@bongos/core 1.24.75 → 1.24.77

package/modules/hall-ui/public/deploy.html

@@ -90,6 +90,6 @@
 <script src="/builders/hall-ask.js"></script>
 <!-- the in-place update window a hosted project's hall opens (task 1005041) -->
 <script src="/builders/deploy-handoff.js?v=2026-11-03-handoff"></script>
-<script src="/builders/deploy.js?v=2026-11-03-handoff"></script>
+<script src="/builders/deploy.js?v=2026-11-09-status"></script>
 </body>
 </html>

package/modules/hall-ui/public/deploy.js

@@ -426,12 +426,63 @@
         Reconnecting sets up <strong>lasting</strong> access: the hub keeps a key of its own for this repository, so this change and every later upgrade are saved to GitHub without asking you again.</p>`;
   }
 
+  // ---- the plain status line (task 1005012) ----------------------------------
+  //
+  // The owner opened this page to put merged work live and found neither a button nor a
+  // sentence: the box was already on the newest version — it had moved there by itself on
+  // its update rule — and the page said only "nothing to deploy". So the box LEADS with one
+  // line in words, up to date or not, and says how the next version reaches it. Every
+  // fact in it is the server's: `behind`, the served version and the update rule. The page
+  // still compares no versions; it only words what it was told.
+  //
+  // How the next version arrives depends on the rule alone. On "Stay put" nothing arrives
+  // by itself, so saying it would is the one sentence here that could be false.
+  const AUTO_RULES = new Set(['patch', 'minor']);
+  function nextVersionWords(p) {
+    if (AUTO_RULES.has(p.update_channel)) {
+      return 'When a newer version is published, it arrives on its own under the update rule below — nothing needs pressing.';
+    }
+    if (p.update_channel === 'pinned') {
+      return 'The update rule below is Stay put, so a newer version waits until you change the update rule.';
+    }
+    return 'When a newer version is published, a deploy button appears here.';
+  }
+
+  // Merged is not live: a merge reaches this project only inside a published version. On
+  // the hall's own view the npm-release module lists where each piece of work has got to,
+  // so the line points at it when it is there, and says nothing about a list that is not.
+  function waitingWorkWords() {
+    const mods = window.__MODULES__;
+    const listed = view.isSelf && !!(mods && mods.enabled && mods.enabled['npm-release']);
+    return `Work merged after that is not live until a published version carries it${
+      listed ? ' — “Where is the work” on this page shows where each piece has got to' : ''}.`;
+  }
+
+  function upToDateHtml(p) {
+    const v = escapeHtml(String(p.served_version));
+    return `
+      <div class="dp-status dp-status--ok" role="status">
+        <p class="ov-row__sub"><strong>Up to date.</strong> This project runs core ${v}, the newest version
+          it can take. Every piece of merged work inside core ${v} is live. There is nothing to deploy.</p>
+        <p class="ov-row__sub">${escapeHtml(nextVersionWords(p))} ${escapeHtml(waitingWorkWords())}</p>
+      </div>`;
+  }
+
+  // Behind: the one primary action on the page. It is a PERSON'S button and stays one —
+  // the project's law is that going live waits for a person, so pressing it opens the
+  // check and the confirm (ADR 0293 D4), and nothing restarts until "Move to …" is pressed.
+  // The id is the step-one id it always was, so the two-step wiring is unchanged.
   function stepOneHtml(p) {
+    const to = escapeHtml(String(p.recommended_version));
+    const auto = AUTO_RULES.has(p.update_channel)
+      ? ' It would also arrive on its own under the update rule below; this does it now.' : '';
     return `
-      <p class="ov-row__sub">Core <strong>${escapeHtml(String(p.recommended_version))}</strong> is published and
-        this box is not on it yet.</p>
-      <div class="ps-controls">
-        <button type="button" class="btn" id="dp-preview-${escapeHtml(String(p.instance_id))}">See what would change</button>
+      <div class="dp-status dp-status--behind" role="status">
+        <p class="ov-row__sub"><strong>Not up to date.</strong> Core <strong>${to}</strong> is published; this project still runs ${escapeHtml(String(p.served_version))}.${auto}</p>
+        <div class="ps-controls">
+          <button type="button" class="btn btn--primary" id="dp-preview-${escapeHtml(String(p.instance_id))}">Deploy core ${to} now</button>
+        </div>
+        <p class="ov-row__sub dp-status__note">You see what it brings in and confirm before anything restarts.</p>
       </div>`;
   }
 
