@bongos/core 1.19.104 → 1.19.106

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.104",
-  "core_contract": "1.19.104",
-  "source_commit": "3c2a0481a031c30a0afdd9294b2510373ffe960f",
+  "core_version": "1.19.106",
+  "core_contract": "1.19.106",
+  "source_commit": "9c4d81635ba2c3b6781454fef02a2b4fd03c313a",
   "source_ref": "HEAD",
-  "built_at": "2026-08-14T00:14:10.093Z",
+  "built_at": "2026-08-14T01:02:38.447Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 301,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1558,
-  "tree_sha256": "8257863293fa7660b41b1617777db22fadd851349106de278c846a482dd31a66",
+  "tree_sha256": "8dc050d8d7110c73665132a52cad7e280ab1b8db7053b35778cd87c03a4d9b6e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4147,12 +4147,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "ef0ed51dd00b72093c6deac7c061dc0fddf88b0135d2d1981c00d37cdb7a9345"
+      "sha256": "5ac251e031cc6f47a48545e288edb4c894b5832a1a27f80c4ff39abf23f17517"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "64f2fc25cfe4707562314bef85b1a22c3b3027e6b43d74644fd37fbc61daa539"
+      "sha256": "ecc9e5581a436fcf4bafb8d8d9d64f688884d0344f7c484e5cfeadace6f4a198"
     },
     {
       "path": "public-docs/index.html",
@@ -4412,7 +4412,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "f70211d0d2bfe21fa7000ab82d0adcaa97df1f28763e366965da2b92847b31b6"
+      "sha256": "e9fd91527dd347041b35701f67fe4b245e99ec0cbe015a98bbae24cb9fcfea52"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5727,7 +5727,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "c8a86a1c119d7da3b4baf912eb2d228f83be18b07fbce6c104858a00027efbda"
+      "sha256": "20c85ad2a6dc6be87060b034fb9aaa10712463f9f12164d836588f8a28cf3caf"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7252,7 +7252,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "d8fd9759b99b2136f8b438727b74b15346db7cbd8f0ef8b67aec3049f059df2b"
+      "sha256": "1671466fb3301b1b549835ff7e7466a1374079a470f58773cdeddbe81ba3b478"
     },
     {
       "path": "tests/provision.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.104",
+  "version": "1.19.106",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.104",
+      "version": "1.19.106",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.104",
+  "version": "1.19.106",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -159,22 +159,6 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
       </div>
       <div class="hintbar"><span><kbd>click a project</kbd> open it</span></div>
     </div>
-
-    <!-- The project card. An OVERLAY inside the map, not a fourth view: opening
-         a project must not cost you the sky you were reading (direction §9).
-         Real markup, never JS-built (C7) — the same reason every other view
-         ships as markup — so its copy is in the document and its ids are stable.
-         Filled by openCard(); it carries no project identity of its own. -->
-    <div class="cardScrim" id="cardScrim" hidden>
-      <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName">
-        <button type="button" class="cardX" id="cardClose" aria-label="Close">✕</button>
-        <span class="cardDot" id="cardDot"></span>
-        <h3 id="cardName"></h3>
-        <p class="cardTag" id="cardTag"></p>
-        <p class="cardRel" id="cardRel" hidden></p>
-        <div class="cardActions" id="cardActions"></div>
-      </div>
-    </div>
   </div>
 
   <div class="wrap viewWrap" id="sub-table-body" hidden>
@@ -201,13 +185,37 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
           <td class="right num" id="selfBuilders">—</td>
           <td class="colTags" id="selfTags">—</td>
           <td class="right colStatus"><span class="chip calm"><span class="cdot"></span>—</span></td>
-          <td class="colGo"><a class="btn small ghost" href="#" data-self-open>Open →</a></td>
+          <td class="colGo"><a class="btn small ghost" href="/">Open →</a></td>
         </tr>
         <!--apex-only:end-->
       </tbody>
     </table>
     <p class="finePrint" style="text-align:center">Click a column to sort.</p>
   </div>
+
+  <!-- The project card. An OVERLAY inside the map, not a fourth view: opening
+       a project must not cost you the sky you were reading (direction §9).
+       Real markup, never JS-built (C7) — the same reason every other view
+       ships as markup — so its copy is in the document and its ids are stable.
+       Filled by openCard(); it carries no project identity of its own.
+
+       IT MUST STAY A SIBLING OF THE TWO SUB-VIEWS, never a child of either.
+       It shipped inside #sub-sky-body, which the table view sets `hidden` on —
+       and `[hidden]{display:none !important}` means every descendant stops
+       generating a box, so the card opened at 0x0 in table view and was simply
+       never seen. position:fixed does not rescue an element inside a
+       display:none ancestor. It worked in sky view, which is the default and
+       where it was built, so nothing noticed (task 1002780). -->
+  <div class="cardScrim" id="cardScrim" hidden>
+    <div class="projCard" id="projCard" role="dialog" aria-modal="true" aria-labelledby="cardName">
+      <button type="button" class="cardX" id="cardClose" aria-label="Close">✕</button>
+      <span class="cardDot" id="cardDot"></span>
+      <h3 id="cardName"></h3>
+      <p class="cardTag" id="cardTag"></p>
+      <p class="cardRel" id="cardRel" hidden></p>
+      <div class="cardActions" id="cardActions"></div>
+    </div>
+  </div>
 </section>
 
