@bongos/core 1.21.60 → 1.21.61

package/modules/hall-ui/public/project-settings.css

@@ -214,3 +214,8 @@
    the 24px floor: the prose-link recipe buys the height with padding and hands it back
    with an equal negative margin, so the line does not re-space. */
 .dp-settled .ov-row__sub a { display: inline-block; min-height: 24px; padding: 3px 0; margin: -3px 0; }
+
+/* The danger zone (task 1004570) — two links out to the hosting platform, each with
+   one sentence saying what it does. Plain list, the lede's measure. */
+.ps-danger__list { margin: 10px 0 0; padding-left: 18px; line-height: 1.6; max-width: var(--measure); }
+.ps-danger__list li + li { margin-top: 8px; }

package/modules/hall-ui/public/project-settings.html

@@ -49,6 +49,18 @@
                thing this page exists to end. -->
           <div id="ps-rows"><span class="kit-skel"></span></div>
         </section>
+        <!-- Danger zone (task 1004570): where this project's OWNER takes it offline or
+             disconnects it. Both controls live on the platform that hosts the project,
+             so this only links there. Hidden unless GET /project/manage-link answers
+             with a link — an Archon on a hosted project; never on a self-hosted one. -->
+        <section class="scroll" id="ps-danger" aria-labelledby="ps-danger-h" hidden>
+          <h2 class="scroll__h" id="ps-danger-h">Danger zone</h2>
+          <p class="scroll__lede"><span id="ps-danger-lede"></span> <a id="ps-danger-manage" href="#"></a></p>
+          <ul class="ps-danger__list">
+            <li><a id="ps-danger-offline" href="#">Take it offline</a> — stops the project and its nightly backups but keeps everything: its database, its backups and your repository on GitHub. You can bring it back.</li>
+            <li><a id="ps-danger-disconnect" href="#">Disconnect from Bongos entirely</a> — erases the project’s server, its database and every backup, and releases its name and web address. Your repository on GitHub is kept. This cannot be undone.</li>
+          </ul>
+        </section>
       </main>
 
       <footer class="app-foot" id="app-foot"></footer>

package/modules/hall-ui/public/project-settings.js

@@ -245,5 +245,25 @@
     }
   }
 
+  // The danger zone (task 1004570). The server answers only an Archon — on a hosted
+  // project, its owner — and answers { link: null } where there is no hosting platform
+  // to link to, so every other outcome (refused, failed, self-hosted) leaves the section
+  // hidden: a missing link, never a dead one. The act itself stays on the platform.
+  async function loadDanger() {
+    let link = null;
+    try {
+      const res = await api.request('GET', `${API}/project/manage-link`);
+      link = res.ok && res.data ? res.data.link : null;
+    } catch (_) { link = null; }
+    if (!link || !link.offline_url || !link.disconnect_url) return;
+    $('ps-danger-lede').textContent = `This project is hosted on ${link.hub_host}, and that is where it is taken offline or removed. Both links below open this project’s page there.`;
+    $('ps-danger-manage').textContent = `Manage this project on ${link.hub_host}`;
+    $('ps-danger-manage').href = link.manage_url;
+    $('ps-danger-offline').href = link.offline_url;
+    $('ps-danger-disconnect').href = link.disconnect_url;
+    $('ps-danger').hidden = false;
+  }
+
   load();
+  loadDanger();
 })();

package/modules/hall-ui/records/project-danger-zone.md

@@ -0,0 +1,10 @@
+# The danger zone on /project-settings — a hosted project's owner reaches Take-offline and Delete (task 1004570)
+
+The owner of a hosted project could not find how to delete it: both controls live on the hub's Projects page, and nothing in the project's own hall pointed there. What this settled:
+
+- **Link-out only.** The section links to the hub's page for this project, scrolled to the `#mDelete` / `#mDisconnect` cards. The typed-name confirm and the intent queue stay on the hub (ADR 0290); the hall gains no second delete path.
+- **The server decides who sees it.** `GET /project/manage-link` is Archon-only (on a hosted project the owner is its Archon), and answers `{ link: null }` when the instance has no hub to link to — a self-hosted instance, or the hub itself. The section is `hidden` in the markup and shown only for a real link, so every other outcome is a missing section, never a dead link.
+- **The link names the project by slug.** The hall knows its hub origin and client id (which is its slug, ADR 0246) from its sign-in configuration, never a hardcoded domain. The hub's Projects page resolves `?view=manage&project=<slug>` against the visitor's OWN projects; a slug that is not theirs opens their list, not someone else's project. The slug survives a sign-in detour.
+- **The two sentences track the hub's folds.** `tests/project_manage_link.mjs` holds the hall's claims (repository kept, cannot be undone, can bring it back) against the hub's own fold copy.
+
+Tests: `tests/project_manage_link.mjs` (C1 owner link, C2 non-owner refused by the real gate, C3 self-hosted answers none). Harness fixture: `project__manage-link.json`.

