@bongos/core 1.21.94 → 1.21.95

package/tests/github_handback_any_device.mjs

@@ -0,0 +1,340 @@
+// tests/github_handback_any_device.mjs — coming back from GitHub works from any tab or
+// device, and the page keeps checking while you are away (task 1004650).
+//
+// Before: the GitHub hand-back sent the founder to /projects?view=new#ghstate=…, and the
+// page knew WHICH project only from that tab's sessionStorage (cb-created-instance). Approve
+// on a phone, or in another window, and you landed on a blank create page. And both wizard
+// polls parked themselves while the tab was hidden — exactly while the founder was on GitHub.
+//
+// Now the callback and setup pages send the founder to the return route, which resolves the
+// one-time state to the project the SERVER remembers for it and lands its signed-in owner on
+// /projects?view=new&id=<project>; the page asks the server's resume read for that project
+// and opens part 03 with nothing in browser storage. The polls keep going while hidden, at
+// a slower pace, and a waiting tick runs at once when the tab is seen again.
+//
+// The whole path runs for real at least once: the REAL setup route's page → its REAL hand-
+// back script → the REAL return route (302) → the REAL page code (sliced out of
+// projects.html and run in a vm, the vm-slice idiom of tests/wizard_intent_resume.mjs) with
+// EMPTY sessionStorage, whose fetches go to the REAL resume route. DB-free: the provisioning
+// data-access fns and the session resolver are stubbed on the cached modules.
+//
+// Run:  node --test --test-reporter=tap tests/github_handback_any_device.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+// CRLF on a Windows checkout — a vm cannot run a slice with stray \r in it
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+
+// ── the world: two builders, a project each, one attempt in flight ───────────────────
+const STATE = 'ab12'.repeat(8);
+const NOW = new Date().toISOString();
+const MINE = { id: 42, owner_builder_id: 7, slug: 'mercury', domain: 'mercury.example.com', target_ref: 'acme/mercury', status: 'active', onboard_mode: 'greenfield', created_at: NOW };
+const THEIRS = { id: 43, owner_builder_id: 8, slug: 'venus', domain: 'venus.example.com', target_ref: 'zed/venus', status: 'active', onboard_mode: 'greenfield', created_at: NOW };
+const ATTEMPT = { id: 99, instance_id: 42, requested_by: 7, state: STATE, status: 'converting', app_slug: 'mercury-app', created_at: NOW, updated_at: NOW, expires_at: new Date(Date.now() + 600000).toISOString() };
+
+const provisioning = require(`${ROOT}/modules/provisioning/provisioning.js`);
+provisioning.getInstanceById = async (_db, id) => [MINE, THEIRS].find((i) => i.id === Number(id)) || null;
+provisioning.getOAuthManifestByState = async (_db, s) => (s === STATE ? ATTEMPT : null);
+provisioning.getLatestOAuthManifestForInstance = async (_db, id) => (Number(id) === 42 ? ATTEMPT : null);
+provisioning.listInstancesForOwner = async (_db, who) => [MINE, THEIRS].filter((i) => i.owner_builder_id === who);
+provisioning.recordEvent = async () => {};
+const githubSetup = require(`${ROOT}/modules/provisioning/github-setup.js`);
+githubSetup.githubSetupFacts = async () => ({});   // nothing verified yet: the install is still to do
+
+// The session is a cookie naming the builder; no cookie is nobody. Both auth doors read it.
+const api = require(`${ROOT}/src/module-api.js`);
+const whoOf = (req) => { const m = /(?:^|;\s*)who=(\d+)/.exec(String(req.headers.cookie || '')); return m ? Number(m[1]) : null; };
+api.resolveSession = async (req) => (whoOf(req) ? { builder_id: whoOf(req), status: 'active', source: 'web' } : null);
+api.requireBuilder = (req, res, next) => {
+  const who = whoOf(req);
+  if (!who) return res.status(401).json({ error: { code: 'unauthenticated' } });
+  req.builder = { id: who };
+  return next();
+};
+
+const express = require('express');
+const githubSetupRoutes = require(`${ROOT}/modules/provisioning/routes/github-setup.js`);
