@bongos/core 1.21.93 → 1.21.94

package/modules/public-landing/public/projects.html

@@ -601,6 +601,8 @@ body:has(#view-new:not([hidden])) footer.foot{position:relative;z-index:1;backgr
   display:inline-flex;align-items:center;justify-content:center;font-family:var(--font-body);font-size:13px;letter-spacing:0;}
 #panel-done .humanSteps>li.sdone::before{content:"✓";text-transform:none;color:var(--ok);background:color-mix(in srgb,var(--ok) 12%,transparent);border:1px solid var(--ok);}
 #panel-done .humanSteps>li.slocked::before{border:1px solid var(--rule-soft);}
+/* the optional step (command-line sign-in, task 1004649): a dashed ring until it ticks */
+#panel-done .humanSteps>li.soptional:not(.sdone)::before{border-style:dashed;}
 #panel-done .humanSteps b{font-size:15px;line-height:24px;}
 .alive{margin-top:18px;padding-top:18px;border-top:1px solid var(--rule);}
 #view-new .aliveH{margin:0;font-family:var(--font-display);font-size:28px;font-weight:200;letter-spacing:-.02em;line-height:1.2;text-transform:none;color:var(--ink);}
@@ -6603,7 +6605,7 @@ summary{min-height:24px;padding:3px 0;}
       return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
         '">' + label + '</a>';
     }
-    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null };
+    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, setup: null, installUrl: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var lastProgHtml = '';            /* same change-only contract, for the progress strip */
@@ -6632,6 +6634,9 @@ summary{min-height:24px;padding:3px 0;}
        (task 1002562) — the owner no longer runs `bongos init --adopt` here. */
     function renderStepGithubRepo() {
       var landed = live.instStatus === 'active';
+      /* the one-page checklist (task 1004649) shows only the GitHub steps the founder
+         takes; a repo the platform made or adopted needs nothing, so it is not a row */
+      if (state.mode === 'adopt' || state.repoAutoCreated || landed) return '';
       var repoLabel = state.owner && state.repo ? '<strong>' + esc(state.owner + '/' + state.repo) + '</strong>' : 'your new repository';
       /* Naming a repo without linking it stranded the owner on exactly the path where the
          platform did the work (task 1002855). Adopt links the repo the owner picked;
@@ -6697,27 +6702,34 @@ summary{min-height:24px;padding:3px 0;}
       else window.location.assign(url);
     }
 
