@bongos/core 1.19.353 → 1.19.355

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.353",
-  "core_contract": "1.19.353",
-  "source_commit": "5bb1f8185d48f3d3d53181f4525eca45b0cef665",
+  "core_version": "1.19.355",
+  "core_contract": "1.19.355",
+  "source_commit": "a7ad49c28f305814b88df556ae4c1d18ceca1a01",
   "source_ref": "HEAD",
-  "built_at": "2026-08-25T13:07:06.857Z",
+  "built_at": "2026-08-25T13:24:07.447Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 329,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 1857,
-  "tree_sha256": "3b39dee80eea8539fc0a7b82684369a69c58b09c426cac168f029815bc78270e",
+  "tree_sha256": "abdcd03b753d6da9681bddd073feee645787426d01b5d8ecd460cba64d4a6b73",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -367,7 +367,7 @@
     {
       "path": "clients/bongos-client/index.d.ts",
       "mode": "0000644",
-      "sha256": "8a03a6a6fa27ca367cef614e2d03bdf8c2363b50e5a11eca3b9e6faa803080f7"
+      "sha256": "f32214ef80ab2e05d032e35da07b84e7300a490001dd39a7f7d0ff1997053836"
     },
     {
       "path": "clients/bongos-client/index.mjs",
@@ -1452,7 +1452,7 @@
     {
       "path": "docs/api/openapi.json",
       "mode": "0000644",
-      "sha256": "86c346871a6181f8396b8daa5dcaa59180109a414162389786a23a43b51b93d6"
+      "sha256": "03a8b40f27b4ad5bd8219d4a755eb18c7b925feee465c6d97d3cb1b8c372651f"
     },
     {
       "path": "docs/architecture.md",
@@ -4477,7 +4477,7 @@
     {
       "path": "modules/provisioning/provisioning.js",
       "mode": "0000644",
-      "sha256": "862fa78c7272a28cdc644debfd8ec364b80b635e8b9a6f41afb76b93312f27dd"
+      "sha256": "ff156c4c0252240026a5ce98547efa76d585d6f0fd88c5b0b95c5598901865ab"
     },
     {
       "path": "modules/provisioning/rate-limit.js",
@@ -4487,7 +4487,7 @@
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "5e9b3d225f06ab2d92b1f85d0d338ae6fa9aaae31afad92b043172e048455895"
+      "sha256": "026234f2c2c212a7ecc3808380bd3ea0cca81e2efc39c619968c505099830e5c"
     },
     {
       "path": "modules/provisioning/tests/liveness.mjs",
@@ -4787,12 +4787,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "0b1bb5323c63aefbe9f58e5bd5eba8cfed791c5089bf5dbae18fde4055c31299"
+      "sha256": "2e354a8f810ac30ec70aab86c458d275f4d598788d8dbbfb1fc2a91a9f035ff1"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c524de81eaba481839a9515c321c48d231506f677459d76c495bb51ebfd8b90c"
+      "sha256": "7dc6f776203244cb6e6b909f1a32c93948d04dc243bfd714d281bf1b8ee8fcdb"
     },
     {
       "path": "public-docs/index.html",
@@ -5052,7 +5052,7 @@
     {
       "path": "public-landing/projects.html",
       "mode": "0000644",
-      "sha256": "6d57b80519977cc23b3da231164e20b645ced2b6bbf97ebd3e64f3f9b393321b"
+      "sha256": "42ddc3ecf96a31919f0e700f2cd0092d8225858c78ef4d231e4b3ac301b5b318"
     },
     {
       "path": "public-landing/world/assets/clouds/cloud-island-large.png",
@@ -6617,7 +6617,7 @@
     {
       "path": "src/bongos/serve-internal.js",
       "mode": "0000644",
-      "sha256": "bf37dbda6a10fe8b21f6df01e8bdd62aea3f539523464b37666ffd535ceb7e00"
+      "sha256": "025676342224c2944fa2361965c12d9e6cf812fd17541c737a32fab7544c2709"
     },
     {
       "path": "src/bongos/stealth-gate.js",
@@ -6652,7 +6652,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "82bd181f16c9ee484e55c879439a7f61ff056588080a57bd95a3881d89b726f3"
+      "sha256": "43ca06d2e5757257056bcaac608518df57c750d552ad667ec751a6ca28a0c00a"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -8147,7 +8147,7 @@
     {
       "path": "tests/landing_page.mjs",
       "mode": "0000644",
-      "sha256": "2efddbab276f2ef38dbcf09ef6b76d4c1ff58f68c8b11a8803c7a27b605b385f"
+      "sha256": "7457d53dee7cce5770c17ec908c0f051e72092d2fa1cf5a9a1198fbdac64145a"
     },
     {
       "path": "tests/lib_sh_resolution.mjs",
@@ -8542,7 +8542,7 @@
     {
       "path": "tests/projects_hub_pre_uat.mjs",
       "mode": "0000644",
-      "sha256": "4f8b786e8704b418354d2551d20466e4d9ca705ca7ac39d00cd2dc83e3080032"
+      "sha256": "919caac313f78c8c88e7ecca1a49ff2f1da53e443acda434f0648a9b5215f24d"
     },
     {
       "path": "tests/promote_goal_id.mjs",
@@ -8582,7 +8582,7 @@
     {
       "path": "tests/provisioning_settings.mjs",
       "mode": "0000644",
-      "sha256": "a525fdcfa2fde8edd2be3198ca7213b9b6bc43a12f748a718a570b7f993972b6"
+      "sha256": "7b6aa958f626054746e5272113bb314a118073507d5baed65f52cafdc25f7085"
     },
     {
       "path": "tests/provisioning_settings_env.mjs",

