@bongos/core 1.19.209 → 1.19.211

package/tests/github_repo_visibility.mjs

@@ -0,0 +1,168 @@
+// tests/github_repo_visibility.mjs — the manage page's repo-visibility routes
+// (task 1003045): GET /github/repo + POST /github/repo/visibility.
+//
+// The load-bearing assertions:
+//   • the PRIVATE direction is refused BEFORE GitHub is ever called (409
+//     private_not_deployable): the deploy pull runs as the shared deploy key,
+//     which cannot read a private repo (walk finding N4), so flipping private
+//     would break the project's next deploy — the honest-refusal leg this task
+//     ships. The refusal must not even consult the stored token.
+//   • flip-to-public calls makeRepoPublic with the parsed owner/name and
+//     forwards GitHub's own answer — the new state is never assumed
+//   • a GitHub 401 drops the stored token and re-prompts (the /github/repos
+//     convention); GitHub's 404 forwards as repo_not_found (no leak beyond what
+//     GitHub told this account); a GitHub 403 becomes not_repo_admin
+//   • a malformed owner/name is a clean 400 bad_repo_ref
+//
+// DB-free + network-free: db.getGithubToken and the github-repos helpers are
+// stubbed on their cached module objects (the github_token_store.mjs pattern —
+// which is also why routes/github.js requires the helpers as a namespace).
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// A valid key BEFORE requiring the modules, so secret-box reads as configured.
+process.env.BUILDER_SECRET_KEY = 'ab'.repeat(32);
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const db = require(path.join(ROOT, 'src/bongos/db.js'));
+const githubRepos = require(path.join(ROOT, 'src/bongos/github-repos.js'));
+const buildGithubRouter = require(path.join(ROOT, 'src/bongos/routes/github.js'));
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+const { GithubApiError } = githubRepos;
+
+function fakeRes() {
+  const res = { _status: 200, _body: null };
+  res.status = (c) => { res._status = c; return res; };
+  res.json = (b) => { res._body = b; return res; };
+  attachFail({}, res, () => {}); // installs res.fail exactly as the router does
+  return res;
+}
+function finalHandler(router, method, pth) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pth && l.route.methods[method]);
+  const stack = layer.route.stack;
+  return stack[stack.length - 1].handle; // the handler after requireBuilder
+}
+
+// One stubbed world per test: a live repo-scoped token + programmable helpers.
+// getRepo/makePublic are thunks so a test can return an answer or throw a typed
+// GithubApiError, exactly as the real helpers do.
+function stub({ token = { token: 'tok', scope: 'repo read:user' }, getRepo, makePublic } = {}) {
+  const orig = {
+    get: db.getGithubToken, del: db.deleteGithubToken,
+    read: githubRepos.getUserRepo, flip: githubRepos.makeRepoPublic,
+  };
+  const calls = { read: [], flip: [], del: 0 };
+  db.getGithubToken = async () => token;
+  db.deleteGithubToken = async () => { calls.del++; };
+  githubRepos.getUserRepo = async (_t, ref) => { calls.read.push(ref); return getRepo(); };
+  githubRepos.makeRepoPublic = async (_t, ref) => { calls.flip.push(ref); return makePublic(); };
+  const restore = () => {
+    db.getGithubToken = orig.get; db.deleteGithubToken = orig.del;
+    githubRepos.getUserRepo = orig.read; githubRepos.makeRepoPublic = orig.flip;
+  };
+  return { calls, restore };
+}
+
+const getHandler = () => finalHandler(buildGithubRouter(), 'get', '/github/repo');
+const postHandler = () => finalHandler(buildGithubRouter(), 'post', '/github/repo/visibility');
+
+test('GET /github/repo: forwards GitHub\'s answer for the caller\'s own credential', async () => {
+  const s = stub({ getRepo: () => ({ full_name: 'jaxri/mercury', html_url: 'https://github.com/jaxri/mercury', private: true, admin: true }) });
+  try {
+    const res = fakeRes();
+    await getHandler()({ builder: { id: 1 }, query: { repo: 'jaxri/mercury' } }, res);
+    assert.equal(res._status, 200);
+    assert.equal(res._body.repo.private, true);
+    assert.equal(res._body.repo.admin, true);
+    assert.equal(res._body.private_deployable, false, 'the platform truth rides every answer');
