@bongos/core 1.19.210 → 1.19.211

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.210",
-  "core_contract": "1.19.210",
-  "source_commit": "00146d83dff6ca94febcce329b5677b8d7dcb25c",
+  "core_version": "1.19.211",
+  "core_contract": "1.19.211",
+  "source_commit": "348da70b502ddf8be58aa20aeb71dcf7be94ec7c",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T22:55:17.955Z",
+  "built_at": "2026-08-17T23:14:01.398Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
     "agent_docs_stubbed": 21,
-    "functional_verbatim": 1300,
+    "functional_verbatim": 1301,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 1631,
-  "tree_sha256": "101f3cedf1222f6a1a14cc53957baf132e2586e9061e196dcff4550d43033a10",
+  "file_count": 1632,
+  "tree_sha256": "5d3eac725354ec0e3bd3c1d91f38bcc539a355b8e2b137de56de74ddfbe2572f",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -347,12 +347,12 @@
     {
       "path": "clients/bongos-client/README.md",
       "mode": "0000644",
-      "sha256": "2755203dec4a1450c5950c39a767bc093d1d1227f952193001cdfa94205e995f"
+      "sha256": "81ffa13d3b249b46c4ed62be26cf8e985102697f090a3cfbe7491ff728976028"
     },
     {
       "path": "clients/bongos-client/bongos-client.global.js",
       "mode": "0000644",
-      "sha256": "7b4e5ecf6c6d12a3c9e603a0f5b4bd28ba8cd991399ed8941181b6aeae53772d"
+      "sha256": "23b9f9be8ed1276fa2422cb74ae185c0e37813672e83196aeb6810f091815c12"
     },
     {
       "path": "clients/bongos-client/examples/hello-world.mjs",
@@ -362,17 +362,17 @@
     {
       "path": "clients/bongos-client/index.cjs",
       "mode": "0000644",
-      "sha256": "a92355ef21073634500f6806f1e495c955a0b67e889cf07264ed8d1169b119be"
+      "sha256": "0e38267f075a54b3695a40da4a54f366d5b42827027e4e3614713e6bcc19ca4a"
     },
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "8fe97a3daefdceb9bf40a15a19dffb81fb6387c0acbe20041e58e63b24e80dd1"
+      "sha256": "004ad81d92eab45d5384876ce355b8f9208c32e202289f5c4fb1117932d27a14"
     },
     {
       "path": "clients/bongos-client/index.mjs",
       "mode": "0000644",
-      "sha256": "adb2a36a9598c543adbf7c8011f36585f7c394bac7f4961718359ee7a29cb1dd"
+      "sha256": "661cd90af7bd8d0190cf9cef5614fee48dc48858d3cf9dea681da8b3fc99d170"
     },
     {
       "path": "clients/bongos-client/package.json",
@@ -1367,12 +1367,12 @@
     {
       "path": "docs/api-reference.md",
       "mode": "0000644",
-      "sha256": "7b61c830bb85b66e1d6d5dad672fd4b90166e01d07be0f5db7677fc38cc24817"
+      "sha256": "43f6538485af5153a0ce0fb82f103431fa869cc7d996f5b6694577c474b0f0fe"
     },
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "260f4413742edbb61d7695a1912ecae67383c9787a7f6f40211c5421668da480"
+      "sha256": "274bd57fc6c0b83aba02cedb5cc6daa2fca4a9d74ae5268e527a81ebc10b50e0"
     },
     {
       "path": "docs/architecture.md",
@@ -2682,7 +2682,7 @@
     {
       "path": "modules/dev-box/app/src/vendor/bongos-client.cjs",
       "mode": "0000644",
-      "sha256": "a92355ef21073634500f6806f1e495c955a0b67e889cf07264ed8d1169b119be"
+      "sha256": "0e38267f075a54b3695a40da4a54f366d5b42827027e4e3614713e6bcc19ca4a"
     },
     {
       "path": "modules/dev-box/app/test/unit.mjs",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "4cfce69a22e52a9c0a89cd376458a32616167c2c6ca387f9cfc376212fd630db"
+      "sha256": "aa3d213f3f3548f655bee0361f01e43ee380b54e958f8d11683ba7d94a098d2b"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "6c5ee2445f8c94f3ccbcee5c2387ac2029e34607601ff6146c6a932dc6282d40"
+      "sha256": "368f9931ba9dc39483dc3a9c488fb8df45342cccccab65d34b9a4d083fa530ed"
     },
     {
       "path": "public-docs/index.html",
@@ -4547,7 +4547,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "e19cbe7db15331509cb1f09c5e8cbcf0379bb55ddb5bc405d4ebf386186f016c"
+      "sha256": "790034f4256a31da114969853e14fdf47b43b0ad35907b4fcc14ff98897ec7d1"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5682,7 +5682,7 @@
     {
       "path": "src/bongos/github-repos.js",
       "mode": "0000644",
-      "sha256": "893a2eb6f2658942cee2043ff130a5ae38538007e47e2ec2665548e0d286e211"
+      "sha256": "f34518361f15a20c4dc60a936878e72b4c81d99e41e00180270919dcbbd83008"
     },
     {
       "path": "src/bongos/goal-scope-check.js",
@@ -5807,7 +5807,7 @@
     {
       "path": "src/bongos/routes/github.js",
       "mode": "0000644",
-      "sha256": "2895aa72fbcef361a5edf07166e64e9902edcb5971eb2e496705b3bfddeabda1"
+      "sha256": "d8674cd2358b63f8463d91484495feaa38219fafdc0d925ad52ddb206a2cc84a"
     },
     {
       "path": "src/bongos/routes/healthz.js",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "8f9beea649114a7133ef56008878f45197bb97c29bdddf6e5c6c5d786ca30981"
+      "sha256": "5998d6f2561e88ca21f3f764a48fd496767d0b2f16aeaf1a1e7cf981333c4faf"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -6734,10 +6734,15 @@
       "mode": "0000644",
       "sha256": "850113ed91babc9eb54dc22231f194d283fd3f94cee9deef1e6e0bf6f3a969c2"
     },
+    {
+      "path": "tests/github_repo_visibility.mjs",
+      "mode": "0000644",
+      "sha256": "c2c428ade3a7cf802dfc46415c1d3c1e09fe826e223df71101e81d014cb5d69e"
+    },
     {
       "path": "tests/github_repos_helpers.mjs",
       "mode": "0000644",
-      "sha256": "14d68c064218655bdbc04fe95dd7d03a8ac0d152301ac65c8c2c7b9fd93926ef"
+      "sha256": "a450e5248b3b97ddaa11b1b9c79d768779df24b11cd1177174390ae80f5fe624"
     },
     {
       "path": "tests/github_token_store.mjs",
@@ -7522,7 +7527,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "3c31493c1b2a804b52f34310dc31f10b3bf67387ed9266c06fd7295aac2f0d5b"
+      "sha256": "963b745e4b4ecd6a786f88758d57aee8680edd49d25f0cc84e3b563a5125be3b"
     },
     {
       "path": "tests/provision.mjs",
@@ -7572,7 +7577,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "d3e132bd85382b1a9ff4fa2d582a5fc72dabc91b2dc50828b5f622f6c112b2f1"
+      "sha256": "266f5936675c0f6eb8d64af713d215edea2b88bcab50153497ef2d23fec1ff65"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/clients/bongos-client/README.md

