@bongos/core 1.18.0 → 1.18.18

package/public-landing/create.html

@@ -29,6 +29,13 @@
   --font-mono:"Fira Code",ui-monospace,SFMono-Regular,Menlo,monospace;
 }
 *{box-sizing:border-box;margin:0;padding:0;}
+/* The `hidden` attribute must always win. Several blocks below set an explicit
+   `display` via a class (.field→block, .row2→grid); an author rule like that
+   silently defeats the user-agent [hidden] rule, so `el.hidden = true` fails to
+   hide them. The Home step (task 1002228) toggles el.hidden to switch between the
+   adopt-picker / fresh-name / manual sub-panels — without this they ALL render at
+   once. Make hidden authoritative for the whole page. */
+[hidden]{display:none !important;}
 html{scroll-behavior:smooth;}
 body{
   font-family:var(--font-body); color:var(--ink);
@@ -75,11 +82,6 @@ body{
 .exit-wizard kbd{font-family:var(--font-mono);font-size:10px;line-height:1;background:rgba(42,31,23,0.08);border-radius:4px;padding:2px 5px;color:var(--ink-faint);}
 .who{display:flex;align-items:center;gap:10px;font-size:14px;font-weight:600;color:var(--ink-soft);min-height:34px;}
 .who img{width:30px;height:30px;border-radius:50%;border:2px solid #fff;box-shadow:0 2px 8px rgba(42,31,23,0.12);}
-.who a{color:var(--accent-deep);text-decoration:none;font-weight:700;}
-.who a:hover{text-decoration:underline;}
-/* switch to a different GitHub account from inside the wizard (task 2098) */
-.who .switch-acct{font-size:12px;font-weight:600;color:var(--ink-faint);padding-left:10px;margin-left:2px;border-left:1px solid rgba(42,31,23,0.16);}
-.who .switch-acct:hover{color:var(--accent-deep);}
 
 /* ── layout ── */
 .wrap{
@@ -195,10 +197,6 @@ input[type=text].bad{border-color:var(--err);}
 .ghbtn:hover{background:#1b1f24;transform:translateY(-1px);}
 .ghbtn:active{transform:translateY(0) scale(.98);}
 .ghbtn .gh{width:18px;height:18px;fill:currentColor;}
-.ghcreate{display:none;margin-bottom:18px;}
-.ghcreate.on{display:block;}
-.ghcreate-note{font-size:13px;font-weight:500;color:var(--ink-faint);line-height:1.5;margin-top:9px;max-width:52ch;}
-.ghcreate-note strong{color:var(--ink-soft);}
 .steps .ghbtn{font-size:14px;padding:9px 16px;margin-top:10px;}
 
 /* buttons */
@@ -327,6 +325,16 @@ input[type=text].bad{border-color:var(--err);}
 @media (prefers-reduced-motion:reduce){
   *,*::before,*::after{animation:none !important;transition:none !important;}
 }
+/* GitHub repo picker (task 1002099) */
+.linklike{background:none;border:0;padding:0;margin-left:12px;color:var(--accent-deep);font:inherit;font-size:13px;cursor:pointer;text-decoration:underline;}
+#ghConnect .btn{margin-top:4px;}
+.ghlist{margin-top:8px;max-height:220px;overflow-y:auto;border:1px solid var(--line,#e7d8c4);border-radius:10px;background:var(--bg-deep,#fff);}
+.ghlist:empty{display:none;}
+.ghrow{display:flex;align-items:center;gap:8px;width:100%;text-align:left;background:none;border:0;border-bottom:1px solid rgba(42,31,23,0.06);padding:9px 12px;font:inherit;font-size:13.5px;color:var(--ink,#2a1f17);cursor:pointer;}
+.ghrow:last-child{border-bottom:0;}
+.ghrow:hover{background:#fff9f2;}
+.ghrow[aria-selected=true]{background:#fff3e6;box-shadow:inset 3px 0 0 var(--accent,#f97316);font-weight:600;}
+.ghrow .priv{margin-left:auto;font-size:11px;font-weight:600;color:var(--ink-faint,#9b8a78);background:rgba(42,31,23,0.06);border-radius:5px;padding:1px 6px;}
 </style>
 </head>
 <body>
@@ -363,7 +371,11 @@ input[type=text].bad{border-color:var(--err);}
     <section class="panel" id="panel-gate" aria-labelledby="gate-h">
       <h1 id="gate-h">Create a project</h1>
       <p class="lede">Your own <strong data-brand-product-inline>Cloud Bongos</strong> project: its own repository, its own home on the web, and a hall of AI builders who do the building. You set the direction; agents lay down the code. Sign in with GitHub so the project belongs to <em>you</em> from the very first beat.</p>
-      <a class="btn big" id="signin" href="/api/bongos/auth/web/start?return=/create">
+      <!-- The wizard's own sign-in opts into repo scope (read:user + public_repo) up
+           front (&repos=1) — anyone here intends to create a project, which needs repo
+           access, so we ask once at sign-in instead of a second "Connect" step at Home.
