@bongos/core 1.25.17 → 1.25.19

package/modules/ui-design/kit/serve.js

@@ -132,7 +132,7 @@ const UNAUTH = { error: { code: 'unauthenticated', message: 'unauthenticated' }
 // only its length matters here; `optional` and `bundles` are byte-for-byte.
 const STARTER_BUNDLES_FIXTURE = {
   core: [
-    'autonomy', 'builder-settings', 'copy-desk', 'economy', 'government', 'grading',
+    'app-host', 'autonomy', 'builder-settings', 'copy-desk', 'economy', 'government', 'grading',
     'hall-ui', 'ideas', 'lifecycle', 'memory', 'onboarding', 'page-notes', 'public-landing',
     'security', 'sessions', 'specialities', 'status-ui', 'ui-design',
   ],

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.17",
+  "version": "1.25.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.17",
+      "version": "1.25.19",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.17",
+  "version": "1.25.19",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11834,5 +11834,29 @@
       "id": "1005280",
       "text": "Owners bringing in an existing project get a prompt for their own AI to read the code and map goals, tasks and what's broken; they then choose what Bongos files as drafts."
     }
+  ],
+  "1.25.18": [
+    {
+      "id": "1005281",
+      "text": "When an owner's own AI reads their existing project, it can now suggest modules from the project's own list that would do a weak job better; the owner accepts each one as a to-do or dismisses it."
+    },
+    {
+      "id": "1005276",
+      "text": "People who start a project from the front page can now talk with the guide in a plain, simple version instead of the game, and switch between the two mid-chat."
+    },
+    {
+      "id": "1005119",
+      "text": "When founding a project, the charter step now asks how decisions should go and what the founder believes, then recommends a government, a level of strictness, and a first draft of the rules, each with the reason in the founder"
+    },
+    {
+      "id": "1004571",
+      "text": "Inside a project's hall, the options menu now shows where the project's app runs (no platform yet, or Render and its progress and address), and gives the owner a one-click way to connect Render."
+    }
+  ],
+  "1.25.19": [
+    {
+      "id": "1005115",
+      "text": "A solo founder's Genesis now moves to the next stage by itself when a stage's work is finished, and every stage leaves a named document (the scope, the strategy...) they can come back and edit any time."
+    }
   ]
 }

package/scripts/bongos/first-read.js

@@ -8,12 +8,15 @@
 // the map file the session wrote, which `check` validates locally first with the same
 // rules the server applies (modules/lifecycle/first-read.js).
 //
-//   bongos first-read prompt                 print the prompt and the map's shape
-//   bongos first-read check  <map.json>      validate locally (no network)
+//   bongos first-read prompt                 print the prompt, with this project's module list
+//   bongos first-read catalog                the modules a map may recommend (task 1005281)
+//   bongos first-read check  <map.json>      validate (asks for the module list only when
+//                                            the map recommends modules)
 //   bongos first-read submit <map.json>      send it for review — files nothing
 //   bongos first-read show   [<map id>]      the newest map (or one), with what is filed
 //   bongos first-read accept <map id> --all | --items <ref>,<ref>   ONLY with the owner's yes
-//   bongos first-read reject <map id>        the owner's no — files nothing
+//   bongos first-read dismiss <map id> --items <ref>,<ref>   the owner's no to some items
+//   bongos first-read reject <map id>        the owner's no to all of it — files nothing
 
 'use strict';
 
@@ -34,9 +37,10 @@ function printErrors(errors) {
 
 function printItems(items) {
   for (const i of items) {
-    const mark = i.filed ? '  [already in Bongos]' : '';
-    const indent = i.type === 'goal' ? '' : '    ';
-    console.log(`${indent}${i.type.padEnd(4)}  ${i.title}${mark}\n${indent}      ref: ${i.ref}`);
+    const mark = !i.filed ? '' : i.filed.kind === 'dismissed' ? '  [dismissed]' : '  [already in Bongos]';
+    const indent = i.type === 'goal' || i.type === 'module' ? '' : '    ';
+    console.log(`${indent}${i.type.padEnd(6)}  ${i.title}${mark}\n${indent}        ref: ${i.ref}`);
+    if (i.type === 'module' && i.found) console.log(`${indent}        found: ${i.found}`);
   }
 }
 
