@bongos/core 1.21.68 → 1.21.70

package/modules/platform-identity/instance-feedback.js

@@ -21,6 +21,15 @@
 // an absent rank as untrusted, so even the owner's own feedback waits for the nod
 // rather than inheriting a hub rank the instance never vouched for.
 //
+// TWO DOORS IN (task 1004591). The relay above needs the project linked to the hub,
+// which many are not, so the CLI now sends STRAIGHT here (POST /sso/feedback/direct)
+// with a one-time receipt from its own project (src/bongos/routes/feedback.js).
+// The hub answers at once, then redeems the receipt at the project's public URL:
+// the project names the signed-in sender and the hash of the text, and only a
+// matching report is filed. A project on the hub's own domain is one we run, so
+// its word is verified; any other domain is printed as "confirmed by <host>".
+// The relay stays for projects on cores older than the receipt.
+//
 // THE ATTRIBUTION IS THE HUB'S, NOT THE INSTANCE'S. Client credentials prove WHICH
 // PROJECT is calling and nothing about WHO sent it, so the sender must hold a
 // membership on that project carrying the hub's own sign-in witness
@@ -86,8 +95,11 @@ function feedbackTitle(message) {
   return `Feedback: ${title}`;
 }
 
-function feedbackBody({ message, client, account, githubId, context = {} }) {
-  const who = account && account.github_login ? `@${account.github_login}` : `GitHub user ${githubId}`;
+function feedbackBody({ message, client, account, githubId, context = {}, vouch = null }) {
+  // vouch (direct reports only): { hosted, host, login } — the receipt's word.
+  const claimed = vouch && typeof vouch.login === 'string' && /^[A-Za-z0-9-]{1,39}$/.test(vouch.login) ? vouch.login : null;
+  const who = account && account.github_login ? `@${account.github_login}`
+    : claimed ? `@${claimed} (GitHub user ${githubId})` : `GitHub user ${githubId}`;
   const project = client.name ? `${client.name} (${client.origin || client.client_id})` : (client.origin || client.client_id);
   const stamps = [
     ['Core', cleanStamp(context.core_version)],
@@ -97,10 +109,13 @@ function feedbackBody({ message, client, account, githubId, context = {} }) {
   // The hub's own attribution comes FIRST and the sender's words follow as a
   // quote, so text they type can never pose as the footer a reviewer trusts.
   const quoted = String(message).trim().split('\n').map((l) => `> ${l}`).join('\n');
+  const vouchLine = !vouch ? []
+    : [`- Sender: ${vouch.hosted ? 'verified (a project Cloud Bongos hosts)' : `confirmed by ${vouch.host} (self-hosted, not verified by us)`}`];
   return [
-    'Sent from a managed project with `bongos feedback`.',
+    vouch ? 'Sent with `bongos feedback`.' : 'Sent from a managed project with `bongos feedback`.',
     `- Project: ${project}`,
     `- Sent by: ${who}`,
+    ...vouchLine,
     ...(stamps ? [`- Running: ${stamps}`] : []),
     '',
     quoted,
@@ -110,12 +125,15 @@ function feedbackBody({ message, client, account, githubId, context = {} }) {
 // fileInstanceFeedback — file one relayed report. `deps.capture` is the
 // `ideas.capture` port; `deps.getAccount` and `deps.hubBuilderId` read the hub's
 // own rows for the sender. Returns the landing the CLI prints.
-async function fileInstanceFeedback({ client, githubId, message, kind, context }, deps) {
-  const account = await deps.getAccount(githubId).catch(() => null);
-  const capturedBy = await deps.hubBuilderId(githubId).catch(() => null);
+async function fileInstanceFeedback({ client, githubId, message, kind, context, vouch = null }, deps) {
+  // A self-hosted project's word cannot borrow a hub account: its owner could
+  // name anyone's GitHub id, so the hub's login and builder row stay unread.
+  const trusted = !vouch || vouch.hosted;
+  const account = trusted ? await deps.getAccount(githubId).catch(() => null) : null;
+  const capturedBy = trusted ? await deps.hubBuilderId(githubId).catch(() => null) : null;
   const idea = await deps.capture({
     title: feedbackTitle(message),
-    bodyMd: feedbackBody({ message, client, account, githubId, context }),
+    bodyMd: feedbackBody({ message, client, account, githubId, context, vouch }),
     kind: FEEDBACK_KINDS[kind],
     capturedBy,
     filerRank: null, // untrusted by design — see the header
@@ -129,7 +147,90 @@ async function fileInstanceFeedback({ client, githubId, message, kind, context }
     : { landed: 'inbox', idea_id: String(idea.id) };
 }
 