+    /* The four GitHub steps of part 03, in the mockup's words and order (task 1004649,
+       docs/design/mocks/day-night-rooms/): Approve the <name> app on GitHub · Install it
+       on your repo · Builders can sign in · Command-line sign-in is on. One click starts
+       ONE trip — approve, straight on to installing, back here — and every tick is what
+       the server verified (live.setup, the status poll's `checklist`). Every value that
+       reaches the markup goes through esc(). */
+    function ghStep(key) { return live.setup && live.setup[key]; }
+    function appTitle() { return 'Approve the ' + esc(state.name || state.slug || 'project') + ' app on GitHub'; }
+
     /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
        (gap 3 / idea 1000676); locked until a domain exists (the App needs the real
        callback host — the server refuses domainless with domain_required). */
     function renderStepOauthApp() {
       var domain = resolvedDomain();
       if (!domain) {
-        return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Unlocks once your project has an address — sign-in needs a real domain. Attach one any time from ' + projectPageLink('this project’s own page') + '.</p></li>';
+        return '<li class="slocked" data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>Unlocks once your project has an address — sign-in needs a real domain. Attach one any time from ' + projectPageLink('this project’s own page') + '.</p></li>';
+      }
+      /* GitHub made the app and the platform placed its keys: the slug is recorded only
+         after the placement (the runner), so a known slug outside a failure is the tick —
+         a fact, whatever the venue says about starting a NEW trip */
+      if (live.manifest !== 'error' && live.manifest !== 'expired' && (ghStep('approve') === 'done' || live.appSlug)) {
+        return '<li class="sdone" data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>GitHub made the app, and its keys are on your project.</p></li>';
       }
       /* honesty about the venue (owner walk, 2026-08-12): GitHub rejects app
          manifests whose hook URL isn't publicly reachable, so a locally-hosted
          platform can't complete the one-click flow — say it BEFORE the bounce. */
       if (!apexBase()) {
-        return '<li class="slocked" data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>This platform is running on a local address, and GitHub refuses app setups it can’t reach over the public internet — so the one-click flow can’t complete here. On a publicly-addressed platform this is one click.</p>' + manualOauthDetails() + '</li>';
-      }
-      if (live.manifest === 'done') {
-        /* the wait ends HERE now, not on the callback page (task 1004548): once the
-           project answers too, the step carries the door itself */
-        var open = live.instStatus === 'active' && live.addrReady;
-        return '<li class="sdone" data-onboard-step="oauth-app"><b>GitHub sign-in is wired</b><p>Credentials placed and verified — sign-in on <code style="font-family:var(--font-mono)">' + esc(domain) + '</code> is live.' +
-          (open ? '' : ' The door below opens once your project is answering.') + '</p>' +
-          (open ? '<a class="ghbtn" href="https://' + esc(domain) + '" target="_blank" rel="noopener">Open ' + esc(domain) + ' →</a>' : '') + '</li>';
+        return '<li class="slocked" data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>This platform is running on a local address, and GitHub refuses app setups it can’t reach over the public internet — so the one-click flow can’t complete here. On a publicly-addressed platform this is one click.</p>' + manualOauthDetails() + '</li>';
       }
       if (live.manifest === 'error' || live.manifest === 'expired') {
         /* a plain sentence first; the raw route text folds under Technical
@@ -6731,86 +6743,98 @@ summary{min-height:24px;padding:3px 0;}
         else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from ' + projectPageLink('its own page') + ', then come back to this step.';
         else if (live.manifestFailure === 'sign_in_unconfirmed') {
           var appLink = live.appSlug ? '<a href="https://github.com/settings/apps/' + esc(live.appSlug) + '" target="_blank" rel="noopener">your app on GitHub</a>' : 'the app on your GitHub account';
-          return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>GitHub approved the app and the platform placed its credentials on your project, but your project didn’t confirm that sign-in works. Trying again would make a second app on your GitHub account and is unlikely to fix this — it needs a look from the platform team. <a href="/contact">Contact us</a> and mention ' + appLink + '.</p>' +
+          return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>GitHub approved the app and the platform placed its credentials on your project, but your project didn’t confirm that sign-in works. Trying again would make a second app on your GitHub account and is unlikely to fix this — it needs a look from the platform team. <a href="/contact">Contact us</a> and mention ' + appLink + '.</p>' +
             progressMarkup(1, 1, 'Stopped: your project didn’t confirm sign-in.', 'isErr', 'signin') +
             '<button type="button" class="linklike" data-action="manifest-start">Try again anyway</button></li>';
         }
         else if (live.manifestFailure === 'finish_failed') snag = 'GitHub approved the app, but the platform couldn’t finish setting up sign-in on your project. The app GitHub made is still on your account — delete it first (GitHub → Settings → Developer settings → GitHub Apps) so you don’t end up with two, then try again.';
         else { snag = 'GitHub setup didn’t start. Nothing was changed on GitHub — try again.'; raw = live.manifestMsg; }
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>' + snag + '</p>' +
+        return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>' + snag + '</p>' +
           (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') +
-          '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+          '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Connect GitHub ↗</button>' + manualOauthDetails() + '</li>';
       }
       if (live.manifest === 'code_received' || live.manifest === 'converting') {
-        /* GitHub's half is done — say so, rather than keep telling the founder
-           to approve an app they just approved */
+        /* GitHub's half of the approval is done — say so, rather than keep telling the
+           founder to approve an app they just approved */
         autoOpenArmed = true;
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>GitHub’s part is done. The platform is placing the credentials on your project now — this usually takes a few minutes, and this step ticks itself.</p>' +
-          progressMarkup(1, 1, 'Placing credentials and checking sign-in works…', '', 'signin') + autoOpenTick() + '</li>';
+        return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>Approved on GitHub. The platform is placing the app’s keys on your project, and the GitHub tab goes on to installing it on your repo. This step ticks itself.</p>' +
+          progressMarkup(1, 1, 'Placing the app’s keys on your project…', '', 'signin') + autoOpenTick() + '</li>';
       }
       if (live.manifest) {   /* pending — GitHub holds the manifest, nobody has approved it yet */
         autoOpenArmed = true;
-        return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in</b><p>Waiting on GitHub — approve the app in the tab that opened. No GitHub tab? It may have opened behind this window or in another one. Once approved, the platform places the credentials and verifies sign-in on its own; this step ticks itself.</p>' +
+        return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>Waiting on GitHub — approve the app in the tab that opened. No GitHub tab? It may have opened behind this window or in another one. Once approved, GitHub takes you straight on to installing it on your repo, then back here; every step ticks itself.</p>' +
           progressMarkup(0, 0, 'Waiting for your approval on GitHub…', '', 'signin') + autoOpenTick() +
           (manifestStale ? '<button type="button" class="linklike" data-action="manifest-start">Didn’t get to GitHub? Start the setup again</button>' : '') + '</li>';
       }
-      return '<li data-onboard-step="oauth-app"><b>Wire GitHub sign-in — one click</b><p>Approve a pre-filled GitHub App and the platform wires sign-in by itself: no keys to copy, and the secret never leaves the server side.</p>' +
-        '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Set up GitHub sign-in</button>' + manualOauthDetails() + '</li>';
+      return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>One trip to GitHub: approve the app, install it on your repo, and you land back here. No keys to copy, and the secret never leaves the server side.</p>' +
+        '<button type="button" class="ghbtn" data-action="manifest-start">' + GH_ICON + 'Connect GitHub ↗</button>' + manualOauthDetails() + '</li>';
     }
 