@@ -57,16 +61,37 @@ async function call(method, path, body) {
 }
 
 const fail = () => require('./cli-lib').cliExit(1);
+
+// The live module list, or null when it cannot be read (no session, or the server says so).
+async function liveCatalog() {
+  const out = await call('GET', '/api/bongos/first-read/catalog');
+  return out && out.available ? out.modules : null;
+}
 const flag = (name) => { const i = process.argv.indexOf(name); return i === -1 ? null : (process.argv[i + 1] || ''); };
 
 (async () => {
   const [verb, arg] = process.argv.slice(2);
   switch (verb) {
-    case 'prompt':
-      console.log(fr.firstReadPrompt());
+    case 'prompt': {
+      // The server's prompt carries the live module list; offline, the fixed text says
+      // how to fetch it later.
+      const out = await call('GET', '/api/bongos/first-read/prompt');
+      console.log(out ? out.prompt : fr.firstReadPrompt());
+      return;
+    }
+    case 'catalog': {
+      const out = await call('GET', '/api/bongos/first-read/catalog');
+      if (!out) return fail();
+      if (!out.available) { console.log('The module list cannot be read on this project. Leave "recommended_modules" out of the map.'); return; }
+      if (!out.modules.length) { console.log('This project has no modules left to switch on. Leave "recommended_modules" out of the map.'); return; }
+      console.log('Modules this project can switch on (recommend only these, by key):');
+      for (const m of out.modules) console.log(`  ${m.key}: ${m.title}. ${m.summary}`.trimEnd());
       return;
+    }
     case 'check': {
-      const v = fr.validateRepoMap(readMap(arg));
+      const raw = readMap(arg);
+      const recommends = Array.isArray(raw.recommended_modules) && raw.recommended_modules.length > 0;
+      const v = fr.validateRepoMap(raw, recommends ? { catalog: await liveCatalog() } : {});
       if (!v.ok) { printErrors(v.errors); process.exit(1); }
       console.log(`The map is in the right shape: ${v.items.length} items.`);
       printItems(v.items);
@@ -80,7 +105,7 @@ const flag = (name) => { const i = process.argv.indexOf(name); return i === -1 ?
       if (!out) return fail();
       console.log(`Sent as map ${out.map_id}. Nothing is filed yet.`);
       printItems(out.items);
-      console.log(`\nWalk the owner through it. Only with their yes:\n  bongos first-read accept ${out.map_id} --all\n  bongos first-read accept ${out.map_id} --items <ref>,<ref>\nor, if they want none of it:\n  bongos first-read reject ${out.map_id}`);
+      console.log(`\nWalk the owner through it. Only with their yes:\n  bongos first-read accept ${out.map_id} --all\n  bongos first-read accept ${out.map_id} --items <ref>,<ref>\nwhat they turn down:\n  bongos first-read dismiss ${out.map_id} --items <ref>,<ref>\nor, if they want none of it:\n  bongos first-read reject ${out.map_id}`);
       return;
     }
     case 'show': {
@@ -103,6 +128,15 @@ const flag = (name) => { const i = process.argv.indexOf(name); return i === -1 ?
       for (const s of out.skipped) console.log(`  skipped ${s.ref} (${s.reason.replace('_', ' ')})`);
       return;
     }
+    case 'dismiss': {
+      const list = (flag('--items') || '').split(',').map((x) => x.trim()).filter(Boolean);
+      if (!arg || !list.length) { console.error('usage: bongos first-read dismiss <map id> --items <ref>,<ref>'); process.exit(2); }
+      const out = await call('POST', `/api/bongos/first-read/maps/${arg}/dismiss`, { items: list });
+      if (!out) return fail();
+      console.log(`Dismissed: ${out.dismissed.length ? out.dismissed.join(', ') : 'nothing'}. A later read-through will not raise them again.`);
+      for (const x of out.skipped) console.log(`  skipped ${x.ref} (${x.reason.replace('_', ' ')})`);
+      return;
+    }
     case 'reject': {
       if (!arg) { console.error('usage: bongos first-read reject <map id>'); process.exit(2); }
       if (!(await call('POST', `/api/bongos/first-read/maps/${arg}/reject`, {}))) return fail();
@@ -110,7 +144,7 @@ const flag = (name) => { const i = process.argv.indexOf(name); return i === -1 ?
       return;
     }
     default:
-      console.log('usage: bongos first-read prompt | check <file> | submit <file> | show [id] | accept <id> --all|--items a,b | reject <id>');
+      console.log('usage: bongos first-read prompt | catalog | check <file> | submit <file> | show [id] | accept <id> --all|--items a,b | dismiss <id> --items a,b | reject <id>');
       process.exit(verb ? 2 : 0);
   }
 })().catch((e) => { console.error(e.message || e); process.exitCode = 1; });

