@bongos/core 1.21.95 → 1.21.97

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.95",
+  "version": "1.21.97",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.95",
+      "version": "1.21.97",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.95",
+  "version": "1.21.97",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9400,5 +9400,17 @@
       "id": "1004650",
       "text": "Connecting GitHub no longer depends on staying in one browser tab. After you approve on GitHub, even on your phone or in another window, you land back on your own project's GitHub checklist. Our server remembers which project"
     }
+  ],
+  "1.21.96": [
+    {
+      "id": "1004651",
+      "text": "Founders can now put a new project under a GitHub organisation, not only their own account. When connecting GitHub, they choose \"On my account\" or \"On an organisation\". Their organisations are listed; one they only belong to ("
+    }
+  ],
+  "1.21.97": [
+    {
+      "id": "1004652",
+      "text": "Connecting GitHub no longer makes a second app when something goes wrong. If a step stops, the checklist shows which one, says in one plain sentence that nothing is lost, and gives a \"Pick up where it stopped\" button that carr"
+    }
   ]
 }

package/scripts/gds/provision-github-setup.js

@@ -19,14 +19,19 @@
 // A verified fact is recorded once as a provisioning_events row; the checklist reads it.
 //
 // BOUNDED. Only attempts that settled within VERIFY_WINDOW_MS, or whose install was
-// reported within it, are checked, at most SWEEP_LIMIT per tick — so a finished or
-// abandoned project costs nothing, and a founder who ticks device flow later re-opens the
-// window by reinstalling or from the hall (task 1004652 owns "check again").
+// reported or a check requested within it, are checked, at most SWEEP_LIMIT per tick — so
+// a finished or abandoned project costs nothing, and "Pick up where it stopped" / "Check
+// again" on the project page re-opens the window (task 1004652).
+// SIGN-IN, TOO (task 1004652). An attempt that stopped because the project did not confirm
+// sign-in in time ('error' with the app's keys placed) is re-asked on each tick in the
+// window, with the keys already placed: when the project now answers auth_configured the
+// attempt becomes 'done' — the same app, never a second one.
 // Secrets: web.env is read on the box, parsed in memory, and only NAMES ever reach a log.
 
 const crypto = require('node:crypto');
 const { webEnvPath } = require('./provision-units.js');
 const { SETUP_EVENTS, VERIFY_WINDOW_MS, githubSetupFacts, targetRepo } = require('../../modules/provisioning/github-setup.js');
+const { parseHealthzAuth } = require('./oauth-secret.js');
 
 const SWEEP_LIMIT = 20;
 const UA = 'cloud-bongos-provisioner';
@@ -95,22 +100,29 @@ async function attemptsToVerify(db) {
   const { rows } = await db.query(
     `WITH latest AS (
        SELECT DISTINCT ON (instance_id) * FROM provisioning_oauth_manifests ORDER BY instance_id, created_at DESC)
-     SELECT l.id, l.instance_id, l.created_at, l.requested_by, i.slug, i.target_ref, i.hosting_shape, i.status AS instance_status
+     SELECT l.id, l.instance_id, l.created_at, l.requested_by, l.status, i.slug, i.port, i.target_ref, i.hosting_shape, i.status AS instance_status
        FROM latest l JOIN provisioning_instances i ON i.id = l.instance_id
       WHERE l.app_id IS NOT NULL AND l.status IN ('done', 'error') AND i.status = 'active'
         AND (l.updated_at > now() - ($1 * interval '1 second')
              OR EXISTS (SELECT 1 FROM provisioning_events e WHERE e.instance_id = l.instance_id
-                         AND e.event = $2 AND e.created_at > now() - ($1 * interval '1 second')))
+                         AND e.event = ANY($2) AND e.created_at > now() - ($1 * interval '1 second')))
       ORDER BY l.updated_at DESC LIMIT ${SWEEP_LIMIT}`,
-    [windowSec, SETUP_EVENTS.installReported]);
+    [windowSec, [SETUP_EVENTS.installReported, SETUP_EVENTS.checkRequested]]);
   return rows;
 }
 