package/clients/bongos-client/index.d.ts

@@ -81,7 +81,7 @@ export interface GetProjectsResponse { projects: unknown }
 export interface GetProvisioningFleetResponse { instances: unknown }
 export interface GetProvisioningGithubAppStatusResponse { ok: boolean; status: unknown; ready: unknown; terminal: unknown; domain: unknown; instance_status: unknown; app_slug: unknown }
 export interface GetProvisioningHealthResponse { module: unknown; ok: boolean; coreVersion: unknown }
-export interface GetProvisioningInstancesIdResponse { instance: unknown; open_intent: unknown }
+export interface GetProvisioningInstancesIdResponse { instance: unknown; open_intent: unknown; github_app: unknown }
 export interface GetProvisioningInstancesIdSettingsResponse { ok: boolean; settings: unknown; options: unknown }
 export interface GetProvisioningInstancesResponse { instances: unknown }
 export interface GetProvisioningOnboardPlanResponse { mode: unknown; steps: unknown }

package/docs/api/openapi.json

@@ -14994,11 +14994,13 @@
         "type": "object",
         "properties": {
           "instance": {},
-          "open_intent": {}
+          "open_intent": {},
+          "github_app": {}
         },
         "required": [
           "instance",
-          "open_intent"
+          "open_intent",
+          "github_app"
         ]
       },
       "GetProvisioningInstancesIdSettingsResponse": {

package/modules/provisioning/provisioning.js

@@ -232,6 +232,18 @@ function publicInstance(row) {
   };
 }
 
+// The GitHub-App manifest leg's truth for an instance, as the read surface carries
+// it (task 1003235): the latest attempt's lifecycle status + the App's public slug.
+// Same vocabulary as GET /github-app/status ('pending' | 'code_received' |
+// 'converting' | 'done' | 'error' | 'expired'), so the wizard can seed its
+// `live.manifest` from a plain instance read after a reload, a second tab, or
+// another device — no sessionStorage bridge needed. null = no attempt ever made.
+// PURE: an allow-list projection of the manifest row, never the row itself.
+function publicGithubApp(manifestRow) {
+  if (!manifestRow || !manifestRow.status) return null;
+  return { status: String(manifestRow.status), app_slug: manifestRow.app_slug || null };
+}
+
 // The instance's EFFECTIVE settings: the defaults overlaid with the stored,
 // on-vocabulary keys. An off-vocabulary or unknown stored value falls back to
 // its default rather than leaking into the read surface. PURE.
@@ -812,7 +824,7 @@ module.exports = {
   isValidSlug, costEstimateUsd, publicInstance, normalizeHostname,
   defaultDomainForSlug, isReservedHostname, effectiveSettings,
   // pure — GitHub App Manifest flow (task 2080)
-  githubAppName, buildGithubAppManifest, manifestPostUrl,
+  githubAppName, buildGithubAppManifest, manifestPostUrl, publicGithubApp,
   // data access
   isProvisionedHostname,
   getInstanceById, getInstanceBySlug, getInstanceByDomain, listInstancesForOwner, listAllInstances,