@@ -613,7 +664,7 @@
     if (moving.has(p.instance_id)) action = movingHtml(p);
     else if (p.open_intent) action = busyHtml(p);
     else if (p.reading === 'no_answer') action = '';
-    else if (!p.behind) action = `<p class="ov-row__sub">Nothing newer is published that this box can take. There is nothing to deploy.</p>`;
+    else if (!p.behind) action = upToDateHtml(p);
     else action = step === 'confirm' ? stepTwoHtml(p, isSelf) : stepOneHtml(p);
     if (!moving.has(p.instance_id)) action += settledHtml(p);
     return `

package/modules/hall-ui/public/home-city.js

@@ -57,7 +57,7 @@
   const SKY_LABEL = 'The project\'s ideas as a night sky over the city\'s real skyline, with this week\'s ideators ranked beside it';
   const CITY_LABEL = 'The project as a city: one tower per working area, as tall as what has shipped there, with the builders of the week beside it';
 
-  let host = null, model = null, viewerId = null, t = 0, target = 0, raf = null, run = null, lastWeek = -1, shown = false, gallery = null;
+  let host = null, model = null, viewerId = null, t = 0, target = 0, raf = null, run = null, lastWeek = -1, shown = false, gallery = null, ideaBox = null;
   const rungs = new Map();
 
   function mode() {
@@ -292,11 +292,15 @@
 
   // ---- the artist's Home (task 1005060): in Artistry the same section is the gallery,
   // home-gallery.js, the bench in the museum the city's art district opens onto ----
+  // In Ideating, the idea box (home-idea-box.js) opens Home above the sky, and shows even
+  // when the sky could not be read: filing an idea needs no picture of the others.
   function craftHome() {
     const art = !!gallery && document.documentElement.dataset.craft === 'artistry';
+    const idea = !!ideaBox && craft() === 'ideating';
     host.classList.toggle('hc--gallery', art);
     if (gallery) gallery.show(art);
-    host.hidden = !(art || shown);
+    if (ideaBox) ideaBox.show(idea);
+    host.hidden = !(art || idea || shown);
   }
 
   // ---- the governor's Home is the street; tests swap the hop for a recorder ----
@@ -338,6 +342,7 @@
     wireTip();
     wireDoors();
     if (window.OTBHomeGallery) gallery = window.OTBHomeGallery.attach(host);
+    if (window.OTBHomeIdeaBox) ideaBox = window.OTBHomeIdeaBox.attach(host);
     document.addEventListener('otb:craft', craftHome);
     craftHome();
     new MutationObserver(() => { if (model) drawScene(); }).observe(document.documentElement, { attributes: true, attributeFilter: ['data-theme'] });

package/modules/hall-ui/public/home-idea-box.css

@@ -0,0 +1,33 @@
+/* modules/hall-ui/public/home-idea-box.css — the idea box that opens the ideator's Home
+   (home-idea-box.js; record modules/hall-ui/records/home-city.md § "The idea box").
+   It sits at the top of the city's section, over the sky. Every colour is a hall token
+   or a mix of one; the tokens carry both modes, so no rule here is written per mode.
+   Every type size and radius is a --ds-* scale token (DESIGN.md, the Fifteen Rule), and
+   the narrow layout comes from wrapping rather than a breakpoint, so the sheet adds no
+   typed-in value to the design counts. No :root, no motion. */
+
+.hib { padding: clamp(16px, 4vw, 28px) clamp(16px, 4vw, 28px) clamp(14px, 3vw, 20px); display: grid; gap: 10px; }
+.hib[hidden] { display: none; }
+.hib-h { margin: 0; font: 600 var(--ds-text-4xl)/1.25 var(--font-display); color: var(--ink); }
+.hib-h label { cursor: text; }
+/* The box takes the row; on a narrow screen the button wraps under it */
+.hib-row { display: flex; flex-wrap: wrap; gap: 10px; align-items: flex-start; }
+.hib .hib-title {
+  width: 100%; min-width: 0; box-sizing: border-box;
+  font: 400 var(--ds-text-xl)/1.4 var(--font-body); color: var(--ink);
+  background: var(--bg-card); border: var(--line) solid var(--rule-soft); border-radius: var(--radius-sm);
+}
+.hib textarea.hib-title {
+  flex: 1 1 16rem; width: auto; min-height: 48px; max-height: 40vh; padding: 12px 20px;
+  font-size: var(--ds-text-2xl); line-height: 22px;
+  border-radius: var(--ds-radius-panel); resize: none; overflow-y: auto;
+}
+.hib .hib-title::placeholder { color: var(--ink-faint); }
+.hib .hib-title:focus-visible { outline: 2px solid var(--focus); outline-offset: 1px; border-color: transparent; }
+.hib-file { min-height: 48px; padding: 0 22px; font-size: var(--ds-text-lg); flex-shrink: 0; }
+.hib-said { margin: 0; min-height: 1.4em; font: 400 var(--ds-text-md)/1.4 var(--font-body); color: var(--ink-soft); }
+.hib-said--err { color: var(--danger); }
+.hib-said a { color: var(--ink); }
+
+/* The setup guide is about building on your own machine; in Ideating, Home opens on the box */
+html[data-craft="ideating"] #welcome-scroll { display: none; }