+// ── the direct door (task 1004591) ───────────────────────────────────────────
+
+const RECEIPT_TIMEOUT_MS = 8000;
+
+function sha256Hex(text) {
+  return require('node:crypto').createHash('sha256').update(String(text), 'utf8').digest('hex');
+}
+
+// projectOrigin — the caller-named project, accepted only as a bare https origin
+// on a DNS name (no IP literal, no port, no path, no userinfo). Null otherwise.
+function projectOrigin(raw) {
+  let u;
+  try { u = new URL(String(raw || '')); } catch { return null; }
+  if (u.protocol !== 'https:' || u.port || u.username || u.password) return null;
+  if (u.pathname !== '/' && u.pathname !== '') return null;
+  if (u.search || u.hash) return null;
+  const host = u.hostname.toLowerCase();
+  if (!host.includes('.') || require('node:net').isIP(host.replace(/^\[|\]$/g, ''))) return null;
+  if (/(^|\.)(localhost|local|internal|test|invalid)$/.test(host)) return null;
+  return { origin: `https://${host}`, host };
+}
+
+// isHostedBy — a project on the hub's own domain (or the hub itself) is one we run.
+function isHostedBy(host, hubHost) {
+  const h = String(hubHost || '').toLowerCase();
+  return !!h && (host === h || host.endsWith(`.${h}`));
+}
+
+// verifyDirectReport — redeem the receipt at the project and check it matches.
+// Resolves { ok: true, receipt } or { ok: false, reason }; never throws. The
+// address is attacker-named, so the host must resolve to a public address
+// (deps.assertPublicHost) and a redirect is an error, never followed.
+async function verifyDirectReport({ origin, receipt, message, kind }, deps) {
+  const target = projectOrigin(origin);
+  if (!target) return { ok: false, reason: 'bad_origin' };
+  if (!/^[A-Za-z0-9_-]{16,64}$/.test(String(receipt || ''))) return { ok: false, reason: 'bad_receipt' };
+  try {
+    await deps.assertPublicHost(target.host);
+  } catch {
+    return { ok: false, reason: 'private_host' };
+  }
+  let body;
+  try {
+    const res = await (deps.fetchImpl || fetch)(`${target.origin}/api/bongos/feedback/receipt/${receipt}`, {
+      headers: { accept: 'application/json' },
+      redirect: 'error',
+      signal: AbortSignal.timeout(RECEIPT_TIMEOUT_MS),
+    });
+    if (res.status !== 200) return { ok: false, reason: `receipt_http_${res.status}` };
+    body = await res.json();
+  } catch {
+    return { ok: false, reason: 'receipt_unreachable' };
+  }
+  if (!body || typeof body !== 'object') return { ok: false, reason: 'receipt_malformed' };
+  if (!/^\d{1,20}$/.test(String(body.github_id || ''))) return { ok: false, reason: 'receipt_malformed' };
+  if (body.sha256 !== sha256Hex(message)) return { ok: false, reason: 'text_mismatch' };
+  if ((body.kind || 'bug') !== kind) return { ok: false, reason: 'kind_mismatch' };
+  return { ok: true, target, receipt: body };
+}
+
+// fileDirectReport — the whole after-the-202 half: verify, then file. Returns the
+// landing, or { dropped: reason } for a report the project did not vouch for.
+async function fileDirectReport({ origin, receipt, message, kind, context = {}, hubHost }, deps) {
+  const v = await verifyDirectReport({ origin, receipt, message, kind }, deps);
+  if (!v.ok) return { dropped: v.reason };
+  const githubId = String(v.receipt.github_id);
+  const hosted = isHostedBy(v.target.host, hubHost);
+  return fileInstanceFeedback({
+    client: { name: v.target.host, origin: v.target.origin, client_id: v.target.host },
+    githubId,
+    message,
+    kind,
+    // The project's own core version beats whatever the CLI claimed.
+    context: { ...context, core_version: v.receipt.core_version || null },
+    vouch: { hosted, host: v.target.host, login: v.receipt.github_login },
+  }, deps);
+}
+
 module.exports = {
+  sha256Hex,
+  projectOrigin,
+  isHostedBy,
+  verifyDirectReport,
+  fileDirectReport,
   FEEDBACK_KINDS,
   MESSAGE_MAX,
   PER_SENDER_LIMIT,

package/modules/platform-identity/routes/sso.js

@@ -30,9 +30,25 @@ const applicationEcho = require('../application-echo');
 // The guild label the echo carries (task 1002303, ADR 0365 D5).
 const guildEngagements = require('../guild-engagements');
 const instanceFeedback = require('../instance-feedback');
+const projectStats = require('../project-stats');
 
