@bongos/core 1.19.565 → 1.19.567

package/modules/public-landing/public/projects.html

@@ -5586,7 +5586,10 @@ summary{min-height:24px;padding:3px 0;}
            return), never from renderManage, which the fetch-free tick calls */
         if (!keepRepo) loadRepoVisibility(inst);
         /* the settings row + the project's own manifest — the same cadence as
-           the GitHub read: entry + tab return, never the in-flight tick */
+           the GitHub read: entry + tab return, never the in-flight tick. The
+           three cards below share ONE read of the row (task 1003582), so
+           dropping the memo here is what keeps each entry a fresh read */
+        if (!keepRepo) forgetSettings();
         if (!keepRepo) loadVisibility(inst);
         if (!keepRepo) loadJoinability(inst);
         if (!keepRepo) loadDoor();
@@ -5936,30 +5939,67 @@ summary{min-height:24px;padding:3px 0;}
       .then(function () { if (timer) clearTimeout(timer); });
   }
 
+  /* ── the settings row, read ONCE per manage entry (task 1003582) ─────────
+     Three cards render off the SAME row — how the project is reached
+     (platform_visibility), how people join (joinability), and its door on the
+     map (visibility) — and each used to GET it for itself: three identical
+     round trips on every entry, growing by one with each card added.
+
+     Memoised like ensureModsCatalog()/ensureBundles(), with the one difference
+     that matters: those hold a catalog nothing rewrites, this holds a
+     per-project row every card's Save rewrites. So the memo is keyed on the
+     project AND dropped by forgetSettings() at the top of each entry pass —
+     nothing else may reuse it, or a card would paint a row the owner has since
+     changed. The saves stay separate: each card still PATCHes its own key.
+
+     It RESOLVES with the whole answer, status included, rather than throwing on
+     a refusal — each card keeps writing its own line for a lapsed session vs.
+     an outage. A transport failure still rejects, and every consumer catches it
+     privately, so one card's failure never silences its siblings. */
+  var settingsPromise = null;
+  var settingsFor = null;   /* which project the memo holds — a switch must not reuse it */
+
+  function ensureSettings() {
+    if (settingsPromise && settingsFor === manageId) return settingsPromise;
+    settingsFor = manageId;
+    settingsPromise = fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
+      .then(function (res) {
+        return jsonOrEmpty(res).then(function (data) {
+          return { ok: res.ok, status: res.status, data: data || {} };
+        });
+      });
+    return settingsPromise;
+  }
+
+  /* Drop the memo so the next ensureSettings() is a real read. This is also
+     what makes the alert's "Try again" work: a rejected promise left memoised
+     would keep answering with the failure forever. */
+  function forgetSettings() { settingsPromise = null; settingsFor = null; }
+
   function loadVisibility(inst) {
     mVisSettings = null; mVisRunsHtml = ''; mVisPushSeen = false;
     visMsg('<p class="finePrint">Reading the project’s settings…</p>');
     var asked = manageId; /* a stale answer must never describe a newer project */
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
-      .then(function (res) {
-        if (asked !== manageId) throw new Error('stale');
-        return jsonOrEmpty(res).then(function (data) {
-          if (res.ok) {
-            mVisSettings = {
-              value: (data.settings || {}).platform_visibility,
-              options: (data.options || {}).platform_visibility || Object.keys(VIS_OPTIONS)
-            };
-            renderVis();
-            /* while a push is open the line is the intent's — the manifest is
-               asked the moment it settles (renderVisState), not now */
-            if (!visPushOpen(inst)) loadVisRuns(inst);
-            return;
-          }
-          visMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
-        });
+    ensureSettings()
+      .then(function (ans) {
+        if (asked !== manageId) return;
+        if (ans.ok) {
+          mVisSettings = {
+            value: (ans.data.settings || {}).platform_visibility,
