@bongos/core 1.24.91 → 1.24.93

package/scripts/bongos/reauth.js

@@ -1,45 +1,42 @@
 #!/usr/bin/env node
-// scripts/bongos/reauth.js — #504.
+// scripts/bongos/reauth.js — #504; one-click since task 1005118.
 //
-// The fast, UI-first path to refresh an expired/invalid GDS CLI session.
-//
-// Why this exists: a CLI session can stop working — revoked from the hall's
-// "Sign out everywhere", swept by a demotion, or invalidated by an auth-changing
-// deploy. (It no longer stops working from mere disuse: ADR 0294 removed the idle
-// expiry, because the timer only ever signed out the legitimate holder while
-// refresh-on-use kept a thief's copy alive.) Whatever killed it, the friction of
-// getting back in — the slow Device Flow, terminal codes, Gemini-key prompts — is
-// not something to keep. This script is the fix:
+// Signs the command line back in when its Bongos session has stopped working —
+// revoked from the hall's "Sign out everywhere", swept by a demotion, or
+// invalidated by an auth-changing deploy. (Never from mere disuse: ADR 0294
+// removed the idle expiry.)
 //
 //   1. Detect — is the current session still valid? (GET /api/bongos/me)
-//        valid   → print who you are + exit 0. Nothing to do.
-//        invalid → exit 10 ("re-auth needed") after opening the browser.
-//   2. Guide — open the builder's Settings page in the default browser (where
-//      the builder is already signed in via the httpOnly cookie) and print the
-//      exact click-path: Settings → CLI Access → Re-issue CLI token → Copy.
-//      The page hands back a one-liner: `bongos paste-token
-//      <token>`. The builder pastes that one line back into Claude; the
-//      /builder-reauth skill runs it (paste-token.js verifies + writes safely).
+//        valid → print who you are + exit 0. Nothing to do.
+//   2. Approve in the browser (task 1005118) — start a sign-in that asks the
+//      instance for its OWN approval page (device-approval.js), open it with the
+//      code filled in, and wait. The builder's browser is already signed in, so
+//      the page is one Approve click; the terminal's poll then receives the new
+//      session and this script saves it. Nothing to copy, nothing to paste, and
+//      the token never passes through the chat.
 //
-// This script never touches the session file itself — paste-token.js owns the
-// write (and its verify-before-write safety contract). reauth.js is detect +
-// open + instruct only, so a failed re-auth can never corrupt a good session.
+// It used to be four steps with a paste: Settings → "Re-issue CLI token" → Copy →
+// paste a `bongos paste-token <token>` line into Claude, which put the token in
+// the chat history. That path stays as the FALLBACK for a machine with no browser
+// to approve from (`--paste` prints it; so does any failure here).
 //
-// Honors Lars's UI-first rule as far as guided-paste allows: browser clicks +
-// a single copy/paste, no Device-Flow code entry. (A true zero-paste loopback
-// flow is a deferred follow-up.)
+// The session is written only after the server handed back a token for a
+// signed-in person, and through saveSession (the per-instance store, ADR 0269),
+// so a failed or cancelled approval never touches the existing session file.
 //
 // Usage:
-//   node scripts/bongos/reauth.js            # detect; if invalid, open Settings + guide
-//   node scripts/bongos/reauth.js --no-open  # detect + guide, but don't open browser
+//   node scripts/bongos/reauth.js            # detect; if invalid, approve in the browser
+//   node scripts/bongos/reauth.js --paste    # detect; if invalid, print the copy-paste path
+//   node scripts/bongos/reauth.js --no-open  # as --paste, without opening the browser
 //
 // Exit codes:
-//   0  — session is valid (no re-auth needed)
-//   10 — re-auth needed (browser opened, instructions printed)
-//   2  — could not reach the API to check (network); guidance still printed
+//   0  — signed in: the session was already valid, or the approval just landed
+//   10 — still not signed in (cancelled, ran out, or not let in); fallback printed
+//   2  — could not reach the instance (network); the session may be fine
 
 const { spawn } = require('node:child_process');
 const lib = require('./cli-lib');
+const { readSessionConfigSync } = require('../../src/instance-config');
 
