@bongos/core 1.24.62 → 1.24.63

package/tests/hall_dialog.mjs

@@ -10,6 +10,9 @@
 //      branded confirm (what will happen, in words) and runs its write only when the answer is yes;
 //   3. the guards: no window.confirm anywhere in modules/hall-ui, and each of the six builds now
 //      runs on OTBDialog with no scrim/backdrop rule of its own.
+// Task 1005136 adds the prompt variant (OTBDialog.prompt, which replaced every window.prompt), its
+// flows, and widens the guard repo-wide: no browser confirm, alert or prompt in any served page
+// (every module's public/ and views/, the API docs, and the pages src/ renders).
 import assert from 'node:assert/strict';
 import { test, after } from 'node:test';
 import { createRequire } from 'node:module';
@@ -55,9 +58,13 @@ async function runFlow(file, name, args, { answer, globals = {} } = {}) {
   const writes = [];
   const record = (m, u, b) => { writes.push({ method: m, url: String(u), body: b }); return { ok: true, status: 200, data: { permission_count: 3 } }; };
   const window = {
-    OTBDialog: { confirm: async (o) => { asked.push(o); return answer; } },
+    OTBDialog: {
+      confirm: async (o) => { asked.push(o); return answer; },
+      prompt: async (o) => { asked.push(o); return answer; },
+    },
     location: { assign() {} },
     confirm: () => { throw new Error('window.confirm was called'); },
+    prompt: () => { throw new Error('window.prompt was called'); },
   };
   const ctx = vm.createContext({
     window,
@@ -135,6 +142,37 @@ for (const f of FLOWS) {
   });
 }
 
+// Every replaced window.prompt whose flow is a named function: the branded prompt is asked, a
+// dismissal (null) sends nothing, and the typed text is what the write carries.
+const PROMPT_FLOWS = [
+  { flow: 'name a passkey card', file: 'settings-passkeys.js', fn: 'rename',
+    args: () => ['cred-1', { querySelector: (q) => (q === 'strong' ? { textContent: 'Old card' } : {}) }],
+    write: /passkeys\/rename/, carries: (w, text) => w.body.nickname === text },
+  { flow: 'release a studio round', file: 'studio.js', fn: 'releasePage', args: () => ['page-1', 77, fakeBtn()],
+    globals: { lib: { PAGE_ID_RE: /^[a-z0-9-]+$/ }, WRITE_ROUTES: { release: (id) => `/tweak/${id}/release` }, loadPages: async () => {}, paintPanel() {}, byId: () => null },
+    write: /tweak\/page-1\/release/, carries: (w, text) => w.body.note === text && w.body.task_id === 77 },
+  { flow: 'rename a saved view', file: 'hall-kit.js', fn: 'renameView', args: () => [{ id: 5, name: 'Mine' }],
+    viewCall: true, globals: { act: (fn) => fn(), views: { page: 'work' } },
+    write: /^\/5$/, carries: (w, text) => w.body.name === text },
+];
+
+for (const f of PROMPT_FLOWS) {
+  test(`${f.flow}: the branded prompt asks, a dismissal sends nothing, the typed text is sent`, async () => {
+    let sent = [];
+    const extra = { ...(f.globals || {}) };
+    if (f.viewCall) extra.call = (m, u, b) => { sent.push({ method: m, url: u, body: b }); };
+    const no = await runFlow(f.file, f.fn, f.args(), { answer: null, globals: extra });
+    assert.equal(no.asked.length, 1, 'the prompt is shown once');
+    assert.ok(no.asked[0].title && no.asked[0].confirmLabel, 'it has a title and names its act');
+    assert.equal([...no.writes, ...sent].filter((w) => f.write.test(w.url)).length, 0, 'a dismissal sends nothing');
+    sent = [];
+    const yes = await runFlow(f.file, f.fn, f.args(), { answer: 'A new line', globals: extra });
+    const hits = [...yes.writes, ...sent].filter((w) => f.write.test(w.url));
+    assert.equal(hits.length, 1, 'the answer sends the write, once');
+    assert.ok(f.carries(hits[0], 'A new line'), 'the write carries the typed text');
+  });
+}
+
 test('a verify-kind confirm attests the verification; any other kind asks nothing', async () => {
   const sent = [];
   const runLifecycle = (b, u, body) => sent.push({ u, body });
@@ -182,35 +220,74 @@ test('the bulk release on the shared toolbar asks first, and releases only on ye
 
