@bongos/core 1.21.17 → 1.21.18

package/modules/public-landing/public/projects.html

@@ -590,7 +590,6 @@ summary{min-height:24px;padding:3px 0;}
 
 /* GitHub repo picker (task 1002099): hairline rows, the chosen one marked on
    the accent; the private badge in the label face */
-#ghConnect .btn{margin-top:4px;}
 .ghlist{margin-top:4px;max-height:220px;overflow-y:auto;border:0;border-top:1px solid var(--rule);border-radius:0;background:none;}
 .ghlist:empty{display:none;}
 .ghrow{display:flex;align-items:center;gap:8px;width:100%;min-height:40px;text-align:left;background:none;border:0;border-bottom:1px solid var(--rule-soft);padding:10px 0;font:inherit;font-size:14px;color:var(--ink);cursor:pointer;}
@@ -1637,11 +1636,11 @@ summary{min-height:24px;padding:3px 0;}
                       <!-- GitHub-integrated repo picker (adopt) + auto-create (fresh) — task 1002099.
                            Without repo access we fall back to the manual owner/repo inputs
                            (#manualHome), which stay authoritative. -->
-                      <div id="ghConnect" class="reassure">
-                        <p id="ghConnectMsg">&nbsp;</p>
-                        <button type="button" class="btn" id="ghConnectBtn">Allow repo access</button>
-                        <button type="button" class="linklike" id="ghManualToggle">or enter it manually</button>
-                      </div>
+                      <!-- no repo-access ask in the wizard (task 1004555): every hub sign-in asks for repo
+                           access (ADR 0364), and a missing token is fetched by one automatic GitHub
+                           round-trip. Only when that hop could not help does this line show, above
+                           the manual fields. -->
+                      <div id="ghNoAccess" class="hint" hidden>We couldn’t read your GitHub repositories just now, so enter the repo by hand below.</div>
                       <div id="ghBusy" class="hint" hidden>Reading your GitHub repositories…</div>
                       <div id="ghAdopt" class="wizField" hidden>
                         <span>Pick one of your repositories</span>
@@ -1667,8 +1666,6 @@ summary{min-height:24px;padding:3px 0;}
                         </label>
                         <!-- visibility stated BEFORE GitHub's own radio is the first place it appears (task 1002721) -->
                         <div class="hint" style="grid-column:1 / -1;">Creating the repo yourself on GitHub? Public or private is your choice there — both work here, and we never change it.</div>
-                        <!-- the way back from the manual fallback (task 1003683) -->
-                        <button type="button" class="linklike" id="ghManualBack" style="grid-column:1 / -1;" hidden>Use my GitHub repositories instead</button>
                       </div>
                       <div class="hint" id="h-home">&nbsp;</div>
                       <button type="button" class="btn small rowUse" data-row-use>Use this</button>
@@ -5276,44 +5273,39 @@ summary{min-height:24px;padding:3px 0;}
             403 → offer to grant repo access (a ?repos=1 re-sign-in);
             503 (server can't store the token) or any error → the manual inputs.
           #manualHome (the classic owner/repo fields) is the always-safe fallback. ── */
-    var repoAccess = null;   /* null=unknown/loading · true · 'need-connect' · 'unavailable' · 'manual' */
+    var repoAccess = null;   /* null=unknown/loading · true · 'unavailable' (manual fields) */
     var repoList = [];       /* the user's repos (from the probe) — feeds the picker + the fresh-name clash hint */
     var ghProbed = false;
 
-    function isManualHome() { return repoAccess === 'manual' || repoAccess === 'unavailable'; }
+    function isManualHome() { return repoAccess === 'unavailable'; }
     function validRepoName(s) { return /^[A-Za-z0-9._-]{1,100}$/.test(String(s || '')); }
     function myLogin() { return (me && me.github_login) || 'you'; }
 
-    function connectRepos(e) {
-      if (e) e.preventDefault();
-      /* Same-tab navigation so the sessionStorage draft round-trips back to the Home step. */
+    /* The one automatic GitHub round-trip (task 1004555). The token is missing (a session
+       from before ADR 0364, or a sign-out elsewhere), and GitHub answers a repo sign-in at
+       once for anyone who already approved it — so the page goes and fetches it instead of
+       asking. Same tab, so the sessionStorage draft comes back with its step (task 1004549).
+       ONCE per tab session: a hop that came back still without access cannot be helped by a
+       second, so the caller falls back to the manual fields instead of looping. A probe that
+       answers 200 clears the mark, so a later expiry may hop again. */
+    var HOP_KEY = 'cb-repo-hop';
+    function repoHopDone() { try { return sessionStorage.getItem(HOP_KEY) === '1'; } catch (e) { return true; } }
+    function hopForRepoAccess() {
+      if (repoHopDone()) return false;
+      try { sessionStorage.setItem(HOP_KEY, '1'); } catch (e) { return false; }
+      saveDraft();
       window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew&repos=1');
+      return true;
     }
-    $('ghConnectBtn').addEventListener('click', connectRepos);
-    $('ghManualToggle').addEventListener('click', function () { repoAccess = 'manual'; syncHome(); $('f-owner').focus(); });
-    $('ghManualBack').addEventListener('click', function () { repoAccess = 'need-connect'; syncHome(); $('ghConnectBtn').focus(); });
 