+           Hall + CLI sign-in stay identity-only (ADR 0143 least-privilege default). -->
+      <a class="btn big" id="signin" href="/api/bongos/auth/web/start?return=/create&amp;repos=1">
         <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
         Sign in with GitHub
       </a>
@@ -405,7 +417,31 @@ input[type=text].bad{border-color:var(--err);}
           </button>
         </div>
         <div class="reassure" id="adoptNote">Adopting never overwrites your files: you get a conflict pre-flight first, nothing is written until you accept, and your existing backlog (issues, TODOs) is imported as real tasks.</div>
-        <div class="row2">
+
+        <!-- GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099.
+             Progressive enhancement: when the signed-in user grants repo access we let
+             them PICK a repo (adopt) or NAME one we auto-create (fresh). Without that
+             access — not granted yet, or the server can't store the token — we fall back
+             to the manual owner/repo inputs below (#manualHome), which stay authoritative. -->
+        <div id="ghConnect" class="reassure">
+          <p id="ghConnectMsg">&nbsp;</p>
+          <button type="button" class="btn" id="ghConnectBtn">Allow repo access</button>
+          <button type="button" class="linklike" id="ghManualToggle">or enter it manually</button>
+        </div>
+        <div id="ghBusy" class="hint" hidden>Reading your GitHub repositories…</div>
+        <div id="ghAdopt" class="field" hidden>
+          <span>Pick one of your repositories</span>
+          <input type="text" id="ghSearch" placeholder="Search your repos…" autocomplete="off">
+          <div id="ghList" class="ghlist" role="listbox" aria-label="Your repositories"></div>
+          <div class="hint" id="ghAdoptHint">&nbsp;</div>
+        </div>
+        <div id="ghFresh" class="field" hidden>
+          <span>New repository name</span>
+          <input type="text" id="ghNewName" placeholder="mercury" autocomplete="off" maxlength="100">
+          <div class="hint" id="ghFreshHint">We’ll create an empty repo at <code id="ghFreshPreview" style="font-family:var(--font-mono)">github.com/you/mercury</code>.</div>
+        </div>
+
+        <div class="row2" id="manualHome">
           <label class="field"><span>GitHub owner <small>(user or org)</small></span>
             <input type="text" id="f-owner" placeholder="acme" autocomplete="off" maxlength="60">
           </label>
@@ -413,13 +449,6 @@ input[type=text].bad{border-color:var(--err);}
             <input type="text" id="f-repo" placeholder="mercury" autocomplete="off" maxlength="120">
           </label>
         </div>
-        <div class="ghcreate" id="ghCreate">
-          <a class="ghbtn" id="ghCreateBtn" href="https://github.com/new" target="_blank" rel="noopener">
-            <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
-            Create this repo on GitHub
-          </a>
-          <p class="ghcreate-note">Opens GitHub with the name already filled in — just click <strong>Create repository</strong> and leave it empty, then come back and press Next. Already made it? Just press Next.</p>
-        </div>
         <div class="hint" id="h-home">&nbsp;</div>
         <div class="nav">
           <button type="button" class="btn ghost" data-back="1">← Back</button>
@@ -566,10 +595,6 @@ input[type=text].bad{border-color:var(--err);}
     if (owner) u.searchParams.set('owner', owner);
     return u.toString();
   }
-  function updateGhCreateHref() {
-    var a = $('ghCreateBtn');
-    if (a) a.href = githubNewRepoUrl(state.owner, state.repo);
-  }
   function esc(s) {
     return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
       return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
@@ -595,6 +620,7 @@ input[type=text].bad{border-color:var(--err);}
     saveDraft();
     var h = $(panels[step]).querySelector('h1');
     if (h) { h.setAttribute('tabindex', '-1'); h.focus({ preventScroll: false }); }
+    if (step === 2) { syncHome(); ensureRepoAccess(); }
     if (step === 4) renderReview();
   }
 
@@ -622,7 +648,6 @@ input[type=text].bad{border-color:var(--err);}
     if (!state.repoTouched) {
       state.repo = deriveRepo(state.name);
       $('f-repo').value = state.repo;
-      updateGhCreateHref();
     }
     var h = $('h-name');
     if (state.slug) { h.innerHTML = 'its handle on the platform: <code>' + esc(state.slug) + '</code>'; h.className = 'hint'; }
@@ -636,18 +661,143 @@ input[type=text].bad{border-color:var(--err);}
     $('c-green').setAttribute('aria-pressed', String(mode === 'greenfield'));
     $('c-adopt').setAttribute('aria-pressed', String(mode === 'adopt'));
     $('adoptNote').classList.toggle('on', mode === 'adopt');
-    // The "create the repo on GitHub" button only makes sense when starting fresh —
-    // an adopted repo already exists.
