@bongos/core 1.19.138 → 1.19.140

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.138",
-  "core_contract": "1.19.138",
-  "source_commit": "c881ff7b166e960c529748049090f53ad17276c8",
+  "core_version": "1.19.140",
+  "core_contract": "1.19.140",
+  "source_commit": "10935aeebedec72d8090e9be8f6d261d3b44d787",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T14:53:14.334Z",
+  "built_at": "2026-08-15T15:07:34.061Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1574,
-  "tree_sha256": "09b573285811157440bc46ef823f8ae2adf4735d9a0d559e656a7a68793a0bdf",
+  "tree_sha256": "bff52e93502be3347f11913b68eb9807f14d6181c7e9f85788de9f4d21fa9c64",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "b3bd34c7f961631c76f810499e202ecf7ff7b28beb3933da63fd89be5b684e6b"
+      "sha256": "9a8f370c9664f4d95d9030a91829796d447c7bd2e0e5f19d7be9f34ee4f9e305"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "470274822238a12b1ad33021c5c9fc233f69beefdb30730fc7208257e01a11ef"
+      "sha256": "3dab4531988ec5a8632934a63ca42c7872e899c878ffd75a85ba4ef9e0bbf806"
     },
     {
       "path": "public-docs/index.html",
@@ -4437,7 +4437,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "060cfd1249c09576e634c7c84c8470207cf55b93cb0719cc89821c8c59aa2a17"
+      "sha256": "1c7cb3f54e177325c60a713a3f9219ce4349be229a3638f67319484f11cfef07"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b5bbd063bab04b41b5fa8769f2c8de1e0919c28be09bcdf45345ff9440558205"
+      "sha256": "ce6bcfa96110ae47a5098b08b574d9f8d015acfca354db31cd438c68362b3027"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7312,7 +7312,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "ee5c944f9e3bd3d618c977e76d4e2ba3e663ce59bf7833f9427a0191717ba57d"
+      "sha256": "5a3f724b4e84324d7560254517612b45fd4e4e31e57ebbb0b35a4021d712df6b"
     },
     {
       "path": "tests/provision.mjs",
@@ -7352,7 +7352,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "d0907a08d6b932d25df7b143e82c94d64a15eab66a7bd1df86ba85b1729661b7"
+      "sha256": "5760a59ccce395dbc3ac7bb49df58db3acac2954ab83b345b557233bb3381e12"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.138",
+  "version": "1.19.140",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.138",
+      "version": "1.19.140",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.138",
+  "version": "1.19.140",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -1438,9 +1438,16 @@ h1[tabindex="-1"]:focus{outline:none;}
     setView('mine');
     tryAnchor();   /* the list may already be rendered from an earlier visit */
   }
+  /* Card-shell lookup by instance id. CSS.escape, not esc(): the data-inst
+     attribute holds the DECODED value, so an HTML-escaped id would never match
+     — and raw interpolation is selector injection. esc() stays correct for
+     RENDERING data-inst into markup; this is the only selector path. */
+  function liFor(id) {
+    return document.querySelector('li[data-inst="' + CSS.escape(String(id == null ? '' : id)) + '"]');
+  }
   function tryAnchor() {
     if (!pendingAnchor) return;
-    var li = document.querySelector('li[data-inst="' + pendingAnchor + '"]');
+    var li = liFor(pendingAnchor);
     if (!li) return;
     pendingAnchor = null;
     /* a search or state filter that hides the target would turn the anchor
@@ -2925,11 +2932,36 @@ h1[tabindex="-1"]:focus{outline:none;}
                  : 'Raising the server, database, and address — nothing needed from you.',
           '', revive ? 'revive' : 'standup');
       } else if (s === 'active') {
+        /* Live lights on a VERIFIED answer, not on script completion (direction
+           §7): the strip keys on the same last_verified_* overlay the manage
+           list's chips read. null is deliberately distinct from false — a fresh
+           standup stays unprobed for up to a sweep interval and must not read
+           as a failure. */
         var addr = inst.domain ? 'https://' + inst.domain : null;
-        el.innerHTML = progressMarkup(-1, 3,
-          'Your project is up' + (addr ? ' — <a href="' + esc(addr) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>' : '') +
-          '. Finish the steps below and the hall is yours.', 'isLive');
-        return true;
+        var link = addr ? '<a href="' + esc(addr) + '" target="_blank" rel="noopener">' + esc(inst.domain) + '</a>' : null;
+        var flow = revive ? 'revive' : 'standup';
+        if (!addr) {
+          /* domainless instances are never probed — there is no address to
+             answer at, so a verified answer can never arrive; say what IS true
+             instead of promising the hall (sign-in stays locked without one) */
+          el.innerHTML = progressMarkup(-1, 3,
+            'The build finished — your project is standing, but it has no address yet, so sign-in can’t be wired up. Attach a domain any time from <a href="?view=mine">your projects page</a>; the steps below that need one unlock then.', 'isLive', flow);
+          return true;
+        }
+        if (inst.last_verified_up === false) {
+          el.innerHTML = progressMarkup(2, 2,
+            'The build finished, but ' + link + ' isn’t answering right now — this panel keeps checking.', '', flow);
+          return false;
+        }
+        if (inst.last_verified_up) {
+          el.innerHTML = progressMarkup(-1, 3,
+            'Your project is answering at ' + link + '. Finish the steps below and the hall is yours.', 'isLive', flow);
+          return true;
+        }
+        /* null: standing, not checked yet — keep watching until the first probe */
+        el.innerHTML = progressMarkup(2, 2,
+          'The build finished — checking that ' + link + ' answers…', '', flow);
+        return false;
       } else if (s === 'error') {
         /* the honest snag (direction §5 / F19): no raw stderr as the headline, no
            false "keeps retrying" — retries stop, and the retry door is the mine view */
@@ -3112,7 +3144,7 @@ h1[tabindex="-1"]:focus{outline:none;}
     var shown = 0;
     Object.keys(byId).forEach(function (id) {
       var inst = byId[id];
-      var li = document.querySelector('[data-inst="' + esc(String(id)) + '"]');
+      var li = liFor(id);
       if (!li) return;
       var keep = (mineFilter === 'all' || groupFor(inst) === mineFilter) &&
                  (!q || findText(inst).indexOf(q) !== -1);
@@ -3379,10 +3411,11 @@ h1[tabindex="-1"]:focus{outline:none;}
   }
 
