@bongos/core 1.23.12 → 1.23.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/.bongos-core.json CHANGED
@@ -2,11 +2,11 @@
2
2
  "artifact": "bongos-core",
3
3
  "manifest_schema": 1,
4
4
  "generator": "scripts/bongos/package-core.js",
5
- "core_version": "1.23.12",
6
- "core_contract": "1.23.12",
7
- "source_commit": "eceb5a0bdf5de80369ba1434765de82b3a8b1d07",
5
+ "core_version": "1.23.13",
6
+ "core_contract": "1.23.13",
7
+ "source_commit": "66a2a6f1a31ff4989cf34fd195d4624af85d6d38",
8
8
  "source_ref": "HEAD",
9
- "built_at": "2026-10-27T21:05:06.917Z",
9
+ "built_at": "2026-10-27T22:41:45.921Z",
10
10
  "redaction": {
11
11
  "model": "docs-redacted+functional-verbatim",
12
12
  "docs_redacted": 616,
@@ -17,7 +17,7 @@
17
17
  "gate": "passed"
18
18
  },
19
19
  "file_count": 4223,
20
- "tree_sha256": "0bedfb9efd7e7117896254c844e416f48aff6c3adc0bf1babe9ac1ce17dea0c1",
20
+ "tree_sha256": "d3d2fe96ff57ad5fe427962d0346dce56bfdedd5092c815c2a5bc333f8b14d39",
21
21
  "files": [
22
22
  {
23
23
  "path": ".claude/skills/ask-for-help/SKILL.md",
@@ -2937,7 +2937,7 @@
2937
2937
  {
2938
2938
  "path": "docs/module-api-changelog.md",
2939
2939
  "mode": "0000644",
2940
- "sha256": "4b7d3923e5ee6e6ba7806e9a6b1c47091b97c3da52c4f936f531da85b5d89c6a"
2940
+ "sha256": "2a9fad6ef83589d532b0b9a775cdd1696f2f85496669316b7268855cf00109a5"
2941
2941
  },
2942
2942
  {
2943
2943
  "path": "docs/modules-contract.md",
@@ -3027,7 +3027,7 @@
3027
3027
  {
3028
3028
  "path": "docs/page-readings.json",
3029
3029
  "mode": "0000644",
3030
- "sha256": "4957f98396b51b4316c7a158606611f357a53c4857189e2c791346cf1fd11c64"
3030
+ "sha256": "edc725651684edd503875846732e17c4f4a288520d8bb13250ce50041f7f83ae"
3031
3031
  },
3032
3032
  {
3033
3033
  "path": "docs/project-context.template.md",
@@ -6782,7 +6782,7 @@
6782
6782
  {
6783
6783
  "path": "modules/hall-ui/public/tweak-editor-lib.js",
6784
6784
  "mode": "0000644",
6785
- "sha256": "44e3bd2a07435be3a6163f6585e262f76ecf823213f3dece66d75f5ad9874615"
6785
+ "sha256": "dd283fe72d5090f54e709813e2f2026313cfb996dee623307d7c8b191229dd3d"
6786
6786
  },
6787
6787
  {
6788
6788
  "path": "modules/hall-ui/public/tweak-editor.css",
@@ -7042,7 +7042,7 @@
7042
7042
  {
7043
7043
  "path": "modules/hall-ui/records/tweak-editor.md",
7044
7044
  "mode": "0000644",
7045
- "sha256": "0f991a75a272d533911072acb4cc87d618c352eb39b4d14307257db041b66ec3"
7045
+ "sha256": "bbb9b9b322d5e840538d3e66bec8e25f81d4aaf2c2def3115b26c11548c43996"
7046
7046
  },
7047
7047
  {
7048
7048
  "path": "modules/hall-ui/records/welcome-tower.md",
@@ -10917,12 +10917,12 @@
10917
10917
  {
10918
10918
  "path": "package-lock.json",
10919
10919
  "mode": "0000644",
10920
- "sha256": "a3dde4bdde02eccb3b3510f5bc886f3c8a969ab0f931afffd27976d25517ceff"
10920
+ "sha256": "03ef103bf610c3231add50d0f37db64136afaaa85213242ad6409fc1d1c9a305"
10921
10921
  },
10922
10922
  {
10923
10923
  "path": "package.json",
10924
10924
  "mode": "0000644",
10925
- "sha256": "2b8447709902530d57406950ee97b181fbd34ae37b348cccfc87bcf8daf51eaf"
10925
+ "sha256": "2622ebb5d8933c07b426fec356223757485cfe3075cd1ae87f8e30df712442d6"
10926
10926
  },
10927
10927
  {
10928
10928
  "path": "public-docs/index.html",
@@ -10942,7 +10942,7 @@
10942
10942
  {
10943
10943
  "path": "release-notes.json",
10944
10944
  "mode": "0000644",
10945
- "sha256": "677534fa5150c969a048e5e0b8f403a37a33e23f697b5e0ded93f6341c8e2e8c"