+let server, origin;
+before(async () => {
+  const app = express();
+  app.use('/api/bongos', githubSetupRoutes());
+  server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  origin = `http://127.0.0.1:${server.address().port}`;
+});
+after(() => server && server.close());
+
+const get = (p, who, extra = {}) => fetch(origin + p, { redirect: 'manual', headers: who ? { cookie: `who=${who}` } : {}, ...extra });
+
+// ── the page code, sliced (each boundary asserted below) ──────────────────────────────
+function region(startMark, endMark) {
+  const s = SCRIPT.indexOf(startMark);
+  const e = s < 0 ? -1 : SCRIPT.indexOf(endMark, s);
+  return s > 0 && e > s ? SCRIPT.slice(s, e) : null;
+}
+const POLLS = region("    /* ── C8: the wizard's polls run only while the create view is on stage", '    /* ── live build progress (task 2083)');
+const WATCH_VARS = region('    var pollTimer = null;', "    /* The done panel's own flow vocabularies");
+const START_PROGRESS = (SCRIPT.match(/ {4}function startProgress\(id\) \{[\s\S]*?\n {4}\}/) || [null])[0];
+const DOORS = region("    /* ── the hub's three doors ── */", '    return { enter: enter, leave: leave, onAuth: onAuth };');
+
+test('the page regions are still findable (a rename must fail loudly, not test nothing)', () => {
+  assert.ok(POLLS, 'the wizard poll region (C8 → the manifest poll) was not found');
+  assert.ok(WATCH_VARS, 'the progress watch vars were not found');
+  assert.ok(START_PROGRESS, 'startProgress() was not found');
+  assert.ok(DOORS, "the hub's three doors (createdRecord → enter) were not found");
+  assert.match(POLLS, /var handbackProject = /, 'the hand-back names its project in the poll region');
+  assert.match(DOORS, /function askServerResume\(focus\)/, 'the server resume ask lives with enter()');
+  assert.doesNotMatch(POLLS + DOORS, /innerHTML/, 'no live DOM from strings');
+});
+
+// A miniature browser for the sliced page: empty storage (or storage that throws), the URL
+// the founder landed on, a document whose `hidden` the test flips, recorded timers, and a
+// fetch that goes to the REAL routes as the given builder.
+function page({ url, who, storage = 'empty', name = '', hidden = false, instanceRead = null }) {
+  const u = new URL(url, 'https://hub.example');
+  const store = new Map();
+  const log = { show: [], progress: [], offers: [], fetched: [], timers: [], cleared: 0, resets: 0, rendered: 0 };
+  const listeners = {};
+  const inflight = [];
+  log.inflight = inflight;
+  const sessionStorage = storage === 'throws'
+    ? { getItem() { throw new Error('denied'); }, setItem() { throw new Error('denied'); }, removeItem() { throw new Error('denied'); } }
+    : { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, String(v)), removeItem: (k) => store.delete(k) };
+  const el = () => ({ addEventListener() {}, focus() {}, hidden: true, textContent: '' });
+  const sandbox = {
+    API: '/api/bongos', DRAFT_KEY: 'cb-create-draft-v10', CREATED_KEY: 'cb-created-instance', DECLINED_KEY: 'cb-resume-declined',
+    location: { search: u.search, hash: u.hash },
+    URLSearchParams, JSON, String, Number, Math, Object, Date, encodeURIComponent, Promise,
+    document: { hidden, addEventListener: (ev, fn) => { (listeners[ev] = listeners[ev] || []).push(fn); } },
+    sessionStorage,
+    setTimeout: (fn, ms) => { log.timers.push({ fn, ms }); return log.timers.length; },
+    clearTimeout: () => { log.cleared += 1; },
+    fetch: (p, opts) => {
+      log.fetched.push(p);
+      const answer = (instanceRead && /\/provisioning\/instances\/\d+$/.test(p))
+        ? Promise.resolve({ ok: true, status: 200, json: async () => instanceRead() })
+        : get(p, who, { method: (opts && opts.method) || 'GET' });
+      inflight.push(answer.then((r) => r.clone().text()).catch(() => null));
+      return answer;
+    },
+    $: el,
+    currentView: 'new', authKnown: true, me: { id: who, github_login: 'founder' },
