@bongos/core 1.19.351 → 1.19.353

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.351",
-  "core_contract": "1.19.351",
-  "source_commit": "a1a7446c35da856e17ae920f2d2e2a446320edb6",
+  "core_version": "1.19.353",
+  "core_contract": "1.19.353",
+  "source_commit": "5bb1f8185d48f3d3d53181f4525eca45b0cef665",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T12:53:45.200Z",
+  "built_at": "2026-08-25T13:07:06.857Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 329,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1857,
-  "tree_sha256": "fef03d4bf7a70641e028393447ebffd7ca615173e976f25945a0f2846cb9f791",
+  "tree_sha256": "3b39dee80eea8539fc0a7b82684369a69c58b09c426cac168f029815bc78270e",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -4787,12 +4787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "782cf5fe234b13ce532d23dff2d26511364e0671fc4a706e828bb69a1aa747e5"
+      "sha256": "0b1bb5323c63aefbe9f58e5bd5eba8cfed791c5089bf5dbae18fde4055c31299"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "ffa5d64cebc96b2aa32b1e925ec8d128854b565fde7853b1dd6a1a40ae24f1ff"
+      "sha256": "c524de81eaba481839a9515c321c48d231506f677459d76c495bb51ebfd8b90c"
     },
     {
       "path": "public-docs/index.html",
@@ -5797,17 +5797,17 @@
     {
       "path": "scripts/gds/provision-repo.js",
       "mode": "0000644",
-      "sha256": "bc1b8850038c8aaa8c0cbf2d5d9881f671b7cb959533802bc5d6b23b48ba15bd"
+      "sha256": "c87cccdd63ac6fa6d38771c3ad178e5e919f8bee62ad769b9d127819f84e2750"
     },
     {
       "path": "scripts/gds/provision-units.js",
       "mode": "0000644",
-      "sha256": "6fe61c756ca409fd4e7967144cf53a064a7095ab09006f71642d5cac860e93d7"
+      "sha256": "e8a44143883403c2ff8e20107250d63f6d19a14050279e8d675480582e07c555"
     },
     {
       "path": "scripts/gds/provision.js",
       "mode": "0000644",
-      "sha256": "2f9e608632b147602b8e141a0cba2071bf36e27fafadd410b7fea399f448250c"
+      "sha256": "5b4f5edce415dd46db830104eb196de678214730d736ebf3ae26a7671b718c77"
     },
     {
       "path": "scripts/gds/publish-credential-check.js",
@@ -6622,7 +6622,7 @@
     {
       "path": "src/bongos/stealth-gate.js",
       "mode": "0000644",
-      "sha256": "6ea72c90380663fac7ece7d97cd628792f3d68a2969a502c59addfcb83c2bcb4"
+      "sha256": "a1b771c103e332b93978e80f16760f80f7ab0260157db31c47d4655d69977344"
     },
     {
       "path": "src/bongos/uptime-poller.js",
@@ -6652,7 +6652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "227d48d264188e540dda1fb674d6fb282d8eafd3db3d3d876ef075c0690029fa"
+      "sha256": "82bd181f16c9ee484e55c879439a7f61ff056588080a57bd95a3881d89b726f3"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8557,7 +8557,7 @@
     {
       "path": "tests/provision.mjs",
       "mode": "0000644",
-      "sha256": "304f8d9243512672a706a1e073a4874aec2e24a43cfbed550967db1fd23a16dc"
+      "sha256": "0fc6c6626b43458c2e065322bec5a2ecd87e50a44abd2838d81ff0f0b6abeae7"
     },
     {
       "path": "tests/provisioning_default_domain.mjs",
@@ -9112,7 +9112,7 @@
     {
       "path": "tests/stealth_gate.mjs",
       "mode": "0000644",
-      "sha256": "c4deafe658457e9f3c17a99f6ab2435e1b1c4d42d74d77304ba792458562e771"
+      "sha256": "bb264253e2a9c233734cf9273928db203f8f441c4e7a53f5f9ae5ea0477e20e3"
     },
     {
       "path": "tests/stop_refcheck.mjs",

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.351",
+  "version": "1.19.353",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.351",
+      "version": "1.19.353",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.351",
+  "version": "1.19.353",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/scripts/gds/provision-repo.js

