@bongos/core 1.21.181 → 1.22.1

package/modules/hall-ui/public/paintbrush.js

@@ -43,11 +43,7 @@
 
   var bar = null, st = null;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function tidy(s) { return String(s == null ? '' : s).replace(/\s+/g, ' ').trim(); }
   function plural(n, one, many) { return n + ' ' + (n === 1 ? one : many); }
   function clip(s, n) { s = tidy(s); return s.length > n ? s.slice(0, n - 1) + '…' : s; }

package/modules/hall-ui/public/palette.js

@@ -105,11 +105,7 @@
   var searchAbort = null; // the in-flight request's AbortController, if the runtime has one
   var searchCache = {};   // query (trimmed+lowercased) -> raw hits[], this OPEN only
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function visible(id) {
     var el = document.getElementById(id);
     return !!(el && !el.hidden);

package/modules/hall-ui/public/primer.html

@@ -110,9 +110,10 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- the shared markdown reader (window.OTBMdReader) — primer.js renders through

package/modules/hall-ui/public/primer.js

@@ -55,7 +55,7 @@
   function $(sel) { return document.querySelector(sel); }
 
   const MD = window.OTBMdReader;
-  const escapeHtml = (MD && MD.escapeHtml) || ((s) => String(s));
+  const escapeHtml = (s) => window.OTB.escapeHtml(s); // task 1004876: the old fallback escaped nothing
 
   // The shared resolver, plus the one rewrite that is the primer's alone: the
   // economy doc has an in-hall reader page (task 1472), so a link to it stays in

package/modules/hall-ui/public/profile-crafts.js

@@ -33,11 +33,9 @@
 (function () {
   'use strict';
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
   function objects() {
     return (typeof window !== 'undefined' && window.OTBIdeaObjects) || null;
   }

package/modules/hall-ui/public/profile.html

@@ -205,13 +205,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->
 <script src="/builders/vote-control.js"></script>
 <script src="/builders/brand-apply.js?v=2026-06-27-r75"></script>

package/modules/hall-ui/public/project-settings.html

@@ -69,12 +69,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-16-gate"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/project-settings.js?v=2026-10-08-ship-mode"></script>
 </body>

package/modules/hall-ui/public/ranks.html

@@ -71,13 +71,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded before ranks.js, which pulls from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/founding-mark.js?v=2026-09-30-founding"></script>
 <script src="/builders/ranks.js?v=2026-09-30-founding"></script>
 </body>

package/modules/hall-ui/public/roadmap.html

@@ -41,12 +41,12 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- The chart kit and the timeline's series builders (task 1003447). Both MUST
      precede roadmap.js: the page reads window.OTBKit / window.OTBRoadmapTimeline
      at render time, so loading either after would be a blank section in

package/modules/hall-ui/public/roster.html

@@ -53,14 +53,13 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB — rank labels, number formats) + the
-     branding pack's currency label, loaded BEFORE roster.js. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
+<!-- the branding pack's currency label, loaded BEFORE roster.js. -->
 <script src="/builders/brand-apply.js"></script>
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/founding-mark.js?v=2026-09-30-founding"></script>

package/modules/hall-ui/public/sessions.html

@@ -109,13 +109,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded BEFORE sessions.js so it can pull from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>
 <!-- The shared component kit — the pager contract this page now uses instead of
      its own (task 1003279-sibling follow-up of 1003281). Must load BEFORE

package/modules/hall-ui/public/settings.html

@@ -470,13 +470,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page scripts run. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded before consuming IIFEs. -->
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- shared component kit (window.OTBKit) — section rail (task 2166). -->
 <script src="/builders/hall-kit.js"></script>
 <!-- shared record overlay (#/idea|blocker/N) — every hall page carries it; this

package/modules/hall-ui/public/shell.js

@@ -64,11 +64,7 @@
   // builders.js owns these hashes (deep-link overlay) — never route them.
   var DEEPLINK_RE = /^#\/(task|idea|blocker)\/(\d+)$/;
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function moduleOn(name) {
     var m = window.__MODULES__;
     if (!m || !m.enabled || !(name in m.enabled)) return true;