+    state: { step: 0, name, slug: '', domain: '', mode: 'greenfield', owner: 'founder', repo: '', noAddress: false },
+    live: { instStatus: null, addrReady: false, manifest: null, manifestFailure: null, appSlug: null, setup: null, installUrl: null },
+    instanceId: null, watchPending: false,
+    show(step) { sandbox.state.step = step; log.show.push(step); },
+    renderDone() { log.rendered += 1; }, renderSteps() { log.rendered += 1; },
+    resetForNewProject() { log.resets += 1; },
+    saveDraft() {},
+    setProgress() {}, progressMarkup: () => '', setMoment() {}, renderProgress: () => false, addressReady: () => true,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext([POLLS, WATCH_VARS, START_PROGRESS, DOORS].join('\n'), sandbox);
+  // the real startProgress runs too; record which project it watches
+  const realStart = sandbox.startProgress;
+  // the resume line is real markup (#wizResume); record what it is told to name
+  sandbox.paintResumeOffer = (rec) => { log.offers.push(rec ? rec.id : null); };
+  sandbox.startProgress = (id) => { log.progress.push(id); return realStart(id); };
+  return { sandbox, log, store, listeners, fire: (ev) => (listeners[ev] || []).forEach((fn) => fn()) };
+}
+// wait until every request the page made has answered and its handlers have run
+async function settle(log) {
+  for (let round = 0; round < 20; round++) {
+    const seen = log.inflight.length;
+    await Promise.all(log.inflight.slice());
+    for (let i = 0; i < 6; i++) await new Promise((r) => setImmediate(r));
+    if (log.inflight.length === seen) return;
+  }
+}
+
+// The served hand-back page, run for real: its own config and script, no opener (a phone
+// has no wizard tab behind it), and where it sends the browser.
+async function handbackFromSetupRoute() {
+  const res = await get(`/api/bongos/provisioning/github-app/setup?installation_id=5&setup_action=install&state=${STATE}`);
+  const html = await res.text();
+  const cfg = JSON.parse((html.match(/window\.__CB_SETUP__=(\{[^<]*?\});/) || [])[1] || 'null');
+  const script = (html.match(/<script>\s*(\(function\(\)\{[\s\S]*?)<\/script>\s*<\/body>/) || [])[1];
+  assert.ok(cfg && script, 'the setup route serves the hand-back page with its config and script');
+  let replaced = null;
+  const timers = [];
+  const back = { href: '' };
+  const sb = { __CB_SETUP__: cfg, opener: null, close() {}, document: { getElementById: (id) => (id === 'back' ? back : null) }, location: { replace: (u) => { replaced = u; } }, setTimeout: (fn) => timers.push(fn), encodeURIComponent };
+  sb.window = sb;
+  vm.runInNewContext(script, sb);
+  while (timers.length) timers.shift()();
+  return { replaced, html };
+}
+
+test('approved on a phone, empty storage: the real hand-back lands on the right project at part 03', async () => {
+  const { replaced, html } = await handbackFromSetupRoute();
+  assert.equal(replaced, `/api/bongos/provisioning/github-app/return?state=${STATE}`, 'the hand-back goes to the return route, not a bare create page');
+  assert.ok(html.includes(`href="/api/bongos/provisioning/github-app/return?state=${STATE}"`), 'the no-script link goes there too');
+
+  const ret = await get(replaced, 7);
+  assert.equal(ret.status, 302, 'the owner is redirected');
+  const landing = ret.headers.get('location');
+  assert.equal(landing, `/projects?view=new&id=42#ghstate=${STATE}`, 'to the project the SERVER remembers for the state');
+  assert.equal(ret.headers.get('cache-control'), 'no-store');
+
+  // the page, with NOTHING in this browser's storage
+  const { sandbox, log, store } = page({ url: landing, who: 7 });
+  assert.equal(store.size, 0, 'the browser starts with empty storage');
+  sandbox.enter(false);           // what onAuth() does once /me answers
+  assert.deepEqual(log.show, [], 'a named hand-back waits for the server instead of painting another project');
+  await settle(log);
+  assert.ok(log.fetched.includes('/api/bongos/provisioning/github-app/resume?id=42'), JSON.stringify(log.fetched));