package/scripts/bongos/genesis.js

@@ -11,6 +11,7 @@
 //
 // Usage:
 //   npx bongos genesis show [stage]                       every stage, or one, with its answers
+//   npx bongos genesis document <stage>                   the stage's document (task 1005115): what it left behind, editable any time
 //   npx bongos genesis context                            what the founder said, as markdown (for planning sessions)
 //   npx bongos genesis assist <stage>                     the brief for the founder's AI session (the assisted door)
 //   npx bongos genesis answer <stage> <question> "<words>" [--origin founder|assisted]
@@ -28,7 +29,7 @@
 const fs = require('node:fs');
 const { apiCall, requireSession, errCode, cliExit } = require('./cli-lib');
 
-const USAGE = 'usage: npx bongos genesis show [stage] | context | assist <stage> | answer <stage> <question> "<words>" [--origin founder|assisted] | answer <stage> <question> --not-sure|--skip ["why"] | clear <stage> <question> | history <stage> <question> | door <stage> guided|open|assisted | page <stage> "<words>"|--file <path>|--remove | link <stage> <url>|--remove';
+const USAGE = 'usage: npx bongos genesis show [stage] | context | document <stage> | assist <stage> | answer <stage> <question> "<words>" [--origin founder|assisted] | answer <stage> <question> --not-sure|--skip ["why"] | clear <stage> <question> | history <stage> <question> | door <stage> guided|open|assisted | page <stage> "<words>"|--file <path>|--remove | link <stage> <url>|--remove';
 
 const STATE_LABEL = { answered: '', not_sure: '[not sure yet] ', skipped: '[skipped] ' };
 const ORIGIN_LABEL = { assisted: ' (with AI help)', carried_over: ' (carried over — confirm or edit)' };
@@ -41,16 +42,36 @@ function formatStage(s) {
   for (const q of s.questions) {
     if (q.group && q.group !== group) { group = q.group; out.push(`  — ${group} —`); }
     out.push(`  ${q.id}: ${q.ask}`);
+    if (q.choices) out.push(`    choose: ${q.choices.map((c) => `${c.key} (${c.label})`).join(' · ')}`);
     if (!q.answer) { out.push('    (empty)'); continue; }
     const a = q.answer;
-    const words = a.text ? a.text.replace(/\n/g, '\n    ') : '';
+    const said = a.choice_label || a.text;
+    const words = said ? said.replace(/\n/g, '\n    ') : '';
     out.push(`    ${STATE_LABEL[a.state] || ''}${words}${ORIGIN_LABEL[a.origin] || ''}`.trimEnd());
   }
   if (s.page) out.push('  Page:', `    ${s.page.replace(/\n/g, '\n    ')}`);
   if (s.link) out.push(`  Link: ${s.link}`);
+  if (s.advice) out.push('', ...formatAdvice(s.advice));
   return out.join('\n');
 }
 