10945
+ "sha256": "e5b1ee916f89efa32ecac48f374ffebddbe6acfd6b7b3e35a698e1f21080a068"
10946
10946
  },
10947
10947
  {
10948
10948
  "path": "scripts/bongos/CLAUDE.md",
@@ -14817,7 +14817,7 @@
14817
14817
  {
14818
14818
  "path": "src/module-api.js",
14819
14819
  "mode": "0000644",
14820
- "sha256": "3895730c365ce15e62ac51d34df110955f7f36d226f26d24b296467e67d5f98f"
14820
+ "sha256": "b634ffd6cf11e7f6a70a9f48dc3f33ecd01dc985fe447bfea28b8e40db6314f0"
14821
14821
  },
14822
14822
  {
14823
14823
  "path": "src/module-loader/catalog.js",
@@ -17622,7 +17622,7 @@
17622
17622
  {
17623
17623
  "path": "tests/hall_tweak_editor.mjs",
17624
17624
  "mode": "0000644",
17625
- "sha256": "11668c052eefdd9984487a6f7eeb04913056c0f9cb266fba84793da0bf7ff72b"
17625
+ "sha256": "81e03b554851f982aa26d4465bb86b3fea9e67344641e61f618cd06749fd7532"
17626
17626
  },
17627
17627
  {
17628
17628
  "path": "tests/hall_work_history_id.mjs",
@@ -3241,5 +3241,7 @@ is load-bearing: the script throws rather than guess if it is missing, and
3241
3241
  landed since 1.23.10 with no explicit bump. run 40552168441. (task 1002620)
3242
3242
  1.23.12 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
3243
3243
  landed since 1.23.11 with no explicit bump. run 40583533060. (task 1002620)
3244
+ 1.23.13 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
3245
+ landed since 1.23.12 with no explicit bump. run 40596643484. (task 1002620)
3244
3246
  ---------------------------------------------------------------------------
3245
3247
  ```
@@ -3868,34 +3868,34 @@
3868
3868
  "surface": "builders",
3869
3869
  "title": "Studio",
3870
3870
  "states_read": ["home","out","flow","flow-pick","status","words-offer","words-edit","reviews","full","full-back","approvals","approvals-before","approvals-phone","approvals-note","approved","sent-back"],
3871
- "files_hash": "c28b9e674cf6a389",
3872
- "reading_hash": "a79704d0791f02bb",
3871
+ "files_hash": "4538426333de6374",
3872
+ "reading_hash": "55e9090fdd96a979",
3873
3873
  "counts": {"lines":30,"placed":16,"shared":6,"unplaced":8},
3874
3874
  "omitted": {"data":4},
3875
3875
  "notes": ["flow: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","flow-pick: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","status: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","words-offer: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","words-edit: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","reviews: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","full: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","full-back: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","approvals: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","approvals-before: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","approvals-phone: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","approvals-note: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","approved: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood","sent-back: an action failed (page.click: Timeout 6000ms exceeded.); read as it stood"],
3876
3876
  "lines": [
3877
3877
  {"key":"L0001","section":"skip link","text":"Skip to content","placement":"shared","file":"modules/hall-ui/public/shell.js","line":868,"string_id":"87cee78ca134"},
3878
3878