 // One limiter per hub process for POST /sso/feedback (task 1004462).
 const feedbackLimiter = instanceFeedback.makeFeedbackLimiter();
+// …and two for POST /sso/feedback/direct (task 1004591), which carries no
+// credential: one keyed by the caller's address ALONE, so naming a fresh host on
+// every request buys nothing, and one by the named project and address.
+const directIpLimiter = instanceFeedback.makeFeedbackLimiter();
+const directFeedbackLimiter = instanceFeedback.makeFeedbackLimiter();
+
+// The hub's own host: a direct report from it or a subdomain of it comes from a
+// project we run. Best-effort — no host means nothing counts as hosted. Read once.
+let _hubHost = null;
+function hubHost() {
+  if (_hubHost === null) {
+    try { _hubHost = new URL(api.branding().domains.publicOrigin).hostname.toLowerCase(); } catch { _hubHost = ''; }
+  }
+  return _hubHost;
+}
 
 // Per-IP cap for POST /sso/applicant-profile — DEFENCE IN DEPTH behind the echo
 // gate, not the gate itself (task 1002972 grade advisory). The echo already
@@ -781,5 +797,60 @@ module.exports = function ssoRoutes() {
     }
   });
 
+  // POST /sso/feedback/direct — `bongos feedback` straight from a builder's CLI,
+  // with a one-time receipt from their own project (task 1004591). Answers 202 at
+  // once so the builder never waits; the receipt is redeemed AFTER, and a report
+  // the project does not vouch for is dropped (logged, never filed). Why this
+  // proves the sender, and what "hosted" earns: ../instance-feedback.js.
+  //
+  // rank: public — no session on the hub; the proof is the project's receipt.
+  // Capped per caller address (10/h whatever host it names), then per named
+  // project (30/h), BEFORE anything is fetched.
+  router.post('/sso/feedback/direct', (req, res) => {
+    if (validateOrRespond(req, res, {
+      origin: { required: true, type: 'string', maxLength: 200 },
+      receipt: { required: true, type: 'string', maxLength: 64 },
+      message: { required: true, type: 'string', maxLength: instanceFeedback.MESSAGE_MAX },
+      kind: { type: 'string', enum: Object.keys(instanceFeedback.FEEDBACK_KINDS) },
+      context: {},
+    })) return;
+    const b = req.body || {};
+    const target = instanceFeedback.projectOrigin(b.origin);
+    if (!target) return res.fail('bad_origin', 400);
+    const message = String(b.message).trim();
+    if (!message) return res.fail('message_required', 400);
+    // The address's own bucket first (both of its tiers keyed by the address, so
+    // no bucket is shared between callers); only an address still under its cap
+    // may spend from the named project's bucket — a refused caller costs a real
+    // project nothing.
+    const ip = String(req.ip || 'unknown');
+    let allowed = directIpLimiter.take(ip, 'direct');
+    if (allowed.ok) allowed = directFeedbackLimiter.take(target.host, ip);
+    if (!allowed.ok) {
+      res.set('Retry-After', String(allowed.retryAfter));
+      return res.fail('rate_limited', 429, { scope: `feedback-${allowed.scope}`, retry_after_seconds: allowed.retryAfter });
+    }
+    res.status(202).json({ ok: true, accepted: true });
+    const ctx = b.context && typeof b.context === 'object' ? b.context : {};
+    instanceFeedback.fileDirectReport({
+      origin: target.origin,
+      receipt: b.receipt,
+      message: b.message,
+      kind: b.kind || 'bug',
+      context: { cli_version: ctx.cli_version, os: ctx.os },
+      hubHost: hubHost(),
+    }, {
+      assertPublicHost: (host) => projectStats.assertPublicHost(host),
+      capture: (...a) => api.resolve('ideas.capture')(...a),
+      getAccount: (id) => pi.getAccount(id, { pool }),
+      hubBuilderId: async (id) => {
+        const { rows } = await pool.query('SELECT id FROM builders WHERE github_id = $1 LIMIT 1', [id]);
+        return rows[0] ? rows[0].id : null;
+      },
+    }).then((r) => {
+      if (r && r.dropped) log.warn(`[platform-identity] /sso/feedback/direct dropped from ${target.host}: ${r.dropped}`);
+    }, (err) => log.error('[platform-identity] /sso/feedback/direct', err));
+  });
+
   return router;
 };