@@ -5,7 +5,7 @@ A **generated**, zero-dependency typed client for the Bongos API — produced fr
 by hand; it regenerates when the spec changes, so it can never drift from the routes.
 
 - API version: **v1** (served at `/api/bongos/v1`)
-- 278 operations across 46 resource groups
+- 280 operations across 46 resource groups
 
 ## Install
 

package/clients/bongos-client/bongos-client.global.js

@@ -283,6 +283,10 @@ function createClient(opts = {}) {
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
     },
     "github": {
+      // GET /github/repo — rank: any-builder — GET /github/repo
+      getGithubRepo: (args) => request("GET", "/github/repo", { hasBody: false }, args),
+      // POST /github/repo/visibility — rank: any-builder — POST /github/repo/visibility
+      postGithubRepoVisibility: (args) => request("POST", "/github/repo/visibility", { hasBody: true }, args),
       // GET /github/repos — rank: any-builder — GET /github/repos
       getGithubRepos: (args) => request("GET", "/github/repos", { hasBody: false }, args),
       // POST /github/repos — rank: any-builder — POST /github/repos

package/clients/bongos-client/index.cjs

@@ -282,6 +282,10 @@ function createClient(opts = {}) {
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
     },
     "github": {
+      // GET /github/repo — rank: any-builder — GET /github/repo
+      getGithubRepo: (args) => request("GET", "/github/repo", { hasBody: false }, args),
+      // POST /github/repo/visibility — rank: any-builder — POST /github/repo/visibility
+      postGithubRepoVisibility: (args) => request("POST", "/github/repo/visibility", { hasBody: true }, args),
       // GET /github/repos — rank: any-builder — GET /github/repos
       getGithubRepos: (args) => request("GET", "/github/repos", { hasBody: false }, args),
       // POST /github/repos — rank: any-builder — POST /github/repos

package/clients/bongos-client/index.d.ts

@@ -35,6 +35,7 @@ export interface GetBuildersMePendingRankChangeResponse { change: unknown; greet
 export interface GetBuildersRosterResponse { builders: unknown; stale_hours: unknown }
 export interface GetDiscordChannelsPlanResponse { ok: boolean; guild_id: unknown; op_count: unknown; ops: unknown; warnings: unknown }
 export interface GetDoneWhenPendingReviewResponse { criteria: unknown; count: unknown }
+export interface GetGithubRepoResponse { ok: boolean; repo: unknown; private_deployable: boolean }
 export interface GetGithubReposResponse { repos: unknown }
 export interface GetGoalsIdConflictsResponse { ok: boolean; goal_id: unknown; conflicts: unknown; cross_goals_considered: unknown }
 export interface GetGoalsIdRequestsResponse { requests: unknown }
@@ -199,6 +200,8 @@ export interface PostDoneWhenCriterionIdSatisfyRequest { satisfied_by_task_id?:
 export interface PostDoneWhenCriterionIdSatisfyResponse { criterion: unknown; goal_achieved: unknown; goal: unknown }
 export interface PostDoneWhenCriterionIdUnsatisfyResponse { criterion: unknown }
 export interface PostGateApprovalsPrApproveResponse { ok: boolean; pr: unknown; already_clear?: boolean; message: unknown; head_sha?: unknown; status_set?: boolean; recheck?: unknown }
+export interface PostGithubRepoVisibilityRequest { repo: string; visibility: "public" | "private" }
+export interface PostGithubRepoVisibilityResponse { ok: boolean; repo: unknown; private_deployable: boolean }
 export interface PostGithubReposRequest { name: string }
 export interface PostGithubReposResponse { repo: unknown }
 export interface PostGoalsIdArchiveResponse { ok: boolean; goal: unknown }
@@ -530,6 +533,10 @@ export interface BongosClient {
     postGateApprovalsPrApprove(args?: RequestArgs): Promise<PostGateApprovalsPrApproveResponse>;
   };
   "github": {
+    /** GET /github/repo — rank: any-builder */
+    getGithubRepo(args?: RequestArgs): Promise<GetGithubRepoResponse>;
+    /** POST /github/repo/visibility — rank: any-builder */
+    postGithubRepoVisibility(args: RequestArgs & { body: PostGithubRepoVisibilityRequest }): Promise<PostGithubRepoVisibilityResponse>;
     /** GET /github/repos — rank: any-builder */
     getGithubRepos(args?: RequestArgs): Promise<GetGithubReposResponse>;
     /** POST /github/repos — rank: any-builder */

package/clients/bongos-client/index.mjs

@@ -279,6 +279,10 @@ export function createClient(opts = {}) {
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
     },
     "github": {
+      // GET /github/repo — rank: any-builder — GET /github/repo
+      getGithubRepo: (args) => request("GET", "/github/repo", { hasBody: false }, args),
+      // POST /github/repo/visibility — rank: any-builder — POST /github/repo/visibility
+      postGithubRepoVisibility: (args) => request("POST", "/github/repo/visibility", { hasBody: true }, args),
       // GET /github/repos — rank: any-builder — GET /github/repos
       getGithubRepos: (args) => request("GET", "/github/repos", { hasBody: false }, args),
       // POST /github/repos — rank: any-builder — POST /github/repos