 // ── the guards ──────────────────────────────────────────────────────────────
 
-function hallFiles() {
+// Every file a browser is served, repo-wide (task 1005136): each module's public/ and views/, the
+// API docs, and src/ (whose server-rendered pages carry inline scripts). Vendored bundles excluded.
+function servedFiles() {
   const out = [];
   const walk = (d) => {
+    if (!fs.existsSync(d)) return;
     for (const e of fs.readdirSync(d, { withFileTypes: true })) {
       const p = path.join(d, e.name);
-      if (e.isDirectory()) walk(p);
-      else if (/\.(js|html|mjs|cjs)$/.test(e.name)) out.push(p);
+      if (e.isDirectory()) { if (!/^(node_modules|vendor|fixtures)$/.test(e.name)) walk(p); }
+      else if (/\.(js|html|mjs|cjs)$/.test(e.name) && !/\.(standalone|min)\.js$/.test(e.name)) out.push(p);
     }
   };
-  walk(path.join(ROOT, 'modules', 'hall-ui'));
+  for (const m of fs.readdirSync(path.join(ROOT, 'modules'))) {
+    walk(path.join(ROOT, 'modules', m, 'public'));
+    walk(path.join(ROOT, 'modules', m, 'views'));
+  }
+  walk(path.join(ROOT, 'public-docs'));
+  walk(path.join(ROOT, 'src'));
   return out;
 }
 
-test('no window.confirm anywhere in modules/hall-ui (comments stripped)', () => {
-  const hits = [];
-  for (const f of hallFiles()) {
-    const src = stripComments(fs.readFileSync(f, 'utf8'));
-    // a call to the browser's box: window.confirm, or a bare confirm( that is not a method or a definition
-    if (/\bwindow\s*\.\s*confirm\b/.test(src) || /(^|[^.\w$])(?<!function\s)confirm\s*\(/m.test(src.replace(/function\s+confirm\s*\(/g, ''))) {
-      hits.push(path.relative(ROOT, f));
+// A call to one of the browser's three boxes: window.confirm/alert/prompt, or a bare confirm( /
+// alert( / prompt( that is not a method (OTBDialog.confirm) or the definition of one. Read line
+// by line, comments out: a whole-file comment stripper eats code across a `/*` inside a string
+// ('/api/bongos/*'), which would let a real call hide behind it. A block comment is one that
+// OPENS a line (how every file here writes them); a same-line /* */, <!-- --> and a trailing
+// // comment are cut where they stand.
+const BOX = /\bwindow\s*\.\s*(confirm|alert|prompt)\b|(^|[^.\w$])(confirm|alert|prompt)\s*\(/;
+function browserBoxCall(rawSrc) {
+  let block = null;
+  for (const raw of String(rawSrc).split('\n')) {
+    let t = raw.trim();
+    if (block) {
+      const end = t.indexOf(block);
+      if (end === -1) continue;
+      t = t.slice(end + block.length);
+      block = null;
     }
+    if (t.startsWith('/*') && !t.includes('*/')) { block = '*/'; continue; }
+    if (t.startsWith('<!--') && !t.includes('-->')) { block = '-->'; continue; }
+    if (/^(\/\/|\*)/.test(t)) continue;
+    const code = t.replace(/\/\*.*?\*\//g, '').replace(/<!--.*?-->/g, '')
+      .replace(/(^|[^:'"`\\])\/\/.*$/, '$1').replace(/function\s+(confirm|alert|prompt)\s*\(/g, '');
+    if (BOX.test(code)) return true;
   }
-  assert.deepEqual(hits, [], 'use OTBDialog.confirm (hall-dialog.js) instead of the browser confirm');
+  return false;
+}
+
+test('no browser confirm, alert or prompt in any served page (comments stripped)', () => {
+  const files = servedFiles();
+  assert.ok(files.length > 200 && files.some((f) => f.includes(`${path.sep}public-landing${path.sep}`)) && files.some((f) => f.includes(`${path.sep}raise${path.sep}`)),
+    'the scan reaches beyond the hall');
+  const hits = files.filter((f) => browserBoxCall(fs.readFileSync(f, 'utf8'))).map((f) => path.relative(ROOT, f));
+  assert.deepEqual(hits, [], 'use OTBDialog.confirm / OTBDialog.prompt (hall-dialog.js) instead of the browser\'s box');
 });
 