package/modules/public-landing/public/account.html

@@ -10,7 +10,8 @@
      once, and every project's hall links out to it instead of keeping a copy.
      Hub-only: platform-server.js serves /account only where platform-identity
      is on, because every read and write below is one of that module's own-scoped
-     routes (GET/PATCH /me/cross-project, PATCH /me/handle, PATCH /me/profile).
+     routes (GET/PATCH /me/cross-project, PATCH /me/handle, PATCH /me/profile,
+     GET /my-projects and POST /my-projects/:clientId/leave).
      Server-stamped like the footer doors: {{…}} tokens filled by landingPage(). -->
 <title>{{productName}} — Your account</title>
 <meta name="description" content="Your {{productName}} account: your handle, your name, your bio and links, and who can find you.">
@@ -245,6 +246,24 @@
         <p class="projMsg" id="recordMsg" role="status" aria-live="polite"></p>
       </form>
     </section>
+
+    <!-- PROJECTS YOU BUILD ON — GET /my-projects building[], Leave → POST
+         /my-projects/:clientId/leave (task 1003774). Moved here from
+         /projects?view=mine by task 1004277: the owner's call of 2026-09-25 put it
+         on the builder's own profile, own view only, and with no hub profile page
+         built (/u/<handle> was abandoned) this page is that own view (the owner's
+         pick, 2026-10-06). Cross-project data, so never on a project hall's seat
+         profile. The rows are cosmos.css's .mineRow, as on /invitations. -->
+    <section class="aSec" id="aBuilding" aria-labelledby="aBuilding-h">
+      <h2 id="aBuilding-h">projects you build on</h2>
+      <p class="aSide">The projects you have joined as a builder. Only you see this list.</p>
+      <div class="aBody">
+        <p class="aWhat" id="buildingLoading">Reading the projects you build on…</p>
+        <p class="aWhat" id="buildingEmpty" hidden>You’re not building on any other projects yet.</p>
+        <ul class="mineRows" id="buildingList"></ul>
+        <p class="projMsg" id="buildingMsg" role="status" aria-live="polite"></p>
+      </div>
+    </section>
   </div>
 </main>
 
@@ -323,6 +342,12 @@
       $('loading').hidden = true;
       $('door').hidden = true;
       $('acctBody').hidden = false;
+      // a link to one section (/projects' "Open your account" names #aBuilding)
+      // lands on it: the browser looked for the anchor while the body was hidden
+      var hash = window.location && window.location.hash;
+      var target = hash && document.getElementById(hash.slice(1));
+      if (target && typeof target.scrollIntoView === 'function') target.scrollIntoView();
+      loadBuilding();
     }, function () { showAlert('Couldn’t reach the server — check your connection and refresh.'); });
   }
 
@@ -530,6 +555,68 @@
       : 'Cross-project record shown on your public profile.');
   });
 
