@bongos/core 1.24.91 → 1.24.93

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/bongos/package-core.js",
-  "core_version": "1.24.91",
-  "core_contract": "1.24.91",
-  "source_commit": "a22021565f291899e091258dc39071e4b3261e2e",
+  "core_version": "1.24.93",
+  "core_contract": "1.24.93",
+  "source_commit": "8071fd2502f713c6b549097cfd5d79d606f32867",
   "source_ref": "HEAD",
-  "built_at": "2026-11-12T12:41:58.407Z",
+  "built_at": "2026-11-12T20:21:01.886Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 650,
     "agent_docs_stubbed": 32,
-    "functional_verbatim": 3964,
+    "functional_verbatim": 3967,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 4647,
-  "tree_sha256": "195792ff38f7ebbfcfcb39423492588ebbf36563eccdbadb90f4207164f06fad",
+  "file_count": 4650,
+  "tree_sha256": "14cce51acfe462e49a4caaa95f39316299e9da4b7eaad55df49bd1082d03adaf",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -82,7 +82,7 @@
     {
       "path": ".claude/skills/builder-reauth/SKILL.md",
       "mode": "0000644",
-      "sha256": "87914427956d7dd7d947e56fc3aaa0029c53aae738469470782ed7b3b397c8fc"
+      "sha256": "66a2755314dbf7e4ede87854b8a47730f0603196ab79498f85b5a8ba175e155d"
     },
     {
       "path": ".claude/skills/builder-redteam/SKILL.md",
@@ -352,7 +352,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "f9f0e9f4f0d7f87abffa4d19cd4a25d4ab1d9bd6403c50e739acd37383aa2db9"
+      "sha256": "61118835fbddfe0f7a64113ccc4b9e2f79ea095b4c7bef0b079250a83871f652"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -2442,7 +2442,7 @@
     {
       "path": "docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md",
       "mode": "0000644",
-      "sha256": "7c13a3f082ab91435a181f8b197f1e46708cc1b24a9ad80463c74f3726280d70"
+      "sha256": "fc77036762aa8daa9820f22f0d75dfaa63c1de282efe9124cfbc31fdc2d45cf7"
     },
     {
       "path": "docs/adr/0397-the-payment-rail-is-stripe-connect-with-one-connected-account-per-project.md",
@@ -2487,12 +2487,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "65f7628372fca1bb6fd5feb7199e68fddac624f3d8541a77ebd5828b7fdf0a9a"
+      "sha256": "dd3ab48cc4735ba7af87f656b299ede977c38623318350b6b32191538c6f8b52"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "335d23581fe7d06ff91aa155b70edb69c0195c46a49aaa8959db0d707b4abf19"
+      "sha256": "8004732e03a7d1cead9cba35155c8336015e23f509fcd2b1ef13fbf887a549ec"
     },
     {
       "path": "docs/architecture.md",
@@ -2517,12 +2517,12 @@
     {
       "path": "docs/copy-inventory.md",
       "mode": "0000644",
-      "sha256": "290386a7922531e1b30de4adcd4fb541880a94b3ff7db78d72ac10f6bcff314b"
+      "sha256": "4f561c4c13b185d12c1cb4c2dce8d7f4415bf22fd3d9f6969556e21335a1f643"
     },
     {
       "path": "docs/copy-registry.json",
       "mode": "0000644",
-      "sha256": "611c4618f066d69b80124ad51138927337aa64401fe566eddbd5f2f7f329591d"
+      "sha256": "e2fd36ea4e5ba73c38737e07f3ced678d330356bd803cb52ecbb65063e85e457"
     },
     {
       "path": "docs/design/apex-pass-2-direction.md",
@@ -3037,7 +3037,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "cd252fd841709bd269f9925c659e02876523dbf626959f4e3bd3feb1c88745d4"
+      "sha256": "bba6458b2c8742106eabe1e8c4646fb9a5ceea75fba0bb3a375b6ea7a986fc80"
     },
     {
       "path": "docs/modules-contract.md",
@@ -3117,12 +3117,12 @@
     {
       "path": "docs/page-inventory.json",
       "mode": "0000644",
-      "sha256": "2b6eff1405abfb279b3c239a0e71cad3b0801eb4d21a798536443e84ff7d648e"
+      "sha256": "4b063630995768d45aa24d10d484607495ce6732fbf279488bbba89cccb1c17c"
     },
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "e793384169510479355b6d08b5d937d3d3b907a244c37bb2af6f03d1615d57bb"
+      "sha256": "a15df86b33d43c4b42bc9854319497d86b3671ffbda88f765bfe8ed3a9ed6fde"
     },
     {
       "path": "docs/project-context.template.md",
@@ -6222,7 +6222,7 @@
     {
       "path": "modules/hall-ui/public/city.css",
       "mode": "0000644",
-      "sha256": "33056c156e2ec8a8ad008c1e268b82e7445f3e1471e79e572c3054cfdf56d474"
