@bongos/core 1.19.137 → 1.19.139

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.137",
-  "core_contract": "1.19.137",
-  "source_commit": "9fa1fb193ed67e42c77580783b8d46b43dfc04cd",
+  "core_version": "1.19.139",
+  "core_contract": "1.19.139",
+  "source_commit": "f5c30a288b3d2e438db66a6c80a845c6d389c3b7",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T14:29:50.076Z",
+  "built_at": "2026-08-15T15:00:38.021Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1574,
-  "tree_sha256": "106a541f9d1c75255cd4bf29b2cb87f60cb07a6f413f81d3a27f0b7887eaa200",
+  "tree_sha256": "a3c1891b3b817e057662118da1da9b7952ea9c428344f02c4fbc87cf15fb468f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "82ff1180ef9d22a39f2ea3af15eecd26e9598c7c98d85b501030ab8c67566e7e"
+      "sha256": "82837d1851e437e93bd6027ad59f49e9b1cff5fe4cbc0ba6d1bb8685b243308d"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "a60b9403891192d3338e76f313135db3bec75a8205920c839b6bdb5a95b40661"
+      "sha256": "eddbbbd8e503347796b3df0c99c4891a15815c91d86223cc19384bde1e1abec1"
     },
     {
       "path": "public-docs/index.html",
@@ -4437,7 +4437,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "ac866c928701c41ac7f055f8807590a3db71eb2538502a54a6fca9ac1d79868d"
+      "sha256": "1cc492c8b781bd67f284d3fbcb3d2d46a7159dc6de8af3fb92e2b5589e4f7b10"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "d4b3ac997a8dbf4acfdda32a4b62622908fdc87fcef6dbbfa563d49b76be34ce"
+      "sha256": "599d420de3284de8a307b0ab87a3506faa8f3e3c9f0014d5bdd36bdeaa1a7317"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7312,7 +7312,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "ee5c944f9e3bd3d618c977e76d4e2ba3e663ce59bf7833f9427a0191717ba57d"
+      "sha256": "5a3f724b4e84324d7560254517612b45fd4e4e31e57ebbb0b35a4021d712df6b"
     },
     {
       "path": "tests/provision.mjs",
@@ -7352,7 +7352,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "7f2fe0290fc0a429b54ca53d449453e9009a57e40bb8003b2718beef33be2309"
+      "sha256": "d0907a08d6b932d25df7b143e82c94d64a15eab66a7bd1df86ba85b1729661b7"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.137",
+  "version": "1.19.139",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.137",
+      "version": "1.19.139",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.137",
+  "version": "1.19.139",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -1438,9 +1438,16 @@ h1[tabindex="-1"]:focus{outline:none;}
     setView('mine');
     tryAnchor();   /* the list may already be rendered from an earlier visit */
   }
+  /* Card-shell lookup by instance id. CSS.escape, not esc(): the data-inst
+     attribute holds the DECODED value, so an HTML-escaped id would never match
+     — and raw interpolation is selector injection. esc() stays correct for
+     RENDERING data-inst into markup; this is the only selector path. */
+  function liFor(id) {
+    return document.querySelector('li[data-inst="' + CSS.escape(String(id == null ? '' : id)) + '"]');
+  }
   function tryAnchor() {
     if (!pendingAnchor) return;
-    var li = document.querySelector('li[data-inst="' + pendingAnchor + '"]');
+    var li = liFor(pendingAnchor);
     if (!li) return;
     pendingAnchor = null;
     /* a search or state filter that hides the target would turn the anchor
@@ -2668,7 +2675,7 @@ h1[tabindex="-1"]:focus{outline:none;}
           : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
       }
       var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
-      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the name already filled in), press <strong>Create repository</strong>, and leave it completely empty. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the owner and name already filled in), press <strong>Create repository</strong>, and leave it completely empty. It must land at exactly ' + repoLabel + ' — leave GitHub’s Owner box as prefilled (your personal account), because the build watches that exact address; a repo created under a different owner (an organization, say) is never found. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
         '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Create ' + repoLabel + ' on GitHub</a></li>';
     }
 