+            options: (ans.data.options || {}).platform_visibility || Object.keys(VIS_OPTIONS)
+          };
+          renderVis();
+          /* while a push is open the line is the intent's — the manifest is
+             asked the moment it settles (renderVisState), not now */
+          if (!visPushOpen(inst)) loadVisRuns(inst);
+          return;
+        }
+        visMsg('<p class="finePrint">' + (ans.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
       })
-      .catch(function (err) {
-        if (String(err && err.message) === 'stale') return;
+      .catch(function () {
+        /* the read is shared now, so its rejection reaches all three cards —
+           each one still only speaks for the project it was asked about */
+        if (asked !== manageId) return;
         visMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
       });
   }
@@ -6313,24 +6353,22 @@ summary{min-height:24px;padding:3px 0;}
     mJoinSettings = null; mJoinRunsHtml = ''; mJoinPushSeen = false;
     joinMsg('<p class="finePrint">Reading the project’s settings…</p>');
     var asked = manageId; /* a stale answer must never describe a newer project */
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
-      .then(function (res) {
-        if (asked !== manageId) throw new Error('stale');
-        return jsonOrEmpty(res).then(function (data) {
-          if (res.ok) {
-            mJoinSettings = {
-              value: (data.settings || {}).joinability,
-              options: (data.options || {}).joinability || Object.keys(JOIN_OPTIONS)
-            };
-            renderJoin();
-            if (!visPushOpen(inst)) loadJoinRuns(inst);
-            return;
-          }
-          joinMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
-        });
+    ensureSettings()
+      .then(function (ans) {
+        if (asked !== manageId) return;
+        if (ans.ok) {
+          mJoinSettings = {
+            value: (ans.data.settings || {}).joinability,
+            options: (ans.data.options || {}).joinability || Object.keys(JOIN_OPTIONS)
+          };
+          renderJoin();
+          if (!visPushOpen(inst)) loadJoinRuns(inst);
+          return;
+        }
+        joinMsg('<p class="finePrint">' + (ans.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
       })
-      .catch(function (err) {
-        if (String(err && err.message) === 'stale') return;
+      .catch(function () {
+        if (asked !== manageId) return;
         joinMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
       });
   }
@@ -6539,23 +6577,21 @@ summary{min-height:24px;padding:3px 0;}
     mDoorSettings = null;
     doorMsg('<p class="finePrint">Reading the project’s settings…</p>');
     var asked = manageId; /* a stale answer must never describe a newer project */
-    fetch(API + '/provisioning/instances/' + encodeURIComponent(manageId) + '/settings', { credentials: 'same-origin' })
-      .then(function (res) {
-        if (asked !== manageId) throw new Error('stale');
-        return jsonOrEmpty(res).then(function (data) {
-          if (res.ok) {
-            mDoorSettings = {
-              value: (data.settings || {}).visibility,
-              options: (data.options || {}).visibility || Object.keys(DOOR_OPTIONS)
-            };
-            renderDoor();
-            return;
-          }
-          doorMsg('<p class="finePrint">' + (res.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
-        });
+    ensureSettings()
+      .then(function (ans) {
+        if (asked !== manageId) return;
+        if (ans.ok) {
+          mDoorSettings = {
+            value: (ans.data.settings || {}).visibility,
+            options: (ans.data.options || {}).visibility || Object.keys(DOOR_OPTIONS)
+          };
+          renderDoor();
+          return;
+        }
+        doorMsg('<p class="finePrint">' + (ans.status === 401 ? signInAgain() : 'Couldn’t read this project’s settings right now — refresh in a moment.') + '</p>');
       })
-      .catch(function (err) {
-        if (String(err && err.message) === 'stale') return;
+      .catch(function () {
+        if (asked !== manageId) return;
         doorMsg('<p class="finePrint">Couldn’t read this project’s settings right now — refresh in a moment.</p>');
       });
   }