+    assert.deepEqual(s.calls.read, [{ owner: 'jaxri', name: 'mercury' }]);
+  } finally { s.restore(); }
+});
+
+test('GET /github/repo: a malformed ref is a clean 400 before any token or GitHub touch', async () => {
+  const s = stub({ getRepo: () => ({}) });
+  try {
+    for (const bad of ['', 'no-slash', '-lead/x', 'a/b/c', 'owner/', 'javascript:alert(1)']) {
+      const res = fakeRes();
+      await getHandler()({ builder: { id: 1 }, query: { repo: bad } }, res);
+      assert.equal(res._status, 400, `ref ${JSON.stringify(bad)} must 400`);
+      assert.equal(res._body.error.code, 'bad_repo_ref');
+    }
+    assert.equal(s.calls.read.length, 0, 'GitHub is never consulted for a malformed ref');
+  } finally { s.restore(); }
+});
+
+test('GET /github/repo: GitHub\'s 404 forwards as repo_not_found — no leak beyond GitHub\'s own answer', async () => {
+  const s = stub({ getRepo: () => { throw new GithubApiError('nope', { status: 404, code: 'repo_not_found' }); } });
+  try {
+    const res = fakeRes();
+    await getHandler()({ builder: { id: 1 }, query: { repo: 'jaxri/gone' } }, res);
+    assert.equal(res._status, 404);
+    assert.equal(res._body.error.code, 'repo_not_found');
+  } finally { s.restore(); }
+});
+
+test('GET /github/repo: a GitHub 401 drops the stored token and re-prompts (the /github/repos convention)', async () => {
+  const s = stub({ getRepo: () => { throw new GithubApiError('bad', { status: 401, code: 'github_unauthorized' }); } });
+  try {
+    const res = fakeRes();
+    await getHandler()({ builder: { id: 1 }, query: { repo: 'jaxri/mercury' } }, res);
+    assert.equal(res._status, 403);
+    assert.equal(res._body.error.code, 'repo_scope_required');
+    assert.equal(s.calls.del, 1, 'the dead token is swept so the next attempt re-prompts cleanly');
+  } finally { s.restore(); }
+});
+
+test('POST visibility=private: refused 409 private_not_deployable — GitHub and the token store untouched', async () => {
+  const s = stub({ makePublic: () => ({}) });
+  const origGet = db.getGithubToken;
+  let tokenReads = 0;
+  db.getGithubToken = async () => { tokenReads++; return { token: 'tok', scope: 'repo' }; };
+  try {
+    const res = fakeRes();
+    await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'private' } }, res);
+    assert.equal(res._status, 409);
+    assert.equal(res._body.error.code, 'private_not_deployable');
+    assert.match(res._body.error.message, /deploy/i, 'the refusal says WHY in plain words');
+    assert.equal(s.calls.flip.length, 0, 'no GitHub call for a refused direction');
+    assert.equal(tokenReads, 0, 'the refusal happens before the credential is even read');
+  } finally { db.getGithubToken = origGet; s.restore(); }
+});
+
+test('POST visibility=public: flips via makeRepoPublic and forwards GitHub\'s answer', async () => {
+  const s = stub({ makePublic: () => ({ full_name: 'jaxri/mercury', html_url: 'https://github.com/jaxri/mercury', private: false, admin: true }) });
+  try {
+    const res = fakeRes();
+    await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'public' } }, res);
+    assert.equal(res._status, 200);
+    assert.equal(res._body.ok, true);
+    assert.equal(res._body.repo.private, false, 'the new state is GitHub\'s answer, never assumed');
+    assert.deepEqual(s.calls.flip, [{ owner: 'jaxri', name: 'mercury' }]);
+  } finally { s.restore(); }
+});
+
+test('POST visibility=public: GitHub\'s 403 becomes not_repo_admin, said plainly', async () => {
+  const s = stub({ makePublic: () => { throw new GithubApiError('no', { status: 403, code: 'not_repo_admin' }); } });
+  try {
+    const res = fakeRes();
+    await postHandler()({ builder: { id: 1 }, body: { repo: 'other/repo', visibility: 'public' } }, res);
+    assert.equal(res._status, 403);
+    assert.equal(res._body.error.code, 'not_repo_admin');
+  } finally { s.restore(); }
+});
+
+test('POST: an off-vocabulary visibility is a 400 (strict enum), never silently coerced', async () => {
+  const s = stub({ makePublic: () => ({}) });
+  try {
+    const res = fakeRes();
+    await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'internal' } }, res);
+    assert.equal(res._status, 400);
+    assert.equal(s.calls.flip.length, 0);
+  } finally { s.restore(); }
+});