+  assert.deepEqual(log.show, [2], 'part 03 — the created page — is shown');
+  assert.equal(log.progress[0], 42, 'and it watches project 42');
+  assert.equal(sandbox.state.slug, 'mercury');
+  assert.equal(sandbox.state.repo, 'mercury', 'the install step names the repo the server knows');
+  assert.equal(sandbox.manifestState, STATE, 'the attempt from the fragment keeps being watched');
+  assert.ok(log.fetched.some((p) => p === `/api/bongos/provisioning/github-app/status?state=${STATE}`), 'the state-keyed checklist poll runs');
+  assert.equal(JSON.parse(store.get('cb-created-instance')).id, 42, 'a reload of this tab keeps the project');
+});
+
+test('the same hand-back works where the browser refuses storage outright', async () => {
+  const { sandbox, log } = page({ url: `/projects?view=new&id=42#ghstate=${STATE}`, who: 7, storage: 'throws' });
+  sandbox.enter(false);
+  await settle(log);
+  assert.deepEqual(log.show, [2]);
+  assert.equal(log.progress[0], 42);
+});
+
+test('a different signed-in builder is refused — never shown or landed on the project', async () => {
+  const ret = await get(`/api/bongos/provisioning/github-app/return?state=${STATE}`, 8);
+  const html = await ret.text();
+  assert.equal(ret.status, 404, 'a refusal, not a redirect');
+  assert.equal(ret.headers.get('location'), null);
+  assert.match(html, /This isn’t your project/);
+  assert.doesNotMatch(html, /mercury|view=new&id=|42/, 'the page names no project');
+  const unknown = await (await get(`/api/bongos/provisioning/github-app/return?state=${'cd34'.repeat(8)}`, 8)).text();
+  assert.equal(unknown, html, 'an unknown state reads the same (no oracle about which)');
+  const malformed = await get('/api/bongos/provisioning/github-app/return?state=../../etc', 7);
+  assert.equal(malformed.status, 404);
+
+  // and the resume read gives them nothing either, even for a crafted ?id=42
+  const j = await (await get('/api/bongos/provisioning/github-app/resume?id=42', 8)).json();
+  assert.equal(j.project, null);
+  const { sandbox, log } = page({ url: '/projects?view=new&id=42', who: 8 });
+  sandbox.enter(false);
+  await settle(log);
+  assert.ok(!log.progress.includes(42), 'the page never watches a project that is not theirs');
+  assert.ok(!log.show.includes(2), 'and never opens its part 03');
+});
+
+test('not signed in → through sign-in, then back to the same return', async () => {
+  const ret = await get(`/api/bongos/provisioning/github-app/return?state=${STATE}`, null);
+  assert.equal(ret.status, 302);
+  const loc = ret.headers.get('location');
+  const u = new URL(loc, 'https://hub.example');
+  assert.equal(u.pathname, '/api/bongos/auth/web/start');
+  assert.equal(u.searchParams.get('return'), `/api/bongos/provisioning/github-app/return?state=${STATE}`, 'the return target is the return route itself');
+  assert.equal(u.searchParams.get('repos'), '1', 'with the hub sign-in door’s repo scope');
+});
+
+test('the state stays single-use where it is used: the return route changes nothing', async () => {
+  let writes = 0;
+  const prev = provisioning.attachManifestCode;
+  provisioning.attachManifestCode = async () => { writes += 1; return null; };
+  const a = await get(`/api/bongos/provisioning/github-app/return?state=${STATE}`, 7);
+  const b = await get(`/api/bongos/provisioning/github-app/return?state=${STATE}`, 7);
+  provisioning.attachManifestCode = prev;
+  assert.equal(writes, 0, 'no code exchange, no status change');
+  assert.equal(a.headers.get('location'), b.headers.get('location'), 'the owner can come back again; nobody else can at all');
+});
+
+test('opening the create page later, from any device, resumes part 03 from the server’s view', async () => {
+  const later = page({ url: '/projects?view=new', who: 7 });
+  later.sandbox.enter(false);
+  await settle(later.log);
+  assert.ok(later.log.fetched.includes('/api/bongos/provisioning/github-app/resume'));
+  assert.deepEqual(later.log.show.slice(-1), [2], 'the unfinished project comes back');