  {"key":"L0002","section":"top bar","text":"Jump to…","placement":"shared","file":"modules/hall-ui/public/shell.js","line":540,"string_id":"eba610d25523"},
3879
- {"key":"L0003","section":"top bar","text":"⌘K","placement":"shared"},
3879
+ {"key":"L0003","section":"top bar","text":"Ctrl K","placement":"shared"},
3880
3880
  {"key":"L0004","section":"top bar","text":"Building","placement":"shared"},
3881
3881
  {"key":"L0005","section":"top bar","text":"Artistry","placement":"shared"},
3882
3882
  {"key":"L0006","section":"top bar","text":"Ideating","placement":"shared"},
3883
3883
  {"key":"L0007","section":"page top","text":"{{worldName}} · studio","placement":"placed","file":"modules/hall-ui/public/studio.html","line":85,"string_id":"3d8611c2e79d"},
3884
3884
  {"key":"L0008","section":"page top","text":"pages tweaked","placement":"placed","file":"modules/hall-ui/public/studio.html","line":89,"string_id":"271de72308a4"},
3885
3885
  {"key":"L0009","section":"page top","text":"this week","placement":"placed","file":"modules/hall-ui/public/studio.html","line":91,"string_id":"130c3731ad83"},
3886
- {"key":"L0010","section":"Good morning.","text":"Good morning.","placement":"placed","file":"modules/hall-ui/public/studio.js","line":991,"string_id":"36083f00396d"},
3887
- {"key":"L0011","section":"Good morning.","text":"{…}, on the {…} page, is where you left it. {…} of its {…} lines are yours so far.","placement":"placed","file":"modules/hall-ui/public/studio.js","line":659,"string_id":"7763e6f28c67"},
3888
- {"key":"L0012","section":"Good morning.","text":"click any words here to rewrite them","placement":"placed","file":"modules/hall-ui/public/studio.html","line":103,"string_id":"8d46c902a9d5"},
3889
- {"key":"L0013","section":"Good morning.","text":"Resume","placement":"unplaced"},
3890
- {"key":"L0014","section":"Good morning.","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","occurrences":2},
3891
- {"key":"L0015","section":"Good morning.","text":"Tweak/CopyWrite Flow","placement":"placed","file":"modules/hall-ui/public/studio.html","line":123,"string_id":"18801fb6845f"},
3892
- {"key":"L0016","section":"Good morning.","text":"next up: {…} — {…}","placement":"unplaced"},
3893
- {"key":"L0017","section":"Good morning.","text":"Copy-write Approval queue","placement":"placed","file":"modules/hall-ui/public/studio.html","line":127,"string_id":"f770588750ef"},
3894
- {"key":"L0018","section":"Good morning.","text":"2 pages applied, waiting for you","placement":"unplaced"},
3895
- {"key":"L0019","section":"Good morning.","text":"Artist Review Status","placement":"placed","file":"modules/hall-ui/public/studio.html","line":131,"string_id":"4d3b1bcae3eb"},
3896
- {"key":"L0020","section":"Good morning.","text":"From the live site","placement":"placed","file":"modules/hall-ui/public/studio.html","line":137,"string_id":"edced5d528c3"},
3897
- {"key":"L0021","section":"Good morning.","text":"2 reviews from the live site","placement":"unplaced"},
3898
- {"key":"L0022","section":"Good morning.","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":670,"string_id":"fd1903586e8e"},
3886
+ {"key":"L0010","section":"Good evening.","text":"Good evening.","placement":"placed","file":"modules/hall-ui/public/studio.html","line":101,"string_id":"80fd51db38d7"},
3887
+ {"key":"L0011","section":"Good evening.","text":"{…}, on the {…} page, is where you left it. {…} of its {…} lines are yours so far.","placement":"placed","file":"modules/hall-ui/public/studio.js","line":659,"string_id":"7763e6f28c67"},
