@bongos/core 1.21.72 → 1.21.73

package/modules/hall-ui/public/work.html

@@ -171,9 +171,9 @@
 
 <!-- The app shell (sidebar + top bar + footer). Dependency-free; runs at parse
      time so the chrome exists before the deferred page scripts execute. -->
-<script src="/builders/shell-trail.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/craft-mode.js?v=2026-10-04-lightbulb"></script>
-<script src="/builders/shell.js?v=2026-10-04-lightbulb"></script>
+<script src="/builders/shell-trail.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/craft-mode.js?v=2026-10-08-city-tab"></script>
+<script src="/builders/shell.js?v=2026-10-08-city-tab"></script>
 <!-- jump palette (Ctrl/Cmd-K). Optional by design: without it the shell's slot stays hidden. -->
 <script src="/builders/palette.js" defer></script>
 <!-- shared frontend toolkit (window.OTB) — loaded FIRST so work.js can pull from it. -->

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.72",
+  "version": "1.21.73",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.72",
+      "version": "1.21.73",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.72",
+  "version": "1.21.73",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9242,5 +9242,11 @@
       "id": "1004578",
       "text": "While a new project is being set up, founders now get a little cloud-hopping game: each cloud is a public project on the platform, in its own planet colour. When the project goes live, clouds and stars fill the screen and fade"
     }
+  ],
+  "1.21.73": [
+    {
+      "id": "1004625",
+      "text": "The governor city now has its own tab, and in Governing mode it leads the sidebar with every other governing page tucked into one dropdown under it."
+    }
   ]
 }

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.72'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.73'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/craft_mode_nav.mjs