@@ -323,6 +323,18 @@ function alreadyScaffolded(root, mode, { fsImpl = fs } = {}) {
 //
 // Idempotent (see alreadyScaffolded) and dry-run safe (every mutation goes through the
 // injected exec/writeFile). ADR 0108 / 0121 / 0125.
+// The signed-in builder who owns the instance — the founding firstAdmin. Best-effort:
+// no db, no row, or a query error → null, and callers fall back to the repo owner in
+// target_ref. Shared by the scaffold's branding.firstAdmin and web.env's
+// <prefix>_FIRST_ADMIN (task 1003240) so the two can never disagree.
+async function ownerLoginOf(inst, db) {
+  if (!inst || !inst.owner_builder_id || !db || typeof db.query !== 'function') return null;
+  try {
+    const r = await db.query('SELECT github_login FROM builders WHERE id = $1', [inst.owner_builder_id]);
+    return r && r.rows && r.rows[0] && r.rows[0].github_login ? r.rows[0].github_login : null;
+  } catch { return null; }
+}
+
 async function scaffoldStandaloneRepo(inst, deps) {
   // The scaffold BUILDS + pushes the instance's repo (git clone, package-core,
   // `bongos init`, git push) — control-plane work that needs the packaging tools +
@@ -352,13 +364,7 @@ async function scaffoldStandaloneRepo(inst, deps) {
     : `  [scaffold] ${repo.owner}/${repo.name} → ${root} (clone → materialize → pin core ${coreV} → commit → push)`);
 
   // Owner login = the founding firstAdmin. Best-effort; the spec falls back to the repo owner.
-  let ownerLogin = null;
-  if (inst.owner_builder_id && db) {
-    try {
-      const r = await db.query('SELECT github_login FROM builders WHERE id = $1', [inst.owner_builder_id]);
-      ownerLogin = r && r.rows && r.rows[0] ? r.rows[0].github_login : null;
-    } catch { /* fall back to the repo owner */ }
-  }
+  const ownerLogin = await ownerLoginOf(inst, db);
 
   // Resolve the instance owner's OAuth token BEFORE any git network op.
   //
@@ -820,6 +826,7 @@ module.exports = {
   CORE_PKG_DIR,
   INSTANCE_GITIGNORE,
   alreadyScaffolded,
+  ownerLoginOf,
   asPostgres,
   buildCorePinRefreshCommit,
   dbCreateCmd,

package/scripts/gds/provision-units.js

@@ -153,7 +153,7 @@ function provisionedEnvPrefix() {
 // the hall on this host + OAuth uses the real callback origin — without them the pack
 // stays at neutral localhost and the hall never loads (task 1972). No domain yet
 // (bring-your-own deferred, ADR 0111 §4) ⇒ origins stay neutral until one is set.
-function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null } = {}) {
+function webEnvBody(inst, { clientId = '', clientSecret = '', appId = null, appPem = null, federation = null, ownerLogin = null } = {}) {
   const prefix = provisionedEnvPrefix(), { settingsEnvLines } = require(path.join(REPO_ROOT, 'modules/provisioning/provisioning')); // eslint-disable-line global-require
   const origin = inst.domain ? `https://${inst.domain}` : '';
   const originLines = origin
@@ -191,12 +191,12 @@ ${prefix}_OAUTH_ORIGIN=${origin}
   // demo had every origin override but no FIRST_ADMIN, so the owner could not be seated).
   // Derived from the instance repo owner (target_ref = "<owner>/<repo>"), the SAME source
   // instanceInitSpec uses for the scaffold's branding.firstAdmin — so this env override and
-  // the scaffolded config/branding.json agree. (Org-owned repo: the org login is not a
-  // sign-in identity, so it is left unset; the owner sets <prefix>_FIRST_ADMIN by hand.)
+  // the scaffolded config/branding.json agree — and, like the spec, PREFERS the signed-in
+  // builder's login when the caller resolved one (ownerLoginOf). An org-owned repo's
+  // owner is the org, which is not a sign-in identity: seating it seats nobody (task 1003240).
   const ownerRepo = parseTargetRef(inst.target_ref);
-  const firstAdminLine = ownerRepo && ownerRepo.owner
-    ? `${prefix}_FIRST_ADMIN=${ownerRepo.owner}\n`
-    : '';
+  const firstAdmin = ownerLogin || (ownerRepo && ownerRepo.owner) || null;
+  const firstAdminLine = firstAdmin ? `${prefix}_FIRST_ADMIN=${firstAdmin}\n` : '';
   // Cross-site identity federation block (ADR 0141 §4, task #1002109). Present only for
   // a HOSTED (federated) instance: flips auth.idp ON via the env override branding.js
   // reads (idpEnabled), and carries the hub origin, this instance's per-client secret

package/scripts/gds/provision.js

@@ -50,7 +50,7 @@ const cp = require('node:child_process');
 const crypto = require('node:crypto');
 
