@bongos/core 1.21.15 → 1.21.16

package/modules/public-landing/public/account.html

@@ -104,7 +104,7 @@
     <!-- the identity chip IS the profile trigger; paintBar fills it from GET /me.
          Signed out it stays hidden and the sign-in door takes its slot. -->
     <button class="trig who" type="button" id="who" data-menu="profile" aria-expanded="false" aria-controls="menuProfile" hidden><img id="whoImg" alt="" hidden><span class="whoName" id="whoLogin"></span><svg class="cv" viewBox="0 0 20 20" aria-hidden="true"><path d="m5.6 8 4.4 4.4L14.4 8"/></svg></button>
-    <a class="signinDoor" id="signinTop" hidden href="/api/bongos/auth/web/start?return=/account">Sign in</a>
+    <a class="signinDoor" id="signinTop" hidden href="/api/bongos/auth/web/start?return=/account&amp;repos=1">Sign in</a>
   </div>
 </header>
 
@@ -138,7 +138,7 @@
   <section class="aDoor" id="door" hidden aria-labelledby="door-h">
     <h2 class="vh" id="door-h">Sign in</h2>
     <p>Sign in with GitHub to change your handle, your bio and links, and who can find you.</p>
-    <a class="btn" id="signin" href="/api/bongos/auth/web/start?return=/account">
+    <a class="btn" id="signin" href="/api/bongos/auth/web/start?return=/account&amp;repos=1">
       <!-- keep the spaces inside this path's numbers: same shape, and they are load-bearing (task 1004401) -->
       <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23 .82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2 .82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12 .51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29 .25.54.73 .54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15 .46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
       Sign in with GitHub

package/modules/public-landing/public/account.probes.json

@@ -5,7 +5,7 @@
   "probes": [
     { "name": "signed out: the door, and sign-in returns to /account", "auth": false, "width": 1440,
       "steps": [["wait", 300]],
-      "expect": { "visible": ["#door"], "hidden": ["#acctBody"], "href": [["#signin", "/api/bongos/auth/web/start?return=/account"]] } },
+      "expect": { "visible": ["#door"], "hidden": ["#acctBody"], "href": [["#signin", "/api/bongos/auth/web/start?return=/account&repos=1"]] } },
     { "name": "signed in: nothing changed saves nothing", "auth": true, "width": 1440,
       "steps": [["wait", 400], ["click", "#profileSave"], ["wait", 150]],
       "expect": { "text": [["#profileMsg", "Nothing has changed."]] } },
@@ -56,7 +56,7 @@
       "expect": { "closed": "#menuProjects" } },
     { "name": "signed out: no chip, the sign-in door in its slot, returning to /account", "auth": false, "width": 1440,
       "steps": [["wait", 300]],
-      "expect": { "hidden": ["#who"], "visible": ["#signinTop", "#projTrig"], "href": [["#signinTop", "/api/bongos/auth/web/start?return=/account"]] } },
+      "expect": { "hidden": ["#who"], "visible": ["#signinTop", "#projTrig"], "href": [["#signinTop", "/api/bongos/auth/web/start?return=/account&repos=1"]] } },
     { "name": "signed out the Projects band is Sky / Table / New project (no Your projects)", "continue": true,
       "steps": [["click", "#projTrig"], ["wait", 120]],
       "expect": { "open": "#menuProjects", "count": [["#menuProjects .bandCell:not([hidden])", 3]], "hidden": ["#mineCell"] } },

package/modules/public-landing/public/index.html

@@ -673,7 +673,7 @@ composition A; landing composition v3, picked by the owner 2026-08-27. No roll,
     <!-- the identity slot: the sign-in door signed out; the chip (the profile trigger) once
          the session resolves — swapped client-side, never a wrong-state flash -->
     <span class="whoSlot" id="who">
-      <a class="pill signin" href="/api/bongos/auth/web/start?return=/">Sign in</a>
+      <a class="pill signin" href="/api/bongos/auth/web/start?return=/&amp;repos=1">Sign in</a>
     </span>
   </div>
 </header>

package/modules/public-landing/public/projects.html

@@ -705,7 +705,7 @@ summary{min-height:24px;padding:3px 0;}
     <!-- the identity chip IS the profile trigger; renderWho fills it. Signed
          out it does not exist and the sign-in door takes its slot. -->
     <button class="trig who" type="button" id="who" data-menu="profile" aria-expanded="false" aria-controls="menuProfile" hidden></button>
-    <a class="signinDoor" id="signinTop" hidden href="/api/bongos/auth/web/start?return=/projects">Sign in</a>
+    <a class="signinDoor" id="signinTop" hidden href="/api/bongos/auth/web/start?return=/projects&amp;repos=1">Sign in</a>
   </div>
 </header>
 