package/modules/public-landing/public/projects.html

@@ -2477,6 +2477,13 @@ summary{min-height:24px;padding:3px 0;}
      the ?view=manage&id=N deep link, read by loadManage() */
   var manageId = null;
   var manageInst = null;
+  /* a project's own hall links here by SLUG (task 1004570): it knows its slug, not
+     this page's instance id. Held until the visitor's own projects load, then
+     resolved against THOSE only — a slug that is not yours opens nothing. The
+     section (#mDelete / #mDisconnect) is held too, because setView rewrites the
+     URL and drops the hash before the manage view has painted. */
+  var handedProject = null;
+  var handedSection = null;
 
   function viewFromUrl() {
     var v;
@@ -2486,6 +2493,8 @@ summary{min-height:24px;padding:3px 0;}
       var id = null;
       try { id = new URLSearchParams(location.search).get('id'); } catch (e) {}
       if (id) { manageId = String(id); return 'manage'; }
+      try { handedProject = new URLSearchParams(location.search).get('project') || null; } catch (e) {}
+      if (handedProject && /^#m(Delete|Disconnect)$/.test(location.hash || '')) handedSection = location.hash.slice(1);
       return 'mine';
     }
     return VIEWS[v] ? v : 'map';
@@ -2526,8 +2535,10 @@ summary{min-height:24px;padding:3px 0;}
        sign-in door on the hub's own pages carries the repo scope (task 1004549,
        ADR 0364): it is asked once, at sign-in, and held for the whole session, so
        no flow ever stops halfway to ask for it */
-    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects%3Fview%3D' + v +
-      idPart.replace('&', '%26').replace('=', '%3D') + '&repos=1';
+    /* a hand-off that is still waiting on sign-in keeps its slug through the door */
+    var backPart = handedProject ? encodeURIComponent('?view=manage&project=' + handedProject)
+      : '%3Fview%3D' + v + idPart.replace('&', '%26').replace('=', '%3D');
+    $('signinTop').href = '/api/bongos/auth/web/start?return=/projects' + backPart + '&repos=1';
     /* the mine view is the only one that polls; it re-reads on entry so a
        card that changed while you were on the map is not stale — including
        the membership + invitations lists (task 1003774), the same re-read
@@ -3324,6 +3335,16 @@ summary{min-height:24px;padding:3px 0;}
      opens that project's own manage view — the per-project page the
      manage-wave tasks fill in. It replaced the scroll-anchor-into-the-list
      this function used to do. ── */
+  /* the hall's hand-off (task 1004570): the slug becomes one of YOUR projects or
+     nothing — this page stays on your list rather than guessing */
+  function openHandedProject() {
+    if (!handedProject) return;
+    var slug = handedProject;
+    handedProject = null;
+    var inst = ownedInstances.filter(function (i) { return i && i.slug === slug; })[0];
+    if (inst) goToManage(inst.id);
+    else handedSection = null;
+  }
   function goToManage(instId) {
     manageId = String(instId || '');
     manageInst = null;
@@ -8609,6 +8630,12 @@ summary{min-height:24px;padding:3px 0;}
         var inst = data.instance || {};
         inst.open_intent = data.open_intent || null;
         renderManage(inst);
+        /* the hall's hand-off named a card — land on it once the page has its content */
+        if (handedSection) {
+          var target = $(handedSection);
+          handedSection = null;
+          if (target && target.scrollIntoView) target.scrollIntoView({ block: 'start' });
+        }
         /* the SECOND, GitHub-backed read — fired only here (entry + tab
            return), never from renderManage, which the fetch-free tick calls */
         if (!keepRepo) loadRepoVisibility(inst);
@@ -10841,7 +10868,7 @@ summary{min-height:24px;padding:3px 0;}
       $('gate').hidden = true;
       $('mine').hidden = false;
       load();
-      return Promise.all([loadMemberships(), loadOwnedInstances(), loadInvites()]);
+      return Promise.all([loadMemberships(), loadOwnedInstances(), loadInvites()]).then(openHandedProject);
     })
     .catch(function (err) {
       me = null;