@@ -187,7 +187,7 @@ test('a mode never shows a tab the gate hid, and a later gate pass keeps the mod
   p.signIn('thetes');
   assert.ok(!p.showing().includes('watch'), 'a thetes in Governing does not get the metic-floored Watch tab');
   assert.ok(!p.headShowing('government'), 'nor its group head');
-  assert.deepEqual(p.showing(), ['blockers', 'board-room', 'profile', 'collab', 'roster'], 'what a thetes board member in Governing sees');
+  assert.deepEqual(p.showing(), ['blockers', 'board-room', 'city', 'profile', 'collab', 'roster'], 'what a thetes board member in Governing sees');
   p.signIn('archon');
   assert.ok(p.showing().includes('watch'), 'promoted, the gate lets it through and the mode keeps it');
   assert.ok(p.headShowing('government'), 'and its group head comes back with it, which only a mode pass after the gate can know');
@@ -202,3 +202,119 @@ test('shell.js applies the mode AFTER its gate loop, and style.css hides what th
   assert.match(read('style.css'), /#app-sidebar \[data-craft-off\] \{ display: none !important; \}/);
   assert.doesNotMatch(CRAFT, /\.hidden\s*=/, 'the mode never writes `hidden`, which the gate owns');
 });
+
+// ---------- the Governing fold (owner, 2026-10-08) ----------
+// Governing leads with the City and folds its other own tabs into one dropdown
+// under it. The fold MOVES nodes, which the parsed sidebar above cannot model, so
+// these cases run the real craft-mode.js against a small working tree: nodes with
+// parents, insertBefore and comments, laid out as shell.js's NAV groups are.
+function treeNode(tag, nodeType = 1) {
+  const attrs = {};
+  const n = {
+    tagName: tag, nodeType, id: '', className: '', dataset: {}, hidden: false, childNodes: [], parentNode: null, _html: '', type: '',
+    setAttribute(k, v) { attrs[k] = String(v); }, getAttribute(k) { return k in attrs ? attrs[k] : null; },
+    hasAttribute(k) { return k in attrs; }, removeAttribute(k) { delete attrs[k]; },
+    get classList() {
+      const self = this;
+      const list = () => self.className.split(/\s+/).filter(Boolean);
+      return {
+        contains: (c) => list().includes(c),
+        add: (c) => { if (!list().includes(c)) self.className = list().concat(c).join(' '); },
+        remove: (c) => { self.className = list().filter((x) => x !== c).join(' '); },
+        toggle(c, on) { if (on === undefined) on = !this.contains(c); if (on) this.add(c); else this.remove(c); return on; },
+      };
+    },
+    get nextSibling() { const p = this.parentNode; return p ? p.childNodes[p.childNodes.indexOf(this) + 1] || null : null; },
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+    appendChild(c) { return this.insertBefore(c, null); },
+    insertBefore(c, ref) {
+      if (c.parentNode) c.parentNode.removeChild(c);
+      const i = ref ? this.childNodes.indexOf(ref) : -1;
+      if (i === -1) this.childNodes.push(c); else this.childNodes.splice(i, 0, c);
+      c.parentNode = this;
+      return c;
+    },
+    removeChild(c) { this.childNodes.splice(this.childNodes.indexOf(c), 1); c.parentNode = null; return c; },
+    walk(fn) { for (const c of this.childNodes) { if (c.nodeType === 1) { fn(c); c.walk(fn); } } },
+    querySelectorAll(sel) { const out = []; this.walk((c) => { if (sel.startsWith('.') && c.classList.contains(sel.slice(1))) out.push(c); }); return out; },
+    querySelector(sel) { return this.querySelectorAll(sel)[0] || null; },
+    addEventListener() {}, focus() {},
+  };
+  return n;
+}
+function bootTree({ mode = null, activeId = null } = {}) {
+  const el = (tag, cls, id) => { const n = treeNode(tag); n.className = cls || ''; n.id = id || ''; return n; };
+  const sidebar = el('NAV', '', 'app-sidebar');
+  // shell.js's NAV, group by group: the unlabeled one holds its items directly,
+  // a labeled one a head and a .nav-items wrapper (renderSidebar's shape).
+  for (const block of SHELL.slice(SHELL.indexOf('var NAV = ['), SHELL.indexOf('// ---------- nav group collapse')).split('{ group: ').slice(1)) {
+    const label = /^'([^']*)'/.exec(block)[1];
+    const group = el('DIV', 'nav-group' + (label ? ' nav-group--collapsible' : ''));
+    let into = group;
+    if (label) {
+      const head = el('BUTTON', 'nav-group__head');
+      head.dataset.group = label.toLowerCase();
+      group.appendChild(head);
+      into = group.appendChild(el('DIV', 'nav-items', 'nav-items-' + label.toLowerCase()));
+    }
+    for (const m of block.matchAll(/\{ id: '([a-z-]+)', label:/g)) {
+      into.appendChild(el('A', 'nav-item' + (m[1] === activeId ? ' nav-item--active' : ''), 'nav-' + m[1]));
+    }
+    sidebar.appendChild(group);
+  }
+  const root = treeNode('HTML');
+  const byId = (id) => { if (sidebar.id === id) return sidebar; let hit = null; sidebar.walk((c) => { if (!hit && c.id === id) hit = c; }); return hit; };
+  const mk = (obj) => ({ getItem: (k) => (k in obj ? obj[k] : null), setItem: (k, v) => { obj[k] = String(v); }, removeItem: (k) => { delete obj[k]; } });
+  const documentObj = {
+    body: treeNode('BODY'), documentElement: root, activeElement: null,
+    getElementById: byId, querySelector: () => null, querySelectorAll: () => [],
+    createElement: (t) => treeNode(t.toUpperCase()), createComment: (t) => Object.assign(treeNode('#comment', 8), { data: t }),
+    addEventListener() {}, removeEventListener() {},
+  };
+  const windowObj = {
+    location: { search: '' }, matchMedia: () => ({ matches: false }),
+    localStorage: mk({}), sessionStorage: mk(mode ? { 'hall-craft': mode } : {}),
+  };
+  const sandbox = { window: windowObj, document: documentObj, console, CustomEvent: class { constructor(t, i) { this.type = t; Object.assign(this, i); } } };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(CRAFT, sandbox, { filename: 'craft-mode.js' });
+  const craft = windowObj.OTBCraftMode;
+  craft.mount();
+  const fold = () => byId('craft-fold');
+  const ids = (n) => n.querySelectorAll('.nav-item').map((a) => a.id.slice(4));
+  const order = () => ids(sidebar);
+  return { craft, sidebar, fold, ids, order, byId };
+}
+
+test('GOVERNING LEADS WITH THE CITY: its other tabs fold into one dropdown right under it', () => {
+  const before = bootTree().order();
+  const p = bootTree({ mode: 'governing' });
+  const fold = p.fold();
+  assert.ok(fold, 'the dropdown exists in Governing');
+  assert.equal(p.byId('nav-city').nextSibling, fold, 'directly under the City tab');
+  const own = p.craft.tabsFor('governing').filter((id) => !p.craft.ALWAYS_TABS.includes(id) && id !== 'city');
+  assert.deepEqual(JSON.parse(JSON.stringify(p.ids(fold))), JSON.parse(JSON.stringify(own)), 'every other Governing tab is in it, in the mode\'s order');
+  assert.ok(fold.classList.contains('nav-group--collapsed'), 'a dropdown starts closed');
+  const head = fold.querySelector('.nav-group__head');
+  assert.equal(head.getAttribute('aria-expanded'), 'false');
+  assert.equal(head.getAttribute('aria-controls'), 'nav-items-craft-fold', 'the head names the region it opens');
+  assert.match(head.innerHTML, /More governing/);
+  assert.ok(head.hasAttribute('data-craft-off') === false, 'its head shows while a tab inside does');
+  assert.ok(p.sidebar.querySelectorAll('.nav-group__head').find((h) => h.dataset.group === 'government').hasAttribute('data-craft-off'),
+    'the emptied Government head hides, so no label sits over nothing');
+  p.craft.choose('building');
+  assert.equal(p.fold(), null, 'leaving Governing removes the dropdown');
+  assert.deepEqual(p.order(), before, 'and puts every tab back exactly where it was');
+  p.craft.choose('governing');
+  p.craft.choose('governing');
+  assert.equal(p.sidebar.querySelectorAll('.craft-fold').length, 1, 'choosing it again builds no second dropdown');
+});
+
+test('the dropdown opens on its own when the page you are on is inside it', () => {
+  const p = bootTree({ mode: 'governing', activeId: 'watch' });
+  assert.ok(!p.fold().classList.contains('nav-group--collapsed'), 'on Watch, the dropdown is open');
+  assert.equal(p.fold().querySelector('.nav-group__head').getAttribute('aria-expanded'), 'true');
+  assert.equal(bootTree({ mode: 'artistry' }).fold(), null, 'no other mode folds anything');
+  assert.equal(bootTree().fold(), null, 'nor does no mode');
+});