3888
+ {"key":"L0012","section":"Good evening.","text":"click any words here to rewrite them","placement":"placed","file":"modules/hall-ui/public/studio.html","line":103,"string_id":"8d46c902a9d5"},
3889
+ {"key":"L0013","section":"Good evening.","text":"Resume","placement":"unplaced"},
3890
+ {"key":"L0014","section":"Good evening.","text":"{…} of {…}","placement":"placed","file":"modules/hall-ui/public/sky-panel.js","line":120,"string_id":"73c1372b43d9","occurrences":2},
3891
+ {"key":"L0015","section":"Good evening.","text":"Tweak/CopyWrite Flow","placement":"placed","file":"modules/hall-ui/public/studio.html","line":123,"string_id":"18801fb6845f"},
3892
+ {"key":"L0016","section":"Good evening.","text":"next up: {…} — {…}","placement":"unplaced"},
3893
+ {"key":"L0017","section":"Good evening.","text":"Copy-write Approval queue","placement":"placed","file":"modules/hall-ui/public/studio.html","line":127,"string_id":"f770588750ef"},
3894
+ {"key":"L0018","section":"Good evening.","text":"2 pages applied, waiting for you","placement":"unplaced"},
3895
+ {"key":"L0019","section":"Good evening.","text":"Artist Review Status","placement":"placed","file":"modules/hall-ui/public/studio.html","line":131,"string_id":"4d3b1bcae3eb"},
3896
+ {"key":"L0020","section":"Good evening.","text":"From the live site","placement":"placed","file":"modules/hall-ui/public/studio.html","line":137,"string_id":"edced5d528c3"},
3897
+ {"key":"L0021","section":"Good evening.","text":"2 reviews from the live site","placement":"unplaced"},
3898
+ {"key":"L0022","section":"Good evening.","text":"Builders hall · this session","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":670,"string_id":"fd1903586e8e"},
3899
3899
  {"key":"L0023","section":"What are you doing now?","text":"What are you doing now?","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":671,"string_id":"60853319f290"},
3900
3900
  {"key":"L0024","section":"What are you doing now?","text":"Pick one. You can switch any time from the top bar.","placement":"placed","file":"modules/hall-ui/public/craft-mode.js","line":672,"string_id":"4f87d5b17b54"},
3901
3901
  {"key":"L0025","section":"What are you doing now?","text":"Building","placement":"unplaced"},
@@ -4117,7 +4117,7 @@
4117
4117
  "surface": "builders",
4118
4118
  "title": "Tweak a page",
4119
4119
  "states_read": ["doc","typed","chrome","submitted","picking","out"],
4120
- "files_hash": "7a60cbfee02d831b",
4120
+ "files_hash": "d456607f6e2337c7",
4121
4121
  "reading_hash": "711c540ebc7ef977",
4122
4122
  "counts": {"lines":23,"placed":15,"shared":1,"unplaced":7},
4123
4123
  "omitted": {"data":35},
@@ -223,12 +223,13 @@
223
223
  //
224
224
  // The SIBLINGS (task 1004393): once the proxy answers the apex and status hosts
225
225
  // with `frame-ancestors 'self' https://builders.<apex>` instead of SAMEORIGIN,
226
- // those two pages may split in place too. Until then framing them shows the
227
- // browser's refusal page, so FRAME_SIBLINGS stays false and flipping it is the
228
- // step after the proxy change (the owner's steps are on task 1004393). Only the
229
- // apex and status.<apex> are siblings, never another subdomain: the proxy keeps
230
- // every other host unframeable, sign-in and settings included.