@@ -897,7 +897,7 @@ summary{min-height:24px;padding:3px 0;}
            /create, listing your own instances needs no repo scope) -->
       <section id="gate" hidden>
         <p class="lede">Every project you own, in one place — its live status, its address, and the controls that matter. Sign in with GitHub to see yours.</p>
-        <a class="btn" id="signin" href="/api/bongos/auth/web/start?return=/projects%3Fview%3Dmine">
+        <a class="btn" id="signin" href="/api/bongos/auth/web/start?return=/projects%3Fview%3Dmine&amp;repos=1">
           <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
           Sign in with GitHub
         </a>
@@ -999,7 +999,7 @@ summary{min-height:24px;padding:3px 0;}
     <!-- signed out: the same identity-only door the mine view uses (ADR 0143) -->
     <section id="mGate" class="card" hidden>
       <p class="lede">This is a project’s management page — it answers only to the person who owns it. Sign in with GitHub to open yours.</p>
-      <a class="btn" id="mSignin" href="/api/bongos/auth/web/start?return=/projects%3Fview%3Dmine">
+      <a class="btn" id="mSignin" href="/api/bongos/auth/web/start?return=/projects%3Fview%3Dmine&amp;repos=1">
         <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
         Sign in with GitHub
       </a>
@@ -1395,7 +1395,8 @@ summary{min-height:24px;padding:3px 0;}
             <!-- The wizard's own sign-in opts into repo scope (read:user + repo, ADR 0155) up
                  front (&repos=1) — anyone here intends to create a project, which needs repo
                  access, so we ask once at sign-in instead of a second "Connect" step later.
-                 Hall + CLI sign-in stay identity-only (ADR 0143 least-privilege default). -->
+                 Every hub sign-in door does the same since ADR 0364; the hall + CLI
+                 sign-ins stay identity-only (ADR 0143 least-privilege default). -->
             <a class="btn big" id="wizSignin" href="/api/bongos/auth/web/start?return=/projects%3Fview%3Dnew&amp;repos=1">
               <svg class="gh" viewBox="0 0 16 16" aria-hidden="true"><path d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27s1.36.09 2 .27c1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.01 8.01 0 0 0 16 8c0-4.42-3.58-8-8-8z"/></svg>
               Continue with GitHub
@@ -2494,11 +2495,12 @@ summary{min-height:24px;padding:3px 0;}
       else history.replaceState(null, '', '?view=' + v + idPart);
     } catch (e) {}
     if (v !== 'manage') document.title = BASE_TITLE;
-    /* the shell's sign-in door returns the visitor to the view they left, and
-       carries the repo scope when that view is the wizard (ADR 0143: the
-       create path asks once up front instead of a second consent at Home) */
+    /* the shell's sign-in door returns the visitor to the view they left. Every
+       sign-in door on the hub's own pages carries the repo scope (task 1004549,
+       ADR 0364): it is asked once, at sign-in, and held for the whole session, so
+       no flow ever stops halfway to ask for it */
     $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v +
-      idPart.replace('&', '%26').replace('=', '%3D') + (v === 'new' ? '&repos=1' : '');
+      idPart.replace('&', '%26').replace('=', '%3D') + '&repos=1';
     /* the mine view is the only one that polls; it re-reads on entry so a
        card that changed while you were on the map is not stale — including
        the membership + invitations lists (task 1003774), the same re-read
@@ -7190,8 +7192,15 @@ summary{min-height:24px;padding:3px 0;}
     function enter(focus) {
       if (authKnown && !me) { show(0, !!focus); return; }
       var created = authKnown ? createdRecord() : null;
-      if (created && created.id) { enterCreated(created, !!focus); return; }
-      paintResumeOffer(null);
+      /* A draft part-way through the wizard (steps 1–5) beside a stored create is a
+         SECOND project being typed. A reload or a GitHub round-trip (repo access) is
+         that same visit continuing, so the draft keeps its place and the earlier
+         project stays one click away on the resume line — it used to land on the
+         earlier project's done panel, dropping the founder out of the draft
+         (task 1004549). A deliberate nav still goes through enterCreated. */
+      var draftInFlight = state.step >= 1 && state.step <= 5;
+      if (created && created.id && (focus || !draftInFlight || resumeIntent)) { enterCreated(created, !!focus); return; }
+      paintResumeOffer(created && created.id ? created : null);
       /* before identity settles, never render past step 1 (the fork and its terms
          tick, since task 1004504): deeper steps carry authenticated side effects (the Home-step repo
          probe), and onAuth() re-enters to the real draft step the moment /me answers */
@@ -7345,8 +7354,8 @@ summary{min-height:24px;padding:3px 0;}
   function jsonOrEmpty(res) { return res.json().catch(function () { return {}; }); }
 