package/modules/hall-ui/public/home-idea-box.js

@@ -0,0 +1,106 @@
+// modules/hall-ui/public/home-idea-box.js — the ideator's Home opens on the idea box
+// (goal 1000095, the owner's "work-first hall", 2026-11-04; record
+// modules/hall-ui/records/home-city.md § "The idea box").
+//
+// In Ideating, the first thing on Home is a place to type an idea and file it; the sky
+// and the ladder of ideators stay under it, secondary. It is ONE box and a button
+// (owner, 2026-11-05: "only one box"): Enter files, Shift+Enter starts a new line, and
+// the box grows with what is typed. The first line is the idea's title, any lines after
+// it its details. Filing is POST /inbox as the sky's quick composer files
+// (sky-composer.js): { title, body_md, kind: 'feature' }. A failed filing keeps the
+// words where they were and says why; a filed one says where it went and links to
+// Your thinking, where every thought the builder filed is listed.
+//
+// It is not a hall widget of its own (Home's stats zone holds one): home-city.js
+// attaches it at the top of its section and shows it when the craft is Ideating, the
+// way it shows the gallery in Artistry. It reads nothing; it writes one thing.
+(function () {
+  'use strict';
+
+  var API = '/api/bongos';
+
+  // ---- pure: what the line under the box says (node-testable) ----
+  function explain(res) {
+    var err = res && res.data && res.data.error;
+    var code = err && (typeof err === 'object' ? err.code : err);
+    var details = (err && typeof err === 'object' && err.details) || {};
+    if (details.reason) return 'Not filed: ' + details.reason + '. Your idea is still here.';
+    if (res && (res.status === 401 || res.status === 403)) return 'Not filed: your session may have expired. Reload and try again.';
+    if (code) return 'Not filed: ' + String(code).replace(/_/g, ' ') + '. Your idea is still here.';
+    return 'Not filed' + (res && res.status ? ' (' + res.status + ')' : '') + '. Nothing was saved; your idea is still here.';
+  }
+  // the first non-empty line is the title; whatever follows it is the details
+  function body(text) {
+    var lines = String(text || '').replace(/\r\n?/g, '\n').split('\n');
+    while (lines.length && !lines[0].trim()) lines.shift();
+    return { title: (lines.shift() || '').trim(), body_md: lines.join('\n').trim(), kind: 'feature' };
+  }
+  var Lib = { explain: explain, body: body };
+  if (typeof module !== 'undefined' && module.exports) module.exports = Lib;
+  if (typeof document === 'undefined') return;
+
+  function attach(host) {
+    var api = null, filing = false;
+    var root = document.createElement('form');
+    root.className = 'hib';
+    root.setAttribute('novalidate', '');
+    root.setAttribute('aria-labelledby', 'hib-h');
+    root.hidden = true;
+    root.innerHTML =
+      '<h2 class="hib-h" id="hib-h"><label for="hib-title">What is your idea?</label></h2>' +
+      '<div class="hib-row">' +
+        '<textarea id="hib-title" class="hib-title" rows="1" placeholder="One line is enough" aria-describedby="hib-keys"></textarea>' +
+        '<button type="submit" class="btn hib-file">File idea</button>' +
+      '</div>' +
+      '<p class="sr-only" id="hib-keys">Enter files the idea. Shift and Enter starts a new line.</p>' +
+      '<p class="hib-said" role="status" aria-live="polite"></p>';
+    host.insertBefore(root, host.firstChild);
+    var title = root.querySelector('.hib-title');
+    var said = root.querySelector('.hib-said'), btn = root.querySelector('.hib-file');
+
+    // the box is as tall as what is in it
+    function fit() { title.style.height = 'auto'; title.style.height = title.scrollHeight + 'px'; }
+    title.addEventListener('input', fit);
+    // Enter files, Shift+Enter is a new line; a key that is still composing a character is left alone
+    title.addEventListener('keydown', function (e) {
+      if (e.key !== 'Enter' || e.shiftKey || e.isComposing) return;
+      e.preventDefault();
+      if (typeof root.requestSubmit === 'function') root.requestSubmit(); else root.dispatchEvent(new Event('submit', { cancelable: true }));
+    });
+
+    function say(text, link) {
+      said.textContent = text;
+      said.classList.toggle('hib-said--err', !link && !!text);
+      if (link) {
+        var a = document.createElement('a');
+        a.href = '/thinking';
+        a.textContent = 'See it in Your thinking';
+        said.append(' ', a);
+      }
+    }
+
+    root.addEventListener('submit', function (e) {
+      e.preventDefault();
+      if (filing) return;
+      var b = body(title.value);
+      if (!b.title) { say('Type your idea first.'); title.focus(); return; }
+      api = api || (window.BongosClient && window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin', throwOnError: false }));
+      if (!api) { say(explain(null)); return; }
+      filing = true; btn.disabled = true; say('');
+      api.request('POST', API + '/inbox', { body: b }).catch(function () { return null; }).then(function (res) {
+        filing = false; btn.disabled = false;
+        if (!res || !res.ok || !res.data || !res.data.idea) { say(explain(res)); return; }
+        title.value = ''; fit();
+        say(res.data.routed_task ? 'Filed, and it is already a task.' : 'Filed. It waits for the next triage.', true);
+        title.focus();
+      });
+    });
+
+    return {
+      // shown in Ideating
+      show: function (on) { root.hidden = !on; },
+    };
+  }
+
+  window.OTBHomeIdeaBox = { attach: attach, lib: Lib };
+})();