+      "sha256": "4696bb120ec74640555ad747711986e96dea49c658e782f77f1042b9f70a0ecd"
     },
     {
       "path": "modules/hall-ui/public/city.html",
@@ -6232,7 +6232,7 @@
     {
       "path": "modules/hall-ui/public/city.js",
       "mode": "0000644",
-      "sha256": "e0800a150b163e23a233dbf0fd05a67fdf7af0eff71d2f5b519d74ebc4d347af"
+      "sha256": "928ef8c8b5f567195c6892673d61e5a953c80f95f4524de1fe258a68fc926e81"
     },
     {
       "path": "modules/hall-ui/public/city.states.json",
@@ -6517,7 +6517,7 @@
     {
       "path": "modules/hall-ui/public/goal-map.html",
       "mode": "0000644",
-      "sha256": "22bfd6cbf4bfbd6c31611ca8ce2f0160a0ff29ab920280d1c53e43151a33cc14"
+      "sha256": "94be9df5343f593a296586185b4b544640063d8f8bd64c1c10d1061b275c37d0"
     },
     {
       "path": "modules/hall-ui/public/goal-map.states.json",
@@ -7212,7 +7212,7 @@
     {
       "path": "modules/hall-ui/public/sky-interaction.js",
       "mode": "0000644",
-      "sha256": "488a6d7de479e546ad8f263aba7bea767867e22e5eb9897d5531ea032fc82beb"
+      "sha256": "2eae15cb9ec10e0317be9e92670bbaaf21e8157fa53234d1ca458c30c48eec6d"
     },
     {
       "path": "modules/hall-ui/public/sky-layout.js",
@@ -7234,6 +7234,11 @@
       "mode": "0000644",
       "sha256": "8b9b9495eac0febcf56d4e049f1ceeb9cfdc6fc0031c93d99256dc628a95585a"
     },
+    {
+      "path": "modules/hall-ui/public/sky-visor.js",
+      "mode": "0000644",
+      "sha256": "d3b594d333a427fbafb7584be6ceeb965f06d8363bfea322bab61dfbecf8fd3e"
+    },
     {
       "path": "modules/hall-ui/public/speciality-tools.css",
       "mode": "0000644",
@@ -7387,12 +7392,12 @@
     {
       "path": "modules/hall-ui/public/thinking.css",
       "mode": "0000644",
-      "sha256": "99df2ce6bb017b78d0fd4f3f4f4607cecfea3e3a9275aaded09c4a66bdfe5a9f"
+      "sha256": "b0be3e10a3413a833043dc43d568071bc20040e593b2cad52016b5176be5269a"
     },
     {
       "path": "modules/hall-ui/public/thinking.html",
       "mode": "0000644",
-      "sha256": "fa46073d30502efef230a21e48146a044916d487c79e099433917407575fd60a"
+      "sha256": "494e89a7a527be66b61d330047d0c425967f920140bcba6340fa25f51d53f185"
     },
     {
       "path": "modules/hall-ui/public/thinking.states.json",
@@ -7442,7 +7447,7 @@
     {
       "path": "modules/hall-ui/public/visor.js",
       "mode": "0000644",
-      "sha256": "7c3dec2c81435516e15a35d4245557215c84d809f76ac9b49f95529a935518ec"
+      "sha256": "ce6b2a68e041a0e529fed8270405dcd15bb300e1ec5bf1d3c6afbf561ee53936"
     },
     {
       "path": "modules/hall-ui/public/vote-control.js",
@@ -7752,7 +7757,7 @@
     {
       "path": "modules/hall-ui/records/visor.md",
       "mode": "0000644",
-      "sha256": "515c6e31880265d11477e723fd0307d49409b6c04d5e53aa6579ef809c88269b"
+      "sha256": "a1e1421463d9107782c46309339510d6e5c82a38f142ccf35f17fb53effb6c97"
     },
     {
       "path": "modules/hall-ui/records/welcome-tower.md",
@@ -12102,12 +12107,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ab7441e6cc38edc40acce9d7090d25016f42420246eaf6ed7e2f37eab0200024"
+      "sha256": "aca584f965a5191a12f9c0547ed3bc0be72a13f8043b13a2d3a2ec65b08d8632"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "eb582572ac4dd9fa60fe3275a450b9aa4599edc45600a1f8bf066e15d9a341b3"
+      "sha256": "c0cae817310174c3e98cef573263c33c9807c1c8086b050fc13f5f1a18001b4d"
     },
     {
       "path": "public-docs/index.html",
@@ -12127,7 +12132,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "c44e40bf773cc25fdb58b9bae2081fb6fa18132e915649a6acf05a18a74412d6"
+      "sha256": "6aff28036a7071c6895abc1f682477f4cd41b1fe02bf96fad15a7f42c05de7d9"
     },
     {
       "path": "scripts/bongos/CLAUDE.md",
@@ -12417,7 +12422,7 @@
     {
       "path": "scripts/bongos/cli-lib.js",
       "mode": "0000644",
-      "sha256": "7f00d2ce761ee775341e21cce68e64b8346f2f2c4bcd5cd41b16b9e8404f926e"
+      "sha256": "49a35fbc1523b75e922ed79ff473e833a8cae915d46d36981b8993eb522571be"
     },
     {
       "path": "scripts/bongos/client-baseurl-guard.js",
