@bongos/core 1.19.529 → 1.19.530

package/.bongos-core.json

@@ -2,22 +2,22 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.19.529",
-  "core_contract": "1.19.529",
-  "source_commit": "80d814daa7174fe0e760966095ee9339a29d7d1d",
+  "core_version": "1.19.530",
+  "core_contract": "1.19.530",
+  "source_commit": "f0252c888bf69ec2aadf5067e81ab801f6e6ef70",
   "source_ref": "HEAD",
-  "built_at": "2026-09-04T13:17:35.687Z",
+  "built_at": "2026-09-04T13:34:55.894Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 435,
     "agent_docs_stubbed": 24,
-    "functional_verbatim": 1976,
+    "functional_verbatim": 1978,
     "rules": 3,
     "gate_literals": 3,
     "gate": "passed"
   },
-  "file_count": 2435,
-  "tree_sha256": "a029bcb3e7adddef9f33b68cd23f96158ebb345a0b1a60e28dc8f2553809d595",
+  "file_count": 2437,
+  "tree_sha256": "9d176777fdd02fcc72db1a22651a24c4cbb6d8ff5a4531567c1d07e25511c7e1",
   "files": [
     {
       "path": ".claude/skills/blocker-review/SKILL.md",
@@ -2617,7 +2617,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "8a6ba922b7918d974e9374510472ce2a67c28790e60875b36efe7ceccda84e2f"
+      "sha256": "b4be57f7972652783e91059ffccf9b0df8d972611955a66368c32bc14120dddc"
     },
     {
       "path": "docs/modules-contract.md",
@@ -6064,10 +6064,15 @@
       "mode": "0000644",
       "sha256": "4c933aad1307378496d47960e24c9d797a1f122f28aefa27b769f336e4cf2e75"
     },
+    {
+      "path": "modules/provisioning/routes/callback-page.js",
+      "mode": "0000644",
+      "sha256": "6b43ebf71a778277b94de1b9400f690fac9f51b48010e50a159af57195f99f02"
+    },
     {
       "path": "modules/provisioning/routes/provisioning.js",
       "mode": "0000644",
-      "sha256": "69ec9994c833b54466fa0e83a3aa2c09eada6b0aefadf73e6eb50b085996aaa6"
+      "sha256": "e08199bc9146bd3122ca038637a0e390b9f5e636a102fa290dba414cf6cafdc1"
     },
     {
       "path": "modules/provisioning/starter-bundles.js",
@@ -7327,12 +7332,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "43ac8c190119cd19cbd7884c854dd616d4dce8947f9435367acbf04c3058d7b1"
+      "sha256": "c5ca6f4757bfbd6c174c11a75b767eb787bd202c8eda8e9ee1b51b7d76608b2a"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "9baba915b700faa5eda5733b68bffd4aaeaa54b5a3076502440c39a944944f3d"
+      "sha256": "2795c4357358560ad6802a780c375b49326f09c1c79ea047702cdcc2b8c602dd"
     },
     {
       "path": "public-docs/index.html",
@@ -9012,7 +9017,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "532e7d3dc98b5ff136f1cb7484232b17f2f3c750dad15315493224b2619ef78f"
+      "sha256": "a92fb66032716db9e4517d003bde07cb8283a2282d2b3925283c2018cb348598"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -9752,7 +9757,7 @@
     {
       "path": "tests/design_tokens_sync.mjs",
       "mode": "0000644",
-      "sha256": "0454ee692bbbf19d02c7f19c029f4da5a4dd939b84c4d67ebb713d12de179c2a"
+      "sha256": "6fc1f0a595d3042b5b57b708643cfdc18007b3b33bb6684ffbeb46217da4c376"
     },
     {
       "path": "tests/dev_lib.mjs",
@@ -11274,6 +11279,11 @@
       "mode": "0000644",
       "sha256": "9a04386b3047177bb55b6d392db88764f06f92e5c0b20c16ed9e0f8ce520b07d"
     },
+    {
+      "path": "tests/provisioning_callback_page.mjs",
+      "mode": "0000644",
+      "sha256": "74d53ae7f3c93883bdc6db5187c904cc6c641267233d70bfef1a25d5b2a4ca05"
+    },
     {
       "path": "tests/provisioning_default_domain.mjs",
       "mode": "0000644",
@@ -11292,7 +11302,7 @@
     {
       "path": "tests/provisioning_module_selection.mjs",
       "mode": "0000644",
-      "sha256": "48fc7c59efae4b7d1b9ab565882473483d7b4d8a40635583a789d0749da16578"
+      "sha256": "4a27e1641d949f261a8ba1b72816a8b077fc8a55862c4eef4091b453b7cfd45c"
     },
     {
       "path": "tests/provisioning_onboard_mode.mjs",

package/docs/module-api-changelog.md

@@ -1495,5 +1495,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.527 with no explicit bump. run 33829339717. (task 1002620)
   1.19.529 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.528 with no explicit bump. run 33877197857. (task 1002620)
+  1.19.530 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.529 with no explicit bump. run 33878817005. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/provisioning/routes/callback-page.js