-    /* device-flow — the one-checkbox repair for terminal sign-in (task 1003051):
-       GitHub creates a manifest-born App with Device Flow OFF and offers no API to
-       enable it, so `bongos setup` in a terminal is refused until the owner ticks
-       the box. Web sign-in works either way; the CLI also has a web-token fallback. */
+    /* device-flow — "Command-line sign-in is on", the OPTIONAL fourth step (task 1004649).
+       GitHub creates a manifest-born App with Device Flow OFF and offers no manifest
+       field and no API to switch it on (the spike in task 1004649), so only the founder's
+       own tick in the app's settings can — and the runner ticks this step when GitHub
+       starts a device sign-in for the app. It never holds the project back: web sign-in
+       works without it, and the CLI falls back to a web token meanwhile. */
     function renderStepDeviceFlow() {
+      var title = '<b>Command-line sign-in is on</b>';
+      if (ghStep('device_flow') === 'done') {
+        return '<li class="sdone soptional" data-onboard-step="device-flow">' + title + '<p>Builders can sign in from a terminal too — the <code style="font-family:var(--font-mono)">bongos setup</code> command builders run on their own machine.</p></li>';
+      }
       if (live.manifest !== 'done') {
-        return '<li class="slocked" data-onboard-step="device-flow"><b>Let builders sign in from a command line — one checkbox</b><p>Unlocks once GitHub sign-in above is wired. It lets builders sign in from a terminal — the <code style="font-family:var(--font-mono)">bongos setup</code> command builders run on their own machine; web sign-in works without it.</p></li>';
+        return '<li class="slocked soptional" data-onboard-step="device-flow">' + title + '<p>Optional — turn it on later. It lets builders sign in from a terminal, with the <code style="font-family:var(--font-mono)">bongos setup</code> command they run on their own machine; web sign-in works without it.</p></li>';
       }
       var appUrl = live.appSlug ? 'https://github.com/settings/apps/' + esc(live.appSlug) : null;
-      return '<li data-onboard-step="device-flow"><b>Let builders sign in from a command line — one checkbox</b><p>' +
+      return '<li class="soptional" data-onboard-step="device-flow">' + title + '<p>Optional — turn it on later. GitHub leaves it off on new apps and lets only you switch it on: ' +
         (appUrl
-          ? 'Open <a href="' + appUrl + '" target="_blank" rel="noopener">your app’s settings</a>, check <strong>Enable Device Flow</strong>, and save. '
+          ? 'open <a href="' + appUrl + '" target="_blank" rel="noopener">your app’s settings</a>, check <strong>Enable Device Flow</strong>, and save. '
           : 'GitHub → Settings → Developer settings → GitHub Apps → your app → check <strong>Enable Device Flow</strong> → save. ') +
-        'GitHub leaves it off on new apps and only offers it as this checkbox — until it’s ticked, terminal sign-in falls back to a web token from the hall’s Settings page.</p></li>';
+        'We tick this when GitHub has it on. Until then builders sign in on the web, and terminal sign-in falls back to a web token from the hall’s Settings page.</p></li>';
     }
 
-    /* app-install — the ADR 0055 publish credential (task 1003049): the sign-in App
-       doubles as it, but only an INSTALLED App can mint push tokens; without this
-       one click every finished task waits at confirmed for a manual merge. */
+    /* app-install — "Install it on your repo": the ADR 0055 publish credential (task
+       1003049). The same trip carries the founder here straight from the approval (task
+       1004649); this step ticks only once the runner has asked GitHub, with the app's own
+       key, and GitHub said the app is on this repo. The button is the way back for a
+       founder who returned without installing. */
     function renderStepAppInstall() {
-      if (live.manifest !== 'done') {
-        return '<li class="slocked" data-onboard-step="app-install"><b>Install the GitHub App on your repo</b><p>Unlocks once GitHub sign-in above is wired — the same app, installed on your repo, is what lets finished work merge and ship itself.</p></li>';
+      var title = '<b>Install it on your repo</b>';
+      if (ghStep('install') === 'done') {
+        return '<li class="sdone" data-onboard-step="app-install">' + title + '<p>The app is on ' + (state.owner && state.repo ? esc(state.owner + '/' + state.repo) : 'your repo') + ', so finished work can merge and ship itself.</p></li>';
       }
-      var installUrl = live.appSlug ? 'https://github.com/apps/' + esc(live.appSlug) + '/installations/new' : null;
-      return '<li data-onboard-step="app-install"><b>Install the GitHub App on your repo</b><p>One click: install the app you just approved on this project’s repo. Without it, finished work waits for a manual merge instead of shipping itself.</p>' +
-        (installUrl
-          ? '<a class="ghbtn" href="' + installUrl + '" target="_blank" rel="noopener">' + GH_ICON + 'Install the app on your repo</a>'
-          : '<p>GitHub → Settings → Developer settings → GitHub Apps → your app → <strong>Install App</strong> → pick this project’s repo.</p>') +
-        '</li>';
+      if (!live.appSlug) {
+        return '<li class="slocked" data-onboard-step="app-install">' + title + '<p>Comes straight after the approval, on the same trip: pick your repo and you land back here.</p></li>';
+      }
+      var installUrl = live.installUrl || ('https://github.com/apps/' + encodeURIComponent(live.appSlug) + '/installations/new');
+      return '<li data-onboard-step="app-install">' + title + '<p>Your GitHub tab goes here next. We check with GitHub that the app is on your repo, and this step ticks itself. Came back without installing it?</p>' +
+        '<a class="ghbtn" href="' + esc(installUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Install it on your repo ↗</a></li>';
     }
 