 <!-- ══════════════════ VIEW · YOUR PROJECTS ════════════════════════════════ -->

package/src/module-api.js

@@ -635,8 +635,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.102 with no explicit bump. run 31754659965. (task 1002620)
 //   1.19.104 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.103 with no explicit bump. run 31756625919. (task 1002620)
+//   1.19.105 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.104 with no explicit bump. run 31758526405. (task 1002620)
+//   1.19.106 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.105 with no explicit bump. run 31759315328. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.104'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.106'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -453,3 +453,91 @@ test('the platform answers for itself by the same rule it applies to others', ()
   assert.match(SCRIPT, /function loadSelfStats/);
   assert.match(SCRIPT, /-system\$/, 'machine accounts are excluded here too, or the platform inflates itself');
 });
+
+
+/* ── The card must RENDER in both sub-views (task 1002780) ──────────────────
+   It shipped nested inside #sub-sky-body. The table view sets `hidden` on that
+   container, and [hidden]{display:none !important} stops every descendant
+   generating a box — so the card "opened" at 0x0 and was never seen. Every
+   property said open; only the geometry disagreed.
+
+   The first attempt at this fix deleted #sub-sky-body's closing tag, which
+   re-parented everything after it and left the bug in place while LOOKING
+   fixed — regex-proximity checks passed on the broken file. These tests walk
+   the real tag depth instead. ── */
+
+function mapSection(html) {
+  const open = html.indexOf('<section id="view-map">');
+  assert.ok(open !== -1, 'view-map section must exist');
+  return html.slice(open, html.indexOf('<section id="view-mine"'));
+}
+
+test('the map section closes every div it opens', () => {
+  // an unclosed div is invisible to a regex check and to `hidden`-flag
+  // assertions alike, and silently re-parents everything after it
+  const map = mapSection(HUB);
+  const opens = (map.match(/<div\b/g) || []).length;
+  const closes = (map.match(/<\/div>/g) || []).length;
+  assert.equal(opens, closes, 'unbalanced divs re-parent the nodes that follow');
+});
+
+// Walk the real tag structure and return the ids of every element still OPEN
+// where `needle` appears. Depth-tracking, NOT regex proximity: the first
+// version of this test took the next `</div>` as proof the outer div had
+// closed, accepted an inner one, and passed on the still-broken file.
+function openAncestorsAt(html, needle) {
+  const at = html.indexOf(needle);
+  assert.ok(at !== -1, needle + ' not found');
+  const stack = [];
+  const tag = /<(\/?)(div|section)\b([^>]*)>/g;
+  let m;
+  while ((m = tag.exec(html)) !== null && m.index < at) {
+    if (m[1] === '/') stack.pop();
+    else if (!m[3].trim().endsWith('/')) {
+      const id = (m[3].match(/id="([^"]+)"/) || [, null])[1];
+      stack.push(id);
+    }
+  }
+  return stack.filter(Boolean);
+}
+
+test('no container the view router hides may be an ancestor of the card', () => {
+  const ancestors = openAncestorsAt(HUB, 'id="cardScrim"');
+  for (const hidden of ['sub-sky-body', 'sub-table-body']) {
+    assert.ok(!ancestors.includes(hidden),
+      '#' + hidden + ' is toggled hidden — the card cannot live inside it. open: ' + ancestors.join(' > '));
+  }
+  assert.ok(ancestors.includes('view-map'), 'it is still the overlay of the map view');
+});
+
+test('the table body is a sibling of the sky wrapper, not nested inside it', () => {
+  // the same defect seen from the other side — a missing close tag re-parents
+  // the table itself, which is what the first fix attempt actually did
+  const ancestors = openAncestorsAt(HUB, 'id="sub-table-body"');
+  assert.ok(!ancestors.includes('sub-sky-body'),
+    'the table must not sit inside the sky wrapper. open: ' + ancestors.join(' > '));
+});
+
+/* ── The self row's Open goes somewhere (task 1002777) ──────────────────────
+   Task 1002760's static self row shipped its action cell as href="#" with a
+   `data-self-open` hook nobody ever wired. The row-click handler deliberately
+   ignores clicks inside an <a> so real links keep their jobs — but this link
+   had no job, so the click was swallowed AND went nowhere. ── */
+
+test('the self row Open is a real link home, not an unwired hook', () => {
+  const selfRow = (HUB.match(/<tr id="selfRow">([\s\S]*?)<\/tr>/) || [, ''])[1];
+  assert.match(selfRow, /<a[^>]*href="\/"[^>]*>Open/,
+    'the platform project IS this site — its Open navigates to /');
+  assert.doesNotMatch(selfRow, /target=/,
+    'a new tab for the page you are already on is a bug, not a courtesy');
+  assert.doesNotMatch(HUB, /data-self-open/, 'the never-wired hook must not survive');
+});
+
+test('no anchor in the table ships a placeholder href', () => {
+  // href="#" is the shape of this bug: a dead link wearing button clothes
+  const table = (HUB.match(/<table[\s\S]*?<\/table>/) || [''])[0];
+  assert.ok(table, 'the table must be findable');
+  assert.doesNotMatch(table, /href="#"/, 'no anchor in the table may ship href="#"');
+  const generated = (SCRIPT.match(/return '<tr data-generated([\s\S]*?)'<\/tr>';/) || [, ''])[1];
+  assert.doesNotMatch(generated, /href="#"/, 'generated rows must not ship placeholders either');
+});