package/tests/hall_city.mjs

@@ -271,8 +271,9 @@ test('the page holds only the wordmark, the switch, the city, one button and one
 });
 
 // task 1004544 (owner decision 2026-10-02): the city sits in the hall chrome
-// behind the shell's full-screen switch, the sky's mechanism (task 1004327),
-// and still has no sidebar link.
+// behind the shell's full-screen switch, the sky's mechanism (task 1004327).
+// The owner put the CITY on the sidebar on 2026-10-08 (the Governing mode's
+// lead tab); the street still has no link of its own.
 test('the city sits in the hall chrome, behind the shell\'s full-screen switch', () => {
   const html = read('city.html').replace(/<!--[\s\S]*?-->/g, '');
   assert.match(html, /<body data-page="city"[^>]*\sdata-fullscreen-switch>/, 'the bare attribute: the page lays itself out for full screen');
@@ -285,7 +286,8 @@ test('the city sits in the hall chrome, behind the shell\'s full-screen switch',
   assert.match(css, /html\[data-fullscreen="on"\] \.city-main \{ top: 0; left: 0; \}/);
   assert.match(css, /html\[data-fullscreen="on"\] \.city-top \{ right: 184px; \}/, 'the strip steps clear of the corner exit');
   const shell = read('shell.js');
-  assert.doesNotMatch(shell, /href:\s*'(\/builders)?\/(city|street)'/, 'no sidebar link (owner: leave it off the sidebar)');
+  assert.match(shell, /\{ id: 'city', label: 'City', icon: 'city', href: '\/city', gate: 'perm:board\.vote\.cast' \}/, 'the city is a tab, gated on its page\'s atom');
+  assert.doesNotMatch(shell, /href:\s*'(\/builders)?\/street'/, 'the street has no sidebar link: the way in is the city');
 });
 
 test('motion is CSS only and dies under reduced motion; no page :root; no innerHTML', () => {

package/tests/hall_nav.mjs

@@ -267,7 +267,9 @@ test('sidebar groups read by audience, in order', () => {
   // purpose (task 1003479, and tests/goal_map_page.mjs pinned it); the owner
   // granted the sky that slot on 2026-09-24 (ADR 0227 §11), under Goals because
   // it is the goals seen as one picture.
-  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'thinking', 'studio'],
+  // 2026-10-08: 'city' — the governor city — joins after the Board Room, on the
+  // same atom and for the same reason (owner call; it leads the Governing mode).
+  assert.deepEqual(nav[0].items.map((i) => i.id), ['home', 'roadmap', 'goals', 'goal-map', 'work', 'blockers', 'board-room', 'city', 'thinking', 'studio'],
     'the unlabeled group is the project itself (task 1002425 order)');
   assert.deepEqual(nav[1].items.map((i) => i.id), ['standing', 'profile'], 'You = your own numbers');
   // task 1003444: 'people' LEFT the group — the owner deleted the hall's

package/tests/hall_street.mjs

@@ -504,7 +504,8 @@ test('the street sits in the hall chrome, behind the shell\'s full-screen switch
   assert.match(css, /\.street-stage \{ position: fixed; top: var\(--topbar-h, 56px\); left: var\(--sidebar-w-rail, 64px\);[^}]*contain: layout paint;/);
   assert.match(css, /html\[data-fullscreen="on"\] \.street-stage \{ top: 0; left: 0; \}/);
   assert.match(css, /html\[data-fullscreen="on"\] \.street-top \{ padding-right: 184px; \}/, 'the strip steps clear of the corner exit');
-  assert.doesNotMatch(read('shell.js'), /href:\s*'(\/builders)?\/(city|street)'/, 'no sidebar link (owner: leave it off the sidebar)');
+  // The city became a tab on 2026-10-08 (owner); the street is still reached through it.
+  assert.doesNotMatch(read('shell.js'), /href:\s*'(\/builders)?\/street'/, 'no sidebar link (owner: leave it off the sidebar)');
 });
 
 test('motion is CSS only and dies under reduced motion; no page :root; no innerHTML', () => {

package/tests/hall_tweak_editor.mjs

@@ -635,7 +635,7 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-04-lightbulb/);
+    assert.match(HTML, /shell\.js\?v=2026-10-08-city-tab/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = 'af1c61ca87767b44';
+const SHELL_SHA = '02e600a176c32f6a';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);