-    $('ghCreate').classList.toggle('on', mode === 'greenfield');
-    updateGhCreateHref();
     saveDraft();
+    syncHome();
   }
   $('c-green').addEventListener('click', function () { setMode('greenfield'); });
   $('c-adopt').addEventListener('click', function () { setMode('adopt'); });
   setMode(state.mode);
 
-  $('f-owner').addEventListener('input', function () { state.owner = this.value.trim(); state.ownerTouched = true; updateGhCreateHref(); saveDraft(); });
-  $('f-repo').addEventListener('input', function () { state.repo = this.value.trim(); state.repoTouched = true; updateGhCreateHref(); saveDraft(); });
+  /* ── GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099 / ADR 0143.
+        Progressive enhancement: probe GET /github/repos once we reach step 2.
+          200 → we hold repo access → show the picker (adopt) / name field (fresh);
+          403 → offer to grant repo access (a ?repos=1 re-sign-in);
+          503 (server can't store the token) or any error → the manual inputs.
+        #manualHome (the classic owner/repo fields) is the always-safe fallback. ── */
+  var repoAccess = null;   // null=unknown/loading · true · 'need-connect' · 'unavailable' · 'manual'
+  var repoList = [];       // the user's repos (from the probe) — feeds the picker + the fresh-name clash hint
+  var ghProbed = false;
+
+  function isManualHome() { return repoAccess === 'manual' || repoAccess === 'unavailable'; }
+  function validRepoName(s) { return /^[A-Za-z0-9._-]{1,100}$/.test(String(s || '')); }
+  function myLogin() { return (me && me.github_login) || 'you'; }
+
+  function connectRepos(e) {
+    if (e) e.preventDefault();
+    // Same-tab navigation so the sessionStorage draft round-trips back to step 2.
+    window.location.assign(API + '/auth/web/start?return=/create&repos=1');
+  }
+  $('ghConnectBtn').addEventListener('click', connectRepos);
+  $('ghManualToggle').addEventListener('click', function () { repoAccess = 'manual'; syncHome(); $('f-owner').focus(); });
+
+  function syncHome() {
+    var need = repoAccess === 'need-connect';
+    var ok = repoAccess === true;
+    var adopt = state.mode === 'adopt';
+    $('ghBusy').hidden = !!repoAccess;              // busy only while still probing (null)
+    $('ghConnect').classList.toggle('on', need);    // .reassure box: shown via .on (not hidden — .reassure sets display:none)
+    $('ghAdopt').hidden = !(ok && adopt);
+    $('ghFresh').hidden = !(ok && !adopt);
+    $('manualHome').hidden = !isManualHome();
+    if (need) {
+      $('ghConnectMsg').textContent = adopt
+        ? 'You’re signed in — creating your project needs one more GitHub permission. Allow repo access to pick the repository to adopt.'
+        : 'You’re signed in — creating your project needs one more GitHub permission. Allow repo access and we’ll create the empty repo for you.';
+    }
+    if (ok && adopt) initAdoptPicker();
+    if (ok && !adopt) syncFresh();
+  }
+
+  function syncFresh() {
+    // Fresh + access: the repo is created under the signed-in account. Seed owner for
+    // the review/target now; the create response confirms the real full_name.
