@bongos/core 1.25.24 → 1.25.26

package/src/bongos/routes/auth.js

@@ -710,6 +710,7 @@ module.exports = function buildAuthRouter() {
     // ?switch=1 — sign in as a DIFFERENT GitHub account (task 1004789): show
     // GitHub's account picker instead of re-using the one logged in there.
     const wantsSwitch = req.query.switch === '1' || req.query.switch === 'true';
+    const wantsSignup = req.query.signup === '1' || req.query.signup === 'true'; // no GitHub account yet: its sign-up page (task 1005283)
     // A sign-in begun on a satellite hub host (builders./status.) restarts on
     // the canonical host (task 1004357). The handshake cookies are host-only now,
     // and the callback always lands on the canonical host, so a state cookie set
@@ -720,8 +721,7 @@ module.exports = function buildAuthRouter() {
       const raw = safeReturnTo(req.query.return) || safeReturnTo(req.headers.referer) || '/';
       const back = raw.startsWith('/') ? `https://${host}${raw}` : raw;
       const params = new URLSearchParams({ return: back });
-      if (wantsRepos) params.set('repos', '1');
-      if (wantsSwitch) params.set('switch', '1');
+      for (const [k, on] of [['repos', wantsRepos], ['switch', wantsSwitch], ['signup', wantsSignup]]) if (on) params.set(k, '1');
       if (req.query.via === 'github') params.set('via', 'github');
       return res.redirect(`${WEB_REDIRECT_ORIGIN.replace(/\/+$/, '')}${apiBase(req)}/auth/web/start?${params}`);
     }
@@ -729,7 +729,7 @@ module.exports = function buildAuthRouter() {
     // host (a builder who signed in on the apex, then opened builders.): no
     // GitHub round-trip, just hand that host its copy. A repo-scope sign-in
     // still goes to GitHub — it exists to ask for the broader grant.
-    if (!wantsRepos && !wantsSwitch) {
+    if (!wantsRepos && !wantsSwitch && !wantsSignup) {
       const target = safeReturnTo(req.query.return);
       if (target && !target.startsWith('/')) {
         try {
@@ -746,7 +746,7 @@ module.exports = function buildAuthRouter() {
     // lands on one chooser — Continue with GitHub or Continue with Google — so no
     // page needs its own pair of buttons. `via=github` is the GitHub button (and
     // any door that needs GitHub itself); "New account" names a GitHub account.
-    if (req.query.via !== 'github' && !wantsSwitch && googleConfigured()) {
+    if (req.query.via !== 'github' && !wantsSwitch && !wantsSignup && googleConfigured()) {
       const ret = safeReturnTo(req.query.return) || safeReturnTo(req.headers.referer);
       const gh = new URLSearchParams({ via: 'github' });
       if (ret) gh.set('return', ret);
@@ -803,9 +803,9 @@ module.exports = function buildAuthRouter() {
     // Federate through the hub when configured (ADR 0141 §1); otherwise the direct
     // GitHub authorize, carrying the repo-scope opt-in. Same CSRF state cookie either
     // way — the callback validates it identically, so the hub leg is CSRF-protected too.
-    res.redirect(auth.idpConfigured()
-      ? auth.buildIdpAuthorizeUrl(state, redirectUri)
-      : auth.buildAuthorizeUrl(state, redirectUri, { repos: wantsRepos, switchAccount: wantsSwitch }));
+    if (auth.idpConfigured()) return res.redirect(auth.buildIdpAuthorizeUrl(state, redirectUri));
+    const authorizeUrl = auth.buildAuthorizeUrl(state, redirectUri, { repos: wantsRepos, switchAccount: wantsSwitch });
+    res.redirect((wantsSignup && auth.githubSignupUrl(authorizeUrl)) || authorizeUrl);
   });
 
   // GET /auth/web/handoff?code=&return= — the far side of the one-time session

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.24'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.26'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/auth_switch_account.mjs

@@ -24,13 +24,9 @@ test('switchAccount adds prompt=select_account; a plain sign-in does not', () =>
   assert.equal(sw.searchParams.get('scope'), plain.searchParams.get('scope'));
 });
 