     function syncHome() {
-      var need = repoAccess === 'need-connect';
       var ok = repoAccess === true;
       var adopt = state.mode === 'adopt';
       $('ghBusy').hidden = !!repoAccess;              /* busy only while still probing (null) */
-      $('ghConnect').classList.toggle('on', need);    /* .reassure box: shown via .on (not hidden — .reassure sets display:none) */
+      $('ghNoAccess').hidden = repoAccess !== 'unavailable';
       $('ghAdopt').hidden = !(ok && adopt);
       $('ghFresh').hidden = !(ok && !adopt);
       $('manualHome').hidden = !isManualHome();
-      /* only when the visitor CHOSE manual: with 'unavailable' the server cannot hold a
-         token, so a connect round-trip would land back here having changed nothing */
-      $('ghManualBack').hidden = repoAccess !== 'manual';
-      if (need) {
-        /* Informed consent (ADR 0155): this grants `repo`, which GitHub's own screen
-           words as full control of ALL your repositories — so say plainly why we ask
-           and what we do with it, rather than letting GitHub's wording be the first
-           the user hears of it. Private repos are the reason the scope is this wide. */
-        $('ghConnectMsg').textContent = adopt
-          ? 'You’re signed in — creating your project needs one more GitHub permission. GitHub will ask for repository access (it words this as access to all your repositories — that is the only scope it offers that can write to a private repo). We use it to read the repo you pick and push the setup commit to it. Nothing else is touched.'
-          : 'You’re signed in — creating your project needs one more GitHub permission. GitHub will ask for repository access (it words this as access to all your repositories — the narrower option cannot write to private repos). We use it to create your new empty repo and push the setup commit to it. Nothing else is touched.';
-      }
       if (ok && adopt) initAdoptPicker();
       if (ok && !adopt) syncFresh();
     }
@@ -5413,13 +5405,16 @@ summary{min-height:24px;padding:3px 0;}
 
     function ensureRepoAccess() {
       if (ghProbed && repoAccess !== null) return;   /* already known this session */
-      if (isManualHome()) return;                     /* user chose manual — don't nag */
       repoAccess = null; syncHome();                  /* show "reading your repos…" */
       fetch(API + '/github/repos', { credentials: 'same-origin' })
         .then(function (res) {
           ghProbed = true;
-          if (res.status === 200) return res.json().then(function (d) { repoList = (d && d.repos) || []; repoAccess = true; });
-          if (res.status === 403 || res.status === 401) { repoAccess = 'need-connect'; return; }
+          if (res.status === 200) {
+            try { sessionStorage.removeItem(HOP_KEY); } catch (e) {}
+            return res.json().then(function (d) { repoList = (d && d.repos) || []; repoAccess = true; });
+          }
+          /* no stored token: fetch it (one hop), else the manual fields */
+          if (res.status === 403 || res.status === 401) { if (!hopForRepoAccess()) repoAccess = 'unavailable'; return; }
           repoAccess = 'unavailable'; return;         /* 503 or anything else → manual fallback */
         })
         .catch(function () { ghProbed = true; repoAccess = 'unavailable'; })
@@ -5901,7 +5896,6 @@ summary{min-height:24px;padding:3px 0;}
         if (!works.length) return homeErr('Pick what already exists, then your main one.');
         if (works.indexOf(a.main_work) === -1) return homeErr('Mark which of them is your main one.');
       }
-      if (repoAccess === 'need-connect') return homeErr('Allow GitHub repo access to pick or create your repository — or choose “enter it manually”.');
       if (repoAccess === true && state.mode !== 'adopt') {
         /* Fresh with access: just the new repo NAME (owner is the signed-in account). */
         if (!validRepoName(state.repo)) return homeErr('Name the new repository (letters, numbers, and . _ -).');
@@ -6346,9 +6340,12 @@ summary{min-height:24px;padding:3px 0;}
       }).then(function (res) {
         return res.json().catch(function () { return {}; }).then(function (data) {
           if (res.status === 401 || res.status === 403) {
-            repoAccess = 'need-connect';
-            var e0 = new Error('reconnect'); e0.gotoHome = true;
-            e0.homeMsg = 'Your GitHub authorization expired — reconnect on the Home step to create the repo.';
+            /* the token went between the probe and Create: the hop fetches it again and
+               brings the founder back to this screen; if it cannot, the manual fields */
+            var hopped = hopForRepoAccess();
+            if (!hopped) { repoAccess = 'unavailable'; syncHome(); }
+            var e0 = new Error('reconnect'); e0.gotoHome = !hopped;
+            e0.homeMsg = 'We couldn’t create the repo on GitHub just now — enter one you made yourself below.';
             throw e0;
           }
           if (!res.ok) {