@@ -0,0 +1,159 @@
+// modules/provisioning/routes/callback-page.js — the standalone HTML the public
+// GitHub-App-Manifest redirect lands on (task 1003570; the page itself is task 2096).
+//
+// WHY. This is pure PRESENTATION for exactly one route — `GET /provisioning/
+// github-app/callback` in routes/provisioning.js — and it is ~135 lines of escaper,
+// palette, stylesheet, client script and template with no request, DB or auth logic
+// in it. Carrying it inside the route file pushed that file onto the 1500-line
+// OVERSIZE_LINES fitness ratchet (scripts/gds/fitness-ratchets.js), where the next
+// single added line failed `unit` and the only obvious escape — raising the baseline
+// — is the one thing the ratchet forbids (ADR 0243 §4/§5 for the argument that put
+// it there). Moved here verbatim so the route file has room to change again.
+//
+// Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
+// 0083); it is required by routes/provisioning.js and by nothing else.
+//
+// Shape: no DB, no network, no request object — given a plain options bag it returns
+// a string. `esc` and `callbackPage` are the whole surface; PAGE_STYLE and
+// CALLBACK_SCRIPT stay private because they are only ever this page's own body.
+'use strict';
+
+const api = require('../../../src/module-api');
+
+// Minimal HTML escaper for the callback landing page (no template engine here).
+function esc(s) {
+  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
+    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
+  ));
+}
+
+// Accent pair resolved from the instance's own branding — the pack is the palette
+// authority (task 1002810); the literal fallbacks are the neutral pack's values, so
+// a branding validation error still paints the current family, never a stale one.
+const ACCENT = (() => {
+  try {
+    const c = api.branding().theme?.ui?.colors || {};
+    return { sun: c.accent || '#fb9569', sun600: c.accentDeep || '#a3481a' };
+  } catch { return { sun: '#fb9569', sun600: '#a3481a' }; }
+})();
+
+// Brand styling for the standalone onboarding pages — sunrise palette + Baloo 2 /
+// Quicksand (accents from the branding pack, config/branding.neutral.json resolved
+// under the instance's own config/branding.json). Light + dark aware; no external
+// dependency beyond an optional Google-Fonts link (system fallback if it doesn't load).
+const PAGE_STYLE = `
+:root{color-scheme:light dark;--sun:${ACCENT.sun};--sun600:${ACCENT.sun600};--sunInk:#2a1305;--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
+@media (prefers-color-scheme:dark){:root{--ink:#f5efe6;--inkSoft:#cbbdad;--card:#241b13;--line:#3a2c1e;--bg1:#2a1d10;--bg2:#1b130b;--bg3:#130d07}}
+*{box-sizing:border-box}html,body{height:100%}
+body{margin:0;font-family:"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--ink);background:linear-gradient(180deg,var(--bg1) 0%,var(--bg2) 45%,var(--bg3) 100%);background-attachment:fixed;display:flex;align-items:center;justify-content:center;padding:1.5rem;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}
+.card{width:100%;max-width:30rem;background:var(--card);border:1px solid var(--line);border-radius:20px;padding:2.4rem 2rem 2rem;text-align:center;box-shadow:0 18px 50px -22px rgba(120,60,10,.4),0 2px 8px rgba(120,60,10,.07)}
+.badge-warn{font-size:2.4rem;line-height:1;margin:0 auto 1rem}
+h1{font-family:"Baloo 2",system-ui,sans-serif;font-weight:700;font-size:1.5rem;line-height:1.15;margin:.2rem 0 .55rem}
+.sub{color:var(--inkSoft);font-size:1.02rem;line-height:1.5;margin:0 auto;max-width:24rem}
+.sub p{margin:.6rem 0}
+code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rgba(56,189,248,.14);color:var(--sky600);padding:.12em .45em;border-radius:6px;font-size:.9em;overflow-wrap:anywhere}
+@media (prefers-color-scheme:dark){code{color:var(--sky)}}
+.steps{display:flex;align-items:flex-start;justify-content:center;margin:1.9rem 0 1.1rem}
+.step{flex:1 1 0;max-width:9rem;position:relative}
+.step::before{content:"";position:absolute;top:16px;left:-50%;width:100%;height:3px;background:var(--line);z-index:0;transition:background .4s ease}
+.step:first-child::before{display:none}
+.dot{width:34px;height:34px;border-radius:50%;margin:0 auto;display:grid;place-items:center;background:var(--bg3);border:2px solid var(--line);color:var(--inkSoft);font-weight:700;font-size:.95rem;position:relative;z-index:1;transition:all .4s ease}
+.lbl{margin-top:.55rem;font-size:.78rem;color:var(--inkSoft);font-weight:600;line-height:1.25;padding:0 .2rem}
+.step.done .dot{background:var(--ok);border-color:var(--ok);color:#fff}
+.step.done::before{background:var(--ok)}
+.step.active .dot{border-color:var(--sun);color:var(--sun600);animation:pulse 1.5s ease-in-out infinite}
+.step.active .lbl{color:var(--ink)}
+.step.active .dot::after{content:"";position:absolute;inset:-3px;border-radius:50%;border:2px solid transparent;border-top-color:var(--sun);animation:spin .8s linear infinite}
+@keyframes spin{to{transform:rotate(360deg)}}
+@keyframes pulse{0%,100%{box-shadow:0 0 0 4px rgba(249,115,22,.15)}50%{box-shadow:0 0 0 9px rgba(249,115,22,.04)}}
+@media (prefers-reduced-motion:reduce){.step.active .dot,.step.active .dot::after{animation:none}}
+.status-line{min-height:1.4em;color:var(--inkSoft);font-size:.94rem;margin:.4rem auto 0;max-width:24rem;line-height:1.45}
+.cta{margin-top:1.4rem}
+.btn{display:inline-block;background:var(--sun);color:var(--sunInk);text-decoration:none;font-weight:700;font-family:"Baloo 2",system-ui,sans-serif;padding:.72rem 1.5rem;border-radius:999px;font-size:1.02rem;box-shadow:0 10px 22px -8px rgba(249,115,22,.7);transition:transform .15s ease,box-shadow .15s ease}
+.btn:hover{transform:translateY(-1px);box-shadow:0 14px 28px -8px rgba(249,115,22,.8)}
+.muted{color:var(--inkSoft);opacity:.9;font-size:.85rem;margin:1.1rem auto 0;max-width:24rem;line-height:1.45}
+.hidden{display:none!important}
+`;
+
+// Client script for the PROGRESS variant only (task 2096): poll the public status