package/tests/github_repos_helpers.mjs

@@ -114,3 +114,52 @@ test('createUserRepo: 422 → typed name_taken (the route maps this to a friendl
     (e) => e.code === 'name_taken' && e.status === 422,
   );
 });
+
+// ---- repo-visibility helpers (task 1003045) ----
+
+test('getUserRepo: asks /repos/{owner}/{name}, maps private + admin off GitHub\'s answer', async () => {
+  let calledUrl = '';
+  const fetchImpl = async (url) => {
+    calledUrl = url;
+    return res(200, {
+      full_name: 'me/mercury', html_url: 'https://github.com/me/mercury',
+      private: true, permissions: { admin: true, push: true },
+    });
+  };
+  const out = await gh.getUserRepo('tok', { owner: 'me', name: 'mercury', fetchImpl });
+  assert.match(calledUrl, /\/repos\/me\/mercury$/);
+  assert.deepEqual(out, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury', private: true, admin: true });
+});
+
+test('getUserRepo: 404 → typed repo_not_found (GitHub\'s own no-leak shape, forwarded)', async () => {
+  const fetchImpl = async () => res(404, { message: 'Not Found' });
+  await assert.rejects(
+    () => gh.getUserRepo('tok', { owner: 'me', name: 'gone', fetchImpl }),
+    (e) => e.code === 'repo_not_found' && e.status === 404,
+  );
+});
+
+test('makeRepoPublic: PATCHes exactly {private:false} — the private direction is structurally impossible', async () => {
+  // Like createUserRepo's private:false, the direction is deliberately not a
+  // parameter: the deploy pull runs as the shared deploy key that cannot read a
+  // private repo (N4), so nothing in the codebase may flip a repo private.
+  let sentMethod = '';
+  let sentBody = null;
+  const fetchImpl = async (url, init) => {
+    sentMethod = init.method;
+    sentBody = JSON.parse(init.body);
+    return res(200, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury', private: false, permissions: { admin: true } });
+  };
+  const out = await gh.makeRepoPublic('tok', { owner: 'me', name: 'mercury', fetchImpl });
+  assert.equal(sentMethod, 'PATCH');
+  assert.deepEqual(sentBody, { private: false }, 'only the public direction can ever travel');
+  assert.equal(out.private, false);
+});
+
+test('makeRepoPublic: 403 → typed not_repo_admin', async () => {
+  const fetchImpl = async () => res(403, { message: 'Must have admin rights' });
+  await assert.rejects(
+    () => gh.makeRepoPublic('tok', { owner: 'other', name: 'repo', fetchImpl }),
+    (e) => e.code === 'not_repo_admin' && e.status === 403,
+  );
+});

package/tests/projects_hub.mjs

@@ -51,7 +51,11 @@ test('the nav carries Home plus the three views, and Home is not a view', () =>
 
 test('?view= is the deep-link contract, read on boot and written with replaceState', () => {
   assert.match(SCRIPT, /new URLSearchParams\(location\.search\)\.get\('view'\)/);
-  assert.match(SCRIPT, /history\.replaceState\(null, '', '\?view=' \+ v\)/);
+  assert.match(SCRIPT, /history\.replaceState\(null, '', '\?view=' \+ v \+ idPart\)/);
+  // the manage view is per-project, so its deep link carries the id too
+  // (task 1003041) — and the id is encoded, never raw-interpolated
+  assert.match(SCRIPT, /'&id=' \+ encodeURIComponent\(manageId\)/,
+    'the URL writer must carry the manage id, encoded');
   // the landing page's CTAs have always pointed here — this is the bug they hit
   const landing = fs.readFileSync(path.join(ROOT, 'public-landing', 'index.html'), 'utf8');
   assert.match(landing, /href="\/projects\?view=new"/,
@@ -753,7 +757,8 @@ test('owned truth reaches the TABLE too — same list, same chip, same manage jo
 });
 
 test('an owned orb\'s job is manage, not the public site', () => {
-  assert.match(SCRIPT, /'\?view=mine'/, 'the owned href is the manage deep-link, real and middle-clickable');
+  assert.match(SCRIPT, /'\?view=manage&id=' \+ encodeURIComponent\(String\(inst\.id\)\)/,
+    'the owned href is the manage deep-link, real and middle-clickable');
   assert.match(SCRIPT, /hasAttribute\('data-manage'\)\) return goToManage/,
     'a plain click on an owned orb routes to manage before the card path');
   const orbs = (SCRIPT.match(/function renderOrbs\(([\s\S]*?)\n  \}/) || [, ''])[1];
@@ -794,13 +799,15 @@ test('the orb chip is the manage list\'s truth, never a second story (C6)', () =
     'no instance chip may be literal-classed live — chipMarkup() decides from the overlay');
 });
 
