@bongos/core 1.19.209 → 1.19.211

package/public-landing/projects.html

@@ -43,6 +43,12 @@ try{var _m=localStorage.getItem('cb-color-mode');if(_m==='light'||_m==='dark')do
 .viewWrap{padding-bottom:40px;}
 .card{margin-bottom:26px;}
 
+/* ── the manage view (task 1003041): container rhythm only — every component
+   it draws (card, chip, addr, empty) is cosmos vocabulary ── */
+.backRow{margin:14px 0;font-weight:700;}
+#view-manage .empty{text-align:left;}
+#view-manage .empty p{margin-bottom:0;}
+
 /* The bongo pair on the New-project view. Component-scoped custom properties,
    never :root (C1). The drum head is SKIN — using --bg-card would turn it black
    in dark mode — and --drum-shadow is ink in light but PLAIN BLACK in dark,
@@ -557,6 +563,79 @@ h1[tabindex="-1"]:focus{outline:none;}
   </div>
 </section>
 
+<!-- ══════════════════ VIEW · MANAGE ═══════════════════════════════════════
+     One owned project's management home (task 1003041, goal-1000058 wave).
+     Deep link: ?view=manage&id=N — goToManage() routes the map's owned
+     orbs/rows and the mine cards here. The API is the wall: the per-id read
+     is own-scoped (owner, or an archon for fleet support) and answers 404
+     for anyone else, so a stranger's deep link renders the same clean
+     "no project here" as a wrong id — never a permission hint. The settings
+     sections are the homes the sibling manage-wave tasks fill in; until each
+     ships, its section says so honestly instead of faking a control. -->
+<section id="view-manage" hidden>
+  <div class="wrap viewWrap">
+    <p class="backRow"><a href="?view=mine" data-nav-to="mine">← Your projects</a></p>
+
+    <!-- signed out: the same identity-only door the mine view uses (ADR 0143) -->
+    <section id="mGate" class="card" hidden>
+      <p class="lede">This is a project’s management page — it answers only to the person who owns it. Sign in with GitHub to open yours.</p>
+      <a class="btn" id="mSignin" href="/api/bongos/auth/web/start?return=/projects%3Fview%3Dmine">
+        <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
+        Sign in with GitHub
+      </a>
+    </section>
+
+    <!-- 404: one clean state for "not yours" and "doesn't exist" — the API
+         answers both identically on purpose, and so does this copy -->
+    <section id="mMissing" class="card" hidden>
+      <p class="lede">No project here. It may have been removed, or the link may be wrong.</p>
+      <a class="btn small ghost" href="?view=mine" data-nav-to="mine">Back to your projects</a>
+    </section>
+
+    <div class="alert" id="mAlert" role="alert"></div>
+    <div class="loading" id="mLoading">Reading the project…</div>
+
+    <section id="mMain" hidden>
+      <div class="hero" style="padding-left:0;padding-right:0">
+        <h1>Manage</h1>
+        <p class="lede">One project, up close — its address, its repository, and what the platform last <b>verified</b> about it, with a timestamp. The controls land here piece by piece; each section says what it can do today.</p>
+      </div>
+
+      <div class="card">
+        <div class="projHead"><span class="projName" id="mName">…</span><span id="mChip"></span></div>
+        <div class="projMeta" id="mMeta" hidden></div>
+        <div class="addr" id="mAddr" hidden></div>
+        <p class="finePrint" id="mCreated" hidden></p>
+      </div>
+
+      <div class="card" id="mVisibility">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Who can see it</h2>
+        <div class="empty"><p>Choosing who can open this project’s pages — everyone, or only people signed in to it — isn’t wired up here yet. It lands in one of the next updates; until then every project keeps the behavior it already has.</p></div>
+      </div>
+
+      <div class="card" id="mJoinability">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">How people join</h2>
+        <div class="empty"><p>Choosing how new people join — walk right in, apply first, or invite only — isn’t wired up here yet. It lands in one of the next updates.</p></div>
+      </div>
+
+      <!-- live since task 1003045: reads the repo's real visibility from GitHub
+           with the owner's own repository credential. Flip-to-PUBLIC only — the
+           private direction is refused (server + copy) until the private-repo
+           deploy fix lands, because the deploy pull cannot read a private repo
+           (walk finding N4). -->
+      <div class="card" id="mRepoVisibility">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Repository visibility</h2>
+        <div id="mRepoVis"><p class="finePrint">Checking the repository on GitHub…</p></div>
+      </div>
+
+      <div class="card" id="mDelete">
+        <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Delete the project</h2>
+        <div class="empty"><p>Deleting a project from this page isn’t wired up yet. A running project can still be torn down from its card under <a href="?view=mine" data-nav-to="mine">Your projects</a> — that stops the server and keeps your repository.</p></div>
+      </div>
+    </section>
+  </div>
+</section>
+
 <!-- ══════════════════ VIEW · NEW PROJECT ══════════════════════════════════
      The whole create wizard, absorbed from /create (task 1002763; direction
      §4 — that route now 302s here). Seven panels behind the five-beat rail; the
@@ -912,12 +991,23 @@ h1[tabindex="-1"]:focus{outline:none;}
      pointed at /projects?view=new) actually arrive somewhere.
      ══════════════════════════════════════════════════════════════════════════ */
 