+// endpoint, advance the stepper, and auto-open the instance the moment its credentials
+// land. Deliberately contains NO backticks and NO ${...} so it survives the outer
+// template literal verbatim; the only server data it reads is the JSON config block
+// written just above it. Fails soft — a poll hiccup just retries; a long wait reveals a
+// manual "open" button rather than ever falsely erroring. The auto-open countdown runs
+// ONLY when this page is the wizard's pop-up; a same-tab return (pop-up blocked) keeps
+// the founder here with the door and a way back to the checklist (task 1003236).
+const CALLBACK_SCRIPT = `
+(function(){
+  var cfg=window.__CB_SETUP__||{};
+  var state=cfg.state||'',domain=cfg.domain||'';
+  if(!state||!domain)return;
+  var target='https://'+domain;
+  var pollUrl=location.pathname.replace('/callback','/status')+'?state='+encodeURIComponent(state);
+  var steps=document.getElementById('steps'),statusEl=document.getElementById('status');
+  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot'),back=document.getElementById('back');
+  /* Opened from the wizard as a pop-up (window.opener alive, or the tab still carries the name the wizard gave it):
+     the checklist is in the other tab, so this one may auto-open the instance. Same-tab fallback (pop-up blocked,
+     form target=_self): this IS the founder's checklist tab — never navigate it away; offer both doors (task 1003236). */
+  var popup=!!window.opener||window.name==='ghAppSetup';
+  var finished=false,tries=0,manual=false;
+  function dot(n){return steps.querySelector('[data-step="'+n+'"]');}
+  function setActive(n){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active','done');if(i<n){el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}else if(i===n){el.classList.add('active');}}}
+  function allDone(){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active');el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}}
+  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');
+    if(!popup){go.textContent='Open '+domain+' \\u2192';if(back)back.classList.remove('hidden');if(foot)foot.textContent='Your setup checklist is waiting where you left it \\u2014 finish it first, or open your instance now.';return;}
+    var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
+  function failed(){if(finished)return;finished=true;statusEl.textContent='Setup didn\\u2019t finish. Open your instance page and start the GitHub sign-in setup again.';cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';}
+  function revealManual(){if(manual||finished)return;manual=true;cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';if(foot)foot.textContent='This is taking a little longer than usual \\u2014 you can open your instance now, or keep waiting.';}
+  function schedule(){if(!finished)setTimeout(poll,3000);}
+  function poll(){tries++;fetch(pollUrl,{headers:{accept:'application/json'},cache:'no-store'}).then(function(r){return r.ok?r.json():null;}).then(function(j){if(!j){schedule();return;}if(j.ready||j.status==='done'){ready();return;}if(j.status==='error'||j.status==='expired'){failed();return;}setActive(2);if(tries===40)revealManual();schedule();}).catch(function(){schedule();});}
+  setActive(2);poll();
+})();
+`;
+
+// The standalone landing page for the public GitHub redirect (the mothership serves it;
+// it is NOT the hall shell). Two variants share the Cloud Bongos brand shell (task 2096):
+//   • progress — ok + state + domain: an animated stepper that polls the status endpoint
+//     and auto-opens the instance when its credentials are placed.
+//   • message — everything else (errors + the no-domain success fallback): a calm badge
+//     + `body` (server-authored, trusted HTML).
+function callbackPage({ ok, title, body, state, domain }) {
+  const progress = !!(ok && state && domain);
+  const cfgJson = JSON.stringify({ state: state || '', domain: domain || '' }).replace(/</g, '\\u003c');
+  const head = `<!doctype html><html lang="en"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="color-scheme" content="light dark">
+<title>${esc(title)}</title>
+<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+<link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@600;700;800&family=Quicksand:wght@400;500;600;700&family=Fira+Code&display=swap" rel="stylesheet">
+<style>${PAGE_STYLE}</style></head><body>`;
+  if (progress) {
+    return `${head}
+<main class="card">
+  <h1>${esc(title)}</h1>
+  <p class="sub">Finishing sign-in setup for <code>${esc(domain)}</code>.</p>
+  <div class="steps" id="steps" aria-label="Setup progress">
+    <div class="step done" data-step="1"><div class="dot">✓</div><div class="lbl">GitHub app created</div></div>
+    <div class="step active" data-step="2"><div class="dot">2</div><div class="lbl">Placing credentials</div></div>
+    <div class="step" data-step="3"><div class="dot">3</div><div class="lbl">Ready to sign in</div></div>
+  </div>
+  <p class="status-line" id="status">Hang tight — keep this tab open while we finish.</p>
+  <div class="cta hidden" id="cta"><a class="btn" id="go" href="https://${esc(domain)}">Open ${esc(domain)} →</a></div>
+  <p class="muted hidden" id="back"><a href="/projects?view=new">Finish your remaining setup steps →</a></p>
+  <p class="muted" id="foot">This page opens <code>${esc(domain)}</code> for you the moment it’s ready.</p>
+  <noscript><p class="muted">When setup finishes, open <a href="https://${esc(domain)}">${esc(domain)}</a> and sign in with GitHub — that first sign-in makes you the owner.</p></noscript>
+</main>
+<script>window.__CB_SETUP__=${cfgJson};</script>
+<script>${CALLBACK_SCRIPT}</script>
+</body></html>`;
+  }
+  return `${head}
+<main class="card">
+  <div class="badge-warn">${ok ? '✓' : '⚠️'}</div>
+  <h1>${esc(title)}</h1>
+  <div class="sub">${body || ''}</div>
+</main>
+</body></html>`;
+}
+
+module.exports = { esc, callbackPage };