-test('click-to-manage anchors the project and defers until the card exists', () => {
-  assert.match(SCRIPT, /function goToManage/);
-  assert.match(SCRIPT, /pendingAnchor/);
-  assert.match(SCRIPT, /scrollIntoView/);
-  const fn = (SCRIPT.match(/function tryAnchor\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
-  assert.ok(fn, 'tryAnchor() must be extractable');
-  assert.match(fn, /mineClear/, 'a filter that hides the anchored card is cleared, not silently no-op\'d');
+test('click-to-manage opens the per-project manage view (task 1003041)', () => {
+  const fn = (SCRIPT.match(/function goToManage\(instId\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'goToManage() must be extractable');
+  assert.match(fn, /manageId = String\(instId/, 'the target project rides the module state');
+  assert.match(fn, /setView\('manage'\)/, 'the destination is the manage view, not a scroll anchor');
+  // the scroll-anchor era ended with its caller — a half-removed pendingAnchor
+  // would silently no-op every manage click
+  assert.doesNotMatch(SCRIPT, /pendingAnchor/, 'the anchor machinery must be fully gone');
+  assert.doesNotMatch(COSMOS, /\.proj\.anchored/, 'and so must its landing-glow rule');
 });
 
 test('the map does not poll for owned truth — it re-reads on entry (C8)', () => {
@@ -887,3 +894,145 @@ test('zoom heads for the cursor and survives line-mode wheels', () => {
   assert.ok(COSMOS.includes('transform-origin:0 0'),
     'the camera algebra assumes the layer scales about its origin');
 });
+
+/* ── The manage view (task 1003041, goal-1000058 wave) ──────────────────────
+   One owned project's management home: ?view=manage&id=N. The identity block
+   renders the own-scoped per-id read (with the verification overlay); the
+   settings sections are the homes the sibling manage-wave tasks fill in, each
+   an honest not-wired-yet until its task ships. The API is the wall: 404 for
+   strangers (owner or archon only), so the page renders one clean not-found
+   and never a permission hint. ── */
+
+test('the manage view ships as real markup with the four settings homes (C7)', () => {
+  assert.match(HUB, /id="view-manage"/);
+  for (const id of ['mGate', 'mSignin', 'mMissing', 'mAlert', 'mLoading', 'mMain',
+    'mName', 'mChip', 'mMeta', 'mAddr', 'mCreated',
+    'mVisibility', 'mJoinability', 'mRepoVisibility', 'mDelete']) {
+    assert.match(HUB, new RegExp(`id="${id}"`), `${id} must be real markup`);
+  }
+  // and the not-yet copy a crawler reads is in the document, not a template string
+  assert.match(HUB, /isn’t wired up/, 'the honest empty states live in the markup');
+});
+
+test('the manage view balances its own tree, like the wizard', () => {
+  const start = HUB.indexOf('<section id="view-manage"');
+  const end = HUB.indexOf('<section id="view-new"');
+  assert.ok(start !== -1 && end > start, 'need the view-manage span');
+  const manage = HUB.slice(start, end);
+  assert.equal((manage.match(/<div\b/g) || []).length, (manage.match(/<\/div>/g) || []).length,
+    'every div opened in #view-manage closes in #view-manage');
+  assert.equal((manage.match(/<section\b/g) || []).length, (manage.match(/<\/section>/g) || []).length,
+    'every section opened in #view-manage closes in #view-manage');
+});
+
+test('?view=manage&id=N is the deep link — read on boot, and no id means the list', () => {
+  assert.match(SCRIPT, /if \(v === 'manage'\)/, 'viewFromUrl must know the manage view');
+  assert.match(SCRIPT, /\.get\('id'\)/, 'and read the project id off the URL');
+  assert.match(SCRIPT, /manageId = String\(id\); return 'manage';/,
+    'an id lands on the manage view');
+  assert.match(SCRIPT, /return 'mine';/,
+    'a bare ?view=manage names no project — the list is the honest landing');
+});
+
+test('a stranger\'s deep link renders one clean not-found — never a permission hint', () => {
+  const missing = (HUB.match(/<section id="mMissing"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(missing, 'the not-found state must be extractable');
+  assert.doesNotMatch(missing, /permission|allowed|access|owner/i,
+    'the 404 copy must not hint that the project exists behind a wall');
+  assert.match(SCRIPT, /res\.status === 404[\s\S]{0,220}mMissing/,
+    'a 404 lands on the clean not-found state');
+  assert.match(SCRIPT, /res\.status === 401[\s\S]{0,220}mGate/,
+    'a 401 stays a sign-in gate, distinct from not-found');
+});
+
+test('the manage chip defers to chipFor — one site, no second story (C6)', () => {
+  const fn = (SCRIPT.match(/function renderManage\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'renderManage() must be extractable');
+  assert.equal((fn.match(/chipFor\(inst\)/g) || []).length, 1,
+    'renderManage must have exactly one chip call site');
+  assert.match(fn, /addressRow\(inst\)/, 'the address sentence is the shared, verified one');
+  assert.match(fn, /SHAPE_LABEL/, 'the hosting shape speaks the card\'s vocabulary');