package/modules/hall-ui/public/index.html

@@ -23,6 +23,7 @@
   <link rel="stylesheet" href="/builders/hall-ask.css">
   <link rel="stylesheet" href="/builders/home-city.css">
   <link rel="stylesheet" href="/builders/home-gallery.css">
+  <link rel="stylesheet" href="/builders/home-idea-box.css">
 </head>
 <body data-page="home">
 
@@ -133,6 +134,7 @@
 <script src="/builders/city-draw.js" defer></script>
 <script src="/builders/home-city-draw.js" defer></script>
 <script src="/builders/home-gallery.js" defer></script>
+<script src="/builders/home-idea-box.js" defer></script>
 <script src="/builders/home-city.js" defer></script>
 <!-- task 1003455: the shared blocker-row renderer (window.OTBBlockersLib), read by
      both goal-inbox.js's attention-inbox slice below and the /blockers page.

package/modules/hall-ui/public/project-settings.css

@@ -212,6 +212,21 @@
 }
 .dp-settled .ps-controls { margin: 0.4rem 0 0.2rem; }
 
+/* The box's plain status line (task 1005012): up to date, or not and here is the button.
+   The same left-mark grammar as the settled states — ok when nothing waits, the accent
+   when a published version is waiting for a person's press. */
+.dp-status { margin: 0.4rem 0 0; }
+.dp-status--ok {
+  border-left: 3px solid var(--ok);
+  padding-left: 0.7rem;
+}
+.dp-status--behind {
+  border-left: 3px solid var(--accent);
+  padding-left: 0.7rem;
+}
+.dp-status .ps-controls { margin: 0.5rem 0 0.3rem; }
+.dp-status__note { color: var(--ink-soft); }
+
 /* The project's update rule (task 1004445) — a quiet setting under the move, set apart by
    a hairline so it does not read as part of whichever state sits above it. */
 .dp-rule {

package/modules/hall-ui/records/home-city.md

@@ -175,6 +175,27 @@ leaderboard.
 - Pinned in `tests/home_studio.mjs` and `tests/home_studio_widget.mjs` (real browser, empty states included); harness
   fixtures `copy-desk__studio.json` and `home__studio__works.json`.
 