-test('the start route reads ?switch=1 and passes it to the GitHub leg', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/auth.js'), 'utf8');
-  assert.match(src, /const wantsSwitch = req\.query\.switch === '1'/);
-  assert.match(src, /switchAccount: wantsSwitch/);
-  // a switch must reach GitHub, never short-circuit through the live-session handoff
-  assert.match(src, /if \(!wantsRepos && !wantsSwitch\) \{/);
-});
+// The start route itself is now RUN, not read (task 1005283): tests/github_signup_handoff.mjs
+// calls GET /auth/web/start with ?switch=1 and asserts the redirect carries
+// prompt=select_account and goes to GitHub, never through the live-session handoff.
 
 test('the landing carries the New account door beside Sign in', () => {
   const html = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public/index.html'), 'utf8');

package/tests/github_signup_handoff.mjs

@@ -0,0 +1,135 @@
+// tests/github_signup_handoff.mjs — no GitHub account yet: GitHub's own sign-up page, with
+// "Continue with Google", and back to project creation (task 1005283).
+//
+// WHY. Bongos cannot make a GitHub account for anyone, and every project lives in a GitHub
+// repository. A person with only a Google account used to meet "Continue with GitHub" and
+// nothing else. GitHub's sign-up page offers "Continue with Google", and during an OAuth
+// sign-in GitHub's own screen links it with `return_to` = the authorize step, so the
+// sign-in resumes once the account exists (checked on GitHub's live pages, signed out,
+// 2026-11-13). `?signup=1` on our sign-in start opens THAT page directly.
+//
+// What this pins, by RUNNING the start route's handler (no network, no database):
+//   1. ?signup=1 redirects to https://github.com/signup with return_to = the same
+//      authorize step (same state cookie, same client, same repo scope, same callback);
+//   2. it skips the GitHub-or-Google chooser, which would offer a Bongos Google sign-in
+//      that cannot make a project;
+//   3. a plain sign-in still goes to the authorize step, and ?switch=1 still adds the
+//      account picker (converted here from tests/auth_switch_account.mjs's source read);
+//   4. githubSignupUrl hands on only github.com's own authorize path;
+//   5. the creation page's gate says why GitHub is needed and carries the door, whose
+//      link runs through the route above and returns to /projects?view=new.
+//
+// Run:  node --test tests/github_signup_handoff.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.BONGOS_GITHUB_CLIENT_ID = process.env.BONGOS_GITHUB_CLIENT_ID || 'gh-test-client';
+process.env.BONGOS_GITHUB_CLIENT_SECRET = process.env.BONGOS_GITHUB_CLIENT_SECRET || 'gh-test-secret';
+// Google sign-in on, so the chooser would show for a plain sign-in: the door must skip it
+process.env.BONGOS_GOOGLE_CLIENT_ID = 'google-test-client';
+process.env.BONGOS_GOOGLE_CLIENT_SECRET = 'google-test-secret';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+// "Continue with Google" is offered only when the hub that keeps Google sign-ins is present
+const seams = require(path.join(ROOT, 'src/module-seams.js'));
+if (!seams.hasProvider('platform-identity.hub')) {
+  seams.registerProvider('platform-identity.hub', { signInWithGoogle: async () => null, recordHubSignin: async () => {} });
+}
+const buildAuthRouter = require(path.join(ROOT, 'src/bongos/routes/auth.js'));
+const { githubSignupUrl } = require(path.join(ROOT, 'src/bongos/auth.js'));
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+
+function fakeRes() {
+  const res = {
+    _status: 200, _body: null, _redirect: null, _cookies: {},
+    status(c) { this._status = c; return this; },
+    type() { return this; },
+    send(b) { this._body = b; return this; },
+    json(b) { this._body = b; return this; },
+    set() { return this; },
+    redirect(a, b) { this._redirect = b === undefined ? a : b; return this; },
+    cookie(n, v, o) { this._cookies[n] = { v, o }; return this; },
+    clearCookie() { return this; },
+  };
+  attachFail({}, res, () => {});
+  return res;
+}
+const start = (() => {
+  const layer = buildAuthRouter().stack.find((l) => l.route?.path === '/auth/web/start' && l.route.methods.get);
+  assert.ok(layer, 'GET /auth/web/start exists');
+  return layer.route.stack.at(-1).handle;
+})();
+const req = (query) => ({ query, headers: { host: 'localhost' }, baseUrl: '/api/bongos', body: {} });
+async function run(query) { const res = fakeRes(); await start(req(query), res); return res; }
+
