@bongos/core 1.18.0 → 1.18.3

package/modules/status-ui/public/explore.html

@@ -0,0 +1,54 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Explore — featured projects</title>
+  <style>
+    /* Self-contained so the showcase renders correctly whether or not the host
+       injects theme tokens. Warm Cloud Bongos defaults; overridable by the pack. */
+    :root {
+      --bg: #fff7ed; --card: #ffffff; --ink: #2a1f17; --ink-soft: #6b5d52;
+      --rule: #fed7aa; --accent: #ea580c;
+    }
+    * { box-sizing: border-box; }
+    body {
+      margin: 0; padding: 2.5rem 1.25rem 4rem;
+      background: var(--bg); color: var(--ink);
+      font-family: "Quicksand", system-ui, -apple-system, "Segoe UI", sans-serif;
+      line-height: 1.5;
+    }
+    .wrap { max-width: 960px; margin: 0 auto; }
+    header { text-align: center; margin-bottom: 2.5rem; }
+    h1 { font-size: 2rem; margin: 0 0 .35rem; letter-spacing: .01em; }
+    .sub { color: var(--ink-soft); margin: 0; }
+    .grid { display: grid; gap: 1rem; grid-template-columns: repeat(auto-fill, minmax(260px, 1fr)); }
+    .card {
+      background: var(--card); border: 1px solid var(--rule); border-radius: 14px;
+      padding: 1.1rem 1.2rem; text-decoration: none; color: inherit;
+      display: flex; flex-direction: column; gap: .4rem; transition: transform .12s ease, box-shadow .12s ease;
+    }
+    .card:hover { transform: translateY(-2px); box-shadow: 0 6px 20px rgba(234,88,12,.12); }
+    .card h2 { font-size: 1.15rem; margin: 0; }
+    .card p { margin: 0; color: var(--ink-soft); font-size: .95rem; }
+    .card .origin { color: var(--accent); font-size: .82rem; word-break: break-all; margin-top: auto; }
+    .card .art { width: 100%; height: 120px; object-fit: cover; border-radius: 10px; margin-bottom: .3rem; }
+    .empty, .err { text-align: center; color: var(--ink-soft); padding: 3rem 1rem; }
+    @media (prefers-color-scheme: dark) {
+      :root { --bg: #1a1410; --card: #241c16; --ink: #f5ece3; --ink-soft: #b9a998; --rule: #4a3728; }
+    }
+  </style>
+</head>
+<body>
+  <div class="wrap">
+    <header>
+      <h1>Explore</h1>
+      <p class="sub">Featured projects built on the platform.</p>
+    </header>
+    <div id="grid" class="grid" hidden></div>
+    <div id="empty" class="empty" hidden>No featured projects yet — check back soon.</div>
+    <div id="err" class="err" hidden>Couldn't load projects right now.</div>
+  </div>
+  <script src="/explore.js"></script>
+</body>
+</html>