+## The idea box — the ideator's Home opens on it (task 1005078)
+
+The owner's work-first hall (2026-11-04: "the hall is for doing work, not looking at stuff"), goal 1000095. In
+Ideating, the first thing on Home is a place to type an idea and file it; the sky and the ladder stay under it.
+
+- **One section, still.** `home-idea-box.js` is not a hall widget (Home's stats zone holds one): `home-city.js`
+  attaches it at the top of its section, the gallery's way, and `craftHome()` shows it in Ideating only. It shows
+  even when `GET /home/city` failed, because filing needs no picture of the other ideas.
+- **One box and a button** (owner, 2026-11-05: "the idea submission should only have one box"). Enter files and
+  Shift+Enter starts a new line (owner, same day); the box grows with what is typed. The first non-empty line is
+  the title and any lines after it are `body_md`. No kind or goal picker: it files `kind: 'feature'` through
+  `POST /inbox`, the sky composer's quick filing, and triage routes it. The top bar's + idea button is unchanged.
+- **What it says.** A refusal keeps the words and names the reason (`details.reason`, else the code); a filing
+  clears the box and links to Your thinking. It reads nothing.
+- **The setup guide hides in Ideating** (`#welcome-scroll`, `home-idea-box.css`): it is about building on your
+  own machine and pushed the box below the fold. Every other craft still shows it.
+- **Preview.** `scripts/hall-preview/server.js` answers `POST /inbox` with the canned `inbox.post.json`, so the
+  filed state can be seen. Pinned by `tests/home_idea_box.mjs` (8 cases, a real browser).
+- **Sign-off.** The owner saw it in the preview at 1440 dark and said "Looks right, ship it" (2026-11-05), then
+  asked for Enter / Shift+Enter, which was added before the ship.
+
 ## The governor's Home is the street (task 1005064)
 
 The owner, 2026-11-04, after the four Homes went live: "when you tab between the pages the home screen

package/modules/ideas/routes/blockers.js

@@ -79,6 +79,28 @@ function askRequired(req, body) {
   return !TEMPLATED_SOURCES.includes(body.source);
 }
 