+test('?signup=1 opens GitHub’s sign-up page, which resumes this same sign-in', async () => {
+  const res = await run({ via: 'github', signup: '1', return: '/projects?view=new', repos: '1' });
+  assert.ok(res._redirect, 'a redirect, not the chooser page');
+  const signup = new URL(res._redirect);
+  assert.equal(signup.origin + signup.pathname, 'https://github.com/signup');
+  assert.equal(signup.searchParams.get('source'), 'oauth', 'the same marker GitHub’s own "Create an account" link carries');
+  const back = new URL(signup.searchParams.get('return_to'), 'https://github.com');
+  assert.equal(back.pathname, '/login/oauth/authorize', 'the way back is the authorize step');
+  assert.equal(back.searchParams.get('client_id'), process.env.BONGOS_GITHUB_CLIENT_ID);
+  const stateCookie = Object.values(res._cookies).find((c) => /^[0-9a-f]{32}$/.test(String(c.v)));
+  assert.ok(stateCookie, 'a state cookie is set');
+  assert.equal(back.searchParams.get('state'), stateCookie.v,
+    'the state GitHub hands back is the one in this browser’s cookie, so the callback accepts it');
+  assert.match(back.searchParams.get('scope'), /\brepo\b/, 'the repo access project creation needs is asked once, on the way back');
+  assert.match(back.searchParams.get('redirect_uri'), /\/auth\/web\/callback$/);
+  assert.ok(Object.values(res._cookies).some((c) => c.v === '/projects?view=new'), 'after the callback, the person lands on project creation');
+});
+
+test('the door skips the GitHub-or-Google chooser; a plain sign-in still shows it', async () => {
+  const signup = await run({ signup: '1', return: '/projects?view=new', repos: '1' });
+  assert.match(signup._redirect || '', /^https:\/\/github\.com\/signup\?/, 'no via=github needed: a GitHub sign-up is GitHub');
+  const plain = await run({ return: '/projects?view=new', repos: '1' });
+  assert.equal(plain._redirect, null);
+  assert.match(plain._body, /Continue with GitHub/);
+});
+
+test('without ?signup a sign-in goes to the authorize step, and ?switch=1 still adds the account picker', async () => {
+  const plain = await run({ via: 'github', return: '/projects?view=new', repos: '1' });
+  const p = new URL(plain._redirect);
+  assert.equal(p.origin + p.pathname, 'https://github.com/login/oauth/authorize');
+  assert.equal(p.searchParams.get('prompt'), null);
+  const sw = await run({ switch: '1', return: '/' });
+  const s = new URL(sw._redirect);
+  assert.equal(s.pathname, '/login/oauth/authorize');
+  assert.equal(s.searchParams.get('prompt'), 'select_account', 'a switch reaches GitHub, never the live-session handoff');
+});
+
+test('githubSignupUrl hands on only github.com’s own authorize path', () => {
+  const ok = githubSignupUrl('https://github.com/login/oauth/authorize?client_id=c&state=s&scope=repo');
+  assert.equal(new URL(ok).searchParams.get('return_to'), '/login/oauth/authorize?client_id=c&state=s&scope=repo');
+  for (const bad of [
+    'https://evil.example/login/oauth/authorize?state=s',
+    'http://github.com/login/oauth/authorize?state=s',
+    'https://github.com/settings/tokens',
+    'https://github.com.evil.example/login/oauth/authorize',
+    'not a url',
+    null,
+  ]) assert.equal(githubSignupUrl(bad), null, String(bad));
+});
+
+test('the creation page says why GitHub is needed and offers the door, returning to creation', () => {
+  const hub = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public/projects.html'), 'utf8').replace(/\r\n/g, '\n');
+  const gate = (hub.match(/<section class="panel" id="panel-gate"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(gate, 'the gate is findable');
+  assert.match(gate, /<p class="finePrint" id="wizWhyGh">Your project’s files live in a GitHub repository, so it needs a GitHub account\.<\/p>/);
+  const door = gate.match(/<a id="wizSignup" href="([^"]+)">Make one free with Google<\/a>/);
+  assert.ok(door, 'the door sits on the gate');
+  assert.ok(gate.indexOf('id="wizSignin"') < gate.indexOf('id="wizSignup"'), 'under Continue with GitHub, not instead of it');
+  const href = new URL(door[1].replace(/&amp;/g, '&'), 'https://hub.example');
+  assert.equal(href.pathname, '/api/bongos/auth/web/start');
+  assert.equal(href.searchParams.get('signup'), '1');
+  assert.equal(href.searchParams.get('repos'), '1', 'the same repo access the GitHub button asks for');
+  assert.equal(href.searchParams.get('return'), '/projects?view=new');
+  assert.match(gate, /choose <strong>Continue with Google<\/strong>, and you come straight back here/);
+});