package/docs/api/openapi.json

@@ -3641,6 +3641,93 @@
         ]
       }
     },
+    "/github/repo": {
+      "get": {
+        "operationId": "get_github_repo",
+        "tags": [
+          "github"
+        ],
+        "summary": "GET /github/repo",
+        "description": "reads one repo AS the caller's own GitHub credential sees it (the manage page's repo-visibility read, task 1003045). GitHub's 404 covers both \"no such repo\" and \"no access\" — forwarded as-is, no existence leak.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/github.js",
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/GetGithubRepoResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/BadRequest"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
+    "/github/repo/visibility": {
+      "post": {
+        "operationId": "post_github_repo_visibility",
+        "tags": [
+          "github"
+        ],
+        "summary": "POST /github/repo/visibility",
+        "description": "flips one of the caller's repos PUBLIC, with their own credential. The private direction is REFUSED here, before GitHub is ever called: the deploy pull still runs as the shared deploy key that cannot read a private repo (walk finding N4), so flipping private would break the project's next deploy — the refusal is the honest leg task 1003045 ships.\n\n**Rank:** `any-builder` — Any authenticated builder (row-level ownership enforced in-handler).",
+        "x-rank": "any-builder",
+        "x-source": "src/bongos/routes/github.js",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PostGithubRepoVisibilityRequest"
+              }
+            }
+          },
+          "x-validated": true
+        },
+        "responses": {
+          "200": {
+            "description": "Success.",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PostGithubRepoVisibilityResponse"
+                }
+              }
+            }
+          },
+          "400": {
+            "$ref": "#/components/responses/ValidationFailed"
+          },
+          "401": {
+            "$ref": "#/components/responses/Unauthorized"
+          },
+          "403": {
+            "$ref": "#/components/responses/Forbidden"
+          }
+        },
+        "security": [
+          {
+            "builderSession": []
+          }
+        ]
+      }
+    },
     "/github/repos": {
       "get": {
         "operationId": "get_github_repos",
@@ -13020,6 +13107,23 @@
           "count"
         ]
       },
+      "GetGithubRepoResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "repo": {},
+          "private_deployable": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok",
+          "repo",
+          "private_deployable"
+        ]
+      },
       "GetGithubReposResponse": {
         "type": "object",
         "properties": {
@@ -15323,6 +15427,44 @@
           "message"
         ]
       },
+      "PostGithubRepoVisibilityRequest": {
+        "type": "object",
+        "properties": {
+          "repo": {
+            "type": "string",
+            "maxLength": 140
+          },
+          "visibility": {
+            "type": "string",
+            "enum": [
+              "public",
+              "private"
+            ]
+          }
+        },
+        "required": [
+          "repo",
+          "visibility"
+        ],
+        "additionalProperties": false
+      },
+      "PostGithubRepoVisibilityResponse": {
+        "type": "object",
+        "properties": {
+          "ok": {
+            "type": "boolean"
+          },
+          "repo": {},
+          "private_deployable": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "ok",
+          "repo",
+          "private_deployable"
+        ]
+      },
       "PostGithubReposRequest": {
         "type": "object",
         "properties": {
@@ -17587,9 +17729,9 @@
       "description": "A required dependency/feature is not configured or is temporarily down."
     }
   },
-  "x-endpoint-count": 278,
-  "x-schema-count": 314,
+  "x-endpoint-count": 280,
+  "x-schema-count": 317,
   "x-undocumented-bodies": 8,
-  "x-response-schemas": 212,
+  "x-response-schemas": 214,
   "x-generated-by": "scripts/gds/gen-api-docs.js"
 }

package/docs/api-reference.md

@@ -2,7 +2,7 @@
 
 # Bongos API reference
 
-> **Generated from the live route files** — the route file is authoritative. 278 endpoints across 46 route files.
+> **Generated from the live route files** — the route file is authoritative. 280 endpoints across 46 route files.
 > Machine-readable spec: [`docs/api/openapi.json`](api/openapi.json) (OpenAPI 3.1). Rendered docs site: **`/docs`** (e.g. `cloudbongos.com/docs`).
 
 Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>.md)): `public` < `any-builder` < `metic+archon` < `archon`.
@@ -178,10 +178,12 @@ Base path: `/api/bongos`. Ranks (enforced server-side, [ADR 0016](adr/<redacted>
 | GET | `/api/bongos/gate-approvals` | `metic+archon` | — | GET /gate-approvals — open PRs awaiting owner approval (gate-review red), with the verdict + per-file reasons + changed files + diff link. |
 | POST | `/api/bongos/gate-approvals/:pr/approve` | `archon` | — | POST /gate-approvals/:pr/approve — record owner approval for a stuck gate PR and re-run the gate-review check so it clears. |
 
-## `github` (2)
+## `github` (4)
 
 | Method | Path | Rank | Body | Description |
 |---|---|---|---|---|
+| GET | `/api/bongos/github/repo` | `any-builder` | — | reads one repo AS the caller's own GitHub credential sees it (the manage page's repo-visibility read, task 1003045). |
+| POST | `/api/bongos/github/repo/visibility` | `any-builder` | `repo`, `visibility` | flips one of the caller's repos PUBLIC, with their own credential. |
 | GET | `/api/bongos/github/repos` | `any-builder` | — | acts only on the caller's OWN GitHub identity (the token they granted). |
 | POST | `/api/bongos/github/repos` | `any-builder` | `name` | creates a repo in the caller's OWN account. |
 

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -282,6 +282,10 @@ function createClient(opts = {}) {
       postGateApprovalsPrApprove: (args) => request("POST", "/gate-approvals/{pr}/approve", { hasBody: true }, args),
     },
     "github": {
+      // GET /github/repo — rank: any-builder — GET /github/repo
+      getGithubRepo: (args) => request("GET", "/github/repo", { hasBody: false }, args),
+      // POST /github/repo/visibility — rank: any-builder — POST /github/repo/visibility
+      postGithubRepoVisibility: (args) => request("POST", "/github/repo/visibility", { hasBody: true }, args),
       // GET /github/repos — rank: any-builder — GET /github/repos
       getGithubRepos: (args) => request("GET", "/github/repos", { hasBody: false }, args),
       // POST /github/repos — rank: any-builder — POST /github/repos

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.210",
+  "version": "1.19.211",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.210",
+      "version": "1.19.211",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.210",
+  "version": "1.19.211",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -618,9 +618,14 @@ h1[tabindex="-1"]:focus{outline:none;}
         <div class="empty"><p>Choosing how new people join — walk right in, apply first, or invite only — isn’t wired up here yet. It lands in one of the next updates.</p></div>
       </div>
 