+// Does the project answer that sign-in is configured? The project's JSON health read
+// (the same probe as provision.js authHealthzCmd — the root /healthz says a plain "ok").
+function signInAnswers(r, boxExec) {
+  const out = boxExec(`curl -sS --max-time 5 http://127.0.0.1:${r.port}/api/bongos/healthz`, { allowFail: true });
+  return parseHealthzAuth(out && out.stdout).authConfigured === true;
+}
+
 // One tick: for every attempt in the window, check whatever is not verified yet and record
 // what GitHub confirmed. Returns { checked, installed, deviceFlow }.
 async function verifyGithubAppSetups(deps) {
   const { db, provisioning, log, apply } = deps;
-  const out = { checked: 0, installed: 0, deviceFlow: 0 };
+  const out = { checked: 0, installed: 0, deviceFlow: 0, signIn: 0 };
   const rows = await attemptsToVerify(db);
   if (!apply) {
     for (const r of rows) log(`  would check the GitHub install + device flow for ${r.slug} (manifest #${r.id})`);
@@ -118,9 +130,17 @@ async function verifyGithubAppSetups(deps) {
   }
   for (const r of rows) {
     const facts = await githubSetupFacts(db, r.instance_id, r.created_at);
-    if (facts.installedAt && facts.deviceFlowAt) continue;
+    const signInStopped = r.status === 'error';
+    if (facts.installedAt && facts.deviceFlowAt && !signInStopped) continue;
     const onControlBox = r.hosting_shape === 'cloud-host' || r.hosting_shape === 'control-plane';
     const boxExec = onControlBox ? (deps.controlExec || deps.exec) : deps.exec;
+    if (signInStopped && signInAnswers(r, boxExec)) {
+      await provisioning.resolveOAuthManifest(db, r.id, 'done', { github_code: null });
+      await provisioning.recordEvent(db, { instanceId: r.instance_id, ownerBuilderId: r.requested_by, event: 'oauth-manifest-done',
+        detail: 'sign-in confirmed on a later check, with the app already made', actor: 'runner' }).catch(() => {});
+      out.signIn++; log(`  ✓ ${r.slug}: sign-in now confirmed`);
+    }
+    if (facts.installedAt && facts.deviceFlowAt) { out.checked++; continue; }
     const read = boxExec(`${deps.privileged ? 'sudo ' : ''}cat ${webEnvPath(r)}`, { allowFail: true });
     const creds = appCredsFromEnv(read && read.stdout);
     out.checked++;
@@ -141,7 +161,7 @@ async function verifyGithubAppSetups(deps) {
       }
     }
   }
-  if (out.checked) log(`github-setup — checked=${out.checked} installed=${out.installed} device-flow=${out.deviceFlow}`);
+  if (out.checked) log(`github-setup — checked=${out.checked} installed=${out.installed} device-flow=${out.deviceFlow} sign-in=${out.signIn}`);
   return out;
 }
 