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.565",
+  "version": "1.19.567",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.565",
+      "version": "1.19.567",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.565",
+  "version": "1.19.567",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -49,7 +49,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.565'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.567'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/manage_settings_shared_read.mjs

@@ -0,0 +1,146 @@
+// tests/manage_settings_shared_read.mjs — one read of the project's settings
+// row per manage entry, EXECUTED (task 1003582).
+//
+// The defect this pins shut: entering /projects?view=manage fired
+// GET /provisioning/instances/:id/settings three times in a row, because the
+// three cards that render off that row — how the project is reached, how people
+// join, and its door on the map — each fetched it for themselves. Three round
+// trips and three DB reads for one row, growing by one with every settings-
+// backed card added to the page.
+//
+// tests/projects_hub.mjs pins that all three cards go through the shared
+// reader; this file lifts the reader itself out of modules/public-landing/
+// public/projects.html, runs it in a vm under a scripted fetch, and counts the
+// round trips. The vm-harness precedent is tests/project_door_ui.mjs.
+//
+// What it proves, and why each matters:
+//   • three callers in one entry cost ONE round trip — the defect itself
+//   • forgetSettings() makes the next read real, so entry and tab return each
+//     see the row as it is now, never the one from the last visit
+//   • that is also what lets the alert's "Try again" retry after a failure: a
+//     rejected promise left memoised would answer with the failure forever
+//   • switching projects is never served the previous project's row, even with
+//     the memo still warm — the cache is keyed on the project, not just present
+//   • a refusal RESOLVES carrying its status, so each card can still tell a
+//     lapsed session apart from an outage in its own words
+//
+// Run:  node --test --test-reporter=tap tests/manage_settings_shared_read.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// The reader, sliced from the page verbatim. Both boundaries are asserted so a
+// rename cannot leave this file executing an empty string and passing.
+const START = SCRIPT.indexOf('  var settingsPromise = null;');
+const END = SCRIPT.indexOf('  function loadVisibility(');
+assert.ok(START > 0, 'the shared reader must start at its memo declaration');
+assert.ok(END > START, 'the shared reader must sit above its first consumer');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['function ensureSettings(', 'function forgetSettings(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// ── the harness ──────────────────────────────────────────────────────────────
+// Narrow on purpose: the region touches fetch, jsonOrEmpty, API and manageId,
+// and nothing else — so the stub stays honest about what it can prove.
+
+function boot({ ok = true, status = 200, body = { settings: { visibility: 'public' } }, reject = false } = {}) {
+  const requests = [];
+  const sandbox = {
+    Promise, JSON, String, Object, Error, encodeURIComponent,
+    API: '/api/bongos',
+    manageId: '18',
+    jsonOrEmpty: (res) => Promise.resolve(res._json),
+    fetch: (url, init = {}) => {
+      requests.push({ url, credentials: init.credentials });
+      return reject ? Promise.reject(new Error('network')) : Promise.resolve({ ok, status, _json: body });
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(REGION, sandbox, { filename: 'projects.html#shared-settings-read' });
+
+  const settle = async () => { for (let i = 0; i < 30; i++) await Promise.resolve(); };
+  return { requests, sandbox, settle };
+}
+
+// ── the tests ────────────────────────────────────────────────────────────────
+
+test('the three cards of one manage entry cost ONE round trip, not three', async () => {
+  // Arrange — the page's own entry pass: three readers, back to back
+  const ui = boot();
+
+  // Act
+  const answers = await Promise.all([
+    ui.sandbox.ensureSettings(),
+    ui.sandbox.ensureSettings(),
+    ui.sandbox.ensureSettings(),
+  ]);
+
+  // Assert
+  assert.equal(ui.requests.length, 1, 'one GET served all three cards');
+  assert.equal(ui.requests[0].url, '/api/bongos/provisioning/instances/18/settings');
+  assert.equal(ui.requests[0].credentials, 'same-origin', 'the cookie session is the auth — this page carries no token');
+  for (const a of answers) assert.deepEqual(a.data.settings, { visibility: 'public' }, 'every caller got the same row');
+});
+
+test('forgetSettings makes the next read real — entry and tab return never reuse the last visit’s row', async () => {
+  // Arrange
+  const ui = boot();
+  await ui.sandbox.ensureSettings();
+
+  // Act — what loadManage does at the top of every entry + tab return pass
+  ui.sandbox.forgetSettings();
+  await ui.sandbox.ensureSettings();
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the second entry asked the server again');
+});
+
+test('a failed read can be retried — the rejection is not memoised past forgetSettings', async () => {
+  // Arrange — the outage the manage alert's "Try again" exists for
+  const ui = boot({ reject: true });
+  await assert.rejects(ui.sandbox.ensureSettings(), /network/);
+
+  // Act — the retry runs loadManage again, which forgets first
+  ui.sandbox.forgetSettings();
+  await assert.rejects(ui.sandbox.ensureSettings(), /network/);
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the retry was a real second attempt, not the stored failure');
+});
+
+test('switching projects is never served the previous project’s row', async () => {
+  // Arrange — the memo is warm for project 18
+  const ui = boot();
+  await ui.sandbox.ensureSettings();
+
+  // Act — the owner opens a different project; loadManage has not forgotten yet
+  ui.sandbox.manageId = '19';
+  await ui.sandbox.ensureSettings();
+
+  // Assert
+  assert.equal(ui.requests.length, 2, 'the memo is keyed on the project, not merely present');
+  assert.equal(ui.requests[1].url, '/api/bongos/provisioning/instances/19/settings');
+});
+
+test('a refusal RESOLVES carrying its status, so each card can still say what happened', async () => {
+  // Arrange — a lapsed session: the card must offer sign-in, not report an outage
+  const ui = boot({ ok: false, status: 401, body: {} });
+
+  // Act
+  const ans = await ui.sandbox.ensureSettings();
+
+  // Assert
+  assert.equal(ans.ok, false);
+  assert.equal(ans.status, 401, 'the status reaches the card — 401 reads differently from 500');
+  assert.deepEqual(ans.data, {}, 'an empty body is an object, so a card can read through it without guarding');
+});

