {
+// `browser: true` (a returning builder's re-sign-in, task 1005118) asks the
+// instance for its own approval page instead of GitHub's code entry: a browser
+// that is already signed in approves with one click. An older instance ignores
+// the ask and answers GitHub's flow, which this loop runs unchanged.
+async function runDeviceFlow(base, { log, idp = null, browser = false }) {
   const startUrl = idp ? `${idp.origin}/api/bongos/sso/device/start` : `${base}/api/bongos/auth/device/start`;
   const start = await fetchJson(startUrl, {
     method: 'POST',
     // Federated: the hub resolves + binds the client from the USER-TYPED origin
     // (`base`), never a client_id we supply — so this CLI can only ever mint an
     // assertion scoped to the instance the user actually typed (ADR 0141 §1).
-    ...(idp ? { body: JSON.stringify({ origin: base }) } : {}),
+    ...(idp ? { body: JSON.stringify({ origin: base }) }
+      : browser ? { body: JSON.stringify({ approve_in_browser: true }) } : {}),
   });
   // ADR 0116 nests the slug at error.code (task 1003658). This site was half-converted:
   // it read the nested shape for idp_signing_unconfigured but kept a FLAT comparison for
@@ -142,10 +147,16 @@ async function runDeviceFlow(base, { log, idp = null }) {
   const expires = Number(start.data.expires_in) || 900;
 
   log('');
+  // An approval-page link (it carries the code) is longer than the box: print it
+  // whole underneath rather than cut it, so a browser that didn't open can be
+  // pointed at it by hand.
+  const uri = String(verification_uri);
+  const fits = uri.length <= 36;
   log('  ┌────────────────────────────────────────────┐');
-  log(`  │  Open:  ${String(verification_uri).slice(0, 36).padEnd(36)}│`);
+  if (fits) log(`  │  Open:  ${uri.padEnd(36)}│`);
   log(`  │  Code:  ${String(user_code).slice(0, 36).padEnd(36)}│`);
   log('  └────────────────────────────────────────────┘');
+  if (!fits) log(`  Open:  ${uri}`);
   log('');
   openBrowser(verification_uri);
   log('  Waiting for you to approve in the browser…');

package/scripts/bongos/plain-cards.js

@@ -324,7 +324,7 @@ const CARDS = Object.freeze({
     'You, to sign in.', RULE),
   session_invalid: card(
     'Your sign-in to the project has ended.',
-    'I will walk you through signing in again — Settings, then one copy and paste.',
+    'I will open a page in your browser — you click Approve, and that is all.',
     'You, to sign in again.', RULE),
   instance_mismatch: card(
     'This computer is signed in to a different project than the one this folder belongs to.',