 const { CONFIG, MANIFEST_UA, MANIFEST_VERIFY_INTERVAL_MS, MANIFEST_VERIFY_TRIES, MAX_INTENT_ATTEMPTS, REPO_ROOT, coreVersionSafe, hasFlag, loadDeps, oauthSecret, provisionerBotEmail } = require('./provision-config.js');
-const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
+const { APP_USER, alreadyScaffolded, buildCorePinRefreshCommit, dbCreateCmd, dbName, deployKeyPath, deployKeyTitle, ensurePrivateRepoAccess, installedCorePackDir, installedCoreTarball, instanceInitSpec, instanceRepoRemote, migrateCmd, onboardMode, ownerLoginOf, parseTargetRef, planCorePinRefresh, refreshStandaloneCorePin, resolveOwnerGithubToken, resolveVendorableCoreTarball, safeVersionLabel, scaffoldStandaloneRepo, seedFirstVersionCmd, standaloneInstallCmd, standaloneMigrateCmd, standalonePullCmd, standaloneRegenDocsCmd, standaloneRoot } = require('./provision-repo.js');
 const { backupScriptPath, backupService, backupServicePath, backupTimer, backupTimerPath, backupUnitName, serviceUnit, serviceUnitPath, webEnvBody, webEnvPath } = require('./provision-units.js');
 const { caddyBlock, caddySnippetPath, checkDnsTokenScope, classifyZoneScope, dnsUpsertEnv, federateInstance, federationHubOrigin, healthzCmd, shouldFederate, zoneForDomain } = require('./provision-net.js');
 
@@ -381,7 +381,7 @@ async function provisionInstance(inst, deps) {
 
   // ── step 3: config + per-instance secrets ─────────────────────────────────
   log('  [config] per-instance web.env');
-  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation }), { mode: 0o600, sudo: true });
+  if (local) boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
   else log('    (baked into cloud-init)');
 
   // ── step 4: systemd unit + enable ─────────────────────────────────────────
@@ -588,7 +588,7 @@ async function domainAttachInstance(inst, deps) {
     : CONFIG.publicIp;
 
   log('  [config] re-write per-instance web.env (origins now carry the domain)');
-  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null }), { mode: 0o600, sudo: true });
+  boxWriteFile(webEnvPath(inst), webEnvBody(inst, { federation: null, ownerLogin: await ownerLoginOf(inst, deps.db) }), { mode: 0o600, sudo: true });
   log('  [service] restart to pick up the new origins');
   boxExec(`${sudoP}systemctl restart ${inst.slug}`);
 
@@ -790,7 +790,7 @@ async function placeManifestCreds(inst, mrow, deps) {
   //    writeFile logs only a byte count; the value is base64/temp-file placed).
   log(`  [oauth-manifest] place creds in ${webEnvPath(inst)} + restart ${inst.slug}`);
   boxWriteFile(webEnvPath(inst), webEnvBody(inst, {
-    clientId: creds.clientId, clientSecret: creds.clientSecret,
+    clientId: creds.clientId, clientSecret: creds.clientSecret, ownerLogin: await ownerLoginOf(inst, deps.db),
     // The App id + private key double as the ADR 0055 publish credential (task
     // 1003049); older Apps (pre-permission manifests) return a pem too — placing
     // it is harmless and heals once the owner grants the permissions + installs.

package/src/bongos/stealth-gate.js

@@ -107,11 +107,30 @@ function isExempt(path) {
   return EXEMPT.some((re) => re.test(path));
 }
 