+// Pure: the charter stage's recommendation from the founder's answers (task 1005119).
+// A recommendation only: choosing is still the founder's.
+function formatAdvice(a) {
+  const out = [`  Recommended government: ${a.charter.name}`, `    Why: ${a.charter.why}`];
+  if (a.charter.council_rank) out.push(`    It is governed by a council rank you create: ${a.charter.council_rank}.`);
+  out.push('    It is a recommendation. Any form, or your own settings, is still yours to choose.');
+  if (a.preset) {
+    out.push(`  Recommended strictness: ${a.preset.name}. ${a.preset.line}`, `    Why: ${a.preset.why}`, `    ${a.preset.is}`);
+    for (const l of a.preset.laws) out.push(`    - ${l.text}: ${l.effect_on_ai}`);
+  } else {
+    out.push('  Strictness: no preset recommended. Written principles with no laws is a fine way to start.');
+  }
+  out.push('  Draft bylaws and code of conduct, from your answers (edit it, then save it with',
+    '  npx bongos genesis page charter --file <path>):', '', ...String(a.draft_md || '').split('\n').map((l) => `    ${l}`));
+  return out;
+}
+
 // Pure: parse `answer` arguments into the PUT body, or { error }.
 function parseAnswer(rest) {
   const args = [...rest];
@@ -110,6 +131,12 @@ async function main(argv) {
     return 0;
   }
   if (!stage) { console.error(USAGE); return 2; }
+  if (cmd === 'document') {
+    const d = await call('GET', `/founding/work/${enc(stage)}/document`, null, 'read the document');
+    if (!d) return 1;
+    console.log(d.document.markdown || `${d.document.title}: nothing written yet.`);
+    return 0;
+  }
   if (cmd === 'assist') {
     const d = await call('GET', `/founding/work/${enc(stage)}/assist`, null, 'build the brief');
     if (!d) return 1;

package/scripts/bongos/publish-manifest.js

@@ -78,6 +78,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/render-deploy/',  // the deploy page of a project whose app deploys through Render (task 1004270). default:false. MUST be here for the npm-release reason: modules/hall-ui/ ships as one subtree, so a released core without it carries deploy.js's loader for #rd-panel with no routes behind it.
   'modules/market-watch/',   // the weekly AI market watch (task 1004935, goal 1000137). default:false and empty for now, but MUST be here: shipped is not enabled, and a released core without it answers "unknown module" to an instance that turns it on; tests/market_watch_module.mjs (publishable) also reads its manifest.
   'modules/ai-studio/',      // AI generation for artists (task 1004916, ADR 0392): keys, prepaid balance, generate. default:false.
+  'modules/app-host/', // where the app runs (task 1004571): the options menu's panel, read from the hub. default:true.
   'modules/front-door-guide/', // the start-a-project guide (task 1005272): a capped AI chat for a signed-out visitor on the platform's key. default:false, hub first; shipped is not enabled.
   'modules/raise/',           // the /raise investor page (task 1004847, ADR 0384) — ships in core, enabled ONLY on the hub, like platform-identity. Owner decision 2026-10-25: the whole page, its copy and starting numbers included, lives in the repo so builders can contribute to it, accepting that it publishes with the core. Secrets never do: the investor password is RAISE_PASSWORD_HASH in the instance env. default:false.
   'modules/platform-identity/', // hub identity provider (ADR 0141) — ships in core, enabled ONLY on the hub (cloudbongos.com). MUST be here or the hub's enabledModules() throws "unknown module" and provision.js's federation load MODULE_NOT_FOUNDs (task 1002235, same rationale as provisioning above). default:false — shipped ≠ enabled; a vanilla/self-hosted instance never turns it on.