package/scripts/bongos/reauth.js

@@ -1,45 +1,42 @@
 #!/usr/bin/env node
-// scripts/bongos/reauth.js — #504.
+// scripts/bongos/reauth.js — #504; one-click since task 1005118.
 //
-// The fast, UI-first path to refresh an expired/invalid GDS CLI session.
-//
-// Why this exists: a CLI session can stop working — revoked from the hall's
-// "Sign out everywhere", swept by a demotion, or invalidated by an auth-changing
-// deploy. (It no longer stops working from mere disuse: ADR 0294 removed the idle
-// expiry, because the timer only ever signed out the legitimate holder while
-// refresh-on-use kept a thief's copy alive.) Whatever killed it, the friction of
-// getting back in — the slow Device Flow, terminal codes, Gemini-key prompts — is
-// not something to keep. This script is the fix:
+// Signs the command line back in when its Bongos session has stopped working —
+// revoked from the hall's "Sign out everywhere", swept by a demotion, or
+// invalidated by an auth-changing deploy. (Never from mere disuse: ADR 0294
+// removed the idle expiry.)
 //
 //   1. Detect — is the current session still valid? (GET /api/bongos/me)
-//        valid   → print who you are + exit 0. Nothing to do.
-//        invalid → exit 10 ("re-auth needed") after opening the browser.
-//   2. Guide — open the builder's Settings page in the default browser (where
-//      the builder is already signed in via the httpOnly cookie) and print the
-//      exact click-path: Settings → CLI Access → Re-issue CLI token → Copy.
-//      The page hands back a one-liner: `bongos paste-token
-//      <token>`. The builder pastes that one line back into Claude; the
-//      /builder-reauth skill runs it (paste-token.js verifies + writes safely).
+//        valid → print who you are + exit 0. Nothing to do.
+//   2. Approve in the browser (task 1005118) — start a sign-in that asks the
+//      instance for its OWN approval page (device-approval.js), open it with the
+//      code filled in, and wait. The builder's browser is already signed in, so
+//      the page is one Approve click; the terminal's poll then receives the new
+//      session and this script saves it. Nothing to copy, nothing to paste, and
+//      the token never passes through the chat.
 //
-// This script never touches the session file itself — paste-token.js owns the
-// write (and its verify-before-write safety contract). reauth.js is detect +
-// open + instruct only, so a failed re-auth can never corrupt a good session.
+// It used to be four steps with a paste: Settings → "Re-issue CLI token" → Copy →
+// paste a `bongos paste-token <token>` line into Claude, which put the token in
+// the chat history. That path stays as the FALLBACK for a machine with no browser
+// to approve from (`--paste` prints it; so does any failure here).
 //
-// Honors Lars's UI-first rule as far as guided-paste allows: browser clicks +
-// a single copy/paste, no Device-Flow code entry. (A true zero-paste loopback
-// flow is a deferred follow-up.)
+// The session is written only after the server handed back a token for a
+// signed-in person, and through saveSession (the per-instance store, ADR 0269),
+// so a failed or cancelled approval never touches the existing session file.
 //
 // Usage:
-//   node scripts/bongos/reauth.js            # detect; if invalid, open Settings + guide
-//   node scripts/bongos/reauth.js --no-open  # detect + guide, but don't open browser
+//   node scripts/bongos/reauth.js            # detect; if invalid, approve in the browser
+//   node scripts/bongos/reauth.js --paste    # detect; if invalid, print the copy-paste path
+//   node scripts/bongos/reauth.js --no-open  # as --paste, without opening the browser
 //
 // Exit codes:
-//   0  — session is valid (no re-auth needed)
-//   10 — re-auth needed (browser opened, instructions printed)
-//   2  — could not reach the API to check (network); guidance still printed
+//   0  — signed in: the session was already valid, or the approval just landed
+//   10 — still not signed in (cancelled, ran out, or not let in); fallback printed
+//   2  — could not reach the instance (network); the session may be fine
 
 const { spawn } = require('node:child_process');
 const lib = require('./cli-lib');
+const { readSessionConfigSync } = require('../../src/instance-config');
 
 // lib.API_BASE is session-aware (task 1002427), so both URLs name the instance the
 // builder is actually signed into — not this checkout's branding default, which is
@@ -85,7 +82,7 @@ function openInBrowser(url) {
 
 function printGuidance({ opened }) {
   console.log('');
-  console.log('Refresh your GDS CLI session (UI-first — no Device Flow):');
+  console.log('Fallback — sign back in with a copied line:');
   console.log('');
   // We can't reliably know if the browser actually launched — spawn() reports
   // a missing-binary error asynchronously, after this prints. So we never claim
@@ -102,19 +99,71 @@ function printGuidance({ opened }) {
   console.log('');
   console.log('  If the page says you are not signed in, sign in at the builders\'');
   console.log(`  hall first (${HALL_URL}), then return to Settings and click Re-issue.`);
-  console.log('  Fallback (terminal Device Flow): node scripts/bongos/setup.js --force');
   console.log('');
 }
 