   function renderCard(inst) {
-    /* ids are server-generated, but escape anyway — every interpolated field in
-       this file goes through esc(), no exceptions (the grader's rule is right) */
+    /* iid is for MARKUP interpolation only (esc() = HTML escape); the DOM
+       lookup goes through liFor(), which CSS-escapes — the two escapes are
+       not interchangeable */
     var iid = esc(String(inst.id));
-    var li = document.querySelector('[data-inst="' + iid + '"]');
+    var li = liFor(inst.id);
     if (!li) return;
     var gone = inst.status === 'torn_down';
     li.className = 'proj' + (gone ? ' gone' : '');

package/src/module-api.js

@@ -703,8 +703,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.136 with no explicit bump. run 31890033301. (task 1002620)
 //   1.19.138 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.137 with no explicit bump. run 31891128524. (task 1002620)
+//   1.19.139 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.138 with no explicit bump. run 31891461224. (task 1002620)
+//   1.19.140 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.139 with no explicit bump. run 31891805999. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.138'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.140'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -765,6 +765,23 @@ test('an owned orb\'s job is manage, not the public site', () => {
     'the orb route key must not collide with the manage list\'s card identity');
 });
 
+test('the card-shell lookup CSS-escapes the id — HTML-escape never reaches a selector (task 1002893)', () => {
+  const fn = (SCRIPT.match(/function liFor\(([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'liFor() must be extractable');
+  assert.match(fn, /CSS\.escape\(/, 'the selector path escapes with CSS.escape, not esc()');
+  // liFor is the ONLY data-inst selector site — esc() belongs to markup
+  // rendering, where it stays; a second selector site could quietly restore
+  // the esc()-in-selector (or no-escape) shape this test exists to kill
+  const sel = SCRIPT.match(/\[data-inst="' \+/g) || [];
+  assert.equal(sel.length, 1, 'exactly one data-inst selector concatenation (inside liFor)');
+  assert.match(SCRIPT, /\[data-inst="' \+ CSS\.escape\(/, 'and that one site CSS-escapes');
+  // the two prior wrong shapes, by name
+  assert.doesNotMatch(SCRIPT, /\[data-inst="' \+ esc\(/,
+    'an HTML-escaped id must never be interpolated into a selector');
+  assert.doesNotMatch(SCRIPT, /\[data-inst="' \+ pendingAnchor/,
+    'raw interpolation into a selector is the injection-shaped site');
+});
+
 test('the orb chip is the manage list\'s truth, never a second story (C6)', () => {
   const orbs = (SCRIPT.match(/function renderOrbs\(([\s\S]*?)\n  \}/) || [, ''])[1];
   // exactly ONE chip site, and it defers to chipFor() — a second site could

package/tests/public_landing_projects.mjs

@@ -160,6 +160,22 @@ test('the done panel reads the open intent — a queued revive is never told to
   assert.match(body, /\.prog\.flowDown/, 'the .prog strip has the teardown palette (transcribed from .strip.flowDown)');
 });
 
+test('the done panel lights Live on a verified answer, never on status alone (task 1002895)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function renderProgress\(inst\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'renderProgress() must be extractable');
+  assert.match(fn, /last_verified_up/, 'the strip reads the verification overlay, not status alone');
+  // the three honest rungs: verified, failed probe, and never-probed —
+  // null is deliberately distinct from false and must not read as a failure
+  assert.match(fn, /answering at/i, 'verified speaks the list view\'s language');
+  assert.match(fn, /isn’t answering right now/, 'a failed probe is spoken, never painted green');
+  assert.match(fn, /checking that/, 'the never-probed instance gets its own calm rung');
+  // gap row 8: domainless is never probed at all — it states its truth instead
+  // of promising the hall (sign-in stays locked without an address)
+  assert.match(fn, /no address yet/, 'the domainless path cannot fall into an unverified hole');
+  assert.doesNotMatch(fn, /Your project is up/, 'the status-alone headline is dead');
+});
+
 test('the address row surfaces the manual-DNS note the runner recorded (F16)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /inst\.dns_note/, 'the card reads the dns_note the runner writes');