+      <!-- live since task 1003045: reads the repo's real visibility from GitHub
+           with the owner's own repository credential. Flip-to-PUBLIC only — the
+           private direction is refused (server + copy) until the private-repo
+           deploy fix lands, because the deploy pull cannot read a private repo
+           (walk finding N4). -->
       <div class="card" id="mRepoVisibility">
         <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Repository visibility</h2>
-        <div class="empty"><p>Making the project’s code repository public or private from here isn’t wired up yet. Until it lands, GitHub’s own settings page is the place to change that.</p></div>
+        <div id="mRepoVis"><p class="finePrint">Checking the repository on GitHub…</p></div>
       </div>
 
       <div class="card" id="mDelete">
@@ -3942,6 +3947,9 @@ h1[tabindex="-1"]:focus{outline:none;}
         var inst = data.instance || {};
         inst.open_intent = data.open_intent || null;
         renderManage(inst);
+        /* the SECOND, GitHub-backed read — fired only here (entry + tab
+           return), never from renderManage, which the fetch-free tick calls */
+        loadRepoVisibility(inst);
       })
       .catch(function (err) {
         var m = String(err && err.message);
@@ -3959,6 +3967,122 @@ h1[tabindex="-1"]:focus{outline:none;}
   }
   setInterval(manageChipTick, REFRESH_MS);
 
+  /* ── repo visibility (task 1003045): read live from GitHub with the owner's
+     own repository credential; flip-to-PUBLIC only. The private direction is
+     refused by the server — and unbuilt here — until the private-repo deploy
+     fix lands: the deploy pull runs as the shared deploy key, which cannot
+     read a private repo (walk finding N4), so flipping private would break
+     the project's next deploy. Every claim below is what GitHub answered for
+     THIS account — never a cached or guessed state. ── */
+
+  var manageRepo = null; /* GitHub's last answer for the manage view's repo */
+
+  function repoVisReconnect() {
+    return API + '/auth/web/start?repos=1&return=' +
+      encodeURIComponent('/projects?view=manage&id=' + manageId);
+  }
+
+  function repoVisMsg(html) { $('mRepoVis').innerHTML = html; }
+
+  function renderRepoVis(repo) {
+    if (repo.private) {
+      repoVisMsg(
+        '<div class="addr">This repository is <b>private</b> — only accounts it’s shared with can read its code.</div>' +
+        '<div class="projMsg err">The platform can’t deploy private repositories yet, so deploys for this project will fail while it stays private.</div>' +
+        (repo.admin
+          ? '<div class="actions"><button type="button" class="btn small" data-repo-public>Make it public</button></div>'
+          : '<p class="finePrint">Your GitHub account can’t change this repository’s settings.</p>'));
+    } else {
+      repoVisMsg(
+        '<div class="addr">This repository is <b>public</b> — anyone can read its code.</div>' +
+        '<p class="finePrint">Making it private isn’t possible from here yet: the platform can’t deploy private repositories. The switch lands with that fix.</p>');
+    }
+  }
+
+  function loadRepoVisibility(inst) {
+    manageRepo = null;
+    if (!inst.target_ref) {
+      repoVisMsg('<p class="finePrint">No repository is linked to this project.</p>');
+      return;
+    }
+    repoVisMsg('<p class="finePrint">Checking the repository on GitHub…</p>');
+    var asked = manageId; /* a stale answer must never describe a newer project */
+    fetch(API + '/github/repo?repo=' + encodeURIComponent(inst.target_ref), { credentials: 'same-origin' })
+      .then(function (res) {
+        if (asked !== manageId) throw new Error('stale');
+        return jsonOrEmpty(res).then(function (data) {
+          if (res.ok) { manageRepo = data.repo || {}; renderRepoVis(manageRepo); return; }
+          var e = apiError(data, res.status);
+          if (e.code === 'repo_scope_required') {
+            /* the stored repository credential lives an hour (ADR 0155) — the
+               owner reconnects through the same door the create wizard uses */
+            repoVisMsg('<p class="finePrint">Seeing and changing this here needs repository access. ' +
+              '<a href="' + repoVisReconnect() + '">Reconnect GitHub with repository access</a>.</p>');
+          } else if (e.code === 'github_repos_unavailable') {
+            repoVisMsg('<p class="finePrint">Repository access isn’t configured on this server, so visibility can’t be read from here.</p>');
+          } else if (e.code === 'repo_not_found') {
+            repoVisMsg('<p class="finePrint">GitHub didn’t show this repository to your account — it may have been deleted, renamed, or belong to a different account.</p>');
+          } else if (res.status === 401) {
+            repoVisMsg('<p class="finePrint">' + signInAgain() + '</p>');
+          } else {
+            repoVisMsg('<p class="finePrint">GitHub couldn’t be reached right now — refresh in a moment.</p>');
+          }
+        });
+      })
+      .catch(function (err) {
+        if (String(err && err.message) === 'stale') return;
+        repoVisMsg('<p class="finePrint">GitHub couldn’t be reached right now — refresh in a moment.</p>');
+      });
+  }
+
+  /* flipping public exposes the code to everyone — never one accidental click */
+  function askRepoPublic() {
+    var act = document.querySelector('#mRepoVis .actions');
+    if (!act) return;
+    act.innerHTML = '<div class="confirmRow">' +
+      '<span class="plain">Make it public? Anyone on the internet will be able to read the code.</span>' +
+      '<button type="button" class="btn small" data-repo-public-yes>Yes, make it public</button>' +
+      '<button type="button" class="linklike" data-repo-public-no>Keep it private</button></div>';
+  }
+
+  function doRepoPublic() {
+    if (!manageInst || !manageInst.target_ref) return;
+    repoVisMsg('<p class="finePrint">Asking GitHub…</p>');
+    fetch(API + '/github/repo/visibility', {
+      method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ repo: manageInst.target_ref, visibility: 'public' })
+    }).then(function (res) {
+      return jsonOrEmpty(res).then(function (data) {
+        if (res.ok) {
+          /* GitHub's own answer paints the new state — never an assumption */
+          manageRepo = data.repo || {};
+          renderRepoVis(manageRepo);
+          return;
+        }
+        var e = apiError(data, res.status);
+        /* say what the server said, on top of the still-true state */
+        if (manageRepo) renderRepoVis(manageRepo);
+        else repoVisMsg('');
+        $('mRepoVis').insertAdjacentHTML('beforeend',
+          res.status === 401
+            ? '<div class="projMsg err">' + signInAgain() + '</div>'
+            : '<div class="projMsg err">' + esc(e.message || 'The change could not be made — try again in a moment.') + '</div>');
+      });
+    }).catch(function () {
+      if (manageRepo) renderRepoVis(manageRepo);
+      $('mRepoVis').insertAdjacentHTML('beforeend',
+        '<div class="projMsg err">Couldn’t reach the platform — check your connection and try again.</div>');
+    });
+  }
+
+  $('mRepoVis').addEventListener('click', function (ev) {
+    var t = ev.target.closest && ev.target.closest('button');
+    if (!t) return;
+    if (t.hasAttribute('data-repo-public')) return askRepoPublic();
+    if (t.hasAttribute('data-repo-public-yes')) return doRepoPublic();
+    if (t.hasAttribute('data-repo-public-no')) { if (manageRepo) renderRepoVis(manageRepo); }
+  });
+
   /* ── teardown: ask, confirm (the truth, itemized — direction §5.4), then
      SAY exactly what the server said ── */
 