-  var VIEWS = { map: 1, mine: 1, new: 1 };
+  var VIEWS = { map: 1, mine: 1, new: 1, manage: 1 };
   var currentView = 'map';
+  /* the manage view's target project (task 1003041) — set by goToManage() and
+     the ?view=manage&id=N deep link, read by loadManage() */
+  var manageId = null;
+  var manageInst = null;
 
   function viewFromUrl() {
     var v;
     try { v = new URLSearchParams(location.search).get('view'); } catch (e) { v = null; }
+    if (v === 'manage') {
+      /* per-project: no id names no project — the list is the honest landing */
+      var id = null;
+      try { id = new URLSearchParams(location.search).get('id'); } catch (e) {}
+      if (id) { manageId = String(id); return 'manage'; }
+      return 'mine';
+    }
     return VIEWS[v] ? v : 'map';
   }
 
@@ -930,14 +1020,20 @@ h1[tabindex="-1"]:focus{outline:none;}
       if (a.dataset.nav !== 'home' && a.dataset.nav === v) a.setAttribute('aria-current', 'page');
       else a.removeAttribute('aria-current');
     });
-    try { history.replaceState(null, '', '?view=' + v); } catch (e) {}
+    /* the manage view's URL names its project — the deep-link contract grew
+       an id in task 1003041, so a manage tab is shareable and reload-safe */
+    var idPart = (v === 'manage' && manageId) ? '&id=' + encodeURIComponent(manageId) : '';
+    try { history.replaceState(null, '', '?view=' + v + idPart); } catch (e) {}
     /* the shell's sign-in door returns the visitor to the view they left, and
        carries the repo scope when that view is the wizard (ADR 0143: the
        create path asks once up front instead of a second consent at Home) */
-    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v + (v === 'new' ? '&repos=1' : '');
+    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v +
+      idPart.replace('&', '%26').replace('=', '%3D') + (v === 'new' ? '&repos=1' : '');
     /* the mine view is the only one that polls; it re-reads on entry so a
        card that changed while you were on the map is not stale */
     if (v === 'mine' && me) refreshList();
+    /* manage re-reads its project on entry — no timer lives here (C8) */
+    if (v === 'manage') loadManage();
     /* owned chips refresh on re-entry, never on a timer — C8 keeps the map quiet */
     if (v === 'map' && me) loadOwnedInstances().then(applyMapFilter);
     /* the living sky runs only on stage (C8) — start and stop with the view;
@@ -1169,11 +1265,11 @@ h1[tabindex="-1"]:focus{outline:none;}
       var href = safeHttpUrl(p.origin);
       if (inst) {
         /* an OWNED entry — catalog-annotated or owned-only, one code path.
-           Its job is MANAGE (direction §5): same tab, anchored on that
-           project. The public-site door still exists on the manage card; a
-           middle-click lands a fresh tab on the manage view, which is this
-           orb's honest destination. */
-        a.href = '?view=mine';
+           Its job is MANAGE (direction §5): a plain click opens that
+           project's manage view (task 1003041), and the href IS that view's
+           deep link, so a middle/ctrl-click lands a fresh tab on the same
+           honest destination. The public-site door stays on the manage page. */
+        a.href = '?view=manage&id=' + encodeURIComponent(String(inst.id));
         a.setAttribute('data-manage', String(inst.id));
       } else {
         /* The href STAYS, and stays honest, even though a plain click now opens
@@ -1441,16 +1537,14 @@ h1[tabindex="-1"]:focus{outline:none;}
     if (p) openCard(p, relOf(p), a);
   });
 