+  assert.equal(later.log.progress[0], 42);
+
+  // someone typing a new project keeps their page; the project waits on the resume line
+  const typing = page({ url: '/projects?view=new', who: 7, name: 'Second idea' });
+  typing.sandbox.enter(false);
+  await settle(typing.log);
+  assert.ok(!typing.log.progress.includes(42));
+  assert.deepEqual(typing.log.offers.filter(Boolean), [42]);
+
+  // a deliberate "New project" only offers it
+  const nav = page({ url: '/projects?view=new', who: 7 });
+  nav.sandbox.enter(true);
+  await settle(nav.log);
+  assert.ok(!nav.log.progress.includes(42));
+  assert.deepEqual(nav.log.offers.filter(Boolean), [42]);
+
+  // "Start another project" said no to it in this tab
+  const declined = page({ url: '/projects?view=new', who: 7 });
+  declined.store.set('cb-resume-declined', '42');
+  declined.sandbox.enter(false);
+  await settle(declined.log);
+  assert.ok(!declined.log.progress.includes(42));
+
+  // a connected project is not "in progress"; nor is anything for a builder with none
+  githubSetup.githubSetupFacts = async () => ({ installedAt: NOW });
+  const prevAttempt = { ...ATTEMPT };
+  Object.assign(ATTEMPT, { status: 'done' });
+  const done = await (await get('/api/bongos/provisioning/github-app/resume', 7)).json();
+  Object.assign(ATTEMPT, prevAttempt);
+  githubSetup.githubSetupFacts = async () => ({});
+  assert.equal(done.project, null, 'a project whose GitHub is connected is not resumed');
+  const none = await (await get('/api/bongos/provisioning/github-app/resume', 9)).json();
+  assert.equal(none.project, null);
+  const anon = await get('/api/bongos/provisioning/github-app/resume', null);
+  assert.equal(anon.status, 401, 'signed-in only');
+});
+
+test('a hidden tab keeps checking at the slow pace, and checks at once when seen again', async () => {
+  const { sandbox, log, fire } = page({ url: `/projects?view=new&id=42#ghstate=${STATE}`, who: 7, hidden: true });
+  sandbox.pollManifest(STATE);
+  await settle(log);
+  assert.equal(log.fetched.filter((p) => /github-app\/status/.test(p)).length, 1, 'the hidden tab still asks — it does not park');
+  assert.equal(log.timers.length, 1);
+  assert.equal(log.timers[0].ms, 20000, 'and asks again at the slow pace');
+  assert.equal(sandbox.manifestPending, false, 'nothing is parked');
+
+  // the founder comes back to the laptop: the waiting tick runs now, not in 20s
+  sandbox.document.hidden = false;
+  fire('visibilitychange');
+  await settle(log);
+  assert.equal(log.cleared, 1, 'the slow timer is dropped');
+  assert.equal(log.fetched.filter((p) => /github-app\/status/.test(p)).length, 2, 'and the check runs immediately');
+  assert.equal(log.timers[log.timers.length - 1].ms, 4000, 'then the normal pace');
+
+  // off the create view the poll still parks (C8)
+  sandbox.currentView = 'map';
+  log.timers[log.timers.length - 1].fn();
+  assert.equal(sandbox.manifestPending, true);
+});
+
+test('the laptop left waiting ticks on its own while the phone approves (the owner read, hidden tab)', async () => {
+  let installed = false;
+  const instanceRead = () => ({
+    instance: { ...MINE },
+    github_app: { status: 'done', app_slug: 'mercury-app' },
+    github_setup: { checklist: { approve: 'done', install: installed ? 'done' : 'now', sign_in: 'done', device_flow: 'later', connected: installed }, install_url: null },
+  });
+  const { sandbox, log } = page({ url: '/projects?view=new', who: 7, hidden: true, instanceRead });
+  sandbox.startProgress(42);
+  await settle(log);
+  assert.equal(sandbox.live.setup.install, 'now');
+  assert.equal(log.timers.length, 1, 'still watching while hidden');
+  assert.equal(log.timers[0].ms, 20000, 'at the slow pace');
+  installed = true;              // the phone installed the app; the runner verified it
+  log.timers[0].fn();
+  await settle(log);
+  assert.equal(sandbox.live.setup.install, 'done', 'the checklist ticked without anyone touching the laptop');
+});