package/src/bongos/github-repos.js

@@ -102,4 +102,64 @@ async function createUserRepo(token, { name, fetchImpl = fetch } = {}) {
   throw new GithubApiError(`GitHub create-repo failed (${res.status})`, { status: res.status, code: 'github_error' });
 }
 
-module.exports = { listUserRepos, createUserRepo, GithubApiError, MAX_PAGES };
+// Read one repo as GitHub answers it FOR THIS TOKEN — the manage page's
+// visibility read (task 1003045). GitHub's own 404 covers both "no such repo"
+// and "no access", which is exactly the no-leak shape the caller wants to
+// forward. `permissions.admin` says whether this token could change settings.
+// Returns { full_name, html_url, private, admin }.
+async function getUserRepo(token, { owner, name, fetchImpl = fetch } = {}) {
+  const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`, {
+    headers: ghHeaders(token),
+  });
+  if (res.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (res.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository', { status: 404, code: 'repo_not_found' });
+  }
+  if (!res.ok) {
+    throw new GithubApiError(`GitHub /repos read failed (${res.status})`, { status: res.status, code: 'github_error' });
+  }
+  const r = await res.json();
+  return {
+    full_name: r.full_name,
+    html_url: r.html_url,
+    private: !!r.private,
+    admin: !!(r.permissions && r.permissions.admin),
+  };
+}
+
+// Flip one repo PUBLIC — and only public. Like createUserRepo's private:false,
+// the direction is deliberately not a parameter: the deploy pull still runs as
+// the shared deploy key that cannot read a private repo (walk finding N4), so
+// nothing in this codebase may flip a repo private until that fix lands — the
+// route refuses the request; this helper makes the refusal structural
+// (task 1003045). Returns the same shape as getUserRepo.
+async function makeRepoPublic(token, { owner, name, fetchImpl = fetch } = {}) {
+  const res = await fetchImpl(`${GH_API}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}`, {
+    method: 'PATCH',
+    headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
+    body: JSON.stringify({ private: false }),
+  });
+  if (res.status === 401) {
+    throw new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+  }
+  if (res.status === 403) {
+    throw new GithubApiError('GitHub refused the change for this account', { status: 403, code: 'not_repo_admin' });
+  }
+  if (res.status === 404) {
+    throw new GithubApiError('GitHub answered 404 for that repository', { status: 404, code: 'repo_not_found' });
+  }
+  if (!res.ok) {
+    throw new GithubApiError(`GitHub repo-visibility change failed (${res.status})`, { status: res.status, code: 'github_error' });
+  }
+  const r = await res.json();
+  return {
+    full_name: r.full_name,
+    html_url: r.html_url,
+    private: !!r.private,
+    admin: !!(r.permissions && r.permissions.admin),
+  };
+}
+
+module.exports = { listUserRepos, createUserRepo, getUserRepo, makeRepoPublic, GithubApiError, MAX_PAGES };

package/src/bongos/routes/github.js

@@ -1,5 +1,7 @@
 // src/bongos/routes/github.js — GitHub repo list/create for the signed-in user, the
-// server half of the onboarding wizard's repo picker (adopt) + auto-create (fresh).
+// server half of the onboarding wizard's repo picker (adopt) + auto-create (fresh),
+// plus the manage page's repo-visibility read/flip (task 1003045 — public only; the
+// private direction is refused until the private-repo deploy fix lands).
 // Task 1002099 / ADR 0143.
 //
 // These act on the user's OWN GitHub identity, so they live in core auth alongside
@@ -18,11 +20,29 @@ const auth = require('../auth');
 const db = require('../db');
 const secretBox = require('../secret-box');
 const { listUserRepos, createUserRepo } = require('../github-repos');
+// Namespace require for the visibility helpers (task 1003045): the route tests
+// stub these on the cached module object, which a load-time destructure would
+// pin to the real implementations.
+const githubRepos = require('../github-repos');
 const { validateOrRespond } = require('./_helpers');
 
 // GitHub repo names: 1–100 chars of [A-Za-z0-9._-]. We validate strictly for a clean
 // 400; anything GitHub still rejects surfaces as the 422→409 name_taken path.
 const REPO_NAME_RE = /^[A-Za-z0-9._-]{1,100}$/;
+// owner/name for the visibility routes: a GitHub login (1–39 chars, alnum + inner
+// hyphens) over a repo name. Strict for a clean 400; GitHub still owns the truth.
+const REPO_REF_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})?\/[A-Za-z0-9._-]{1,100}$/;
+
+// Parse + validate the owner/name ref, or send a 400 and return null.
+function parseRepoRef(raw, res) {
+  const ref = String(raw || '').trim();
+  if (!REPO_REF_RE.test(ref)) {
+    res.fail('bad_repo_ref', { status: 400, message: 'Name the repository as owner/name.' });
+    return null;
+  }
+  const [owner, name] = ref.split('/');
+  return { owner, name };
+}
 
 // Resolve the caller's stored repo token, or send the right failure and return null.
 // Centralizes the 503-vs-403 decision both endpoints share.
@@ -97,5 +117,70 @@ module.exports = function buildGithubRouter() {
     }
   });
 