231
- const FRAME_SIBLINGS = false;
226
+ // those two pages may split in place too. The proxy change is live (checked on
227
+ // the apex and status hosts in task 1004644), so FRAME_SIBLINGS is on. Set it
228
+ // back to false if the proxy ever stops sending frame-ancestors: framing them
229
+ // would show the browser's refusal page. Only the apex and status.<apex> are
230
+ // siblings, never another subdomain: the proxy keeps every other host
231
+ // unframeable, sign-in and settings included.
232
+ const FRAME_SIBLINGS = true;
232
233
  function siblingOrigins(loc) {
233
234
  const here = new URL(loc.href || loc.origin);
234
235
  if (!/^builders\./.test(here.hostname)) return [];
@@ -27,7 +27,7 @@ The paper is paper and the room is the room whatever the hall's theme: the stage
27
27
  - **Boxes grow to their words** rather than the artboard's rows 1 or 2.
28
28
  - **A refused upload opens a panel** (task 1004354, `#tw-refused`): the "is in" panel's glass and scrim over the whole window, a headline per refusal (`lib.uploadRefusal`), the server's words, the lines it names, "what to do", and "download this page again" or close (Escape too). An artist uploads from the bar, often far down the page, where the paper's notice was off screen. The notice stays on the paper after the panel closes. The kit has no file-upload action, so the panel is proven in `tests/hall_tweak_editor.mjs` and by shots of a real browser at 1440 and 390, not by a states.json state.
29
29
  - **The check, the restore and Shift + Enter (task 1004385, owner-asked).** Beside each line a round restore button (only on a changed line: it puts the page's words back and takes the check off) and a round green check. A checked line takes a light green wash; the owner picked the check over a tint alone. **Shift + Enter** in a line checks it and lands in the next, and a green hint above the words says so (with "N of M checked"), because it is the quickest way through a page. Enter alone is unchanged. The checks are the artist's place-keeper and stay in the browser (`localStorage`, keyed by page and reading hash, so a page that moved never ticks the wrong words); the server has no such field and `WRITES` is unchanged. A page the caller cannot write has none of it. Rules in `tweak-editor-lib.js` (`nextLineKey`, `confirmedCount`, `parseConfirmed`, `confirmStoreKey`, `hintText`).
30
- - **No page title or sub text at the top of the paper, and "open the page" is a menu (task 1004386, owner-asked).** The bar already names the page, so the paper opens on its first section; the h1 stays, visually hidden, for the one-h1 floor. "open the page" is a **split button** (owner-amended mid-build): the main half repeats the artist's last choice ("open the page ↗" for a new tab, "open in split view"), and the ▾ beside it opens **open in new tab** and **open in split view**. Click, keyboard and touch; hover alone opens nothing, because a hover menu closes when the pointer wanders and does not exist on touch. Split view has a **draggable divider** (mouse, touch, or the arrow keys and Home/End on the focused divider; the live page takes 20% to 80% of the window, `lib.clampSplit`), and the frame stops taking the pointer while it is dragged. The choice, the size and whether split view was open are remembered (`hall-tweak-open-as`, `hall-tweak-split-size`, `hall-tweak-split`), so the next page opens the same way; a split that would be a second window never reopens on load, because a browser blocks a popup nobody clicked. At phone width the live page takes at most half the screen, whatever the saved size, because the two-row bar is tall there. Split view pins the live page under the words (words above, page below, both scroll; "close split view" unloads it; the frame loads only when opened). **The live site answers `X-Frame-Options: SAMEORIGIN`** (set at the proxy in front of the app, not in this repo), so only a page on the editor's own host can be framed. A landing or status page is on another host, so its split view opens the page in a second window docked to the bottom half of the screen (`lib.canFrame`, `lib.splitWindowFeatures`). **Letting them split in place (task 1004393)** is two steps, in this order. First the proxy answers the apex and `status.<apex>` with `<redacted>: frame-ancestors 'self' https://builders.<apex>` in place of `X-Frame-Options: SAMEORIGIN`, and every other host keeps SAMEORIGIN (sign-in and settings stay unframeable). Then `FRAME_SIBLINGS` in `tweak-editor-lib.js` flips to `true`. `lib.canFrame` then also admits exactly those two origins, same scheme and port, and only from the builders host; never another subdomain or a lookalike. Flipping it before the proxy changes would put the browser's refusal page in the split, which is why it ships off.
