@bongos/core 1.19.140 → 1.19.141

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.140",
-  "core_contract": "1.19.140",
-  "source_commit": "10935aeebedec72d8090e9be8f6d261d3b44d787",
+  "core_version": "1.19.141",
+  "core_contract": "1.19.141",
+  "source_commit": "b945e540f7d2e847172a7d529a393ef7ed3cd181",
   "source_ref": "HEAD",
-  "built_at": "2026-08-15T15:07:34.061Z",
+  "built_at": "2026-08-15T15:22:10.867Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 303,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1574,
-  "tree_sha256": "bff52e93502be3347f11913b68eb9807f14d6181c7e9f85788de9f4d21fa9c64",
+  "tree_sha256": "ebfb642cad8b628d4485648012f4b179c33923d35f37dd4f4be28e87245f99b9",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4177,12 +4177,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "9a8f370c9664f4d95d9030a91829796d447c7bd2e0e5f19d7be9f34ee4f9e305"
+      "sha256": "e2dbef1b10a02d42af480300fa0be08f86312d8be984a64e1f0522f5f70b1152"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "3dab4531988ec5a8632934a63ca42c7872e899c878ffd75a85ba4ef9e0bbf806"
+      "sha256": "624eb72a1cc5d8f63b33038e823818c93159c0f92351f011c88202618c2aff45"
     },
     {
       "path": "public-docs/index.html",
@@ -4437,7 +4437,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "1c7cb3f54e177325c60a713a3f9219ce4349be229a3638f67319484f11cfef07"
+      "sha256": "1823d08908672433c4ef47c9320598fd1e6c949836daf8f874b5b802fc43f9c5"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5767,7 +5767,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "ce6bcfa96110ae47a5098b08b574d9f8d015acfca354db31cd438c68362b3027"
+      "sha256": "851121766a8f979a937d436e38efa09f77dae45687c464d7a5a8185373a0fcbe"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7352,7 +7352,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "5760a59ccce395dbc3ac7bb49df58db3acac2954ab83b345b557233bb3381e12"
+      "sha256": "d7998f770254f2c0179a6269d408f571c8757a97defd2543462b8496cb5f3e23"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.140",
+  "version": "1.19.141",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.140",
+      "version": "1.19.141",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.140",
+  "version": "1.19.141",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -159,6 +159,10 @@ h1[tabindex="-1"]:focus{outline:none;}
 }
 .humanSteps b{font-size:15px;}
 .humanSteps p{font-size:13.5px;font-weight:500;color:var(--ink-soft);line-height:1.55;margin-top:4px;}
+/* a repo the platform already handled is named as a plain inline link (task 1002855) —
+   the .ghbtn treatment reads as an action to take, and there is nothing here to do */
+.humanSteps p a{color:var(--accent-deep);font-weight:700;text-decoration:none;}
+.humanSteps p a:hover{text-decoration:underline;}
 /* live checklist states (task 1002694): a step the platform has verified done, and a
    step that can't be performed yet (its prerequisite — usually the domain — is missing) */
 .humanSteps>li.sdone{border-color:color-mix(in srgb,var(--ok) 30%,var(--bg-card));background:linear-gradient(180deg,color-mix(in srgb,var(--ok) 8%,var(--bg-card)) 0%,var(--bg-card) 100%);}
@@ -2154,6 +2158,19 @@ h1[tabindex="-1"]:focus{outline:none;}
       if (owner) u.searchParams.set('owner', owner);
       return u.toString();
     }
+    /* github.com address of the repo this draft points at, or '' when we can't name one
+       honestly. Adopt: owner/repo IS the address the owner picked. Auto-create: the
+       html_url the create call returned — a draft predating task 1002855 has none, and
+       gets no link rather than a guess that could 404. The scheme is hard-coded and both
+       segments are encoded, so nothing here can become an off-site or javascript: href. */
+    function repoLinkFor() {
+      if (!state.owner || !state.repo) return '';
+      if (state.mode === 'adopt') {
+        return 'https://github.com/' + encodeURIComponent(state.owner) + '/' + encodeURIComponent(state.repo);
+      }
+      var stored = String(state.repoUrl || '');