package/tests/hall_visor.mjs

@@ -236,7 +236,7 @@ test('source: the minimal visor spends the Helm tokens and types in no colour, s
   assert.ok(phone, 'the phone rules sit in the shared phone block');
   assert.match(phone[0], /\.visor__hint:not\(\[data-visor-sheet\]\) \{ display: none; \}/, 'a phone keeps only Actions of the hints');
   assert.doesNotMatch(read('home-city.css'), /visor-on/, 'Home has no top-right pill to clear any more');
-  assert.match(read('city.css'), /\nhtml\.visor-on \.city-door \{ bottom: 224px; \}/, 'the city\'s door clears the centred button at every width');
+  assert.match(read('city.css'), /\nhtml\.visor-on \.city-door \{ bottom: calc\(180px - var\(--visor-drop, 0px\)\); \}/, 'the city\'s door clears the centred button at every width (task 1005266: the row dropped, except on a phone)');
 });
 
 // ---------- in a browser: the glass over a stand-in scene ----------
@@ -554,3 +554,102 @@ test('the glass is the kit\'s: the cut accent button, ice hints with no box, the
   assert.match(f.ring, /inset/, 'focus is the inset two-tone ring (--press-focus)');
   await ctx.close();
 });
+
+// ---------- task 1005266: the glass rests while you look and wakes slim when you act ----------
+test('the top arc cuts into pieces of the same curve (task 1005266)', () => {
+  const V = loadPure();
+  assert.equal(V.arcPiece(0, 1), 'M76 100Q500 -100 924 100', 'the whole of it is the arc itself');
+  const end = (d) => d.split(' ').slice(-2).join(' '), start = (d) => d.slice(1, d.indexOf('Q'));
+  assert.equal(end(V.arcPiece(0, 0.5)), start(V.arcPiece(0.5, 1)), 'two halves meet');
+  assert.equal(start(V.arcPiece(0.5, 1)), '500 0', 'at the top of the arc');
+});
+
+test('the glass rests when you leave it alone and wakes when you reach for it (task 1005266)', { skip }, async () => {
+  const { ctx, page, errors } = await open({ helm: true });
+  const look = () => page.evaluate(() => {
+    const op = (s) => getComputedStyle(document.querySelector(s)).opacity;
+    return { resting: OTBVisor.resting(), main: op('.visor__main'), hints: op('.visor__hints'), who: op('.visor__who'), place: op('.visor__top'), sprite: op('.visor__sprite'), sight: op('.visor__sight') };
+  });
+  assert.equal((await look()).resting, false, 'arriving at a place shows the whole glass');
+  await page.mouse.move(640, 300);
+  await page.waitForFunction(() => OTBVisor.resting(), null, { timeout: 8000 });
+  await page.waitForTimeout(400);
+  assert.deepEqual(await look(), { resting: true, main: '0', hints: '0', who: '0', place: '0', sprite: '1', sight: '1' }, 'at rest only the frame and your picture are drawn');
+  await page.mouse.move(640, 790);
+  await page.waitForTimeout(400);
+  assert.deepEqual(await look(), { resting: false, main: '1', hints: '1', who: '1', place: '1', sprite: '1', sight: '1' }, 'the pointer near the bottom of the view wakes it');
+  await page.mouse.move(640, 300);
+  await page.mouse.down();
+  assert.equal((await look()).resting, true, 'a press on the scene rests it at once');
+  await page.mouse.move(700, 790, { steps: 3 });
+  assert.equal((await look()).resting, true, 'a drag that passes the bottom of the view is looking, not reaching');
+  await page.mouse.up();
+  // a visor key wakes it, and the open sheet holds it awake
+  await page.mouse.move(640, 300);
+  await page.keyboard.press('a');
+  assert.deepEqual(await page.evaluate(() => [OTBVisor.isOpen(), OTBVisor.resting()]), [true, false], 'A opens the sheet on a waking glass');
+  await page.mouse.click(300, 300);
+  assert.equal((await look()).resting, false, 'the sheet holds the glass awake');
+  await page.keyboard.press('Escape');
+  assert.equal(await page.evaluate(() => document.activeElement.matches('[data-visor-sheet]')), true, 'the keyboard is back on Actions, which also holds it');
+  await page.mouse.click(300, 300);
+  assert.deepEqual(await page.evaluate(() => [OTBVisor.resting(), document.activeElement === document.body]), [true, true], 'going back to the scene rests it and hands the keyboard back');