+  // ---- projects you build on (task 1004277; the rows and Leave came from
+  // /projects?view=mine, task 1003774). Read once the account is shown, on its
+  // own: a failed read says so and never paints a false "not building on
+  // anything". The map's mineOrigins clean-up stayed behind with the map —
+  // /projects re-reads GET /my-projects whenever it is opened. ----
+  function hostOf(origin) {
+    return String(origin || '').replace(/^https?:\/\//, '').replace(/^www\./, '').replace(/\/.*$/, '').toLowerCase();
+  }
+  function rowEl(tag, cls) { var e = document.createElement(tag); if (cls) e.className = cls; return e; }
+  function loadBuilding() {
+    var msg = $('buildingMsg');
+    return request('GET', '/my-projects').then(function (res) {
+      $('buildingLoading').hidden = true;
+      if (!res.ok || !res.data) { say(msg, 'Couldn’t read the projects you build on — refresh in a moment.', 'err'); return; }
+      paintBuilding(res.data.building || []);
+    }, function () {
+      $('buildingLoading').hidden = true;
+      say(msg, 'Couldn’t reach the server — check your connection and refresh.', 'err');
+    });
+  }
+  function paintBuilding(rows) {
+    var ul = $('buildingList');
+    ul.textContent = '';
+    rows.forEach(function (m) { ul.appendChild(buildingRow(m)); });
+    $('buildingEmpty').hidden = rows.length > 0;
+  }
+  function buildingRow(m) {
+    var label = m.name || m.client_id;
+    var row = rowEl('li', 'mineRow');
+    var main = rowEl('div', 'mineRow__main');
+    var name = rowEl('div', 'mineRow__name');
+    name.textContent = label;
+    main.appendChild(name);
+    var host = hostOf(m.origin);
+    if (host) { var h = rowEl('span', 'mineRow__host'); h.textContent = host; main.appendChild(h); }
+    row.appendChild(main);
+    var actions = rowEl('div', 'mineRow__actions');
+    var btn = document.createElement('button');
+    btn.type = 'button';
+    btn.className = 'btn small ghost';
+    btn.textContent = 'Leave';
+    // every row's button reads Leave; the name says which project it leaves
+    btn.setAttribute('aria-label', 'Leave ' + label);
+    btn.addEventListener('click', function () { leave(m.client_id, label, row, btn); });
+    actions.appendChild(btn);
+    row.appendChild(actions);
+    return row;
+  }
+  function leave(clientId, label, row, btn) {
+    var msg = $('buildingMsg');
+    function restore() { btn.disabled = false; btn.textContent = 'Leave'; }
+    btn.disabled = true;
+    btn.textContent = 'Leaving…';
+    request('POST', '/my-projects/' + encodeURIComponent(clientId) + '/leave').then(function (res) {
+      if (res.status === 401) { restore(); sessionGone(msg); return; }
+      if (!res.ok) { restore(); say(msg, 'Couldn’t leave ' + label + '. Try again.', 'err'); return; }
+      row.remove();
+      say(msg, 'You left ' + label + '.', 'ok');
+      if (!$('buildingList').children.length) $('buildingEmpty').hidden = false;
+    }, function () { restore(); say(msg, 'Couldn’t reach the server. Try again.', 'err'); });
+  }
+
   // The identity read failing is not a sign-out. If the account itself was
   // read, the chip names it from that answer, so the way out is never lost.
   load().then(function () { return bar.ready; }).then(function () {

package/modules/public-landing/public/account.probes.json

@@ -30,6 +30,15 @@
     { "name": "hiding the record saves hide_stats alone", "continue": true,
       "steps": [["click", "#aRecord .aOpt:nth-child(2)"], ["click", "#recordSave"], ["wait", 400]],
       "expect": { "text": [["#recordMsg", "Cross-project record hidden — removed from your profile and directories immediately."]], "checked": "input[name=record][value=hide]" } },
+    { "name": "projects you build on (task 1004277): one row per project, each with its own Leave", "auth": true, "width": 1440, "url": "/account#aBuilding",
+      "steps": [["wait", 500]],
+      "expect": { "count": [["#buildingList .mineRow", 2]], "attr": [["#buildingList .mineRow:first-child button", "aria-label", "Leave Example World"], ["#buildingList .mineRow:last-child button", "aria-label", "Leave Emersonian Circles"]], "hidden": ["#buildingEmpty"] } },
+    { "name": "Leave drops the row and says so", "continue": true,
+      "steps": [["click", "#buildingList .mineRow:first-child button"], ["wait", 300]],
+      "expect": { "count": [["#buildingList .mineRow", 1]], "text": [["#buildingMsg", "You left Example World."]], "hidden": ["#buildingEmpty"] } },
+    { "name": "leaving the last project shows the empty line", "continue": true,
+      "steps": [["click", "#buildingList .mineRow:first-child button"], ["wait", 300]],
+      "expect": { "count": [["#buildingList .mineRow", 0]], "text": [["#buildingMsg", "You left Emersonian Circles."], ["#buildingEmpty", "You’re not building on any other projects yet."]], "visible": ["#buildingEmpty"] } },
     { "name": "the hub's bar: the chip names the person, both bands closed, the page starts under the bar (task 1004455)", "auth": true, "width": 1440,
       "steps": [["wait", 400]],
       "expect": { "expanded": false, "top": [["#acct", 64]], "visible": ["#projTrig", "#who"], "hidden": ["#signinTop", "#menuProjects", "#menuProfile"], "text": [["#whoLogin", "builder"]], "count": [["#mapQ", 0]] } },