   function signInAgain() {
-    /* from the wizard, the re-sign-in keeps the repo scope it already granted */
-    var back = currentView === 'new' ? '/projects%3Fview%3Dnew&amp;repos=1' : '/projects';
+    /* the re-sign-in keeps the repo scope, like every hub sign-in door (ADR 0364) */
+    var back = (currentView === 'new' ? '/projects%3Fview%3Dnew' : '/projects') + '&amp;repos=1';
     return 'Your session expired — <a href="' + API + '/auth/web/start?return=' + back + '">sign in again</a>.';
   }
 
@@ -7948,7 +7957,7 @@ summary{min-height:24px;padding:3px 0;}
      in hand so "checked Xm ago" keeps telling the truth (C6). ── */
 
   function manageSignin() {
-    return API + '/auth/web/start?return=' +
+    return API + '/auth/web/start?repos=1&return=' +
       encodeURIComponent('/projects?view=manage&id=' + manageId);
   }
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.15",
+  "version": "1.21.16",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.15",
+      "version": "1.21.16",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.15",
+  "version": "1.21.16",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8846,5 +8846,11 @@
       "id": "1004512",
       "text": "Deploying a core update to a project that runs under its own account used to fail every time, blaming unsaved file changes that were never there. The update now writes files as the account that owns them and touches the databa"
     }
+  ],
+  "1.21.16": [
+    {
+      "id": "1004549",
+      "text": "Signing in on cloudbongos.com now asks GitHub for repo access once and keeps it while you stay signed in, so project setup no longer stops to ask — and a trip to GitHub mid-setup brings you back exactly where you were."
+    }
   ]
 }

package/src/bongos/db.js

@@ -253,16 +253,17 @@ async function getBuilderRoleChoices(builderIds) {
 
 // ---- GitHub OAuth repo token, encrypted at rest (core_192 / task 1002099) ----
 //
-// The onboarding wizard (public-landing/create.html) opts into `public_repo` at
-// sign-in so it can list + create the user's repos. That user-to-server GitHub
-// token is held here BRIEFLY: encrypted with secret-box (master key in server env
-// only — the plaintext never touches the DB) and given a short TTL (one wizard
-// sitting), read back by the repo picker/creator, then deleted on use. It is the
+// The hub's sign-in doors opt into `repo` at sign-in so the create wizard can list +
+// create the user's repos. That user-to-server GitHub token is held here: encrypted
+// with secret-box (master key in server env only — the plaintext never touches the
+// DB) for as long as the web session it arrived with (the callback passes the
+// session's remaining life as ttlMs; task 1004549, ADR 0364), and deleted on web
+// sign-out, on offboarding, or when GitHub says it was revoked. It is the
 // auth system's OWN handshake token (distinct from a feature's third-party key
 // like the art module's Gemini key, ADR 0102), so it lives in core auth. secret-box
 // is the gate: with no master key configured we NEVER store a plaintext token —
 // capture no-ops and the wizard degrades to manual repo entry (ADR 0143).
-const GITHUB_TOKEN_TTL_MS = 60 * 60 * 1000; // 1h — one wizard sitting.
+const GITHUB_TOKEN_TTL_MS = 60 * 60 * 1000; // 1h — the fallback when no session expiry is known.
 