@@ -12937,7 +12942,7 @@
     {
       "path": "scripts/bongos/login.js",
       "mode": "0000644",
-      "sha256": "0a13005b8a73dd31b46bdb6f7762f483654e85e060f37eb8e78d9a6088f7245c"
+      "sha256": "c6e9232bae6700d8e4bebfd11796b00ee850ae78da5ae689dcc109366bb46600"
     },
     {
       "path": "scripts/bongos/main-audit.js",
@@ -13127,7 +13132,7 @@
     {
       "path": "scripts/bongos/plain-cards.js",
       "mode": "0000644",
-      "sha256": "2fc62830cab07c3536eeb531429de39b1726657e5fd6862b9bf3b6d76e93e56d"
+      "sha256": "755fdb4f7596c114a888fbdaf540e82bccd184b6ae7b4bf01d8163b3f0b9ed0e"
     },
     {
       "path": "scripts/bongos/portability-smoke-art.sh",
@@ -13292,7 +13297,7 @@
     {
       "path": "scripts/bongos/reauth.js",
       "mode": "0000644",
-      "sha256": "2e790186eebf403037e61a499bd865a9ebdfb8fe6e9958d95a4cd078f7b521fa"
+      "sha256": "5d62a84e7f2e35ab6fa37c5fd7b37bd9baf48b7bc984591a01c8850665746f88"
     },
     {
       "path": "scripts/bongos/recall.js",
@@ -15912,7 +15917,7 @@
     {
       "path": "src/bongos/routes/auth-google.js",
       "mode": "0000644",
-      "sha256": "f7531eefb5d958f4924aff1e0e1bf8bf258f82cc676d7bdb0f26e6235a181ae4"
+      "sha256": "7d42cf2a68ebf6d852cc63fdfb8774867221b880025669d5f9a29ac20f26bd9d"
     },
     {
       "path": "src/bongos/routes/auth-link.js",
@@ -15922,7 +15927,7 @@
     {
       "path": "src/bongos/routes/auth.js",
       "mode": "0000644",
-      "sha256": "5dac69f518fb0933f111d3df4dfc400e1573ffd2849abe7599ed16bd0ab63d58"
+      "sha256": "438f7feeb87eb85b4aaca2bf20e0304d95822a8e77c92f9c2a042a90dd0bb03d"
     },
     {
       "path": "src/bongos/routes/backup.js",
@@ -16062,7 +16067,7 @@
     {
       "path": "src/bongos/sign-in-pages.js",
       "mode": "0000644",
-      "sha256": "cfd8a09da90e8f2a176e94c960736bbb295c216a1d6bf1f8027f7f0ce1ceacc8"
+      "sha256": "8f93a2b576e4f2b2bdaf8feec2a8c6c4b23f31be4c071f119a4ca56f39e5fa6c"
     },
     {
       "path": "src/bongos/software-update.js",
@@ -16132,7 +16137,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "95d86d1e9db626680711ac8e0f79e6458c5e20b0af7343640c6cf0d4e5e6cadd"
+      "sha256": "a8399bb92d13d12c44c07cf942398f10b93590bbeb054610a5d9952cd9b044ab"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -17174,6 +17179,11 @@
       "mode": "0000644",
       "sha256": "79c57041a871f9700682ac96cebf5d07fe393cc274b5549e8659cad34f44cee1"
     },
+    {
+      "path": "tests/cli_reauth_browser.mjs",
+      "mode": "0000644",
+      "sha256": "758964ef9d4d5d1921162aab1e86a4fb07fe7347aca5866391c8dd33ce67d94d"
+    },
     {
       "path": "tests/cli_sessions.mjs",
       "mode": "0000644",
@@ -19027,7 +19037,7 @@
     {
       "path": "tests/hall_city.mjs",
       "mode": "0000644",
-      "sha256": "781ad77857a1c04165bdd98d033a0776f036feff0752a49b033a4a1bc8179f13"
+      "sha256": "3505970e7551ed2d4ca8767ba0b3b63f564ffc6d76706a181db8826aeb4d8efd"
     },
     {
       "path": "tests/hall_city_card_words.mjs",
@@ -19037,7 +19047,7 @@
     {
       "path": "tests/hall_city_living.mjs",
       "mode": "0000644",
-      "sha256": "1b6744e38a44f486978a1f3ecf275fa260a6d79b0779242fdd4827980b14593d"
+      "sha256": "a8d7ef26e5f647dac6fb03d3759968585ef0146a03de6c8e2897c0943c6db1ee"
     },
     {
       "path": "tests/hall_city_rewording.mjs",
@@ -19304,6 +19314,11 @@
       "mode": "0000644",
       "sha256": "77589e0ab28f723090eeb1863e1a431ed6fec9c761ece66239431d3116b1c63a"
     },
+    {
+      "path": "tests/hall_sky_visor.mjs",
+      "mode": "0000644",
+      "sha256": "ffbf1958a0d19b498ebaa7d1b3d0865252c33bc3eb7ca9f58f10bb9861d05927"
+    },
     {
       "path": "tests/hall_start_screen.mjs",
       "mode": "0000644",
@@ -19387,7 +19402,7 @@
     {
       "path": "tests/hall_visor.mjs",
       "mode": "0000644",
-      "sha256": "055de4ac3afe4e7883be6cb462e00879bafc4c7593186ae7d728dbd5ee13f6f6"
+      "sha256": "7cebc92c9a8c34eb1d11ef0316767fd0ff3fc01dfe20917f7b4194f89174830c"
     },
     {
       "path": "tests/hall_work_history_id.mjs",