+    state.owner = myLogin();
+    $('ghNewName').value = state.repo || '';
+    updateFreshPreview();
+  }
+  function updateFreshPreview() {
+    var hint = $('ghFreshHint');
+    var clash = state.repo && repoList.some(function (r) { return String(r.name).toLowerCase() === state.repo.toLowerCase(); });
+    if (state.repo && !validRepoName(state.repo)) {
+      hint.className = 'hint err'; hint.textContent = 'Use letters, numbers, and . _ - (1–100 chars).';
+    } else if (clash) {
+      hint.className = 'hint err'; hint.innerHTML = 'You already have a repo named <strong>' + esc(state.repo) + '</strong> — pick another name, or adopt it instead.';
+    } else {
+      hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>.';
+    }
+  }
+  $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });
+
+  // The adopt picker behaves like a standard combobox (owner design review, task
+  // 1002247): the dropdown is open only while the visitor is choosing. Selecting a
+  // repo fills the search box with its full_name and collapses the list; focusing or
+  // typing reopens it.
+  function openRepoList() { $('ghList').hidden = false; renderRepoList(); }
+  function closeRepoList() { $('ghList').hidden = true; }
+  function renderRepoList() {
+    var q = ($('ghSearch').value || '').trim().toLowerCase();
+    var sel = state.owner && state.repo ? (state.owner + '/' + state.repo) : '';
+    // When the box just shows the current selection verbatim, list everything (so the
+    // visitor can switch) instead of filtering down to the one selected repo.
+    var effectiveQ = q === sel.toLowerCase() ? '' : q;
+    var rows = repoList.filter(function (r) { return !effectiveQ || String(r.full_name).toLowerCase().indexOf(effectiveQ) >= 0; }).slice(0, 100);
+    $('ghList').innerHTML = rows.length
+      ? rows.map(function (r) {
+          return '<button type="button" class="ghrow" role="option" data-full="' + esc(r.full_name) + '" aria-selected="' + (r.full_name === sel) + '">' +
+            '<span>' + esc(r.full_name) + '</span>' + (r.private ? '<span class="priv">Private</span>' : '') + '</button>';
+        }).join('')
+      : '<div class="hint" style="padding:10px 12px">No repositories match “' + esc(effectiveQ) + '”.</div>';
+  }
+  // Fill the search box with the current selection (if any) and collapse the list;
+  // with nothing chosen yet, open it so the visitor sees their repos right away.
+  function initAdoptPicker() {
+    var sel = state.owner && state.repo ? state.owner + '/' + state.repo : '';
+    // Only treat it as a confirmed pick if it's actually one of the visitor's repos.
+    // owner/repo are auto-derived from the project name, so a bare derived value must
+    // NOT masquerade as a chosen repo — that would collapse the list onto a repo that
+    // may not even exist.
+    var picked = sel && repoList.some(function (r) { return String(r.full_name).toLowerCase() === sel.toLowerCase(); });
+    var h = $('ghAdoptHint');
+    if (picked) {
+      $('ghSearch').value = sel;
+      h.className = 'hint ok'; h.innerHTML = 'Adopting <strong>' + esc(sel) + '</strong>.';
+      closeRepoList();
+    } else {
+      $('ghSearch').value = '';
+      h.className = 'hint'; h.innerHTML = '&nbsp;';
+      openRepoList();
+    }
+  }
+  $('ghSearch').addEventListener('focus', function () { this.select(); openRepoList(); });
+  $('ghSearch').addEventListener('input', openRepoList);
+  $('ghList').addEventListener('click', function (ev) {
+    var row = ev.target.closest('.ghrow'); if (!row) return;
+    var full = row.getAttribute('data-full'); var slash = full.indexOf('/');
+    state.owner = full.slice(0, slash); state.repo = full.slice(slash + 1);
+    state.ownerTouched = true; state.repoTouched = true;   // a real pick — don't let name-derive clobber it
+    saveDraft();
+    $('ghSearch').value = full;                       // pull the choice into the search box …
+    var h = $('ghAdoptHint'); h.className = 'hint ok'; h.innerHTML = 'Adopting <strong>' + esc(full) + '</strong>.';
+    closeRepoList();                                  // … and collapse the dropdown (typical UX)
+  });
+
+  function ensureRepoAccess() {
+    if (ghProbed && repoAccess !== null) return;   // already known this session
+    if (isManualHome()) return;                     // user chose manual — don't nag
+    repoAccess = null; syncHome();                  // show "reading your repos…"
+    fetch(API + '/github/repos', { credentials: 'same-origin' })
+      .then(function (res) {
+        ghProbed = true;
+        if (res.status === 200) return res.json().then(function (d) { repoList = (d && d.repos) || []; repoAccess = true; });
+        if (res.status === 403 || res.status === 401) { repoAccess = 'need-connect'; return; }
+        repoAccess = 'unavailable'; return;         // 503 or anything else → manual fallback
+      })
+      .catch(function () { ghProbed = true; repoAccess = 'unavailable'; })
+      .then(syncHome);
+  }
+
+  $('f-owner').addEventListener('input', function () { state.owner = this.value.trim(); state.ownerTouched = true; saveDraft(); });