package/modules/status-ui/public/explore.js

@@ -0,0 +1,67 @@
+// explore.js — the public Explore showcase (ADR 0141 §5, task #1002110). Fetches the
+// hub's featured projects and renders cards. On a NON-hub instance (platform-identity
+// off) the endpoint 404s / returns nothing, so the page shows a graceful empty state.
+//
+// Project fields come from the network, so every value is set via textContent /
+// attribute assignment — never innerHTML — so a project name/tagline can't inject markup.
+(function () {
+  'use strict';
+  var grid = document.getElementById('grid');
+  var empty = document.getElementById('empty');
+  var err = document.getElementById('err');
+
+  function show(el) { if (el) el.hidden = false; }
+
+  // Only http(s) origins are linkified — never javascript:/data: etc.
+  function safeHref(origin) {
+    try {
+      var u = new URL(String(origin));
+      return (u.protocol === 'https:' || u.protocol === 'http:') ? u.toString() : null;
+    } catch (_) { return null; }
+  }
+
+  function card(p) {
+    var href = safeHref(p.origin);
+    var el = document.createElement(href ? 'a' : 'div');
+    el.className = 'card';
+    if (href) { el.href = href; el.target = '_blank'; el.rel = 'noopener noreferrer'; }
+
+    if (p.art_url && safeHref(p.art_url)) {
+      var img = document.createElement('img');
+      img.className = 'art';
+      img.src = p.art_url;
+      img.alt = '';
+      img.loading = 'lazy';
+      el.appendChild(img);
+    }
+    var h = document.createElement('h2');
+    h.textContent = p.name || p.origin || 'Untitled project';
+    el.appendChild(h);
+    if (p.tagline) {
+      var tag = document.createElement('p');
+      tag.textContent = p.tagline;
+      el.appendChild(tag);
+    }
+    if (p.origin) {
+      var o = document.createElement('span');
+      o.className = 'origin';
+      o.textContent = String(p.origin).replace(/^https?:\/\//, '');
+      el.appendChild(o);
+    }
+    return el;
+  }
+
+  fetch('/api/gds/projects/featured', { headers: { Accept: 'application/json' } })
+    .then(function (r) { if (!r.ok) throw new Error('http ' + r.status); return r.json(); })
+    .then(function (data) {
+      var projects = (data && Array.isArray(data.projects)) ? data.projects : [];
+      if (projects.length === 0) { show(empty); return; }
+      projects.forEach(function (p) { grid.appendChild(card(p)); });
+      show(grid);
+    })
+    .catch(function () {
+      // A missing endpoint (non-hub instance) is not an error to the visitor — show
+      // the empty state rather than a scary failure.
+      show(empty);
+    });
+}());

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.18.0",
+  "version": "1.18.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.18.0",
+      "version": "1.18.3",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.18.0",
+  "version": "1.18.3",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/create.html