+  // rank: any-builder — reads one repo AS the caller's own GitHub credential sees
+  // it (the manage page's repo-visibility read, task 1003045). GitHub's 404 covers
+  // both "no such repo" and "no access" — forwarded as-is, no existence leak.
+  router.get('/github/repo', auth.requireBuilder, async (req, res) => {
+    const ref = parseRepoRef(req.query.repo, res);
+    if (!ref) return;
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      const repo = await githubRepos.getUserRepo(token, ref);
+      // private_deployable is the platform truth the UI copy leans on: the deploy
+      // pull runs as the shared deploy key, which cannot read a private repo (N4).
+      res.json({ ok: true, repo, private_deployable: false });
+    } catch (err) {
+      if (err && err.status === 401) {
+        await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+        return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to read the repository.' });
+      }
+      if (err && err.code === 'repo_not_found') {
+        return res.fail('repo_not_found', { status: 404, message: 'GitHub didn’t show that repository to your account.' });
+      }
+      console.error('[gds] GET /github/repo', err && err.message);
+      res.fail('github_error', { status: 502, message: 'GitHub could not be reached. Try again in a moment.' });
+    }
+  });
+
+  // rank: any-builder — flips one of the caller's repos PUBLIC, with their own
+  // credential. The private direction is REFUSED here, before GitHub is ever
+  // called: the deploy pull still runs as the shared deploy key that cannot read
+  // a private repo (walk finding N4), so flipping private would break the
+  // project's next deploy — the refusal is the honest leg task 1003045 ships.
+  router.post('/github/repo/visibility', auth.requireBuilder, async (req, res) => {
+    if (validateOrRespond(req, res, {
+      repo: { required: true, type: 'string', maxLength: 140 },
+      visibility: { required: true, type: 'string', enum: ['public', 'private'] },
+    })) return;
+    const ref = parseRepoRef(req.body.repo, res);
+    if (!ref) return;
+    if (req.body.visibility !== 'public') {
+      return res.fail('private_not_deployable', {
+        status: 409,
+        message: 'Private repositories can’t be deployed yet — the platform’s deploy pull can’t read them, so making this repository private would break the project’s next deploy. This lands with the private-repo deploy fix.',
+      });
+    }
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      const repo = await githubRepos.makeRepoPublic(token, ref);
+      res.json({ ok: true, repo, private_deployable: false });
+    } catch (err) {
+      if (err && err.status === 401) {
+        await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+        return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to change the repository.' });
+      }
+      if (err && err.code === 'not_repo_admin') {
+        return res.fail('not_repo_admin', { status: 403, message: 'GitHub refused: your account can’t change this repository’s settings.' });
+      }
+      if (err && err.code === 'repo_not_found') {
+        return res.fail('repo_not_found', { status: 404, message: 'GitHub didn’t show that repository to your account.' });
+      }
+      console.error('[gds] POST /github/repo/visibility', err && err.message);
+      res.fail('github_error', { status: 502, message: 'GitHub could not make the change. Try again in a moment.' });
+    }
+  });
+
   return router;
 };

package/src/module-api.js

@@ -847,8 +847,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.208 with no explicit bump. run 32072227661. (task 1002620)
 //   1.19.210 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.209 with no explicit bump. run 32078135414. (task 1002620)
+//   1.19.211 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.210 with no explicit bump. run 32079512489. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.210'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.211'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/github_repo_visibility.mjs

