@bongos/core 1.21.95 → 1.21.96

package/modules/provisioning/github-setup.js

@@ -37,8 +37,17 @@ const SETUP_EVENTS = Object.freeze({
   installReported: 'github-app-install-reported',
   installed: 'github-app-installed',
   deviceFlow: 'github-app-device-flow',
+  // the organisation the founder chose to make the app on (task 1004651); its detail is
+  // the org's login. Written by the mint route; absent = the founder's personal account.
+  appOrg: 'github-app-org',
 });
 
+// A GitHub login (1-39 chars, letters/digits and single inner hyphens). The org name the
+// mint route takes from the page passes this before it reaches a GitHub URL, and the
+// recorded one passes it again before it reaches a link. PURE.
+const GITHUB_LOGIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+function validGithubLogin(s) { return typeof s === 'string' && GITHUB_LOGIN_RE.test(s); }
+
 // How long after an attempt settles the runner keeps checking for the install and the
 // device-flow tick. Past it the checklist stops promising a self-tick for device flow
 // (the step says "turn it on later"); a fresh install report re-opens the window.
@@ -65,16 +74,23 @@ function targetRepo(inst) {
 // The verified facts for one instance since `since` (the attempt's created_at): when each
 // setup event was first seen, or null. One indexed read (idx_provisioning_events_instance).
 async function githubSetupFacts(db, instanceId, since) {
+  // `detail` is the newest row's, for the one event that carries a value (appOrg)
   const { rows } = await db.query(
-    `SELECT event, min(created_at) AS at FROM provisioning_events
+    `SELECT event, min(created_at) AS at, (array_agg(detail ORDER BY created_at DESC))[1] AS detail
+       FROM provisioning_events
       WHERE instance_id = $1 AND event = ANY($2) AND created_at >= $3
       GROUP BY event`,
     [instanceId, Object.values(SETUP_EVENTS), since || new Date(0).toISOString()]);
+  const find = (name) => rows.find((x) => x.event === name);
   const at = (name) => {
-    const r = rows.find((x) => x.event === name);
+    const r = find(name);
     return r && r.at ? new Date(r.at).toISOString() : null;
   };
-  return { installReportedAt: at(SETUP_EVENTS.installReported), installedAt: at(SETUP_EVENTS.installed), deviceFlowAt: at(SETUP_EVENTS.deviceFlow) };
+  const org = find(SETUP_EVENTS.appOrg);
+  return {
+    installReportedAt: at(SETUP_EVENTS.installReported), installedAt: at(SETUP_EVENTS.installed), deviceFlowAt: at(SETUP_EVENTS.deviceFlow),
+    appOrg: org && validGithubLogin(org.detail) ? org.detail : null,
+  };
 }
 
 // Each checklist step's state, from the latest attempt's EFFECTIVE status (manifest-truth's
@@ -113,7 +129,7 @@ function stillVerifying(row, facts = {}, now = Date.now()) {
 // lands on the setup page, which sends the founder back to their projects.
 // A failed facts read is "nothing verified yet" — the honest 'now' states, never a 500.
 async function githubSetupRead(db, inst, row, status, { now = Date.now(), withState = true } = {}) {
-  if (!row) return { checklist: githubChecklist(null, null), install_url: null, repo: targetRepo(inst), verifying: false };
+  if (!row) return { checklist: githubChecklist(null, null), install_url: null, repo: targetRepo(inst), verifying: false, app_org: null };
   let facts = {};
   // through module.exports so a route test can stub the one DB read on the cached module
   try { facts = await module.exports.githubSetupFacts(db, row.instance_id, row.created_at); } catch (_) { facts = {}; }
@@ -123,7 +139,13 @@ async function githubSetupRead(db, inst, row, status, { now = Date.now(), withSt
     install_url: checklist.install === 'done' ? null : installUrlFor({ appSlug: row.app_slug, state: withState ? row.state : null }),
     repo: targetRepo(inst),
     verifying: stillVerifying(row, facts, now),
+    // the organisation this attempt makes the app on, or null for the founder's account
+    // (task 1004651): the page links the app's settings under the right owner
+    app_org: validGithubLogin(facts.appOrg) ? facts.appOrg : null,
   };
 }
 
-module.exports = { SETUP_EVENTS, VERIFY_WINDOW_MS, installUrlFor, targetRepo, githubSetupFacts, githubChecklist, stillVerifying, githubSetupRead };
+module.exports = {
+  SETUP_EVENTS, VERIFY_WINDOW_MS, installUrlFor, targetRepo, githubSetupFacts, githubChecklist, stillVerifying, githubSetupRead,
+  validGithubLogin,
+};

package/modules/provisioning/routes/github-setup.js

@@ -100,6 +100,7 @@ module.exports = function buildGithubSetupRouter() {
         install_url: setup.install_url,
         repo: setup.repo,
         verifying: setup.verifying,
+        app_org: setup.app_org,
       });
     } catch (err) {
       log.error('[provisioning] GET /provisioning/github-app/status', err);