package/tests/origin_containment.mjs

@@ -0,0 +1,114 @@
+// tests/origin_containment.mjs — the downward-only containment rule (task 1003670,
+// ADR 0254): may a URL a REMOTE instance reported be published under that instance's
+// name?
+//
+// Two surfaces relay a third party's URL into an anchor on the hub — a builder's ship
+// links and a project's `hall_origin` — and until this task they answered the question
+// differently: the ship link demanded containment, the hall address demanded only that
+// the host DIFFER from the project's site. This file is the rule's own proof, so the
+// two callers cannot drift again.
+//
+// EVERY CASE HERE IS AN ATTACK OR THE SHAPE THAT MAKES ONE POSSIBLE. What is asserted
+// is what is REFUSED; the accept list is deliberately short, because a containment rule
+// that is generous is not one.
+//
+// Run:  node --test tests/origin_containment.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+// A REAL ESM import, not createRequire: knip does not trace createRequire(), and this
+// is the export's only test (learning: knip-createrequire-test-imports).
+import { urlWithinOrigin } from '../modules/platform-identity/origin-containment.js';
+
+const ORIGIN = 'https://project.example';
+
+test('a link at the reporting origin itself is kept, verbatim', () => {
+  assert.equal(urlWithinOrigin(`${ORIGIN}/builders#/task/1`, ORIGIN), `${ORIGIN}/builders#/task/1`);
+  assert.equal(urlWithinOrigin(ORIGIN, ORIGIN), ORIGIN);
+});
+
+test('a link BELOW the reporting origin is kept — the hall on a subdomain is the whole point', () => {
+  const hall = 'https://builders.project.example/';
+  assert.equal(urlWithinOrigin(hall, ORIGIN), hall);
+  assert.equal(urlWithinOrigin('https://a.b.c.project.example/x', ORIGIN), 'https://a.b.c.project.example/x',
+    'depth is not bounded — every label below the origin is still the origin\'s own');
+});
+
+test('the host comparison ignores case, and a port is not a trust boundary', () => {
+  assert.equal(urlWithinOrigin('https://BUILDERS.Project.Example/x', ORIGIN), 'https://BUILDERS.Project.Example/x');
+  assert.equal(urlWithinOrigin('https://project.example:8443/x', ORIGIN), 'https://project.example:8443/x');
+  assert.equal(urlWithinOrigin('http://project.example/x', ORIGIN), 'http://project.example/x',
+    'http is allowed — the scheme gate is about javascript:, not about TLS');
+});
+
+/* ── the refusals: each row is a way a hostile instance tries to publish a link that
+   is not its own, under a name that is ─────────────────────────────────────────── */
+
+for (const [attack, raw, origin] of [
+  // The plain one this task exists for: a remote instance advertising a hall it does
+  // not own, which the hub then renders as an <a href> under the victim's project.
+  ['an unrelated host', 'https://evil.example/phish', ORIGIN],
+  ['an unrelated host with a convincing path', 'https://evil.example/project.example/builders', ORIGIN],
+
+  // A shared multi-tenant apex, the shape origin-containment.js's header names: the
+  // neighbour is NOT the neighbour's to link, and neither is the apex above both.
+  ['a SIBLING under a shared apex', 'https://bar.pages.example/x', 'https://foo.pages.example'],