+// The session to write after an approval: the server's token + builder for THIS
+// instance, with every other field (gemini_api_key et al.) carried over from the
+// existing session when it belongs to the same instance. Pure, so it is tested.
+function nextSession(existing, { token, builder, apiBase }) {
+  const sameInstance = existing && existing.api_base
+    && lib.sessionHostKey(existing.api_base) === lib.sessionHostKey(apiBase);
+  const carried = sameInstance ? existing
+    : (existing && existing.gemini_api_key ? { gemini_api_key: existing.gemini_api_key } : {});
+  return { ...carried, token, builder, api_base: apiBase };
+}
+
+// Approve in the browser, then save. → true when signed back in.
+async function approveInBrowser() {
+  const { runDeviceFlow } = require('./login');
+  console.log('');
+  console.log('Opening a page in your browser to sign the command line back in.');
+  console.log('Check the code matches, then click "Approve" — this carries on by itself.');
+  let out;
+  try {
+    out = await runDeviceFlow(lib.API_BASE, { log: console.log, browser: true });
+  } catch (err) {
+    console.log('');
+    console.log(`The browser sign-in didn't finish: ${err && err.message ? err.message : err}`);
+    return false;
+  }
+  console.log('');
+  if (!out || out.state !== 'ok' || !out.token) {
+    console.log(out && out.state === 'not_approved'
+      ? 'That account is not let in to this project yet — ask its owner.'
+      : 'The sign-in ran out before it was approved. Run this again to get a fresh page.');
+    return false;
+  }
+  let existing = null;
+  try {
+    const raw = readSessionConfigSync();
+    existing = raw ? JSON.parse(raw) : null;
+  } catch (_) { existing = null; }
+  await lib.saveSession(nextSession(existing, { token: out.token, builder: out.builder, apiBase: lib.API_BASE }));
+  const b = out.builder || {};
+  console.log(`✓ Signed back in as ${b.github_login || '?'}${b.rank ? ` (rank: ${b.rank})` : ''}.`);
+  return true;
+}
+
+async function reSignIn({ paste, noOpen }) {
+  if (paste) {
+    printGuidance({ opened: noOpen ? false : openInBrowser(SETTINGS_URL) });
+    process.exit(10);
+  }
+  if (await approveInBrowser()) process.exit(0);
+  printGuidance({ opened: false });
+  process.exit(10);
+}
+
 async function main() {
+  // --no-open (the old flag) means no browser at all, so it is the paste path too.
   const noOpen = process.argv.includes('--no-open');
+  const paste = noOpen || process.argv.includes('--paste');
 
   const session = await lib.loadSession();
   if (!session || !session.token) {
-    console.log('No GDS CLI session found on this machine.');
-    const opened = noOpen ? false : openInBrowser(SETTINGS_URL);
-    printGuidance({ opened });
-    process.exit(10);
+    console.log('No Bongos sign-in found on this machine.');
+    return reSignIn({ paste, noOpen });
   }
 
   // Detect: is the existing token still valid? /me is the canonical check
@@ -126,30 +175,31 @@ async function main() {
     res = await api.me.getMe();
   } catch (err) {
     console.error(`Could not reach ${lib.API_BASE} to check your session: ${err.message}`);
-    const opened = noOpen ? false : openInBrowser(SETTINGS_URL);
-    printGuidance({ opened });
+    console.error('Your sign-in may be fine — try again once you are back online.');
     process.exit(2);
   }
 
   if (res.ok) {
     const b = (res.data && res.data.builder) || {};
-    console.log(`Your GDS CLI session is valid — no re-auth needed.`);
+    console.log('Your Bongos sign-in is working — nothing to do.');
     console.log(`  Signed in as ${b.github_login || '?'}${b.rank ? ` (rank: ${b.rank})` : ''}.`);
-    console.log('  (CLI sessions do not expire — they last until revoked. Kill one from');
+    console.log('  (Sign-ins do not expire — they last until revoked. Kill one from');
     console.log('   Settings → Active sessions, or "Sign out everywhere".)');
     process.exit(0);
   }
 