package/modules/hall-ui/public/sky-data.js

@@ -87,7 +87,7 @@
   }
   // esc — the prototype builds HTML strings, and every title, criterion and
   // goal name passes through here first, so a title never becomes markup.
-  function esc(s) { return String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])); }
+  function esc(s) { return window.OTB.escapeHtml(s); }
   function fmtDate(iso) { if (!iso) return '—'; const d = new Date(iso); return d.toLocaleDateString('en-GB', { day: '2-digit', month: 'short' }).toLowerCase(); }
   function fmtDay(t) { return new Date(t).toLocaleDateString('en-GB', { day: '2-digit', month: 'short', year: 'numeric' }).toLowerCase(); }
   function ageDays(iso) { return iso ? (NOW - new Date(iso).getTime()) / 86400000 : 0; }

package/modules/hall-ui/public/street.html

@@ -228,9 +228,10 @@
   </div>
 </div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/gov-living.js?v=2026-10-09-positions1"></script>
 <script src="/builders/gov-feeds.js?v=2026-10-09-living3"></script>

package/modules/hall-ui/public/studio.html

@@ -188,11 +188,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <!-- The kit, for its ONE renderer: the full-size ship-time visual figure
      (task 1003829), which the older reviews still show. -->
 <script src="/builders/hall-visual.js?v=2026-09-16-visual1"></script>

package/modules/hall-ui/public/task-detail.js

@@ -75,12 +75,7 @@
   // dom-utils.js already publishes escapeHtml on window.OTB (this file uses
   // OTB.toast the same way) — a local copy would be its 9th byte-identical twin.
   // The fallback keeps the file's self-contained contract if OTB hasn't loaded.
-  function esc(s) {
-    if (window.OTB && window.OTB.escapeHtml) return window.OTB.escapeHtml(s);
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   async function fetchRef(kind, id) {
     if (kind === 'blocker') {

package/modules/hall-ui/public/task-lib.js

@@ -23,14 +23,9 @@
 (() => {
   'use strict';
 
-  // Local HTML-escape — deliberately NOT window.OTB.escapeHtml, so this file
-  // keeps hall-kit's dependency-free property (same reasoning, same duplication
-  // of ~4 lines being cheaper than a load-order constraint).
-  function esc(s) {
-    return String(s ?? '').replace(/[&<>"']/g, (c) => ({
-      '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;',
-    }[c]));
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
 
   // Sort key for a "P3"-style priority string. Unparseable/absent sorts last.
   function priorityRank(p) {

package/modules/hall-ui/public/task.html

@@ -55,13 +55,12 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded FIRST so task.js can pull from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
 <!-- task-detail.js still owns the #/idea/N and #/blocker/N deep-link overlay
      (and the #/task/N → /task/N redirect, task 751); load it here too so those
      links still resolve from this page. -->

package/modules/hall-ui/public/thinking.html

@@ -138,9 +138,10 @@
   </div>
 </div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
 
 <script src="/builders/idea-objects.js?v=2026-09-27-split"></script>

package/modules/hall-ui/public/tweak-editor.html

@@ -142,11 +142,11 @@
 
 <div id="toast" class="toast" role="status" aria-live="polite" data-visible="0"></div>
 
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <script src="/builders/palette.js" defer></script>
-<script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
 <script src="/builders/brand-holes.js?v=2026-09-29-aqfix"></script>
 <script src="/builders/tweak-editor-lib.js?v=2026-09-29-tw27"></script>
 <script src="/builders/tweak-editor.js?v=2026-09-29-tw27-aqfix"></script>

package/modules/hall-ui/public/vote-control.js

@@ -30,7 +30,7 @@
     insufficient_rank: 'Voting opens at Metic rank.',
   };
 
-  const esc = (s) => String(s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const esc = (s) => window.OTB.escapeHtml(s);
   const netText = (n) => { const v = Number(n) || 0; return v > 0 ? `+${v}` : `${v}`; };
   const validId = (id) => { const n = Number(id); return Number.isInteger(n) && n > 0 ? n : null; };
 

package/modules/hall-ui/public/watch.html

@@ -163,13 +163,12 @@
 
 <!-- The app shell (sidebar + top bar). Dependency-free; loaded FIRST so the
      chrome exists before the page script runs. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded before watch.js, which pulls from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <!-- shared component kit (window.OTBKit) — tabs, ledger, pager (task 2166). -->
 <script src="/builders/hall-kit.js"></script>
 <script src="/builders/task-detail.js?v=2026-07-03-taskdetail"></script>