package/modules/provisioning/routes/provisioning.js

@@ -1230,11 +1230,22 @@ module.exports = function provisioningRoutes() {
   // GitHub, the owner approves, and GitHub redirects back to the public callback below.
   // The web tier only RECORDS the attempt (state token) — the control-plane runner does
   // the token exchange + cred placement (trust boundary intact, ADR 0111 §2).
-  // Body: { account? ('personal'|'org') }.
+  // Body: { account? ('personal'|'org'), org? (a GitHub organisation login) }.
+  // A personal or an organisation account (task 1004651): account 'org' makes the app on
+  // the organisation the founder chose on the page (`org`), else on the repo's owner. The
+  // org name is checked against GitHub's login rules here, never trusted from the page;
+  // whether the founder may make an app there is GitHub's to enforce on its own page
+  // (this module holds no GitHub token to ask with, ADR 0111 §2). Anything other than
+  // account 'org' is the founder's personal account, exactly as before.
   router.post('/provisioning/instances/:id/github-app', auth.requireBuilder, async (req, res) => {
     const id = parseId(req, res); // (req, res) — parseId sends 400 bad_id + returns null on failure
     if (!id) return;
-    if (validateOrRespond(req, res, { account: { type: 'string', maxLength: 12 } })) return;
+    if (validateOrRespond(req, res, { account: { type: 'string', maxLength: 12 }, org: { type: 'string', maxLength: 39 } })) return;
+    const wantsOrg = !!(req.body && req.body.account === 'org');
+    const typedOrg = wantsOrg && typeof req.body.org === 'string' ? req.body.org.trim() : '';
+    if (typedOrg && !githubSetup.validGithubLogin(typedOrg)) {
+      return res.fail('bad_org', { status: 400, message: 'That isn’t a GitHub organisation name: letters, numbers and single dashes, up to 39.' });
+    }
     try {
       const inst = await provisioning.getInstanceById(pool, id);
       if (!inst || String(inst.owner_builder_id) !== String(req.builder.id)) {
@@ -1249,6 +1260,14 @@ module.exports = function provisioningRoutes() {
       if (!origin) {
         return res.fail('mothership_origin_unset', { status: 500, message: 'This control plane has no publicOrigin configured — cannot build the GitHub redirect URL.' });
       }
+      // the org candidate: the one the founder chose, else the repo's owner (a login only)
+      const repoOwner = ownerFromTargetRef(inst.target_ref);
+      const orgLogin = typedOrg || (githubSetup.validGithubLogin(repoOwner) ? repoOwner : null);
+      // an explicit organisation choice never falls back to the personal account unseen
+      if (wantsOrg && !orgLogin) {
+        return res.fail('org_required', { status: 400, message: 'Name the GitHub organisation to make the app on.' });
+      }
+      const account = wantsOrg ? 'org' : 'personal';
       const state = crypto.randomBytes(32).toString('hex');
       const expiresAt = new Date(Date.now() + MANIFEST_STATE_TTL_MS).toISOString();
       await provisioning.createOAuthManifest(pool, { instanceId: id, state, requestedBy: req.builder.id, expiresAt });
@@ -1256,13 +1275,19 @@ module.exports = function provisioningRoutes() {
         instanceId: id, ownerBuilderId: req.builder.id, event: 'oauth-manifest-start',
         detail: 'GitHub App Manifest link minted', actor: 'api:self',
       }).catch(() => {});
+      // which account owns this attempt's app, so the page can link its settings there
+      // from any tab or device (github-setup.js reads it back as app_org)
+      if (account === 'org') {
+        await provisioning.recordEvent(pool, {
+          instanceId: id, ownerBuilderId: req.builder.id, event: githubSetup.SETUP_EVENTS.appOrg,
+          detail: orgLogin, actor: 'api:self',
+        }).catch(() => {});
+      }
 
       const manifest = provisioning.buildGithubAppManifest({
         instanceName: inst.slug, slug: inst.slug, instanceDomain: inst.domain,
         mothershipOrigin: origin, brand: mothershipBrand(),
       });
-      const orgLogin = ownerFromTargetRef(inst.target_ref);
-      const account = req.body && req.body.account === 'org' && orgLogin ? 'org' : 'personal';
       res.json({
         state,
         account,

package/modules/public-landing/public/projects.html

@@ -459,6 +459,13 @@ body:has(#view-new:not([hidden])) footer.foot{position:relative;z-index:1;backgr
 .hint strong{color:var(--ink);font-weight:500;}
 
 .row2{display:grid;grid-template-columns:1fr 1fr;gap:0 22px;}
+/* whose GitHub account (task 1004651): the account, the organisation, and a typed name
+   with its Check button sitting on the field's baseline */
+.acctPick{max-width:680px;}
+.acctPick .row2{grid-template-columns:1fr;}
+.acctPick .acctTyped{display:flex;align-items:flex-end;gap:14px;}
+.acctPick .acctTyped .wizField{flex:1;min-width:0;}
+.acctPick .acctTyped .btn{flex:none;margin:0 0 2px;}
 