 // Store (or replace) the builder's GitHub repo token. `token` is the raw
 // user-to-server access token; it is encrypted here so the plaintext never touches

package/src/bongos/routes/auth.js

@@ -878,13 +878,18 @@ module.exports = function buildAuthRouter() {
       // every older name and the legacy apex-scoped copy, so a browser arriving
       // with either leaves holding only the host-only cookie.
       setSessionCookie(req, res, token, expiresAt);
-      // Persist the wizard's repo token (task 1002099 / ADR 0143): encrypted at rest,
-      // short-TTL, keyed to the builder — the repo picker/creator reads it back over
-      // the next few minutes. Gated on secret-box being configured (upsertGithubToken
+      // Persist the repo token (task 1002099 / ADR 0143): encrypted at rest, keyed to
+      // the builder. It lives exactly as long as the session it rode in on (task
+      // 1004549, ADR 0364) — a builder who stays signed in is never asked again, and
+      // signing out drops it. Gated on secret-box being configured (upsertGithubToken
       // no-ops when it isn't). Best-effort: a capture failure must NEVER break sign-in.
       if (wantsRepos && githubToken) {
         try {
-          await db.upsertGithubToken({ builderId: builder.id, token: githubToken, scope: githubScope });
+          const sessionLeft = expiresAt ? new Date(expiresAt).getTime() - Date.now() : 0;
+          await db.upsertGithubToken({
+            builderId: builder.id, token: githubToken, scope: githubScope,
+            ...(sessionLeft > 0 ? { ttlMs: sessionLeft } : {}),
+          });
         } catch (e) {
           log.error('[gds] web/callback: repo-token capture failed (non-blocking):', e.message);
         }
@@ -1157,6 +1162,14 @@ module.exports = function buildAuthRouter() {
     const token = (req.headers['authorization'] || '').replace(/^Bearer\s+/, '')
       || sessionCookieToken(req);
     if (token) await db.revokeSession(token);
+    // A WEB sign-out also drops the stored repo token (task 1004549, ADR 0364): it is
+    // held for as long as the builder stays signed in, and no longer. A CLI logout
+    // (bearer header) leaves it — the browser session that granted it is still live.
+    if (!req.headers['authorization'] && sessionCookieToken(req)) {
+      await db.deleteGithubToken({ builderId: req.builder.id }).catch((e) => {
+        log.error('[gds] auth/logout: repo-token delete failed (non-blocking):', e.message);
+      });
+    }
     // Clear every session name, host-only AND the legacy apex-scoped form — a
     // clearCookie only matches the cookie whose domain attribute it names, and a
     // sign-out that left one behind would re-authenticate the next request.

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.15'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.16'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/github_token_session_life.mjs

