@bongos/core 1.19.104 → 1.19.105

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.104",
-  "core_contract": "1.19.104",
-  "source_commit": "3c2a0481a031c30a0afdd9294b2510373ffe960f",
+  "core_version": "1.19.105",
+  "core_contract": "1.19.105",
+  "source_commit": "e17befb90a1b0010369b049bfe92c597f46feaa1",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T00:14:10.093Z",
+  "built_at": "2026-08-14T00:47:52.457Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 301,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1558,
-  "tree_sha256": "8257863293fa7660b41b1617777db22fadd851349106de278c846a482dd31a66",
+  "tree_sha256": "0bd2c06a8df30c32d74aae5a437dc8e71707e2201560e7275d066136aa1f0a63",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4147,12 +4147,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ef0ed51dd00b72093c6deac7c061dc0fddf88b0135d2d1981c00d37cdb7a9345"
+      "sha256": "1180a81b8034f5e25bb1da6370b91e69575b653dc6f459e16d20dc6764c38e71"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "64f2fc25cfe4707562314bef85b1a22c3b3027e6b43d74644fd37fbc61daa539"
+      "sha256": "ebcbf2f1c4b4479c82525349cb2f2aacf659c80eab6876112947bff44600b718"
     },
     {
       "path": "public-docs/index.html",
@@ -4412,7 +4412,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "f70211d0d2bfe21fa7000ab82d0adcaa97df1f28763e366965da2b92847b31b6"
+      "sha256": "9e6d99f0a54a6189f7295b799c3061c4b23b69569d15e0dd1e1d2e6e8c8671fc"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5727,7 +5727,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c8a86a1c119d7da3b4baf912eb2d228f83be18b07fbce6c104858a00027efbda"
+      "sha256": "452383073e87173fa0a4f56df5a3a126ab888807dd416df4939ba951a0a0cf43"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7252,7 +7252,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "d8fd9759b99b2136f8b438727b74b15346db7cbd8f0ef8b67aec3049f059df2b"
+      "sha256": "d57dbc4d5b06d2302211d73d1d41c7edf025b38fca433b30df37cf8afc898da9"
     },
     {
       "path": "tests/provision.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.104",
+  "version": "1.19.105",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.104",
+      "version": "1.19.105",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.104",
+  "version": "1.19.105",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -159,22 +159,6 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       </div>
       <div class="hintbar"><span><kbd>click a project</kbd> open it</span></div>
     </div>
-
-    <!-- The project card. An OVERLAY inside the map, not a fourth view: opening
-         a project must not cost you the sky you were reading (direction §9).
-         Real markup, never JS-built (C7) — the same reason every other view
-         ships as markup — so its copy is in the document and its ids are stable.
-         Filled by openCard(); it carries no project identity of its own. -->
-    <div class="cardScrim" id="cardScrim" hidden>
-      <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName">
-        <button type="button" class="cardX" id="cardClose" aria-label="Close">✕</button>
-        <span class="cardDot" id="cardDot"></span>
-        <h3 id="cardName"></h3>
-        <p class="cardTag" id="cardTag"></p>
-        <p class="cardRel" id="cardRel" hidden></p>
-        <div class="cardActions" id="cardActions"></div>
-      </div>
-    </div>
   </div>
 
   <div class="wrap viewWrap" id="sub-table-body" hidden>
@@ -208,6 +192,30 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
     </table>
     <p class="finePrint" style="text-align:center">Click a column to sort.</p>
   </div>
+
+  <!-- The project card. An OVERLAY inside the map, not a fourth view: opening
+       a project must not cost you the sky you were reading (direction §9).
+       Real markup, never JS-built (C7) — the same reason every other view
+       ships as markup — so its copy is in the document and its ids are stable.
+       Filled by openCard(); it carries no project identity of its own.
+
+       IT MUST STAY A SIBLING OF THE TWO SUB-VIEWS, never a child of either.
+       It shipped inside #sub-sky-body, which the table view sets `hidden` on —
+       and `[hidden]{display:none !important}` means every descendant stops
+       generating a box, so the card opened at 0x0 in table view and was simply
+       never seen. position:fixed does not rescue an element inside a
+       display:none ancestor. It worked in sky view, which is the default and
+       where it was built, so nothing noticed (task 1002780). -->
+  <div class="cardScrim" id="cardScrim" hidden>
+    <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName">
+      <button type="button" class="cardX" id="cardClose" aria-label="Close">✕</button>
+      <span class="cardDot" id="cardDot"></span>
+      <h3 id="cardName"></h3>
+      <p class="cardTag" id="cardTag"></p>
+      <p class="cardRel" id="cardRel" hidden></p>
+      <div class="cardActions" id="cardActions"></div>
+    </div>
+  </div>
 </section>
 