 /* the choice (start fresh / adopt): two cells of one band on hairlines, the
    chosen one carrying the dot — the dot is the mark, so the icon leaves */
@@ -1810,6 +1817,21 @@ summary{min-height:24px;padding:3px 0;}
                           <!-- visibility is stated on EVERY repo path (task 1002721); updateFreshPreview()
                                replaces this floor with the same claim plus the resolved repo URL -->
                           <div class="hint" id="ghFreshHint">A new <strong>private</strong> repo. You can make it public later.</div>
+                          <!-- whose account the new repo is made on (task 1004651); the
+                               organisation names are GitHub's, so they are built as DOM
+                               text, never as markup -->
+                          <div class="acctPick" id="raPick">
+                            <div class="row2">
+                              <label class="wizField"><span>Whose account</span>
+                                <select id="raSel"><option value="personal">On my account</option><option value="org">On an organisation</option></select></label>
+                              <label class="wizField" id="raOrgField" hidden><span>Organisation</span><select id="raOrg"></select></label>
+                            </div>
+                            <div class="row2 acctTyped" id="raTyped" hidden>
+                              <label class="wizField"><span>Organisation name</span><input type="text" id="raName" placeholder="acme-studio" autocomplete="off" maxlength="39"></label>
+                              <button type="button" class="btn small ghost" id="raCheck">Check</button>
+                            </div>
+                            <p class="hint" id="raNote" aria-live="polite"></p>
+                          </div>
                         </div>
                         <div class="row2" id="manualHome">
                           <label class="wizField"><span>GitHub owner <small>(user or org)</small></span>
@@ -2104,6 +2126,20 @@ summary{min-height:24px;padding:3px 0;}
                 <p class="hint" id="doneRender" role="status" hidden></p>
                 <p class="hint" id="doneLook" role="status" hidden></p>
                 <div id="doneApp" hidden></div>
+                <!-- whose account GitHub makes the app on (task 1004651, the mockup's
+                     account select beside Connect GitHub); shown while Connect is offered -->
+                <div class="acctPick" id="aaPick" hidden>
+                  <div class="row2">
+                    <label class="wizField"><span>Make the app on</span>
+                      <select id="aaSel" aria-label="Which GitHub account"><option value="personal">On my account</option><option value="org">On an organisation</option></select></label>
+                    <label class="wizField" id="aaOrgField" hidden><span>Organisation</span><select id="aaOrg"></select></label>
+                  </div>
+                  <div class="row2 acctTyped" id="aaTyped" hidden>
+                    <label class="wizField"><span>Organisation name</span><input type="text" id="aaName" placeholder="acme-studio" autocomplete="off" maxlength="39"></label>
+                    <button type="button" class="btn small ghost" id="aaCheck">Check</button>
+                  </div>
+                  <p class="hint" id="aaNote" aria-live="polite"></p>
+                </div>
                 <ol class="humanSteps" id="humanSteps"></ol>
                 <!-- the STABLE live region: the strip inside is rebuilt every 5s tick,
                      and a live region that is itself replaced never announces -->
@@ -5438,13 +5474,16 @@ summary{min-height:24px;padding:3px 0;}
          Never before identity settles — myLogin()'s 'you' is display copy, and a
          draft that stored it would file target_ref "you/<repo>". */
       if (!me) return;
-      state.owner = myLogin();
+      /* the founder's own account, unless they chose an organisation for it (task 1004651) */
+      state.owner = state.repoOrg || myLogin();
       $('ghNewName').value = state.repo || '';
       updateFreshPreview();
+      if (repoPick) repoPick.load(state.repoAcct === 'org' ? (state.repoOrg || state.repoOrgTyped || '') : null);
     }
     function updateFreshPreview() {
       var hint = $('ghFreshHint');
-      var clash = state.repo && repoList.some(function (r) { return String(r.name).toLowerCase() === state.repo.toLowerCase(); });
+      /* repoList is the founder's OWN repos, so a clash is only knowable on their account */
+      var clash = !state.repoOrg && state.repo && repoList.some(function (r) { return String(r.name).toLowerCase() === state.repo.toLowerCase(); });
       if (state.repo && !validRepoName(state.repo)) {
         hint.className = 'hint err'; hint.textContent = 'Use letters, numbers, and . _ - (1–100 chars).';
       } else if (clash) {
@@ -5453,11 +5492,177 @@ summary{min-height:24px;padding:3px 0;}
         /* Visibility stated up front (task 1002694 / idea 1000684): repos WE create are
            private by default (github-repos.js, ADR 0370); the owner can make one
            public later from the project's manage page. */
-        hint.className = 'hint'; hint.innerHTML = 'A new <strong>private</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(myLogin()) + '/' + esc(state.repo || 'name') + '</code>. You can make it public later.';
+        hint.className = 'hint'; hint.innerHTML = 'A new <strong>private</strong> repo at <code style="font-family:var(--font-mono)">github.com/' + esc(state.repoOrg || myLogin()) + '/' + esc(state.repo || 'name') + '</code>. You can make it public later.';
       }
     }
     $('ghNewName').addEventListener('input', function () { state.repo = this.value.trim(); updateFreshPreview(); saveDraft(); });
 