+      return stored.indexOf('https://github.com/') === 0 ? stored : '';
+    }
     function saveDraft() {
       try { sessionStorage.setItem(DRAFT_KEY, JSON.stringify(state)); } catch (e) {}
     }
@@ -2554,6 +2571,10 @@ h1[tabindex="-1"]:focus{outline:none;}
             state.owner = full.slice(0, full.indexOf('/'));
             state.repo = full.slice(full.indexOf('/') + 1);
           }
+          /* Keep GitHub's own html_url so the done panel can link the repo it made
+             (task 1002855). It rides saveDraft(), so a resumed draft keeps the link. */
+          var made = data.repo && data.repo.html_url;
+          if (typeof made === 'string' && made.indexOf('https://github.com/') === 0) state.repoUrl = made;
           state.repoAutoCreated = true; saveDraft();
         });
       });
@@ -2664,15 +2685,23 @@ h1[tabindex="-1"]:focus{outline:none;}
     function renderStepGithubRepo() {
       var landed = live.instStatus === 'active';
       var repoLabel = state.owner && state.repo ? '<strong>' + esc(state.owner + '/' + state.repo) + '</strong>' : 'your new repository';
+      /* Naming a repo without linking it stranded the owner on exactly the path where the
+         platform did the work (task 1002855). Adopt links the repo the owner picked;
+         auto-create links the html_url GitHub itself returned. A draft written before this
+         change carries no stored URL and degrades to the bare name — never a guessed link.
+         Only these two branches link: the manual branch below still has a real .ghbtn
+         action, and nesting an <a> inside it would be malformed. */
+      var repoUrl = repoLinkFor();
+      var repoLink = repoUrl ? '<a href="' + esc(repoUrl) + '" target="_blank" rel="noopener">' + repoLabel + '</a>' : repoLabel;
       if (state.mode === 'adopt') {
         return landed
-          ? '<li class="sdone" data-onboard-step="github-repo"><b>Your repo carries the platform</b><p>The build layered the platform onto ' + repoLabel + ' — existing files, history, and backlog kept. Pull to see it.</p></li>'
-          : '<li data-onboard-step="github-repo"><b>Your existing repo</b><p>The build clones ' + repoLabel + ' and layers the platform onto its existing history — nothing is created or emptied, and your backlog is imported. Nothing for you to do here.</p></li>';
+          ? '<li class="sdone" data-onboard-step="github-repo"><b>Your repo carries the platform</b><p>The build layered the platform onto ' + repoLink + ' — existing files, history, and backlog kept. Pull to see it.</p></li>'
+          : '<li data-onboard-step="github-repo"><b>Your existing repo</b><p>The build clones ' + repoLink + ' and layers the platform onto its existing history — nothing is created or emptied, and your backlog is imported. Nothing for you to do here.</p></li>';
       }
       if (state.repoAutoCreated) {
         return landed
-          ? '<li class="sdone" data-onboard-step="github-repo"><b>Repo ready — scaffold landed</b><p>We created ' + repoLabel + ' (public, by design) and the build pushed your project’s starting files to it.</p></li>'
-          : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLabel + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
+          ? '<li class="sdone" data-onboard-step="github-repo"><b>Repo ready — scaffold landed</b><p>We created ' + repoLink + ' (public, by design) and the build pushed your project’s starting files to it.</p></li>'
+          : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLink + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
       }
       var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
       return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the owner and name already filled in), press <strong>Create repository</strong>, and leave it completely empty. It must land at exactly ' + repoLabel + ' — leave GitHub’s Owner box as prefilled (your personal account), because the build watches that exact address; a repo created under a different owner (an organization, say) is never found. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +

