@bongos/core 1.21.27 → 1.21.29

package/tests/goal_map_page.mjs

@@ -431,9 +431,9 @@ await test('the page is the sky\'s own surface — the same sheet and the same s
   assert.match(html, /<main id="hall-main" class="sky-stage">/, 'the sky is drawn in the stage, the skip link\'s target');
   const scripts = (h) => [...h.matchAll(/<script src="\/builders\/([^"?]+)\?v=([^"]+)"/g)].map((m) => [m[1], m[2]]);
   // criterion-uat-ui.js (task 1004402): the rings' UAT state words, shared with the goal page.
-  assert.deepEqual(scripts(html).filter((s) => s[0] !== 'shell.js').map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
+  assert.deepEqual(scripts(html).filter((s) => !['shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0])).map((s) => s[0]), ['idea-objects.js', 'criterion-uat-ui.js', 'sky-data.js', 'sky-layout.js', 'sky-draw.js', 'sky-interaction.js', 'sky-panel.js', 'sky-composer.js', 'sky-tour.js']);
   // Both doors load the shell (tasks 1004327, 1004430); the SKY's files are the same.
-  const skyScripts = (h) => scripts(h).filter((s) => s[0] !== 'shell.js');
+  const skyScripts = (h) => scripts(h).filter((s) => !['shell-trail.js', 'craft-mode.js', 'shell.js'].includes(s[0]));
   assert.deepEqual(skyScripts(html), skyScripts(thinking), 'the two doors load the same sky files at the same stamp');
   assert.equal(html.match(/thinking\.css\?v=([^"]+)/)[1], thinking.match(/thinking\.css\?v=([^"]+)/)[1]);
   assert.match(read('thinking.css'), /body\[data-page\] \.sky-stage \{/, 'the sheet dresses the one stage both doors draw in inside the hall');

package/tests/hall_city.mjs

@@ -253,7 +253,7 @@ test('the city sits in the hall chrome, behind the shell\'s full-screen switch',
   for (const id of ['app-sidebar', 'app-scrim', 'app-topbar']) assert.match(html, new RegExp(`id="${id}"`), id);
   assert.match(html, /<main id="hall-main" class="city-main">\s*<div class="city-top">/, 'the stage is the one <main>, the strip inside it');
   const scripts = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts, ['shell', 'palette', 'city-draw', 'city'], 'the shell first, as on every hall page');
+  assert.deepEqual(scripts, ['shell-trail', 'craft-mode', 'shell', 'palette', 'city-draw', 'city'], 'the shell first, as on every hall page');
   const css = read('city.css').replace(/\/\*[\s\S]*?\*\//g, '');
   assert.match(css, /\.city-main \{ position: fixed; top: var\(--topbar-h, 56px\); left: var\(--sidebar-w-rail, 64px\);[^}]*contain: layout paint;/);
   assert.match(css, /html\[data-fullscreen="on"\] \.city-main \{ top: 0; left: 0; \}/);

package/tests/hall_fullscreen.mjs

@@ -22,6 +22,8 @@ import { fileURLToPath } from 'node:url';
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const HALL = path.join(ROOT, 'modules/hall-ui/public');
 const SHELL = fs.readFileSync(path.join(HALL, 'shell.js'), 'utf8');
+// task 1004492: the way back lives in shell-trail.js, which every page loads first.
+const TRAIL = fs.readFileSync(path.join(HALL, 'shell-trail.js'), 'utf8');
 const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
 
 // Boot the shell once — one page load. `store` is the browser's localStorage and
@@ -121,6 +123,7 @@ function boot({ page = 'thinking', optIn = true, store = {}, storageThrows = fal
   };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
+  vm.runInContext(TRAIL, sandbox, { filename: 'shell-trail.js' });
   vm.runInContext(SHELL, sandbox, { filename: 'shell.js' });
   const root = documentObj.documentElement;
   return {