-  /* ── Click-to-manage (task 1002744): an owned orb opens YOUR side of the hub,
-     anchored on that project's card. The anchor is deferred — setView('mine')
-     triggers an async refreshList(), so the target `[data-inst]` node may not
-     exist yet; render() and refreshList() retry tryAnchor() once it does. ── */
-  var ANCHOR_GLOW_MS = 2200;
-  var pendingAnchor = null;
+  /* ── Click-to-manage (task 1002744 → 1003041): an owned orb, row or card
+     opens that project's own manage view — the per-project page the
+     manage-wave tasks fill in. It replaced the scroll-anchor-into-the-list
+     this function used to do. ── */
   function goToManage(instId) {
-    pendingAnchor = String(instId || '');
-    setView('mine');
-    tryAnchor();   /* the list may already be rendered from an earlier visit */
+    manageId = String(instId || '');
+    manageInst = null;
+    setView('manage');
   }
   /* Card-shell lookup by instance id. CSS.escape, not esc(): the data-inst
      attribute holds the DECODED value, so an HTML-escaped id would never match
@@ -1459,18 +1553,6 @@ h1[tabindex="-1"]:focus{outline:none;}
   function liFor(id) {
     return document.querySelector('li[data-inst="' + CSS.escape(String(id == null ? '' : id)) + '"]');
   }
-  function tryAnchor() {
-    if (!pendingAnchor) return;
-    var li = liFor(pendingAnchor);
-    if (!li) return;
-    pendingAnchor = null;
-    /* a search or state filter that hides the target would turn the anchor
-       into a silent no-op — clear them the same way the visitor would */
-    if (li.hidden) $('mineClear').click();
-    li.scrollIntoView({ block: 'center' });
-    li.classList.add('anchored');
-    setTimeout(function () { li.classList.remove('anchored'); }, ANCHOR_GLOW_MS);
-  }
 
   $('mapRows').addEventListener('click', function (ev) {
     /* the row's own "Open →" keeps its job — the card is for the rest of the row */
@@ -3630,7 +3712,9 @@ h1[tabindex="-1"]:focus{outline:none;}
     }
     var lm = lastMsg[inst.id];
     body += '<div class="projMsg' + (lm && lm.cls ? ' ' + lm.cls : '') + '" id="msg-' + iid + '">' + (lm ? lm.text : '') + '</div>';
-    var acts = [];
+    /* every owned card opens its manage view (task 1003041) — a real link, so
+       middle/ctrl-click works; the delegated handler upgrades a plain click */
+    var acts = ['<a class="btn small ghost" data-manage="' + iid + '" href="?view=manage&id=' + iid + '">Manage</a>'];
     if (canRetry(inst)) acts.push('<button type="button" class="btn small" data-retry="' + iid + '">Try again</button>');
     if (canRevive(inst)) acts.push('<button type="button" class="btn small" data-revive="' + iid + '">Bring it back</button>');
     if (canTeardown(inst)) acts.push('<button type="button" class="btn small danger" data-teardown="' + iid + '">Tear it down</button>');
@@ -3663,7 +3747,6 @@ h1[tabindex="-1"]:focus{outline:none;}
     });
     recountMine();
     applyMine();
-    tryAnchor();   /* a click-to-manage jump may be waiting on this render */
   }
 