 // lib.API_BASE is session-aware (task 1002427), so both URLs name the instance the
 // builder is actually signed into — not this checkout's branding default, which is
@@ -85,7 +82,7 @@ function openInBrowser(url) {
 
 function printGuidance({ opened }) {
   console.log('');
-  console.log('Refresh your GDS CLI session (UI-first — no Device Flow):');
+  console.log('Fallback — sign back in with a copied line:');
   console.log('');
   // We can't reliably know if the browser actually launched — spawn() reports
   // a missing-binary error asynchronously, after this prints. So we never claim
@@ -102,19 +99,71 @@ function printGuidance({ opened }) {
   console.log('');
   console.log('  If the page says you are not signed in, sign in at the builders\'');
   console.log(`  hall first (${HALL_URL}), then return to Settings and click Re-issue.`);
-  console.log('  Fallback (terminal Device Flow): node scripts/bongos/setup.js --force');
   console.log('');
 }
 
+// The session to write after an approval: the server's token + builder for THIS
+// instance, with every other field (gemini_api_key et al.) carried over from the
+// existing session when it belongs to the same instance. Pure, so it is tested.
+function nextSession(existing, { token, builder, apiBase }) {
+  const sameInstance = existing && existing.api_base
+    && lib.sessionHostKey(existing.api_base) === lib.sessionHostKey(apiBase);
+  const carried = sameInstance ? existing
+    : (existing && existing.gemini_api_key ? { gemini_api_key: existing.gemini_api_key } : {});
+  return { ...carried, token, builder, api_base: apiBase };
+}
+
+// Approve in the browser, then save. → true when signed back in.
+async function approveInBrowser() {
+  const { runDeviceFlow } = require('./login');
+  console.log('');
+  console.log('Opening a page in your browser to sign the command line back in.');
+  console.log('Check the code matches, then click "Approve" — this carries on by itself.');
+  let out;
+  try {
+    out = await runDeviceFlow(lib.API_BASE, { log: console.log, browser: true });
+  } catch (err) {
+    console.log('');
+    console.log(`The browser sign-in didn't finish: ${err && err.message ? err.message : err}`);
+    return false;
+  }
+  console.log('');
+  if (!out || out.state !== 'ok' || !out.token) {
+    console.log(out && out.state === 'not_approved'
+      ? 'That account is not let in to this project yet — ask its owner.'
+      : 'The sign-in ran out before it was approved. Run this again to get a fresh page.');
+    return false;
+  }
+  let existing = null;
+  try {
+    const raw = readSessionConfigSync();
+    existing = raw ? JSON.parse(raw) : null;
+  } catch (_) { existing = null; }
+  await lib.saveSession(nextSession(existing, { token: out.token, builder: out.builder, apiBase: lib.API_BASE }));
+  const b = out.builder || {};
+  console.log(`✓ Signed back in as ${b.github_login || '?'}${b.rank ? ` (rank: ${b.rank})` : ''}.`);
+  return true;
+}
+
+async function reSignIn({ paste, noOpen }) {
+  if (paste) {
+    printGuidance({ opened: noOpen ? false : openInBrowser(SETTINGS_URL) });
+    process.exit(10);
+  }
+  if (await approveInBrowser()) process.exit(0);
+  printGuidance({ opened: false });
+  process.exit(10);
+}
+
 async function main() {
+  // --no-open (the old flag) means no browser at all, so it is the paste path too.
   const noOpen = process.argv.includes('--no-open');
+  const paste = noOpen || process.argv.includes('--paste');
 
   const session = await lib.loadSession();
   if (!session || !session.token) {
-    console.log('No GDS CLI session found on this machine.');
-    const opened = noOpen ? false : openInBrowser(SETTINGS_URL);
-    printGuidance({ opened });
-    process.exit(10);
+    console.log('No Bongos sign-in found on this machine.');
+    return reSignIn({ paste, noOpen });
   }
 
   // Detect: is the existing token still valid? /me is the canonical check
@@ -126,30 +175,31 @@ async function main() {
     res = await api.me.getMe();
   } catch (err) {
     console.error(`Could not reach ${lib.API_BASE} to check your session: ${err.message}`);
-    const opened = noOpen ? false : openInBrowser(SETTINGS_URL);
-    printGuidance({ opened });
+    console.error('Your sign-in may be fine — try again once you are back online.');
     process.exit(2);
   }
 
   if (res.ok) {
     const b = (res.data && res.data.builder) || {};
-    console.log(`Your GDS CLI session is valid — no re-auth needed.`);
+    console.log('Your Bongos sign-in is working — nothing to do.');
     console.log(`  Signed in as ${b.github_login || '?'}${b.rank ? ` (rank: ${b.rank})` : ''}.`);
-    console.log('  (CLI sessions do not expire — they last until revoked. Kill one from');
+    console.log('  (Sign-ins do not expire — they last until revoked. Kill one from');
     console.log('   Settings → Active sessions, or "Sign out everywhere".)');
     process.exit(0);
   }
 
