@bongos/core 1.19.336 → 1.19.337

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.336",
-  "core_contract": "1.19.336",
-  "source_commit": "85d561ede2a6c0ab512de0e97780813e9fea4112",
+  "core_version": "1.19.337",
+  "core_contract": "1.19.337",
+  "source_commit": "a1079dd09b8ae45b780cdcab81eb44696be21f01",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T00:56:17.081Z",
+  "built_at": "2026-08-25T01:01:18.995Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 325,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1830,
-  "tree_sha256": "5a51e5573725c512980eafa27efcd8c38c63d1ffddf8d108ca0803f5a3ebac68",
+  "tree_sha256": "39cc259330321323f293c3d933377998d7c3cf229570269ccbf77fa1bef52857",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4427,7 +4427,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "8bd43d1101599f5ff838641a9cbaa9bfd208eea4a3c7876f45ac034a8bf3b5d0"
+      "sha256": "b9762b6b76d4ee7f57a3a8c37f126eb768ff8c90e194a575dddc7704a534062d"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -4727,12 +4727,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "2aec5aabe3c60deec1e8f210e69d070f95b0e8d8a1a8fd55e9344399d67c66e5"
+      "sha256": "6e1f14fea8a5dac393261b47a9563eabca0bda30f2c9a6d56f22e17f548c42aa"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "417a1f2c9a79ec8492ee09886edc0e2cbefa35a1ba9686bc81a9dabe4527ce45"
+      "sha256": "b3c8163bb92a02b01ca2ec14a46b8b1b3c25f1e6ae25001b0fea4a2303820713"
     },
     {
       "path": "public-docs/index.html",
@@ -6557,7 +6557,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "0a68c727fa467947704e21c886c0de2839aea5ecad7bf8b67f72867b7028ffb8"
+      "sha256": "8ffe1c3c3683e95f182da6cad74272574cbe1a2d94a9b959221cc71084c1b8d3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8457,7 +8457,7 @@
     {
       "path": "tests/provisioning_github_app_routes.mjs",
       "mode": "0000644",
-      "sha256": "fce4837d4882dcd980bc144a2afeaf04fbce99aa31d7d1a72a277bad0ebfae99"
+      "sha256": "dd53361cf8bd7e517e886701753d64c05c3235995785991558805f493cde529c"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",

package/modules/provisioning/routes/provisioning.js

@@ -144,7 +144,9 @@ code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rg
 // land. Deliberately contains NO backticks and NO ${...} so it survives the outer
 // template literal verbatim; the only server data it reads is the JSON config block
 // written just above it. Fails soft — a poll hiccup just retries; a long wait reveals a
-// manual "open" button rather than ever falsely erroring.
+// manual "open" button rather than ever falsely erroring. The auto-open countdown runs
+// ONLY when this page is the wizard's pop-up; a same-tab return (pop-up blocked) keeps
+// the founder here with the door and a way back to the checklist (task 1003236).
 const CALLBACK_SCRIPT = `
 (function(){
   var cfg=window.__CB_SETUP__||{};
@@ -153,12 +155,18 @@ const CALLBACK_SCRIPT = `
   var target='https://'+domain;
   var pollUrl=location.pathname.replace('/callback','/status')+'?state='+encodeURIComponent(state);
   var steps=document.getElementById('steps'),statusEl=document.getElementById('status');
-  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot');
+  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot'),back=document.getElementById('back');
+  /* Opened from the wizard as a pop-up (window.opener alive, or the tab still carries the name the wizard gave it):
+     the checklist is in the other tab, so this one may auto-open the instance. Same-tab fallback (pop-up blocked,
+     form target=_self): this IS the founder's checklist tab — never navigate it away; offer both doors (task 1003236). */
+  var popup=!!window.opener||window.name==='ghAppSetup';
   var finished=false,tries=0,manual=false;
   function dot(n){return steps.querySelector('[data-step="'+n+'"]');}
   function setActive(n){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active','done');if(i<n){el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}else if(i===n){el.classList.add('active');}}}
   function allDone(){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active');el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}}
-  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
+  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');
+    if(!popup){go.textContent='Open '+domain+' \\u2192';if(back)back.classList.remove('hidden');if(foot)foot.textContent='Your setup checklist is waiting where you left it \\u2014 finish it first, or open your instance now.';return;}
+    var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
   function failed(){if(finished)return;finished=true;statusEl.textContent='Setup didn\\u2019t finish. Open your instance page and start the GitHub sign-in setup again.';cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';}
   function revealManual(){if(manual||finished)return;manual=true;cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';if(foot)foot.textContent='This is taking a little longer than usual \\u2014 you can open your instance now, or keep waiting.';}
   function schedule(){if(!finished)setTimeout(poll,3000);}
@@ -195,6 +203,7 @@ function callbackPage({ ok, title, body, state, domain }) {
   </div>
   <p class="status-line" id="status">Hang tight — keep this tab open while we finish.</p>
   <div class="cta hidden" id="cta"><a class="btn" id="go" href="https://${esc(domain)}">Open ${esc(domain)} →</a></div>
+  <p class="muted hidden" id="back"><a href="/projects?view=new">Finish your remaining setup steps →</a></p>
   <p class="muted" id="foot">This page opens <code>${esc(domain)}</code> for you the moment it’s ready.</p>
   <noscript><p class="muted">When setup finishes, open <a href="https://${esc(domain)}">${esc(domain)}</a> and sign in with GitHub — that first sign-in makes you the owner.</p></noscript>
 </main>