package/scripts/bongos/seam-wiring-guard.js

@@ -97,11 +97,12 @@ const SEAM_CONSUMERS = {
   uiSections: {
     // Per-MODULE, not per-entry: hallWidgetScripts looks for one widget file per page
     // however many sections the module names — hall-widget.js for the index, and since
-    // task 1004301 task-widget.js for a task's page. Either one wires the declaration.
+    // task 1004301 task-widget.js for a task's page, and since task 1004571 settings-widget.js
+    // for the options menu. Any one wires the declaration.
     consumer: 'src/module-loader/loader.js hallWidgetScripts',
     kind: 'file',
     artifact: (dir) => path.join(dir, 'public', 'hall-widget.js'),
-    alternates: (dir) => [path.join(dir, 'public', 'task-widget.js')],
+    alternates: (dir) => [path.join(dir, 'public', 'task-widget.js'), path.join(dir, 'public', 'settings-widget.js')],
   },
   skills: {
     // moduleSkillSources resolves a declared name against the module's OWN tree or

package/scripts/hall-preview/server.js

@@ -457,6 +457,8 @@ for (const key of MODULES_ON) {
   const isOn = (k) => !!(mods.enabled && mods.enabled[k]);
   if (stamped['index.html']) stamped['index.html'] = injectModuleHallWidgets(stamped['index.html'], hallWidgetScripts({ isEnabled: isOn }));
   if (stamped['task.html']) stamped['task.html'] = injectModuleHallWidgets(stamped['task.html'], hallWidgetScripts({ isEnabled: isOn, file: 'task-widget.js' }), 'task');
+  // the options menu's module panels (task 1004571)
+  if (stamped['settings.html']) stamped['settings.html'] = injectModuleHallWidgets(stamped['settings.html'], hallWidgetScripts({ isEnabled: isOn, file: 'settings-widget.js' }), 'settings');
   // ...and their assets, for the same set. The real asset route (serve-internal.js) gates on
   // the instance config's enabled set, which ignores --modules-on, so a widget injected for
   // a module this checkout's config leaves off 404'd and the slot stayed empty (task 1004940).

package/src/bongos/auth-admission.js

@@ -626,8 +626,72 @@ async function notifyHubOfInvite(githubLogin, { invited = true } = {}) {
   }
 }
 
+// WHERE THIS PROJECT'S OWNER TAKES IT OFFLINE OR DISCONNECTS IT (task 1004570). Both
+// controls live on the hub's Projects page for this project — the typed-name confirm and
+// the intent queue are there (ADR 0290) — so the hall only links to them and gains no
+// second delete path. Moved here from routes/core-update.js (task 1004571) so the kernel's
+// readAppStatusFromHub can name the same page; the route re-exports it. The hub origin and
+// this project's client id, which is its slug; null on a self-hosted instance or the hub itself, so the
+// hall shows no section rather than a dead link. The page resolves ?project=<slug>
+// against the visitor's OWN projects, so the link opens nothing for anyone else.
+function hubManageLinks(config) {
+  if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
+  if (!/^https?:\/\/[^\s"'<>]+$/i.test(config.origin)) return null;
+  const origin = config.origin.replace(/\/+$/, '');
+  const page = `${origin}/projects?view=manage&project=${encodeURIComponent(String(config.clientId))}`;
+  let host = origin;
+  try { host = new URL(origin).host; } catch { /* keep the origin as written */ }
+  return { hub_host: host, manage_url: page, offline_url: `${page}#mDelete`, disconnect_url: `${page}#mDisconnect` };
+}
+
+// readAppStatusFromHub() — where THIS project's own app runs, asked of the hub (task
+// 1004571). We host every project's hall; its app runs on the owner's Render account, and
+// that setup's state lives in the hub's provisioning row, not here. So the hall asks, as
+// the project itself (client_id + client_secret, POST /sso/app-status), and the hub answers
+// with modules/provisioning/app-status.js's own shape for this project only.
+//
+// In the kernel beside the other hub calls for readApplicantProfileFromHub's reason: it
+// holds the project's hub client secret, and a module reaches it only through this narrow
+// port — no argument, one project, one direction in.
+//
+// Answers, never throws:
+//   { hub: false }                              — not federated (self-hosted, or the hub)
+//   { hub: true, reachable: false, manage }     — the hub did not answer (down, older hub)
+//   { hub: true, reachable: true, known, app, sandbox, manage }
+// `manage` is the hub's page for this project ({ manage_url, hub_host }, hubManageLinks
+// above), where the owner connects Render; it names an address and grants nothing.
+
+const HUB_APP_STATUS_TIMEOUT_MS = 5000;
+
+async function readAppStatusFromHub() {
+  let idp = null;
+  try { idp = loadIdpConfig(); } catch { idp = null; }
+  if (!idp) return { hub: false };
+  const links = hubManageLinks(idp);
+  const manage = links ? { manage_url: links.manage_url, hub_host: links.hub_host } : null;
+  try {
+    const r = await fetch(`${idp.origin}/api/bongos/sso/app-status`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': userAgent() },
+      signal: AbortSignal.timeout(HUB_APP_STATUS_TIMEOUT_MS),
+      body: JSON.stringify({ client_id: idp.clientId, client_secret: idp.clientSecret }),
+    });
+    const body = r.ok ? await r.json().catch(() => null) : null;
+    if (!body || body.ok !== true) return { hub: true, reachable: false, manage };
+    const app = body.app && typeof body.app === 'object' ? body.app : null;
+    // The sandbox beside the app (task 1005289); an older hub sends none.
+    const sandbox = body.sandbox && typeof body.sandbox === 'object' ? body.sandbox : null;
+    return { hub: true, reachable: true, known: body.known === true, app, sandbox, manage };
+  } catch (err) {
+    log.info('[auth] hub app-status read failed (non-blocking):', err.message);
+    return { hub: true, reachable: false, manage };
+  }
+}
+
 module.exports = {
   firstAdminLogin,
+  readAppStatusFromHub,
+  hubManageLinks,
   firstTimeAdmissionBlocked,
   instanceNeedsFirstAdmin,
   readApplicantProfileFromHub,