package/modules/hall-ui/public/welcome-boot.js

@@ -139,11 +139,9 @@
   }
 
   // ---------- the overlay ----------
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  // The shared escaper: window.OTB in the page; under Node (this file is also require()d as a
+  // CommonJS lib — see its module.exports and its tests) dom-utils.js's own export (task 1004876).
+  function esc(s) { return (typeof window !== 'undefined' ? window.OTB : require('./dom-utils.js')).escapeHtml(s); }
   function craft() { return window.OTBCraftMode || null; }
   function reducedMotion() {
     return !!(window.matchMedia && window.matchMedia('(prefers-reduced-motion: reduce)').matches);

package/modules/hall-ui/public/work.html

@@ -171,13 +171,12 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
+<script src="/builders/dom-utils.js?v=2026-10-25-escape"></script>
 <script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
 <script src="/builders/craft-mode.js?v=2026-10-09-living3"></script>
-<script src="/builders/shell.js?v=2026-10-25-autobongos"></script>
+<script src="/builders/shell.js?v=2026-10-25-escape"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
-<!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->
-<script src="/builders/dom-utils.js?v=2026-06-14-domutils" defer></script>
 <!-- task 1004727: the ONE karma vote control every task/idea list renders -->
 <script src="/builders/vote-control.js"></script>
 <!-- shared component kit (window.OTBKit) — tabs, pager, filter bar (task 2166). -->

package/modules/lifecycle/ship-card.js

@@ -587,10 +587,7 @@ function renderMonospaceCard(model) {
 }
 
 // ---- HTML renderer (the in-feed branded card) ------------------------------
-function esc(s) {
-  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) =>
-    ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
-}
+function esc(s) { return require('../../src/module-api').escapeHtml(s); } // the one server escaper (task 1004876)
 function factHtml(f) {
   let inner = esc(f.value);
   if (f.mono) inner = `<span class="cc-mono">${inner}</span>`;

package/modules/npm-release/preview/proxy.js

@@ -29,9 +29,8 @@ function withoutPreviewCookie(cookieHeader) {
     .join('; ');
 }
 
-function escapeHtml(s) {
-  return String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
-}
+// The one server escaper, through the doorway (task 1004876); this copy used to skip '.
+const { escapeHtml } = require('../../../src/module-api');
 
 /** The banner markup: which version this is, which one the hall runs, and the way out. */
 function bannerHtml({ viewing, running, exitHref }) {

package/modules/npm-release/public/task-widget.js

@@ -16,7 +16,7 @@
   'use strict';
 
   const API = '/api/bongos';
-  const esc = (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const esc = (s) => window.OTB.escapeHtml(s); // the hall's shared escaper (dom-utils.js, task 1004876)
   const client = window.BongosClient && window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false });
   const DONE = ['completed', 'confirmed', 'shipped'];
 

package/modules/platform-identity/routes/sso.js

@@ -118,9 +118,7 @@ function reportAsOf(req) {
 // The /sso/authorize failures are pre-redirect (bad client / bad redirect_uri), so
 // we must render our OWN page rather than bounce to an unvalidated URI.
 function errorPage(detail) {
-  const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => (
-    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
-  ));
+  const esc = api.escapeHtml; // the one server escaper (task 1004876)
   return `<!doctype html><html lang="en"><head><meta charset="utf-8">`
     + `<meta name="viewport" content="width=device-width, initial-scale=1">`
     + `<title>Sign-in handoff failed</title></head><body>`

package/modules/provisioning/routes/callback-page.js

@@ -20,12 +20,8 @@
 
 const api = require('../../../src/module-api');
 
-// Minimal HTML escaper for the callback landing page (no template engine here).
-function esc(s) {
-  return String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
-    { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]
-  ));
-}
+// The one server escaper, through the doorway (task 1004876).
+function esc(s) { return api.escapeHtml(s); }
 