+// The path the visitor knocked on, carried through the form so the password
+// lands them where they were going instead of on '/' (task 1003241). RELATIVE
+// PATHS ONLY: one leading slash, no '//' (protocol-relative), no backslash
+// (browsers read '/\evil' as '//evil'), no control bytes, not the gate's own
+// path — anything else is null and the redirect falls back to '/'. The same
+// shape as the relative branch of auth.js's safeReturnTo, kept local because
+// the gate mounts ahead of every router and loads nothing it does not need.
+function relativeReturn(raw) {
+  if (typeof raw !== 'string' || !raw.length || raw.length > 512) return null;
+  if (!raw.startsWith('/') || raw.startsWith('//') || raw.includes('\\')) return null;
+  if (/[\x00-\x1f\x7f]/.test(raw)) return null;
+  if (raw === '/' || raw.startsWith(SUBMIT_PATH)) return null;
+  return raw;
+}
+
+function escAttr(s) {
+  return String(s).replace(/&/g, '&amp;').replace(/"/g, '&quot;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
 // The form. Self-contained and token-free on purpose: it is served BEFORE the
 // visitor is allowed to see anything, so it must not pull the branding bundle,
 // the stylesheet, or any other asset that would leak the design of an
 // unannounced product to whoever knocks.
-function formHtml({ productName, wrong }) {
+function formHtml({ productName, wrong, returnTo }) {
   const name = String(productName || 'This instance').replace(/[<>&"]/g, '');
   return `<!doctype html><html lang="en"><head><meta charset="utf-8">
 <meta name="viewport" content="width=device-width,initial-scale=1">
@@ -144,6 +163,7 @@ button{padding:11px 20px;border:0;border-radius:999px;background:#ce4806;color:#
 <h1>${name}</h1>
 <p>Not open to the world yet. Enter the password to have a look.</p>
 <form method="POST" action="${SUBMIT_PATH}">
+  ${returnTo ? `<input type="hidden" name="return" value="${escAttr(returnTo)}">` : ''}
   <input type="password" name="password" placeholder="Password" aria-label="Password" autofocus required>
   <button type="submit">Enter</button>
 </form>
@@ -175,8 +195,10 @@ function stealthGate() {
         const want = password();
         const ok = given.length === want.length
           && crypto.timingSafeEqual(Buffer.from(given), Buffer.from(want));
+        // re-validated on the way back: the field is visitor-supplied
+        const returnTo = relativeReturn(params.get('return'));
         if (!ok) {
-          return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: true }));
+          return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: true, returnTo }));
         }
         res.cookie(COOKIE, expectedToken(), {
           httpOnly: true,
@@ -186,7 +208,7 @@ function stealthGate() {
           ...domainOpts(req),
           // no maxAge/expires — a SESSION cookie, by the owner's choice
         });
-        res.redirect(303, '/');
+        res.redirect(303, returnTo || '/');
       });
       return undefined;
     }
@@ -195,8 +217,11 @@ function stealthGate() {
     if (tokenMatches(readCookie(req, COOKIE))) return next();
 
     // 401 rather than 200: this is an unauthenticated request being refused, and
-    // a crawler that ignores the noindex should still be told so.
-    return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: false }));
+    // a crawler that ignores the noindex should still be told so. A GET's own
+    // path rides the form so the password lands the visitor back on it; any
+    // other method has nothing safe to replay as a GET.
+    const returnTo = (req.method === 'GET' || req.method === 'HEAD') ? relativeReturn(req.originalUrl) : null;
+    return res.status(401).type('html').send(formHtml({ productName: productName(), wrong: false, returnTo }));
   };
 }
 

package/src/module-api.js

@@ -1132,8 +1132,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.349 with no explicit bump. run 32810944115. (task 1002620)
 //   1.19.351 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.350 with no explicit bump. run 32850120472. (task 1002620)
+//   1.19.352 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.351 with no explicit bump. run 32850767673. (task 1002620)
+//   1.19.353 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.352 with no explicit bump. run 32851392269. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.351'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.353'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/provision.mjs

@@ -238,6 +238,17 @@ t('webEnvBody: the repo target_ref seats the founding owner via <prefix>_FIRST_A
   assert.doesNotMatch(P.webEnvBody(coTenant), /_FIRST_ADMIN=/);
 });
 
+t('webEnvBody: a resolved owner login wins over the repo owner — an org-owned repo seats the signed-in builder (task 1003240)', () => {
+  // The org that owns an adopted repo is not a sign-in identity; seating it seats nobody.
+  // Same preference instanceInitSpec already applies to the scaffold's branding.firstAdmin.
+  const inst = { ...coTenant, hosting_shape: 'standalone', domain: 'mercury.example.com', target_ref: 'acme-org/mercury' };
+  const withLogin = P.webEnvBody(inst, { ownerLogin: 'octocat' });
+  assert.match(withLogin, new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=octocat`));
+  assert.doesNotMatch(withLogin, /_FIRST_ADMIN=acme-org/);
+  // no resolved login → the repo owner stays the fallback (a personal repo's owner IS the builder)
+  assert.match(P.webEnvBody(inst), new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=acme-org`));
+});
+
 t('caddyBlock: a domain → on-demand-TLS reverse_proxy to the local port; no domain → a comment', () => {
   const withDomain = P.caddyBlock({ ...coTenant, domain: 'mercury.example.com' });
   assert.match(withDomain, /mercury\.example\.com \{/);
@@ -408,6 +419,21 @@ await ta('provisionInstance(standalone): the backup unit ExecStart points at the
   assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
 });
 