+    /* ── whose GitHub account: mine or an organisation's (task 1004651) ──
+       Two pickers share this: the new repo's owner (part 02's Code row) and the app's
+       (part 03). The founder's organisations come from GET /github/orgs; GitHub may not
+       show this sign-in's memberships (it asks for repo access, not org access), so a
+       typed name with a Check button is always offered beside the list, and a role GitHub
+       did not tell us is said as such. For the app, an organisation the founder is known
+       not to own is listed with the reason and cannot be picked: only owners can make
+       apps there. Every organisation name is DOM text (textContent / option text). */
+    var GH_LOGIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+    var OTHER_ORG = '__other';   /* a login can never contain "_" */
+    var orgsRead = null;
+    function readOrgs() {
+      if (!orgsRead) {
+        orgsRead = fetch(API + '/github/orgs', { credentials: 'same-origin' })
+          .then(function (res) { return res.ok ? res.json() : null; })
+          .then(function (d) {
+            var orgs = d && Array.isArray(d.orgs) ? d.orgs.filter(function (o) { return o && GH_LOGIN_RE.test(String(o.login || '')); }) : [];
+            return { orgs: orgs, listed: (d && d.listed) || 'none' };
+          })
+          .catch(function () { orgsRead = null; return { orgs: [], listed: 'none' }; });
+      }
+      return orgsRead;
+    }
+    function acctPicker(p, opts) {
+      var el = { box: $(p + 'Pick'), sel: $(p + 'Sel'), orgField: $(p + 'OrgField'), org: $(p + 'Org'), typed: $(p + 'Typed'), name: $(p + 'Name'), check: $(p + 'Check'), note: $(p + 'Note') };
+      var orgs = [], listed = 'none', loaded = false, typed = null, checking = false;
+      function find(login) {
+        var l = String(login || '').toLowerCase();
+        for (var i = 0; i < orgs.length; i++) if (orgs[i].login.toLowerCase() === l) return orgs[i];
+        return null;
+      }
+      /* for the app only: GitHub will not let a known non-owner make it */
+      function refused(o) { return !!(opts.needsOwner && o && o.can_create_apps === false); }
+      function say(text, cls) { el.note.textContent = text || ''; el.note.className = 'hint' + (cls ? ' ' + cls : ''); }
+      function fill(want) {
+        while (el.org.firstChild) el.org.removeChild(el.org.firstChild);
+        var pick = '';
+        orgs.forEach(function (o) {
+          var opt = document.createElement('option');
+          opt.value = o.login;
+          if (refused(o)) {
+            opt.disabled = true;
+            opt.textContent = o.login + (o.role === 'member' ? ' (you’re a member, not an owner)' : ' (not open to you yet)');
+          } else {
+            opt.textContent = o.login;
+            if (!pick) pick = o.login;
+          }
+          el.org.appendChild(opt);
+        });
+        var other = document.createElement('option');
+        other.value = OTHER_ORG;
+        other.textContent = orgs.length ? 'Another organisation…' : 'Type its name…';
+        el.org.appendChild(other);
+        var w = want ? find(want) : null;
+        if (w && !refused(w)) pick = w.login;
+        else if (want) { pick = OTHER_ORG; el.name.value = want; }
+        el.org.value = pick || OTHER_ORG;
+      }
+      /* the choice: personal, or an organisation and whether it can go ahead */
+      function value() {
+        if (el.sel.value !== 'org') return { account: 'personal', ok: true };
+        var v = el.org.value;
+        if (v && v !== OTHER_ORG) { var o = find(v); return { account: 'org', org: o ? o.login : v, ok: !refused(o), access: o }; }
+        var nm = String(el.name.value || '').trim();
+        if (typed && !typed.missing && typed.login.toLowerCase() === nm.toLowerCase()) return { account: 'org', org: typed.login, ok: !refused(typed), access: typed };
+        return { account: 'org', org: '', ok: false, typedName: nm };
+      }
+      function paint() {
+        var isOrg = el.sel.value === 'org';
+        el.orgField.hidden = !isOrg || !loaded || !orgs.length;   /* nothing listed: just the typed name */
+        el.typed.hidden = !(isOrg && loaded && el.org.value === OTHER_ORG);
+        var v = value();
+        if (!isOrg) say('');
+        else if (!loaded) say('Reading your organisations from GitHub…');
+        else if (v.org && v.access && v.access.reason && (opts.needsOwner || v.access.can_create_apps === false)) say(v.access.reason, v.access.can_create_apps === false ? 'err' : '');
+        else if (v.org) say(v.access && v.access.can_create_apps ? 'You own ' + v.org + ' on GitHub.' : '');
+        else if (checking) say('Checking with GitHub…');
+        else if (typed && typed.missing && typed.login.toLowerCase() === String(el.name.value || '').trim().toLowerCase()) say(typed.reason, 'err');
+        else say(listed === 'none' && !orgs.length ? 'GitHub didn’t show us your organisations, so type its name and press Check.' : 'Type the organisation’s name and press Check.');
+        if (opts.onChange) opts.onChange(v);
+      }
+      function check() {