package/scripts/gds/provision.js

@@ -1081,14 +1081,22 @@ async function placeManifestCreds(inst, mrow, deps) {
   // 3) rewrite web.env with the creds + restart the unit (never logs the secret — the
   //    writeFile logs only a byte count; the value is base64/temp-file placed).
   log(`  [oauth-manifest] place creds in ${webEnvPath(inst)} + restart ${inst.slug}`);
-  boxWriteFile(webEnvPath(inst), webEnvBody(inst, {
-    clientId: creds.clientId, clientSecret: creds.clientSecret, ownerLogin: await ownerLoginOf(inst, deps.db),
-    // The App id + private key double as the ADR 0055 publish credential (task
-    // 1003049); older Apps (pre-permission manifests) return a pem too — placing
-    // it is harmless and heals once the owner grants the permissions + installs.
-    appId: creds.appId, appPem: creds.appPem,
-  }), { mode: 0o600, sudo: true });
-  pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
+  try {
+    boxWriteFile(webEnvPath(inst), webEnvBody(inst, {
+      clientId: creds.clientId, clientSecret: creds.clientSecret, ownerLogin: await ownerLoginOf(inst, deps.db),
+      // The App id + private key double as the ADR 0055 publish credential (task
+      // 1003049); older Apps (pre-permission manifests) return a pem too — placing
+      // it is harmless and heals once the owner grants the permissions + installs.
+      appId: creds.appId, appPem: creds.appPem,
+    }), { mode: 0o600, sudo: true });
+    pmFor(deps).restartService(inst, { exec: boxExec, sudoP });
+  } catch (e) {
+    // The code is spent and the keys are not placed: a retry would re-convert a burned
+    // code, so say so (codeSpent) and name the app GitHub made for the platform team
+    // (task 1004652 — the wizard offers to send it to them; the slug stays OFF the row,
+    // because a recorded slug reads as "keys placed").
+    return { ok: false, codeSpent: apply, error: `GitHub made the app ${creds.appSlug || creds.appId || '?'}, but placing its keys failed: ${e.message}` };
+  }
   // The app now exists AND its credentials are placed — the checklist's first tick, and the
   // slug the callback page needs to send the founder on to installing it (task 1004649).
   if (apply && deps.onCredsPlaced) await Promise.resolve().then(() => deps.onCredsPlaced({ appId: creds.appId, appSlug: creds.appSlug })).catch(() => {});
@@ -1182,7 +1190,10 @@ async function drainOAuthManifests(deps) {
         converted++;
       }
     } catch (e) {
-      await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: e.message }).catch(() => {});
+      // GitHub's 404 means the code is used or past its hour: drop it, so "pick up where it
+      // stopped" (task 1004652) never re-queues a dead code. Any other failure keeps it.
+      const dead = /conversion failed: (Not Found|HTTP 404)/.test(String(e.message));
+      await provisioning.resolveOAuthManifest(db, mrow.id, 'error', { last_error: e.message, ...(dead ? { github_code: null } : {}) }).catch(() => {});
       errors++; log(`  ✖ oauth-manifest #${mrow.id}: ${e.message}`);
     }
   }

package/src/bongos/github-repos.js

@@ -103,6 +103,134 @@ async function createUserRepo(token, { name, fetchImpl = fetch } = {}) {
   throw new GithubApiError(`GitHub create-repo failed (${res.status})`, { status: res.status, code: 'github_error' });
 }
 