+    /* first-sign-in — "Builders can sign in": ticks when the platform has seen sign-in
+       work on the project (the runner's auth_configured check, the manifest 'done'). The
+       door opens only when the project ANSWERS too: a link to an address that does not
+       resolve yet is the worst first impression a founder can get (task 1003232). */
     function renderStepFirstSignIn() {
       var domain = resolvedDomain();
+      var title = '<b>Builders can sign in</b>';
       if (!domain) {
-        return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks with sign-in above — you’ll open your project’s address, sign in with GitHub once, and be seated as the owner (the founding Archon).</p></li>';
+        return '<li class="slocked" data-onboard-step="first-sign-in">' + title + '<p>Unlocks with an address — then you open it, sign in with GitHub once, and take the owner’s seat (the founding Archon).</p></li>';
       }
-      /* the door opens only when the project ANSWERS and sign-in is wired: a
-         link to an address that does not resolve yet is the worst first
-         impression a founder can get of their own project (task 1003232) */
-      if (live.instStatus !== 'active' || !live.addrReady || live.manifest !== 'done') {
-        return '<li class="slocked" data-onboard-step="first-sign-in"><b>First sign-in</b><p>Unlocks once your project is answering and sign-in above is wired. Then you’ll open <code style="font-family:var(--font-mono)">' + esc(domain) + '</code>, sign in with GitHub once, and be seated as the owner — the founding Archon.</p></li>';
+      if (live.manifest !== 'done') {
+        return '<li class="slocked" data-onboard-step="first-sign-in">' + title + '<p>Ticks once the platform has seen sign-in work on <code style="font-family:var(--font-mono)">' + esc(domain) + '</code>.</p></li>';
       }
-      return '<li data-onboard-step="first-sign-in"><b>First sign-in</b><p>Open <a href="https://' + esc(domain) + '" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(domain) + '</code></a> and sign in with GitHub once. That seats you as the owner — the founding Archon.</p></li>';
+      var open = live.instStatus === 'active' && live.addrReady;
+      return '<li class="sdone" data-onboard-step="first-sign-in">' + title + '<p>Sign-in works on <code style="font-family:var(--font-mono)">' + esc(domain) + '</code>.' +
+        (open ? ' Open it and sign in with GitHub once to take the owner’s seat — the founding Archon.' : ' The door opens here once your project is answering.') + '</p>' +
+        (open ? '<a class="ghbtn" href="https://' + esc(domain) + '" target="_blank" rel="noopener">Open ' + esc(domain) + ' →</a>' : '') + '</li>';
     }
 
+    /* enter-hall — not a row of the GitHub checklist (the "is alive" block below carries
+       the way in); kept only for a project with no address, whose hall is local */
     function renderStepEnterHall() {
       var domain = resolvedDomain();
-      if (domain && (live.instStatus !== 'active' || !live.addrReady || live.manifest !== 'done')) {
-        return '<li class="slocked" data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Unlocks with the first sign-in — your project’s home will be <code style="font-family:var(--font-mono)">' + esc(domain) + '/builders</code>.</p></li>';
-      }
-      return domain
-        ? '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>Your project’s home — open <a href="https://' + esc(domain) + '/builders" target="_blank" rel="noopener"><code style="font-family:var(--font-mono)">' + esc(domain) + '/builders</code></a> and start building.</p></li>'
-        : '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine.</p></li>';
+      if (domain) return '';
+      return '<li data-onboard-step="enter-hall"><b>Enter your builders hall</b><p>No address yet — run <code style="font-family:var(--font-mono)">bongos dev</code> in your repo checkout to start the local hall on your machine (on an address it lives at /builders).</p></li>';
     }
 
     var STEP_RENDERERS = {
@@ -6828,9 +6852,13 @@ summary{min-height:24px;padding:3px 0;}
        control-plane wizard cannot reach. Spun out per the direction's §9
        delivery-split as task 1002739. */
 
