@bongos/core 1.21.67 → 1.21.68

package/.bongos-core.json

@@ -2,11 +2,11 @@
   "artifact": "bongos-core",
   "manifest_schema": 1,
   "generator": "scripts/gds/package-core.js",
-  "core_version": "1.21.67",
-  "core_contract": "1.21.67",
-  "source_commit": "d47aad0e873a78904c981b809062792003207822",
+  "core_version": "1.21.68",
+  "core_contract": "1.21.68",
+  "source_commit": "905d458be330f20adcb3a7d845df43fee7eff689",
   "source_ref": "HEAD",
-  "built_at": "2026-10-06T17:54:50.385Z",
+  "built_at": "2026-10-06T18:26:22.762Z",
   "redaction": {
     "model": "docs-redacted+functional-verbatim",
     "docs_redacted": 587,
@@ -17,7 +17,7 @@
     "gate": "passed"
   },
   "file_count": 3583,
-  "tree_sha256": "9e5acb92e763d8ffaa8cb3f51ed15d92cc5da78a0db387f5660313ef3f59f675",
+  "tree_sha256": "a902270fa53256d93862bf90030c31725f778c4a86e45b3e7ab48660dbb1a34f",
   "files": [
     {
       "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2847,7 +2847,7 @@
     {
       "path": "docs/module-api-changelog.md",
       "mode": "0000644",
-      "sha256": "3a8483f3b1bfeee5129f0b3120d559517d2379e729932680dbf370acb53c909f"
+      "sha256": "fd5870bc0ed7adb62a63d1339b2922163ef6dcd5e38d183b2902c7767782b5bd"
     },
     {
       "path": "docs/modules-contract.md",
@@ -2937,7 +2937,7 @@
     {
       "path": "docs/page-readings.json",
       "mode": "0000644",
-      "sha256": "4475500bd02e0c2e381609268b87fdc939d932112e9b9e1f0a3ff31488ff2c57"
+      "sha256": "7e8658d86ed640ea55dad973f0f39b124d6f8960d87c7dab17981c0365f64436"
     },
     {
       "path": "docs/project-context.template.md",
@@ -9212,7 +9212,7 @@
     {
       "path": "modules/public-landing/public/invitations.html",
       "mode": "0000644",
-      "sha256": "6775f25bdae0f80419e6523e4b368b62812040f5cfb34c1ae23b42b55c468be3"
+      "sha256": "5b0b779c53f00f20d298c168e680b0f95334d6919869b4b4560e2dab534f4bdd"
     },
     {
       "path": "modules/public-landing/public/invitations.probes.json",
@@ -10037,12 +10037,12 @@
     {
       "path": "package-lock.json",
       "mode": "0000644",
-      "sha256": "debdf805f0e43fa453b07b17ff192faa8d15d81ba6795dd1299aad6f2b4f7349"
+      "sha256": "9bf9f4221d7b278a8bc8220046fea675373e383d3588e644f0727b2ac942ddb5"
     },
     {
       "path": "package.json",
       "mode": "0000644",
-      "sha256": "c9398b668bd9a5ecc85766696dd81915f885e31084452ffe85098135e106f082"
+      "sha256": "36e78f9f5af0899ec6d026bc20abdce4e5a467130e639d432238d677cac0aa36"
     },
     {
       "path": "public-docs/index.html",
@@ -10062,7 +10062,7 @@
     {
       "path": "release-notes.json",
       "mode": "0000644",
-      "sha256": "a688b82430fa5d9dd691f76bea6f7e5429d82b9151189093f2c3d167aa7c5449"
+      "sha256": "125ba1b20b6eb21664bccbfa277c61a65a58920b48a7a26126a4782d7e48ad26"
     },
     {
       "path": "scripts/cron/style_guide_audit.sh",
@@ -12282,7 +12282,7 @@
     {
       "path": "src/module-api.js",
       "mode": "0000644",
-      "sha256": "b36016a91228286215541459f863b968e74aa6d83e58d6ca024392c7793ac8d2"
+      "sha256": "46c686b3ad977c0ebf004d351746e3fa5491de0d2898c873c4604c9edfce5f5c"
     },
     {
       "path": "src/module-loader/catalog.js",
@@ -14852,7 +14852,7 @@
     {
       "path": "tests/hub_invitations_page.mjs",
       "mode": "0000644",
-      "sha256": "f8da457dce58c17c623a976cf650a0abfd31fafb516ddc0c0c074d45871458a2"
+      "sha256": "7ac7c55c05086c04759d80aa70011cf51b3574bcb97801922b38e127f16e044b"
     },
     {
       "path": "tests/hub_invite_notices.mjs",

package/docs/module-api-changelog.md

@@ -2966,5 +2966,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.21.65 with no explicit bump. run 37486828045. (task 1002620)
   1.21.67 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.21.66 with no explicit bump. run 37507134428. (task 1002620)
+  1.21.68 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.21.67 with no explicit bump. run 37511231885. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/docs/page-readings.json