package/tests/hall_street.mjs

@@ -376,7 +376,7 @@ test('the page holds the prototype\'s header, the street, the readings and the c
   assert.match(html, /<a class="street-mark" id="streetHome" href="\/builders\/city"[^>]*>\{\{productName\}\}</);
   for (const id of ['hudNeeds', 'hudMoving', 'hudShare', 'streetMode', 'streetSigns', 'streetPins', 'streetDoors', 'streetCard']) assert.match(html, new RegExp(`id="${id}"`), id);
   const scripts = [...html.matchAll(/<script src="\/builders\/([a-z-]+)\.js/g)].map((m) => m[1]);
-  assert.deepEqual(scripts, ['shell', 'palette', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-amend', 'street'], 'the hall shell (task 1004544), the shared kit, then the card (task 1004528), the interiors (task 1004526) and the drafted amendment (task 1004530)');
+  assert.deepEqual(scripts, ['shell-trail', 'craft-mode', 'shell', 'palette', 'city-draw', 'street-draw', 'street-card', 'street-inside', 'street-amend', 'street'], 'the hall shell (task 1004544), the shared kit, then the card (task 1004528), the interiors (task 1004526) and the drafted amendment (task 1004530)');
   assert.equal(City.STREET_HREF, '/builders/street', 'the city\'s door is this page');
 });
 

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-02-trail/);
+    assert.match(HTML, /shell\.js\?v=2026-10-02-craft/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '901fc3252b096ce6';
+const SHELL_SHA = '8932abeda77f250a';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/provisioning_callback_page.mjs

@@ -38,7 +38,7 @@ test('esc renders an absent value as the empty string, never "null"/"undefined"'
   assert.equal(esc(false), 'false');
 });
 
-test('the progress variant escapes the title + domain it interpolates', () => {
+test('the hand-back variant escapes the title + domain it interpolates', () => {
   const html = callbackPage({
     ok: true,
     title: 'Setting up <your> instance',
@@ -49,9 +49,9 @@ test('the progress variant escapes the title + domain it interpolates', () => {
   assert.match(html, /evil&quot;\.example\.com/, 'the domain rides through esc');
   assert.doesNotMatch(html, /Setting up <your> instance/, 'no raw title anywhere on the page');
   assert.doesNotMatch(html, /https:\/\/evil"\.example\.com/, 'no unescaped domain in an href');
-  // it IS the progress variant: the stepper + the config block the client script reads
-  assert.match(html, /id="steps"/);
-  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com"\}/);
+  // it IS the hand-back variant (task 1004548): the way back + the config block the client script reads
+  assert.match(html, /id="back" href="\/projects\?view=new"/);
+  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com","back":"\/projects\?view=new"\}/);
 });
 
 test('the message variant escapes the title but passes server-authored body HTML through', () => {
@@ -63,7 +63,7 @@ test('the message variant escapes the title but passes server-authored body HTML
   assert.match(html, /<h1>This setup link has &lt;expired&gt;<\/h1>/);
   assert.match(html, /<div class="sub"><p>Ask the owner for a fresh link\.<\/p><\/div>/,
     'body is trusted server-authored HTML — the route composes it, a request never does');
-  assert.doesNotMatch(html, /id="steps"/, 'no stepper without ok + state + domain');
+  assert.doesNotMatch(html, /id="back"/, 'no hand-back without ok + state + domain');
   assert.match(html, /badge-warn">⚠️</, 'a failure wears the warning badge');
 });
 

package/tests/provisioning_github_app_routes.mjs

@@ -93,44 +93,43 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=GHCODE123&state=GOODSTATE`);
   const html = await res.text();
-  t('good state → 200 text/html progress page wired to auto-open', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /Setting up your instance/.test(html) && /Placing credentials/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
+  t('good state → 200 text/html hand-back page', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /GitHub app created/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
   t('the page names the instance host', /mercury\.example\.com/.test(html));
-  // task 1003236: a same-tab return (pop-up blocked → form target=_self) must never be
-  // navigated away from the checklist. The page carries a hidden way back, and the
-  // countdown sits behind the pop-up guard.
-  t('carries a hidden "finish your remaining setup steps" link back to the wizard', /<p class="muted hidden" id="back"><a href="\/projects\?view=new">Finish your remaining setup steps/.test(html));
-  t('the auto-open countdown is reachable only past the pop-up guard', /var popup=!!window\.opener\|\|window\.name==='ghAppSetup';/.test(html) && /if\(!popup\)\{[^}]*return;\}\s*var n=4;\(function tick\(\)\{if\(n<=0\)\{location\.href=target;/.test(html) && (html.match(/location\.href=target/g) || []).length === 1);
+  // task 1004548: the founder no longer waits here — the page hands them back to the
+  // checklist, which shows the wait. A manual way back is always on the page.
+  t('carries a plain "back to my checklist" link (works without script)', /<a class="btn" id="back" href="\/projects\?view=new">Back to my checklist/.test(html));
+  t('no progress stepper or countdown left on the page', !/id="steps"/.test(html) && !/Placing credentials/.test(html) && !/location\.href=target/.test(html));
 