-  // 401 / 403 / anything not-ok → treat as "needs re-auth".
-  console.log('Your GDS CLI session is no longer valid (expired or revoked).');
-  const opened = noOpen ? false : openInBrowser(SETTINGS_URL);
-  printGuidance({ opened });
-  process.exit(10);
+  // 401 / 403 / anything not-ok → sign back in.
+  console.log('Your Bongos sign-in has stopped working (revoked or replaced).');
+  return reSignIn({ paste, noOpen });
 }
 
-main().catch((err) => {
-  console.error('reauth failed:', err && err.message ? err.message : err);
-  // Still print the manual path so the builder isn't stranded.
-  printGuidance({ opened: false });
-  process.exit(2);
-});
+if (require.main === module) {
+  main().catch((err) => {
+    console.error('reauth failed:', err && err.message ? err.message : err);
+    // Still print the manual path so the builder isn't stranded.
+    printGuidance({ opened: false });
+    process.exit(2);
+  });
+}
+
+module.exports = { nextSession };

package/src/bongos/routes/auth-google.js

@@ -12,8 +12,10 @@
 //   GET  /auth/device           → the page a terminal sends the person to
 //   POST /auth/device/approve   → the signed-in person approves or cancels it
 //
-// Every route answers only where googleConfigured() — the owner's Google app AND
-// the hub that keeps who signs in with it (auth-google.js).
+// The two /auth/google routes answer only where googleConfigured() — the owner's
+// Google app AND the hub that keeps who signs in with it (auth-google.js). The
+// two /auth/device routes answer everywhere: a CLI re-sign-in asks for them on a
+// GitHub-only site too (task 1005118), where the page offers GitHub alone.
 'use strict';
 
 const express = require('express');
@@ -244,7 +246,7 @@ module.exports = function buildAuthGoogleRouter() {
         state: 'signin',
         userCode: pending.userCode,
         githubHref: `${base}/auth/web/start?via=github&return=${encodeURIComponent(here)}`,
-        googleHref: `${base}/auth/google/start?return=${encodeURIComponent(here)}`,
+        googleHref: googleConfigured() ? `${base}/auth/google/start?return=${encodeURIComponent(here)}` : null,
       }));
     }
     return res.type('text/html').send(renderDeviceApprovalPage({

package/src/bongos/routes/auth.js

@@ -603,9 +603,9 @@ module.exports = function buildAuthRouter() {
     if (!auth.authConfigured()) {
       return res.fail('auth_not_configured', { status: 503, message: 'GitHub OAuth App credentials missing on the server. See blockers/blockers.md#github-oauth-app.' });
     }
-    // Google offered here: the terminal is sent to this instance's own approval
-    // page, where the person signs in with GitHub or Google (device-approval.js).
-    if (googleConfigured()) {
+    if (validateOrRespond(req, res, { approve_in_browser: { type: 'boolean' } }, { strict: true })) return;
+    // Google offered, or a re-sign-in asked (task 1005118): this site's own approval page (device-approval.js).
+    if (googleConfigured() || req.body?.approve_in_browser === true) {
       return res.json(startBrowserDeviceFlow({
         pageUrl: `${WEB_REDIRECT_ORIGIN.replace(/\/+$/, '')}${apiBase(req)}/auth/device`,
       }));

package/src/bongos/sign-in-pages.js

@@ -76,8 +76,7 @@ ${bodyHtml}
 function choiceButtons({ githubHref, googleHref }) {
   return `      <div class="signinChoices">
         <a class="landing__btn" href="${escapeHtml(githubHref)}">${GITHUB_MARK}Continue with GitHub</a>
-        <a class="landing__btn" href="${escapeHtml(googleHref)}">${GOOGLE_MARK}Continue with Google</a>
-      </div>`;
+${googleHref ? `        <a class="landing__btn" href="${escapeHtml(googleHref)}">${GOOGLE_MARK}Continue with Google</a>\n` : ''}      </div>`;
 }
 
 // The sign-in chooser /auth/web/start shows when Google sign-in is switched on.