package/modules/provisioning/routes/provisioning.js

@@ -27,6 +27,9 @@
 //
 // Reaches core ONLY through the doorway src/module-api.js (the one-way rule, ADR
 // 0083); it requires this module's own provisioning.js (same-dir), never a sibling.
+// The GitHub-App callback page's presentation (esc / ACCENT / the stylesheet / the
+// client script / callbackPage) lives in ./callback-page.js — moved out under task
+// 1003570 because this file had reached the 1500-line fitness ratchet.
 'use strict';
 
 const crypto = require('node:crypto');
@@ -39,6 +42,7 @@ const { onboardPlan, stepsForShape } = require('../onboard-plan');
 const { ALWAYS_ON_CORE, OPTIONAL_MODULES, starterBundleAnswerTable, optionalModules, effectiveModules } = require('../starter-bundles');
 const { recommendationsForDetails } = require('../recommendations');
 const { makeAskRateLimiter, clientIp } = require('../rate-limit');
+const { callbackPage } = require('./callback-page');
 // task 1003208: structured logging (pino via the doorway) — was console.*.
 const log = api.logger('provisioning');
 
@@ -139,142 +143,6 @@ function badModuleSelection(modules) {
   return null;
 }
 
-// Minimal HTML escaper for the callback landing page (no template engine here).
-function esc(s) {
-  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
-    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
-  ));
-}
-
-// Accent pair resolved from the instance's own branding — the pack is the palette
-// authority (task 1002810); the literal fallbacks are the neutral pack's values, so
-// a branding validation error still paints the current family, never a stale one.
-const ACCENT = (() => {
-  try {
-    const c = api.branding().theme?.ui?.colors || {};
-    return { sun: c.accent || '#fb9569', sun600: c.accentDeep || '#a3481a' };
-  } catch { return { sun: '#fb9569', sun600: '#a3481a' }; }
-})();
-
-// Brand styling for the standalone onboarding pages — sunrise palette + Baloo 2 /
-// Quicksand (accents from the branding pack, config/branding.neutral.json resolved
-// under the instance's own config/branding.json). Light + dark aware; no external
-// dependency beyond an optional Google-Fonts link (system fallback if it doesn't load).
-const PAGE_STYLE = `
-:root{color-scheme:light dark;--sun:${ACCENT.sun};--sun600:${ACCENT.sun600};--sunInk:#2a1305;--coral:#fb7185;--sky:#38bdf8;--sky600:#0284c7;--ok:#16a34a;--warn:#f59e0b;--ink:#2a1f17;--inkSoft:#6b5d52;--card:#fffdfa;--line:#f0e2cf;--bg1:#fde8c8;--bg2:#fff4e6;--bg3:#fffdfa}
-@media (prefers-color-scheme:dark){:root{--ink:#f5efe6;--inkSoft:#cbbdad;--card:#241b13;--line:#3a2c1e;--bg1:#2a1d10;--bg2:#1b130b;--bg3:#130d07}}
-*{box-sizing:border-box}html,body{height:100%}
-body{margin:0;font-family:"Quicksand",system-ui,-apple-system,"Segoe UI",sans-serif;color:var(--ink);background:linear-gradient(180deg,var(--bg1) 0%,var(--bg2) 45%,var(--bg3) 100%);background-attachment:fixed;display:flex;align-items:center;justify-content:center;padding:1.5rem;-webkit-font-smoothing:antialiased;text-rendering:optimizeLegibility}
-.card{width:100%;max-width:30rem;background:var(--card);border:1px solid var(--line);border-radius:20px;padding:2.4rem 2rem 2rem;text-align:center;box-shadow:0 18px 50px -22px rgba(120,60,10,.4),0 2px 8px rgba(120,60,10,.07)}
-.badge-warn{font-size:2.4rem;line-height:1;margin:0 auto 1rem}
-h1{font-family:"Baloo 2",system-ui,sans-serif;font-weight:700;font-size:1.5rem;line-height:1.15;margin:.2rem 0 .55rem}
-.sub{color:var(--inkSoft);font-size:1.02rem;line-height:1.5;margin:0 auto;max-width:24rem}
-.sub p{margin:.6rem 0}
-code{font-family:"Fira Code",ui-monospace,SFMono-Regular,monospace;background:rgba(56,189,248,.14);color:var(--sky600);padding:.12em .45em;border-radius:6px;font-size:.9em;overflow-wrap:anywhere}
-@media (prefers-color-scheme:dark){code{color:var(--sky)}}
-.steps{display:flex;align-items:flex-start;justify-content:center;margin:1.9rem 0 1.1rem}
-.step{flex:1 1 0;max-width:9rem;position:relative}
-.step::before{content:"";position:absolute;top:16px;left:-50%;width:100%;height:3px;background:var(--line);z-index:0;transition:background .4s ease}
-.step:first-child::before{display:none}