+  $('f-repo').addEventListener('input', function () { state.repo = this.value.trim(); state.repoTouched = true; saveDraft(); });
 
   $('f-slug').addEventListener('input', function () {
     state.slugTouched = true;
@@ -675,7 +825,17 @@ input[type=text].bad{border-color:var(--err);}
       return true;
     }
     if (step === 2) {
-      if (!state.owner || !state.repo) { $('h-home').textContent = 'Both owner and repository name are needed.'; $('h-home').className = 'hint err'; return false; }
+      var homeErr = function (msg) { $('h-home').textContent = msg; $('h-home').className = 'hint err'; return false; };
+      if (repoAccess === 'need-connect') return homeErr('Allow GitHub repo access to pick or create your repository — or choose “enter it manually”.');
+      if (repoAccess === true && state.mode !== 'adopt') {
+        // Fresh with access: just the new repo NAME (owner is the signed-in account).
+        if (!validRepoName(state.repo)) return homeErr('Name the new repository (letters, numbers, and . _ -).');
+      } else {
+        // Adopt (picker or manual) and the manual fallback: need a concrete owner + repo.
+        if (!state.owner || !state.repo) {
+          return homeErr(state.mode === 'adopt' && repoAccess === true ? 'Pick one of your repositories.' : 'Both owner and repository name are needed.');
+        }
+      }
       $('h-home').innerHTML = '&nbsp;'; $('h-home').className = 'hint';
       return true;
     }
@@ -725,20 +885,58 @@ input[type=text].bad{border-color:var(--err);}
     return 'Couldn’t file the request: ' + (err && err.message ? err.message : 'something went sideways. Try again.');
   }
 
+  /* Fresh + repo access: auto-create the empty GitHub repo NOW (the commit moment),
+     then hand its real full_name to provisioning. No-op for adopt / manual / no-access.
+     Idempotent across a retry — once created we reuse the stashed full_name so a second
+     click doesn't trip GitHub's 422 "name already exists". Errors set err.gotoHome so
+     the caller bounces the user back to the Home step to fix the name / reconnect. */
+  function ensureFreshRepo() {
+    if (state.mode === 'adopt' || repoAccess !== true) return Promise.resolve();
+    if (state.repoAutoCreated && state.owner && state.repo) return Promise.resolve();
+    return fetch(API + '/github/repos', {
+      method: 'POST', credentials: 'same-origin',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: state.repo })
+    }).then(function (res) {
+      return res.json().catch(function () { return {}; }).then(function (data) {
+        if (res.status === 401 || res.status === 403) {
+          repoAccess = 'need-connect';
+          var e0 = new Error('reconnect'); e0.gotoHome = true;
+          e0.homeMsg = 'Your GitHub authorization expired — reconnect on the Home step to create the repo.';
+          throw e0;
+        }
+        if (!res.ok) {
+          var e = new Error((data.error && (data.error.message || data.error.code)) || ('HTTP ' + res.status));
+          e.data = data;
+          if (data.error && data.error.code === 'name_taken') { e.gotoHome = true; e.homeMsg = data.error.message; }
+          throw e;
+        }
+        var full = data.repo && data.repo.full_name;
+        if (full && full.indexOf('/') > 0) {
+          state.owner = full.slice(0, full.indexOf('/'));
+          state.repo = full.slice(full.indexOf('/') + 1);
+        }
+        state.repoAutoCreated = true; saveDraft();
+      });
+    });
+  }
+
   $('doCreate').addEventListener('click', function () {
     var btn = this;
     var alertBox = $('createAlert');
     alertBox.classList.remove('on');
     btn.disabled = true; btn.textContent = 'Raising it into the sky…';
-    fetch(API + '/provisioning/instances', {
-      method: 'POST', credentials: 'same-origin',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        slug: state.slug,
-        hosting_shape: 'standalone',
-        domain: state.domain || undefined,
-        target_ref: state.owner + '/' + state.repo
-      })
+    ensureFreshRepo().then(function () {
+      return fetch(API + '/provisioning/instances', {
+        method: 'POST', credentials: 'same-origin',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          slug: state.slug,
+          hosting_shape: 'standalone',
+          domain: state.domain || undefined,
+          target_ref: state.owner + '/' + state.repo
+        })
+      });
     }).then(function (res) {
       if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/create'); throw new Error('signing in'); }
       return res.json().catch(function () { return {}; }).then(function (data) {
@@ -761,9 +959,17 @@ input[type=text].bad{border-color:var(--err);}
       startProgress(data.instance && data.instance.id);
     }).catch(function (err) {
       if (String(err && err.message) === 'signing in') return;
+      btn.disabled = false; btn.textContent = 'Create my project';
+      if (err && err.gotoHome) {
+        // A repo-creation problem (name taken / reconnect) — bounce back to the Home
+        // step with the reason, so the user fixes it where the repo is chosen.