@@ -29,6 +29,13 @@
   --font-mono:"Fira Code",ui-monospace,SFMono-Regular,Menlo,monospace;
 }
 *{box-sizing:border-box;margin:0;padding:0;}
+/* The `hidden` attribute must always win. Several blocks below set an explicit
+   `display` via a class (.field→block, .row2→grid); an author rule like that
+   silently defeats the user-agent [hidden] rule, so `el.hidden = true` fails to
+   hide them. The Home step (task 1002228) toggles el.hidden to switch between the
+   adopt-picker / fresh-name / manual sub-panels — without this they ALL render at
+   once. Make hidden authoritative for the whole page. */
+[hidden]{display:none !important;}
 html{scroll-behavior:smooth;}
 body{
   font-family:var(--font-body); color:var(--ink);
@@ -327,6 +334,16 @@ input[type=text].bad{border-color:var(--err);}
 @media (prefers-reduced-motion:reduce){
   *,*::before,*::after{animation:none !important;transition:none !important;}
 }
+/* GitHub repo picker (task 1002099) */
+.linklike{background:none;border:0;padding:0;margin-left:12px;color:var(--accent-deep);font:inherit;font-size:13px;cursor:pointer;text-decoration:underline;}
+#ghConnect .btn{margin-top:4px;}
+.ghlist{margin-top:8px;max-height:220px;overflow-y:auto;border:1px solid var(--line,#e7d8c4);border-radius:10px;background:var(--bg-deep,#fff);}
+.ghlist:empty{display:none;}
+.ghrow{display:flex;align-items:center;gap:8px;width:100%;text-align:left;background:none;border:0;border-bottom:1px solid rgba(42,31,23,0.06);padding:9px 12px;font:inherit;font-size:13.5px;color:var(--ink,#2a1f17);cursor:pointer;}
+.ghrow:last-child{border-bottom:0;}
+.ghrow:hover{background:#fff9f2;}
+.ghrow[aria-selected=true]{background:#fff3e6;box-shadow:inset 3px 0 0 var(--accent,#f97316);font-weight:600;}
+.ghrow .priv{margin-left:auto;font-size:11px;font-weight:600;color:var(--ink-faint,#9b8a78);background:rgba(42,31,23,0.06);border-radius:5px;padding:1px 6px;}
 </style>
 </head>
 <body>
@@ -405,7 +422,31 @@ input[type=text].bad{border-color:var(--err);}
           </button>
         </div>
         <div class="reassure" id="adoptNote">Adopting never overwrites your files: you get a conflict pre-flight first, nothing is written until you accept, and your existing backlog (issues, TODOs) is imported as real tasks.</div>
-        <div class="row2">
+
+        <!-- GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099.
+             Progressive enhancement: when the signed-in user grants repo access we let
+             them PICK a repo (adopt) or NAME one we auto-create (fresh). Without that
+             access — not granted yet, or the server can't store the token — we fall back
+             to the manual owner/repo inputs below (#manualHome), which stay authoritative. -->
+        <div id="ghConnect" class="reassure">
+          <p id="ghConnectMsg">&nbsp;</p>
+          <button type="button" class="btn" id="ghConnectBtn">Connect GitHub</button>
+          <button type="button" class="linklike" id="ghManualToggle">or enter it manually</button>
+        </div>
+        <div id="ghBusy" class="hint" hidden>Reading your GitHub repositories…</div>
+        <div id="ghAdopt" class="field" hidden>
+          <span>Pick one of your repositories</span>
+          <input type="text" id="ghSearch" placeholder="Search your repos…" autocomplete="off">
+          <div id="ghList" class="ghlist" role="listbox" aria-label="Your repositories"></div>
+          <div class="hint" id="ghAdoptHint">&nbsp;</div>
+        </div>
+        <div id="ghFresh" class="field" hidden>
+          <span>New repository name</span>
+          <input type="text" id="ghNewName" placeholder="mercury" autocomplete="off" maxlength="100">
+          <div class="hint" id="ghFreshHint">We’ll create an empty repo at <code id="ghFreshPreview" style="font-family:var(--font-mono)">github.com/you/mercury</code>.</div>
+        </div>
+
+        <div class="row2" id="manualHome">
           <label class="field"><span>GitHub owner <small>(user or org)</small></span>
             <input type="text" id="f-owner" placeholder="acme" autocomplete="off" maxlength="60">
           </label>
@@ -595,6 +636,7 @@ input[type=text].bad{border-color:var(--err);}
     saveDraft();
     var h = $(panels[step]).querySelector('h1');
     if (h) { h.setAttribute('tabindex', '-1'); h.focus({ preventScroll: false }); }
+    if (step === 2) { syncHome(); ensureRepoAccess(); }
     if (step === 4) renderReview();
   }
 
@@ -641,11 +683,108 @@ input[type=text].bad{border-color:var(--err);}
     $('ghCreate').classList.toggle('on', mode === 'greenfield');
     updateGhCreateHref();
     saveDraft();
+    syncHome();
   }
   $('c-green').addEventListener('click', function () { setMode('greenfield'); });
   $('c-adopt').addEventListener('click', function () { setMode('adopt'); });
   setMode(state.mode);
 