-test('the guard catches a window.confirm when one comes back', () => {
-  const src = stripComments("// window.confirm('old') is history\nif (!window.confirm('Delete?')) return;");
-  assert.ok(/\bwindow\s*\.\s*confirm\b/.test(src));
-  assert.ok(!/\bwindow\s*\.\s*confirm\b/.test(stripComments('/* window.confirm() was here */ OTBDialog.confirm({})')));
+test('the guard catches a browser box when one comes back, and leaves the shared dialog alone', () => {
+  for (const bad of ["if (!window.confirm('Delete?')) return;", "const n = window.prompt('Name');", "alert('done')",
+    "if (x && !confirm('Discard?')) return;", "var r = prompt('Why?') || null;"]) {
+    assert.ok(browserBoxCall(bad), `caught: ${bad}`);
+  }
+  // a `/*` inside a string must not hide a real call on a later line
+  assert.ok(browserBoxCall("const p = '/api/bongos/*';\nif (!confirm('Go?')) return;\nconst q = 'a */ b';"), 'caught past a /* in a string');
+  for (const ok of ["// window.confirm('old') is history\nOTBDialog.confirm({})", '/* window.prompt() was here */ await window.OTBDialog.prompt({ title: "x" })',
+    '/* the browser box:\n   window.confirm() calls whose box\n*/ OTBDialog.confirm({})', '<!-- an old\n  confirm() lived here -->',
+    'function confirm(opts) {}', 'const confirmAction = () => {}; confirmAction();']) {
+    assert.ok(!browserBoxCall(ok), `left alone: ${ok}`);
+  }
 });
 