@@ -3112,7 +3119,7 @@ h1[tabindex="-1"]:focus{outline:none;}
     var shown = 0;
     Object.keys(byId).forEach(function (id) {
       var inst = byId[id];
-      var li = document.querySelector('[data-inst="' + esc(String(id)) + '"]');
+      var li = liFor(id);
       if (!li) return;
       var keep = (mineFilter === 'all' || groupFor(inst) === mineFilter) &&
                  (!q || findText(inst).indexOf(q) !== -1);
@@ -3379,10 +3386,11 @@ h1[tabindex="-1"]:focus{outline:none;}
   }
 
   function renderCard(inst) {
-    /* ids are server-generated, but escape anyway — every interpolated field in
-       this file goes through esc(), no exceptions (the grader's rule is right) */
+    /* iid is for MARKUP interpolation only (esc() = HTML escape); the DOM
+       lookup goes through liFor(), which CSS-escapes — the two escapes are
+       not interchangeable */
     var iid = esc(String(inst.id));
-    var li = document.querySelector('[data-inst="' + iid + '"]');
+    var li = liFor(inst.id);
     if (!li) return;
     var gone = inst.status === 'torn_down';
     li.className = 'proj' + (gone ? ' gone' : '');

package/src/module-api.js

@@ -701,8 +701,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.135 with no explicit bump. run 31889474899. (task 1002620)
 //   1.19.137 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.136 with no explicit bump. run 31890033301. (task 1002620)
+//   1.19.138 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.137 with no explicit bump. run 31891128524. (task 1002620)
+//   1.19.139 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.138 with no explicit bump. run 31891461224. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.137'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.139'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -765,6 +765,23 @@ test('an owned orb\'s job is manage, not the public site', () => {
     'the orb route key must not collide with the manage list\'s card identity');
 });
 
+test('the card-shell lookup CSS-escapes the id — HTML-escape never reaches a selector (task 1002893)', () => {
+  const fn = (SCRIPT.match(/function liFor\(([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'liFor() must be extractable');
+  assert.match(fn, /CSS\.escape\(/, 'the selector path escapes with CSS.escape, not esc()');
+  // liFor is the ONLY data-inst selector site — esc() belongs to markup
+  // rendering, where it stays; a second selector site could quietly restore
+  // the esc()-in-selector (or no-escape) shape this test exists to kill
+  const sel = SCRIPT.match(/\[data-inst="' \+/g) || [];
+  assert.equal(sel.length, 1, 'exactly one data-inst selector concatenation (inside liFor)');
+  assert.match(SCRIPT, /\[data-inst="' \+ CSS\.escape\(/, 'and that one site CSS-escapes');
+  // the two prior wrong shapes, by name
+  assert.doesNotMatch(SCRIPT, /\[data-inst="' \+ esc\(/,
+    'an HTML-escaped id must never be interpolated into a selector');
+  assert.doesNotMatch(SCRIPT, /\[data-inst="' \+ pendingAnchor/,
+    'raw interpolation into a selector is the injection-shaped site');
+});
+
 test('the orb chip is the manage list\'s truth, never a second story (C6)', () => {
   const orbs = (SCRIPT.match(/function renderOrbs\(([\s\S]*?)\n  \}/) || [, ''])[1];
   // exactly ONE chip site, and it defers to chipFor() — a second site could

package/tests/public_landing_projects.mjs

@@ -117,6 +117,21 @@ test('the empty state points a new owner at the wizard view — never at a hall'
   assert.doesNotMatch(body, /Enter the Hall/i);
 });
 
+test('the manual-repo step states placement and visibility — the owner never has to ask', async () => {
+  // QA walk F7 (task 1002702 → 1002721, owner firsthand): the "Create the empty
+  // GitHub repo" step never said WHERE the repo lands, and the owner had to ask
+  // "is there somewhere specific I should set it up?" mid-walk. The step must
+  // say the repo belongs at the exact prefilled owner/name (changing GitHub's
+  // Owner dropdown strands the build watching the wrong address) and must state
+  // the visibility choice up front, before GitHub's own radio is the first
+  // mention.
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /Owner box/, 'the step must name GitHub’s Owner box and say to leave it as prefilled');
+  assert.match(body, /exact address|exactly[^<]*repoLabel|land at exactly/,
+    'the step must say the build watches the exact owner/name');
+  assert.match(body, /public or private/i, 'visibility must be stated in our copy, not first seen on GitHub');
+});
+
 test('teardown copy states what the runner actually does, per hosting shape (F17)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   // the DECIDED policy: shared shapes keep the database; a dedicated machine