-.dot{width:34px;height:34px;border-radius:50%;margin:0 auto;display:grid;place-items:center;background:var(--bg3);border:2px solid var(--line);color:var(--inkSoft);font-weight:700;font-size:.95rem;position:relative;z-index:1;transition:all .4s ease}
-.lbl{margin-top:.55rem;font-size:.78rem;color:var(--inkSoft);font-weight:600;line-height:1.25;padding:0 .2rem}
-.step.done .dot{background:var(--ok);border-color:var(--ok);color:#fff}
-.step.done::before{background:var(--ok)}
-.step.active .dot{border-color:var(--sun);color:var(--sun600);animation:pulse 1.5s ease-in-out infinite}
-.step.active .lbl{color:var(--ink)}
-.step.active .dot::after{content:"";position:absolute;inset:-3px;border-radius:50%;border:2px solid transparent;border-top-color:var(--sun);animation:spin .8s linear infinite}
-@keyframes spin{to{transform:rotate(360deg)}}
-@keyframes pulse{0%,100%{box-shadow:0 0 0 4px rgba(249,115,22,.15)}50%{box-shadow:0 0 0 9px rgba(249,115,22,.04)}}
-@media (prefers-reduced-motion:reduce){.step.active .dot,.step.active .dot::after{animation:none}}
-.status-line{min-height:1.4em;color:var(--inkSoft);font-size:.94rem;margin:.4rem auto 0;max-width:24rem;line-height:1.45}
-.cta{margin-top:1.4rem}
-.btn{display:inline-block;background:var(--sun);color:var(--sunInk);text-decoration:none;font-weight:700;font-family:"Baloo 2",system-ui,sans-serif;padding:.72rem 1.5rem;border-radius:999px;font-size:1.02rem;box-shadow:0 10px 22px -8px rgba(249,115,22,.7);transition:transform .15s ease,box-shadow .15s ease}
-.btn:hover{transform:translateY(-1px);box-shadow:0 14px 28px -8px rgba(249,115,22,.8)}
-.muted{color:var(--inkSoft);opacity:.9;font-size:.85rem;margin:1.1rem auto 0;max-width:24rem;line-height:1.45}
-.hidden{display:none!important}
-`;
-
-// Client script for the PROGRESS variant only (task 2096): poll the public status
-// endpoint, advance the stepper, and auto-open the instance the moment its credentials
-// land. Deliberately contains NO backticks and NO ${...} so it survives the outer
-// template literal verbatim; the only server data it reads is the JSON config block
-// written just above it. Fails soft — a poll hiccup just retries; a long wait reveals a
-// manual "open" button rather than ever falsely erroring. The auto-open countdown runs
-// ONLY when this page is the wizard's pop-up; a same-tab return (pop-up blocked) keeps
-// the founder here with the door and a way back to the checklist (task 1003236).
-const CALLBACK_SCRIPT = `
-(function(){
-  var cfg=window.__CB_SETUP__||{};
-  var state=cfg.state||'',domain=cfg.domain||'';
-  if(!state||!domain)return;
-  var target='https://'+domain;
-  var pollUrl=location.pathname.replace('/callback','/status')+'?state='+encodeURIComponent(state);
-  var steps=document.getElementById('steps'),statusEl=document.getElementById('status');
-  var cta=document.getElementById('cta'),go=document.getElementById('go'),foot=document.getElementById('foot'),back=document.getElementById('back');
-  /* Opened from the wizard as a pop-up (window.opener alive, or the tab still carries the name the wizard gave it):
-     the checklist is in the other tab, so this one may auto-open the instance. Same-tab fallback (pop-up blocked,
-     form target=_self): this IS the founder's checklist tab — never navigate it away; offer both doors (task 1003236). */
-  var popup=!!window.opener||window.name==='ghAppSetup';
-  var finished=false,tries=0,manual=false;
-  function dot(n){return steps.querySelector('[data-step="'+n+'"]');}
-  function setActive(n){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active','done');if(i<n){el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}else if(i===n){el.classList.add('active');}}}
-  function allDone(){for(var i=1;i<=3;i++){var el=dot(i);if(!el)continue;el.classList.remove('active');el.classList.add('done');el.querySelector('.dot').textContent='\\u2713';}}
-  function ready(){if(finished)return;finished=true;allDone();statusEl.textContent='Your instance is ready \\u2014 sign in with GitHub to claim it as owner.';cta.classList.remove('hidden');