package/.claude/skills/builder-reauth/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: builder-reauth
 description: >-
-  Refresh an expired Bongos CLI session, UI-first. Triggers: "/builder-reauth", "re-auth", "refresh my session", "my Bongos session expired", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
+  Sign the CLI back in with one browser click. Triggers: "/builder-reauth", "re-auth", "sign me back in", "refresh my session", "re-issue my CLI token", or any /builder-* failing with "Bongos CLI session is no longer valid".
 plain: >-
   Signs your assistant back in when its sign-in to the project has expired.
 reach-for: >-
@@ -10,7 +10,7 @@ cost: >-
   Free. It replaces your saved sign-in and changes nothing else.
 ---
 
-You are refreshing the current builder's Bongos CLI session. CLI bearer tokens **do not expire** — since [ADR 0294](../../../docs/adr/0294-cli-sessions-do-not-expire.md) a session lasts until it is revoked. So a rejected token means something killed it: the builder (or an Archon) revoked it, a demotion swept it, or an auth-changing deploy invalidated it. This skill is the **fast path back in**: browser clicks plus a single copy/paste, instead of the slower terminal Device Flow.
+You are signing the current builder's command line back in to Bongos. CLI sessions **do not expire** — since [ADR 0294](../../../docs/adr/0294-cli-sessions-do-not-expire.md) a session lasts until it is revoked. So a rejected session means something killed it: the builder (or an Archon) revoked it, a demotion swept it, or an auth-changing deploy invalidated it. This skill gets them back in with **one Approve click in their browser** — nothing to copy, nothing to paste, and the token never passes through the chat (task 1005118).
 
 ## Why there is no expiry (so you can explain it if asked)
 
@@ -18,42 +18,40 @@ There used to be a 24h idle TTL, for auth-token hygiene (GDS-V3 criterion **C9**
 
 What actually bounds a leaked token is **revocation**, and it is faster than any clock: the builder kills it themselves from Settings → Active sessions or "Sign out everywhere" ([ADR 0206](../../../docs/adr/0206-own-scoped-session-revocation-no-absolute-ceiling.md)). Rank changes were never the TTL's job either — demotion calls `revokeAllSessionsForBuilder` synchronously and rank is read fresh from the DB on every request ([ADR 0016](../../../docs/adr/0016-trust-boundary-server-enforced-permissions.md)).
 