+// CHECKED, NOT INFERRED (task 1005120). A blocker spends the owner's attention, the
+// scarcest thing a project has. One project's blocker asked its owner to "apply to
+// Plaid for OAuth" for days after the project's own shipped work found there was
+// nothing to apply for: it had been filed on an inference (one bank worked, one did
+// not) when the page that settled it was one click away. So the same filings that
+// owe an ask (an AI session, by hand) also owe `checked` — one sentence naming what
+// the session opened or ran that showed only a person can do this. It is written into
+// the blocker's body, so whoever re-reads the blocker later (the daily review re-checks
+// before asking again) can see what the claim rested on and test it against what has
+// shipped since. The floor is a length, because a length is all a server can judge;
+// it stops "probably needed", which is the shape the hunch takes.
+const CHECKED_MIN = 30;
+const CHECKED_REQUIRED_MESSAGE = 'An AI session files a blocker only after checking it really needs a person. '
+  + `Add "checked": one sentence (${CHECKED_MIN} characters or more) saying what you opened or ran that showed it, `
+  + 'for example the settings page you read or the command whose output you saw. If you have not checked, check first.';
+// The line names WHO checked, so a blocker is tracked back to its filer — the person a
+// re-check asks first — without a new column on the core-owned table.
+function checkedLine(checked, builder) {
+  const who = builder && builder.github_login ? ` (by @${builder.github_login})` : '';
+  return `**Checked before filing${who}:** ${String(checked).trim()}`;
+}
+
 // The `ideas.fileBlocker` port's writer: POST /blockers' shape and length rules, for a caller
 // inside the server, which has no request to validate. A refusal throws with code BAD_BLOCKER.
 function fileBlockerFromServer({ title, bodyMd = '', source, sourceRef } = {}) {
@@ -145,6 +167,8 @@ module.exports = function buildBlockersRouter() {
   // person answers (task 1004703, see THE ASK above); a slop ask files nothing
   // (400 `ask_refused`). An AI session filing by hand (a CLI session, any `source`
   // but a templated script's) must send one: without it, 400 `ask_required` (task 1004704).
+  // The same filing also sends `checked` — what it opened or ran that showed a person
+  // is needed — or 400 `checked_required`; it is appended to body_md (task 1005120).
   // → 201 { blocker, ask } (ask: the stored card, or null).
   router.post('/blockers', api.requireBuilder, async (req, res) => {
     if (validateOrRespond(req, res, {
@@ -153,6 +177,7 @@ module.exports = function buildBlockersRouter() {
       source: { type: 'string', maxLength: LIMITS.SOURCE },
       source_ref: { type: 'string', maxLength: LIMITS.SOURCE_REF },
       ask: { type: 'object' },
+      checked: { type: 'string', maxLength: LIMITS.TITLE },
     })) return;
     const body = req.body || {};
     let verdict = null;
@@ -177,10 +202,31 @@ module.exports = function buildBlockersRouter() {
         return res.fail('ask_refused', { status: 400, message: gov.refusalLine(verdict.errors), details: { errors: verdict.errors } });
       }
     }
+    // After the ask, so a filing with no card hears about the card first (task 1005120).
+    const checked = typeof body.checked === 'string' ? body.checked.trim() : '';
+    if (askRequired(req, body) && checked.length < CHECKED_MIN) {
+      return res.fail('checked_required', {
+        status: 400,
+        message: CHECKED_REQUIRED_MESSAGE,
+        details: { field: 'checked', min_length: CHECKED_MIN },
+      });
+    }
+    const bodyMd = checked
+      ? [String(body.body_md ?? '').trim(), checkedLine(checked, req.builder)].filter(Boolean).join('\n\n')
+      : (body.body_md ?? '');
+    // body_md was validated on its own; the check line is added after, so the whole is
+    // held to the same cap rather than quietly growing past it.
+    if (bodyMd.length > LIMITS.DESCRIPTION) {
+      return res.fail('body_too_long', {
+        status: 400,
+        message: `The blocker's text and its "checked" line come to ${bodyMd.length} characters; ${LIMITS.DESCRIPTION} at most. Shorten the body.`,
+        details: { field: 'body_md', max_length: LIMITS.DESCRIPTION },
+      });
+    }
     try {
       const blocker = await blockers.createBlocker({
         title: body.title,
-        bodyMd: body.body_md ?? '',
+        bodyMd,
         source: body.source ?? 'manual',
         sourceRef: body.source_ref ?? null,
       });

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.75",
+  "version": "1.24.77",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.24.75",
+      "version": "1.24.77",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.24.75",
+  "version": "1.24.77",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11470,10 +11470,28 @@
       "text": "The hall has a game mode: once it is on, every page opens full screen with no sidebar, and Escape brings the menus back when you need them."
     }
   ],
-  "1.24.75": [
+  "1.24.76": [
+    {
+      "id": "1005078",
+      "text": "In Ideating mode, Home now opens on a single box to type and file an idea — press Enter to file it, Shift+Enter for a new line."
+    },
+    {
+      "id": "1005120",
+      "text": "Blockers now cost a real check to file: an AI session must say what it looked at that showed a person is needed, and that note stays on the blocker. The daily blocker review now re-checks each one against what has shipped sinc"
+    },
+    {
+      "id": "1005012",
+      "text": "The Deploy page now says in one plain line whether the project is up to date. When it is, it says merged work in that version is live and that the next version arrives on its own (or waits, if the project is set to stay put)."
+    },
     {
       "id": "1005121",
       "text": "Closing a project-setup stage is now one step: if the founder alone decides, the stage closes and the project moves on at once; if others must vote, the answer says who and what to do next instead of falsely reporting success."
     }
+  ],
+  "1.24.77": [
+    {
+      "id": "1005095",
+      "text": "The Autobongos runner can now be set up on any Windows PC or Mac, including a laptop, with no administrator step. One program installs it, starts it whenever you sign in to the device, keeps it running, updates it by itself, a"
+    }
   ]
 }