+  ['an ANCESTOR of its own host (the github.io shape)', 'https://pages.example/x', 'https://foo.pages.example'],
+  ['the bare apex of a deep origin', 'https://example/x', 'https://a.b.example'],
+
+  // Suffix matching without the dot anchor is a lookalike-domain generator: every
+  // registrable name that ENDS in the victim's name would contain it.
+  ['a lookalike domain that merely ends in the origin', 'https://notproject.example/x', ORIGIN],
+  ['a lookalike with the origin as a bare substring', 'https://project.example.evil.test/x', ORIGIN],
+
+  // The host check alone passes this: the host IS evil.example. What a human reads is
+  // the victim's domain, which is the entire trick.
+  ['credentials that read as the victim\'s domain', 'https://project.example@evil.example/x', ORIGIN],
+  ['user:password credentials on the origin itself', 'https://user:pw@project.example/x', ORIGIN],
+
+  // A relayed href is a script sink if the scheme is not constrained here.
+  ['a javascript: scheme', 'javascript:alert(1)', ORIGIN],
+  ['a data: URL', 'data:text/html,<script>alert(1)</script>', ORIGIN],
+  ['a file: URL', 'file:///etc/passwd', ORIGIN],
+  ['a protocol-relative URL', '//evil.example/x', ORIGIN],
+
+  // Not a URL, or not a string at all — a third-party JSON field is any shape.
+  ['a bare path', '/builders', ORIGIN],
+  ['an empty string', '', ORIGIN],
+  ['a number', 12345, ORIGIN],
+  ['an object', { href: `${ORIGIN}/x` }, ORIGIN],
+  ['null', null, ORIGIN],
+  ['undefined', undefined, ORIGIN],
+
+  // The ORIGIN side is stored data, not validated data. A hostless one leaves the
+  // suffix as a bare ".", which a legal trailing-dot FQDN would match.
+  ['a trailing-dot FQDN against a hostless origin', 'https://evil.example./x', 'data:text/plain,x'],
+  ['any link against a hostless origin', 'https://evil.example/x', 'file:///tmp/x'],
+  ['any link against an unparseable origin', 'https://evil.example/x', 'not-a-url'],
+  ['any link against an empty origin', 'https://evil.example/x', ''],
+  ['any link against a null origin', 'https://evil.example/x', null],
+]) {
+  test(`REFUSED: ${attack}`, () => {
+    assert.equal(urlWithinOrigin(raw, origin), null);
+  });
+}
+
+test('REFUSED: a URL over the cap — refused whole, never truncated', () => {
+  // Truncation is the tempting alternative and it is worse: a sliced URL still parses
+  // and points somewhere else, so the hub would publish a link nobody wrote.
+  const long = `${ORIGIN}/${'x'.repeat(600)}`;
+  assert.equal(urlWithinOrigin(long, ORIGIN), null, 'contained, but too long — still refused');
+  assert.equal(urlWithinOrigin(long, ORIGIN, 1000), long, 'the cap is the only thing refusing it');
+  assert.equal(urlWithinOrigin(`${ORIGIN}/x`, ORIGIN, 5), null, 'a caller may bound it tighter');
+});
+
+test('a refusal is always null — never a throw, and never a repaired URL', () => {
+  for (const raw of ['https://evil.example/x', 'javascript:alert(1)', 'http://', 7, [], true]) {
+    const out = urlWithinOrigin(raw, ORIGIN);
+    assert.equal(out, null, `${String(raw)} → null`);
+  }
+  // The kept value is the INPUT, byte for byte: normalising it here would mean the hub
+  // publishes a URL the instance never reported.
+  const odd = `${ORIGIN}/a//b?q=1#f`;
+  assert.equal(urlWithinOrigin(odd, ORIGIN), odd);
+});