package/modules/provisioning/routes/provisioning.js

@@ -619,9 +619,13 @@ module.exports = function provisioningRoutes() {
         return res.fail('instance_not_found', 404);
       }
       const open = await provisioning.getOpenIntent(pool, id);
+      // The GitHub-App leg's truth rides the same read (task 1003235), so the done
+      // panel recovers it from server state after a reload — not from sessionStorage.
+      const manifest = await provisioning.getLatestOAuthManifestForInstance(pool, id);
       res.json({
         instance: provisioning.publicInstance(inst),
         open_intent: open ? { action: open.action, state: open.state } : null,
+        github_app: provisioning.publicGithubApp(manifest),
       });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/instances/:id', err);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.353",
+  "version": "1.19.355",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.353",
+      "version": "1.19.355",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.353",
+  "version": "1.19.355",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/public-landing/projects.html

@@ -3555,6 +3555,18 @@ summary{min-height:24px;padding:3px 0;}
             var inst = data.instance;
             if (inst) inst.open_intent = data.open_intent || null;   /* F22: the strip reads intents */
             if (inst) watchFlow = inst.torn_down_at ? 'revive' : 'standup';
+            /* server-derived manifest truth (task 1003235): a reload, a second tab
+               or another device re-learns the GitHub-App leg from this same read.
+               A live manifest poll owns live.manifest while it runs, so the seed
+               yields to it. */
+            var ga = data.github_app;
+            if (ga && ga.status && !manifestPollTimer) {
+              var seeded = ga.status === 'done' ? 'done' : ga.status;
+              var seedChanged = seeded !== live.manifest || (!!ga.app_slug && ga.app_slug !== live.appSlug);
+              if (ga.app_slug) live.appSlug = ga.app_slug;
+              live.manifest = seeded;
+              if (seedChanged) { rememberManifest(undefined, live.manifest, live.appSlug || undefined); renderSteps(); }
+            }
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */

package/src/bongos/serve-internal.js

@@ -169,7 +169,8 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
   const tagline = (brand.copy && brand.copy.tagline) || '';
   const cur = (brand.currency && brand.currency.label) || 'credits';
   const Cur = cur ? cur.charAt(0).toUpperCase() + cur.slice(1) : cur;
-  return String(html == null ? '' : html)
+  const hall = hallOrigin || origin || '';
+  return dropEmptyHrefLinks(String(html == null ? '' : html), { publicOrigin: origin || '', buildersOrigin: hall, sourceRepoUrl: sourceRepo || '' })
     .split('{{worldName}}').join(esc(world))
     .split('{{productName}}').join(esc(product))
     .split('{{Currency}}').join(esc(Cur))
@@ -178,10 +179,23 @@ function applyBrandTokens(html, brand = clientBranding(), origin = safePublicOri
     .split('{{publicOrigin}}').join(esc(origin || ''))
     // a pack that names no hall of its own resolves to its OWN apex — never to
     // whichever instance authored the file
-    .split('{{buildersOrigin}}').join(esc(hallOrigin || origin || ''))
+    .split('{{buildersOrigin}}').join(esc(hall))
     .split('{{sourceRepoUrl}}').join(esc(sourceRepo || ''))
     .split('{{instanceBase}}').join(esc(instanceBase || ''));
 }
+// A link whose href is a BARE origin token that resolves empty is dropped whole,
+// server-side (task 1003242; the branding contract): a pack that names no domains
+// would otherwise stamp `href=""` — a dead hall pill on every page carrying one,
+// and only index.html scrubs those client-side. Exact-token hrefs only: a token
+// inside a longer URL still stamps (an empty prefix leaves a relative path).
+function dropEmptyHrefLinks(html, values) {
+  let out = html;
+  for (const [token, value] of Object.entries(values)) {
+    if (value) continue;
+    out = out.replace(new RegExp(`<a\\b[^>]*\\bhref="\\{\\{${token}\\}\\}"[^>]*>[\\s\\S]*?<\\/a>`, 'g'), '');
+  }
+  return out;
+}
 // Every token lands in HTML — as element text, or inside a double-quoted
 // attribute (href/content). Escaping is defence in depth, not a live fix: the
 // only source is config/branding.json, which is committed, code-reviewed and