 test('every hall page loads the shared dialog right after the shell, deferred alike', () => {
@@ -399,3 +476,78 @@ test('a confirm over a bound overlay: Escape closes the confirm only, then the o
   assert.equal(ov.modal, 'true');
   await ctx.close();
 });
+
+// ── the prompt (task 1005136) ────────────────────────────────────────────────
+
+test('the prompt: a labelled field in the shared dialog, focused with its text selected; Enter answers with what was typed', { skip }, async () => {
+  const { ctx, page } = await boot();
+  await page.focus('#go');
+  await page.evaluate(() => { window.__r = window.OTBDialog.prompt({ title: 'Name this card', label: 'Shown on your sign-in list', value: 'Old name', confirmLabel: 'Save' }); });
+  const s = await page.evaluate(() => {
+    const d = document.querySelector('dialog.hall-dialog');
+    const f = d.querySelector('input.hall-dialog__field');
+    const lab = document.querySelector(`label[for="${f.id}"]`);
+    return {
+      modal: d.matches(':modal'), title: document.getElementById(d.getAttribute('aria-labelledby')).textContent,
+      label: lab && lab.textContent, focused: document.activeElement === f,
+      selected: f.value.slice(f.selectionStart, f.selectionEnd), buttons: [...d.querySelectorAll('.hall-dialog__actions button')].map((b) => b.textContent),
+      width: Math.round(f.getBoundingClientRect().width), panel: Math.round(d.querySelector('.hall-dialog__body').getBoundingClientRect().width),
+    };
+  });
+  assert.equal(s.modal, true);
+  assert.equal(s.title, 'Name this card');
+  assert.equal(s.label, 'Shown on your sign-in list', 'the field is labelled');
+  assert.equal(s.focused, true, 'the field takes focus');
+  assert.equal(s.selected, 'Old name', 'its text is selected, so typing replaces it');
+  assert.deepEqual(s.buttons, ['Cancel', 'Save']);
+  assert.equal(s.width, s.panel, 'the field spans the dialog');
+  await page.keyboard.type('New name');
+  await page.keyboard.press('Enter');
+  assert.equal(await page.evaluate(() => window.__r), 'New name', 'Enter answers with the typed text');
+  assert.equal(await page.evaluate(() => document.querySelector('dialog.hall-dialog')), null, 'and the dialog is gone');
+  assert.equal(await page.evaluate(() => document.activeElement.id), 'go', 'focus is back on the trigger');
+  await ctx.close();
+});
+
+test('the prompt: Cancel, Escape and the scrim answer null; an empty answer is still an answer', { skip }, async () => {
+  const { ctx, page } = await boot();
+  const ask = (o) => page.evaluate((opts) => { window.__r = window.OTBDialog.prompt(opts); }, o);
+  await ask({ title: 'Why?' });
+  assert.equal(await page.evaluate(() => document.querySelector('input.hall-dialog__field').getAttribute('aria-label')), 'Why?', 'no label: the title names the field');
+  await page.click('.hall-dialog__actions .btn--ghost');
+  assert.equal(await page.evaluate(() => window.__r), null, 'Cancel is null');
+  await ask({ title: 'Why?' });
+  await page.keyboard.press('Escape');
+  assert.equal(await page.evaluate(() => window.__r), null, 'Escape is null');
+  await ask({ title: 'Why?' });
+  await page.mouse.click(5, 5);
+  assert.equal(await page.evaluate(() => window.__r), null, 'the scrim is null');
+  await ask({ title: 'Why?', confirmLabel: 'Go' });
+  await page.click('.hall-dialog__actions .btn:not(.btn--ghost)');
+  assert.equal(await page.evaluate(() => window.__r), '', 'confirming a blank field answers the empty string, not null');
+  await ctx.close();
+});
+
+test('the prompt: a required field keeps its confirm off until something is typed', { skip }, async () => {
+  const { ctx, page } = await boot();
+  await page.evaluate(() => { window.__r = window.OTBDialog.prompt({ title: 'New name for this view', required: true, confirmLabel: 'Rename' }); });
+  const ok = '.hall-dialog__actions .btn:not(.btn--ghost)';
+  assert.equal(await page.$eval(ok, (b) => b.disabled), true, 'blank: the confirm is off');
+  await page.keyboard.press('Enter');
+  assert.ok(await page.evaluate(() => !!document.querySelector('dialog.hall-dialog')), 'Enter on a blank required field does not answer');
+  await page.keyboard.type('   ');
+  assert.equal(await page.$eval(ok, (b) => b.disabled), true, 'spaces are still blank');
+  await page.keyboard.type('Mine');
+  assert.equal(await page.$eval(ok, (b) => b.disabled), false, 'typed: the confirm is on');
+  await page.click(ok);
+  assert.equal(await page.evaluate(() => window.__r), '   Mine', 'the text is handed back exactly as typed');
+  await ctx.close();
+});
+
+test('the prompt\'s title, body and label are text, never markup', { skip }, async () => {
+  const { ctx, page } = await boot();
+  await page.evaluate(() => { window.OTBDialog.prompt({ title: '<b>t</b>', body: '<img src=x onerror="window.__x=1">', label: '<i>l</i>' }); });
+  const s = await page.evaluate(() => ({ img: !!document.querySelector('.hall-dialog img'), i: !!document.querySelector('.hall-dialog i'), b: !!document.querySelector('.hall-dialog b'), x: window.__x }));
+  assert.deepEqual(s, { img: false, i: false, b: false, x: undefined });
+  await ctx.close();
+});