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.17",
+  "version": "1.21.18",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.17",
+      "version": "1.21.18",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.17",
+  "version": "1.21.18",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -8858,5 +8858,11 @@
       "id": "1004554",
       "text": "Bongos no longer plays any sounds: no ship bell, credits chime, fanfare or end-of-turn chime. Settings → Sound now just says they're off for now."
     }
+  ],
+  "1.21.18": [
+    {
+      "id": "1004555",
+      "text": "Project setup no longer shows an \"Allow repo access\" button — if the site needs GitHub access it fetches it in a quick reload and brings you straight back to where you were."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.17'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.18'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/wizard_draft_resume.mjs

@@ -101,57 +101,86 @@ test('a draft already at step 1 is unchanged, and an out-of-range step is not re
   }
 });
 
-// ── slice 2 · syncHome's control over the way back ────────────────────────────────
+// ── slice 2 · no "Allow repo access" step: the token is fetched, not asked for (task 1004555) ──
+// Owner, 2026-10-02: "I don't want to see the old button at all." Every hub sign-in asks
+// for repo access (ADR 0364) and GitHub answers at once for anyone who approved it, so a
+// missing token is fetched by ONE automatic round-trip. The slices below are syncHome (what
+// shows) and ensureRepoAccess (the probe and the hop), run under a DOM + fetch stub.
 const SYNC_RE = /function syncHome\(\) \{[\s\S]*?\n {4}\}/;
 const syncSlice = (HUB.match(SYNC_RE) || [null])[0];
+const HOP_RE = /var HOP_KEY = 'cb-repo-hop';[\s\S]*?function hopForRepoAccess\(\) \{[\s\S]*?\n {4}\}/;
+const hopSlice = (HUB.match(HOP_RE) || [null])[0];
+const PROBE_RE = /function ensureRepoAccess\(\) \{[\s\S]*?\n {4}\}/;
+const probeSlice = (HUB.match(PROBE_RE) || [null])[0];
 
-test('the syncHome slice is still findable', () => {
+test('the syncHome, hop and probe slices are still findable', () => {
   assert.ok(syncSlice, 'syncHome() was not found in projects.html');
-  assert.match(syncSlice, /ghManualBack/, 'syncHome governs the way-back control');
+  assert.ok(hopSlice, 'hopForRepoAccess() was not found in projects.html');
+  assert.ok(probeSlice, 'ensureRepoAccess() was not found in projects.html');
+});
+
+test('the page carries no "Allow repo access" control at all', () => {
+  assert.doesNotMatch(HUB, /Allow repo access/);
+  assert.doesNotMatch(HUB, /id="ghConnect/);
+  assert.doesNotMatch(HUB, /need-connect/, 'no state is left that would ask for it');
 });
 