+// ---- organisations (task 1004651) ----
+// A founder can put the project under a GitHub organisation instead of their personal
+// account: the empty repo (createOrgRepo) and the project's sign-in app (the manifest
+// flow's /organizations/<org>/settings/apps/new, built by the provisioning module).
+//
+// THE SCOPE LIMIT, said once. The hub's sign-in asks for `read:user repo` (ADR 0155/0364)
+// and not `read:org`, so GitHub may refuse the membership reads below for this token.
+// Widening the sign-in scope is auth-config.js's call, not this file's, so every read
+// here DEGRADES rather than fails: the role-carrying membership list when GitHub allows
+// it, else the organisations the founder's repos sit in (role unknown), and always a
+// typed name the founder can have checked. A role we could not read is said as such,
+// never guessed as "owner", and GitHub's own page still refuses a non-owner.
+
+// A GitHub login: 1-39 chars, letters/digits and single inner hyphens. The gate every
+// org name passes before it reaches a GitHub URL (the page's copy is never trusted).
+const GITHUB_LOGIN_RE = /^[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}$/;
+function validGithubLogin(s) { return typeof s === 'string' && GITHUB_LOGIN_RE.test(s); }
+
+// GitHub's refusal when the org restricts which OAuth apps may act for it. Matched on
+// the message because GitHub gives it no code of its own.
+function isAppRestricted(body) {
+  return /OAuth App access restrictions|third-party application access/i.test(String((body && body.message) || ''));
+}
+async function readBody(res) {
+  try { return await res.json(); } catch (_) { return {}; }
+}
+function unauthorized() {
+  return new GithubApiError('GitHub rejected the stored token', { status: 401, code: 'github_unauthorized' });
+}
+
+// One membership → what the page shows. Only an ACTIVE admin (an org owner) can make
+// an app on the org; anyone else gets the reason in words. role null = unknown. PURE.
+function orgAccess({ login, role = null, state = null }) {
+  if (role === 'admin' && state === 'active') return { login, role, can_create_apps: true, reason: null };
+  if (role && state === 'pending') {
+    return { login, role, can_create_apps: false, reason: `Your invitation to ${login} is still waiting. Accept it on GitHub first.` };
+  }
+  if (role) {
+    return { login, role, can_create_apps: false, reason: `You're a member of ${login}, not an owner. Only its owners can make apps there.` };
+  }
+  return {
+    login, role: null, can_create_apps: null,
+    reason: `GitHub didn't tell us your role in ${login}. Only its owners can make the app there; if you aren't one, GitHub will say so on its own page.`,
+  };
+}
+
+// The founder's organisations: { orgs: [orgAccess...], listed: 'memberships'|'repos'|'none' }.
+// 'memberships' carries real roles; 'repos' is the fallback for a token GitHub will not
+// show memberships to (the orgs the founder's repos live in, roles unknown); 'none' means
+// GitHub showed neither, and the page offers only the typed name. Sorted by login.
+async function listUserOrgs(token, { fetchImpl = fetch } = {}) {
+  const byLogin = (a, b) => a.login.toLowerCase().localeCompare(b.login.toLowerCase());
+  const res = await fetchImpl(`${GH_API}/user/memberships/orgs?per_page=${PER_PAGE}`, { headers: ghHeaders(token) });
+  if (res.status === 401) throw unauthorized();
+  if (res.ok) {
+    const rows = await readBody(res);
+    const orgs = (Array.isArray(rows) ? rows : [])
+      .map((m) => ({ login: m && m.organization && m.organization.login, role: m && m.role, state: m && m.state }))
+      .filter((m) => validGithubLogin(m.login))
+      .map(orgAccess)
+      .sort(byLogin);
+    return { orgs, listed: 'memberships' };
+  }
+  // No membership read for this token: the organisations its repos sit in. One page,
+  // a hint list and never a gate; the typed name covers the rest.
+  const r2 = await fetchImpl(`${GH_API}/user/repos?per_page=${PER_PAGE}&sort=updated&affiliation=organization_member`, { headers: ghHeaders(token) });
+  if (r2.status === 401) throw unauthorized();
+  if (!r2.ok) return { orgs: [], listed: 'none' };
+  const repos = await readBody(r2);
+  const seen = new Map();
+  for (const r of Array.isArray(repos) ? repos : []) {
+    const o = r && r.owner;
+    if (o && o.type === 'Organization' && validGithubLogin(o.login) && !seen.has(o.login.toLowerCase())) {
+      seen.set(o.login.toLowerCase(), orgAccess({ login: o.login }));
+    }
+  }
+  return { orgs: [...seen.values()].sort(byLogin), listed: 'repos' };
+}
+
+// Check ONE organisation the founder typed: its orgAccess, or a typed org_not_found when
+// GitHub has no organisation by that name (a personal account's login included). The
+// membership read answers with the role when this token may read it; otherwise the
+// public org read proves the org exists and the role stays unknown.
+async function getOrgAccess(token, { org, fetchImpl = fetch } = {}) {
+  if (!validGithubLogin(org)) throw new GithubApiError('Not a GitHub organisation name', { status: 400, code: 'bad_org' });
+  const res = await fetchImpl(`${GH_API}/user/memberships/orgs/${encodeURIComponent(org)}`, { headers: ghHeaders(token) });
+  if (res.status === 401) throw unauthorized();
+  if (res.ok) {
+    const m = await readBody(res);
+    const login = m && m.organization && validGithubLogin(m.organization.login) ? m.organization.login : org;
+    return orgAccess({ login, role: (m && m.role) || null, state: (m && m.state) || null });
+  }
+  const r2 = await fetchImpl(`${GH_API}/orgs/${encodeURIComponent(org)}`, { headers: ghHeaders(token) });
+  if (r2.status === 401) throw unauthorized();
+  if (r2.status === 404) throw new GithubApiError('GitHub has no organisation by that name', { status: 404, code: 'org_not_found' });
+  if (!r2.ok) throw new GithubApiError(`GitHub /orgs read failed (${r2.status})`, { status: r2.status, code: 'github_error' });
+  const o = await readBody(r2);
+  if (o && o.type && o.type !== 'Organization') throw new GithubApiError('That name is a personal account', { status: 404, code: 'org_not_found' });
+  return orgAccess({ login: o && validGithubLogin(o.login) ? o.login : org });
+}
+
+// Create an EMPTY repo under an organisation: the org twin of createUserRepo, with the
+// same fixed body (private, no first commit; ADR 0370). GitHub decides who may, and a
+// refusal is typed so the page can say WHY:
+//   org_app_restricted - the org limits which OAuth apps may act for it
+//   org_forbidden      - this member may not create repos there
+//   org_not_found      - no such org, or this account cannot see it
+async function createOrgRepo(token, { org, name, fetchImpl = fetch } = {}) {
+  if (!validGithubLogin(org)) throw new GithubApiError('Not a GitHub organisation name', { status: 400, code: 'bad_org' });
+  const res = await fetchImpl(`${GH_API}/orgs/${encodeURIComponent(org)}/repos`, {
+    method: 'POST',
+    headers: ghHeaders(token, { 'Content-Type': 'application/json' }),
+    body: JSON.stringify({ name, private: true, auto_init: false }),
+  });
+  if (res.status === 201) {
+    const r = await res.json();
+    return { full_name: r.full_name, html_url: r.html_url };
+  }
+  if (res.status === 401) throw unauthorized();
+  if (res.status === 422) throw new GithubApiError('A repository with that name already exists in the organisation', { status: 422, code: 'name_taken' });
+  if (res.status === 403) {
+    const body = await readBody(res);
+    throw new GithubApiError('GitHub refused the org repo', { status: 403, code: isAppRestricted(body) ? 'org_app_restricted' : 'org_forbidden' });
+  }
+  if (res.status === 404) throw new GithubApiError('GitHub answered 404 for that organisation', { status: 404, code: 'org_not_found' });
+  throw new GithubApiError(`GitHub create-org-repo failed (${res.status})`, { status: res.status, code: 'github_error' });
+}
+
 // Read one repo as GitHub answers it FOR THIS TOKEN — the manage page's
 // visibility read (task 1003045). GitHub's own 404 covers both "no such repo"
 // and "no access", which is exactly the no-leak shape the caller wants to
@@ -252,6 +380,7 @@ async function deleteDeployKey(token, { owner, name, keyId, fetchImpl = fetch }
 