+        show(2);
+        $('h-home').textContent = err.homeMsg || 'Please revisit the repository step.';
+        $('h-home').className = 'hint err';
+        return;
+      }
       alertBox.textContent = friendlyCreateError(err);
       alertBox.classList.add('on');
-      btn.disabled = false; btn.textContent = 'Create my project';
     });
   });
 
@@ -786,8 +992,10 @@ input[type=text].bad{border-color:var(--err);}
     var ghIcon = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
     steps.push(adopt
       ? '<li data-onboard-step="github-repo"><b>Layer onto your existing repo</b><p>In your repo run <code style="font-family:var(--font-mono)">bongos init --adopt</code>. It shows a conflict pre-flight and writes <em>nothing</em> until you accept — your files and history stay yours, and your existing backlog is imported. Commit and push.</p></li>'
-      : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
-        '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + ghIcon + 'Create ' + repoLabel + ' on GitHub</a></li>');
+      : (state.repoAutoCreated
+        ? '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — empty and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>'
+        : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+        '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + ghIcon + 'Create ' + repoLabel + ' on GitHub</a></li>'));
     if (!state.domain) {
       steps.push('<li><b>Add a domain you own</b><p>Sign-in on your new instance needs a real domain. When you have one, come back here or ask your hall — the address gets wired in minutes.</p></li>');
     }
@@ -917,31 +1125,14 @@ input[type=text].bad{border-color:var(--err);}
     if (e.key === 'Escape') { e.preventDefault(); exitWizard(); }
   });
 
-  /* ── switch GitHub account from inside the wizard (task 2098) ── you are not
-     locked to the account you entered with: sign out of the Cloud Bongos session,
-     then restart GitHub sign-in so the wizard reloads under whichever account you
-     pick. (To land on a *different* GitHub account, switch accounts on GitHub's
-     side; this un-locks our session so the next sign-in is honored.) */
-  function switchAccount(e) {
-    if (e) e.preventDefault();
-    var back = API + '/auth/web/start?return=/create';
-    fetch(API + '/auth/logout', { method: 'POST', credentials: 'same-origin' })
-      .then(function () { window.location.assign(back); })
-      .catch(function () { window.location.assign(back); });
-  }
-
   /* ── boot: who am I? ── (task 2094: the wizard shows the signed-in identity
         ONLY — never a link into cloud bongos's own builders hall. A project
-        creator enters a hall from their own project's landing, not from here.