-## The flow (guided paste)
+## The flow (one click)
 
-1. **Detect.** Run the helper — it checks whether the existing session is still valid and, if not, opens the hall:
+1. **Say what is about to happen, in one line**, before running anything: a page will open in their browser; they check the code and click **Approve**, and you carry on by yourself.
+
+2. **Run the helper with a long timeout** — it waits for the click (up to ten minutes):
    ```bash
    node scripts/bongos/reauth.js
    ```
-   - **Exit 0** → the session is already valid. Relay who they're signed in as and stop — there is nothing to do. Do NOT re-auth a working session.
-   - **Exit 10** → re-auth is needed. The helper has opened (or printed) the builders' hall URL and the click-path. Continue to step 2.
-   - **Exit 2** → the API was unreachable (network). Relay that, and let them retry once they're back online. The session may be fine.
+   Give the Bash call `timeout: 600000`. The helper checks the current session first; if it is broken it asks the instance for its own approval page (`approve_in_browser`), opens it with the code filled in, waits for the click, and saves the new session itself.
+   - **Exit 0** → signed in. Either the session was already working (say so — do NOT re-sign-in a working session) or the approval just landed. Relay who they are signed in as, then re-run whatever `/builder-*` command they were trying.
+   - **Exit 10** → not signed in: they pressed Cancel, the page ran out, or the account is not let in. The helper says which and prints the fallback below. Offer to run it again once; if that also fails, use the fallback.
+   - **Exit 2** → the instance was unreachable (network). The session may be fine; let them retry once they are back online.
 
-2. **Relay the click-path verbatim.** The helper prints the exact steps; pass them to the user clearly (don't paraphrase the URL):
-   - Open `https://example.com/builders/settings` (the helper tries to open it automatically; if not, give them the link).
-   - They are already signed in there via the browser cookie. Under the **"CLI Access"** section, click **"Re-issue CLI token"**.
-   - Click **"Copy"** — it copies a one-line command of the form `bongos paste-token <token>`.
-   - Ask them to **paste that one line back into the chat**.
+3. **If the page says they are not signed in** in the browser, it shows a **Continue with GitHub** button (and Google where the instance offers it). They sign in there and land straight back on the Approve page — the helper is still waiting.
 
-3. **Run the pasted command.** When the user pastes `bongos paste-token <token>`, run it exactly as given. `paste-token.js` verifies the token against `/api/bongos/me` **before** touching the session file (a bad paste leaves the existing session intact) and preserves any `gemini_api_key`. On success it prints the builder login, rank, and confirms the session file was written.
+## Fallback — the copied line (no browser on this machine)
 
-4. **Confirm.** Relay the authenticated identity + rank back to the user, and tell them they can now re-run whatever `/builder-*` command they were trying.
+Only when the one-click path cannot work — a remote/SSH machine with no browser, or the click path failed twice — run `node scripts/bongos/reauth.js --paste` and relay its click-path: Settings → **CLI Access** → **Re-issue CLI token** → **Copy**, then paste the `bongos paste-token <token>` line back into the chat and run it exactly as given. `paste-token.js` verifies the token before writing and preserves `gemini_api_key`. This path puts the token in the chat, so never echo it beyond running that one command, and never write it anywhere yourself.
 
 ## Edge cases
 
-- **"You are not signed in" / `cookie_required`.** The re-issue endpoint mints CLI bearers from a browser *cookie*, not a bearer — a leaked CLI token can't extend its own life. If the Settings page shows them logged out, they sign in at `https://example.com/builders` first, then return to `/builders/settings` and click Re-issue. Once signed in the button works.
-- **No session file at all (fresh machine).** The helper still guides them to the Settings page; if they've never authed on this machine, the hall sign-in + Settings → CLI Access → Re-issue path still works. The terminal Device Flow (`node scripts/bongos/setup.js`) remains the fallback for a brand-new builder with no browser session anywhere.
-- **Browser can't open automatically** (headless / SSH). The helper prints the URL; relay it so they can open it on whatever machine has their browser, then paste the one-liner back.
-- **Fallback — terminal Device Flow.** If the browser path is unavailable for any reason, `node scripts/bongos/setup.js --force` re-auths via GitHub Device Flow (terminal code entry). Slower and not UI-first; use only when the hall route can't be used.
+- **An instance older than task 1005118** ignores the browser-approval ask and answers GitHub's own device flow: the helper prints a code and opens github.com/login/device. Relay the code; the person types it there and approves. It still finishes by itself.
+- **No session file at all (fresh machine).** The helper runs the same browser approval. A brand-new builder who has never signed in anywhere uses `/builder-setup` instead.
+- **Several projects on one machine.** The helper signs in to the project the active session names (or `BONGOS_API_BASE`). Saving goes through the per-instance store (ADR 0269), so other projects' sign-ins are kept.
 