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.336",
+  "version": "1.19.337",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.336",
+      "version": "1.19.337",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.336",
+  "version": "1.19.337",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -1099,8 +1099,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.334 with no explicit bump. run 32795232997. (task 1002620)
 //   1.19.336 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.335 with no explicit bump. run 32795564021. (task 1002620)
+//   1.19.337 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.336 with no explicit bump. run 32795896926. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.336'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.337'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provisioning_github_app_routes.mjs

@@ -11,10 +11,13 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
 import http from 'node:http';
 
 const require = createRequire(import.meta.url);
-const ROOT = new URL('..', import.meta.url).pathname;
+// fileURLToPath, not .pathname: a checkout path with a space reads back percent-encoded
+// (and drive-prefixed) from .pathname on Windows, and require() cannot follow it
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
 
 // Stub the data-access fns BEFORE the route factory captures the module object.
 const provisioning = require(`${ROOT}/modules/provisioning/provisioning.js`);
@@ -92,6 +95,42 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   const html = await res.text();
   t('good state → 200 text/html progress page wired to auto-open', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /Setting up your instance/.test(html) && /Placing credentials/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
   t('the page names the instance host', /mercury\.example\.com/.test(html));
+  // task 1003236: a same-tab return (pop-up blocked → form target=_self) must never be
+  // navigated away from the checklist. The page carries a hidden way back, and the
+  // countdown sits behind the pop-up guard.
+  t('carries a hidden "finish your remaining setup steps" link back to the wizard', /<p class="muted hidden" id="back"><a href="\/projects\?view=new">Finish your remaining setup steps/.test(html));
+  t('the auto-open countdown is reachable only past the pop-up guard', /var popup=!!window\.opener\|\|window\.name==='ghAppSetup';/.test(html) && /if\(!popup\)\{[^}]*return;\}\s*var n=4;\(function tick\(\)\{if\(n<=0\)\{location\.href=target;/.test(html) && (html.match(/location\.href=target/g) || []).length === 1);
+
+  // Run the served script itself (not a copy) against a minimal DOM, once as the
+  // wizard's pop-up and once as a same-tab return, and watch what it does to location.
+  const script = (html.match(/<script>\s*(\(function\(\)\{[\s\S]*?)<\/script>\s*<\/body>/) || [])[1];
+  t('the progress page ships the client script', typeof script === 'string' && script.length > 200);
+  async function runCallback({ opener, name }) {
+    const vm = await import('node:vm');
+    const el = () => { const cls = new Set(); return { textContent: '', classList: { add: (...c) => c.forEach((x) => cls.add(x)), remove: (...c) => c.forEach((x) => cls.delete(x)), contains: (c) => cls.has(c) }, querySelector: () => el() }; };
+    const els = { steps: el(), status: el(), cta: el(), go: el(), foot: el(), back: el() };
+    els.steps.querySelector = () => el();
+    els.back.classList.add('hidden'); els.cta.classList.add('hidden');
+    const timers = [];
+    const sandbox = {
+      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com' },
+      opener, name,
+      document: { getElementById: (id) => els[id] || null },
+      location: { pathname: '/api/bongos/provisioning/github-app/callback', href: 'about:callback' },
+      fetch: async () => ({ ok: true, json: async () => ({ ok: true, ready: true, status: 'done' }) }),
+      setTimeout: (fn) => { timers.push(fn); return timers.length; },
+      encodeURIComponent,
+    };
+    sandbox.window = sandbox;
+    vm.runInNewContext(script, sandbox);
+    for (let i = 0; i < 5; i++) await new Promise((r) => setImmediate(r)); // let the poll's promise chain settle
+    for (let guard = 0; guard < 10 && timers.length; guard++) { const fn = timers.shift(); fn(); }
+    return { href: sandbox.location.href, go: els.go.textContent, backHidden: els.back.classList.contains('hidden'), foot: els.foot.textContent };
+  }
+  const popup = await runCallback({ opener: {}, name: 'ghAppSetup' });
+  t('as the wizard’s pop-up it still counts down and opens the instance', popup.href === 'https://mercury.example.com', JSON.stringify(popup));
+  const sameTab = await runCallback({ opener: null, name: '' });
+  t('as a same-tab return it stays put: door shown, way back revealed, no navigation', sameTab.href === 'about:callback' && sameTab.go === 'Open mercury.example.com →' && sameTab.backHidden === false && /checklist is waiting/.test(sameTab.foot), JSON.stringify(sameTab));
 }
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=X&state=NOPE`);