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.60",
+  "version": "1.21.61",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.60",
+      "version": "1.21.61",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.60",
+  "version": "1.21.61",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9132,5 +9132,11 @@
       "id": "1004553",
       "text": "Builders can now save their filter settings on the Goals and Tasks pages as named views, pick one to open the page with, and find them again on any device. Each builder's views are private to them."
     }
+  ],
+  "1.21.61": [
+    {
+      "id": "1004570",
+      "text": "A project owner now sees a Danger zone in their project's settings, with links straight to the place where they can take the project offline or delete it. Nobody else sees it, and self-hosted projects don't show it."
+    }
   ]
 }

package/src/bongos/routes/core-update.js

@@ -50,6 +50,23 @@ function hubDeployUrl(config) {
   return `${config.origin.replace(/\/+$/, '')}/deploy?project=${encodeURIComponent(String(config.clientId))}`;
 }
 
+// WHERE THIS PROJECT'S OWNER TAKES IT OFFLINE OR DISCONNECTS IT (task 1004570). Both
+// controls live on the hub's Projects page for this project — the typed-name confirm and
+// the intent queue are there (ADR 0290) — so the hall only links to them and gains no
+// second delete path. Same two inputs as hubDeployUrl (the hub origin and this project's
+// client id, which is its slug); null on a self-hosted instance or the hub itself, so the
+// hall shows no section rather than a dead link. The page resolves ?project=<slug>
+// against the visitor's OWN projects, so the link opens nothing for anyone else.
+function hubManageLinks(config) {
+  if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
+  if (!/^https?:\/\/[^\s"'<>]+$/i.test(config.origin)) return null;
+  const origin = config.origin.replace(/\/+$/, '');
+  const page = `${origin}/projects?view=manage&project=${encodeURIComponent(String(config.clientId))}`;
+  let host = origin;
+  try { host = new URL(origin).host; } catch { /* keep the origin as written */ }
+  return { hub_host: host, manage_url: page, offline_url: `${page}#mDelete`, disconnect_url: `${page}#mDisconnect` };
+}
+
 // WHERE THIS PROJECT'S UPDATE BUTTON GOES (task 1004296). The act itself never happens in
 // Settings: it is the deploy door's two-step confirm and auto-rollback (ADR 0293), and that
 // door is the provisioning module's — so only a hall that runs provisioning has one.
@@ -216,9 +233,25 @@ function buildCoreUpdateRouter({
     }, { errorCode: 'software_update_failed', message: false }),
   );
 
+  // GET /project/manage-link — the hub's page for THIS project, where its owner takes it
+  // offline or disconnects it (task 1004570). On a hosted project the owner is its Archon,
+  // so the read is Archon-only: a builder below that is refused and the hall draws no
+  // section. { link: null } on a self-hosted instance (no hub to link to).
+  // rank: archon — the project's owner; it names where the project can be ended.
+  router.get(
+    '/project/manage-link',
+    auth.requireBuilder,
+    auth.requireRank('archon'),
+    asyncHandler('GET /project/manage-link', async (_req, res) => {
+      const { idp } = doorInputs();
+      res.json({ ok: true, link: hubManageLinks(idp) });
+    }, { errorCode: 'manage_link_failed', message: false }),
+  );
+
   return router;
 }
 
 module.exports = buildCoreUpdateRouter;
+module.exports.hubManageLinks = hubManageLinks;
 module.exports.hubDeployUrl = hubDeployUrl;
 module.exports.coreUpdateDocketMatters = coreUpdateDocketMatters;

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.60'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.61'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/project_manage_link.mjs