-    if(!popup){go.textContent='Open '+domain+' \\u2192';if(back)back.classList.remove('hidden');if(foot)foot.textContent='Your setup checklist is waiting where you left it \\u2014 finish it first, or open your instance now.';return;}
-    var n=4;(function tick(){if(n<=0){location.href=target;return;}go.textContent='Opening '+domain+' in '+n+'\\u2026';n--;setTimeout(tick,1000);})();}
-  function failed(){if(finished)return;finished=true;statusEl.textContent='Setup didn\\u2019t finish. Open your instance page and start the GitHub sign-in setup again.';cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';}
-  function revealManual(){if(manual||finished)return;manual=true;cta.classList.remove('hidden');go.textContent='Open '+domain+' \\u2192';if(foot)foot.textContent='This is taking a little longer than usual \\u2014 you can open your instance now, or keep waiting.';}
-  function schedule(){if(!finished)setTimeout(poll,3000);}
-  function poll(){tries++;fetch(pollUrl,{headers:{accept:'application/json'},cache:'no-store'}).then(function(r){return r.ok?r.json():null;}).then(function(j){if(!j){schedule();return;}if(j.ready||j.status==='done'){ready();return;}if(j.status==='error'||j.status==='expired'){failed();return;}setActive(2);if(tries===40)revealManual();schedule();}).catch(function(){schedule();});}
-  setActive(2);poll();
-})();
-`;
-
-// The standalone landing page for the public GitHub redirect (the mothership serves it;
-// it is NOT the hall shell). Two variants share the Cloud Bongos brand shell (task 2096):
-//   • progress — ok + state + domain: an animated stepper that polls the status endpoint
-//     and auto-opens the instance when its credentials are placed.
-//   • message — everything else (errors + the no-domain success fallback): a calm badge
-//     + `body` (server-authored, trusted HTML).
-function callbackPage({ ok, title, body, state, domain }) {
-  const progress = !!(ok && state && domain);
-  const cfgJson = JSON.stringify({ state: state || '', domain: domain || '' }).replace(/</g, '\\u003c');
-  const head = `<!doctype html><html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<meta name="color-scheme" content="light dark">
-<title>${esc(title)}</title>
-<link rel="preconnect" href="https://fonts.googleapis.com"><link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
-<link href="https://fonts.googleapis.com/css2?family=Baloo+2:wght@600;700;800&family=Quicksand:wght@400;500;600;700&family=Fira+Code&display=swap" rel="stylesheet">
-<style>${PAGE_STYLE}</style></head><body>`;
-  if (progress) {
-    return `${head}
-<main class="card">
-  <h1>${esc(title)}</h1>
-  <p class="sub">Finishing sign-in setup for <code>${esc(domain)}</code>.</p>
-  <div class="steps" id="steps" aria-label="Setup progress">
-    <div class="step done" data-step="1"><div class="dot">✓</div><div class="lbl">GitHub app created</div></div>
-    <div class="step active" data-step="2"><div class="dot">2</div><div class="lbl">Placing credentials</div></div>
-    <div class="step" data-step="3"><div class="dot">3</div><div class="lbl">Ready to sign in</div></div>
-  </div>
-  <p class="status-line" id="status">Hang tight — keep this tab open while we finish.</p>
-  <div class="cta hidden" id="cta"><a class="btn" id="go" href="https://${esc(domain)}">Open ${esc(domain)} →</a></div>
-  <p class="muted hidden" id="back"><a href="/projects?view=new">Finish your remaining setup steps →</a></p>
-  <p class="muted" id="foot">This page opens <code>${esc(domain)}</code> for you the moment it’s ready.</p>
-  <noscript><p class="muted">When setup finishes, open <a href="https://${esc(domain)}">${esc(domain)}</a> and sign in with GitHub — that first sign-in makes you the owner.</p></noscript>
-</main>
-<script>window.__CB_SETUP__=${cfgJson};</script>
-<script>${CALLBACK_SCRIPT}</script>
-</body></html>`;
-  }
-  return `${head}
-<main class="card">
-  <div class="badge-warn">${ok ? '✓' : '⚠️'}</div>
-  <h1>${esc(title)}</h1>
-  <div class="sub">${body || ''}</div>
-</main>
-</body></html>`;
-}
-
 // Register this module's kernel seam (ADR 0083 / the registerBoxSeams precedent).
 // Idempotent — the loader calls this factory once at boot, but tests may
 // instantiate the router repeatedly; gating on hasProvider keeps the port