+  /* ── GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099 / ADR 0143.
+        Progressive enhancement: probe GET /github/repos once we reach step 2.
+          200 → we hold repo access → show the picker (adopt) / name field (fresh);
+          403 → offer "Connect GitHub" (a ?repos=1 re-sign-in);
+          503 (server can't store the token) or any error → the manual inputs.
+        #manualHome (the classic owner/repo fields) is the always-safe fallback. ── */
+  var repoAccess = null;   // null=unknown/loading · true · 'need-connect' · 'unavailable' · 'manual'
+  var repoList = [];       // the user's repos (from the probe) — feeds the picker + the fresh-name clash hint
+  var ghProbed = false;
+
+  function isManualHome() { return repoAccess === 'manual' || repoAccess === 'unavailable'; }
+  function validRepoName(s) { return /^[A-Za-z0-9._-]{1,100}$/.test(String(s || '')); }
+  function myLogin() { return (me && me.github_login) || 'you'; }
+
+  function connectRepos(e) {
+    if (e) e.preventDefault();
+    // Same-tab navigation so the sessionStorage draft round-trips back to step 2.
+    window.location.assign(API + '/auth/web/start?return=/create&repos=1');
+  }
+  $('ghConnectBtn').addEventListener('click', connectRepos);
+  $('ghManualToggle').addEventListener('click', function () { repoAccess = 'manual'; syncHome(); $('f-owner').focus(); });
+
+  function syncHome() {
+    var need = repoAccess === 'need-connect';
+    var ok = repoAccess === true;
+    var adopt = state.mode === 'adopt';
+    $('ghBusy').hidden = !!repoAccess;              // busy only while still probing (null)
+    $('ghConnect').classList.toggle('on', need);    // .reassure box: shown via .on (not hidden — .reassure sets display:none)
+    $('ghAdopt').hidden = !(ok && adopt);
+    $('ghFresh').hidden = !(ok && !adopt);
+    $('manualHome').hidden = !isManualHome();
+    if (need) {
+      $('ghConnectMsg').textContent = adopt
+        ? 'Connect your GitHub account and pick the repository to adopt.'
+        : 'Connect your GitHub account and we’ll create the empty repo for you.';
+    }
+    if (ok && adopt) renderRepoList();
+    if (ok && !adopt) syncFresh();
+  }
+
+  function syncFresh() {
+    // Fresh + access: the repo is created under the signed-in account. Seed owner for
+    // the review/target now; the create response confirms the real full_name.
+    state.owner = myLogin();
+    $('ghNewName').value = state.repo || '';
+    updateFreshPreview();
+  }
+  function updateFreshPreview() {
+    var hint = $('ghFreshHint');
+    var clash = state.repo && repoList.some(function (r) { return String(r.name).toLowerCase() === state.repo.toLowerCase(); });
+    if (state.repo && !validRepoName(state.repo)) {
+      hint.className = 'hint err'; hint.textContent = 'Use letters, numbers, and . _ - (1–100 chars).';
+    } else if (clash) {
+      hint.className = 'hint err'; hint.innerHTML = 'You already have a repo named <strong>' + esc(state.repo) + '</strong> — pick another name, or adopt it instead.';
+    } else {
+      hint.className = 'hint'; hint.innerHTML = 'We’ll create an empty repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>.';
+    }
+  }
+  $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });
+
+  function renderRepoList() {
+    var q = ($('ghSearch').value || '').trim().toLowerCase();
+    var rows = repoList.filter(function (r) { return !q || String(r.full_name).toLowerCase().indexOf(q) >= 0; }).slice(0, 100);
+    var sel = state.owner && state.repo ? (state.owner + '/' + state.repo) : '';
+    $('ghList').innerHTML = rows.length
+      ? rows.map(function (r) {
+          return '<button type="button" class="ghrow" role="option" data-full="' + esc(r.full_name) + '" aria-selected="' + (r.full_name === sel) + '">' +
+            '<span>' + esc(r.full_name) + '</span>' + (r.private ? '<span class="priv">Private</span>' : '') + '</button>';
+        }).join('')
+      : '<div class="hint" style="padding:10px 12px">No repositories match “' + esc(q) + '”.</div>';
+  }
+  $('ghSearch').addEventListener('input', renderRepoList);
+  $('ghList').addEventListener('click', function (ev) {
+    var row = ev.target.closest('.ghrow'); if (!row) return;
+    var full = row.getAttribute('data-full'); var slash = full.indexOf('/');
+    state.owner = full.slice(0, slash); state.repo = full.slice(slash + 1);
+    saveDraft();
+    Array.prototype.forEach.call($('ghList').querySelectorAll('.ghrow'), function (b) { b.setAttribute('aria-selected', String(b === row)); });
+    var h = $('ghAdoptHint'); h.className = 'hint ok'; h.innerHTML = 'Adopting <strong>' + esc(full) + '</strong>.';
+  });
+
+  function ensureRepoAccess() {
+    if (ghProbed && repoAccess !== null) return;   // already known this session
+    if (isManualHome()) return;                     // user chose manual — don't nag
+    repoAccess = null; syncHome();                  // show "reading your repos…"
+    fetch(API + '/github/repos', { credentials: 'same-origin' })
+      .then(function (res) {
+        ghProbed = true;
+        if (res.status === 200) return res.json().then(function (d) { repoList = (d && d.repos) || []; repoAccess = true; });
+        if (res.status === 403 || res.status === 401) { repoAccess = 'need-connect'; return; }
+        repoAccess = 'unavailable'; return;         // 503 or anything else → manual fallback
+      })
+      .catch(function () { ghProbed = true; repoAccess = 'unavailable'; })
+      .then(syncHome);
+  }
+
   $('f-owner').addEventListener('input', function () { state.owner = this.value.trim(); state.ownerTouched = true; updateGhCreateHref(); saveDraft(); });
   $('f-repo').addEventListener('input', function () { state.repo = this.value.trim(); state.repoTouched = true; updateGhCreateHref(); saveDraft(); });
 