package/tests/project_door_ui.mjs

@@ -13,6 +13,10 @@
 // the page, so the region is sliced out rather than read from a .js file, and the
 // slice boundaries are asserted so a rename can never quietly test nothing.
 //
+// Since task 1003582 the settings row is read once per manage entry by a shared
+// ensureSettings(), declared ABOVE this region — so the sandbox injects it (see
+// tests/manage_settings_shared_read.mjs for that reader's own behaviour).
+//
 // What it proves, and why each matters:
 //   • the three choices render with the goal's PLAIN interview labels
 //   • the project's CURRENT door is the preselected one — an owner opening the
@@ -105,13 +109,23 @@ function boot({ settings, options = ['public', 'private', 'stealth'], patchAnswe
   const fetch = (url, init = {}) => {
     requests.push({ url, method: init.method || 'GET', body: init.body, credentials: init.credentials, headers: init.headers });
     if ((init.method || 'GET') === 'GET') {
-      return answer({ ok: true, settings, options: { visibility: options } });
+      // the row is read through ensureSettings() below — a GET arriving here
+      // means this section grew a second reader, which is the whole defect
+      throw new Error('this section reads the settings row through ensureSettings(), never its own GET');
     }
     return patchAnswer || answer({ ok: true, saved: { ...settings, visibility: JSON.parse(init.body).visibility }, push: { queued: true, message: 'Saved. Your project will restart to pick this up — until then it keeps its current setting.' } });
   };
+  // The shared read the three settings cards live off (task 1003582). Answers
+  // in ensureSettings()'s own shape — resolved, status carried, never thrown —
+  // and still records the round trip, so a card that stopped reading the row
+  // would show up here as a missing request rather than as silence.
+  const ensureSettings = () => {
+    requests.push({ url: '/api/bongos/provisioning/instances/18/settings', method: 'GET', credentials: 'same-origin' });
+    return Promise.resolve({ ok: true, status: 200, data: { settings, options: { visibility: options } } });
+  };
 
   const sandbox = {
-    $, document, fetch, console, Promise, JSON, String, Object, Array, Error, RegExp,
+    $, document, fetch, ensureSettings, console, Promise, JSON, String, Object, Array, Error, RegExp,
     encodeURIComponent, setTimeout, clearTimeout,
     API: '/api/bongos',
     manageId: '18',

package/tests/project_stats.mjs

@@ -21,7 +21,17 @@ const require = createRequire(import.meta.url);
 const stats = require('../modules/platform-identity/project-stats.js');
 