+await ta('provisionInstance(standalone): web.env seats the signed-in builder, not the org that owns the repo (task 1003240)', async () => {
+  const { deps } = recorder();
+  const bodies = {};
+  deps.writeFile = (p, body) => { bodies[p] = body; return { ok: true }; };
+  // the builders lookup answers with the signed-in owner; every other query stays empty
+  deps.db = { query: async (sql) => (/FROM builders/.test(String(sql)) ? { rows: [{ github_login: 'octocat' }] } : { rows: [] }) };
+  const inst = { ...coTenant, hosting_shape: 'standalone', target_ref: 'acme-org/mercury', owner_builder_id: 7 };
+  const r = await P.provisionInstance(inst, deps);
+  assert.equal(r.ok, true);
+  const envPath = Object.keys(bodies).find((p) => p.endsWith('/web.env'));
+  assert.ok(envPath, 'wrote web.env');
+  assert.match(bodies[envPath], new RegExp(`${reEsc(NEUTRAL_PREFIX)}_FIRST_ADMIN=octocat`));
+  assert.doesNotMatch(bodies[envPath], /_FIRST_ADMIN=acme-org/);
+});
+
 await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + npm ci) + migrates from the instance root', async () => {
   const { deps, cmds, writes } = recorder();
   const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' }, deps);

package/tests/stealth_gate.mjs

@@ -135,6 +135,71 @@ test('a wrong password is refused and says so', async () => {
   assert.ok(!String(res.headers['set-cookie'] || '').includes(gate.COOKIE), 'no cookie on failure');
 });
 
+/* ── the deep link survives the password (task 1003241) ── */
+const unlock = (fields) => request(gate.SUBMIT_PATH, {
+  method: 'POST',
+  body: new URLSearchParams({ password: PASSWORD, ...fields }).toString(),
+});
+
+test('the form carries the path the visitor knocked on, and the password lands them there', async () => {
+  // the pre-UAT walk found a stranger who typed /create landing on the front
+  // door after the password — the deep link rides the form, attribute-escaped
+  const knock = await request('/projects?view=new&repos=1');
+  assert.equal(knock.status, 401);
+  assert.match(knock.body, /<input type="hidden" name="return" value="\/projects\?view=new&amp;repos=1">/);
+  const res = await unlock({ return: '/projects?view=new&repos=1' });
+  assert.equal(res.status, 303);
+  assert.equal(res.headers.location, '/projects?view=new&repos=1');
+  assert.match(String(res.headers['set-cookie'] || ''), new RegExp(gate.COOKIE), 'the cookie still lands');
+});
+
+test('the front door carries no return field, and a bare password still lands on /', async () => {
+  const knock = await request('/');
+  assert.doesNotMatch(knock.body, /name="return"/);
+  const res = await unlock({});
+  assert.equal(res.status, 303);
+  assert.equal(res.headers.location, '/');
+});
+
+test('a wrong password keeps the deep link for the next try', async () => {
+  const res = await request(gate.SUBMIT_PATH, {
+    method: 'POST',
+    body: new URLSearchParams({ password: 'not-it', return: '/create' }).toString(),
+  });
+  assert.equal(res.status, 401);
+  assert.match(res.body, /name="return" value="\/create"/);
+});
+
+test('the return target is relative-path-only — never an absolute or off-site redirect', async () => {
+  const bad = [
+    'https://evil.example/',            // absolute, even https
+    '//evil.example',                   // protocol-relative
+    '/\\evil.example',                  // browsers read the backslash as a slash
+    'javascript:alert(1)',
+    '/ok\r\nSet-Cookie: x=1',           // header injection
+    '/' + 'a'.repeat(600),              // oversize
+    gate.SUBMIT_PATH + '?again',        // the gate's own path would loop
+  ];
+  for (const r of bad) {
+    const res = await unlock({ return: r });
+    assert.equal(res.status, 303, `${JSON.stringify(r)} still opens the gate`);
+    assert.equal(res.headers.location, '/', `${JSON.stringify(r)} must fall back to /`);
+  }
+});
+
+test('a knock that is not a GET is not carried back', async () => {
+  const res = await request('/projects', { method: 'POST', body: 'x=1' });
+  assert.equal(res.status, 401);
+  assert.doesNotMatch(res.body, /name="return"/);
+});
+
+test('a hostile path is escaped in the form, never echoed raw', async () => {
+  const res = await request('/x?q="><script>alert(1)</script>');
+  assert.equal(res.status, 401);
+  assert.doesNotMatch(res.body, /<script/);
+  assert.match(res.body, /value="\/x\?q=&quot;&gt;&lt;script&gt;/);
+});
+
 test('a forged or stale cookie does not open it', async () => {
   for (const bad of ['x', 'deadbeef', gate.expectedToken().slice(0, -1) + '0']) {
     const res = await request('/', { cookie: `${gate.COOKIE}=${bad}` });