 module.exports = {
   listUserRepos, createUserRepo, getUserRepo, makeRepoPublic, makeRepoPrivate,
+  listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin,
   listDeployKeys, addDeployKey, deleteDeployKey,
   GithubApiError, MAX_PAGES,
 };

package/src/bongos/routes/github.js

@@ -19,12 +19,13 @@ const express = require('express');
 const auth = require('../auth');
 const db = require('../db');
 const secretBox = require('../secret-box');
-const { listUserRepos, createUserRepo } = require('../github-repos');
+const { listUserRepos, createUserRepo, listUserOrgs, getOrgAccess, createOrgRepo, validGithubLogin } = require('../github-repos');
 // Namespace require for the visibility helpers (task 1003045): the route tests
 // stub these on the cached module object, which a load-time destructure would
 // pin to the real implementations.
 const githubRepos = require('../github-repos');
 const { validateOrRespond } = require('./_helpers');
+const log = require('../logger').logger.child({ src: 'github' });
 
 // GitHub repo names: 1–100 chars of [A-Za-z0-9._-]. We validate strictly for a clean
 // 400; anything GitHub still rejects surfaces as the 422→409 name_taken path.
@@ -33,6 +34,14 @@ const REPO_NAME_RE = /^[A-Za-z0-9._-]{1,100}$/;
 // hyphens) over a repo name. Strict for a clean 400; GitHub still owns the truth.
 const REPO_REF_RE = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})?\/[A-Za-z0-9._-]{1,100}$/;
 
+// The two org refusals the org routes share (task 1004651).
+function badOrg(res) {
+  return res.fail('bad_org', { status: 400, message: 'That isn’t a GitHub organisation name: letters, numbers and single dashes, up to 39.' });
+}
+function orgNotFound(res, org) {
+  return res.fail('org_not_found', { status: 404, message: `GitHub didn’t show your account an organisation called ${org}.` });
+}
+
 // Parse + validate the owner/name ref, or send a 400 and return null.
 function parseRepoRef(raw, res) {
   const ref = String(raw || '').trim();
@@ -92,22 +101,79 @@ module.exports = function buildGithubRouter() {
     }
   });
 