 const realFetch = globalThis.fetch;
-afterEach(() => { globalThis.fetch = realFetch; });
+// The SSRF guard's resolver. Most fixtures below dodge it with literal IPs, but the
+// hall-containment group needs real HOSTNAMES — containment is a question about
+// domain labels, and an IP origin cannot express "a subdomain of my own site". The
+// module captured `require('node:dns').promises` (the object) at load, so replacing
+// `.lookup` on it is what the guard actually calls.
+const dnsPromises = require('node:dns').promises;
+const realLookup = dnsPromises.lookup;
+function stubDns() {
+  dnsPromises.lookup = () => Promise.resolve([{ address: '93.184.216.34', family: 4 }]);
+}
+afterEach(() => { globalThis.fetch = realFetch; dnsPromises.lookup = realLookup; });
 beforeEach(() => { stats._reset(); });
 
 function json(body) {
@@ -359,28 +369,86 @@ test('the shipped feed is asked for the window explicitly', async () => {
   assert.ok(urls.includes('https://8.8.8.8/api/bongos'), 'the discovery index answers the hall address');
 });
 
-test('hall_origin is the discovery index\'s hall only where it is a different host from the site', async () => {
-  stub({
-    'https://1.1.1.1': { leaderboard: [], enabled: {}, index: { hall: 'https://builders.example.com' } },
-    'https://8.8.8.8': { leaderboard: [], enabled: {}, index: { hall: 'https://8.8.8.8' } },      // single host
-    'https://9.9.9.9': { leaderboard: [], enabled: {}, index: { hall: 'javascript:alert(1)' } },
-    'https://4.4.4.4': { leaderboard: [], enabled: {} },                                           // no index (older core)
-  });
-  const out = await stats.getProjectStats(['https://1.1.1.1', 'https://8.8.8.8', 'https://9.9.9.9', 'https://4.4.4.4']);
-  assert.equal(out['https://1.1.1.1'].hall_origin, 'https://builders.example.com');
-  assert.equal(out['https://8.8.8.8'].hall_origin, null, 'a hall at <site>/builders is the site\'s own door');
-  assert.equal(out['https://9.9.9.9'].hall_origin, null);
+/* ── hall_origin: CONTAINMENT first, the door test second ───────────────────────
+   This is the one value in this file that becomes an <a href> on the hub rather
+   than an <img src>, and it arrives from a REMOTE instance's own discovery index.
+   It used to be checked only for DIFFERING from the project's site host — which is
+   containment inverted: it admitted every host on the internet except the one that
+   was certainly safe. Task 1003670 / ADR 0254 put it on the same downward-only rule
+   a pushed ship link obeys (origin-containment.js, whose own attack matrix is
+   tests/origin_containment.mjs). What is asserted here is the WIRING: that a sweep
+   through getProjectStats really refuses these.
+
+   Hostname fixtures, not the file's usual literal IPs — see stubDns() above. ── */
+
+// each row: [why, origin, the hall the remote advertises, what the hub may publish]
+const HALL_CASES = [
+  ['a hall on a subdomain of the project\'s own origin is the legitimate shape',
+    'https://good.example', 'https://builders.good.example', 'https://builders.good.example'],
+  ['another PORT on the same host is a real second door — a port is not a trust boundary',
+    'https://port.example', 'https://port.example:8443', 'https://port.example:8443'],
+  ['a hall AT the site host is the site\'s own door, not a second one',
+    'https://solo.example', 'https://solo.example', null],
+  // THE ATTACK. Under ADR 0252's auto-appear anyone who points a domain at the hub
+  // can report this, and the old rule published it BECAUSE it differed.
+  ['an unrelated host is a phishing hop, and differing is exactly what used to admit it',
+    'https://victim.example', 'https://evil.example/builders', null],
+  ['a SIBLING under a shared apex belongs to the neighbour',
+    'https://foo.pages.example', 'https://bar.pages.example', null],
+  ['an ANCESTOR of the project\'s own host is the github.io shape — never upward',
+    'https://foo.pages.example', 'https://pages.example', null],
+  ['a lookalike domain that merely ENDS in the origin (the dot anchor)',
+    'https://look.example', 'https://notlook.example', null],
+  ['embedded credentials that read as the project\'s own domain',
+    'https://creds.example', 'https://creds.example@evil.example/builders', null],
+  ['a non-http scheme never becomes an href',
+    'https://scheme.example', 'javascript:alert(1)', null],
+  ['a hall over the URL cap is refused whole, never truncated into a different address',
+    'https://long.example', `https://a.long.example/${'x'.repeat(400)}`, null],
+  ['a hall the project does not name',
+    'https://quiet.example', undefined, null],
+];
+
+test('hall_origin publishes a hall only at or BELOW the project\'s own origin, and only where it is a different door', async () => {
+  stubDns();
+  const fixtures = {};
+  for (const [, origin, hall] of HALL_CASES) {
+    fixtures[origin] = { leaderboard: [], enabled: {}, index: hall === undefined ? {} : { hall } };
+  }
+  stub(fixtures);
+  const out = await stats.getProjectStats(HALL_CASES.map(([, origin]) => origin));
+  for (const [why, origin, , expected] of HALL_CASES) {
+    assert.equal(out[origin].hall_origin, expected, why);
+  }
+});
+
+test('a project with no discovery index at all (an older core) reports no hall', async () => {
+  stub({ 'https://4.4.4.4': { leaderboard: [], enabled: {} } });
+  const out = await stats.getProjectStats(['https://4.4.4.4']);
   assert.equal(out['https://4.4.4.4'].hall_origin, null);
 });
 