@@ -0,0 +1,110 @@
+// tests/github_token_session_life.mjs — the repo token lives as long as the sign-in (task 1004549).
+//
+// Owner decision 2026-10-02 (ADR 0364): repo access is asked once, at sign-in, and stays with
+// the builder for as long as they stay signed in. It used to be held for one hour, so an owner
+// still signed in was sent back to GitHub from the middle of the create wizard for a grant
+// GitHub already held. Two halves, both over the REAL auth router:
+//   - the callback stores the token with the session's remaining life as its TTL;
+//   - a web sign-out deletes it; a CLI logout (bearer header) leaves it alone.
+// Only the GitHub code exchange, the session lookup and the token store are stubbed.
+//
+// Run:  node --test tests/github_token_session_life.mjs
+
+import { test, before, after } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+import { writeFileSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+// RFC 2606 reserved — synthetic, never routable, no host brand in this file.
+const APEX = 'bongos-test.example';
+const brandDir = mkdtempSync(join(tmpdir(), 'cb-gh-token-life-'));
+const brandFile = join(brandDir, 'branding.json');
+writeFileSync(brandFile, JSON.stringify({
+  envPrefix: 'GHTOKLIFE_FIXTURE',
+  domains: { cookieDomain: `.${APEX}`, publicOrigin: `https://${APEX}`, oauthOrigin: `https://${APEX}` },
+}));
+process.env.BONGOS_BRANDING_FILE = brandFile;
+process.env.GHTOKLIFE_FIXTURE_GITHUB_CLIENT_ID = 'fixture-client';
+process.env.GHTOKLIFE_FIXTURE_GITHUB_CLIENT_SECRET = 'fixture-secret';
+const require = createRequire(import.meta.url);
+for (const p of ['BONGOS', ...require('../src/instance-config.js').LEGACY_ENV_PREFIXES]) delete process.env[`${p}_PUBLIC_ORIGIN`];
+process.on('exit', () => { try { rmSync(brandDir, { recursive: true, force: true }); } catch { /* best-effort */ } });
+
+const express = require('express');
+const auth = require('../src/bongos/auth.js');
+const db = require('../src/bongos/db');
+
+const SESSION_MS = 30 * 24 * 60 * 60 * 1000;
+const stored = [];
+const deleted = [];
+const real = {
+  completeWebFlow: auth.completeWebFlow, requireBuilder: auth.requireBuilder,
+  upsertGithubToken: db.upsertGithubToken, deleteGithubToken: db.deleteGithubToken, revokeSession: db.revokeSession,
+};
+auth.completeWebFlow = async () => ({
+  token: 'tok' + 'a'.repeat(40),
+  expiresAt: new Date(Date.now() + SESSION_MS),
+  builder: { id: 7 },
+  githubToken: 'gho_fixture',
+  githubScope: 'read:user,repo',
+});
+// The router binds requireBuilder when it is BUILT, so it is swapped before the require below.
+auth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_id: '1', github_login: 'probe' }; next(); };
+db.upsertGithubToken = async (args) => { stored.push(args); return { stored: true }; };
+db.deleteGithubToken = async (args) => { deleted.push(args); return { deleted: true }; };
+db.revokeSession = async () => {};
+const buildAuthRouter = require('../src/bongos/routes/auth.js');
+
+let server, port;
+before(async () => {
+  const app = express();
+  app.set('trust proxy', true);
+  app.use('/api/bongos', buildAuthRouter());
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(() => { server.close(); Object.assign(auth, { completeWebFlow: real.completeWebFlow, requireBuilder: real.requireBuilder }); Object.assign(db, { upsertGithubToken: real.upsertGithubToken, deleteGithubToken: real.deleteGithubToken, revokeSession: real.revokeSession }); });
+
+function request(method, path, headers = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({ host: '127.0.0.1', port, path, method, headers: { host: APEX, 'x-forwarded-proto': 'https', ...headers } }, (res) => {
+      let body = '';
+      res.on('data', (c) => { body += c; });
+      res.on('end', () => resolve({ status: res.statusCode, setCookies: [].concat(res.headers['set-cookie'] || []), body }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+const pairs = (setCookies) => setCookies.map((c) => c.split(';')[0]).join('; ');
+
+test('a repo sign-in stores the token for the life of the session, not one hour', async () => {
+  stored.length = 0;
+  const start = await request('GET', '/api/bongos/auth/web/start?return=/projects&repos=1');
+  assert.equal(start.status, 302);
+  const state = (start.setCookies.find((c) => c.startsWith('gds_oauth_state=')) || '').split(';')[0].split('=')[1];
+  assert.ok(state, 'the start set a state cookie');
+  const cb = await request('GET', `/api/bongos/auth/web/callback?code=x&state=${state}`, { cookie: pairs(start.setCookies) });
+  assert.equal(cb.status, 302, cb.body);
+  assert.equal(stored.length, 1, 'the repo token was stored');
+  const ttl = stored[0].ttlMs;
+  assert.ok(ttl > SESSION_MS - 60_000 && ttl <= SESSION_MS, `the TTL follows the 30-day session (got ${ttl}ms)`);
+});
+
+test('a web sign-out deletes the repo token', async () => {
+  deleted.length = 0;
+  const out = await request('POST', '/api/bongos/auth/logout', { cookie: auth.SESSION_COOKIE_NAMES[0] + '=tok' + 'a'.repeat(40) });
+  assert.equal(out.status, 200, out.body);
+  assert.deepEqual(deleted, [{ builderId: 7 }]);
+});
+
+test('a CLI logout (bearer) leaves the browser session’s repo token alone', async () => {
+  deleted.length = 0;
+  const out = await request('POST', '/api/bongos/auth/logout', { authorization: 'Bearer cli' + 'b'.repeat(40) });
+  assert.equal(out.status, 200, out.body);
+  assert.deepEqual(deleted, []);
+});

package/tests/hub_account_page.mjs

@@ -74,7 +74,7 @@ test('the script builds no markup from strings, and the controls are real markup
 });
 