+        var nm = String(el.name.value || '').trim();
+        if (!GH_LOGIN_RE.test(nm)) { typed = { login: nm, missing: true, reason: 'That isn’t a GitHub organisation name: letters, numbers and single dashes, up to 39.' }; paint(); return; }
+        checking = true; typed = null; paint();
+        fetch(API + '/github/orgs/' + encodeURIComponent(nm), { credentials: 'same-origin' })
+          .then(function (res) {
+            return res.json().catch(function () { return {}; }).then(function (d) {
+              if (res.ok && d.org && GH_LOGIN_RE.test(String(d.org.login || ''))) return d.org;
+              var msg = (d.error && d.error.message) || '';
+              if (res.status === 404) return { login: nm, missing: true, reason: msg || ('GitHub didn’t show your account an organisation called ' + nm + '.') };
+              return { login: nm, missing: true, reason: 'We couldn’t check that with GitHub just now. Try again in a moment.' };
+            });
+          })
+          .catch(function () { return { login: nm, missing: true, reason: 'We couldn’t check that with GitHub just now. Try again in a moment.' }; })
+          .then(function (r) {
+            checking = false;
+            /* a name typed since the click is not the one this answer is about */
+            if (String(el.name.value || '').trim().toLowerCase() === nm.toLowerCase()) typed = r;
+            paint();
+          });
+      }
+      /* GitHub is asked for the organisations only once one is wanted */
+      function ensureOrgs(want) {
+        if (el.sel.value !== 'org') return;
+        readOrgs().then(function (d) {
+          var first = !loaded;
+          orgs = d.orgs; listed = d.listed; loaded = true;
+          /* a second look keeps what the founder already picked */
+          var keep = first ? want : (value().org || want);
+          fill(keep);
+          if (keep && el.org.value === OTHER_ORG && GH_LOGIN_RE.test(keep)) check();
+          paint();
+        });
+      }
+      el.sel.addEventListener('change', function () { paint(); ensureOrgs(''); });
+      el.org.addEventListener('change', paint);
+      el.name.addEventListener('input', paint);
+      el.name.addEventListener('keydown', function (ev) { if (ev.key === 'Enter') { ev.preventDefault(); check(); } });
+      el.check.addEventListener('click', check);
+      return {
+        value: value,
+        el: el,
+        /* want: null = the founder's own account; a login = that organisation; '' = an
+           organisation not picked yet */
+        load: function (want) {
+          el.sel.value = want != null ? 'org' : 'personal';
+          paint();
+          ensureOrgs(want);
+        },
+        /* the reason the choice cannot go ahead, said where it is made */
+        explain: function () {
+          if (el.org.value === OTHER_ORG && el.name) el.name.focus(); else el.org.focus();
+          if (!el.note.textContent) say('Pick the organisation, or choose your own account.', 'err');
+        }
+      };
+    }
+    var repoPick = acctPicker('ra', {
+      needsOwner: false,
+      onChange: function (v) {
+        if (state.repoAutoCreated) return;   /* GitHub already made it: the owner is a fact now */
+        state.repoAcct = v.account;
+        state.repoOrg = v.account === 'org' && v.ok ? v.org : '';
+        state.repoOrgTyped = v.account === 'org' && !v.org ? (v.typedName || '') : '';
+        if (me && repoAccess === true && state.mode !== 'adopt') state.owner = state.repoOrg || myLogin();
+        updateFreshPreview();
+        saveDraft();
+        if (typeof paintSetup === 'function') paintSetup();
+      }
+    });
+    /* part 03's account picker (task 1004651). Its default is the organisation the app
+       last went to, else the one the new repo went to, else the founder's own account —
+       set once per project, so a poll never undoes a choice. */
+    var appPick = acctPicker('aa', { needsOwner: true });
+    var appPickFor = null;
+    function syncAppPick(offered) {
+      var box = $('aaPick');
+      if (!box || !appPick) return;
+      box.hidden = !offered;
+      if (!offered || appPickFor === instanceId) return;
+      appPickFor = instanceId;
+      var rec = createdRecord() || {};
+      var want = appOrgLogin() || (state.repoAutoCreated && state.repoAcct === 'org' && state.repoOrg) || rec.repo_org || null;
+      appPick.load(want && /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.test(want) ? want : null);
+    }
+
     /* The adopt picker behaves like a standard combobox (owner design review, task
        1002247): the dropdown is open only while the visitor is choosing. Selecting a
        repo fills the search box with its full_name and collapses the list; focusing or
@@ -6019,8 +6224,10 @@ summary{min-height:24px;padding:3px 0;}
         if (works.indexOf(a.main_work) === -1) return homeErr('Mark which of them is your main one.');
       }
       if (repoAccess === true && state.mode !== 'adopt') {
-        /* Fresh with access: just the new repo NAME (owner is the signed-in account). */
+        /* Fresh with access: just the new repo NAME (owner is the signed-in account, or