 ## Constraints
 
-- **The token briefly transits the chat — that's the known cost of guided-paste.** The user pastes `bongos paste-token <token>` into the conversation, so the bearer appears in the chat (and any log/context that captures it). That's the accepted trade-off Lars chose; the deferred zero-paste loopback flow removes it. So: treat the session log as sensitive, **never echo the token beyond running that one pasted command**, and never write it to any file other than `~/.config/otb/gds-session.json` (`paste-token.js` is the only thing that should write it — let it do the write). The token rotates whenever the builder clicks Re-issue again, so re-running this flow invalidates an exposed paste's usefulness for an attacker who lacks the browser cookie.
-- **Don't re-auth a valid session.** If `reauth.js` exits 0, stop.
-- **`GDS_API_BASE`** overrides the endpoint (default `https://example.com`); for local dev `GDS_API_BASE=http://localhost:3000`.
+- **Don't re-sign-in a working session.** If the helper says the sign-in is working, stop.
+- **Never ask for or accept a token in chat** on the one-click path — there is none to handle. Only the fallback carries one.
+- **`BONGOS_API_BASE`** overrides the instance (for local dev `BONGOS_API_BASE=http://localhost:3000`).
 
 ## Files this skill touches
 
-- Runs: `node scripts/bongos/reauth.js` (detect + open browser + print click-path)
-- Runs: `bongos paste-token <token>` (verify + write the new session)
-- Reads/Writes (via paste-token.js): `~/.config/otb/gds-session.json`
-- Calls: `GET /api/bongos/me`; the Settings page (CLI Access) calls `POST /api/bongos/auth/cli-token/issue`
+- Runs: `node scripts/bongos/reauth.js` (detect, browser approval, save) — `--paste` for the fallback
+- Runs (fallback only): `bongos paste-token <token>`
+- Writes (via `saveSession`): the active session file and the per-instance store under `~/.config/cloudbongos/`
+- Calls: `GET /api/bongos/me`, `POST /api/bongos/auth/device/start` + `/auth/device/poll`; the browser page is `/api/bongos/auth/device`

package/clients/bongos-client/index.d.ts

@@ -322,6 +322,7 @@ export interface PostAuthDeviceApproveRequest { user_code: string; decision: "ap
 export interface PostAuthDeviceExchangeRequest { assertion: string }
 export interface PostAuthDeviceExchangeResponse { token: unknown; builder: unknown }
 export interface PostAuthDevicePollRequest { device_code: string }
+export interface PostAuthDeviceStartRequest { approve_in_browser?: boolean }
 export interface PostAuthDiscordUnlinkResponse { ok: boolean; unlinked: unknown }
 export interface PostAuthLogoutResponse { ok: boolean }
 export interface PostAuthRevokeAllRequest { builder_id?: StringifiableId }
@@ -839,7 +840,7 @@ export interface BongosClient {
     /** POST /auth/device/poll — rank: public */
     postAuthDevicePoll(args: RequestArgs & { body: PostAuthDevicePollRequest }): Promise<ApiResponse>;
     /** POST /auth/device/start — rank: public */
-    postAuthDeviceStart(args?: RequestArgs): Promise<ApiResponse>;
+    postAuthDeviceStart(args?: RequestArgs & { body?: PostAuthDeviceStartRequest }): Promise<ApiResponse>;
     /** GET /auth/discord/callback — rank: any-builder */
     getAuthDiscordCallback(args?: RequestArgs): Promise<ApiResponse>;
     /** GET /auth/discord/start — rank: any-builder */

package/docs/adr/0396-google-sign-in-a-stand-in-login-and-a-browser-approved-cli-sign-in.md