-        task 2098: + a "switch account" action so you're not locked in.) ── */
+        creator enters a hall from their own project's landing, not from here.) ── */
   function renderWho() {
     var w = $('who');
     if (me) {
       w.innerHTML = (me.avatar_url ? '<img src="' + esc(me.avatar_url) + '" alt="">' : '') +
-        '<span>' + esc(me.github_login || 'signed in') + '</span>' +
-        '<a href="#" class="switch-acct" id="switchAcct">switch account</a>';
-      var sw = $('switchAcct');
-      if (sw) sw.addEventListener('click', switchAccount);
+        '<span>' + esc(me.github_login || 'signed in') + '</span>';
     } else {
       w.innerHTML = '';
     }
@@ -957,7 +1148,6 @@ input[type=text].bad{border-color:var(--err);}
       if (!state.ownerTouched && !state.owner && me && me.github_login) {
         state.owner = me.github_login;
         $('f-owner').value = state.owner;
-        updateGhCreateHref();
         saveDraft();
       }
       // returning after a create? resume watching that instance instead of a blank wizard

package/public-landing/gate/README.md

@@ -0,0 +1,137 @@
+# Cloud Bongos — landing gate (interactive)
+
+`index.html` is the Cloud Bongos landing experience — a small state machine over one
+self-contained page (`space.css` + `space.js` for the space side; the download scene + its
+drag physics live in the inline `<script>`), built from **drawn ATLA-style sprites**
+(`sprites/*.png` — a `> cloud bongos` terminal, an enter key, a search bar, and download tiles)
+refracting the backdrop through SVG displacement maps.
+
+## The flow (tasks 1721, 1722)
+
+Four body-class views: `view-entry` → `view-space` → `view-download` / `view-detail`.
+
+1. **Entry — type `bongos`, in space** (`#entry`, `view-entry`). Every visit lands here: the
+   `> cloud ▊` terminal floating in the **space sky** (deep-blue → sunrise gradient, drifting
+   clouds), *not* the temple world. Typing `bongos` is the ritual on every visit; the enter key
+   lights, and pressing enter flashes through into the circles. Driven by `space.js`
+   (`entryKey` / `enterSite`), reusing the terminal + enter CSS.
+2. **Space — the circles** (`#space` / `#space-canvas`, `view-space`). A pannable, zoomable sky
+   of project orbs, sized by number of builders, moving as a **living gravity cluster** — every
+   orb attracts every other by its mass (∝ size³), so the field swirls, bodies sling past one
+   another, and a small orb is sometimes briefly caught circling a big one like a moon (task
+   1733; see "The gravity" below). Project data is **inlined** in `space.js` (`PROJECTS`) — Caddy
+   404s `*.json` on staging — so swap in a real registry by changing `PROJECTS` + `layout()`.
+   - **Drag** empty sky to pan · **scroll** to zoom (toward the cursor).
+   - **Hover** an orb for an info card; **click** it to dive in.
+   - **Space bar** opens a search scoped to the orbs **currently in view** (client-side match
+     over name/tagline/tags now; the Claude-backed answer is a dormant seam, `aiAnswer()`, per
+     the "interaction now, AI wired next" decision).
+   - **Click empty sky** drops a new project circle.
+3. **Download — Cloud Bongos' install page** (`#land` in `.stage`, `view-download`). Clicking the
+   Cloud Bongos orb zooms **straight** into the search + download-tiles scene over the
+   temple-world backdrop — **no type-`bongos` gate in between** (that already happened at entry).
+   `space.js` fires `cb:show-download`; the inline script reveals `#land` and runs its drag.
+4. **Detail — other projects** (`#detail`, `view-detail`). Clicking any non-self orb opens a
+   themed "full story — coming soon" page with a link out to its live site.
+
+**ESC** rises from the download or detail page back to the circles (`space.js` → `cb:hide-download`).
+
+## The download scene's elastic-tether drag (task 1534)
+
+Every download sprite (search bar, tiles, wordmark) is draggable. Grab one and it resists like
+it's anchored; pull past the threshold and it snaps free, hovers, then drifts slowly home and
+re-docks, carrying a faint idle bob at rest. The physics is scoped to `.stage`, so it never
+grabs the entry terminal (which `space.js` owns). **This scene is separate from the space
+gravity below — the download interaction is unchanged by task 1733.**
+
+## The space gravity — a living n-body cluster (task 1733)
+
+The project orbs on the **space** view (`view-space`) are a real gravitational simulation, all
+in `space.js`. Each orb is a body with **mass ∝ size³** (more builders → bigger → heavier →
+pulls harder), so the sky behaves like planets, suns and the occasional fleeting moon rather
+than a fixed scatter. Under the hood:
+
+- **Softened Newtonian gravity**, every pair, so a close pass *slings* instead of blowing up
+  (no singularities).
+- A **fixed-timestep leapfrog integrator** (`physStep`) for accurate, energy-stable motion; the
+  frame loop (`tick` → `render`) interpolates between steps for smoothness.