package/tests/projects_hub.mjs

@@ -355,8 +355,12 @@ test('C8 — the wizard polls stop dead off the new view, like the sky off the m
   // guard — merged unguarded they would poll a hidden view for up to 33
   // minutes. Both ticks must consult the same gate the sky consults.
   assert.match(SCRIPT, /function wizPollActive\(\)/, 'the wizard needs its own stage guard');
-  assert.match(SCRIPT, /!document\.hidden && currentView === 'new'/,
-    'the guard is hidden-tab aware and view-scoped');
+  assert.match(SCRIPT, /function wizPollActive\(\) \{\s*return currentView === 'new';\s*\}/,
+    'the guard is view-scoped');
+  // a HIDDEN tab slows the wizard's polls instead of stopping them (task 1004650): that
+  // is exactly when the founder is on GitHub. tests/github_handback_any_device.mjs runs it.
+  assert.match(SCRIPT, /return document\.hidden \? Math\.max\(ms, HIDDEN_POLL_MS\) : ms;/,
+    'a hidden tab keeps checking at the slow pace');
   const gatedTicks = (SCRIPT.match(/if \(!wizPollActive\(\)\)/g) || []).length;
   assert.ok(gatedTicks >= 2, `both wizard ticks (progress + manifest) must check the guard, found ${gatedTicks}`);
   assert.match(SCRIPT, /if \(v === 'new'\) wizard\.enter\(focus\); else wizard\.leave\(\);/,

package/tests/provisioning_callback_page.mjs

@@ -50,8 +50,9 @@ test('the hand-back variant escapes the title + domain it interpolates', () => {
   assert.doesNotMatch(html, /Setting up <your> instance/, 'no raw title anywhere on the page');
   assert.doesNotMatch(html, /https:\/\/evil"\.example\.com/, 'no unescaped domain in an href');
   // it IS the hand-back variant (task 1004548): the way back + the config block the client script reads
-  assert.match(html, /id="back" href="\/projects\?view=new"/);
-  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com","back":"\/projects\?view=new"\}/);
+  // the way back is the return route, which names the project on the server (task 1004650)
+  assert.ok(html.includes('id="back" href="/api/bongos/provisioning/github-app/return?state=GOODSTATE"'));
+  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com","back":"\/api\/bongos\/provisioning\/github-app\/return\?state=GOODSTATE"\}/);
 });
 
 test('the message variant escapes the title but passes server-authored body HTML through', () => {