30
+ - **No page title or sub text at the top of the paper, and "open the page" is a menu (task 1004386, owner-asked).** The bar already names the page, so the paper opens on its first section; the h1 stays, visually hidden, for the one-h1 floor. "open the page" is a **split button** (owner-amended mid-build): the main half repeats the artist's last choice ("open the page ↗" for a new tab, "open in split view"), and the ▾ beside it opens **open in new tab** and **open in split view**. Click, keyboard and touch; hover alone opens nothing, because a hover menu closes when the pointer wanders and does not exist on touch. Split view has a **draggable divider** (mouse, touch, or the arrow keys and Home/End on the focused divider; the live page takes 20% to 80% of the window, `lib.clampSplit`), and the frame stops taking the pointer while it is dragged. The choice, the size and whether split view was open are remembered (`hall-tweak-open-as`, `hall-tweak-split-size`, `hall-tweak-split`), so the next page opens the same way; a split that would be a second window never reopens on load, because a browser blocks a popup nobody clicked. At phone width the live page takes at most half the screen, whatever the saved size, because the two-row bar is tall there. Split view pins the live page under the words (words above, page below, both scroll; "close split view" unloads it; the frame loads only when opened). **The live site answers `X-Frame-Options: SAMEORIGIN`** (set at the proxy in front of the app, not in this repo), so only a page on the editor's own host can be framed. A landing or status page is on another host, so its split view opens the page in a second window docked to the bottom half of the screen (`lib.canFrame`, `lib.splitWindowFeatures`). **Letting them split in place (task 1004393)** is two steps, in this order. First the proxy answers the apex and `status.<apex>` with `<redacted>: frame-ancestors 'self' https://builders.<apex>` in place of `X-Frame-Options: SAMEORIGIN`, and every other host keeps SAMEORIGIN (sign-in and settings stay unframeable). Then `FRAME_SIBLINGS` in `tweak-editor-lib.js` flips to `true` (done in task 1004644, after checking both hosts answer frame-ancestors and no X-Frame-Options). `lib.canFrame` then also admits exactly those two origins, same scheme and port, and only from the builders host; never another subdomain or a lookalike. Flipping it before the proxy changes would put the browser's refusal page in the split, which is why it shipped off until the proxy was live; if the proxy ever stops sending frame-ancestors, flip it back.
31
31
  - **Not on the artboard at all:** the phone layout (the bar becomes a two-row glass card, notes drop under their lines), the shell's full-screen button top right, the read-only and refusal notices on the paper, the chrome view (the switch off), and light mode.
32
32
 
33
33
  ## The proof
package/package-lock.json CHANGED
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "name": "@bongos/core",
3
- "version": "1.23.12",
3
+ "version": "1.23.13",
4
4
  "lockfileVersion": 3,
5
5
  "requires": true,
6
6
  "packages": {
7
7
  "": {
8
8
  "name": "@bongos/core",
9
- "version": "1.23.12",
9
+ "version": "1.23.13",
10
10
  "license": "AGPL-3.0-or-later",
11
11
  "dependencies": {
12
12
  "express": "^4.21.2",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@bongos/core",
3
- "version": "1.23.12",
3
+ "version": "1.23.13",
4
4
  "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
5
5
  "license": "AGPL-3.0-or-later",
6
6
  "main": "src/platform-server.js",
@@ -10459,5 +10459,11 @@
10459
10459
  "id": "1002292",
10460
10460
  "text": "Project owners can now press Recruit next to any builder on the community leaderboard or search, which opens their project's invite page with that builder's name already filled in."
10461
10461
  }
10462
+ ],
10463
+ "1.23.13": [
10464
+ {
10465
+ "id": "1004644",
10466
+ "text": "The tweak editor's split view now shows the landing and status pages under the words, instead of opening a second window."