package/src/bongos/auth.js

@@ -57,7 +57,7 @@ const ic = require('../instance-config');
 const { branding, userAgent } = require('../branding');
 
 const { SCOPE, authConfigured, grantedScopeCoversRepos, idpConfigured, idpEnabled, loadIdpConfig, scopeForWebFlow } = require('./auth-config.js');
-const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readApplicantProfileFromHub, readApplicantViewFromHub, webAdmissionStatus } = require('./auth-admission.js');
+const { firstAdminLogin, firstTimeAdmissionBlocked, instanceNeedsFirstAdmin, joinabilityMode, maybeSeatFirstAdmin, membershipKind, notifyHubOfInvite, openEnrollmentEnabled, readAppStatusFromHub, readApplicantProfileFromHub, readApplicantViewFromHub, webAdmissionStatus } = require('./auth-admission.js');
 const { buildAuthorizeUrl, completeWebFlow, pollDeviceFlow, startDeviceFlow } = require('./auth-github.js');
 const { buildIdpAuthorizeUrl, completeDeviceExchange, completeIdpFlow, idpAuthorizeUrl, loadHubPublicKey, logoutTokenJtiSeenAndRecord, readApplicationVouch, verifyHubAssertion, verifyHubLogoutToken } = require('./auth-idp.js');
 const { addDiscordGuildMember, buildDiscordAuthorizeUrl, discordAuthorizeUrl, discordBotConfigured, discordConfigured, exchangeDiscordCode, fetchDiscordUser, isValidDiscordUserId, loadDiscordBotToken, loadDiscordCreds, removeDiscordGuildMember } = require('./auth-discord.js');
@@ -843,6 +843,7 @@ module.exports = {
   joinabilityMode,
   readApplicantProfileFromHub,
   readApplicantViewFromHub,
+  readAppStatusFromHub,
   notifyHubOfInvite,
   readApplicationVouch,
   firstTimeAdmissionBlocked,

package/src/bongos/module-scope-map.js

@@ -193,6 +193,10 @@ const MODULE_GLOBS = {
     'tests/front_door_guide_plan.mjs', 'tests/front_door_guide_db.mjs',
     'tests/front_door_guide_existing.mjs',
   ],
+  // Where the app runs (task 1004571): the options menu's panel on a project's hall.
+  'app-host': [
+    'modules/app-host/', 'tests/app_host.mjs',
+  ],
   // The /raise investor page (task 1004847, ADR 0384): hub-only.
   raise: [
     'modules/raise/',

package/src/bongos/routes/core-update.js

@@ -53,22 +53,9 @@ function hubDeployUrl(config) {
   return `${config.origin.replace(/\/+$/, '')}/deploy?project=${encodeURIComponent(String(config.clientId))}`;
 }
 