package/modules/public-landing/public/account.states.json

@@ -1,5 +1,5 @@
 {
-  "_": "The account page's states for modules/ui-design/kit/render.js (task 1004259, ADR 0337 D4.3): signed out it is the sign-in door and nothing else; signed in it is the hub's bar (task 1004455: the identity chip from GET /me, the Projects band and the profile band with Account current) over the four sections, painted from the stub's one account (fixtures/me__cross-project.json — public, recruiters following the profile setting, a bio and two links). Dark only, like every apex page (ADR 0204). The private, hidden, not-yet-published account renders from account-private.states.json.",
+  "_": "The account page's states for modules/ui-design/kit/render.js (task 1004259, ADR 0337 D4.3): signed out it is the sign-in door and nothing else; signed in it is the hub's bar (task 1004455: the identity chip from GET /me, the Projects band and the profile band with Account current) over the five sections, painted from the stub's one account (fixtures/me__cross-project.json — public, recruiters following the profile setting, a bio and two links), the fifth being the projects you build on, from fixtures/my-projects.json (task 1004277; in-building lands on it through /account#aBuilding). Dark only, like every apex page (ADR 0204). The private, hidden, not-yet-published account renders from account-private.states.json.",
   "page": "/account",
   "surface": "public-landing",
   "modes": ["dark"],
@@ -12,6 +12,7 @@
     "in": { "auth": true, "actions": [["wait", 400]], "expect": { "visible": ["#acctBody", "#fName", "#fBio", "#fHandle", "#recWhat", "#recordLine", "#who"], "text": [["#whoLogin", "builder"], ["#recordLine", "Your record: 3 projects · 1000 credits · 19 works shipped · 10 karma."]], "hidden": ["#door", "#loading", "#signinTop", "#menuProjects", "#menuProfile"], "value": [["#fHandle", "builder"], ["#fName", "A Builder"], ["#fLinkX", "https://x.com/builder"]] } },
     "in-projects-band": { "auth": true, "actions": [["wait", 400], ["click", "#projTrig"], ["wait", 300]], "expect": { "visible": ["#menuProjects", "#mineCell"], "hidden": ["#menuProfile"] } },
     "in-profile-band": { "auth": true, "actions": [["wait", 400], ["click", "#who"], ["wait", 300]], "expect": { "visible": ["#menuProfile"], "hidden": ["#menuProjects"], "text": [["#bandWhoLogin", "builder"], ["#menuProfile [aria-current=\"page\"]", "Account"]] } },
+    "in-building": { "auth": true, "url": "/account#aBuilding", "actions": [["wait", 500]], "expect": { "visible": ["#aBuilding", "#buildingList"], "hidden": ["#buildingEmpty", "#buildingLoading"], "count": [["#buildingList .mineRow", 2]], "text": [["#buildingList .mineRow:first-child .mineRow__name", "Example World"], ["#buildingList .mineRow:first-child .mineRow__host", "example.com"]], "attr": [["#buildingList .mineRow:first-child button", "aria-label", "Leave Example World"]] } },
     "in-privacy": { "auth": true, "actions": [["wait", 400], ["click", "#aPrivacy .aOpt:nth-child(2)"], ["wait", 150]], "expect": { "checked": "input[name=visibility][value=private]", "text": [["#recWhat", "They will see your name, your picture, your roles, and whether you have been active in the last 30 days — never your credits, works shipped, karma, or the projects you build on. This is the one thing a recruiter can see while your profile page is private. Turning this off removes you from both recruiting surfaces — the recruiting directory, and a recruiter’s look-up of one builder — straight away. · For now this follows your profile page setting."]] } }
   },
   "reducedMotion": { "auth": true, "actions": [["wait", 300]] }