@@ -4423,7 +4423,7 @@
       "surface": "landing",
       "title": "{{productName}} — Invitations",
       "states_read": ["out","in","in-join-applied","in-profile","in-engagements","in-engagement-note","in-engagement-applied","in-guild-cards","in-guild-count-off","in-guild-joined","in-empty","in-pick-open","in-pick-typed","in-pick-chosen"],
-      "files_hash": "f47d2b458c7d82fe",
+      "files_hash": "8c3aa9ca65130b98",
       "reading_hash": "9306d59204f55cc2",
       "counts": {"lines":60,"placed":14,"shared":10,"unplaced":36},
       "omitted": {"data":14},

package/modules/public-landing/public/invitations.html

@@ -197,6 +197,12 @@
       return (u.protocol === 'https:' || u.protocol === 'http:') ? u.href : '';
     } catch (e) { return ''; }
   }
+  /* hostOf is for DISPLAY: it tolerates a bare or half-typed address and drops
+     a leading www, so a row reads "example.com". pickHost (the join picker,
+     below) is for MATCHING: new URL().host keeps www and any port, so it agrees
+     exactly with the origins the server stores, and the picker's mine/applied
+     maps and the "Applied" echo key on that. Folding one into the other would
+     either mislabel rows or miss matches. */
   function hostOf(origin) {
     return String(origin || '').replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*$/, '').toLowerCase();
   }
@@ -222,16 +228,16 @@
     return row;
   }
 
-  /* the leave/decline shape: disable, POST, drop the row on success, restore
-     the button on failure. `onRemoved` carries whatever else the caller needs
-     after the row is gone (the empty-line flip). */
-  function postThenRemoveRow(url, row, btn, idleLabel, onRemoved) {
+  /* the decline shape: disable, POST, drop the row on success, re-enable the
+     button on failure. `onRemoved` carries whatever else the caller needs after
+     the row is gone (the empty-line flip). The busy/idle label swap the /projects
+     copy carries is for its Leave button, which never moved here. */
+  function postThenRemoveRow(url, row, btn, onRemoved) {
     btn.disabled = true;
-    if (idleLabel) btn.textContent = idleLabel.busy;
     fetch(url, { method: 'POST', credentials: 'same-origin' })
       .then(function (r) { return r.ok ? r.json() : Promise.reject(); })
       .then(function () { row.remove(); if (onRemoved) onRemoved(); })
-      .catch(function () { btn.disabled = false; if (idleLabel) btn.textContent = idleLabel.idle; });
+      .catch(function () { btn.disabled = false; });
   }
 
   /* Each invitation renders as a way IN, never an Accept button: the hub's own
@@ -266,7 +272,7 @@
       decline.textContent = 'Decline';
       decline.addEventListener('click', function () {
         postThenRemoveRow(
-          API + '/my-projects/invites/' + encodeURIComponent(inv.client_id) + '/decline', row, decline, null,
+          API + '/my-projects/invites/' + encodeURIComponent(inv.client_id) + '/decline', row, decline,
           paintInvitesSection
         );
       });
@@ -856,8 +862,11 @@
     list.hidden = false;
     input.setAttribute('aria-expanded', 'true');
   }
+  /* once the feed is cached a keystroke renders once; only the first open
+     paints "Loading projects…" and then re-renders when the reads settle */
   function openPicker() {
     renderPicker();
+    if (picker.projects) return;
     loadPicker().then(function () {
       if (document.activeElement === $('joinOrigin')) renderPicker();
     });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.67",
+  "version": "1.21.68",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.67",
+      "version": "1.21.68",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.67",
+  "version": "1.21.68",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9182,5 +9182,11 @@
       "id": "1004257",
       "text": "The cloudbongos.com landing page now has a \"Download the CLI\" button in its closing section. It picks the right download for the visitor's computer and lists the others. It stays hidden until a CLI release is published, so not"
     }
+  ],
+  "1.21.68": [
+    {
+      "id": "1004589",
+      "text": "The /invitations project picker now draws its list once per keystroke instead of twice. Nothing looks different."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.67'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.68'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/hub_invitations_page.mjs

@@ -253,6 +253,21 @@ test('the picker lists the map minus the hub, an anonymous row and your own proj
   assert.equal(ui.$('joinOrigin').value, '', 'an Applied row cannot be picked again');
 });
 
+test('the picker: once the map is cached, a keystroke renders the list once (task 1004589)', async () => {
+  const ui = await boot({ me: { github_login: 'octocat' }, reads: { '/projects/featured': FEED, '/my-projects': MINE } });
+  const input = ui.$('joinOrigin');
+  let renders = 0;
+  const set = input.setAttribute;
+  input.setAttribute = (k, v) => { if (k === 'aria-expanded' && v === 'true') renders++; return set(k, v); };
+  await ui.fire(input, 'focus');
+  assert.equal(renders, 2, 'the first open paints "Loading projects…", then the list when the reads settle');
+  renders = 0;
+  input.value = 'grove';
+  await ui.fire(input, 'input');
+  assert.equal(renders, 1, 'not a second time when the already-settled read resolves again');
+  assert.deepEqual(optionsOf(ui).map((o) => o.children[0].textContent), ['The Grove']);
+});
+
 test('the picker narrows by name or address, and the keyboard picks: arrows skip an Applied row, Enter fills the address, Escape closes', async () => {
   const ui = await boot({ me: { github_login: 'octocat' }, reads: { '/projects/featured': FEED, '/my-projects': MINE } });
   const input = ui.$('joinOrigin');