@@ -0,0 +1,168 @@
+// tests/github_repo_visibility.mjs — the manage page's repo-visibility routes
+// (task 1003045): GET /github/repo + POST /github/repo/visibility.
+//
+// The load-bearing assertions:
+//   • the PRIVATE direction is refused BEFORE GitHub is ever called (409
+//     private_not_deployable): the deploy pull runs as the shared deploy key,
+//     which cannot read a private repo (walk finding N4), so flipping private
+//     would break the project's next deploy — the honest-refusal leg this task
+//     ships. The refusal must not even consult the stored token.
+//   • flip-to-public calls makeRepoPublic with the parsed owner/name and
+//     forwards GitHub's own answer — the new state is never assumed
+//   • a GitHub 401 drops the stored token and re-prompts (the /github/repos
+//     convention); GitHub's 404 forwards as repo_not_found (no leak beyond what
+//     GitHub told this account); a GitHub 403 becomes not_repo_admin
+//   • a malformed owner/name is a clean 400 bad_repo_ref
+//
+// DB-free + network-free: db.getGithubToken and the github-repos helpers are
+// stubbed on their cached module objects (the github_token_store.mjs pattern —
+// which is also why routes/github.js requires the helpers as a namespace).
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// A valid key BEFORE requiring the modules, so secret-box reads as configured.
+process.env.BUILDER_SECRET_KEY = 'ab'.repeat(32);
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const db = require(path.join(ROOT, 'src/bongos/db.js'));
+const githubRepos = require(path.join(ROOT, 'src/bongos/github-repos.js'));
+const buildGithubRouter = require(path.join(ROOT, 'src/bongos/routes/github.js'));
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+const { GithubApiError } = githubRepos;
+
+function fakeRes() {
+  const res = { _status: 200, _body: null };
+  res.status = (c) => { res._status = c; return res; };
+  res.json = (b) => { res._body = b; return res; };
+  attachFail({}, res, () => {}); // installs res.fail exactly as the router does
+  return res;
+}
+function finalHandler(router, method, pth) {
+  const layer = router.stack.find((l) => l.route && l.route.path === pth && l.route.methods[method]);
+  const stack = layer.route.stack;
+  return stack[stack.length - 1].handle; // the handler after requireBuilder
+}
+
+// One stubbed world per test: a live repo-scoped token + programmable helpers.
+// getRepo/makePublic are thunks so a test can return an answer or throw a typed
+// GithubApiError, exactly as the real helpers do.
+function stub({ token = { token: 'tok', scope: 'repo read:user' }, getRepo, makePublic } = {}) {
+  const orig = {
+    get: db.getGithubToken, del: db.deleteGithubToken,
+    read: githubRepos.getUserRepo, flip: githubRepos.makeRepoPublic,
+  };
+  const calls = { read: [], flip: [], del: 0 };
+  db.getGithubToken = async () => token;
+  db.deleteGithubToken = async () => { calls.del++; };
+  githubRepos.getUserRepo = async (_t, ref) => { calls.read.push(ref); return getRepo(); };
+  githubRepos.makeRepoPublic = async (_t, ref) => { calls.flip.push(ref); return makePublic(); };
+  const restore = () => {
+    db.getGithubToken = orig.get; db.deleteGithubToken = orig.del;
+    githubRepos.getUserRepo = orig.read; githubRepos.makeRepoPublic = orig.flip;
+  };
+  return { calls, restore };
+}
+
+const getHandler = () => finalHandler(buildGithubRouter(), 'get', '/github/repo');
+const postHandler = () => finalHandler(buildGithubRouter(), 'post', '/github/repo/visibility');
+
+test('GET /github/repo: forwards GitHub\'s answer for the caller\'s own credential', async () => {
+  const s = stub({ getRepo: () => ({ full_name: 'jaxri/mercury', html_url: 'https://github.com/jaxri/mercury', private: true, admin: true }) });
+  try {
+    const res = fakeRes();
+    await getHandler()({ builder: { id: 1 }, query: { repo: 'jaxri/mercury' } }, res);
+    assert.equal(res._status, 200);
+    assert.equal(res._body.repo.private, true);
+    assert.equal(res._body.repo.admin, true);
+    assert.equal(res._body.private_deployable, false, 'the platform truth rides every answer');
+    assert.deepEqual(s.calls.read, [{ owner: 'jaxri', name: 'mercury' }]);
+  } finally { s.restore(); }
+});
+
+test('GET /github/repo: a malformed ref is a clean 400 before any token or GitHub touch', async () => {
+  const s = stub({ getRepo: () => ({}) });
+  try {
+    for (const bad of ['', 'no-slash', '-lead/x', 'a/b/c', 'owner/', 'javascript:alert(1)']) {
+      const res = fakeRes();
+      await getHandler()({ builder: { id: 1 }, query: { repo: bad } }, res);
+      assert.equal(res._status, 400, `ref ${JSON.stringify(bad)} must 400`);
+      assert.equal(res._body.error.code, 'bad_repo_ref');
+    }
+    assert.equal(s.calls.read.length, 0, 'GitHub is never consulted for a malformed ref');
+  } finally { s.restore(); }
+});
+
+test('GET /github/repo: GitHub\'s 404 forwards as repo_not_found — no leak beyond GitHub\'s own answer', async () => {
+  const s = stub({ getRepo: () => { throw new GithubApiError('nope', { status: 404, code: 'repo_not_found' }); } });
+  try {
+    const res = fakeRes();
+    await getHandler()({ builder: { id: 1 }, query: { repo: 'jaxri/gone' } }, res);
+    assert.equal(res._status, 404);
+    assert.equal(res._body.error.code, 'repo_not_found');
+  } finally { s.restore(); }
+});
+
+test('GET /github/repo: a GitHub 401 drops the stored token and re-prompts (the /github/repos convention)', async () => {
+  const s = stub({ getRepo: () => { throw new GithubApiError('bad', { status: 401, code: 'github_unauthorized' }); } });
+  try {
+    const res = fakeRes();
+    await getHandler()({ builder: { id: 1 }, query: { repo: 'jaxri/mercury' } }, res);
+    assert.equal(res._status, 403);
+    assert.equal(res._body.error.code, 'repo_scope_required');
+    assert.equal(s.calls.del, 1, 'the dead token is swept so the next attempt re-prompts cleanly');
+  } finally { s.restore(); }
+});
+
+test('POST visibility=private: refused 409 private_not_deployable — GitHub and the token store untouched', async () => {
+  const s = stub({ makePublic: () => ({}) });
+  const origGet = db.getGithubToken;
+  let tokenReads = 0;
+  db.getGithubToken = async () => { tokenReads++; return { token: 'tok', scope: 'repo' }; };
+  try {
+    const res = fakeRes();
+    await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'private' } }, res);
+    assert.equal(res._status, 409);
+    assert.equal(res._body.error.code, 'private_not_deployable');
+    assert.match(res._body.error.message, /deploy/i, 'the refusal says WHY in plain words');
+    assert.equal(s.calls.flip.length, 0, 'no GitHub call for a refused direction');
+    assert.equal(tokenReads, 0, 'the refusal happens before the credential is even read');
+  } finally { db.getGithubToken = origGet; s.restore(); }
+});
+
+test('POST visibility=public: flips via makeRepoPublic and forwards GitHub\'s answer', async () => {
+  const s = stub({ makePublic: () => ({ full_name: 'jaxri/mercury', html_url: 'https://github.com/jaxri/mercury', private: false, admin: true }) });
+  try {
+    const res = fakeRes();
+    await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'public' } }, res);
+    assert.equal(res._status, 200);
+    assert.equal(res._body.ok, true);
+    assert.equal(res._body.repo.private, false, 'the new state is GitHub\'s answer, never assumed');
+    assert.deepEqual(s.calls.flip, [{ owner: 'jaxri', name: 'mercury' }]);
+  } finally { s.restore(); }
+});
+
+test('POST visibility=public: GitHub\'s 403 becomes not_repo_admin, said plainly', async () => {
+  const s = stub({ makePublic: () => { throw new GithubApiError('no', { status: 403, code: 'not_repo_admin' }); } });
+  try {
+    const res = fakeRes();
+    await postHandler()({ builder: { id: 1 }, body: { repo: 'other/repo', visibility: 'public' } }, res);
+    assert.equal(res._status, 403);
+    assert.equal(res._body.error.code, 'not_repo_admin');
+  } finally { s.restore(); }
+});
+
+test('POST: an off-vocabulary visibility is a 400 (strict enum), never silently coerced', async () => {
+  const s = stub({ makePublic: () => ({}) });
+  try {
+    const res = fakeRes();
+    await postHandler()({ builder: { id: 1 }, body: { repo: 'jaxri/mercury', visibility: 'internal' } }, res);
+    assert.equal(res._status, 400);
+    assert.equal(s.calls.flip.length, 0);
+  } finally { s.restore(); }
+});