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.24.91'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.24.93'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/cli_reauth_browser.mjs

@@ -0,0 +1,157 @@
+// tests/cli_reauth_browser.mjs — signing the command line back in is one Approve
+// click in the browser, on every instance (task 1005118).
+//
+// What this pins:
+//   - a re-sign-in's device start (approve_in_browser) gets this site's own approval
+//     page even where Google sign-in is OFF; a plain start keeps GitHub's flow, so
+//     `bongos login`'s not_approved → access-request path is untouched;
+//   - on a GitHub-only site the approval page offers GitHub alone (no dead Google door);
+//   - the CLI asks for the browser page only when told to, and prints the whole link;
+//   - the saved session keeps the builder's other fields for the same instance and
+//     never carries another instance's fields across.
+//
+// DB-free and network-free. Run: node tests/cli_reauth_browser.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+
+for (const p of ['BONGOS', 'CLOUDBONGOS', 'GDS', 'OTB']) {
+  delete process.env[`${p}_GOOGLE_CLIENT_ID`];
+  delete process.env[`${p}_GOOGLE_CLIENT_SECRET`];
+}
+process.env.BONGOS_GITHUB_CLIENT_ID = process.env.BONGOS_GITHUB_CLIENT_ID || 'gh-test-client';
+process.env.BONGOS_GITHUB_CLIENT_SECRET = process.env.BONGOS_GITHUB_CLIENT_SECRET || 'gh-test-secret';
+
+const auth = require('../src/bongos/auth.js');
+const { googleConfigured } = require('../src/bongos/auth-google.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+const buildAuthGoogleRouter = require('../src/bongos/routes/auth-google.js');
+const { pollBrowserDeviceFlow } = require('../src/bongos/device-approval.js');
+const { runDeviceFlow } = require('../scripts/bongos/login.js');
+const { nextSession } = require('../scripts/bongos/reauth.js');
+
+let pass = 0, fail = 0;
+const t = async (name, fn) => {
+  try { await fn(); pass++; console.log(`PASS  ${name}`); }
+  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.stack || e.message}`); }
+};
+
+function fakeRes() {
+  const res = {
+    _status: 200, _body: null, _headers: {},
+    status(c) { this._status = c; return this; },
+    type() { return this; },
+    send(b) { this._body = b; return this; },
+    json(b) { this._body = b; return this; },
+    set(k, v) { this._headers[k.toLowerCase()] = v; return this; },
+  };
+  attachFail({}, res, () => {});
+  return res;
+}
+function handler(router, method, path) {
+  const layer = router.stack.find((l) => l.route?.path === path && l.route.methods[method]);
+  assert.ok(layer, `route ${method.toUpperCase()} ${path} exists`);
+  return layer.route.stack.at(-1).handle;
+}
+const req = (over = {}) => ({ query: {}, headers: { host: 'localhost' }, baseUrl: '/api/bongos', body: {}, ...over });
+
+const orig = { configured: auth.authConfigured, start: auth.startDeviceFlow, resolve: auth.resolveSession };
+auth.authConfigured = () => true;
+let githubStarts = 0;
+auth.startDeviceFlow = async () => {
+  githubStarts++;
+  return { device_code: 'gh_dc', user_code: 'WXYZ-1234', verification_uri: 'https://github.com/login/device', expires_in: 900, interval: 5 };
+};
+auth.resolveSession = async () => null;
+
+await t('this test runs as a GitHub-only site', () => {
+  assert.equal(googleConfigured(), false);
+});
+
+await t('a re-sign-in asks for the browser page and gets this site’s own approval page, Google or not', async () => {
+  const res = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req({ body: { approve_in_browser: true } }), res);
+  assert.match(res._body.verification_uri, /\/api\/bongos\/auth\/device\?code=[B-Z]{4}-[B-Z]{4}$/);
+  assert.equal(githubStarts, 0, 'GitHub’s code entry is not started');
+  assert.equal(pollBrowserDeviceFlow(res._body.device_code).state, 'pending', 'the terminal waits on this site');
+});
+
+await t('a plain start on a GitHub-only site keeps GitHub’s flow (first sign-in, access requests)', async () => {
+  const res = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req(), res);