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.529",
+  "version": "1.19.530",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.529",
+      "version": "1.19.530",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.529",
+  "version": "1.19.530",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -45,7 +45,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.529'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.530'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/design_tokens_sync.mjs

@@ -132,7 +132,7 @@ test('the explore page mirrors the pack, var for var', () => {
 
 test('the provisioning onboarding pages resolve their accent pair from branding', () => {
   const source = fs.readFileSync(
-    path.join(REPO_ROOT, 'modules/provisioning/routes/provisioning.js'), 'utf8');
+    path.join(REPO_ROOT, 'modules/provisioning/routes/callback-page.js'), 'utf8');
   assert.match(source, /--sun:\$\{/, '--sun interpolates a resolved value, never a literal');
   assert.match(source, /--sun600:\$\{/, '--sun600 interpolates a resolved value, never a literal');
   const block = source.match(/const ACCENT =[\s\S]*?\}\)\(\);/);

package/tests/provisioning_callback_page.mjs

@@ -0,0 +1,74 @@
+// tests/provisioning_callback_page.mjs — the pin for the extracted callback-page
+// module (task 1003570).
+//
+// WHY. `esc` and `callbackPage` were carried inside modules/provisioning/routes/
+// provisioning.js and were only ever exercised THROUGH the route
+// (tests/provisioning_github_app_routes.mjs mounts the router and reads the served
+// HTML). Once they became a module of their own they needed a pin of their own, or
+// the extraction would be a surface nothing tests directly: this file requires
+// callback-page.js and asserts the escaping contract and that both page variants
+// carry the ESCAPED values, so a later edit that drops an esc() call — the XSS shape
+// this helper exists to prevent — fails here rather than in a served page.
+//
+// DB-free and network-free: callback-page.js reaches core only for branding().
+//
+// Run:  node --test --test-reporter=tap tests/provisioning_callback_page.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+
+// ESM named imports, deliberately — knip credits a named CJS export to a
+// destructured/named binding but not to a property read off a createRequire
+// namespace, and these two exports have no other reader outside the route file.
+import { esc, callbackPage } from '../modules/provisioning/routes/callback-page.js';
+
+test('esc replaces every HTML-significant character, and nothing else', () => {
+  assert.equal(esc('&<>"\''), '&amp;&lt;&gt;&quot;&#39;');
+  assert.equal(esc('<script>alert(1)</script>'), '&lt;script&gt;alert(1)&lt;/script&gt;');
+  // repeats are all replaced, not just the first
+  assert.equal(esc('<<>>'), '&lt;&lt;&gt;&gt;');
+  // ordinary text passes through untouched
+  assert.equal(esc('mercury.example.com'), 'mercury.example.com');
+});
+
+test('esc renders an absent value as the empty string, never "null"/"undefined"', () => {
+  assert.equal(esc(null), '');
+  assert.equal(esc(undefined), '');
+  assert.equal(esc(0), '0');
+  assert.equal(esc(false), 'false');
+});
+
+test('the progress variant escapes the title + domain it interpolates', () => {
+  const html = callbackPage({
+    ok: true,
+    title: 'Setting up <your> instance',
+    state: 'GOODSTATE',
+    domain: 'evil".example.com',
+  });
+  assert.match(html, /<title>Setting up &lt;your&gt; instance<\/title>/);
+  assert.match(html, /evil&quot;\.example\.com/, 'the domain rides through esc');
+  assert.doesNotMatch(html, /Setting up <your> instance/, 'no raw title anywhere on the page');
+  assert.doesNotMatch(html, /https:\/\/evil"\.example\.com/, 'no unescaped domain in an href');
+  // it IS the progress variant: the stepper + the config block the client script reads
+  assert.match(html, /id="steps"/);
+  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com"\}/);
+});
+
+test('the message variant escapes the title but passes server-authored body HTML through', () => {
+  const html = callbackPage({
+    ok: false,
+    title: 'This setup link has <expired>',
+    body: '<p>Ask the owner for a fresh link.</p>',
+  });
+  assert.match(html, /<h1>This setup link has &lt;expired&gt;<\/h1>/);
+  assert.match(html, /<div class="sub"><p>Ask the owner for a fresh link\.<\/p><\/div>/,
+    'body is trusted server-authored HTML — the route composes it, a request never does');
+  assert.doesNotMatch(html, /id="steps"/, 'no stepper without ok + state + domain');
+  assert.match(html, /badge-warn">⚠️</, 'a failure wears the warning badge');
+});
+
+test('ok without state or domain falls back to the message variant', () => {
+  const html = callbackPage({ ok: true, title: 'GitHub app created', body: '<p>Done.</p>' });
+  assert.doesNotMatch(html, /__CB_SETUP__/, 'nothing to poll for, so no client config block');
+  assert.match(html, /badge-warn">✓</, 'but it is still a success');
+});

package/tests/provisioning_module_selection.mjs

@@ -30,7 +30,7 @@ import http from 'node:http';
 // ESM named imports off the CJS module on purpose — knip cannot trace a
 // createRequire() import, so these would read as dead exports (the repo's knip
 // learning; tests/provisioning_starter_bundles.mjs does the same).
-import { ALWAYS_ON_CORE, bundleForProjectType } from '../modules/provisioning/starter-bundles.js';
+import { ALWAYS_ON_CORE, bundleForProjectType, effectiveModules } from '../modules/provisioning/starter-bundles.js';
 