 test('the door returns here, and the page calls only its own-scoped routes', () => {
-  assert.match(PAGE, /href="\/api\/bongos\/auth\/web\/start\?return=\/account"/, 'sign-in lands back on /account');
+  assert.match(PAGE, /href="\/api\/bongos\/auth\/web\/start\?return=\/account&repos=1"/, 'sign-in lands back on /account, asking for repo access once (task 1004549)');
   const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
   assert.deepEqual([...new Set(calls)].sort(), ['GET /me', 'GET /me/cross-project','PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile'].sort());
   assert.match(SCRIPT, /fetch\(API \+ '\/auth\/logout', \{ method: 'POST'/, 'sign out is the hub logout POST');
@@ -107,7 +107,7 @@ test('the bar is the hub’s own: the same markup as /projects, no header of its
     assert.ok(HUB.includes(piece), `projects.html no longer carries: ${piece}`);
     assert.ok(PAGE.includes(piece), `account.html does not carry the hub's: ${piece}`);
   }
-  assert.match(PAGE, /<a class="signinDoor" id="signinTop" hidden href="\/api\/bongos\/auth\/web\/start\?return=\/account">Sign in<\/a>/, 'signed out, the door in the chip’s slot returns here');
+  assert.match(PAGE, /<a class="signinDoor" id="signinTop" hidden href="\/api\/bongos\/auth\/web\/start\?return=\/account&amp;repos=1">Sign in<\/a>/, 'signed out, the door in the chip’s slot returns here');
   assert.match(PAGE, /<a class="skip vh" href="#acct">/);
   assert.match(PAGE, /<main class="acct" id="acct">/, 'the skip link has its landmark');
 });

package/tests/landing_page.mjs

@@ -291,7 +291,7 @@ test('the page reads without JavaScript: the spine is markup, not script-built',
     assert.ok(body.includes(copy), `"${copy}" is only reachable with scripting on`);
   }
   // the sign-in door is markup; the script only UPGRADES it to the signed-in chip
-  assert.match(body, /class="pill signin" href="\/api\/bongos\/auth\/web\/start\?return=\/">Sign in</);
+  assert.match(body, /class="pill signin" href="\/api\/bongos\/auth\/web\/start\?return=\/&amp;repos=1">Sign in</);
 });
 
 // ── (4) the motion kill switch ─────────────────────────────────────────────
@@ -543,7 +543,7 @@ test('the bar is markup: the mark, the Projects trigger, the sign-in door — an
   assert.match(body, /<span class="mark-word">\{\{productName\}\}<\/span>/, 'the product name as plain type, folded away under 900');
   assert.match(body, /<button class="trig" type="button" id="projTrig" data-menu="projects" aria-expanded="false" aria-controls="menuProjects">Projects<svg class="cv"/);
   assert.doesNotMatch(body, /modeBtn|id="mode"|class="moon"|class="sun"/, 'the mode glyph left the bar — the apex is dark only (task 1003336)');
-  assert.match(body, /<span class="whoSlot" id="who">\s*<a class="pill signin" href="\/api\/bongos\/auth\/web\/start\?return=\/">Sign in<\/a>\s*<\/span>/, 'the door stands in the identity slot until the session resolves');
+  assert.match(body, /<span class="whoSlot" id="who">\s*<a class="pill signin" href="\/api\/bongos\/auth\/web\/start\?return=\/&amp;repos=1">Sign in<\/a>\s*<\/span>/, 'the door stands in the identity slot until the session resolves');
   // what left with the pill bar
   assert.doesNotMatch(body, /class="pill nav-pill"|class="right-pills"|class="pill mark-pill"|data-nav="home"/, 'no nav pill, no right pills, no Home');
   assert.doesNotMatch(body.slice(body.indexOf('<header'), body.indexOf('</header>')), /data-link-hall/, 'the bar carries no hall link — the footer does');

package/tests/projects_hub_pre_uat.mjs

@@ -226,7 +226,8 @@ test('the wizard’s 401 recoveries keep the repo scope they already granted', (
   assert.equal(plain, 0, 'no wizard redirect drops the scope');
   assert.ok((SCRIPT.match(/\/auth\/web\/start\?return=\/projects%3Fview%3Dnew&repos=1'\); throw new Error\('signing in'\)/g) || []).length >= 2, 'create + manifest');
   assert.match(SCRIPT, /projects%3Fview%3Dnew&amp;repos=1">sign in again<\/a> to keep watching/, 'the progress watch');
-  assert.match(fn('signInAgain'), /currentView === 'new' \? '\/projects%3Fview%3Dnew&amp;repos=1'/, 'signInAgain from the wizard');
+  // every hub sign-in door asks for repo access since task 1004549, so signInAgain does too
+  assert.match(fn('signInAgain'), /\(currentView === 'new' \? '\/projects%3Fview%3Dnew' : '\/projects'\) \+ '&amp;repos=1'/, 'signInAgain from the wizard');
 });
 