+});
+
+test('the manage view spends no timer requests — refresh is entry and tab return (C8)', () => {
+  const tick = (SCRIPT.match(/function manageChipTick\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(tick, 'manageChipTick() must exist');
+  assert.match(tick, /currentView !== 'manage'/, 'the tick is view-guarded');
+  assert.match(tick, /document\.hidden/, 'and does nothing in a hidden tab');
+  assert.doesNotMatch(tick, /fetch\(/, 'zero requests — recency re-renders from data in hand');
+  assert.match(SCRIPT, /if \(v === 'manage'\) loadManage\(\);/, 'entry re-reads once');
+  assert.match(SCRIPT, /currentView === 'manage' && manageId\) loadManage\(true\)/,
+    'tab return re-reads once, quietly');
+});
+
+test('the repo link is built on github.com and escaped — never a raw href', () => {
+  assert.match(SCRIPT, /https:\/\/github\.com\/' \+ esc\(inst\.target_ref\)/,
+    'the identity block links the repo through the page escaper on a fixed origin');
+});
+
+test('every owned card carries its Manage door, and a modified click keeps its meaning', () => {
+  assert.match(SCRIPT, /data-manage="' \+ iid \+ '" href="\?view=manage&id=' \+ iid/,
+    'the card affordance is a real deep-link anchor');
+  assert.match(SCRIPT, /closest\('a\[data-manage\]'\)/, 'the delegated handler upgrades it');
+  assert.match(SCRIPT, /if \(!isPlainClick\(ev\)\) return;/,
+    'ctrl/middle-click falls through to the browser');
+});
+
+/* ── Repo visibility on the manage page (task 1003045) ──────────────────────
+   The section reads the repo's REAL visibility from GitHub with the owner's
+   own repository credential and offers exactly one direction: private→public.
+   The private direction is refused — server-side and here — until the
+   private-repo deploy fix lands, because the deploy pull runs as the shared
+   deploy key that cannot read a private repo (walk finding N4). ── */
+
+test('the repo-visibility section is live markup with its body slot (C7)', () => {
+  assert.match(HUB, /id="mRepoVis"/, 'the section body must be real markup');
+  assert.match(HUB, /Checking the repository on GitHub…/,
+    'the pre-answer state is honest waiting copy, not a fake answer');
+});
+
+test('flip-to-private cannot travel from this page — only the public direction exists', () => {
+  assert.match(SCRIPT, /visibility: 'public'/, 'the one POST body pins the public direction');
+  assert.doesNotMatch(SCRIPT, /visibility:\s*'private'/,
+    'no code path may send the private direction');
+  // the refusal is SAID, with its reason, not silently missing
+  assert.match(SCRIPT, /can’t deploy private repositories/,
+    'the private-repo limitation is stated in plain words');
+});
+
+test('the visibility shown is GitHub\'s answer, never an assumption', () => {
+  const fn = (SCRIPT.match(/function doRepoPublic\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'doRepoPublic() must be extractable');
+  assert.match(fn, /manageRepo = data\.repo/,
+    'after a flip, the rendered state is what GitHub returned');
+  const render = (SCRIPT.match(/function renderRepoVis\(repo\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(render, 'renderRepoVis() must be extractable');
+  assert.match(render, /repo\.private/, 'the branch reads the live flag');
+  assert.match(render, /repo\.admin/,
+    'the flip button only shows when GitHub says this account may change settings');
+});
+
+test('the GitHub read fires on entry and tab return only — never from the tick\'s render', () => {
+  assert.match(SCRIPT, /loadRepoVisibility\(inst\);/, 'the read rides loadManage\'s success');
+  const render = (SCRIPT.match(/function renderManage\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(render, 'renderManage() must be extractable');
+  assert.doesNotMatch(render, /loadRepoVisibility/,
+    'renderManage is what manageChipTick calls every minute — a read here would poll GitHub (C8)');
+});
+
+test('the reconnect door asks for repository access and returns to this project', () => {
+  const fn = (SCRIPT.match(/function repoVisReconnect\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'repoVisReconnect() must be extractable');
+  assert.match(fn, /repos=1/, 'the door carries the repo scope ask');
+  assert.match(fn, /encodeURIComponent\('\/projects\?view=manage&id=' \+ manageId\)/,
+    'and returns to the exact project being managed');
+});
+
+test('making a repo public asks first — exposure is never one accidental click', () => {
+  const fn = (SCRIPT.match(/function askRepoPublic\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'askRepoPublic() must be extractable');
+  assert.match(fn, /Anyone on the internet will be able to read the code/,
+    'the confirm states the consequence in plain words');
+  assert.match(SCRIPT, /data-repo-public-yes/, 'the confirm is a distinct second click');
+  assert.match(SCRIPT, /data-repo-public-no/, 'and declining is offered, not implied');
+});