+    /* the mockup's order: the repo (only when the founder must make it), approve,
+       install, sign-in, command line; a plan step this page has no row for goes last */
+    var STEP_ORDER = ['github-repo', 'oauth-app', 'app-install', 'first-sign-in', 'device-flow', 'enter-hall'];
+    function stepRank(s) { var i = STEP_ORDER.indexOf(s.key); return i < 0 ? STEP_ORDER.length : i; }
     function renderSteps() {
       fetchPlan().then(function (steps) {
-        var html = steps.filter(function (s) { return s && s.kind === 'human'; }).map(function (s) {
+        var html = steps.filter(function (s) { return s && s.kind === 'human'; }).slice().sort(function (a, b) { return stepRank(a) - stepRank(b); }).map(function (s) {
           var r = STEP_RENDERERS[s.key];
           return r ? r(s) : '<li data-onboard-step="' + esc(s.key) + '"><b>' + esc(s.label || s.key) + '</b></li>';
         }).join('');
@@ -6991,6 +7019,22 @@ summary{min-height:24px;padding:3px 0;}
     function manifestInFlight() {
       return live.manifest === 'pending' || live.manifest === 'code_received' || live.manifest === 'converting';
     }
+    /* the checklist the server derived (task 1004649) — change-only; true when it moved.
+       The install link rides only on a state-keyed read; the owner's read keeps the last. */
+    function seedSetup(checklist, installUrl) {
+      if (!checklist || typeof checklist !== 'object') return false;
+      var next = JSON.stringify(checklist), was = live.setup ? JSON.stringify(live.setup) : '';
+      var url = typeof installUrl === 'string' && /^https:\/\/github\.com\/apps\//.test(installUrl) ? installUrl : null;
+      var urlMoved = !!url && url !== live.installUrl && (!live.installUrl || /[?&]state=/.test(url) || !/[?&]state=/.test(live.installUrl));
+      if (next === was && !urlMoved) return false;
+      live.setup = checklist;
+      if (urlMoved) live.installUrl = url;
+      return true;
+    }
+    /* still worth watching after sign-in: the install not verified yet, while the runner checks */
+    function setupOpen() {
+      return !!(live.setup && !live.setup.connected && live.manifest === 'done');
+    }
     function noteManifestWait() {
       if (live.manifest === 'pending' && !manifestStale && manifestStartedAt && (Date.now() - manifestStartedAt) > 90000) { manifestStale = true; renderSteps(); }
     }
@@ -7006,6 +7050,7 @@ summary{min-height:24px;padding:3px 0;}
           .then(function (d) {
             if (myGen !== manifestGen) return;
             if (d.app_slug && d.app_slug !== live.appSlug) { live.appSlug = d.app_slug; rememberManifest(undefined, undefined, d.app_slug); renderSteps(); }
+            if (seedSetup(d.checklist, d.install_url)) renderSteps();   /* the server-verified ticks (task 1004649) */
             var next = d.ready ? 'done' : (d.status || 'pending');
             var failure = d.failure || null;
             if (next !== live.manifest || failure !== live.manifestFailure) { live.manifest = next; live.manifestFailure = failure; rememberManifest(undefined, next); renderSteps(); }
@@ -7249,6 +7294,8 @@ summary{min-height:24px;padding:3px 0;}
               if (seedChanged) { rememberManifest(undefined, live.manifest, live.appSlug || undefined); renderSteps(); }
               else noteManifestWait();
             }
+            /* the server-verified checklist rides the same read (task 1004649) */
+            if (data.github_setup && !manifestPollTimer && seedSetup(data.github_setup.checklist, data.github_setup.install_url)) renderSteps();
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
@@ -7258,7 +7305,7 @@ summary{min-height:24px;padding:3px 0;}
             var terminal = renderProgress(inst);
             /* a GitHub leg still in flight keeps this read alive even once the
                project is up — after a reload it is the ONLY thing watching it */
-            if (!terminal || manifestInFlight()) pollTimer = setTimeout(tick, 5000);
+            if (!terminal || manifestInFlight() || setupOpen()) pollTimer = setTimeout(tick, 5000);
             else stopPolling();
           })
           .catch(function (err) {
@@ -7288,7 +7335,7 @@ summary{min-height:24px;padding:3px 0;}
       instanceId = null;
       watchPending = false; manifestPending = false; manifestState = null;
       manifestStartedAt = 0; manifestStale = false;
-      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null };
+      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, setup: null, installUrl: null };
       lastStepsHtml = '';
       lastProgHtml = '';
       hopReset();
@@ -7722,7 +7769,8 @@ summary{min-height:24px;padding:3px 0;}
       var list = $('humanSteps'), st = $('ghState');
       if (!list || !st) return;
       if (state.step !== 2) { st.textContent = 'opens once your project exists'; return; }
-      var items = Array.prototype.slice.call(list.children);
+      /* the optional step (command-line sign-in) never holds "connected" back */
+      var items = Array.prototype.slice.call(list.children).filter(function (li) { return !li.classList.contains('soptional'); });
       var done = items.filter(function (li) { return li.classList.contains('sdone'); }).length;
       st.textContent = items.length && done === items.length ? 'connected ✓'
         : manifestInFlight() ? 'waiting on GitHub…'

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.93",
+  "version": "1.21.94",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.93",
+      "version": "1.21.94",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.93",
+  "version": "1.21.94",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9388,5 +9388,11 @@
       "id": "1004657",
       "text": "When a project votes that a part of its government is decided by a group, that vote now holds on every page, not only the People page. Before, someone with the right permission could still switch unattended building on, sign o"
     }
+  ],
+  "1.21.94": [
+    {
+      "id": "1004649",
+      "text": "Connecting GitHub to a new project is now one trip. The founder clicks \"Connect GitHub\", approves the project's app on GitHub, and GitHub carries straight on to installing it on their repo (already picked when the repo is publ"
+    }
   ]
 }

package/scripts/gds/oauth-secret.js

@@ -172,12 +172,14 @@ function main() {
   cp.execSync(`systemctl restart ${slug}`, { stdio: 'inherit' });
   console.log(`✓ restarted ${slug}`);
 