 function runSync(repoAccess) {
   const els = {};
   // Elements start HIDDEN so that "shown" is only ever the result of syncHome setting it.
-  // With a `hidden: false` default, a control syncHome never mentions reads as visible and
-  // the assertion below would pass against the unfixed page.
-  const el = (id) => (els[id] ||= {
-    id, hidden: true, textContent: '', _on: false,
-    classList: { toggle(_c, v) { els[id]._on = !!v; } },
-  });
+  const el = (id) => (els[id] ||= { id, hidden: true, textContent: '' });
   const sandbox = {
-    repoAccess,
-    state: { mode: 'greenfield' },
-    $: el,
-    isManualHome: () => repoAccess === 'manual' || repoAccess === 'unavailable',
+    repoAccess, state: { mode: 'greenfield' }, $: el,
+    isManualHome: () => repoAccess === 'unavailable',
     initAdoptPicker() {}, syncFresh() {},
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(syncSlice + '\nsyncHome();', sandbox);
-  return { connectShown: el('ghConnect')._on, manualShown: !el('manualHome').hidden, backShown: !el('ghManualBack').hidden };
+  return { noteShown: !el('ghNoAccess').hidden, manualShown: !el('manualHome').hidden, freshShown: !el('ghFresh').hidden };
+}
+
+test('without access the manual fields show with one plain line; with access they do not', () => {
+  assert.deepEqual(runSync('unavailable'), { noteShown: true, manualShown: true, freshShown: false });
+  assert.deepEqual(runSync(true), { noteShown: false, manualShown: false, freshShown: true });
+});
+
+async function runProbe({ status, hopped = false }) {
+  const store = new Map(hopped ? [['cb-repo-hop', '1']] : []);
+  const assigned = [];
+  let saves = 0;
+  const sandbox = {
+    API: '/api/bongos', ghProbed: false, repoAccess: null, repoList: [],
+    sessionStorage: { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, v), removeItem: (k) => store.delete(k) },
+    window: { location: { assign: (u) => assigned.push(u) } },
+    saveDraft() { saves += 1; }, syncHome() {},
+    fetch: () => Promise.resolve({ status, json: () => Promise.resolve({ repos: [] }) }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(hopSlice + '\n' + probeSlice + '\nvar done = ensureRepoAccess();', sandbox);
+  await new Promise((r) => setTimeout(r, 0));
+  await new Promise((r) => setTimeout(r, 0));
+  return { assigned, saves, repoAccess: vm.runInContext('repoAccess', sandbox), mark: store.get('cb-repo-hop') || null };
 }
 
-test('choosing manual leaves a way back to the connect offer', () => {
-  const manual = runSync('manual');
-  assert.equal(manual.manualShown, true, 'the manual fields are up');
-  assert.equal(manual.connectShown, false, 'the connect box is down — that is what made it a trap');
-  assert.equal(manual.backShown, true, 'and the way back is offered');
+test('a missing token is fetched by one automatic GitHub round-trip, back to the wizard, draft saved first', async () => {
+  const r = await runProbe({ status: 403 });
+  assert.deepEqual(r.assigned, ['/api/bongos/auth/web/start?return=/projects%3Fview%3Dnew&repos=1']);
+  assert.equal(r.saves, 1, 'the draft is saved before the page leaves');
+  assert.equal(r.mark, '1', 'the hop is marked for this tab');
 });
 
-test('a FORCED fallback offers no way back, because connecting cannot help', () => {
-  // 'unavailable' means the server could not store a token. Offering "use my GitHub
-  // repositories instead" there would send the visitor through a round-trip that lands
-  // them right back here — an offer that cannot be honoured is worse than none.
-  const forced = runSync('unavailable');
-  assert.equal(forced.manualShown, true);
-  assert.equal(forced.backShown, false);
+test('a second miss after the hop falls back to the manual fields instead of looping', async () => {
+  const r = await runProbe({ status: 403, hopped: true });
+  assert.deepEqual(r.assigned, [], 'no second round-trip');
+  assert.equal(r.repoAccess, 'unavailable');
 });
 
-test('while the connect offer is up, the way back is not', () => {
-  const need = runSync('need-connect');
-  assert.equal(need.connectShown, true);
-  assert.equal(need.backShown, false, 'no second, redundant control beside the button itself');
+test('access found clears the mark, so a later expiry may hop again', async () => {
+  const r = await runProbe({ status: 200, hopped: true });
+  assert.equal(r.repoAccess, true);
+  assert.equal(r.mark, null);
 });
 
 // ── slice 3 · why this task's original team-shape claim was wrong ─────────────────

package/tests/wizard_six_screens.mjs

@@ -102,7 +102,7 @@ test('nothing the old steps could do is lost: their controls are moved whole int
     const r = (p.match(new RegExp(`<div class="setRow" data-row="${row}">[\\s\\S]*?\\n {16}</div>\\n`)) || [''])[0];
     for (const id of ids) assert.match(r, new RegExp(`id="${id}"`), `${row} row hosts #${id}`);
   };
-  has('code', ['physExisting', 'c-green', 'c-adopt', 'adoptNote', 'ghConnect', 'ghAdopt', 'ghFresh', 'manualHome', 'h-home']);
+  has('code', ['physExisting', 'c-green', 'c-adopt', 'adoptNote', 'ghNoAccess', 'ghAdopt', 'ghFresh', 'manualHome', 'h-home']);
   has('address', ['f-slug', 'addrConfirm', 'addrCustom', 'f-domain', 'f-noaddr']);
   has('app', ['appOpts', 'renderLater', 'renderSetup', 'f-renderKey', 'renderWs', 'renderSvc', 'renderNew']);
   has('extras', ['modQ', 'modCards', 'modWhy', 'modCoreNote']);