package/scripts/bongos/autobongos-bootstrap.ps1

@@ -0,0 +1,169 @@
+# scripts/bongos/autobongos-bootstrap.ps1 -- the first lines of Autobongos setup
+# on a Windows PC (tasks 1005095, 1005094; goal 1000139).
+#
+#   autobongos-bootstrap.ps1 -Code abr_... -ApiBase https://... -Repo https://github.com/owner/name
+#
+# and, as the hall hands it out, with no file on the PC at all:
+#
+#   & ([scriptblock]::Create((irm 'https://<project>/api/bongos/autonomy/runner-setup.ps1'))) -Code '...' -ApiBase '...' -Repo '...'
+#
+# WHY THIS IS POWERSHELL AND SO SHORT. Everything that sets a runner up is one
+# Node program (autobongos-host.js), the same on Windows and Mac. But Node cannot
+# install Node, and the program lives in a copy of the project that does not exist
+# yet. So this does only what must happen before Node can take over: find or
+# install git, Node and Claude Code, make the runner ITS OWN copy of the project,
+# and hand over. The hall serves this file and Settings puts the one-time code in
+# the command, so the person copies one line.
+#
+# NO ADMINISTRATOR SHELL. It runs as the person, in an ordinary PowerShell window.
+# winget may show Windows' own "allow this app to make changes" prompt while it
+# installs git or Node; that is the installer asking, not this script.
+#
+# EVERY STOP IS A SENTENCE. A failure it cannot fix itself ends with what
+# happened and what to do, never a stack trace. Safe to run again: each step
+# checks before it acts, and a copy that already exists is brought current
+# instead of cloned twice.
+#
+# IT NEVER CALLS exit WHEN IT WAS PASTED (task 1005094). Run as a script block --
+# which is how the pasted line runs it -- `exit` ends the PowerShell WINDOW, so
+# the person would see their window vanish instead of the sentence telling them
+# what to do. Every stop therefore unwinds to the bottom of this file, which
+# calls `exit` only when this is running as a file.
+
+[CmdletBinding()]
+param(
+  [string]$Code,
+  [string]$ApiBase,
+  [string]$Repo,
+  # Where the runner keeps its own files. One folder, so removing the runner is
+  # deleting it. $HOME, not $env:USERPROFILE: it is the same folder on Windows,
+  # and it also exists where this file is only ever tested (PowerShell on Linux
+  # has no USERPROFILE, and a null default stops the script before its first line).
+  [string]$RunnerHome = (Join-Path $HOME '.cloudbongos-runner'),
+  # Say what would be done and stop before changing anything.
+  [switch]$DryRun
+)
+
+$ErrorActionPreference = 'Stop'
+$StopMark = 'autobongos-setup-stopped'
+
+function Stop-Setup([string]$What, [string]$Fix) {
+  Write-Host ''
+  Write-Host "Autobongos setup stopped here: $What" -ForegroundColor Yellow
+  Write-Host "What to do: $Fix"
+  throw $StopMark
+}
+
+function Say([string]$Text) { Write-Host $Text }
+
+# A fresh install changes PATH in the registry, not in this window.
+function Update-PathFromRegistry {
+  $machine = [Environment]::GetEnvironmentVariable('Path', 'Machine')
+  $user = [Environment]::GetEnvironmentVariable('Path', 'User')
+  $env:Path = (@($machine, $user) | Where-Object { $_ }) -join ';'
+}
+
+function Test-Tool([string]$Name) { return [bool](Get-Command $Name -ErrorAction SilentlyContinue) }
+
+# Find a tool, or install it with winget and look again.
+function Assert-Tool([string]$Name, [string]$WingetId, [string]$Url) {
+  if (Test-Tool $Name) { Say "  found $Name"; return }
+  if ($DryRun) { Say "  would install $Name ($WingetId)"; return }
+  if (-not (Test-Tool 'winget')) {
+    Stop-Setup "$Name is not installed, and this PC has no winget to install it with." "Install $Name from $Url, open a new PowerShell window, and paste the setup command again."
+  }
+  Say "  installing $Name (Windows may ask you to allow it)..."
+  & winget install --id $WingetId -e --source winget --accept-package-agreements --accept-source-agreements --silent | Out-Null
+  Update-PathFromRegistry
+  if (-not (Test-Tool $Name)) {
+    Stop-Setup "$Name did not install." "Install $Name from $Url, open a new PowerShell window, and paste the setup command again."
+  }
+  Say "  installed $Name"
+}
+