package/tests/github_repos_helpers.mjs

@@ -114,3 +114,52 @@ test('createUserRepo: 422 → typed name_taken (the route maps this to a friendl
     (e) => e.code === 'name_taken' && e.status === 422,
   );
 });
+
+// ---- repo-visibility helpers (task 1003045) ----
+
+test('getUserRepo: asks /repos/{owner}/{name}, maps private + admin off GitHub\'s answer', async () => {
+  let calledUrl = '';
+  const fetchImpl = async (url) => {
+    calledUrl = url;
+    return res(200, {
+      full_name: 'me/mercury', html_url: 'https://github.com/me/mercury',
+      private: true, permissions: { admin: true, push: true },
+    });
+  };
+  const out = await gh.getUserRepo('tok', { owner: 'me', name: 'mercury', fetchImpl });
+  assert.match(calledUrl, /\/repos\/me\/mercury$/);
+  assert.deepEqual(out, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury', private: true, admin: true });
+});
+
+test('getUserRepo: 404 → typed repo_not_found (GitHub\'s own no-leak shape, forwarded)', async () => {
+  const fetchImpl = async () => res(404, { message: 'Not Found' });
+  await assert.rejects(
+    () => gh.getUserRepo('tok', { owner: 'me', name: 'gone', fetchImpl }),
+    (e) => e.code === 'repo_not_found' && e.status === 404,
+  );
+});
+
+test('makeRepoPublic: PATCHes exactly {private:false} — the private direction is structurally impossible', async () => {
+  // Like createUserRepo's private:false, the direction is deliberately not a
+  // parameter: the deploy pull runs as the shared deploy key that cannot read a
+  // private repo (N4), so nothing in the codebase may flip a repo private.
+  let sentMethod = '';
+  let sentBody = null;
+  const fetchImpl = async (url, init) => {
+    sentMethod = init.method;
+    sentBody = JSON.parse(init.body);
+    return res(200, { full_name: 'me/mercury', html_url: 'https://github.com/me/mercury', private: false, permissions: { admin: true } });
+  };
+  const out = await gh.makeRepoPublic('tok', { owner: 'me', name: 'mercury', fetchImpl });
+  assert.equal(sentMethod, 'PATCH');
+  assert.deepEqual(sentBody, { private: false }, 'only the public direction can ever travel');
+  assert.equal(out.private, false);
+});
+
+test('makeRepoPublic: 403 → typed not_repo_admin', async () => {
+  const fetchImpl = async () => res(403, { message: 'Must have admin rights' });
+  await assert.rejects(
+    () => gh.makeRepoPublic('tok', { owner: 'other', name: 'repo', fetchImpl }),
+    (e) => e.code === 'not_repo_admin' && e.status === 403,
+  );
+});

package/tests/projects_hub.mjs

@@ -977,3 +977,62 @@ test('every owned card carries its Manage door, and a modified click keeps its m
   assert.match(SCRIPT, /if \(!isPlainClick\(ev\)\) return;/,
     'ctrl/middle-click falls through to the browser');
 });
+
+/* ── Repo visibility on the manage page (task 1003045) ──────────────────────
+   The section reads the repo's REAL visibility from GitHub with the owner's
+   own repository credential and offers exactly one direction: private→public.
+   The private direction is refused — server-side and here — until the
+   private-repo deploy fix lands, because the deploy pull runs as the shared
+   deploy key that cannot read a private repo (walk finding N4). ── */
+
+test('the repo-visibility section is live markup with its body slot (C7)', () => {
+  assert.match(HUB, /id="mRepoVis"/, 'the section body must be real markup');
+  assert.match(HUB, /Checking the repository on GitHub…/,
+    'the pre-answer state is honest waiting copy, not a fake answer');
+});
+
+test('flip-to-private cannot travel from this page — only the public direction exists', () => {
+  assert.match(SCRIPT, /visibility: 'public'/, 'the one POST body pins the public direction');
+  assert.doesNotMatch(SCRIPT, /visibility:\s*'private'/,
+    'no code path may send the private direction');
+  // the refusal is SAID, with its reason, not silently missing
+  assert.match(SCRIPT, /can’t deploy private repositories/,
+    'the private-repo limitation is stated in plain words');
+});
+
+test('the visibility shown is GitHub\'s answer, never an assumption', () => {
+  const fn = (SCRIPT.match(/function doRepoPublic\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'doRepoPublic() must be extractable');
+  assert.match(fn, /manageRepo = data\.repo/,
+    'after a flip, the rendered state is what GitHub returned');
+  const render = (SCRIPT.match(/function renderRepoVis\(repo\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(render, 'renderRepoVis() must be extractable');
+  assert.match(render, /repo\.private/, 'the branch reads the live flag');
+  assert.match(render, /repo\.admin/,
+    'the flip button only shows when GitHub says this account may change settings');
+});
+
+test('the GitHub read fires on entry and tab return only — never from the tick\'s render', () => {
+  assert.match(SCRIPT, /loadRepoVisibility\(inst\);/, 'the read rides loadManage\'s success');
+  const render = (SCRIPT.match(/function renderManage\(inst\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(render, 'renderManage() must be extractable');
+  assert.doesNotMatch(render, /loadRepoVisibility/,
+    'renderManage is what manageChipTick calls every minute — a read here would poll GitHub (C8)');
+});
+
+test('the reconnect door asks for repository access and returns to this project', () => {
+  const fn = (SCRIPT.match(/function repoVisReconnect\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'repoVisReconnect() must be extractable');
+  assert.match(fn, /repos=1/, 'the door carries the repo scope ask');
+  assert.match(fn, /encodeURIComponent\('\/projects\?view=manage&id=' \+ manageId\)/,
+    'and returns to the exact project being managed');
+});
+
+test('making a repo public asks first — exposure is never one accidental click', () => {
+  const fn = (SCRIPT.match(/function askRepoPublic\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
+  assert.ok(fn, 'askRepoPublic() must be extractable');
+  assert.match(fn, /Anyone on the internet will be able to read the code/,
+    'the confirm states the consequence in plain words');
+  assert.match(SCRIPT, /data-repo-public-yes/, 'the confirm is a distinct second click');
+  assert.match(SCRIPT, /data-repo-public-no/, 'and declining is offered, not implied');
+});

package/tests/public_landing_projects.mjs

@@ -121,6 +121,16 @@ test('the manage view is served: identity block + honest not-yet sections (task
   assert.doesNotMatch(missing, /permission|allowed|access|owner/i);
 });
 
+test('the repo-visibility section is served live, with the private direction refused (task 1003045)', async () => {
+  const { body } = await request('/projects', 'game.test.local');
+  assert.match(body, /id="mRepoVis"/, 'the live section body is served');
+  assert.match(body, /can’t deploy private repositories/,
+    'the private-repo limitation is stated in plain words');
+  assert.doesNotMatch(body, /visibility:\s*'private'/,
+    'no served code path may send the private direction');
+  assert.match(body, /repos=1/, 'the reconnect door asks for repository access');
+});
+
 test('the empty state points a new owner at the wizard view — never at a hall', async () => {
   const { body } = await request('/projects', 'game.test.local');
   // /create was absorbed into ?view=new (task 1002763); the CTA moves in-page