+           the organisation the founder picked, task 1004651). */
         if (!validRepoName(state.repo)) return homeErr('Name the new repository (letters, numbers, and . _ -).');
+        if (state.repoAcct === 'org' && !state.repoOrg) return homeErr('Pick the organisation for the repo, or put it on your own account.');
       } else {
         /* Adopt (picker or manual) and the manual fallback: need a concrete owner + repo. */
         if (!state.owner || !state.repo) {
@@ -6430,10 +6637,13 @@ summary{min-height:24px;padding:3px 0;}
     function ensureFreshRepo() {
       if (state.mode === 'adopt' || repoAccess !== true) return Promise.resolve();
       if (state.repoAutoCreated && state.owner && state.repo) return Promise.resolve();
+      /* the founder's own account sends exactly what it always did; an organisation
+         rides as `org`, and the server checks the name again (task 1004651) */
+      var repoBody = state.repoAcct === 'org' && state.repoOrg ? { name: state.repo, org: state.repoOrg } : { name: state.repo };
       return fetch(API + '/github/repos', {
         method: 'POST', credentials: 'same-origin',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ name: state.repo })
+        body: JSON.stringify(repoBody)
       }).then(function (res) {
         return res.json().catch(function () { return {}; }).then(function (data) {
           if (res.status === 401 || res.status === 403) {
@@ -6449,6 +6659,8 @@ summary{min-height:24px;padding:3px 0;}
             var e = new Error((data.error && (data.error.message || data.error.code)) || ('HTTP ' + res.status));
             e.data = data;
             if (data.error && data.error.code === 'name_taken') { e.gotoHome = true; e.homeMsg = data.error.message; }
+            /* the organisation said no: its reason, where the owner is chosen */
+            if (data.error && /^(org_app_restricted|org_forbidden|org_not_found|bad_org)$/.test(data.error.code || '')) { e.gotoHome = true; e.homeMsg = data.error.message; }
             throw e;
           }
           var full = data.repo && data.repo.full_name;
@@ -6554,6 +6766,8 @@ summary{min-height:24px;padding:3px 0;}
             id: data.instance && data.instance.id, slug: state.slug, domain: madeDomain,
             noaddr: !madeDomain,
             mode: state.mode, name: state.name, at: Date.now(),
+            /* the organisation the new repo went to, so part 03 offers it for the app */
+            repo_org: state.repoAutoCreated && state.repoAcct === 'org' && state.repoOrg ? state.repoOrg : undefined,
             /* a demo's teammates, offered once the hall is up (task 1004503) */
             demo_invites: state.demo && state.demo.invites && state.demo.invites.length ? state.demo.invites.slice() : undefined
           }));
@@ -6608,7 +6822,7 @@ summary{min-height:24px;padding:3px 0;}
       return '<a href="' + (instanceId ? '?view=manage&id=' + encodeURIComponent(instanceId) : '?view=mine') +
         '">' + label + '</a>';
     }
-    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, setup: null, installUrl: null };
+    var live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null };
     var planPromises = {};             /* mode|domain → Promise<steps[]> */
     var lastStepsHtml = '';
     var lastProgHtml = '';            /* same change-only contract, for the progress strip */
@@ -6660,7 +6874,7 @@ summary{min-height:24px;padding:3px 0;}
           : '<li data-onboard-step="github-repo"><b>Your empty repo is ready</b><p>We created ' + repoLink + ' on GitHub for you — public (projects here are open by design), empty, and waiting. The scaffold lands there when the build runs; nothing for you to do here.</p></li>';
       }
       var ghNewUrl = githubNewRepoUrl(state.owner, state.repo);
-      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the owner and name already filled in), press <strong>Create repository</strong>, and leave it completely empty. It must land at exactly ' + repoLabel + ' — leave GitHub’s Owner box as prefilled (your personal account), because the build watches that exact address; a repo created under a different owner (an organization, say) is never found. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
+      return '<li' + (landed ? ' class="sdone"' : '') + ' data-onboard-step="github-repo"><b>Create the empty GitHub repo</b><p>Do this first — the build needs the repo to exist. Click below (GitHub opens with the owner and name already filled in), press <strong>Create repository</strong>, and leave it completely empty. It must land at exactly ' + repoLabel + ' — leave GitHub’s Owner box as prefilled, because the build watches that exact address; a repo created under a different owner is never found. GitHub will ask public or private — your choice; both work here, and we never change it. Seeing “repository not found” above? That just means the repo isn’t created yet — make it here.</p>' +
         '<a class="ghbtn" href="' + esc(ghNewUrl) + '" target="_blank" rel="noopener">' + GH_ICON + 'Create ' + repoLabel + ' on GitHub</a></li>';
     }
 