   function msg(id, text, cls) {
@@ -3753,7 +3836,6 @@ h1[tabindex="-1"]:focus{outline:none;}
         var sameSet = instances.length === known && instances.every(function (i) { return byId[i.id]; });
         if (!sameSet) { render(instances); return; }
         instances.forEach(function (inst) { takeUpdate(inst.id, inst); });
-        tryAnchor();   /* same-set refresh renders no shells — retry here too */
       })
       .catch(function () { /* transient — next tick will try again */ });
   }
@@ -3767,6 +3849,8 @@ h1[tabindex="-1"]:focus{outline:none;}
     /* returning to a MAP tab re-reads the owned overlay once — event-driven,
        like the mine view's entry refresh, not a timer */
     if (!document.hidden && me && currentView === 'map') loadOwnedInstances().then(applyMapFilter);
+    /* returning to a MANAGE tab re-reads its one project the same way */
+    if (!document.hidden && currentView === 'manage' && manageId) loadManage(true);
   });
 
   /* C6 freshness without C8's cost: once a minute the visible MAP refreshes
@@ -3793,6 +3877,212 @@ h1[tabindex="-1"]:focus{outline:none;}
   }
   setInterval(mapChipTick, REFRESH_MS);
 
+  /* ── the manage view (task 1003041): one owned project's management home.
+     The API is the wall — the per-id read is own-scoped with an archon
+     override and 404s for anyone else — so this code only renders what it
+     answers. The data re-reads on entry and tab return, never on a fetch
+     timer (C8); the once-a-minute tick below re-renders from data already
+     in hand so "checked Xm ago" keeps telling the truth (C6). ── */
+
+  function manageSignin() {
+    return API + '/auth/web/start?return=' +
+      encodeURIComponent('/projects?view=manage&id=' + manageId);
+  }
+
+  function renderManage(inst) {
+    manageInst = inst;
+    $('mLoading').hidden = true;
+    $('mGate').hidden = true;
+    $('mMissing').hidden = true;
+    $('mMain').hidden = false;
+    $('mName').textContent = inst.slug || '';
+    /* the ONE chip site of this view — chipFor() or nothing, so the manage
+       page can never tell a different liveness story than the card (C6) */
+    $('mChip').innerHTML = chipFor(inst);
+    var meta = [];
+    if (inst.target_ref) {
+      meta.push('repo <a href="https://github.com/' + esc(inst.target_ref) +
+        '" target="_blank" rel="noopener"><code>' + esc(inst.target_ref) + '</code></a>');
+    }
+    if (inst.hosting_shape) meta.push(esc(SHAPE_LABEL[inst.hosting_shape] || inst.hosting_shape));
+    if (inst.onboard_mode === 'adopt') meta.push('adopted repo');
+    $('mMeta').innerHTML = meta.join('<span aria-hidden="true">·</span>');
+    $('mMeta').hidden = !meta.length;
+    var addr = addressRow(inst);
+    $('mAddr').innerHTML = addr;
+    $('mAddr').hidden = !addr;
+    /* a fact with no answer hides — never a dash (the card rule) */
+    $('mCreated').textContent = inst.created_at ? 'Created ' + listedDate(inst.created_at) : '';
+    $('mCreated').hidden = !inst.created_at;
+  }
+
+  function loadManage(quiet) {
+    if (!manageId) return;
+    $('mAlert').classList.remove('on');
+    $('mSignin').href = manageSignin();
+    if (!quiet) {
+      $('mMain').hidden = true;
+      $('mGate').hidden = true;
+      $('mMissing').hidden = true;
+      $('mLoading').hidden = false;
+    }
+    var asked = manageId; /* a stale answer must never paint a newer project */
+    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId), { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        if (res.status === 401) {
+          $('mLoading').hidden = true; $('mMain').hidden = true; $('mGate').hidden = false;
+          throw new Error('handled');
+        }