@@ -675,7 +814,17 @@ input[type=text].bad{border-color:var(--err);}
       return true;
     }
     if (step === 2) {
-      if (!state.owner || !state.repo) { $('h-home').textContent = 'Both owner and repository name are needed.'; $('h-home').className = 'hint err'; return false; }
+      var homeErr = function (msg) { $('h-home').textContent = msg; $('h-home').className = 'hint err'; return false; };
+      if (repoAccess === 'need-connect') return homeErr('Connect GitHub to pick or create your repository — or choose “enter it manually”.');
+      if (repoAccess === true && state.mode !== 'adopt') {
+        // Fresh with access: just the new repo NAME (owner is the signed-in account).
+        if (!validRepoName(state.repo)) return homeErr('Name the new repository (letters, numbers, and . _ -).');
+      } else {
+        // Adopt (picker or manual) and the manual fallback: need a concrete owner + repo.
+        if (!state.owner || !state.repo) {
+          return homeErr(state.mode === 'adopt' && repoAccess === true ? 'Pick one of your repositories.' : 'Both owner and repository name are needed.');
+        }
+      }
       $('h-home').innerHTML = '&nbsp;'; $('h-home').className = 'hint';
       return true;
     }
@@ -725,20 +874,58 @@ input[type=text].bad{border-color:var(--err);}
     return 'Couldn’t file the request: ' + (err && err.message ? err.message : 'something went sideways. Try again.');
   }
 