package/tests/provisioning_github_app_routes.mjs

@@ -108,7 +108,11 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   t('good state → 200 text/html one-trip page', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /GitHub app created/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
   // task 1004649: GitHub's half of the approval is done — the SAME tab goes on to the install
   t('says the next step is installing it on the repo', /Next, install it on your repo/.test(html));
-  t('carries a plain way back to the project (works without script)', /<a class="btn" id="back" href="\/projects\?view=new">Back to my project/.test(html));
+  // task 1004650: the way back is the return route, which names the project on the server
+  t('carries a plain way back to the project (works without script)', html.includes('<a class="btn" id="back" href="/api/bongos/provisioning/github-app/return?state=GOODSTATE">Back to my project'));
+  // the script's config is the one the page SERVED, not a copy (task 1004650)
+  const servedCfg = JSON.parse((html.match(/window\.__CB_SETUP__=(\{[^<]*?\});/) || [])[1] || '{}');
+  t('the served config sends the founder to the return route, never to a bare create page', servedCfg.back === '/api/bongos/provisioning/github-app/return?state=GOODSTATE', JSON.stringify(servedCfg));
   t('no progress stepper or countdown left on the page', !/id="steps"/.test(html) && !/Placing credentials/.test(html) && !/location\.href=target/.test(html));
 
   // Run the served INSTALL script (not a copy): it polls the real status shape and goes on.
@@ -116,11 +120,11 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   t('the one-trip page ships its client script', typeof installScript === 'string' && /installations|install_url/.test(installScript));
   async function runInstall(statuses, repoAnswer) {
     const vm = await import('node:vm');
-    const back = { href: '/projects?view=new' }, note = { textContent: '' };
+    const back = { href: '' }, note = { textContent: '' };
     const timers = [], fetched = [];
     const calls = { replaced: null };
     const sandbox = {
-      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com', back: '/projects?view=new' },
+      __CB_SETUP__: servedCfg,
       document: { getElementById: (id) => (id === 'back' ? back : id === 'note' ? note : null) },
       location: { replace: (u) => { calls.replaced = u; } },
       setTimeout: (fn) => { timers.push(fn); return timers.length; },
@@ -154,9 +158,9 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
   const plain = await runInstall([named], null);
   t('a repo GitHub will not describe (private) falls back to the plain install page', plain.replaced === 'https://github.com/apps/mercury-app/installations/new?state=GOODSTATE', JSON.stringify(plain));
   const doneAlready = await runInstall([{ ...named, checklist: { ...named.checklist, install: 'done' } }], null);
-  t('already installed → straight back to the checklist', doneAlready.replaced === '/projects?view=new#ghstate=GOODSTATE', JSON.stringify(doneAlready));
+  t('already installed → straight back to the checklist', doneAlready.replaced === '/api/bongos/provisioning/github-app/return?state=GOODSTATE', JSON.stringify(doneAlready));
   const stopped = await runInstall([{ ...named, status: 'error' }], null);
-  t('a stopped attempt → back to the checklist, which says what stopped', stopped.replaced === '/projects?view=new#ghstate=GOODSTATE', JSON.stringify(stopped));
+  t('a stopped attempt → back to the checklist, which says what stopped', stopped.replaced === '/api/bongos/provisioning/github-app/return?state=GOODSTATE', JSON.stringify(stopped));
 }
 