@@ -58,3 +58,11 @@ Credits, ranks and community pages needed no change: the hub's check-in and roll
 - **Removing.** Never the last way in. And never GitHub from an account born with it: that account's key is its GitHub id, so a GitHub sign-in would still reach it and the removal would be a lie. A person who joined with Google may remove a linked GitHub, and then shows their stand-in again from their next sign-in.
 - **Every GitHub sign-in on the hub finds the person first** (the ADR 0393 carry-over, closed): the web and device sign-ins ask the hub who the GitHub id reaches and use that key. A project's command-line sign-in (`/sso/device/poll`) cannot tell whether the project takes a minted key, so for a GitHub account linked to someone who joined with Google it says to sign in in the browser.
 - **Matching emails suggest, never join.** This amends decision 3's "emails are never looked up" in one place only: on a first Google sign-in, if another account's GitHub way in shows the address Google verified, the person is offered "Sign in with GitHub" (then link Google from the account page) or "Make a new account with Google". Only the provider's name crosses; no account is named or joined. The hub keeps the GitHub address it sees at sign-in (GitHub's public address) for this alone.
+
+## Amendment — every re-sign-in is approved in the browser (task 1005118)
+
+Decision 6 sent the terminal to the approval page only where Google is offered. A returning builder whose CLI session was revoked then had a four-step way back on every other instance: Settings → Re-issue CLI token → Copy → paste a `bongos paste-token <token>` line into the chat, which put a live bearer in the chat history.
+
+So `/auth/device/start` now also answers with the approval page when the CLI asks for it (`{ "approve_in_browser": true }`), Google or not, and `scripts/bongos/reauth.js` asks. The browser is usually already signed in, so the way back is one Approve click and the token never leaves the server-to-terminal poll. On a GitHub-only instance the page's sign-in step offers GitHub alone.
+
+A plain start is unchanged: a first sign-in on a GitHub-only instance keeps GitHub's device flow, because its `not_approved` answer is what `bongos login` turns into an access request. An older instance ignores the ask and answers GitHub's flow, which the CLI runs as before. The paste path stays as the fallback for a machine with no browser (`reauth.js --paste`).

package/docs/api/openapi.json

@@ -2040,12 +2040,23 @@
         "description": "/auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization.\n\n**Rank:** `public` — No authentication — any caller.",
         "x-rank": "public",
         "x-source": "src/bongos/routes/auth.js",
+        "requestBody": {
+          "required": false,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostAuthDeviceStartRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
         "responses": {
           "200": {
             "description": "Success."
           },
           "400": {
-            "$ref": "#/components/responses/BadRequest"
+            "$ref": "#/components/responses/ValidationFailed"
           }
         },
         "security": []
@@ -36584,6 +36595,15 @@
         ],
         "additionalProperties": false
       },
+      "PostAuthDeviceStartRequest": {
+        "type": "object",
+        "properties": {
+          "approve_in_browser": {
+            "type": "boolean"
+          }
+        },
+        "additionalProperties": false
+      },
       "PostAuthDiscordUnlinkResponse": {
         "type": "object",
         "properties": {
@@ -43542,7 +43562,7 @@
     }
   },
   "x-endpoint-count": 696,
-  "x-schema-count": 730,
+  "x-schema-count": 731,
   "x-undocumented-bodies": 12,
   "x-response-schemas": 462,
   "x-generated-by": "scripts/bongos/gen-api-docs.js"

package/docs/api-reference.md

@@ -88,7 +88,7 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/0016-trust
 | POST | `/api/bongos/auth/device/approve` | `any-builder` | `user_code`, `decision` | (own identity only) — mints a CLI session for the signed-in person themselves, from their browser cookie, never from a bearer (the /auth/… |
 | POST | `/api/bongos/auth/device/exchange` | `public` | `assertion` | POST /auth/device/exchange — CLI federation (ADR 0141 §1). |
 | POST | `/api/bongos/auth/device/poll` | `public` | `device_code` | auth flow; the device code itself is the bearer. |
-| POST | `/api/bongos/auth/device/start` | `public` | — | /auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization. |
+| POST | `/api/bongos/auth/device/start` | `public` | `approve_in_browser` | /auth/device — CLI flow rank: public — auth flow itself; identity establishment, not authorization. |
 | GET | `/api/bongos/auth/discord/callback` | `any-builder` | — | completes the link to the caller's own identity. |
 | GET | `/api/bongos/auth/discord/start` | `any-builder` | — | /auth/discord — account-linking OAuth (Phase 3 F2, ADR 0033 §2). |
 | POST | `/api/bongos/auth/discord/unlink` | `any-builder` | — | unlink your OWN Discord. |

package/docs/copy-inventory.md

@@ -10,7 +10,7 @@
 
 | surface | lives at | files | strings |
 |---|---|---|---|
-| `builders-hall` | `modules/hall-ui/public` | 179 | 2072 |
+| `builders-hall` | `modules/hall-ui/public` | 180 | 2072 |
 | `status-dashboard` | `modules/status-ui/public` | 4 | 89 |
 | `landing` | `modules/public-landing/public` | 10 | 1023 |
 