+  /* Fresh + repo access: auto-create the empty GitHub repo NOW (the commit moment),
+     then hand its real full_name to provisioning. No-op for adopt / manual / no-access.
+     Idempotent across a retry — once created we reuse the stashed full_name so a second
+     click doesn't trip GitHub's 422 "name already exists". Errors set err.gotoHome so
+     the caller bounces the user back to the Home step to fix the name / reconnect. */
+  function ensureFreshRepo() {
+    if (state.mode === 'adopt' || repoAccess !== true) return Promise.resolve();
+    if (state.repoAutoCreated && state.owner && state.repo) return Promise.resolve();
+    return fetch(API + '/github/repos', {
+      method: 'POST', credentials: 'same-origin',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ name: state.repo })
+    }).then(function (res) {
+      return res.json().catch(function () { return {}; }).then(function (data) {
+        if (res.status === 401 || res.status === 403) {
+          repoAccess = 'need-connect';
+          var e0 = new Error('reconnect'); e0.gotoHome = true;
+          e0.homeMsg = 'Your GitHub authorization expired — reconnect on the Home step to create the repo.';
+          throw e0;
+        }
+        if (!res.ok) {
+          var e = new Error((data.error && (data.error.message || data.error.code)) || ('HTTP ' + res.status));
+          e.data = data;
+          if (data.error && data.error.code === 'name_taken') { e.gotoHome = true; e.homeMsg = data.error.message; }
+          throw e;
+        }
+        var full = data.repo && data.repo.full_name;
+        if (full && full.indexOf('/') > 0) {
+          state.owner = full.slice(0, full.indexOf('/'));
+          state.repo = full.slice(full.indexOf('/') + 1);
+        }
+        state.repoAutoCreated = true; saveDraft();
+      });
+    });
+  }
+
   $('doCreate').addEventListener('click', function () {
     var btn = this;
     var alertBox = $('createAlert');
     alertBox.classList.remove('on');
     btn.disabled = true; btn.textContent = 'Raising it into the sky…';
-    fetch(API + '/provisioning/instances', {
-      method: 'POST', credentials: 'same-origin',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        slug: state.slug,
-        hosting_shape: 'standalone',
-        domain: state.domain || undefined,
-        target_ref: state.owner + '/' + state.repo
-      })
+    ensureFreshRepo().then(function () {
+      return fetch(API + '/provisioning/instances', {
+        method: 'POST', credentials: 'same-origin',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          slug: state.slug,
+          hosting_shape: 'standalone',
+          domain: state.domain || undefined,
+          target_ref: state.owner + '/' + state.repo
+        })
+      });
     }).then(function (res) {
       if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/create'); throw new Error('signing in'); }
       return res.json().catch(function () { return {}; }).then(function (data) {
@@ -761,9 +948,17 @@ input[type=text].bad{border-color:var(--err);}
       startProgress(data.instance && data.instance.id);
     }).catch(function (err) {
       if (String(err && err.message) === 'signing in') return;
+      btn.disabled = false; btn.textContent = 'Create my project';
+      if (err && err.gotoHome) {
+        // A repo-creation problem (name taken / reconnect) — bounce back to the Home
+        // step with the reason, so the user fixes it where the repo is chosen.
+        show(2);
+        $('h-home').textContent = err.homeMsg || 'Please revisit the repository step.';
+        $('h-home').className = 'hint err';
+        return;
+      }
       alertBox.textContent = friendlyCreateError(err);
       alertBox.classList.add('on');
-      btn.disabled = false; btn.textContent = 'Create my project';
     });
   });
 
@@ -786,8 +981,10 @@ input[type=text].bad{border-color:var(--err);}
     var ghIcon = '<svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>';
     steps.push(adopt
       ? '<li data-onboard-step="github-repo"><b>Layer onto your existing repo</b><p>In your repo run <code style="font-family:var(--font-mono)">bongos init --adopt</code>. It shows a conflict pre-flight and writes <em>nothing</em> until you accept — your files and history stay yours, and your existing backlog is imported. Commit and push.</p></li>'
-      : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
-        '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + ghIcon + 'Create ' + repoLabel + ' on GitHub</a></li>');
+      : (state.repoAutoCreated
+        ? '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — empty and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>'
+        : '<li data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+        '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + ghIcon + 'Create ' + repoLabel + ' on GitHub</a></li>'));
     if (!state.domain) {
       steps.push('<li><b>Add a domain you own</b><p>Sign-in on your new instance needs a real domain. When you have one, come back here or ask your hall — the address gets wired in minutes.</p></li>');
     }

package/scripts/gds/cli-lib.js

@@ -27,10 +27,16 @@ const SESSION_READ_PATHS = [
   ...ic.configReadPaths('gds-session.json'),
   ...ic.configReadPaths('pms-session.json'),
 ];
-// Default to live production. Override with <PREFIX>_API_BASE for local dev:
+// The last-resort default API base — THIS instance's own publicOrigin from the
+// branding pack (task 1002201). One source of truth in instance-config so no CLI
+// script hard-codes another instance's URL; pre-ADR-0139 the literal
+// 'https://amazonprimea.com' was baked in at four sites here, so an unconfigured
+// consumer targeted the founder's (game-only) box. Override with <PREFIX>_API_BASE
+// for local dev / staging:
 //   CLOUDBONGOS_API_BASE=http://localhost:3000 node scripts/gds/start.js
 // Resolves the configured prefix first, then legacy GDS_/OTB_/PMS_API_BASE.
-const API_BASE = ic.resolveEnv('API_BASE') || 'https://amazonprimea.com';
+const DEFAULT_API_BASE = ic.defaultApiBase();
+const API_BASE = ic.resolveEnv('API_BASE') || DEFAULT_API_BASE;
 