+- **Soft collisions** so discs bounce rather than overlap; a **soft containment well** plus a
+  **band thermostat** keep the swirl bounded and lively *forever* — energy is free to ebb and
+  flow inside a band, and only a runaway collapse or blow-up gets a gentle nudge back.
+- Net drift is removed each step, so the cluster stays centred on screen (and stays put when a
+  visitor adds a new orb, which is flung into the swirl).
+
+Verified stable over a 60-minute headless simulation (no NaN, never off-screen, never
+interpenetrating). It replaced the earlier "drift around fixed anchors" motion.
+
+### Tuning the gravity
+
+All knobs live in the `GRAV` block near the top of `space.js`:
+
+| You want…                            | Edit (in `GRAV`)                                  |
+|--------------------------------------|---------------------------------------------------|
+| Livelier / faster swirl              | `SWIRL` ↑ (or `THERMO_LO` ↑)                       |
+| Calmer, slower motion                | `SWIRL` ↓ / `THERMO_LO` ↓                          |
+| Tighter cluster (less panning)       | `CONTAIN_R` ↓                                      |
+| Stronger pull between orbs           | `G` ↑                                              |
+| Fewer hard slingshots on near-misses | `SOFTEN` ↑                                         |
+| Bouncier contacts (→ elastic)        | `REST` → 1                                         |
+| Sharper size→mass contrast           | lower `R_REF`, or raise the `massFor` exponent     |
+
+Turn it off (freeze the orbs): comment out `initOrbits()` in `layout()` and the
+`requestAnimationFrame(tick)` at the bottom of the IIFE — pan, zoom, hover, dive, search and the
+table all keep working.
+
+> **Live:** password-locked at **staging.cloudbongos.com** (the future landing page, parked
+> for review). Setup + the password live in [`docs/recipes/cloudbongos-staging-gate.md`](../../../docs/recipes/cloudbongos-staging-gate.md).
+> Branding (logo coin / wordmark / mascot / code-glyphs) is still being finished and is
+> intentionally untouched here.
+
+## Preview it locally
+
+The page links to art one folder up (`../world/assets/…`), so it must be served from the
+**`brand/cloud-bongos/`** folder — not from `gate/` itself, or those paths break.
+
+**Easiest (Claude Code preview):** start the `gate-preview` server in `.claude/launch.json`,
+then open `http://127.0.0.1:8137/gate/index.html`.
+
+**From a terminal** (repo root): `python3 -m http.server --directory brand/cloud-bongos 8137`,
+then open <http://127.0.0.1:8137/gate/index.html>.
+
+Use a Chromium browser (Chrome/Edge) — the live-glass refraction relies on `backdrop-filter`
+with an SVG displacement map. Safari ignores the displacement and falls back to a plain
+frost, which still looks fine.
+
+## Tuning the drag
+
+All behaviour is in the single `<script>` at the bottom of `index.html`, which opens with a
+commented **TUNING** block. Common tweaks:
+
+| You want…                                | Edit (in the TUNING block)        |
+|------------------------------------------|-----------------------------------|
+| Harder / easier to pull a pane free      | `THRESHOLD` — ↑ harder, ↓ easier  |
+| How far a tap can move before it's a drag | `DEADZONE` — px                   |
+| Freed panes wait longer before returning | `HOVER` — milliseconds            |
+| Slower, more drifty return               | `DRIFT_MAXV` — ↓ slower           |
+| Wider, more wandering return path        | `WMAG` ↑ and/or `TURN` ↓          |
+| More / less idle "breathing"             | `BOB_X`, `BOB_Y` (px) — `0` = off |
+
+### Which elements are draggable
+
+The drag targets **`.mark`** (the wordmark) + every **`.el`** sprite pane (terminal, enter,
+search, tiles). To add one, give it the `el` class (or push it into the `els` array); to
+exclude one, filter it out of `els`.
+
+### Why it does not fight the other animations
+
+The drag only ever applies `transform: translate(…)` to each pane, and it owns that property
+exclusively — so the float/reveal animations were replaced by the drag's own idle bob, and
+the enter key's reveal uses opacity + blur only (no transform). The **scene** transforms
+(the dive's scale/translate) live on the parent `.gate`/`.land` containers, so they compose
+with the per-pane drag instead of clobbering it. When a scene settles, `measure()` re-runs
+so a freshly-revealed pane drags from the right home.
+
+### Turn the drag off
+
+Delete the second `<script>` IIFE (the drag) — the type→dive interaction and all the art
+keep working untouched.