-  // (3) VERIFY — probe /healthz for auth_configured (retry briefly for restart).
+  // (3) VERIFY — probe the JSON health answer for auth_configured (retry briefly for
+  // restart). /api/bongos/healthz, not the root /healthz, which answers a plain "ok"
+  // that never parses (task 1004577).
   if (!port) { console.error('✖ no PORT in web.env and no --port given — cannot probe /healthz'); process.exit(1); }
   let probe = { authConfigured: false };
   for (let i = 0; i < 10; i++) {
     try {
-      const out = cp.execSync(`curl -sS --max-time 5 http://127.0.0.1:${port}/healthz`, { stdio: ['ignore', 'pipe', 'pipe'] }).toString();
+      const out = cp.execSync(`curl -sS --max-time 5 http://127.0.0.1:${port}/api/bongos/healthz`, { stdio: ['ignore', 'pipe', 'pipe'] }).toString();
       probe = parseHealthzAuth(out);
       if (probe.ok || probe.authConfigured) break;
     } catch { /* not up yet */ }

package/scripts/gds/provision-github-setup.js

@@ -0,0 +1,148 @@
+'use strict';
+// scripts/gds/provision-github-setup.js — the control-plane runner's check of the two
+// GitHub steps a founder finishes ON GITHUB after the app exists: "Install it on your repo"
+// and "Command-line sign-in is on" (task 1004649; the checklist is derived in
+// modules/provisioning/github-setup.js).
+//
+// WHY THE RUNNER. Only the runner holds the app's credentials (it placed them in the
+// project's chmod-600 web.env; ADR 0111 §2 / ADR 0133 — the web tier never sees a secret).
+// The setup_url redirect GitHub sends after an install carries an installation_id, but
+// GitHub's own docs warn it can be spoofed, so a tick needs GitHub's answer to a question
+// asked with the app's own key:
+//   install — GET /repos/{owner}/{repo}/installation, authenticated as the app (a JWT
+//             signed with its private key). 200 with an id = installed on THIS repo.
+//   device  — POST github.com/login/device/code with the app's client id. GitHub answers a
+//             device code when device flow is on and `device_flow_disabled` when it is off.
+//             The unused code simply expires; nothing is signed in. GitHub has NO manifest
+//             field and NO API that turns device flow on (spike, task 1004649), so this
+//             only ever OBSERVES the founder's own tick on GitHub.
+// A verified fact is recorded once as a provisioning_events row; the checklist reads it.
+//
+// BOUNDED. Only attempts that settled within VERIFY_WINDOW_MS, or whose install was
+// reported within it, are checked, at most SWEEP_LIMIT per tick — so a finished or
+// abandoned project costs nothing, and a founder who ticks device flow later re-opens the
+// window by reinstalling or from the hall (task 1004652 owns "check again").
+// Secrets: web.env is read on the box, parsed in memory, and only NAMES ever reach a log.
+
+const crypto = require('node:crypto');
+const { webEnvPath } = require('./provision-units.js');
+const { SETUP_EVENTS, VERIFY_WINDOW_MS, githubSetupFacts, targetRepo } = require('../../modules/provisioning/github-setup.js');
+
+const SWEEP_LIMIT = 20;
+const UA = 'cloud-bongos-provisioner';
+
+function b64url(input) {
+  return Buffer.from(input).toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+// An app JWT (RS256, 9 minutes, iat backdated for skew) — GitHub's app authentication.
+function appJwt({ appId, pem, nowSec = Math.floor(Date.now() / 1000) }) {
+  const head = b64url(JSON.stringify({ alg: 'RS256', typ: 'JWT' }));
+  const body = b64url(JSON.stringify({ iat: nowSec - 60, exp: nowSec + 9 * 60, iss: String(appId) }));
+  const signer = crypto.createSign('RSA-SHA256');
+  signer.update(`${head}.${body}`);
+  signer.end();
+  return `${head}.${body}.${b64url(signer.sign(pem))}`;
+}
+
+// The app's id, private key and client id out of a web.env body. The pem is stored as one
+// line with literal \n (provision-units.js webEnvBody); the client id under the pack's
+// prefix, which this does not need to know. Missing pieces are null. PURE.
+function appCredsFromEnv(body) {
+  const val = (re) => { const m = String(body || '').match(re); return m ? m[1].trim() : null; };
+  const pemLine = val(/^GITHUB_APP_PRIVATE_KEY=(.+)$/m);
+  return {
+    appId: val(/^GITHUB_APP_ID=(\d+)\s*$/m),
+    pem: pemLine ? pemLine.replace(/\\n/g, '\n') : null,
+    clientId: val(/^[A-Z0-9_]+_GITHUB_CLIENT_ID=(\S+)\s*$/m),
+  };
+}
+
+// Is the app installed on owner/repo? true · false (404: the app is real, not installed
+// there) · null (cannot tell — any other answer, or no network).
+async function installedOnRepo({ appId, pem, repo, fetchImpl = globalThis.fetch }) {
+  try {
+    const res = await fetchImpl(`https://api.github.com/repos/${repo}/installation`, {