package/src/module-api.js

@@ -1136,8 +1136,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.351 with no explicit bump. run 32850767673. (task 1002620)
 //   1.19.353 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.352 with no explicit bump. run 32851392269. (task 1002620)
+//   1.19.354 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.353 with no explicit bump. run 32852045058. (task 1002620)
+//   1.19.355 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.354 with no explicit bump. run 32853063015. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.353'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.355'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/landing_page.mjs

@@ -142,6 +142,24 @@ test('an unstamped link is removed, not left dangling', () => {
   assert.ok(out.length > 0);
 });
 
+test('a pack with NO domains drops the hall pill server-side rather than stamping href="" (task 1003242)', () => {
+  // the hub has no client scrubber, so an empty token must never reach it as a dead link
+  const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8');
+  assert.match(HUB, /data-link-hall href="\{\{buildersOrigin\}\}"/, 'the hub pill is token-stamped');
+  const none = applyBrandTokens(HUB, BRAND, '', '');
+  assert.doesNotMatch(none, /href=""/, 'no empty href survives the stamp');
+  assert.doesNotMatch(none, /data-link-hall/, 'the pill element is omitted whole, not left dead');
+  assert.doesNotMatch(none, /\{\{[a-zA-Z]+\}\}/, 'every other token still stamps');
+  const apexOnly = applyBrandTokens(HUB, BRAND, 'https://spike-harbor.example', '');
+  assert.match(apexOnly, /data-link-hall href="https:\/\/spike-harbor\.example"/, 'an apex alone keeps the pill, pointed at the apex');
+  const both = applyBrandTokens(HUB, BRAND, 'https://spike-harbor.example', 'https://builders.spike-harbor.example');
+  assert.match(both, /data-link-hall href="https:\/\/builders\.spike-harbor\.example"/);
+  // the landing page too — its client-side scrubber is no longer the only guard
+  assert.doesNotMatch(applyBrandTokens(HTML, BRAND, '', ''), /<a\b[^>]*href=""/);
+  // a token INSIDE a longer href is a relative path once stamped empty, not a dead link — left alone
+  assert.equal(applyBrandTokens('<a href="{{publicOrigin}}/docs">Docs</a>', BRAND, '', ''), '<a href="/docs">Docs</a>');
+});
+
 // ── the branding cascade + portability ─────────────────────────────────────
 
 test('the page declares no :root — a page-local one defeats re-branding (C1)', () => {