   // Run the served script itself (not a copy) against a minimal DOM, once as the
-  // wizard's pop-up and once as a same-tab return, and watch what it does to location.
+  // wizard's pop-up and once as a same-tab return, and watch what it does.
   const script = (html.match(/<script>\s*(\(function\(\)\{[\s\S]*?)<\/script>\s*<\/body>/) || [])[1];
-  t('the progress page ships the client script', typeof script === 'string' && script.length > 200);
-  async function runCallback({ opener, name }) {
+  t('the hand-back page ships the client script', typeof script === 'string' && script.length > 100);
+  async function runCallback({ opener }) {
     const vm = await import('node:vm');
-    const el = () => { const cls = new Set(); return { textContent: '', classList: { add: (...c) => c.forEach((x) => cls.add(x)), remove: (...c) => c.forEach((x) => cls.delete(x)), contains: (c) => cls.has(c) }, querySelector: () => el() }; };
-    const els = { steps: el(), status: el(), cta: el(), go: el(), foot: el(), back: el() };
-    els.steps.querySelector = () => el();
-    els.back.classList.add('hidden'); els.cta.classList.add('hidden');
+    const back = { href: '/projects?view=new' };
     const timers = [];
+    const calls = { close: 0, focusOpener: 0, replaced: null };
     const sandbox = {
-      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com' },
-      opener, name,
-      document: { getElementById: (id) => els[id] || null },
-      location: { pathname: '/api/bongos/provisioning/github-app/callback', href: 'about:callback' },
-      fetch: async () => ({ ok: true, json: async () => ({ ok: true, ready: true, status: 'done' }) }),
+      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com', back: '/projects?view=new' },
+      opener: opener ? { closed: false, focus: () => { calls.focusOpener++; } } : null,
+      close: () => { calls.close++; },
+      document: { getElementById: (id) => (id === 'back' ? back : null) },
+      location: { replace: (u) => { calls.replaced = u; } },
       setTimeout: (fn) => { timers.push(fn); return timers.length; },
       encodeURIComponent,
     };
     sandbox.window = sandbox;
     vm.runInNewContext(script, sandbox);
-    for (let i = 0; i < 5; i++) await new Promise((r) => setImmediate(r)); // let the poll's promise chain settle
-    for (let guard = 0; guard < 10 && timers.length; guard++) { const fn = timers.shift(); fn(); }
-    return { href: sandbox.location.href, go: els.go.textContent, backHidden: els.back.classList.contains('hidden'), foot: els.foot.textContent };
+    const replacedBeforeTimer = calls.replaced;
+    while (timers.length) timers.shift()();
+    return { ...calls, replacedBeforeTimer, backHref: back.href };
   }
-  const popup = await runCallback({ opener: {}, name: 'ghAppSetup' });
-  t('as the wizard’s pop-up it still counts down and opens the instance', popup.href === 'https://mercury.example.com', JSON.stringify(popup));
-  const sameTab = await runCallback({ opener: null, name: '' });
-  t('as a same-tab return it stays put: door shown, way back revealed, no navigation', sameTab.href === 'about:callback' && sameTab.go === 'Open mercury.example.com →' && sameTab.backHidden === false && /checklist is waiting/.test(sameTab.foot), JSON.stringify(sameTab));
+  const want = '/projects?view=new#ghstate=GOODSTATE';
+  const popup = await runCallback({ opener: true });
+  t('as the wizard’s pop-up it focuses the checklist tab and closes itself', popup.focusOpener === 1 && popup.close === 1 && popup.replacedBeforeTimer === null, JSON.stringify(popup));
+  t('…and if the browser refuses the close, the pop-up becomes the checklist', popup.replaced === want, JSON.stringify(popup));
+  const sameTab = await runCallback({ opener: false });
+  t('as a same-tab return it goes straight back to the checklist, carrying the attempt in the fragment', sameTab.close === 0 && sameTab.replaced === want && sameTab.backHref === want, JSON.stringify(sameTab));
 }
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=X&state=NOPE`);