 // The way back to the project (task 1004650): the hub's return route, keyed on the attempt's
 // one-time state. The SERVER resolves that state to the project it was minted for and lands

package/modules/public-landing/public/projects.html

@@ -2173,6 +2173,7 @@ summary{min-height:24px;padding:3px 0;}
 
 <footer class="foot"><!--apex-only:start--><span>A non-profit, capture-resistant commons. </span><!--apex-only:end-->Built by agents, on <span data-brand-product-inline>Cloud&nbsp;Bongos</span>. <a href="https://www.npmjs.com/package/@bongos/core" target="_blank" rel="noopener">Open source</a> (<a href="https://www.gnu.org/licenses/agpl-3.0.html" target="_blank" rel="noopener">AGPL-3.0</a>).<nav class="footNav" aria-label="Site"><a href="/#about">About</a><a href="/docs">Docs</a><a href="/privacy">Privacy</a><a href="/terms">Terms</a><a href="/contact">Contact</a><!--apex-only:start--><a data-link-hall href="{{buildersOrigin}}">Builders' hall</a><!--apex-only:end--></nav></footer>
 
+<script src="/modules/hall-ui/public/dom-utils.js"></script>
 <script>
 /* Brand-pack fill (R57): the server injects window.__BRANDING__ ahead of this
    script; baked markup above is the standalone fallback. */
@@ -2199,11 +2200,8 @@ summary{min-height:24px;padding:3px 0;}
 
   function $(id) { return document.getElementById(id); }
 
-  function esc(s) {
-    return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
-      return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
-    });
-  }
+  /* the hall's shared escaper (dom-utils.js, loaded just above; task 1004876) */
+  function esc(s) { return window.OTB.escapeHtml(s); }
 
   /* ── the app's setup on Render (task 1004353) ──
      GET /provisioning/instances/:id/render is the one source, on both the wizard's done

package/modules/raise/raise.js

@@ -55,7 +55,7 @@ function isEditableKey(key) {
   return !!m && Number(m[1]) >= 1 && Number(m[1]) <= (DEFAULT_SETTINGS.founders || []).length;
 }
 
-const esc = (s) => String(s ?? '').replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+const { escapeHtml: esc } = require('../../src/module-api'); // the one server escaper (task 1004876)
 const usd = (n) => '$' + Math.round(n).toLocaleString('en-US');
 const TBA = '<span class="tba">TBA</span>';
 

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.181",
+  "version": "1.22.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.181",
+      "version": "1.22.1",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.181",
+  "version": "1.22.1",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -10331,18 +10331,6 @@
     {
       "id": "1004889",
       "text": "An automatic security check on search results works again, and it now really catches a private note leaking to the wrong person instead of passing by luck."
-    },
-    {
-      "id": "1004886",
-      "text": "Core releases can no longer be labelled as containing code that never actually went out."
-    },
-    {
-      "id": "1004859",
-      "text": "The Gate page is now called Autobongos. It keeps the runner controls and drops the list of held pull requests, which was always empty because the check it waited on never ran. Old links to /gate still work. The two permissions"
-    },
-    {
-      "id": "1004863",
-      "text": "Eight database tests that had quietly stopped working are repaired and now run on every change, including the one that proves an idea's author is never paid twice and the one that proves search never shows someone a page above"
     }
   ],
   "1.21.179": [
@@ -10362,5 +10350,31 @@
       "id": "1004892",
       "text": "The repo health dashboard's dead-code number now counts the same way the CI check does, so it no longer jumps by about 1,800 false alarms from modules/."
     }
+  ],
+  "1.21.182": [
+    {
+      "id": "1004890",
+      "text": "Removed a leftover permission-list checker that nothing in the product used; the real protections and their tests are unchanged."
+    }
+  ],
+  "1.22.0": [
+    {
+      "id": "1004886",
+      "text": "Core releases can no longer be labelled as containing code that never actually went out."
+    },
+    {
+      "id": "1004859",
+      "text": "The Gate page is now called Autobongos. It keeps the runner controls and drops the list of held pull requests, which was always empty because the check it waited on never ran. Old links to /gate still work. The two permissions"
+    },
+    {
+      "id": "1004863",
+      "text": "Eight database tests that had quietly stopped working are repaired and now run on every change, including the one that proves an idea's author is never paid twice and the one that proves search never shows someone a page above"
+    }
+  ],
+  "1.22.1": [
+    {
+      "id": "1004876",
+      "text": "Builder-written text now goes through one safety filter in the browser and one on the server instead of 42 hand-made copies, six of which let a stray quote through — and a check stops a new copy from creeping back."
+    }
   ]
 }