-  // rank: any-builder — creates a repo in the caller's OWN account.
+  // rank: any-builder — the caller's OWN GitHub organisations (task 1004651), for the
+  // project page's "on an organisation" choice. Each row says whether the caller can make
+  // an app there and, when not, why. `listed` says how much GitHub showed this token
+  // (github-repos.listUserOrgs): the page always offers a typed name beside the list.
+  router.get('/github/orgs', auth.requireBuilder, async (req, res) => {
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      res.json(await listUserOrgs(token));
+    } catch (err) {
+      if (err && err.status === 401) {
+        await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+        return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to list your organisations.' });
+      }
+      log.error('[gds] GET /github/orgs', err && err.message);
+      res.fail('github_error', { status: 502, message: 'GitHub could not be reached. Try again in a moment.' });
+    }
+  });
+
+  // rank: any-builder — checks ONE organisation name the caller typed, as their own
+  // GitHub credential sees it (task 1004651). The name is checked against GitHub's login
+  // rules before it reaches a URL.
+  router.get('/github/orgs/:org', auth.requireBuilder, async (req, res) => {
+    const org = String(req.params.org || '').trim();
+    if (!validGithubLogin(org)) return badOrg(res);
+    const token = await resolveRepoToken(req, res);
+    if (!token) return;
+    try {
+      res.json({ org: await getOrgAccess(token, { org }) });
+    } catch (err) {
+      if (err && err.status === 401) {
+        await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
+        return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to check the organisation.' });
+      }
+      if (err && err.code === 'org_not_found') return orgNotFound(res, org);
+      log.error('[gds] GET /github/orgs/:org', err && err.message);
+      res.fail('github_error', { status: 502, message: 'GitHub could not be reached. Try again in a moment.' });
+    }
+  });
+
+  // rank: any-builder — creates a repo in the caller's OWN account, or (task 1004651)
+  // under an organisation they name in `org`. GitHub decides whether they may; its
+  // refusals come back as 409s with the reason, never as a 403 (the page reads a 403 as
+  // "sign in again").
   router.post('/github/repos', auth.requireBuilder, async (req, res) => {
-    if (validateOrRespond(req, res, { name: { required: true, type: 'string', maxLength: 100 } })) return;
+    if (validateOrRespond(req, res, {
+      name: { required: true, type: 'string', maxLength: 100 },
+      org: { type: 'string', maxLength: 39 },
+    })) return;
     const name = String((req.body && req.body.name) || '').trim();
     if (!REPO_NAME_RE.test(name)) {
       return res.fail('bad_repo_name', { status: 400, message: 'Repository names use letters, numbers, and . _ - (1–100 chars).' });
     }
+    const org = req.body && req.body.org != null ? String(req.body.org).trim() : '';
+    if (org && !validGithubLogin(org)) return badOrg(res);
     const token = await resolveRepoToken(req, res);
     if (!token) return;
     try {
-      const repo = await createUserRepo(token, { name });
+      const repo = org ? await createOrgRepo(token, { org, name }) : await createUserRepo(token, { name });
       res.status(201).json({ repo });
     } catch (err) {
       if (err && err.code === 'name_taken') {
-        return res.fail('name_taken', { status: 409, message: 'You already have a repository with that name. Pick another, or adopt the existing one.' });
+        return res.fail('name_taken', { status: 409, message: org
+          ? `${org} already has a repository with that name. Pick another, or adopt the existing one.`
+          : 'You already have a repository with that name. Pick another, or adopt the existing one.' });
+      }
+      if (org && err && err.code === 'org_app_restricted') {
+        return res.fail('org_app_restricted', { status: 409, message: `${org} only lets apps its owners have approved act for it. An owner can approve this platform in the organisation's settings (Third-party access), or create the repo yourself.` });
+      }
+      if (org && err && err.code === 'org_forbidden') {
+        return res.fail('org_forbidden', { status: 409, message: `GitHub didn't let your account create a repository in ${org}. Ask one of its owners, or put the project on your own account.` });
       }
+      if (org && err && err.code === 'org_not_found') return orgNotFound(res, org);
       if (err && err.status === 401) {
         await db.deleteGithubToken({ builderId: req.builder.id }).catch(() => {});
         return res.fail('repo_scope_required', { status: 403, message: 'Your GitHub authorization expired. Reconnect to create the repo.' });

package/src/module-api.js

@@ -75,7 +75,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.21.95'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.21.97'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/github_one_trip.mjs