package/src/module-api.js

@@ -707,8 +707,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.138 with no explicit bump. run 31891461224. (task 1002620)
 //   1.19.140 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.139 with no explicit bump. run 31891805999. (task 1002620)
+//   1.19.141 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.140 with no explicit bump. run 31892484952. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.140'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.141'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/public_landing_projects.mjs

@@ -176,6 +176,81 @@ test('the done panel lights Live on a verified answer, never on status alone (ta
   assert.doesNotMatch(fn, /Your project is up/, 'the status-alone headline is dead');
 });
 
+/* ── The done panel's GitHub step (task 1002855) ─────────────────────────────
+   'We created <repo> on GitHub for you' named a repo and handed the owner nothing
+   to click, while the manual-create branch right below it rendered a full button:
+   the one path where the PLATFORM did the work was the one that stranded them
+   (owner-reported during the task 1002697 walk). Adopt named a repo unlinked too. ── */
+
+test('the auto-created repo is linked in the done panel, not merely named', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function renderStepGithubRepo\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'renderStepGithubRepo() must be extractable');
+  const auto = (fn.match(/if \(state\.repoAutoCreated\) \{([\s\S]*?)\n      \}/) || [, ''])[1];
+  assert.ok(auto, 'the auto-created branch must be extractable');
+  assert.match(auto, /We created/, 'this is the copy the owner reported');
+  // BOTH copies — scaffold landed and not yet landed — carry the link
+  assert.equal((auto.match(/repoLink/g) || []).length, 2,
+    'the landed and pre-landed copies must both link the repo');
+  assert.doesNotMatch(auto, /repoLabel/,
+    'no auto-created copy may still name the repo without linking it');
+});
+
+test('the adopt branch links the repo it names', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function renderStepGithubRepo\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  const adopt = (fn.match(/if \(state\.mode === 'adopt'\) \{([\s\S]*?)\n      \}/) || [, ''])[1];
+  assert.ok(adopt, 'the adopt branch must be extractable');
+  assert.equal((adopt.match(/repoLink/g) || []).length, 2,
+    'both adopt copies must link the repo the owner picked');
+  assert.doesNotMatch(adopt, /repoLabel/, 'adopt may not name a repo unlinked either');
+});
+
+test('the auto-created link is a plain inline link, never the .ghbtn call to action', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function renderStepGithubRepo\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  const decl = (fn.match(/var repoLink = [^\n]*/) || [''])[0];
+  assert.match(decl, /<a href="/, 'the link is built as an anchor');
+  assert.match(decl, /esc\(repoUrl\)/, 'the href goes through the page escaper');
+  assert.match(decl, /rel="noopener"/, 'a target=_blank link carries rel=noopener');
+  assert.doesNotMatch(decl, /ghbtn/, 'there is nothing to DO here — no button treatment');
+  // the manual-create branch keeps its real .ghbtn action, and an anchor nested
+  // inside that anchor would be malformed — so only the two done branches link
+  assert.match(fn, /class="ghbtn"/, 'the manual-create button survives untouched');
+  // and the plain link needs a style, or it falls back to the browser's blue
+  assert.match(body, /\.humanSteps p a\{/, 'the inline link is styled with the page palette');
+});
+
+test('a draft with no stored repo URL renders no link — never a guessed one', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const src = (body.match(/(function repoLinkFor\(\)\s*\{[\s\S]*?\n    \})/) || [, ''])[1];
+  assert.ok(src, 'repoLinkFor() must be extractable');
+  const urlFor = (state) => new Function('state', `${src}\nreturn repoLinkFor();`)(state);
+
+  // the real auto-created path: GitHub's own html_url, kept on the draft
+  assert.equal(
+    urlFor({ mode: 'greenfield', owner: 'someone', repo: 'thing', repoAutoCreated: true, repoUrl: 'https://github.com/someone/thing' }),
+    'https://github.com/someone/thing');
+  // a draft written before task 1002855 has no stored URL — it degrades to none
+  assert.equal(
+    urlFor({ mode: 'greenfield', owner: 'someone', repo: 'thing', repoAutoCreated: true }), '');
+  // adopt has no server-supplied URL: the repo the owner picked IS the address
+  assert.equal(urlFor({ mode: 'adopt', owner: 'someone', repo: 'thing' }), 'https://github.com/someone/thing');
+  // nothing named yet, and anything that isn't a github.com URL, link to nothing
+  assert.equal(urlFor({ mode: 'adopt', owner: '', repo: '' }), '');
+  assert.equal(urlFor({ mode: 'greenfield', owner: 'a', repo: 'b', repoUrl: 'javascript:alert(1)' }), '');
+  assert.equal(urlFor({ mode: 'greenfield', owner: 'a', repo: 'b', repoUrl: 'https://evil.example/x' }), '');
+});
+
+test('the create-repo response keeps the html_url it already returned', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  const fn = (body.match(/function ensureFreshRepo\(\)\s*\{([\s\S]*?)\n    \}/) || [, ''])[1];
+  assert.ok(fn, 'ensureFreshRepo() must be extractable');
+  assert.match(fn, /data\.repo && data\.repo\.html_url/, 'the URL is read off the response, not dropped');
+  assert.match(fn, /state\.repoUrl = made/, 'and stored on the draft so a resume keeps it');
+  assert.match(fn, /saveDraft\(\)/, 'the draft is persisted after the URL lands on state');
+});
+
 test('the address row surfaces the manual-DNS note the runner recorded (F16)', async () => {
   const { body } = await request('/projects', 'game.test.local');
   assert.match(body, /inst\.dns_note/, 'the card reads the dns_note the runner writes');