@@ -6713,6 +6927,17 @@ summary{min-height:24px;padding:3px 0;}
        reaches the markup goes through esc(). */
     function ghStep(key) { return live.setup && live.setup[key]; }
     function appTitle() { return 'Approve the ' + esc(state.name || state.slug || 'project') + ' app on GitHub'; }
+    /* the organisation that owns the app, when the founder made it on one (task 1004651) */
+    function appOrgLogin() {
+      return typeof live.appOrg === 'string' && /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/.test(live.appOrg) ? live.appOrg : null;
+    }
+    /* the app's own settings on GitHub: under its organisation, or under the founder's
+       account. A raw URL; callers esc() it into an attribute. */
+    function appSettingsUrl() {
+      if (!live.appSlug) return null;
+      var org = appOrgLogin();
+      return 'https://github.com' + (org ? '/organizations/' + encodeURIComponent(org) : '') + '/settings/apps/' + encodeURIComponent(live.appSlug);
+    }
 
     /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow is the primary path
        (gap 3 / idea 1000676); locked until a domain exists (the App needs the real
@@ -6745,12 +6970,14 @@ summary{min-height:24px;padding:3px 0;}
         if (live.manifest === 'expired') snag = 'That setup link expired (they last 30 minutes) — mint a fresh one.';
         else if (live.manifestCode === 'domain_required') snag = 'This project needs an address first — attach one from ' + projectPageLink('its own page') + ', then come back to this step.';
         else if (live.manifestFailure === 'sign_in_unconfirmed') {
-          var appLink = live.appSlug ? '<a href="https://github.com/settings/apps/' + esc(live.appSlug) + '" target="_blank" rel="noopener">your app on GitHub</a>' : 'the app on your GitHub account';
+          var appLink = live.appSlug ? '<a href="' + esc(appSettingsUrl()) + '" target="_blank" rel="noopener">your app on GitHub</a>' : 'the app on your GitHub account';
           return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>GitHub approved the app and the platform placed its credentials on your project, but your project didn’t confirm that sign-in works. Trying again would make a second app on your GitHub account and is unlikely to fix this — it needs a look from the platform team. <a href="/contact">Contact us</a> and mention ' + appLink + '.</p>' +
             progressMarkup(1, 1, 'Stopped: your project didn’t confirm sign-in.', 'isErr', 'signin') +
             '<button type="button" class="linklike" data-action="manifest-start">Try again anyway</button></li>';
         }
-        else if (live.manifestFailure === 'finish_failed') snag = 'GitHub approved the app, but the platform couldn’t finish setting up sign-in on your project. The app GitHub made is still on your account — delete it first (GitHub → Settings → Developer settings → GitHub Apps) so you don’t end up with two, then try again.';
+        else if (live.manifestFailure === 'finish_failed') snag = appOrgLogin()
+          ? 'GitHub approved the app, but the platform couldn’t finish setting up sign-in on your project. The app GitHub made is still on ' + esc(appOrgLogin()) + ' — delete it first (the organisation’s Settings → Developer settings → GitHub Apps) so you don’t end up with two, then try again.'
+          : 'GitHub approved the app, but the platform couldn’t finish setting up sign-in on your project. The app GitHub made is still on your account — delete it first (GitHub → Settings → Developer settings → GitHub Apps) so you don’t end up with two, then try again.';
         else { snag = 'GitHub setup didn’t start. Nothing was changed on GitHub — try again.'; raw = live.manifestMsg; }
         return '<li data-onboard-step="oauth-app"><b>' + appTitle() + '</b><p>' + snag + '</p>' +
           (raw ? '<details><summary>Technical details</summary><p>' + esc(raw) + '</p></details>' : '') +
@@ -6787,7 +7014,7 @@ summary{min-height:24px;padding:3px 0;}
       if (live.manifest !== 'done') {
         return '<li class="slocked soptional" data-onboard-step="device-flow">' + title + '<p>Optional — turn it on later. It lets builders sign in from a terminal, with the <code style="font-family:var(--font-mono)">bongos setup</code> command they run on their own machine; web sign-in works without it.</p></li>';
       }
-      var appUrl = live.appSlug ? 'https://github.com/settings/apps/' + esc(live.appSlug) : null;
+      var appUrl = live.appSlug ? esc(appSettingsUrl()) : null;
       return '<li class="soptional" data-onboard-step="device-flow">' + title + '<p>Optional — turn it on later. GitHub leaves it off on new apps and lets only you switch it on: ' +
         (appUrl
           ? 'open <a href="' + appUrl + '" target="_blank" rel="noopener">your app’s settings</a>, check <strong>Enable Device Flow</strong>, and save. '
@@ -6865,6 +7092,8 @@ summary{min-height:24px;padding:3px 0;}
           var r = STEP_RENDERERS[s.key];
           return r ? r(s) : '<li data-onboard-step="' + esc(s.key) + '"><b>' + esc(s.label || s.key) + '</b></li>';
         }).join('');
+        /* the account picker stands beside Connect GitHub, so it shows while that is offered */
+        syncAppPick(html.indexOf('data-action="manifest-start"') !== -1);
         if (html === lastStepsHtml) return;   /* change-only re-render — polls never clobber open UI */
         lastStepsHtml = html;
         $('humanSteps').innerHTML = html;
@@ -7007,13 +7236,26 @@ summary{min-height:24px;padding:3px 0;}
     var manifestGen = 0;
     function stopManifestPoll() { manifestGen += 1; if (manifestPollTimer) { clearTimeout(manifestPollTimer); manifestPollTimer = null; } }
 