 <!-- ══════════════════ VIEW · YOUR PROJECTS ════════════════════════════════ -->

package/src/module-api.js

@@ -635,8 +635,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.102 with no explicit bump. run 31754659965. (task 1002620)
 //   1.19.104 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.103 with no explicit bump. run 31756625919. (task 1002620)
+//   1.19.105 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.104 with no explicit bump. run 31758526405. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.104'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.105'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -453,3 +453,67 @@ test('the platform answers for itself by the same rule it applies to others', ()
   assert.match(SCRIPT, /function loadSelfStats/);
   assert.match(SCRIPT, /-system\$/, 'machine accounts are excluded here too, or the platform inflates itself');
 });
+
+
+/* ── The card must RENDER in both sub-views (task 1002780) ──────────────────
+   It shipped nested inside #sub-sky-body. The table view sets `hidden` on that
+   container, and [hidden]{display:none !important} stops every descendant
+   generating a box — so the card "opened" at 0x0 and was never seen. Every
+   property said open; only the geometry disagreed.
+
+   The first attempt at this fix deleted #sub-sky-body's closing tag, which
+   re-parented everything after it and left the bug in place while LOOKING
+   fixed — regex-proximity checks passed on the broken file. These tests walk
+   the real tag depth instead. ── */
+
+function mapSection(html) {
+  const open = html.indexOf('<section id="view-map">');
+  assert.ok(open !== -1, 'view-map section must exist');
+  return html.slice(open, html.indexOf('<section id="view-mine"'));
+}
+
+test('the map section closes every div it opens', () => {
+  // an unclosed div is invisible to a regex check and to `hidden`-flag
+  // assertions alike, and silently re-parents everything after it
+  const map = mapSection(HUB);
+  const opens = (map.match(/<div\b/g) || []).length;
+  const closes = (map.match(/<\/div>/g) || []).length;
+  assert.equal(opens, closes, 'unbalanced divs re-parent the nodes that follow');
+});
+
+// Walk the real tag structure and return the ids of every element still OPEN
+// where `needle` appears. Depth-tracking, NOT regex proximity: the first
+// version of this test took the next `</div>` as proof the outer div had
+// closed, accepted an inner one, and passed on the still-broken file.
+function openAncestorsAt(html, needle) {
+  const at = html.indexOf(needle);
+  assert.ok(at !== -1, needle + ' not found');
+  const stack = [];
+  const tag = /<(\/?)(div|section)\b([^>]*)>/g;
+  let m;
+  while ((m = tag.exec(html)) !== null && m.index < at) {
+    if (m[1] === '/') stack.pop();
+    else if (!m[3].trim().endsWith('/')) {
+      const id = (m[3].match(/id="([^"]+)"/) || [, null])[1];
+      stack.push(id);
+    }
+  }
+  return stack.filter(Boolean);
+}
+
+test('no container the view router hides may be an ancestor of the card', () => {
+  const ancestors = openAncestorsAt(HUB, 'id="cardScrim"');
+  for (const hidden of ['sub-sky-body', 'sub-table-body']) {
+    assert.ok(!ancestors.includes(hidden),
+      '#' + hidden + ' is toggled hidden — the card cannot live inside it. open: ' + ancestors.join(' > '));
+  }
+  assert.ok(ancestors.includes('view-map'), 'it is still the overlay of the map view');
+});
+
+test('the table body is a sibling of the sky wrapper, not nested inside it', () => {
+  // the same defect seen from the other side — a missing close tag re-parents
+  // the table itself, which is what the first fix attempt actually did
+  const ancestors = openAncestorsAt(HUB, 'id="sub-table-body"');
+  assert.ok(!ancestors.includes('sub-sky-body'),
+    'the table must not sit inside the sky wrapper. open: ' + ancestors.join(' > '));
+});