+test('containment is read from the ONE shared rule, not re-implemented here', async () => {
+  // The defect this replaced was a second, weaker answer to a question the corpus had
+  // already answered one field over. A local re-implementation would drift again.
+  const src = await import('node:fs').then((fs) =>
+    fs.readFileSync(new URL('../modules/platform-identity/project-stats.js', import.meta.url), 'utf8'));
+  assert.match(src, /require\('\.\/origin-containment'\)/, 'the rule is required, not copied');
+  const fn = (src.match(/function hallOrigin\([\s\S]*?\n\}/) || [''])[0];
+  assert.match(fn, /urlWithinOrigin\(index\?\.hall, origin, URL_MAX\)/, 'the hall is contained before anything else looks at it');
+  assert.doesNotMatch(fn, /httpUrl\(/, 'httpUrl only scheme-checks and TRUNCATES — it is not a containment rule');
+});
+
 test('a dead shipped feed leaves the other quarters standing', async () => {
-  stub({ 'https://8.8.8.8': { leaderboard: [{ github_login: 'a' }], enabled: { game: true }, index: { hall: 'https://h.example.com' } } });
+  // the hall is on this project's OWN host (another port) — anything else is refused
+  // by containment now, which would make this test prove the wrong thing
+  stub({ 'https://8.8.8.8': { leaderboard: [{ github_login: 'a' }], enabled: { game: true }, index: { hall: 'https://8.8.8.8:8443' } } });
   const out = await stats.getProjectStats(['https://8.8.8.8']);
   assert.equal(out['https://8.8.8.8'].shipped_30d, null, 'the dead quarter is unknown');
   assert.equal(out['https://8.8.8.8'].shipped_30d_capped, null);
   assert.equal(out['https://8.8.8.8'].builders, 1);
   assert.deepEqual(out['https://8.8.8.8'].tags, ['game']);
-  assert.equal(out['https://8.8.8.8'].hall_origin, 'https://h.example.com');
+  assert.equal(out['https://8.8.8.8'].hall_origin, 'https://8.8.8.8:8443');
 });
 
 test('the origin\'s host is resolved once per sweep, not once per feed', async () => {