+# The whole setup, in the open (not a function): what node and git print must
+# reach the person as it happens, and node must keep the keyboard for the Claude
+# sign-in. A stop it can explain throws $StopMark and lands in the catch below.
+$SetupExit = 1
+try {
+  if (-not $Code -or -not $ApiBase -or -not $Repo) {
+    Stop-Setup 'the setup command is incomplete.' 'Copy the whole command again from Settings > Your Autobongos runner.'
+  }
+  if ($Repo -notmatch '^https://[A-Za-z0-9.-]+/[A-Za-z0-9._/-]+$') {
+    Stop-Setup 'the project address in the command does not look right.' 'Copy the whole command again from Settings > Your Autobongos runner.'
+  }
+  # The one-time code is sent to this address and the runner's login comes back
+  # from it, so it must be https. Plain http is for this machine alone (a
+  # developer's own instance); autobongos-host.js applies the same rule again.
+  if ($ApiBase -notmatch '^https://[A-Za-z0-9.-]+(:\d+)?/?$' -and $ApiBase -notmatch '^http://(localhost|127\.0\.0\.1)(:\d+)?/?$') {
+    Stop-Setup "the project's address in the command is not a secure (https) address." 'Copy the whole command again from Settings > Your Autobongos runner.'
+  }
+
+  Say 'Setting this PC up as an Autobongos runner.'
+  Say 'It gets its own copy of the project and its own sign-in; your own work on this PC is not touched.'
+  Say ''
+  Say 'Checking the three programs it needs...'
+  Assert-Tool 'git' 'Git.Git' 'https://git-scm.com/download/win'
+  Assert-Tool 'node' 'OpenJS.NodeJS.LTS' 'https://nodejs.org'
+
+  if (Test-Tool 'claude') {
+    Say '  found claude'
+  } elseif ($DryRun) {
+    Say '  would install Claude Code'
+  } else {
+    Say '  installing Claude Code...'
+    # npm.cmd, not npm: PowerShell blocks npm.ps1 by default (task 1005033).
+    & npm.cmd install -g '@anthropic-ai/claude-code' | Out-Null
+    Update-PathFromRegistry
+    if (-not (Test-Tool 'claude')) {
+      Stop-Setup 'Claude Code did not install.' 'Install it from https://claude.com/claude-code, open a new PowerShell window, and paste the setup command again.'
+    }
+    Say '  installed Claude Code'
+  }
+
+  $RepoDir = Join-Path $RunnerHome 'repo'
+  Say ''
+  if ($DryRun) {
+    Say "Would make the runner's copy of the project in $RepoDir and hand over to autobongos-host.js."
+    $SetupExit = 0
+  } else {
+
+  New-Item -ItemType Directory -Force -Path $RunnerHome | Out-Null
+  if (Test-Path (Join-Path $RepoDir '.git')) {
+    Say "The runner's copy is already here; bringing it up to date..."
+    & git -C $RepoDir fetch --quiet origin main
+    if ($LASTEXITCODE -ne 0) {
+      Stop-Setup "this PC could not fetch the project's code from GitHub." 'Sign in to GitHub when Windows asks, then paste the setup command again.'
+    }
+    & git -C $RepoDir reset --quiet --hard origin/main
+  } else {
+    Say "Making the runner's own copy of the project (GitHub may ask you to sign in)..."
+    & git clone --quiet $Repo $RepoDir
+    if ($LASTEXITCODE -ne 0) {
+      Stop-Setup 'this PC could not copy the project from GitHub.' 'Sign in to GitHub in the window that opens (use an account that can see the project), then paste the setup command again.'
+    }
+  }
+
+  $HostJs = Join-Path $RepoDir 'scripts\bongos\autobongos-host.js'
+  if (-not (Test-Path $HostJs)) {
+    Stop-Setup "the project's copy has no runner program in it." 'The project is on an older version. Ask the project owner to update it, then try again.'
+  }
+
+  $env:AUTOBONGOS_HOME = $RunnerHome
+  & node $HostJs setup --code $Code --api-base $ApiBase --mark-runner-copy
+  $SetupExit = $LASTEXITCODE
+
+  }
+} catch {
+  if ("$($_.Exception.Message)" -ne $StopMark) {
+    Write-Host ''
+    Write-Host 'Autobongos setup stopped on something unexpected.' -ForegroundColor Yellow
+    Write-Host 'What to do: paste the setup command again. If it stops here twice, tell the project owner.'
+  }
+  $SetupExit = 1
+}
+
+# As a FILE, report the result the way a script does. PASTED (a script block has
+# no file of its own), leave the window open and only record the result.
+if ($MyInvocation.MyCommand.Path) { exit $SetupExit }
+$global:LASTEXITCODE = $SetupExit