 console.log('\nGET /provisioning/github-app/setup (the App\'s setup_url — task 1004649):');
@@ -181,16 +185,17 @@ console.log('\nGET /provisioning/github-app/setup (the App\'s setup_url — task
   // the plain hand-back page (now the setup_url's) still behaves as before (task 1004548)
   const callbackPage = require(`${ROOT}/modules/provisioning/routes/callback-page.js`).callbackPage;
   const html = callbackPage({ ok: true, title: 'Installed on GitHub', state: 'GOODSTATE', domain: 'mercury.example.com' });
-  t('carries a plain "back to my checklist" link (works without script)', /<a class="btn" id="back" href="\/projects\?view=new">Back to my checklist/.test(html));
+  t('carries a plain "back to my checklist" link (works without script)', html.includes('<a class="btn" id="back" href="/api/bongos/provisioning/github-app/return?state=GOODSTATE">Back to my checklist'));
+  const servedCfg = JSON.parse((html.match(/window\.__CB_SETUP__=(\{[^<]*?\});/) || [])[1] || '{}');
   const script = (html.match(/<script>\s*(\(function\(\)\{[\s\S]*?)<\/script>\s*<\/body>/) || [])[1];
   t('the hand-back page ships the client script', typeof script === 'string' && script.length > 100);
   async function runCallback({ opener }) {
     const vm = await import('node:vm');
-    const back = { href: '/projects?view=new' };
+    const back = { href: '' };
     const timers = [];
     const calls = { close: 0, focusOpener: 0, replaced: null };
     const sandbox = {
-      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com', back: '/projects?view=new' },
+      __CB_SETUP__: servedCfg,
       opener: opener ? { closed: false, focus: () => { calls.focusOpener++; } } : null,
       close: () => { calls.close++; },
       document: { getElementById: (id) => (id === 'back' ? back : null) },
@@ -204,12 +209,12 @@ console.log('\nGET /provisioning/github-app/setup (the App\'s setup_url — task
     while (timers.length) timers.shift()();
     return { ...calls, replacedBeforeTimer, backHref: back.href };
   }
-  const want = '/projects?view=new#ghstate=GOODSTATE';
+  const want = '/api/bongos/provisioning/github-app/return?state=GOODSTATE';
   const popup = await runCallback({ opener: true });
   t('as the wizard’s pop-up it focuses the checklist tab and closes itself', popup.focusOpener === 1 && popup.close === 1 && popup.replacedBeforeTimer === null, JSON.stringify(popup));
   t('…and if the browser refuses the close, the pop-up becomes the checklist', popup.replaced === want, JSON.stringify(popup));
   const sameTab = await runCallback({ opener: false });
-  t('as a same-tab return it goes straight back to the checklist, carrying the attempt in the fragment', sameTab.close === 0 && sameTab.replaced === want && sameTab.backHref === want, JSON.stringify(sameTab));
+  t('as a same-tab return it goes straight back through the return route, carrying the attempt', sameTab.close === 0 && sameTab.replaced === want && sameTab.backHref === want, JSON.stringify(sameTab));
 }
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=X&state=NOPE`);

package/tests/wizard_draft_resume.mjs

@@ -247,6 +247,10 @@ function runEnter({ draftStep, focus = false, resumeIntent = false, created = {
   const log = { shown: [], created: [], offer: undefined };
   const sandbox = {
     authKnown: true, me: { github_login: 'probe' }, resumeIntent,
+    // the server's resume read (task 1004650) already answered for this page load —
+    // this slice is about the record the tab stored (tests/github_handback_any_device.mjs
+    // holds the server's half)
+    resumeAsked: true, handbackProject: null, askServerResume() { throw new Error('not asked twice'); },
     state: { step: draftStep },
     createdRecord: () => created,
     enterCreated: (rec, f) => log.created.push({ id: rec.id, focus: f }),

package/tests/wizard_github_feedback.mjs

@@ -164,7 +164,8 @@ const SEED = SCRIPT.slice(SS, SE);
 test('the reload regions are still findable (a rename must fail loudly)', () => {
   assert.ok(WS > 0 && WE > WS, 'wait-timer boundaries found');
   assert.ok(SS > 0 && SE > SS, 'instance-read seed boundaries found');
-  assert.match(SCRIPT, /if \(!terminal \|\| manifestInFlight\(\) \|\| setupOpen\(\)\) pollTimer = setTimeout\(tick, 5000\);/,
+  // the pace slows while the tab is hidden, never stops (task 1004650)
+  assert.match(SCRIPT, /if \(!terminal \|\| manifestInFlight\(\) \|\| setupOpen\(\)\) pollTimer = setTimeout\(tick, wizPollDelay\(5000\)\);/,
     'a GitHub leg in flight — or an install not yet verified (task 1004649) — keeps the instance read alive once the project is up');
 });