+        /* 404 is ONE clean answer for "not yours" and "doesn't exist" — the
+           API refuses both identically, so this page cannot leak existence */
+        if (res.status === 404) {
+          $('mLoading').hidden = true; $('mMain').hidden = true; $('mMissing').hidden = false;
+          throw new Error('handled');
+        }
+        if (!res.ok) throw new Error('soft');
+        return res.json();
+      })
+      .then(function (data) {
+        var inst = data.instance || {};
+        inst.open_intent = data.open_intent || null;
+        renderManage(inst);
+        /* the SECOND, GitHub-backed read — fired only here (entry + tab
+           return), never from renderManage, which the fetch-free tick calls */
+        loadRepoVisibility(inst);
+      })
+      .catch(function (err) {
+        var m = String(err && err.message);
+        if (m === 'handled' || m === 'stale') return;
+        $('mLoading').hidden = true;
+        var a = $('mAlert');
+        a.textContent = 'Couldn’t read this project right now — refresh in a moment.';
+        a.classList.add('on');
+      });
+  }
+
+  function manageChipTick() {
+    if (document.hidden || currentView !== 'manage' || !manageInst) return;
+    renderManage(manageInst); /* zero requests — re-dates "checked Xm ago" */
+  }
+  setInterval(manageChipTick, REFRESH_MS);
+
+  /* ── repo visibility (task 1003045): read live from GitHub with the owner's
+     own repository credential; flip-to-PUBLIC only. The private direction is
+     refused by the server — and unbuilt here — until the private-repo deploy
+     fix lands: the deploy pull runs as the shared deploy key, which cannot
+     read a private repo (walk finding N4), so flipping private would break
+     the project's next deploy. Every claim below is what GitHub answered for
+     THIS account — never a cached or guessed state. ── */
+
+  var manageRepo = null; /* GitHub's last answer for the manage view's repo */
+
+  function repoVisReconnect() {
+    return API + '/auth/web/start?repos=1&return=' +
+      encodeURIComponent('/projects?view=manage&id=' + manageId);
+  }
+
+  function repoVisMsg(html) { $('mRepoVis').innerHTML = html; }
+
+  function renderRepoVis(repo) {
+    if (repo.private) {
+      repoVisMsg(
+        '<div class="addr">This repository is <b>private</b> — only accounts it’s shared with can read its code.</div>' +
+        '<div class="projMsg err">The platform can’t deploy private repositories yet, so deploys for this project will fail while it stays private.</div>' +
+        (repo.admin
+          ? '<div class="actions"><button type="button" class="btn small" data-repo-public>Make it public</button></div>'
+          : '<p class="finePrint">Your GitHub account can’t change this repository’s settings.</p>'));
+    } else {
+      repoVisMsg(
+        '<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
+        '<p class="finePrint">Making it private isn’t possible from here yet: the platform can’t deploy private repositories. The switch lands with that fix.</p>');
+    }
+  }
+
+  function loadRepoVisibility(inst) {
+    manageRepo = null;
+    if (!inst.target_ref) {
+      repoVisMsg('<p class="finePrint">No repository is linked to this project.</p>');
+      return;
+    }
+    repoVisMsg('<p class="finePrint">Checking the repository on GitHub…</p>');
+    var asked = manageId; /* a stale answer must never describe a newer project */
+    fetch(API + '/github/repo?repo=' + encodeURIComponent(inst.target_ref), { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        return jsonOrEmpty(res).then(function (data) {
+          if (res.ok) { manageRepo = data.repo || {}; renderRepoVis(manageRepo); return; }