 async function readSessionFile(p) {
   try {
@@ -102,7 +108,7 @@ function readSessionToken() {
   if (!j || !j.token) return null;
   return {
     token: j.token,
-    apiBase: ic.resolveEnv('API_BASE') || j.api_base || 'https://amazonprimea.com',
+    apiBase: ic.resolveEnv('API_BASE') || j.api_base || DEFAULT_API_BASE,
   };
 }
 
@@ -278,7 +284,7 @@ async function apiCall(method, urlPath, body = null, opts = {}) {
   // (local dev / staging override), then the logged-in instance, then prod. OTB
   // sessions already store api_base='https://amazonprimea.com', so this is a no-op
   // for the OTB instance and only bites once someone logs in to a different one.
-  const base = ic.resolveEnv('API_BASE') || (session && session.api_base) || 'https://amazonprimea.com';
+  const base = ic.resolveEnv('API_BASE') || (session && session.api_base) || DEFAULT_API_BASE;
   const headers = {
     'Content-Type': 'application/json',
     'User-Agent': 'amazonprimea-gds-cli/1.0',
@@ -349,7 +355,7 @@ async function cliClient(opts = {}) {
       printInstanceMismatchAndExit(mm);
     }
   }
-  const base = ic.resolveEnv('API_BASE') || (session && session.api_base) || 'https://amazonprimea.com';
+  const base = ic.resolveEnv('API_BASE') || (session && session.api_base) || DEFAULT_API_BASE;
   const token = (session && session.token) || null;
   const key = `${base}|${token || ''}|${allowUnauthenticated}|${allowBoxScope}`;
   if (_clientCache.has(key)) return _clientCache.get(key);