@@ -153,7 +153,7 @@ test('the runner records what GitHub confirmed — and only that — reading the
     exec: (cmd) => { cmds.push(cmd); return { ok: true, stdout: ENV }; },
     provisioning: { recordEvent: async (_db, e) => { events.push(e); } },
   });
-  assert.deepEqual(out, { checked: 1, installed: 1, deviceFlow: 0 });
+  assert.deepEqual(out, { checked: 1, installed: 1, deviceFlow: 0, signIn: 0 });
   assert.deepEqual(cmds, ['sudo cat /etc/mercury/web.env'], 'the creds are read where the runner placed them');
   assert.deepEqual(events.map((e) => e.event), ['github-app-installed'], 'device flow off records nothing');
   assert.match(events[0].detail, /acme\/mercury/);
@@ -168,7 +168,7 @@ test('an attempt already fully verified is skipped; dry-run asks GitHub nothing'
     db: fakeDb({ attempts: [ATTEMPT], facts: [{ event: 'github-app-installed', at: '2026-10-08T10:00:00Z' }, { event: 'github-app-device-flow', at: '2026-10-08T10:00:00Z' }] }),
     exec: () => { throw new Error('must not read the box'); }, provisioning: { recordEvent: async () => { throw new Error('nothing to record'); } },
   };
-  assert.deepEqual(await RUN.verifyGithubAppSetups(deps), { checked: 0, installed: 0, deviceFlow: 0 });
+  assert.deepEqual(await RUN.verifyGithubAppSetups(deps), { checked: 0, installed: 0, deviceFlow: 0, signIn: 0 });
   const lines = [];
   await RUN.verifyGithubAppSetups({ ...deps, apply: false, log: (m) => lines.push(m), db: fakeDb({ attempts: [ATTEMPT] }) });
   assert.equal(asked, 0);
@@ -181,7 +181,7 @@ test('the window query takes each project\'s LATEST attempt, past placement, sti
   assert.match(sql, /DISTINCT ON \(instance_id\)[\s\S]*ORDER BY instance_id, created_at DESC/);
   assert.match(sql, /l\.app_id IS NOT NULL AND l\.status IN \('done', 'error'\) AND i\.status = 'active'/);
   assert.match(sql, /LIMIT 20/);
-  assert.deepEqual(params, [GS.VERIFY_WINDOW_MS / 1000, 'github-app-install-reported']);
+  assert.deepEqual(params, [GS.VERIFY_WINDOW_MS / 1000, ['github-app-install-reported', 'github-app-check-requested']], 'an install report or a check request (task 1004652) re-opens it');
   assert.match(fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'provision.js'), 'utf8'), /require\('\.\/provision-github-setup\.js'\)\.verifyGithubAppSetups\(deps\)/, 'it runs on every runner tick, after the conversions');
 });
 
@@ -202,7 +202,7 @@ function page({ manifest, appSlug = null }) {
   const sandbox = {
     live: { manifest, manifestMsg: '', manifestCode: '', manifestFailure: null, appSlug, setup: null, installUrl: null, instStatus: 'active', addrReady: true },
     state: { name: 'Mer<cury', slug: 'mercury', owner: 'acme', repo: 'mercury', step: 2 },
-    manifestStale: false, autoOpenArmed: false,
+    autoOpenArmed: false,
     resolvedDomain: () => 'mercury.example.com', apexBase: () => 'example.com',
     esc: (x) => String(x).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
     GH_ICON: '', manualOauthDetails: () => '', projectPageLink: (t) => t, autoOpenTick: () => '',