package/tests/landing_shared_controls.mjs

@@ -0,0 +1,157 @@
+// tests/landing_shared_controls.mjs — the landing, the hub and the raise page ask in the shared
+// dialog and draw their buttons and dialog frame on the shared scales (task 1005136, goal 1000138).
+//
+// The UI check found the hub's one question (start another project while one builds) and the raise
+// editor's "discard your changes?" still in the browser's confirm box, the hub's project card and
+// both pages' buttons on typed-in corners, sizes and durations, and the signed-in landing bar at
+// 320 overflowing (331px) with the mark under the "projects" label. This pins:
+//   1. both pages load the shared dialog (hall-dialog.js, after the shared escaper) and ask in it;
+//   2. the dialog the shared component builds has a frame on each page, on the shared scales;
+//   3. the buttons and the project card spend the shared corner, line, layer, size and duration;
+//   4. the signed-in bar folds the second-account door into the profile band below 900, keeping
+//      the same door there;
+//   5. in a real browser (skips without a system Edge or Chrome): the hub's confirm opens in the
+//      shared component wearing the landing's frame and buttons, and the signed-in landing bar,
+//      built from index.html's own sheet and markup, holds one row at 320 with the mark clear of
+//      the "projects" trigger. The full page is the kit's: render.js --page / (0 problems).
+import { test, after } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const kit = require('../modules/ui-design/kit/lib.js');
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const LANDING = 'modules/public-landing/public/';
+const COSMOS = read(`${LANDING}assets/cosmos.css`);
+const RAISE_CSS = read('modules/raise/public/raise.css');
+
+// The declarations of the first rule whose selector list is exactly `sel` (compact or spaced).
+function rule(css, sel) {
+  const esc = sel.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const m = css.match(new RegExp(`(?:^|\\n|\\})\\s*${esc}\\s*\\{([^}]*)\\}`));
+  assert.ok(m, `a rule for ${sel}`);
+  return m[1];
+}
+
+test('the hub and the raise editor load the shared dialog after the shared escaper, and ask in it', () => {
+  const hub = read(`${LANDING}projects.html`);
+  assert.match(hub, /<script src="\/modules\/hall-ui\/public\/dom-utils\.js"><\/script>\n(?:<!--[^\n]*-->\n)?<script src="\/modules\/hall-ui\/public\/hall-dialog\.js"><\/script>/);
+  assert.match(hub, /window\.OTBDialog\.confirm\(\{ title: 'Start a new one\?'/, 'the hub asks in the shared confirm');
+  const page = read('modules/raise/page.js');
+  assert.match(page, /dom-utils\.js" defer><\/script><script src="\/modules\/hall-ui\/public\/hall-dialog\.js" defer><\/script><script src="\$\{BASE\}\/assets\/edit\.js/,
+    'the editor gets the escaper, then the dialog, then itself');
+  assert.match(read('modules/raise/public/edit.js'), /window\.OTBDialog\.confirm\(\{ title: 'Discard your unsaved changes\?'/);
+});
+
+test('the shared dialog has a frame on each page, on the shared scales', () => {
+  for (const [name, css] of [['cosmos.css', COSMOS], ['raise.css', RAISE_CSS]]) {
+    const frame = rule(css, '.hall-dialog');
+    for (const want of [/z-index:\s*var\(--ds-z-modal\)/, /border-radius:\s*var\(--ds-radius-panel\)/, /border:\s*var\(--ds-line\) solid var\(--rule\)/]) {
+      assert.match(frame, want, `${name} .hall-dialog: ${want}`);
+    }
+    // the raise page floats it on the shared shadow; the apex world spends no shadow on UI