package/scripts/gds/lint-migrations.js

@@ -0,0 +1,102 @@
+#!/usr/bin/env node
+'use strict';
+// scripts/gds/lint-migrations.js — core-migration FORWARD-SAFETY guard (task 1002223 / audit H10,
+// finding F6).
+//
+// `bongos upgrade` auto-rollback reverts the CODE pin but DELIBERATELY NOT the database
+// (upgrade.js: "the DB is deliberately NOT rolled back … core migrations are additive + forward-
+// safe"). That safety rested on a convention nothing checked. A core migration is FORWARD-SAFE when
+// the PREVIOUS code version still runs against the post-migration schema — so a code-only rollback
+// never strands old code on a schema it can't read. This lints core migrations for operations that
+// BREAK that property and fails unless the migration explicitly acknowledges the exception with a
+//   -- forward-unsafe: <reason>
+// pragma (a deliberate, documented decision — e.g. a historical migration, or one paired with a
+// two-step deploy).
+//
+// SAFE (never flagged): CREATE TABLE/INDEX/…, ADD COLUMN, INSERT/UPDATE, and DROP-then-CREATE of an
+// INDEX / TRIGGER / VIEW / FUNCTION / POLICY (the recreate-in-place idempotency pattern) — none of
+// these remove state the old code depends on.
+// UNSAFE (flagged): DROP TABLE, DROP COLUMN, RENAME COLUMN, ALTER TABLE … RENAME TO, ALTER COLUMN …
+// TYPE, SET NOT NULL — each removes / renames / retypes existing state old code reads.
+//
+// Usage:
+//   node scripts/gds/lint-migrations.js                 # STRICT: exit 1 on any unacknowledged unsafe migration
+//   node scripts/gds/lint-migrations.js --warn          # report only, always exit 0 (migrate.sh uses this)
+//   node scripts/gds/lint-migrations.js --dir <path>    # scan a specific migrations dir (default: <repo>/migrations)
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+
+// The acknowledgement pragma. Lives in a SQL comment; matched on the raw file text.
+const ACK_RE = /^\s*--\s*forward-unsafe\s*:\s*(.+)$/im;
+
+// Genuinely forward-unsafe statement shapes. Ordered; a file matching ANY is unsafe.
+const UNSAFE = [
+  ['drop-table', /\bdrop\s+table\b/i],
+  ['drop-column', /\bdrop\s+column\b/i],
+  ['rename-column', /\brename\s+column\b/i],
+  ['rename-table', /\balter\s+table\s+[^\s;]+\s+rename\s+to\b/i],
+  ['alter-column-type', /\balter\s+column\b[^;]*\btype\b/i],
+  ['set-not-null', /\bset\s+not\s+null\b/i],
+];
+
+// Strip block + line comments so a pattern that appears only in prose/comments never counts as an
+// operation. (The ACK pragma is detected separately, on the raw text, since it IS a comment.)
+function stripSqlComments(sql) {
+  return String(sql).replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/--[^\n]*/g, ' ');
+}
+
+// Classify one migration's SQL: { unsafe: [names], acknowledged: bool, ackReason }.
+function scanMigrationSql(sql) {
+  const code = stripSqlComments(sql);
+  const unsafe = [];
+  for (const [name, re] of UNSAFE) if (re.test(code)) unsafe.push(name);
+  const ack = String(sql).match(ACK_RE);
+  return { unsafe, acknowledged: !!ack, ackReason: ack ? ack[1].trim() : null };
+}
+
+// Scan a migrations directory. Returns { violations, acknowledged } — each entry { file, unsafe, ackReason }.
+// `violations` = unsafe WITHOUT the pragma (fail-closed); `acknowledged` = unsafe WITH it (documented).
+function scanMigrationsDir(dir, fsImpl = fs) {
+  let files;
+  try { files = fsImpl.readdirSync(dir).filter((f) => f.endsWith('.sql')); }
+  catch { return { violations: [], acknowledged: [], scanned: 0 }; }
+  const violations = [];
+  const acknowledged = [];
+  for (const f of files.sort()) {
+    const r = scanMigrationSql(fsImpl.readFileSync(path.join(dir, f), 'utf8'));
+    if (r.unsafe.length === 0) continue;
+    (r.acknowledged ? acknowledged : violations).push({ file: f, unsafe: r.unsafe, ackReason: r.ackReason });
+  }
+  return { violations, acknowledged, scanned: files.length };
+}
+
+function arg(name, fallback = null) {
+  const i = process.argv.indexOf(name);
+  return i >= 0 && i + 1 < process.argv.length ? process.argv[i + 1] : fallback;
+}
+
+function main() {
+  const warnOnly = process.argv.includes('--warn');
+  const dir = path.resolve(arg('--dir', path.join(REPO_ROOT, 'migrations')));
+  const { violations, acknowledged, scanned } = scanMigrationsDir(dir);
+
+  for (const a of acknowledged) {
+    console.error(`[migrations] forward-unsafe (acknowledged): ${a.file} [${a.unsafe.join(', ')}] — ${a.ackReason}`);
+  }
+  if (violations.length === 0) {
+    console.error(`[migrations] forward-safety: OK — ${scanned} core migration(s) scanned, ${acknowledged.length} acknowledged exception(s), 0 unacknowledged.`);
+    return 0;
+  }
+  console.error(`[migrations] forward-safety: ${warnOnly ? 'WARNING' : 'FAILED'} — ${violations.length} core migration(s) contain a forward-UNSAFE operation with no acknowledgement:`);
+  for (const v of violations) console.error(`   ${v.file} [${v.unsafe.join(', ')}]`);
+  console.error('   A code-only `bongos upgrade` rollback does NOT revert the DB, so old code would run on this schema.');
+  console.error('   If intentional, add a top-of-file SQL comment:  -- forward-unsafe: <why it is safe here / the two-step plan>');
+  return warnOnly ? 0 : 1;
+}
+
+module.exports = { scanMigrationSql, scanMigrationsDir, stripSqlComments, UNSAFE, ACK_RE };
+
+if (require.main === module) process.exit(main());