10467
+ }
10462
10468
  ]
10463
10469
  }
package/src/module-api.js CHANGED
@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
81
81
  // MAJOR (see allowBoxScope below): passes the request through untouched.
82
82
  function deprecatedNoopMiddleware(_req, _res, next) { next(); }
83
83
 
84
- const CORE_VERSION = '1.23.12'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
84
+ const CORE_VERSION = '1.23.13'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
85
85
 
86
86
  // A namespaced logger so a module's log lines are attributable + consistent.
87
87
  // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -675,11 +675,13 @@ try {
675
675
  await test('split view can frame only its own host; the live site refuses to be framed from another', () => {
676
676
  const here = { origin: 'https://builders.cloudbongos.com', href: 'https://builders.cloudbongos.com/builders/tweak-editor' };
677
677
  assert.equal(lib.canFrame('https://builders.cloudbongos.com/studio', here), true);
678
- assert.equal(lib.canFrame('https://cloudbongos.com/', here), false, 'the apex is another origin');
678
+ assert.equal(lib.canFrame('https://cloudbongos.com/', here), true, 'the apex is a sibling the proxy lets the builders host frame');
679
+ assert.equal(lib.canFrame('https://cloudbongos.com/', here, false), false, 'the apex is another origin when siblings are off');
679
680
  assert.equal(lib.canFrame('not a url', { origin: '', href: '' }), false);
680
681
  // task 1004393: the apex and status pages split in place only once the proxy allows it.
681
- assert.equal(lib.FRAME_SIBLINGS, false, 'off until the proxy sends frame-ancestors for the builders host');
682
- assert.equal(lib.canFrame('https://status.cloudbongos.com/', here), false, 'the default follows the switch');
682
+ assert.equal(lib.FRAME_SIBLINGS, true, 'on: the proxy sends frame-ancestors for the builders host (task 1004644)');
683
+ assert.equal(lib.canFrame('https://status.cloudbongos.com/', here), true, 'the default follows the switch');
684
+ assert.equal(lib.canFrame('https://status.cloudbongos.com/', here, false), false, 'switched off, only the editor host frames');
683
685
  assert.equal(lib.canFrame('https://cloudbongos.com/pricing', here, true), true, 'the apex, switched on');
684
686
  assert.equal(lib.canFrame('https://status.cloudbongos.com/', here, true), true, 'the status host, switched on');
685
687
  assert.equal(lib.canFrame('https://box.cloudbongos.com/', here, true), false, 'never another subdomain');
@@ -791,19 +793,14 @@ try {
791
793
  } finally { PAGE.url = saved; }
792
794
  });
793
795
 
794
- await test('a page on the apex splits into its own window docked to the bottom half, and never on load', async () => {
796
+ await test('a page on the apex splits in place under the words, with no second window (task 1004644)', async () => {
795
797
  const b = bootEditor({
796
798
  answers: { 'GET /copy-desk/pages/landing:index/draft': ok(editorRead()) },
797
799
  stored: { 'hall-tweak-open-as': 'split', 'hall-tweak-split': 'on' },
798
800
  });
799
801
  await b.settle();
800
- assert.equal(b.opened.length, 0, 'no popup on load: a browser would block it');
801
- assert.equal(b.el('tw-frame').hidden, true, 'nothing framed: the site would refuse');
802
- await b.click('tw-open');
803
- assert.equal(b.opened.length, 1);
804
- assert.deepEqual(b.opened[0].slice(0, 2), ['https://cloudbongos.com/', 'tw-live-page']);
805
- assert.equal(b.opened[0][2], 'popup=yes,width=1600,height=500,left=0,top=500');
806
- assert.equal(b.el('tw-frame').hidden, true);
802
+ assert.equal(b.opened.length, 0, 'no popup: the page is framed in place');
803
+ assert.equal(b.el('tw-frame').hidden, false, 'the apex page shows under the words');
807
804
  });
808
805
 
809
806
  // task 1004776: a guarded line shows what it must still say under it, and the