+    /* the organisation the server says this attempt's app is on: change-only */
+    function noteAppOrg(org) {
+      var next = typeof org === 'string' && org ? org : null;
+      if (next === live.appOrg) return false;
+      live.appOrg = next;
+      return true;
+    }
+
     function startManifest(btn) {
       if (!instanceId) return;
+      /* an organisation that cannot go ahead says why where it is chosen, before any
+         tab opens or any link is minted */
+      var acct = appPick ? appPick.value() : { account: 'personal', ok: true };
+      if (!acct.ok) { appPick.explain(); return; }
       btn.disabled = true; btn.textContent = 'Preparing GitHub…';
       var tab = window.open('about:blank', 'ghAppSetup');
       fetch(API + '/provisioning/instances/' + encodeURIComponent(instanceId) + '/github-app', {
         method: 'POST', credentials: 'same-origin',
-        headers: { 'Content-Type': 'application/json' }, body: '{}'
+        /* the founder's own account posts exactly what it always did */
+        headers: { 'Content-Type': 'application/json' }, body: acct.account === 'org' ? JSON.stringify({ account: 'org', org: acct.org }) : '{}'
       }).then(function (res) {
         if (res.status === 401) { window.location.assign(API + '/auth/web/start?return=/projects%3Fview%3Dnew&repos=1'); throw new Error('signing in'); }
         return res.json().catch(function () { return {}; }).then(function (d) {
@@ -7032,6 +7274,7 @@ summary{min-height:24px;padding:3px 0;}
         form.appendChild(inp); document.body.appendChild(form);
         form.submit(); form.remove();
         live.manifest = 'pending'; live.manifestMsg = ''; live.manifestFailure = null;
+        noteAppOrg(d.account === 'org' ? d.org_login : null);
         manifestStartedAt = Date.now(); manifestStale = false;
         rememberManifest(d.state, 'pending');
         renderSteps();
@@ -7083,7 +7326,10 @@ summary{min-height:24px;padding:3px 0;}
           .then(function (d) {
             if (myGen !== manifestGen) return;
             if (d.app_slug && d.app_slug !== live.appSlug) { live.appSlug = d.app_slug; rememberManifest(undefined, undefined, d.app_slug); renderSteps(); }
-            if (seedSetup(d.checklist, d.install_url)) renderSteps();   /* the server-verified ticks (task 1004649) */
+            /* the server-verified ticks (task 1004649), and whose account the app is on */
+            var setupMoved = seedSetup(d.checklist, d.install_url);
+            if (noteAppOrg(d.app_org)) setupMoved = true;
+            if (setupMoved) renderSteps();
             var next = d.ready ? 'done' : (d.status || 'pending');
             var failure = d.failure || null;
             if (next !== live.manifest || failure !== live.manifestFailure) { live.manifest = next; live.manifestFailure = failure; rememberManifest(undefined, next); renderSteps(); }
@@ -7329,7 +7575,11 @@ summary{min-height:24px;padding:3px 0;}
               else noteManifestWait();
             }
             /* the server-verified checklist rides the same read (task 1004649) */
-            if (data.github_setup && !manifestPollTimer && seedSetup(data.github_setup.checklist, data.github_setup.install_url)) renderSteps();
+            if (data.github_setup && !manifestPollTimer) {
+              var seedMoved = seedSetup(data.github_setup.checklist, data.github_setup.install_url);
+              if (noteAppOrg(data.github_setup.app_org)) seedMoved = true;
+              if (seedMoved) renderSteps();
+            }
             /* the checklist reflects live state (task 1002694): a status transition —
                e.g. the scaffold landing — re-renders the steps (change-only, so the
                5s tick never clobbers an open dropdown or mid-flight button) */
@@ -7369,7 +7619,7 @@ summary{min-height:24px;padding:3px 0;}
       instanceId = null;
       watchPending = false; manifestPending = false; manifestState = null;
       manifestStartedAt = 0; manifestStale = false;
-      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, setup: null, installUrl: null };
+      live = { instStatus: null, addrReady: false, manifest: null, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug: null, appOrg: null, setup: null, installUrl: null };
       lastStepsHtml = '';
       lastProgHtml = '';
       hopReset();

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.95",
+  "version": "1.21.96",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.95",
+      "version": "1.21.96",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.95",
+  "version": "1.21.96",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9400,5 +9400,11 @@
       "id": "1004650",
       "text": "Connecting GitHub no longer depends on staying in one browser tab. After you approve on GitHub, even on your phone or in another window, you land back on your own project's GitHub checklist. Our server remembers which project"
     }
+  ],
+  "1.21.96": [
+    {
+      "id": "1004651",
+      "text": "Founders can now put a new project under a GitHub organisation, not only their own account. When connecting GitHub, they choose \"On my account\" or \"On an organisation\". Their organisations are listed; one they only belong to ("
+    }
   ]
 }