package/modules/public-landing/public/assets/cosmos.css

@@ -1305,6 +1305,9 @@ p.sec-p{font-size:var(--fs-lede);font-weight:500;color:var(--ink-soft);line-heig
    (this content is a stacked list, not a label/value pair). ── */
 .mineExtra section{margin-top:30px;padding-top:26px;border-top:1px solid var(--rule-soft);}
 .mineExtra h2{font-family:var(--font-display);font-weight:300;font-size:clamp(20px,2.2vw,24px);letter-spacing:-.02em;line-height:1.15;text-transform:lowercase;color:var(--ink);margin:0 0 14px;}
+/* the mine view's two ways out (to /invitations and /account) are links in a
+   sentence; inline-block lets each clear the kit's 24px target floor */
+#view-mine .mineExtra .lede a{display:inline-block;min-height:24px;}
 .mineRows{list-style:none;display:flex;flex-direction:column;gap:0;margin:0;padding:0;}
 .mineRow{display:flex;align-items:center;justify-content:space-between;gap:16px;padding:14px 0;border-top:1px solid var(--rule-soft);}
 .mineRows .mineRow:first-child{border-top:0;}

package/modules/public-landing/public/projects.html

@@ -955,20 +955,22 @@ summary{min-height:24px;padding:3px 0;}
         <ul class="projects" id="projectsList"></ul>
         <p class="finePrint">Buttons here ask the platform to act; each row reports only what was verified, and when. A standup keeps going even with this tab closed.</p>
 
-        <!-- ══ PROJECTS YOU BUILD ON (task 1003774) · the way to INVITATIONS ══
+        <!-- ══ the ways to INVITATIONS and to PROJECTS YOU BUILD ON ══
              The invitations (a project's own, a guild's, a guild's engagements, the
              requests to a guild you own) and the join-by-address field have their own
-             page since task 1004276 (the owner's call, ADR 0337 D5): /invitations. ══ -->
+             page since task 1004276 (the owner's call, ADR 0337 D5): /invitations.
+             The projects you build on, with Leave (task 1003774), moved to the
+             account page with task 1004277: the owner put them on the builder's own
+             profile, and /account is the hub's own view of it. ══ -->
         <div class="mineExtra">
           <section aria-labelledby="mineToInvitesH">
             <h2 id="mineToInvitesH">Invitations</h2>
             <p class="lede">Invitations from projects and guilds, and applying to a project by its address, have their own page. <a href="/invitations">Open your invitations</a></p>
           </section>
 
-          <section aria-labelledby="mineBuildingH">
-            <h2 id="mineBuildingH">Projects you build on</h2>
-            <p class="mineEmpty" id="buildingEmpty" hidden>You’re not building on any other projects yet.</p>
-            <ul class="mineRows" id="buildingList"></ul>
+          <section aria-labelledby="mineToAccountH">
+            <h2 id="mineToAccountH">Projects you build on</h2>
+            <p class="lede">The projects you build on, and leaving one, are on your account page. <a href="/account#aBuilding">Open your account</a></p>
           </section>
         </div>
       </section>
@@ -2522,10 +2524,10 @@ summary{min-height:24px;padding:3px 0;}
       : '%3Fview%3D' + v + idPart.replace('&', '%26').replace('=', '%3D');
     $('signinTop').href = '/api/bongos/auth/web/start?return=/projects' + backPart + '&repos=1';
     /* the mine view is the only one that polls; it re-reads on entry so a
-       card that changed while you were on the map is not stale — including
-       the membership list (task 1003774), the same re-read
-       refreshList() already does for owned instances */
-    if (v === 'mine' && me) { refreshList(); loadMemberships(); }
+       card that changed while you were on the map is not stale. (It re-read
+       the memberships too while it listed the projects you build on; that
+       list is /account's since task 1004277.) */
+    if (v === 'mine' && me) refreshList();
     /* manage re-reads its project on entry — no timer lives here (C8) */
     if (v === 'manage') loadManage();
     /* owned chips refresh on re-entry, never on a timer — C8 keeps the map quiet */
@@ -3525,23 +3527,13 @@ summary{min-height:24px;padding:3px 0;}
      401 (signed out) is not an error here. */
   function loadMemberships() {
     return fetch(API + '/my-projects', { credentials: 'same-origin' })
-      .then(function (res) {
-        return res.ok
-          ? res.json().then(function (d) { return { ok: true, d: d }; })
-          : { ok: false, d: { owned: [], building: [], applied: [] } };
-      })
-      .then(function (r) {
-        var d = r.d;
+      .then(function (res) { return res.ok ? res.json() : { owned: [], building: [], applied: [] }; })
+      .then(function (d) {
         mineOrigins = {};
         appliedOrigins = {};
         (d.owned || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'owner'; });
         (d.building || []).forEach(function (m) { if (m.origin) mineOrigins[hostOf(m.origin)] = 'builder'; });
         (d.applied || []).forEach(function (m) { if (m.origin) appliedOrigins[hostOf(m.origin)] = true; });
-        /* only a genuinely successful read may repaint "Projects you build on" —
-           a transient failure resets the map's origin maps (as before) but must
-           not overwrite the list with a false "not building on anything" empty
-           state on every re-entry to this view (task 1003774) */
-        if (r.ok) renderBuildingList(d.building || []);
       })
       .catch(function () { mineOrigins = {}; appliedOrigins = {}; });
   }
@@ -3569,65 +3561,6 @@ summary{min-height:24px;padding:3px 0;}
       .catch(function () { ownedInstances = []; ownedByHost = {}; });
   }
 