+    assert.match(frame, name === 'raise.css' ? /box-shadow:\s*var\(--ds-shadow-pop\)/ : /box-shadow:none/, `${name}: the shadow its world allows`);
+    assert.match(rule(css, '.hall-dialog::backdrop'), /background:\s*rgba\(0,\s*0,\s*0,\s*\.55\)/, `${name}: a black scrim, the one legal literal`);
+    for (const part of ['.hall-dialog__head', '.hall-dialog__title', '.hall-dialog__x', '.hall-dialog__actions']) rule(css, part);
+  }
+  // the buttons the component builds (btn btn--ghost / btn btn--danger) answer on the landing
+  assert.match(COSMOS, /\.btn\.ghost,\.btn\.btn--ghost\{/);
+  assert.match(COSMOS, /\.btn\.danger,\.btn\.btn--danger\{/);
+  assert.match(RAISE_CSS, /\.btn--ghost \{/);
+});
+
+test('the buttons and the project card spend the shared scales, not typed-in values', () => {
+  const btn = rule(COSMOS, '.btn');
+  assert.match(btn, /border-radius:var\(--ds-radius-pill\)/);
+  assert.match(btn, /font-size:var\(--ds-text-lg\)/);
+  assert.doesNotMatch(btn, /\.15s|999px|font-size:\d/, 'no typed-in duration, corner or size');
+  const rbtn = rule(RAISE_CSS, '.btn');
+  assert.match(rbtn, /border-radius: var\(--ds-radius-pill\)/);
+  assert.match(rbtn, /var\(--ds-text-xl\)/);
+  assert.doesNotMatch(rbtn, /\.12s|999px/, 'no typed-in duration or corner');
+  const scrim = rule(COSMOS, '.cardScrim');
+  assert.match(scrim, /z-index:var\(--ds-z-modal\)/, 'the card sits on the shared modal layer');
+  const card = rule(COSMOS, '.projCard');
+  assert.match(card, /border:var\(--ds-line\) solid var\(--rule\)/);
+  assert.match(card, /border-radius:var\(--ds-radius-panel\)/);
+});
+
+test('signed in, the narrow landing bar folds the second-account door into the profile band', () => {
+  const html = read(`${LANDING}index.html`);
+  const narrow = html.slice(html.indexOf('@media (max-width:900px){'));
+  assert.match(narrow.slice(0, narrow.indexOf('\n}\n')), /\.barRight:has\(\.who\) \.newacct\{display:none\}/, 'the pill leaves the bar once the chip is in it');
+  const pill = html.match(/<a class="pill newacct" href="([^"]+)"/);
+  assert.ok(pill, 'the bar still carries the door');
+  const band = html.slice(html.indexOf('id="menuProfile"'));
+  const fold = band.match(/<li class="bandCell bandFold"><a class="bandT" href="([^"]+)"[^>]*>New account<\/a><\/li>/);
+  assert.ok(fold, 'the profile band carries its folded twin');
+  assert.equal(fold[1], pill[1], 'the same door, to the same place');
+});
+
+// ── in a real browser ───────────────────────────────────────────────────────
+
+let browser = null;
+try { browser = await kit.launchBrowser(); } catch (e) { if (!(e instanceof kit.NoBrowserError)) throw e; }
+after(() => browser && browser.close());
+const skip = !browser && 'no system Edge or Chrome';
+const TOKENS = read('modules/ui-design/public/tokens.css');
+
+test('the hub\'s confirm opens in the shared dialog, in the landing\'s frame and buttons', { skip }, async () => {
+  const ctx = await browser.newContext({ viewport: { width: 390, height: 700 } });
+  const page = await ctx.newPage();
+  await page.setContent('<!doctype html><html data-mode="dark"><head><meta charset="utf-8"></head><body><button id="go">Start another project</button></body></html>');
+  await page.addStyleTag({ content: TOKENS + COSMOS });
+  await page.addScriptTag({ content: read('modules/hall-ui/public/dom-utils.js') });
+  await page.addScriptTag({ content: read('modules/hall-ui/public/hall-dialog.js') });
+  await page.focus('#go');
+  await page.evaluate(() => { window.__r = window.OTBDialog.confirm({ title: 'Start a new one?', body: 'Acme keeps building.', confirmLabel: 'Start a new one' }); });