 test('a resumed draft past the code row still probes repo access before Create', () => {

package/tests/wizard_draft_resume.mjs

@@ -204,3 +204,52 @@ test('the team pill is a plain pick on the Team size row — a second click keep
   assert.deepEqual([...HUB.matchAll(/data-team="([a-z-]+)"/g)].map((m) => m[1]), ['small-team', 'community'],
     'the row offers who can join a team; one person is the "One person" pill, not a team shape');
 });
+
+// ── slice 4 · a second draft beside a stored create keeps its place (task 1004549) ──
+// Owner report 2026-10-02: "Allow repo access" seemed to throw the founder out of the
+// flow. GitHub already held the approval, so the round-trip was a blink — and the page
+// came back on the EARLIER project's done panel, because enter() sent every arrival with
+// a stored create (cb-created-instance) to enterCreated(), which treats a non-deliberate
+// arrival as "the same visit, show the watched project". With a draft part-way through
+// the wizard, the same visit IS the draft.
+const ENTER_RE = /function enter\(focus\) \{[\s\S]*?\n {4}\}/;
+const enterSlice = (HUB.match(ENTER_RE) || [null])[0];
+
+test('the enter() slice is still findable', () => {
+  assert.ok(enterSlice, 'enter() was not found in projects.html');
+  assert.match(enterSlice, /enterCreated\(/, 'enter() is where the stored create is routed');
+});
+
+function runEnter({ draftStep, focus = false, resumeIntent = false, created = { id: 101, name: 'Old one' } }) {
+  const log = { shown: [], created: [], offer: undefined };
+  const sandbox = {
+    authKnown: true, me: { github_login: 'probe' }, resumeIntent,
+    state: { step: draftStep },
+    createdRecord: () => created,
+    enterCreated: (rec, f) => log.created.push({ id: rec.id, focus: f }),
+    paintResumeOffer: (rec) => { log.offer = rec; },
+    show: (step) => { sandbox.state.step = step; log.shown.push(step); },
+    saveDraft() {},
+    $: () => ({ focus() {} }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(enterSlice + '\nenter(' + JSON.stringify(focus) + ');', sandbox);
+  return log;
+}
+
+test('back from GitHub mid-draft, with an earlier project stored: the draft step, not the old done panel', () => {
+  for (const step of [2, 3, 4, 5]) {
+    const log = runEnter({ draftStep: step });
+    assert.deepEqual(log.created, [], `step ${step}: the earlier project's panel is not entered`);
+    assert.deepEqual(log.shown, [step], `step ${step}: the draft keeps its place`);
+    assert.equal(log.offer && log.offer.id, 101, 'the earlier project stays one click away on the resume line');
+  }
+});
+
+test('the done panel still comes back when no second draft is in flight, or on a deliberate nav', () => {
+  assert.equal(runEnter({ draftStep: 6 }).created.length, 1, 'a reload on the done panel stays on it');
+  assert.equal(runEnter({ draftStep: 0 }).created.length, 1, 'no draft position: the watched project');
+  assert.deepEqual(runEnter({ draftStep: 4, focus: true }).created, [{ id: 101, focus: true }], 'a deliberate New project nav is enterCreated\'s to decide');
+  assert.equal(runEnter({ draftStep: 4, resumeIntent: true }).created.length, 1, 'the resume link still resumes');
+});

package/tests/wizard_intent_resume.mjs

@@ -61,8 +61,10 @@ test('both slices are still findable (a rename must fail loudly, not silently pa
   assert.match(enterSlice, /startProgress\(created\.id\);/, 'so is the resume branch it guards');
   assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 5 \?/,
     'the STORED draft\'s step decides, not state.step — state.step is 6 for the whole life of a finished standup');
-  assert.match(SCRIPT, /if \(created && created\.id\) \{ enterCreated\(created, !!focus\); return; \}/,
-    'enter() still hands the created record straight to it');
+  // since task 1004549 a second draft in flight keeps its place on a non-deliberate
+  // arrival (tests/wizard_draft_resume.mjs slice 4); a deliberate nav still comes here
+  assert.match(SCRIPT, /if \(created && created\.id && \(focus \|\| !draftInFlight \|\| resumeIntent\)\) \{ enterCreated\(created, !!focus\); return; \}/,
+    'enter() still hands the created record to it on a deliberate nav');
 });
 
 // A faithful miniature: the stubs record what enterCreated ASKS FOR, which is the whole