+          var e = apiError(data, res.status);
+          if (e.code === 'repo_scope_required') {
+            /* the stored repository credential lives an hour (ADR 0155) — the
+               owner reconnects through the same door the create wizard uses */
+            repoVisMsg('<p class="finePrint">Seeing and changing this here needs repository access. ' +
+              '<a href="' + repoVisReconnect() + '">Reconnect GitHub with repository access</a>.</p>');
+          } else if (e.code === 'github_repos_unavailable') {
+            repoVisMsg('<p class="finePrint">Repository access isn’t configured on this server, so visibility can’t be read from here.</p>');
+          } else if (e.code === 'repo_not_found') {
+            repoVisMsg('<p class="finePrint">GitHub didn’t show this repository to your account — it may have been deleted, renamed, or belong to a different account.</p>');
+          } else if (res.status === 401) {
+            repoVisMsg('<p class="finePrint">' + signInAgain() + '</p>');
+          } else {
+            repoVisMsg('<p class="finePrint">GitHub couldn’t be reached right now — refresh in a moment.</p>');
+          }
+        });
+      })
+      .catch(function (err) {
+        if (String(err && err.message) === 'stale') return;
+        repoVisMsg('<p class="finePrint">GitHub couldn’t be reached right now — refresh in a moment.</p>');
+      });
+  }
+
+  /* flipping public exposes the code to everyone — never one accidental click */
+  function askRepoPublic() {
+    var act = document.querySelector('#mRepoVis .actions');
+    if (!act) return;
+    act.innerHTML = '<div class="confirmRow">' +
+      '<span class="plain">Make it public? Anyone on the internet will be able to read the code.</span>' +
+      '<button type="button" class="btn small" data-repo-public-yes>Yes, make it public</button>' +
+      '<button type="button" class="linklike" data-repo-public-no>Keep it private</button></div>';
+  }
+
+  function doRepoPublic() {
+    if (!manageInst || !manageInst.target_ref) return;
+    repoVisMsg('<p class="finePrint">Asking GitHub…</p>');
+    fetch(API + '/github/repo/visibility', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ repo: manageInst.target_ref, visibility: 'public' })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* GitHub's own answer paints the new state — never an assumption */
+          manageRepo = data.repo || {};
+          renderRepoVis(manageRepo);
+          return;
+        }
+        var e = apiError(data, res.status);
+        /* say what the server said, on top of the still-true state */
+        if (manageRepo) renderRepoVis(manageRepo);
+        else repoVisMsg('');
+        $('mRepoVis').insertAdjacentHTML('beforeend',
+          res.status === 401
+            ? '<div class="projMsg err">' + signInAgain() + '</div>'
+            : '<div class="projMsg err">' + esc(e.message || 'The change could not be made — try again in a moment.') + '</div>');
+      });
+    }).catch(function () {
+      if (manageRepo) renderRepoVis(manageRepo);
+      $('mRepoVis').insertAdjacentHTML('beforeend',
+        '<div class="projMsg err">Couldn’t reach the platform — check your connection and try again.</div>');
+    });
+  }
+
+  $('mRepoVis').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (!t) return;
+    if (t.hasAttribute('data-repo-public')) return askRepoPublic();
+    if (t.hasAttribute('data-repo-public-yes')) return doRepoPublic();
+    if (t.hasAttribute('data-repo-public-no')) { if (manageRepo) renderRepoVis(manageRepo); }
+  });
+
   /* ── teardown: ask, confirm (the truth, itemized — direction §5.4), then
      SAY exactly what the server said ── */
 