-// WHERE THIS PROJECT'S OWNER TAKES IT OFFLINE OR DISCONNECTS IT (task 1004570). Both
-// controls live on the hub's Projects page for this project — the typed-name confirm and
-// the intent queue are there (ADR 0290) — so the hall only links to them and gains no
-// second delete path. Same two inputs as hubDeployUrl (the hub origin and this project's
-// client id, which is its slug); null on a self-hosted instance or the hub itself, so the
-// hall shows no section rather than a dead link. The page resolves ?project=<slug>
-// against the visitor's OWN projects, so the link opens nothing for anyone else.
-function hubManageLinks(config) {
-  if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
-  if (!/^https?:\/\/[^\s"'<>]+$/i.test(config.origin)) return null;
-  const origin = config.origin.replace(/\/+$/, '');
-  const page = `${origin}/projects?view=manage&project=${encodeURIComponent(String(config.clientId))}`;
-  let host = origin;
-  try { host = new URL(origin).host; } catch { /* keep the origin as written */ }
-  return { hub_host: host, manage_url: page, offline_url: `${page}#mDelete`, disconnect_url: `${page}#mDisconnect` };
-}
+// hubManageLinks — the hub's page for THIS project (task 1004570). Lives in the kernel's
+// auth-admission.js since task 1004571, which needs it too and may not import a route file.
+const { hubManageLinks } = require('../auth-admission');
 
 // WHERE THIS PROJECT'S UPDATE BUTTON GOES (task 1004296). The act itself never happens in
 // Settings: it is the deploy door's two-step confirm and auto-rollback (ADR 0293), and that

package/src/bongos/routes/modules.js

@@ -232,9 +232,20 @@ function contributeModuleDesk() {
   seams.contribute('governor.docket', { desk: 'rules.modules', gate: { permission: 'module.enable' }, read: async () => moduleDeskRows(listModules()) });
 }
 
+// The port `modules.catalog` (task 1005281): every module on disk with its words and
+// whether it is on, so a module (the lifecycle's first read-through) can name only real
+// modules without requiring core. Read-only, built per call from listModules().
+function registerModuleCatalogPort() {
+  if (seams.hasProvider('modules.catalog')) return;
+  seams.registerProvider('modules.catalog', () => listModules().map((m) => ({
+    key: m.key, title: m.title || m.key, description: m.description || '', enabled: m.enabled === true,
+  })));
+}
+
 module.exports = function buildModulesRouter() {
   contributeModuleRechecksToDocket();
   contributeModuleDesk();
+  registerModuleCatalogPort();
   // Task 1004399: carry tarballs written inside the installed core package (the old
   // store path) into the instance store before the next upgrade erases them. Async and
   // never fatal; a no-op in a single checkout, where the two paths are one directory.