 const require = createRequire(import.meta.url);
 const provisioning = require('../modules/provisioning/provisioning.js');
@@ -152,9 +152,13 @@ t('publicInstance: a row written before provisioning_014 reads as the bundle, no
 
 let lastCreateArgs = null;
 let existingRow = null;
+// The row PATCH …/detail reads, and the row its UPDATE returned. Both null by
+// default, so the POST /instances tests below see the same "no such id" world.
+let detailRow = null;
+let lastUpdatedRow = null;
 provisioning.getInstanceBySlug = async () => existingRow;
 provisioning.getInstanceByDomain = async () => null;
-provisioning.getInstanceById = async () => null;
+provisioning.getInstanceById = async () => detailRow;
 provisioning.createInstance = async (_db, args) => {
   lastCreateArgs = args;
   return existingRow
@@ -164,6 +168,18 @@ provisioning.createInstance = async (_db, args) => {
 provisioning.enqueueIntent = async (_db, id, action) => ({ intent: { id: 9, action, state: 'pending' }, created: true });
 provisioning.getOpenIntent = async () => null;
 provisioning.recordEvent = async () => {};
+// Mirrors the real statement: `detail = detail || $n::jsonb` MERGES the
+// normalized answers onto what is already stored. The row the route then hands
+// `effectiveModules` is that merged one, so a stub that returned the pre-patch
+// row would hide exactly the staleness this test exists to catch.
+provisioning.updateInstanceDetail = async (_db, _id, patch) => {
+  lastUpdatedRow = { ...detailRow };
+  if (patch.description !== undefined) lastUpdatedRow.description = patch.description;
+  if (patch.detail !== undefined) {
+    lastUpdatedRow.detail = { ...(detailRow.detail || {}), ...provisioning.normalizeProjectDetail(patch.detail) };
+  }
+  return lastUpdatedRow;
+};
 
 const api = require('../src/module-api.js');
 api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
@@ -185,11 +201,11 @@ const server = app.listen(0);
 await new Promise((r) => server.once('listening', r));
 const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
 
-function post(path, body) {
+function send(method, path, body) {
   return new Promise((resolve, reject) => {
     const payload = JSON.stringify(body);
     const req = http.request(`${base}${path}`, {
-      method: 'POST',
+      method,
       headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
     }, (res) => {
       let d = '';
@@ -200,6 +216,8 @@ function post(path, body) {
     req.end(payload);
   });
 }
+const post = (path, body) => send('POST', path, body);
+const patch = (path, body) => send('PATCH', path, body);
 
 await ta('POST /instances: the picker\'s ids ride the create request through to storage', async () => {
   // Arrange
@@ -281,6 +299,48 @@ await ta('POST /instances: a re-request never changes an existing project\'s mod
   existingRow = null;
 });
 
+// ── PATCH /instances/:id/detail, over the same mounted router ──────────────
+// The interview's answer MOVES a bundle-sourced project's modules (BV1.R22, ADR
+// 0243), so the reply that takes the answer says what the project now has rather
+// than making the caller re-read. openapi.json names `modules` in this response's
+// `required` list; nothing kept that promise until here — only the pure
+// `effectiveModules` was pinned (tests/provisioning_starter_bundles.mjs).
+
+await ta('PATCH /detail: the reply carries modules, resolved from the row the UPDATE returned', async () => {
+  // Arrange — a game project that skipped the picker, so its modules still
+  // resolve from the bundle and an interview answer can still move them.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'game', modules: null, detail: {} };
+  lastUpdatedRow = null;
+
+  // Act — the owner says they are building it alone
+  const res = await patch('/provisioning/instances/41/detail', { detail: { team_shape: 'solo' } });
+
+  // Assert — the field is there, and it is the POST-patch resolution: a route
+  // that answered off `inst` instead of `updated` would still say 'dev-box'.
+  assert.equal(res.status, 200, res.raw);
+  assert.ok(lastUpdatedRow, 'the route ran the update');
+  assert.deepEqual(res.body.modules, effectiveModules(lastUpdatedRow));
+  assert.deepEqual(res.body.modules.selected, ['discord'], 'solo drops the shared dev box out of the game bundle');
+  assert.equal(res.body.modules.source, 'bundle');
+  assert.ok(res.body.modules.adjustments.some((a) => a.module === 'dev-box'), 'and the change carries its reason');
+  detailRow = null; lastUpdatedRow = null;
+});
+
+await ta('PATCH /detail: a description-only patch answers with modules too — the field is not conditional', async () => {
+  // openapi lists `modules` as REQUIRED, so every 200 off this route carries it,
+  // including the ones that moved nothing a bundle reads.
+  detailRow = { id: 41, owner_builder_id: 7, slug: 'mercury', status: 'active', type: 'research', modules: ['agents', 'discord'], detail: {} };
+  lastUpdatedRow = null;
+
+  const res = await patch('/provisioning/instances/41/detail', { description: 'A study of small things.' });
+
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(res.body.modules, effectiveModules(lastUpdatedRow));
+  assert.deepEqual(res.body.modules.selected, ['agents', 'discord'], 'a chosen set is not re-derived from the type');
+  assert.equal(res.body.modules.source, 'chosen');
+  detailRow = null; lastUpdatedRow = null;
+});
+
 server.close();
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);