@@ -3923,6 +4213,14 @@ h1[tabindex="-1"]:focus{outline:none;}
 
   /* one delegated listener for all card actions */
   $('projectsList').addEventListener('click', function (ev) {
+    /* the Manage link is a real anchor — a modified click keeps its browser
+       meaning, a plain one stays in-page (the orb-click contract) */
+    var m = ev.target.closest && ev.target.closest('a[data-manage]');
+    if (m) {
+      if (!isPlainClick(ev)) return;
+      ev.preventDefault();
+      return goToManage(m.getAttribute('data-manage'));
+    }
     var t = ev.target.closest('button');
     if (!t) return;
     if (t.hasAttribute('data-teardown')) return askTeardown(t.getAttribute('data-teardown'));

package/src/bongos/github-repos.js

@@ -102,4 +102,64 @@ async function createUserRepo(token, { name, fetchImpl = fetch } = {}) {
   throw new GithubApiError(`GitHub create-repo failed (${res.status})`, { status: res.status, code: 'github_error' });
 }
 
-module.exports = { listUserRepos, createUserRepo, GithubApiError, MAX_PAGES };
+// Read one repo as GitHub answers it FOR THIS TOKEN — the manage page's
+// visibility read (task 1003045). GitHub's own 404 covers both "no such repo"
+// and "no access", which is exactly the no-leak shape the caller wants to
+// forward. `permissions.admin` says whether this token could change settings.
+// Returns { full_name, html_url, private, admin }.
+async function getUserRepo(token, { owner, name, fetchImpl = fetch } = {}) {
+  const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`, {
+    headers: ghHeaders(token),
+  });
+  if (res.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (res.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository', { status: 404, code: 'repo_not_found' });
+  }
+  if (!res.ok) {
+    throw new GithubApiError(`GitHub /repos read failed (${res.status})`, { status: res.status, code: 'github_error' });
+  }
+  const r = await res.json();
+  return {
+    full_name: r.full_name,
+    html_url: r.html_url,
+    private: !!r.private,
+    admin: !!(r.permissions && r.permissions.admin),
+  };
+}
+
+// Flip one repo PUBLIC — and only public. Like createUserRepo's private:false,
+// the direction is deliberately not a parameter: the deploy pull still runs as
+// the shared deploy key that cannot read a private repo (walk finding N4), so
+// nothing in this codebase may flip a repo private until that fix lands — the
+// route refuses the request; this helper makes the refusal structural
+// (task 1003045). Returns the same shape as getUserRepo.
+async function makeRepoPublic(token, { owner, name, fetchImpl = fetch } = {}) {
+  const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`, {
+    method: 'PATCH',
+    headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
+    body: JSON.stringify({ private: false }),
+  });
+  if (res.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (res.status === 403) {
+    throw new GithubApiError('GitHub refused the change for this account', { status: 403, code: 'not_repo_admin' });
+  }
+  if (res.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository', { status: 404, code: 'repo_not_found' });
+  }
+  if (!res.ok) {
+    throw new GithubApiError(`GitHub repo-visibility change failed (${res.status})`, { status: res.status, code: 'github_error' });
+  }
+  const r = await res.json();
+  return {
+    full_name: r.full_name,
+    html_url: r.html_url,
+    private: !!r.private,
+    admin: !!(r.permissions && r.permissions.admin),
+  };
+}
+
+module.exports = { listUserRepos, createUserRepo, getUserRepo, makeRepoPublic, GithubApiError, MAX_PAGES };

package/src/bongos/routes/github.js

@@ -1,5 +1,7 @@
 // src/bongos/routes/github.js — GitHub repo list/create for the signed-in user, the
-// server half of the onboarding wizard's repo picker (adopt) + auto-create (fresh).
+// server half of the onboarding wizard's repo picker (adopt) + auto-create (fresh),
+// plus the manage page's repo-visibility read/flip (task 1003045 — public only; the
+// private direction is refused until the private-repo deploy fix lands).
 // Task 1002099 / ADR 0143.
 //
 // These act on the user's OWN GitHub identity, so they live in core auth alongside
@@ -18,11 +20,29 @@ const auth = require('../auth');
 const db = require('../db');
 const secretBox = require('../secret-box');
 const { listUserRepos, createUserRepo } = require('../github-repos');
+// Namespace require for the visibility helpers (task 1003045): the route tests
+// stub these on the cached module object, which a load-time destructure would
+// pin to the real implementations.
+const githubRepos = require('../github-repos');
 const { validateOrRespond } = require('./_helpers');
 
 // GitHub repo names: 1–100 chars of [A-Za-z0-9._-]. We validate strictly for a clean
 // 400; anything GitHub still rejects surfaces as the 422→409 name_taken path.
 const REPO_NAME_RE = /^[A-Za-z0-9._-]{1,100}$/;
+// owner/name for the visibility routes: a GitHub login (1–39 chars, alnum + inner
+// hyphens) over a repo name. Strict for a clean 400; GitHub still owns the truth.
+const REPO_REF_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})?\/[A-Za-z0-9._-]{1,100}$/;
+
+// Parse + validate the owner/name ref, or send a 400 and return null.
+function parseRepoRef(raw, res) {
+  const ref = String(raw || '').trim();
+  if (!REPO_REF_RE.test(ref)) {
+    res.fail('bad_repo_ref', { status: 400, message: 'Name the repository as owner/name.' });
+    return null;
+  }
+  const [owner, name] = ref.split('/');
+  return { owner, name };
+}
 