@@ -316,7 +316,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `4df46e2be815` | certain | Clear the key? | `modules/hall-ui/public/market-watch-settings.js:218` |
 | `593dda3178eb` | certain | Click to copy | `modules/hall-ui/public/copy-on-click.js:137` |
 | `34624d39ff29` | certain | Clone the project to your machine and run | `modules/hall-ui/public/setup-gate.js:34` |
-| `3a426bad2c49` | certain | Close actions | `modules/hall-ui/public/visor.js:222` |
+| `3a426bad2c49` | certain | Close actions | `modules/hall-ui/public/visor.js:232` |
 | `70f6a704d504` | certain | Close it | `modules/hall-ui/public/copy-desk.html:140` |
 | `053e576ba9a3` | certain | Close options | `modules/hall-ui/public/shell-game.js:454` |
 | `d12a2fb5730d` | certain | Close this flag | `modules/hall-ui/public/copy-desk.html:116` |
@@ -1486,7 +1486,7 @@ Identical copy within one surface. Sometimes right (a repeated button), sometime
 | `9a685b01e2c6` | certain | This page opens at a higher rank. | `modules/hall-ui/public/watch.html:237` |
 | `e7a289134dc3` | certain | This page shows no words the reader could find. | `modules/hall-ui/public/tweak-editor.js:246` |
 | `d4b3b5556986` | certain | This page's reference docs | `modules/hall-ui/public/page-notes.js:166` |
-| `79e4a934b434` | certain | This place | `modules/hall-ui/public/visor.js:224` |
+| `79e4a934b434` | certain | This place | `modules/hall-ui/public/visor.js:234` |
 | `5bdcbec770dd` | certain | This project has no slash commands yet. | `modules/hall-ui/public/commands.js:37` |
 | `f53b83bfbe54` | certain | This project has no watch rules yet. | `modules/hall-ui/public/market-watch-rules.js:62` |
 | `e97b2d549f10` | certain | This project is hosted on {…}, and that is where it is taken offline or removed. Both links below open this pr | `modules/hall-ui/public/project-settings.js:412` |

package/docs/copy-registry.json

@@ -12,7 +12,7 @@
   "surfaces": {
     "builders-hall": {
       "at": "modules/hall-ui/public",
-      "files": 179,
+      "files": 180,
       "strings": 2072
     },
     "status-dashboard": {
@@ -5208,7 +5208,7 @@
       "surface": "builders-hall",
       "text": "Close actions",
       "file": "modules/hall-ui/public/visor.js",
-      "line": 222,
+      "line": 232,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -15738,7 +15738,7 @@
       "surface": "builders-hall",
       "text": "This place",
       "file": "modules/hall-ui/public/visor.js",
-      "line": 224,
+      "line": 234,
       "origin": "js-markup",
       "confidence": "certain"
     },

package/docs/module-api-changelog.md

@@ -3430,7 +3430,9 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.24.88 with no explicit bump. run 43213545598. (task 1002620)
   1.24.90 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.24.89 with no explicit bump. run 43217068783. (task 1002620)
-  1.24.91 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
-        landed since 1.24.90 with no explicit bump. run 43220126363. (task 1002620)
+  1.24.92 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.90 with no explicit bump. run 43296447627. (task 1002620)
+  1.24.93 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.24.92 with no explicit bump. run 43299203682. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-inventory.json

@@ -414,7 +414,8 @@
         "modules/hall-ui/public/sky-interaction.js",
         "modules/hall-ui/public/sky-panel.js",
         "modules/hall-ui/public/sky-composer.js",
-        "modules/hall-ui/public/sky-tour.js"
+        "modules/hall-ui/public/sky-tour.js",
+        "modules/hall-ui/public/sky-visor.js"
       ],
       "states_files": [
         "modules/hall-ui/public/goal-map.states.json"
@@ -1324,7 +1325,8 @@
         "modules/hall-ui/public/sky-interaction.js",
         "modules/hall-ui/public/sky-panel.js",
         "modules/hall-ui/public/sky-composer.js",
-        "modules/hall-ui/public/sky-tour.js"
+        "modules/hall-ui/public/sky-tour.js",
+        "modules/hall-ui/public/sky-visor.js"
       ],
       "states_files": [
         "modules/hall-ui/public/thinking.states.json"