package/tests/projects_hub_pre_uat.mjs

@@ -484,3 +484,17 @@ test('control nits: orb cursor, caret under reduced motion, mode label, home lab
   assert.match(HUB, /\.again\{[^}]*padding:6px 2px;min-height:24px;/);
   assert.match(HUB, /\nsummary\{min-height:24px;padding:3px 0;\}/, 'every fold is a 24px target; the disclosure marker stays');
 });
+
+/* ── server-derived manifest truth (task 1003235) ── */
+test('the done panel re-learns the GitHub-App leg from the instance read, yielding to a live manifest poll', () => {
+  /* the seed lives in startProgress's nested tick(), past where fn() stops — read the script */
+  const sp = SCRIPT.slice(SCRIPT.indexOf('function startProgress('));
+  assert.match(sp, /var ga = data\.github_app;\n\s*if \(ga && ga\.status && !manifestPollTimer\) \{/, 'seeded from the same 5s read; a running manifest poll owns live.manifest');
+  assert.match(sp, /var seeded = ga\.status === 'done' \? 'done' : ga\.status;/, 'the status route’s vocabulary, verbatim');
+  assert.match(sp, /if \(ga\.app_slug\) live\.appSlug = ga\.app_slug;\n\s*live\.manifest = seeded;/);
+  assert.match(sp, /if \(seedChanged\) \{ rememberManifest\(undefined, live\.manifest, live\.appSlug \|\| undefined\); renderSteps\(\); \}/, 'change-only: an identical tick neither rewrites the bridge nor re-renders');
+  const seedAt = sp.indexOf('var ga = data.github_app;');
+  const statusAt = sp.indexOf("if (inst && inst.status !== live.instStatus)");
+  assert.ok(seedAt > 0 && seedAt < statusAt, 'the manifest seed lands before the status re-render, so one renderSteps() paints both');
+  assert.match(fn('enter'), /if \(created\.manifest\) \{ live\.manifest = created\.manifest; live\.appSlug = created\.app_slug \|\| null; \}/, 'the sessionStorage bridge stays as the pre-first-tick seed');
+});

package/tests/provisioning_settings.mjs

@@ -42,6 +42,8 @@ provisioning.updateInstanceSettings = async (_db, id, patch) => {
 };
 provisioning.recordEvent = async (_db, e) => { events.push(e); };
 provisioning.getOpenIntent = async () => null;
+let manifest = null;            // the latest manifest attempt the read surfaces (task 1003235)
+provisioning.getLatestOAuthManifestForInstance = async () => manifest;
 
 const api = require('../src/module-api.js');
 let builder = { id: 7, github_login: 'owner', rank: 'thetes' };
@@ -106,6 +108,31 @@ await ta('owner reads their own instance', async () => {
   assert.equal(r.body.instance.slug, 'spike');
 });
 
+await ta('the read carries the GitHub-App leg\'s truth — github_app {status, app_slug} from the latest manifest attempt (task 1003235)', async () => {
+  reset();
+  manifest = { id: 3, instance_id: 18, status: 'done', app_slug: 'spike-bongos', github_code: 'never-surfaced', state: 'never-surfaced' };
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(r.body.github_app, { status: 'done', app_slug: 'spike-bongos' }, 'an allow-list projection — the code and the state token never ride the read');
+  assert.equal(r.body.instance.slug, 'spike', 'the instance projection is untouched');
+});
+
+await ta('no manifest attempt yet → github_app is null, not absent (a reload can tell "never started" from "unknown")', async () => {
+  reset();
+  manifest = null;
+  const r = await get('/provisioning/instances/18');
+  assert.equal(r.status, 200, r.raw);
+  assert.ok('github_app' in r.body, 'the key is always present');
+  assert.equal(r.body.github_app, null);
+});
+
+await ta('publicGithubApp is a pure allow-list projection with the status route\'s vocabulary', async () => {
+  assert.equal(provisioning.publicGithubApp(null), null);
+  assert.equal(provisioning.publicGithubApp({ app_slug: 'x' }), null, 'a row with no status is no truth');
+  assert.deepEqual(provisioning.publicGithubApp({ status: 'pending', github_code: 'secret' }), { status: 'pending', app_slug: null });
+  assert.deepEqual(provisioning.publicGithubApp({ status: 'code_received', app_slug: 'mercury-bongos' }), { status: 'code_received', app_slug: 'mercury-bongos' });
+});
+
 await ta('ANOTHER builder\'s GET → 404 (no existence leak)', async () => {
   reset({ as: { id: 8, github_login: 'stranger', rank: 'thetes' } });
   const r = await get('/provisioning/instances/18');