package/tests/wizard_auto_open.mjs

@@ -0,0 +1,94 @@
+// tests/wizard_auto_open.mjs — the checklist's "Open my project automatically when it's
+// ready" tick (task 1004548).
+//
+// WHY. The GitHub-App callback page used to hold the founder on its own stepper and open
+// the instance itself. Since task 1004548 it hands them straight back to the checklist,
+// so the auto-open moved there. The rule it must keep: open ONCE, only when sign-in is
+// wired AND the project answers, only after a wait this page actually watched (so a
+// revisit to a long-finished checklist never jumps away), never when the founder
+// unticked it — and prefer a new tab, falling back to this one when the browser blocks
+// an unprompted tab.
+//
+// Executed, not read: the real AUTO_OPEN_KEY…maybeAutoOpen region is sliced out of the
+// page's inline script and run in a node:vm under stubs (the vm-slice idiom of
+// tests/wizard_intent_resume.mjs). The slice boundaries are asserted, so a rename fails
+// loudly instead of testing nothing.
+//
+// Run:  node --test tests/wizard_auto_open.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+
+const START = SCRIPT.indexOf("    var AUTO_OPEN_KEY = 'cb-open-when-ready';");
+const END = SCRIPT.indexOf('    /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow', START);
+const SLICE = SCRIPT.slice(START, END);
+
+test('the auto-open region is still findable (a rename must fail loudly)', () => {
+  assert.ok(START > 0 && END > START, 'both slice boundaries found');
+  assert.match(SLICE, /function maybeAutoOpen\(\)/);
+  assert.match(SLICE, /function autoOpenTick\(\)/);
+});
+
+const READY = { manifest: 'done', instStatus: 'active', addrReady: true };
+
+function run({ live = READY, armed = true, pref = null, popupBlocked = false, ticks = 1 } = {}) {
+  const store = new Map();
+  if (pref !== null) store.set('cb-open-when-ready', pref);
+  const calls = { opened: [], assigned: [] };
+  const sandbox = {
+    live: { ...live },
+    resolvedDomain: () => 'mercury.example.com',
+    localStorage: { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, v) },
+    window: {
+      open: (u, t) => { calls.opened.push([u, t]); return popupBlocked ? null : { opener: 'checklist' }; },
+      location: { assign: (u) => { calls.assigned.push(u); } },
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(`${SLICE}\nautoOpenArmed = ${armed ? 'true' : 'false'};\nfor (var i = 0; i < ${ticks}; i++) maybeAutoOpen();\nvar tickHtml = autoOpenTick();`, sandbox);
+  return { calls, sandbox };
+}
+
+test('ready + armed + ticked (the default) → opens the project ONCE, in a new tab', () => {
+  const { calls } = run({ ticks: 3 });
+  assert.deepEqual(calls.opened, [['https://mercury.example.com', '_blank']], 'one new tab, however many renders follow');
+  assert.deepEqual(calls.assigned, [], 'this checklist stays put');
+});
+
+test('a browser that blocks the unprompted tab sends THIS tab instead — the founder asked', () => {
+  const { calls } = run({ popupBlocked: true });
+  assert.deepEqual(calls.assigned, ['https://mercury.example.com']);
+});
+
+test('nothing opens until sign-in is wired AND the project answers', () => {
+  for (const live of [
+    { ...READY, manifest: 'code_received' },
+    { ...READY, instStatus: 'provisioning' },
+    { ...READY, addrReady: false },
+  ]) {
+    const { calls } = run({ live });
+    assert.deepEqual([calls.opened, calls.assigned], [[], []], JSON.stringify(live));
+  }
+});
+
+test('unticked → never opens, and the tick renders unticked', () => {
+  const { calls, sandbox } = run({ pref: '0' });
+  assert.deepEqual([calls.opened, calls.assigned], [[], []]);
+  assert.doesNotMatch(sandbox.tickHtml, / checked/);
+  assert.match(run().sandbox.tickHtml, / checked>/, 'the default is ticked');
+});
+
+test('a checklist that never watched the wait (a revisit) does not jump away', () => {
+  const { calls } = run({ armed: false });
+  assert.deepEqual([calls.opened, calls.assigned], [[], []]);
+});