 // Resolve the caller's stored repo token, or send the right failure and return null.
 // Centralizes the 503-vs-403 decision both endpoints share.
@@ -97,5 +117,70 @@ module.exports = function buildGithubRouter() {
     }
   });
 
+  // rank: any-builder — reads one repo AS the caller's own GitHub credential sees
+  // it (the manage page's repo-visibility read, task 1003045). GitHub's 404 covers
+  // both "no such repo" and "no access" — forwarded as-is, no existence leak.
+  router.get('/github/repo', auth.requireBuilder, async (req, res) => {
+    const ref = parseRepoRef(req.query.repo, res);
+    if (!ref) return;
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      const repo = await githubRepos.getUserRepo(token, ref);
+      // private_deployable is the platform truth the UI copy leans on: the deploy
+      // pull runs as the shared deploy key, which cannot read a private repo (N4).
+      res.json({ ok: true, repo, private_deployable: false });
+    } catch (err) {
+      if (err && err.status === 401) {
+        await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+        return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to read the repository.' });
+      }
+      if (err && err.code === 'repo_not_found') {
+        return res.fail('repo_not_found', { status: 404, message: 'GitHub didn’t show that repository to your account.' });
+      }
+      console.error('[gds] GET /github/repo', err && err.message);
+      res.fail('github_error', { status: 502, message: 'GitHub could not be reached. Try again in a moment.' });
+    }
+  });
+
+  // rank: any-builder — flips one of the caller's repos PUBLIC, with their own
+  // credential. The private direction is REFUSED here, before GitHub is ever
+  // called: the deploy pull still runs as the shared deploy key that cannot read
+  // a private repo (walk finding N4), so flipping private would break the
+  // project's next deploy — the refusal is the honest leg task 1003045 ships.
+  router.post('/github/repo/visibility', auth.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      repo: { required: true, type: 'string', maxLength: 140 },
+      visibility: { required: true, type: 'string', enum: ['public', 'private'] },
+    })) return;
+    const ref = parseRepoRef(req.body.repo, res);
+    if (!ref) return;
+    if (req.body.visibility !== 'public') {
+      return res.fail('private_not_deployable', {
+        status: 409,
+        message: 'Private repositories can’t be deployed yet — the platform’s deploy pull can’t read them, so making this repository private would break the project’s next deploy. This lands with the private-repo deploy fix.',
+      });
+    }
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      const repo = await githubRepos.makeRepoPublic(token, ref);
+      res.json({ ok: true, repo, private_deployable: false });
+    } catch (err) {
+      if (err && err.status === 401) {
+        await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+        return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to change the repository.' });
+      }
+      if (err && err.code === 'not_repo_admin') {
+        return res.fail('not_repo_admin', { status: 403, message: 'GitHub refused: your account can’t change this repository’s settings.' });
+      }
+      if (err && err.code === 'repo_not_found') {
+        return res.fail('repo_not_found', { status: 404, message: 'GitHub didn’t show that repository to your account.' });
+      }
+      console.error('[gds] POST /github/repo/visibility', err && err.message);
+      res.fail('github_error', { status: 502, message: 'GitHub could not make the change. Try again in a moment.' });
+    }
+  });
+
   return router;
 };

package/src/module-api.js

@@ -845,8 +845,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.207 with no explicit bump. run 32068332007. (task 1002620)
 //   1.19.209 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.208 with no explicit bump. run 32072227661. (task 1002620)
+//   1.19.210 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.209 with no explicit bump. run 32078135414. (task 1002620)
+//   1.19.211 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.210 with no explicit bump. run 32079512489. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.209'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.211'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');