@bongos/core 1.19.211 → 1.19.212

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.211",
-  "core_contract": "1.19.211",
-  "source_commit": "348da70b502ddf8be58aa20aeb71dcf7be94ec7c",
+  "core_version": "1.19.212",
+  "core_contract": "1.19.212",
+  "source_commit": "2b4762e127c88a4114c66c25801c21aef9ebf2d9",
   "source_ref": "HEAD",
-  "built_at": "2026-08-17T23:14:01.398Z",
+  "built_at": "2026-08-17T23:23:19.730Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 310,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1632,
-  "tree_sha256": "5d3eac725354ec0e3bd3c1d91f38bcc539a355b8e2b137de56de74ddfbe2572f",
+  "tree_sha256": "a403f7e947eaebd53f2d3b95ff22cc32202aec1c2c0d05aa5e8fdc68dccd599c",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4282,12 +4282,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "aa3d213f3f3548f655bee0361f01e43ee380b54e958f8d11683ba7d94a098d2b"
+      "sha256": "61ee2e3d2da104909ace97881b37ba3fe85535e4f1ca2adfe430c2e12a93a087"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "368f9931ba9dc39483dc3a9c488fb8df45342cccccab65d34b9a4d083fa530ed"
+      "sha256": "3e6a4e9d8281f4911612230833fa96b8ff7f3461f38e5655eafaff2f032aa1fb"
     },
     {
       "path": "public-docs/index.html",
@@ -4547,7 +4547,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "790034f4256a31da114969853e14fdf47b43b0ad35907b4fcc14ff98897ec7d1"
+      "sha256": "603ec55ce4de6477cf5d0602e5963a096799a404b2324f12c62104023e9e0e4b"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -5902,7 +5902,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "5998d6f2561e88ca21f3f764a48fd496767d0b2f16aeaf1a1e7cf981333c4faf"
+      "sha256": "a97718759370258d16378f3e7794180173fabef4053c2f3f1d28c7357affc5dc"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -7527,7 +7527,7 @@
     {
       "path": "tests/projects_hub.mjs",
       "mode": "0000644",
-      "sha256": "963b745e4b4ecd6a786f88758d57aee8680edd49d25f0cc84e3b563a5125be3b"
+      "sha256": "0471ced4ef3d16b5df6a373c04b13c1e83f2c9b2a9590734e4f02f95e195c45a"
     },
     {
       "path": "tests/provision.mjs",
@@ -7577,7 +7577,7 @@
     {
       "path": "tests/public_landing_projects.mjs",
       "mode": "0000644",
-      "sha256": "266f5936675c0f6eb8d64af713d215edea2b88bcab50153497ef2d23fec1ff65"
+      "sha256": "c0e2e85c84f75503438c1951b72a94cf1c74a7cd0c27b774c2dc4d46d99d6cf8"
     },
     {
       "path": "tests/public_mirror_export.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.211",
+  "version": "1.19.212",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.211",
+      "version": "1.19.212",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.211",
+  "version": "1.19.212",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -626,6 +626,14 @@ h1[tabindex="-1"]:focus{outline:none;}
       <div class="card" id="mRepoVisibility">
         <h2 style="font-family:var(--font-display);font-size:19px;margin-bottom:12px;">Repository visibility</h2>
         <div id="mRepoVis"><p class="finePrint">Checking the repository on GitHub…</p></div>
+        <!-- the limitation itself, one click away (grade follow-up task 1003077):
+             the refusal above states it; this fold explains it and links the
+             tracked fix. The hall link is apex-only — a child instance keeps the
+             explanation, not another platform's task tracker. -->
+        <details class="finePrint" id="mRepoVisWhy">
+          <summary>Why can’t it be private yet?</summary>
+          <p>The platform deploys a project by reading its code from GitHub with a shared read-only credential — and private repositories don’t admit it. A private repository’s next deploy would simply fail, so the switch stays off until each project gets its own deploy credential. <!--apex-only:start-->That work is tracked as <a href="{{buildersOrigin}}#/task/1002735" target="_blank" rel="noopener">task 1002735</a> in the builders’ hall.<!--apex-only:end--></p>
+        </details>
       </div>
 
       <div class="card" id="mDelete">

package/src/module-api.js

@@ -849,8 +849,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.209 with no explicit bump. run 32078135414. (task 1002620)
 //   1.19.211 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.210 with no explicit bump. run 32079512489. (task 1002620)
+//   1.19.212 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.211 with no explicit bump. run 32080157462. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.211'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.212'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub.mjs

@@ -1028,6 +1028,21 @@ test('the reconnect door asks for repository access and returns to this project'
     'and returns to the exact project being managed');
 });
 
+test('the refusal carries a LINK to the limitation, never prose alone (task 1003077)', () => {
+  assert.match(HUB, /id="mRepoVisWhy"/, 'the why-fold is real markup beside the section body');
+  const fold = (HUB.match(/<details[^>]*id="mRepoVisWhy"[\s\S]*?<\/details>/) || [''])[0];
+  assert.ok(fold, 'the fold must be extractable');
+  assert.match(fold, /shared read-only credential/, 'the WHY is stated in plain words');
+  assert.match(fold, /\{\{buildersOrigin\}\}#\/task\/1002735/,
+    'the tracked fix is a real link, hall-origin server-stamped (never client-filled)');
+  // apex-only: a child instance keeps the explanation, not another platform's tracker
+  const at = HUB.indexOf('{{buildersOrigin}}#/task/1002735');
+  const before = HUB.slice(0, at);
+  const opens = (before.match(/<!--apex-only:start-->/g) || []).length;
+  const closes = (before.match(/<!--apex-only:end-->/g) || []).length;
+  assert.equal(opens - closes, 1, 'the task link sits inside an apex-only sentinel pair');
+});
+
 test('making a repo public asks first — exposure is never one accidental click', () => {
   const fn = (SCRIPT.match(/function askRepoPublic\(\)\s*\{([\s\S]*?)\n  \}/) || [, ''])[1];
   assert.ok(fn, 'askRepoPublic() must be extractable');

package/tests/public_landing_projects.mjs

@@ -129,6 +129,15 @@ test('the repo-visibility section is served live, with the private direction ref
   assert.doesNotMatch(body, /visibility:\s*'private'/,
     'no served code path may send the private direction');
   assert.match(body, /repos=1/, 'the reconnect door asks for repository access');
+  // the limitation is one click away (task 1003077). This DB-free serve is the
+  // STANDALONE shape, where apex-only spans are stripped — so the explanation
+  // must survive while the cloudbongos task link must NOT (a child instance
+  // never shows another platform's tracker). The link itself is pinned inside
+  // its sentinels by tests/projects_hub.mjs.
+  assert.match(body, /id="mRepoVisWhy"/, 'the why-fold is served');
+  assert.match(body, /shared read-only credential/, 'the explanation survives the strip');
+  assert.doesNotMatch(body, /#\/task\/1002735/,
+    'the apex-only task link is stripped from a standalone serve');
 });
 
 test('the empty state points a new owner at the wizard view — never at a hall', async () => {