+  const s = await page.evaluate(() => {
+    const d = document.querySelector('dialog.hall-dialog');
+    const cs = getComputedStyle(d);
+    const ghost = getComputedStyle(d.querySelector('.btn.btn--ghost'));
+    const ok = d.querySelector('.hall-dialog__actions .btn:not(.btn--ghost)');
+    return { modal: d.matches(':modal'), radius: cs.borderTopLeftRadius, line: cs.borderTopWidth, shadow: cs.boxShadow, z: cs.zIndex,
+      ghostBg: ghost.backgroundColor, ghostEdge: ghost.borderTopWidth, okH: ok.getBoundingClientRect().height, okR: getComputedStyle(ok).borderTopLeftRadius };
+  });
+  assert.equal(s.modal, true, 'the shared component, opened modal');
+  assert.equal(s.radius, '16px', 'the panel corner');
+  assert.equal(s.line, '1px', 'one hairline');
+  assert.equal(s.shadow, 'none', 'the apex world spends no shadow on UI');
+  assert.equal(s.z, '160', 'the shared modal layer');
+  assert.equal(s.ghostBg, 'rgba(0, 0, 0, 0)', 'Cancel takes the landing\'s ghost button through the shared name');
+  assert.equal(s.ghostEdge, '2px');
+  assert.ok(s.okH >= 24, 'the confirm clears the tap floor');
+  assert.equal(s.okR, '999px', 'the pill corner');
+  await page.click('.hall-dialog__actions .btn:not(.btn--ghost)');
+  assert.equal(await page.evaluate(() => window.__r), true);
+  await ctx.close();
+});
+
+test('signed in, the landing bar holds one row at 320 with the mark clear of the triggers', { skip }, async () => {
+  const html = read(`${LANDING}index.html`);
+  const styles = [...html.matchAll(/<style[^>]*>([\s\S]*?)<\/style>/g)].map((m) => m[1]).join('\n');
+  const bar = html.slice(html.indexOf('<header class="topbar bar">'), html.indexOf('</header>') + 9)
+    .replace(/<!--apex-only:(start|end)-->/g, '')
+    .replace(/<span class="whoSlot" id="who">[\s\S]*?<\/span>/, '<span class="whoSlot" id="who"><button type="button" class="trig who"><img width="26" height="26" alt=""><span class="who-name">builder</span></button></span>');
+  // the artist-review door the signed-in bar also carries (page-notes.css draws it 36px wide here)
+  const withReview = bar.replace('<span class="whoSlot"', '<button type="button" class="arv-btn" style="width:36px;min-height:36px">R</button><span class="whoSlot"');
+  const ctx = await browser.newContext({ viewport: { width: 320, height: 640 } });
+  const page = await ctx.newPage();
+  for (const [name, markup, signedIn] of [['signed in', withReview, true], ['signed out', bar.replace(/<span class="whoSlot" id="who">[\s\S]*?<\/span>/, '<span class="whoSlot" id="who"><a class="pill signin" href="#">Sign in</a></span>'), false]]) {
+    await page.setContent(`<!doctype html><html data-mode="dark"><head><meta charset="utf-8"></head><body>${markup}</body></html>`);
+    await page.addStyleTag({ content: TOKENS + styles });
+    const r = await page.evaluate(() => {
+      const box = (s) => { const e = document.querySelector(s); const b = e && e.getBoundingClientRect(); return b && b.width ? { l: b.left, r: b.right } : null; };
+      return { sw: document.documentElement.scrollWidth, mark: box('.barMark'), proj: box('#projTrig'), newacct: box('.newacct') };
+    });
+    assert.ok(r.sw <= 320, `${name}: no sideways scroll at 320 (scrollWidth ${r.sw})`);
+    assert.ok(r.mark.r <= r.proj.l, `${name}: the mark ends before the projects trigger starts (${r.mark.r} vs ${r.proj.l})`);
+    assert.equal(!!r.newacct, !signedIn, signedIn ? 'the second-account door has folded into the profile band' : 'signed out, the door stays in the bar');
+  }
+  await ctx.close();
+});