-  // 401 / 403 / anything not-ok → treat as "needs re-auth".
-  console.log('Your GDS CLI session is no longer valid (expired or revoked).');
-  const opened = noOpen ? false : openInBrowser(SETTINGS_URL);
-  printGuidance({ opened });
-  process.exit(10);
+  // 401 / 403 / anything not-ok → sign back in.
+  console.log('Your Bongos sign-in has stopped working (revoked or replaced).');
+  return reSignIn({ paste, noOpen });
 }
 
-main().catch((err) => {
-  console.error('reauth failed:', err && err.message ? err.message : err);
-  // Still print the manual path so the builder isn't stranded.
-  printGuidance({ opened: false });
-  process.exit(2);
-});
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('reauth failed:', err && err.message ? err.message : err);
+    // Still print the manual path so the builder isn't stranded.
+    printGuidance({ opened: false });
+    process.exit(2);
+  });
+}
+
+module.exports = { nextSession };

package/src/bongos/routes/auth-google.js

@@ -12,8 +12,10 @@
 //   GET  /auth/device           → the page a terminal sends the person to
 //   POST /auth/device/approve   → the signed-in person approves or cancels it
 //
-// Every route answers only where googleConfigured() — the owner's Google app AND
-// the hub that keeps who signs in with it (auth-google.js).
+// The two /auth/google routes answer only where googleConfigured() — the owner's
+// Google app AND the hub that keeps who signs in with it (auth-google.js). The
+// two /auth/device routes answer everywhere: a CLI re-sign-in asks for them on a
+// GitHub-only site too (task 1005118), where the page offers GitHub alone.
 'use strict';
 
 const express = require('express');
@@ -244,7 +246,7 @@ module.exports = function buildAuthGoogleRouter() {
         state: 'signin',
         userCode: pending.userCode,
         githubHref: `${base}/auth/web/start?via=github&return=${encodeURIComponent(here)}`,
-        googleHref: `${base}/auth/google/start?return=${encodeURIComponent(here)}`,
+        googleHref: googleConfigured() ? `${base}/auth/google/start?return=${encodeURIComponent(here)}` : null,
       }));
     }
     return res.type('text/html').send(renderDeviceApprovalPage({

package/src/bongos/routes/auth.js

@@ -603,9 +603,9 @@ module.exports = function buildAuthRouter() {
     if (!auth.authConfigured()) {
       return res.fail('auth_not_configured', { status: 503, message: 'GitHub OAuth App credentials missing on the server. See blockers/blockers.md#github-oauth-app.' });
     }
-    // Google offered here: the terminal is sent to this instance's own approval
-    // page, where the person signs in with GitHub or Google (device-approval.js).
-    if (googleConfigured()) {
+    if (validateOrRespond(req, res, { approve_in_browser: { type: 'boolean' } }, { strict: true })) return;
+    // Google offered, or a re-sign-in asked (task 1005118): this site's own approval page (device-approval.js).
+    if (googleConfigured() || req.body?.approve_in_browser === true) {
       return res.json(startBrowserDeviceFlow({
         pageUrl: `${WEB_REDIRECT_ORIGIN.replace(/\/+$/, '')}${apiBase(req)}/auth/device`,
       }));

package/src/bongos/sign-in-pages.js

@@ -76,8 +76,7 @@ ${bodyHtml}
 function choiceButtons({ githubHref, googleHref }) {
   return `      <div class="signinChoices">
         <a class="landing__btn" href="${escapeHtml(githubHref)}">${GITHUB_MARK}Continue with GitHub</a>
-        <a class="landing__btn" href="${escapeHtml(googleHref)}">${GOOGLE_MARK}Continue with Google</a>
-      </div>`;
+${googleHref ? `        <a class="landing__btn" href="${escapeHtml(googleHref)}">${GOOGLE_MARK}Continue with Google</a>\n` : ''}      </div>`;
 }
 
 // The sign-in chooser /auth/web/start shows when Google sign-in is switched on.

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.91'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.92'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');