package/tests/wizard_intent_resume.mjs

@@ -70,10 +70,10 @@ test('both slices are still findable (a rename must fail loudly, not silently pa
 // A faithful miniature: the stubs record what enterCreated ASKS FOR, which is the whole
 // contract — which panel is shown, whether the answers were reset, and what the offer
 // above step 1 was told to name.
-function runEnter({ focus, resumeIntent = false, draft = null, record }) {
+function runEnter({ focus, resumeIntent = false, draft = null, record, handbackState = null }) {
   const store = new Map();
   if (draft) store.set('draft', JSON.stringify(draft));
-  const calls = { show: [], resets: 0, offer: [], done: 0, progress: [], polls: 0, focused: 0 };
+  const calls = { show: [], resets: 0, offer: [], done: 0, progress: [], polls: 0, focused: 0, remembered: [] };
   // state.step is the DONE step for the whole life of a finished standup — the value
   // a draft-blind reading would have trusted
   const state = { step: draft ? draft.step : 6, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
@@ -83,6 +83,8 @@ function runEnter({ focus, resumeIntent = false, draft = null, record }) {
     live: { manifest: null, appSlug: null },
     manifestState: null,
     manifestPending: false,
+    handbackState,   // the #ghstate=… a GitHub hand-back carries (task 1004548); null on a plain arrival
+    rememberManifest(st, status) { calls.remembered.push([st, status]); },
     sessionStorage: { getItem: (k) => (store.has(k) ? store.get(k) : null) },
     resetForNewProject() { calls.resets += 1; state.step = 1; state.name = ''; state.slug = ''; },
     paintResumeOffer(c) { calls.offer.push(c ? (c.name || c.slug) : null); },
@@ -111,6 +113,19 @@ test('a reload / Back / identity settle (focus false) still resumes the done pan
   assert.deepEqual(calls.offer, [null], 'the offer is down — the done panel is on stage, not step 1');
 });
 
+test('a hand-back from the GitHub callback page resumes watching THAT attempt (task 1004548)', () => {
+  const { calls, sandbox } = runEnter({ focus: false, record: { ...REC }, handbackState: 'ab'.repeat(32) });
+  assert.deepEqual(calls.show, [[6, false]], 'the founder lands on their checklist');
+  assert.equal(sandbox.manifestState, 'ab'.repeat(32), 'the sign-in step polls the attempt GitHub just approved');
+  assert.equal(sandbox.manifestPending, true, 'and the poll is queued for resumePolls()');
+  assert.equal(sandbox.live.manifest, 'code_received', 'it shows the wait, not "Set up GitHub sign-in" again');
+  assert.deepEqual(calls.remembered, [['ab'.repeat(32), 'code_received']], 'the attempt is kept across a reload');
+  assert.equal(sandbox.handbackState, null, 'read once — a later arrival is not a hand-back');
+  const done = runEnter({ focus: false, record: { ...REC, manifest: 'done' }, handbackState: 'cd'.repeat(32) });
+  assert.equal(done.sandbox.live.manifest, 'done', 'a finished setup is never walked back to waiting');
+  assert.equal(done.sandbox.manifestPending, false, 'and nothing is polled for it');
+});
+
 test('a deliberate "New project" click after a finished standup opens a FRESH step 1', () => {
   const { calls, state } = runEnter({ focus: true, record: REC });
   assert.equal(calls.done, 0, 'the previous project\'s done panel is not painted');