package/tests/npm_release_release.mjs

@@ -227,5 +227,5 @@ test('the page renders the Release section and posts to the route', () => {
   const src = fs.readFileSync(new URL('../modules/npm-release/public/work.js', import.meta.url), 'utf8');
   assert.match(src, /\$\{releaseHtml\(data\)\}/);
   assert.match(src, /client\.request\('POST', `\$\{API\}\/npm-release\/release`, \{ body: \{ version \} \}\)/);
-  assert.match(src, /window\.confirm\(/, 'a release is confirmed before it is sent');
+  assert.match(src, /await window\.OTBDialog\.confirm\(\{/, 'a release is confirmed in the hall\'s own dialog before it is sent (task 1005136)');
 });

package/tests/projects_hub.mjs

@@ -607,7 +607,7 @@ test('the platform answers its own figures by the same rule: faces from its lead
 test('the poster is in the world: 560 wide, one hairline, no shadow, the disc surviving over the art, the facts a ledger', () => {
   const block = (COSMOS.match(/\.projCard\{[^}]*\}/) || [''])[0];
   assert.match(block, /width:min\(560px,100%\)/);
-  assert.match(block, /border:1px solid var\(--rule\)/);
+  assert.match(block, /border:var\(--ds-line\) solid var\(--rule\)/, 'one hairline, on the shared line (task 1005136)');
   assert.match(block, /box-shadow:none/);
   assert.match(block, /container-type:inline-size/, 'the disc and the callouts measure the card, not the viewport');
   assert.match(COSMOS, /\.projCard \.cardArt\{[^}]*aspect-ratio:5\/2;object-fit:cover/, 'a fixed 5:2 crop');

package/tests/projects_hub_pre_uat.mjs

@@ -225,7 +225,9 @@ test('the manifest step acknowledges code_received, offers a restart after a sta
 });
 
 test('"Start another project" asks before abandoning a standup still being watched', () => {
-  assert.match(SCRIPT, /if \(instanceId && pollTimer && !confirm\(/);
+  // asked in the shared dialog since task 1005136, never the browser's box
+  assert.match(SCRIPT, /var asked = instanceId && pollTimer\n\s*\? window\.OTBDialog\.confirm\(\{/);
+  assert.match(SCRIPT, /asked\.then\(function \(yes\) \{ if \(yes\) startAnother\(\); \}\);/, 'it starts over only on yes');
 });
 
 /* ── every recovery sign-in from the wizard keeps the repo scope ── */

package/tests/roster_government_columns.mjs

@@ -139,7 +139,9 @@ async function boot(opts = {}) {
     OTBBranding: { currencyLabel: () => 'Credits' },
     BongosClient: { createClient: () => api },
     location: locationObj,
-    prompt: (msg) => { prompts.push(msg); return 'left for a new job'; },
+    // the reason is asked in the hall's own dialog (task 1005136); the browser box must not run
+    OTBDialog: { prompt: async (o) => { prompts.push(o.title); return 'left for a new job'; } },
+    prompt: () => { throw new Error('window.prompt was called'); },
     addEventListener() {},
   };
   // The shell's own /me read, shared on window.__hallReads (shell.js probeMe).