+      headers: { Authorization: `Bearer ${appJwt({ appId, pem })}`, Accept: 'application/vnd.github+json', 'X-GitHub-Api-Version': '2022-11-28', 'User-Agent': UA },
+    });
+    if (res.status === 404) return false;
+    if (!res.ok) return null;
+    const j = await res.json().catch(() => null);
+    return !!(j && j.id != null);
+  } catch (_) { return null; }
+}
+
+// Does GitHub accept a device-flow start for this client id? true · false
+// (device_flow_disabled) · null (any other answer — never read as "off").
+async function deviceFlowOn({ clientId, fetchImpl = globalThis.fetch }) {
+  try {
+    const res = await fetchImpl('https://github.com/login/device/code', {
+      method: 'POST',
+      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': UA },
+      body: `client_id=${encodeURIComponent(clientId)}`,
+    });
+    const j = await res.json().catch(() => null);
+    if (j && j.device_code) return true;
+    if (j && /device_flow_disabled/.test(String(j.error || ''))) return false;
+    return null;
+  } catch (_) { return null; }
+}
+
+// The attempts worth checking this tick: each instance's LATEST attempt, past the
+// credential placement (an app id recorded), settled or reported within the window.
+async function attemptsToVerify(db) {
+  const windowSec = Math.round(VERIFY_WINDOW_MS / 1000);
+  const { rows } = await db.query(
+    `WITH latest AS (
+       SELECT DISTINCT ON (instance_id) * FROM provisioning_oauth_manifests ORDER BY instance_id, created_at DESC)
+     SELECT l.id, l.instance_id, l.created_at, l.requested_by, i.slug, i.target_ref, i.hosting_shape, i.status AS instance_status
+       FROM latest l JOIN provisioning_instances i ON i.id = l.instance_id
+      WHERE l.app_id IS NOT NULL AND l.status IN ('done', 'error') AND i.status = 'active'
+        AND (l.updated_at > now() - ($1 * interval '1 second')
+             OR EXISTS (SELECT 1 FROM provisioning_events e WHERE e.instance_id = l.instance_id
+                         AND e.event = $2 AND e.created_at > now() - ($1 * interval '1 second')))
+      ORDER BY l.updated_at DESC LIMIT ${SWEEP_LIMIT}`,
+    [windowSec, SETUP_EVENTS.installReported]);
+  return rows;
+}
+
+// One tick: for every attempt in the window, check whatever is not verified yet and record
+// what GitHub confirmed. Returns { checked, installed, deviceFlow }.
+async function verifyGithubAppSetups(deps) {
+  const { db, provisioning, log, apply } = deps;
+  const out = { checked: 0, installed: 0, deviceFlow: 0 };
+  const rows = await attemptsToVerify(db);
+  if (!apply) {
+    for (const r of rows) log(`  would check the GitHub install + device flow for ${r.slug} (manifest #${r.id})`);
+    return out;
+  }
+  for (const r of rows) {
+    const facts = await githubSetupFacts(db, r.instance_id, r.created_at);
+    if (facts.installedAt && facts.deviceFlowAt) continue;
+    const onControlBox = r.hosting_shape === 'cloud-host' || r.hosting_shape === 'control-plane';
+    const boxExec = onControlBox ? (deps.controlExec || deps.exec) : deps.exec;
+    const read = boxExec(`${deps.privileged ? 'sudo ' : ''}cat ${webEnvPath(r)}`, { allowFail: true });
+    const creds = appCredsFromEnv(read && read.stdout);
+    out.checked++;
+    const repo = targetRepo(r);
+    const fetchImpl = deps.fetchImpl;
+    if (!facts.installedAt && creds.appId && creds.pem && repo) {
+      if (await installedOnRepo({ appId: creds.appId, pem: creds.pem, repo, fetchImpl })) {
+        await provisioning.recordEvent(db, { instanceId: r.instance_id, ownerBuilderId: r.requested_by, event: SETUP_EVENTS.installed,
+          detail: `the GitHub app is installed on ${repo} (checked with the app's own key)`, actor: 'runner' });
+        out.installed++; log(`  ✓ ${r.slug}: GitHub app installed on ${repo}`);
+      }
+    }
+    if (!facts.deviceFlowAt && creds.clientId) {
+      if (await deviceFlowOn({ clientId: creds.clientId, fetchImpl })) {
+        await provisioning.recordEvent(db, { instanceId: r.instance_id, ownerBuilderId: r.requested_by, event: SETUP_EVENTS.deviceFlow,
+          detail: 'command-line sign-in (device flow) is on for the GitHub app', actor: 'runner' });
+        out.deviceFlow++; log(`  ✓ ${r.slug}: command-line sign-in is on`);
+      }
+    }
+  }
+  if (out.checked) log(`github-setup — checked=${out.checked} installed=${out.installed} device-flow=${out.deviceFlow}`);
+  return out;
+}
+
+module.exports = { appJwt, appCredsFromEnv, installedOnRepo, deviceFlowOn, attemptsToVerify, verifyGithubAppSetups, SWEEP_LIMIT };

package/scripts/gds/provision.js

@@ -1039,6 +1039,13 @@ async function convertManifestCode(code, { fetchImpl = globalThis.fetch, userAge
   };
 }
 