package/src/bongos/serve-internal.js

@@ -418,15 +418,18 @@ function clientBundleScriptTag() {
 // [{ key, src }]; default reads the live enabled set. Pure + exported for the test.
 function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled: isModuleEnabled }), consumer = 'builders') {
   if (!Array.isArray(scripts) || scripts.length === 0) return html;
-  const tags = scripts
-    .map((s) => `<script src="${s.src}" defer></script>`)
-    .join('');
   // Anchor on the consuming page script's <script> (builders.js on the index, task.js on
-  // a task's page — task 1004301) regardless of its ?v= stamp, so the module widgets
-  // always land immediately before the consumer: both are `defer`, so they run in
-  // document order, and a widget's listener exists before the page first announces.
+  // a task's page — task 1004301; settings.js on the options menu — task 1004571)
+  // regardless of its ?v= stamp, so the module widgets always land immediately before the
+  // consumer. A widget loads the way its consumer does: builders.js and task.js are
+  // `defer`, so their widgets are too and run in document order; settings.js is a plain
+  // script, so its widgets are plain too — a deferred one would run after it had mounted.
   const name = /^[a-z-]+$/.test(consumer) ? consumer : 'builders';
   const anchor = html.match(new RegExp(`<script src="\\/builders\\/${name}\\.js[^"]*"[^>]*><\\/script>`));
+  const defer = !anchor || /\sdefer[\s>=]/.test(anchor[0]);
+  const tags = scripts
+    .map((s) => `<script src="${s.src}"${defer ? ' defer' : ''}></script>`)
+    .join('');
   if (anchor) return html.replace(anchor[0], tags + anchor[0]);
   return html.includes('</body>') ? html.replace('</body>', `${tags}</body>`) : html + tags;
 }
@@ -1171,6 +1174,17 @@ function mountInternalSurfaces(app) {
     );
   }
 
+  // task 1004571: the options menu. A module that ships public/settings-widget.js
+  // registers a panel through window.OTB.contributeSettingsPanel; it is loaded just before
+  // settings.js, which mounts every registered panel. With none enabled, nothing changes.
+  if (buildersHtml['settings.html']) {
+    buildersHtml['settings.html'] = injectModuleHallWidgets(
+      buildersHtml['settings.html'],
+      hallWidgetScripts({ isEnabled: isModuleEnabled, file: 'settings-widget.js' }),
+      'settings',
+    );
+  }
+
   // Serve enabled modules' browser assets at /modules/<key>/public/* — the URL the
   // loader's hallWidgetScripts projection points at. Mounted BEFORE the /builders
   // static handler. Gated per-request on the live enabled set so a disabled module's

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.17'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.19'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');
@@ -409,6 +409,11 @@ module.exports = {
   //     1002304). The guild rides only beside a profile, so a null profile is a
   //     null view; an older hub that sends no guild answers guild: null.
   get readApplicantViewFromHub() { return require('./bongos/auth').readApplicantViewFromHub; },
+  // readAppStatusFromHub() — where THIS project's app runs, read from the hub with the
+  //     project's own client credentials (task 1004571). The same narrow-port posture: no
+  //     argument, so a module can neither widen nor re-address it, and the secret stays off
+  //     the doorway. Never throws: { hub: false } | { hub: true, reachable, known?, app?, manage }.
+  get readAppStatusFromHub() { return require('./bongos/auth').readAppStatusFromHub; },
   // notifyHubOfInvite(githubLogin, { invited }) — tell the hub about one of THIS
   //     project's invites (true) or its rescind (false), so the invitee sees it in
   //     My Projects (task 1002818, ADR 0353). The same narrow-port reason as the

package/src/module-loader/loader.js

@@ -221,12 +221,12 @@ function mountModuleRoutes(router, { isEnabled } = {}, opts) {
 //
 // ONE SEAM, ONE FILE PER PAGE (task 1004301). `file` names which page's widget is being
 // asked for: hall-widget.js for the hall index (the default, and the only caller until
-// then), task-widget.js for a task's own page. Same declaration (uiSections), same
+// then), task-widget.js for a task's own page, settings-widget.js for the options menu (1004571). Same declaration (uiSections), same
 // enabled-only asset mount, same "a disabled module simply is not there" — so a module
 // adds a line to the task page without the page's own code ever naming it. The name is
 // matched against PAGE_WIDGET_FILES rather than trusted, so no caller can turn this into
 // a way to serve an arbitrary file.
-const PAGE_WIDGET_FILES = Object.freeze(['hall-widget.js', 'task-widget.js']);
+const PAGE_WIDGET_FILES = Object.freeze(['hall-widget.js', 'task-widget.js', 'settings-widget.js']);
 function hallWidgetScripts({ isEnabled, file = 'hall-widget.js' } = {}, opts) {
   if (!PAGE_WIDGET_FILES.includes(file)) return [];
   const out = [];