-  /* ── the building-on rows (task 1003774; the invitation rows moved to
-     /invitations with task 1004276) ── Same row shape as that page's lists: a name, its host in the mono face, and one
-     action on the right. textContent-only, matching the deleted hall page
-     this restores. */
-  function mineEl(tag, cls) { var e = document.createElement(tag); if (cls) e.className = cls; return e; }
-  function mineRow(p) {
-    var row = mineEl('li', 'mineRow');
-    var main = mineEl('div', 'mineRow__main');
-    var name = mineEl('div', 'mineRow__name');
-    name.textContent = p.name || p.client_id;
-    main.appendChild(name);
-    var host = hostOf(p.origin);
-    if (host) { var h = mineEl('span', 'mineRow__host'); h.textContent = host; main.appendChild(h); }
-    row.appendChild(main);
-    return row;
-  }
-
-  /* the leave/decline shape: disable, POST, drop the row on success, restore
-     the button on failure. `onRemoved` carries whatever else the caller needs
-     after the row is gone (the empty-state flip, the mineOrigins cleanup). */
-  function postThenRemoveRow(url, row, btn, idleLabel, onRemoved) {
-    btn.disabled = true;
-    if (idleLabel) btn.textContent = idleLabel.busy;
-    fetch(url, { method: 'POST', credentials: 'same-origin' })
-      .then(function (r) { return r.ok ? r.json() : Promise.reject(); })
-      .then(function () { row.remove(); if (onRemoved) onRemoved(); })
-      .catch(function () { btn.disabled = false; if (idleLabel) btn.textContent = idleLabel.idle; });
-  }
-
-  function renderBuildingList(rows) {
-    var ul = $('buildingList');
-    ul.textContent = '';
-    (rows || []).forEach(function (m) {
-      var row = mineRow(m);
-      var actions = mineEl('div', 'mineRow__actions');
-      var btn = document.createElement('button');
-      btn.type = 'button';
-      btn.className = 'btn small ghost';
-      btn.textContent = 'Leave';
-      btn.addEventListener('click', function () {
-        postThenRemoveRow(
-          API + '/my-projects/' + encodeURIComponent(m.client_id) + '/leave', row, btn,
-          { busy: 'Leaving…', idle: 'Leave' },
-          /* the map reads mineOrigins for its "you build here" pill and Apply
-             button — clear this project's entry so a leave takes effect there
-             on the next repaint too, not just in this list (task 1003774) */
-          function () {
-            delete mineOrigins[hostOf(m.origin)];
-            if (!ul.children.length) $('buildingEmpty').hidden = false;
-          }
-        );
-      });
-      actions.appendChild(btn);
-      row.appendChild(actions);
-      ul.appendChild(row);
-    });
-    $('buildingEmpty').hidden = !!(rows && rows.length);
-  }
-
   /* the relay the map's per-card Apply (submitApply) drives — POST
      /my-projects/join, the 401 case and the 'requested' echo update kept in ONE
      place (task 1003774). /invitations carries the same relay for its join field

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.68",
+  "version": "1.21.70",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.68",
+      "version": "1.21.70",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.68",
+  "version": "1.21.70",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9188,5 +9188,16 @@
       "id": "1004589",
       "text": "The /invitations project picker now draws its list once per keystroke instead of twice. Nothing looks different."
     }
+  ],
+  "1.21.69": [
+    {
+      "id": "1004277",
+      "text": "The projects you build on, with their Leave buttons, now live on your account page. My projects links there."
+    }
+  ],
+  "1.21.70": [
+    {
+      "text": "Reporting a problem with Bongos now works from every project, including ones like Will's that could not send feedback before. It takes a second, needs no extra sign-in, and the Bongos team can see who really sent each report."
+    }
   ]
 }