+// The sign-in probe: the project's JSON health answer, which carries auth_configured
+// (src/bongos/routes/healthz.js). NOT healthzCmd — the root /healthz answers a plain "ok",
+// which never parses, so every setup that worked was recorded FAILED (task 1004577).
+function authHealthzCmd(inst) {
+  return `curl -sS --max-time 5 http://127.0.0.1:${inst.port}/api/bongos/healthz`;
+}
+
 // Convert one manifest row's code → creds and PLACE them (rewrite web.env + restart +
 // verify /healthz). Uses the SAME executors provisionInstance does, so co-tenant (local
 // or remote-cohost) and standalone (control-plane-local) are handled identically. Returns { ok, appId, appSlug } | { ok:false, error }.
@@ -1082,15 +1089,19 @@ async function placeManifestCreds(inst, mrow, deps) {
     appId: creds.appId, appPem: creds.appPem,
   }), { mode: 0o600, sudo: true });
   pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
+  // The app now exists AND its credentials are placed — the checklist's first tick, and the
+  // slug the callback page needs to send the founder on to installing it (task 1004649).
+  if (apply && deps.onCredsPlaced) await Promise.resolve().then(() => deps.onCredsPlaced({ appId: creds.appId, appSlug: creds.appSlug })).catch(() => {});
 
-  // 4) verify /healthz reports auth_configured=true (only meaningful under --apply).
+  // 4) verify the project reports auth_configured=true (only meaningful under --apply).
   //    PATIENT (F23): the child must boot before it can answer; losing this race
-  //    used to record a failure for a setup that had succeeded.
+  //    used to record a failure for a setup that had succeeded. The JSON answer lives
+  //    at /api/bongos/healthz — the root /healthz says a plain "ok" (task 1004577).
   if (apply) {
     const sleep = deps.sleep || ((ms) => new Promise((r) => setTimeout(r, ms)));
     let authConfigured = false;
     for (let i = 0; i < MANIFEST_VERIFY_TRIES; i++) {
-      const out = boxExec(healthzCmd(inst), { allowFail: true });
+      const out = boxExec(authHealthzCmd(inst), { allowFail: true });
       if (oauthSecret.parseHealthzAuth(out && out.stdout).authConfigured) { authConfigured = true; break; }
       await sleep(MANIFEST_VERIFY_INTERVAL_MS);
     }
@@ -1149,7 +1160,9 @@ async function drainOAuthManifests(deps) {
     try {
       const inst = await provisioning.getInstanceById(db, mrow.instance_id);
       if (!inst) { await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: 'instance row vanished' }); errors++; continue; }
-      const result = await placeManifestCreds(inst, mrow, deps);
+      // the slug lands on the row the moment the credentials are placed (task 1004649)
+      const onCredsPlaced = (c) => provisioning.resolveOAuthManifest(db, mrow.id, 'converting', { app_id: c.appId, app_slug: c.appSlug });
+      const result = await placeManifestCreds(inst, mrow, { ...deps, onCredsPlaced });
       if (result && result.ok === false) {
         // A SPENT code is terminal, always (F23): GitHub's manifest code is
         // single-use, so resetting the row to 'code_received' guarantees the
@@ -1257,6 +1270,7 @@ async function cmdRunIntents(deps) {
   }
   await snapshotAllCoreVersions(deps); // refresh what the deploy control reads, AFTER the drain (ADR 0293 D3/D6)
   const m = await drainOAuthManifests(deps); // same tick: convert + place any GitHub-App-Manifest creds awaiting the control plane
+  await require('./provision-github-setup.js').verifyGithubAppSetups(deps).catch((e) => log(`  github-setup check failed (non-blocking): ${e.message}`)); // install + device flow, asked of GitHub with the app's key (task 1004649)
   log(`done — ran=${ran} ok=${ok} errors=${errors}; oauth-manifest converted=${m.converted} errors=${m.errors}`);
   return { ran, ok, errors, manifests: m };
 }
@@ -1438,7 +1452,7 @@ module.exports = {
   // restart an unreachable ACTIVE instance (task 1003238) — the settings leg minus the env patch
   restartInstance,
   // GitHub App Manifest flow (task 2080, ADR 0133)
-  convertManifestCode, placeManifestCreds, drainOAuthManifests, MANIFEST_UA,
+  convertManifestCode, placeManifestCreds, drainOAuthManifests, authHealthzCmd, MANIFEST_UA,
   // cross-site identity federation (ADR 0141 §4, task #1002109)
   federationHubOrigin, shouldFederate, federateInstance,
 };

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.93'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.94'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');