@@ -0,0 +1,111 @@
+// tests/project_manage_link.mjs — a hosted project's owner reaches Take-offline and
+// Delete from their own hall (task 1004570). These EXECUTE: the link builder against
+// real inputs, and real HTTP requests through the assembled router with only
+// requireBuilder replaced, so the Archon gate that refuses a non-owner is the real one.
+//
+// Run:  node --test tests/project_manage_link.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.NODE_ENV = 'test';
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const { hubManageLinks } = require_(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+
+const HUB = { origin: 'https://hub.example.com/', clientId: 'mercury' };
+
+test('the link opens THIS project on the hub, at the two cards', () => {
+  assert.deepEqual(hubManageLinks(HUB), {
+    hub_host: 'hub.example.com',
+    manage_url: 'https://hub.example.com/projects?view=manage&project=mercury',
+    offline_url: 'https://hub.example.com/projects?view=manage&project=mercury#mDelete',
+    disconnect_url: 'https://hub.example.com/projects?view=manage&project=mercury#mDisconnect',
+  });
+});
+
+test('no hub (self-hosted, or the hub itself) means no link, never a wrong one', () => {
+  assert.equal(hubManageLinks(null), null);
+  assert.equal(hubManageLinks({ origin: 'https://hub.example.com' }), null, 'no client id');
+  assert.equal(hubManageLinks({ origin: 'javascript:alert(1)', clientId: 'x' }), null, 'not an http origin');
+  assert.equal(hubManageLinks({ origin: 'https://hub.example.com/"><script>', clientId: 'x' }), null);
+});
+
+// One server per test: requireBuilder is swapped for a stub that seats the rank the
+// request names, and the route module is re-required so it captures the stub.
+async function withServer(idp, fn) {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/core-update.js'));
+  const realAuth = r2(authPath);
+  const saved = realAuth.requireBuilder;
+  realAuth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, rank: req.get('x-rank') }; next(); };
+  delete r2.cache[routePath];
+  const express = r2('express');
+  const { attachFail } = r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+  const app = express();
+  app.use(attachFail);
+  app.use(r2(routePath)({ doorInputs: () => ({ provisioning: false, idp }) }));
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const get = (rank) => fetch(`http://127.0.0.1:${server.address().port}/project/manage-link`, { headers: { 'x-rank': rank } });
+  try { await fn(get); } finally {
+    server.close();
+    realAuth.requireBuilder = saved;
+    delete r2.cache[routePath];
+  }
+}
+
+test('C1: the owner (the hosted project\'s Archon) gets the link', async () => {
+  await withServer(HUB, async (get) => {
+    const res = await get('archon');
+    assert.equal(res.status, 200);
+    assert.equal((await res.json()).link.offline_url, 'https://hub.example.com/projects?view=manage&project=mercury#mDelete');
+  });
+});
+
+test('C2: a builder of the same project below Archon is refused by the server', async () => {
+  await withServer(HUB, async (get) => {
+    for (const rank of ['metic', 'thetes', 'xenos']) {
+      const res = await get(rank);
+      assert.equal(res.status, 403, `${rank} is refused`);
+      assert.equal(JSON.stringify(await res.json()).includes('hub.example.com'), false, `${rank} learns nothing`);
+    }
+  });
+});
+
+test('C3: a self-hosted instance answers no link', async () => {
+  await withServer(null, async (get) => {
+    const res = await get('archon');
+    assert.equal(res.status, 200);
+    assert.equal((await res.json()).link, null);
+  });
+});
+
+test('the hall section is hidden in the markup and shown only for a real link', () => {
+  const html = read('modules/hall-ui/public/project-settings.html');
+  assert.match(html, /<section class="scroll" id="ps-danger"[^>]*\bhidden>/);
+  const js = read('modules/hall-ui/public/project-settings.js');
+  assert.match(js, /if \(!link \|\| !link\.offline_url \|\| !link\.disconnect_url\) return;/);
+  assert.match(js, /\/project\/manage-link/);
+});
+
+test('the hub resolves the slug against the visitor\'s OWN projects only', () => {
+  const page = read('modules/public-landing/public/projects.html');
+  assert.match(page, /ownedInstances\.filter\(function \(i\) \{ return i && i\.slug === slug; \}\)\[0\]/);
+  assert.match(page, /\.then\(openHandedProject\)/);
+});
+
+test('the hall\'s two sentences say what the hub\'s own folds promise', () => {
+  const hall = read('modules/hall-ui/public/project-settings.html');
+  const hub = read('modules/public-landing/public/projects.html');
+  for (const claim of ['repository on GitHub', 'cannot be undone', 'bring it back', 'Take it offline', 'Disconnect from Bongos entirely']) {
+    assert.ok(hall.includes(claim), `the hall says "${claim}"`);
+    assert.ok(hub.includes(claim), `the hub says "${claim}" too`);
+  }
+});