+  assert.equal(res._body.verification_uri, 'https://github.com/login/device');
+  assert.equal(githubStarts, 1);
+  const truthy = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req({ body: { approve_in_browser: 'yes' } }), truthy);
+  assert.equal(truthy._status, 400, 'only a boolean asks; anything else is refused, never guessed');
+  const stray = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req({ body: { other: 1 } }), stray);
+  assert.equal(stray._status, 400, 'unknown fields are refused (ADR 0118)');
+  assert.equal(githubStarts, 1, 'a refused ask starts nothing');
+});
+
+await t('on a GitHub-only site the approval page offers GitHub alone', async () => {
+  const start = fakeRes();
+  await handler(buildAuthRouter(), 'post', '/auth/device/start')(req({ body: { approve_in_browser: true } }), start);
+  const res = fakeRes();
+  await handler(buildAuthGoogleRouter(), 'get', '/auth/device')(req({ query: { code: start._body.user_code } }), res);
+  assert.match(res._body, /Continue with GitHub/);
+  assert.doesNotMatch(res._body, /Continue with Google/, 'no door to a sign-in this site does not offer');
+});
+
+auth.authConfigured = orig.configured;
+auth.startDeviceFlow = orig.start;
+auth.resolveSession = orig.resolve;
+
+await t('the CLI asks for the browser page only when told to, and prints the whole link', async () => {
+  const realFetch = globalThis.fetch;
+  const bodies = [];
+  const link = 'https://cloudbongos.com/api/bongos/auth/device?code=BCDF-GHJK';
+  globalThis.fetch = async (url, opts) => {
+    if (/device\/start$/.test(url)) {
+      bodies.push(opts.body);
+      return { ok: true, status: 200, text: async () => JSON.stringify({ device_code: 'd', user_code: 'BCDF-GHJK', verification_uri: link, expires_in: 0, interval: 0 }) };
+    }
+    if (/device\/poll$/.test(url)) {
+      return { ok: true, status: 200, text: async () => JSON.stringify({ state: 'ok', token: 'tok', builder: { id: 3 } }) };
+    }
+    throw new Error(`unexpected fetch ${url}`);
+  };
+  const lines = [];
+  // The first poll approves (the loop waits one interval first); an unknown platform
+  // opens no real browser.
+  const savedPlatform = Object.getOwnPropertyDescriptor(process, 'platform');
+  Object.defineProperty(process, 'platform', { value: 'test-none' });
+  try {
+    const out = await runDeviceFlow('https://cloudbongos.com', { log: (l) => lines.push(l), browser: true });
+    assert.deepEqual(out, { state: 'ok', token: 'tok', builder: { id: 3 } }, 'the approval hands back the session');
+    await runDeviceFlow('https://cloudbongos.com', { log: () => {} });
+  } finally {
+    globalThis.fetch = realFetch;
+    Object.defineProperty(process, 'platform', savedPlatform);
+  }
+  assert.deepEqual(JSON.parse(bodies[0]), { approve_in_browser: true });
+  assert.equal(bodies[1], undefined, 'a plain login sends no ask');
+  assert.ok(lines.some((l) => l.includes(link)), 'the link is printed whole, never cut to the box');
+});
+
+await t('the saved session keeps the same instance’s fields and never carries another’s', () => {
+  const builder = { id: 3, github_login: 'test-archon', rank: 'archon' };
+  const same = nextSession(
+    { token: 'old', api_base: 'https://cloudbongos.com', gemini_api_key: 'g', builder: { id: 3 }, extra: 1 },
+    { token: 'new', builder, apiBase: 'https://cloudbongos.com' },
+  );
+  assert.deepEqual(same, { token: 'new', api_base: 'https://cloudbongos.com', gemini_api_key: 'g', builder, extra: 1 });
+  const other = nextSession(
+    { token: 'old', api_base: 'https://toast.cloudbongos.com', gemini_api_key: 'g', extra: 1 },
+    { token: 'new', builder, apiBase: 'https://cloudbongos.com' },
+  );
+  assert.deepEqual(other, { gemini_api_key: 'g', token: 'new', builder, api_base: 'https://cloudbongos.com' });
+  assert.deepEqual(nextSession(null, { token: 'n', builder, apiBase: 'https://x.test' }), { token: 'n', builder, api_base: 'https://x.test' });
+});
+
+console.log(`\n${pass} passed, ${fail} failed`);
+if (fail) process.exit(1);