package/tests/provisioning_settings.mjs

@@ -97,7 +97,36 @@ function reset({ inst, as } = {}) {
   events = [];
 }
 
-console.log('GET /provisioning/instances/:id/settings:');
+console.log('GET /provisioning/instances/:id (the manage page\'s read — task 1003041):');
+
+await ta('owner reads their own instance', async () => {
+  reset();
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.instance.slug, 'spike');
+});
+
+await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
+  reset({ as: { id: 8, github_login: 'stranger', rank: 'thetes' } });
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 404, r.raw);
+  assert.equal(r.body.error.code, 'instance_not_found');
+});
+
+await ta('an Archon may read ANY instance — the manage-page override (task 1003041)', async () => {
+  reset({ as: { id: 999, github_login: 'archon', rank: 'archon' } });
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.instance.slug, 'spike');
+});
+
+await ta('unknown instance id → 404 for everyone, archon included', async () => {
+  reset({ inst: null, as: { id: 999, github_login: 'archon', rank: 'archon' } });
+  const r = await get('/provisioning/instances/999');
+  assert.equal(r.status, 404, r.raw);
+});
+
+console.log('\nGET /provisioning/instances/:id/settings:');
 
 await ta('owner reads DEFAULTS (public / apply) on a row with empty settings — today\'s behavior', async () => {
   reset();

package/tests/public_landing_projects.mjs

@@ -107,6 +107,30 @@ test('a domainless instance gets an honest no-address state', async () => {
   assert.match(body, /[Nn]o address yet/);
 });
 
+test('the manage view is served: identity block + honest not-yet sections (task 1003041)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /id="view-manage"/);
+  // the four settings homes the sibling manage-wave tasks fill in
+  for (const id of ['mVisibility', 'mJoinability', 'mRepoVisibility', 'mDelete']) {
+    assert.match(body, new RegExp(`id="${id}"`), `${id} must be served`);
+  }
+  assert.match(body, /isn’t wired up/, 'each unshipped section says so honestly');
+  // the not-found state is one clean answer — never a permission hint
+  const missing = (body.match(/<section id="mMissing"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(missing, 'the not-found state must be served');
+  assert.doesNotMatch(missing, /permission|allowed|access|owner/i);
+});
+
+test('the repo-visibility section is served live, with the private direction refused (task 1003045)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /id="mRepoVis"/, 'the live section body is served');
+  assert.match(body, /can’t deploy private repositories/,
+    'the private-repo limitation is stated in plain words');
+  assert.doesNotMatch(body, /visibility:\s*'private'/,
+    'no served code path may send the private direction');
+  assert.match(body, /repos=1/, 'the reconnect door asks for repository access');
+});
+
 test('the empty state points a new owner at the wizard view — never at a hall', async () => {
   const { body } = await request('/projects', 'game.test.local');
   // /create was absorbed into ?view=new (task 1002763); the CTA moves in-page