package/tests/hall_city.mjs

@@ -403,11 +403,20 @@ function fakeDom() {
     getElementById: (id) => byId.get(id) || null,
     createElement: (t) => mk(t),
     createElementNS: (_ns, t) => mk(t),
+    // the archived line, as city.html writes it (task 1005209 reads its links for the visor)
+    querySelector: (sel) => (sel === '.city-archived' ? archivedLine() : null),
   };
   return { document, byId, html };
 }
 
-async function bootPage({ feeds = {}, stored = null, osDark = true, shell = undefined, stage = null } = {}) {
+// The page's own archived line: its links, from city.html, word for word.
+function archivedLine() {
+  const line = /<p class="city-archived">([\s\S]*?)<\/p>/.exec(read('city.html'))[1];
+  const links = [...line.matchAll(/<a href="([^"]+)">([^<]+)<\/a>/g)].map(([, href, text]) => ({ textContent: text, getAttribute: (k) => (k === 'href' ? href : null) }));
+  return { querySelectorAll: () => links };
+}
+
+async function bootPage({ feeds = {}, stored = null, osDark = true, shell = undefined, stage = null, visor = undefined } = {}) {
   const { document, byId, html } = fakeDom();
   const store = new Map(stored ? [['hall-theme', stored]] : []);
   const calls = [];
@@ -425,6 +434,7 @@ async function bootPage({ feeds = {}, stored = null, osDark = true, shell = unde
   const observers = [];
   class MutationObserver { constructor(fn) { this.fn = fn; observers.push(this); } observe() {} }
   window.OTBShell = shell;
+  window.OTBVisor = visor;
   if (stage) { const m = document.createElement('main'); m.setAttribute('id', 'hall-main'); Object.assign(m, stage); }
   const ctx = vm.createContext({ window, document, fetch, Promise, Math, String, Number, Array, Object, JSON, console, MutationObserver });
   ctx.globalThis = ctx;
@@ -494,3 +504,33 @@ test('docket text lands as text: a title with markup is never parsed', async ()
   const p = await bootPage({ feeds: FEEDS([matter({ title: '<img src=x onerror=alert(1)>', short: '<b>x</b>' })]) });
   assert.equal(p.byId.get('cityPins').children.length, 1);
 });
+
+
+// task 1005209 (ADR 0403): in game mode the city's door and its archived links are the visor's.
+test("game mode: the door is the visor's lead action on D, and the archived links are in its sheet", async () => {
+  const scenes = [];
+  const ms = [matter({ id: 'board:1', building: 'charter', state: 'needs' }), matter({ id: 'blockers:2', state: 'needs' })];
+  const p = await bootPage({ feeds: FEEDS(ms), visor: { scene: (sc) => scenes.push(sc) } });
+  const last = scenes[scenes.length - 1];
+  assert.equal(last.place, 'Governor city');
+  const [lead, street, views] = last.actions;
+  assert.equal(lead.label, 'start governing', 'what the door says, before the living city reads who it waits on (hall_city_living pins the count)');
+  assert.deepEqual([lead.key, lead.bind, lead.lead], ['d', true, true], 'it is on the glass, and D (which nothing else binds) presses it');
+  assert.deepEqual([street.label, views.label], ['Archived: Street', 'Archived: Building Level Views'], "the line's own words, read off the page");
+  assert.ok(!street.lead && !views.lead && !street.bind && !views.bind, 'the archived links are rows in the sheet, reached by A then the keyboard');
+  const went = [];
+  p.window.location = { assign: (u) => went.push(u) };
+  street.run();
+  views.run();
+  assert.deepEqual(went, ['/builders/street', '/builders/street#building=charter'], 'each goes where its link went');
+  const n = scenes.length;
+  p.window.GovCityPage.draw(true);
+  assert.equal(scenes.length, n, 'a redraw with the same door registers nothing new');
+  assert.deepEqual(JSON.parse(JSON.stringify(last.keys.map((k) => k.key))), ['1–9', '← →'], "the card's own keys are still listed");
+});
+
+test('game mode: the scene carries no button of its own; classic mode keeps the door and the links', () => {
+  const css = read('city.css');
+  assert.ok(css.includes('\nhtml.visor-on .city-start, html.visor-on .city-archived { display: none; }'), 'off the scene only while the visor is up');
+  assert.doesNotMatch(css, /^\.city-start[^{]*\{[^}]*display: none/m, 'never hidden outside game mode');
+});

package/tests/hall_city_living.mjs

@@ -534,6 +534,8 @@ test('the page reads the living feeds and draws the sky, the plates, the plaque
   const m = city();
   const start = p.byId.get('cityStart');
   assert.equal(start.textContent, m.cta.label);
+  const lead = p.window.__visorScene.actions[0];
+  assert.equal(lead.label.toLowerCase(), m.cta.label, 'in game mode the lead action on the visor says what the door says (task 1005209)');
   assert.equal(start.attrs.href, '#decide');
   assert.equal(p.byId.get('cityLine').textContent, m.line);
   for (const id of ['cityBlds', 'citySky', 'cityPins', 'cityPlaque']) assert.equal(findAll(p.byId.get(id), (n) => 'data-proto' in n.attrs).length, 0, id + ': nothing marked prototype');