+  // a control you cannot see is never pressed by accident: the first press only wakes
+  await page.evaluate(() => document.querySelector('[data-visor-sheet]').click());
+  assert.deepEqual(await page.evaluate(() => [OTBVisor.isOpen(), OTBVisor.resting()]), [false, false]);
+  assert.deepEqual(errors, []);
+  await ctx.close();
+});
+
+test('a key hint is its key, and pointing at it names it above the row without moving another (task 1005266)', { skip }, async () => {
+  const { ctx, page, errors } = await open({ helm: true });
+  const boxes = () => page.evaluate(() => [...document.querySelectorAll('.visor__hint')].map((h) => Math.round(h.getBoundingClientRect().left)));
+  const before = await boxes();
+  await page.hover('[data-visor-act="thinking"]');
+  assert.equal(await page.evaluate(() => document.querySelector('.visor__hints').getAttribute('data-name')), 'Your thinking');
+  assert.deepEqual(await boxes(), before, 'naming a key moves no key');
+  assert.equal(await page.textContent('[data-visor-act="thinking"]'), 'TYour thinking', 'the name is still in the page for a screen reader');
+  await page.mouse.move(640, 300);
+  assert.equal(await page.evaluate(() => document.querySelector('.visor__hints').hasAttribute('data-name')), false);
+  assert.deepEqual(errors, []);
+  await ctx.close();
+});
+
+test('the top arc is the version\'s progress while awake, and one plain arc at rest (task 1005266)', { skip }, async () => {
+  const { ctx, page, errors } = await open({ helm: true });
+  await ctx.route(ORIGIN + '/api/bongos/versions/progress', (r) => r.fulfill({ contentType: 'application/json', body: JSON.stringify({ progress: [{ version_id: 'BONGOS-V2', name: 'The ten working areas', status: 'building', percent_complete: 89 }] }) }));
+  await ctx.route(ORIGIN + '/api/bongos/versions/focus', (r) => r.fulfill({ contentType: 'application/json', body: JSON.stringify({ focus_version_id: 'BONGOS-V2' }) }));
+  await page.reload();
+  await page.waitForSelector('.visor__frame--segs');
+  const read = () => page.evaluate(() => {
+    const shown = (e) => getComputedStyle(e).display !== 'none';
+    return {
+      segs: [...document.querySelectorAll('.visor__seg:not(.visor__line--under)')].map((p) => (/visor__seg--(\w+)/.exec(p.getAttribute('class')) || [])[1]),
+      segsShown: [...document.querySelectorAll('.visor__seg')].every(shown),
+      arcShown: [...document.querySelectorAll('.visor__arc')].every(shown),
+      words: document.querySelector('.visor__progress-words [aria-hidden]').textContent,
+      said: document.querySelector('.visor__progress-words .sr-only').textContent,
+      bars: document.querySelectorAll('.visor .segs').length,
+      line: [...document.querySelectorAll('.visor__top > *')].map((e) => Math.round(e.getBoundingClientRect().top)),
+    };
+  });
+  const awake = await read();
+  assert.deepEqual(awake.segs, ['done', 'done', 'done', 'now'], 'four quarters: three built, the fourth being built');
+  assert.deepEqual([awake.segsShown, awake.arcShown], [true, false], 'awake, the pieces stand in for the plain arc');
+  assert.deepEqual([awake.words, awake.said, awake.bars], ['BONGOS-V2 · 89%', 'BONGOS-V2, The ten working areas: 89% built', 0], 'the reading is still said in words; the separate row of bars is gone');
+  assert.equal(awake.line.length, 2);
+  assert.ok(Math.abs(awake.line[0] - awake.line[1]) <= 2, 'the place and the reading share one line');
+  await page.mouse.move(640, 300);
+  await page.mouse.down(); await page.mouse.up();
+  const rest = await read();
+  assert.deepEqual([rest.segsShown, rest.arcShown], [false, true], 'at rest it is the one plain arc');
+  assert.deepEqual(errors, []);
+  await ctx.close();
+});
+
+test('a phone keeps the whole glass: there is no pointer to reach with (task 1005266)', { skip }, async () => {
+  const { ctx, page } = await open({ helm: true, width: 390, height: 844 });
+  await page.evaluate(() => OTBVisor.rest());
+  assert.deepEqual(await page.evaluate(() => [OTBVisor.resting(), document.getElementById('visor').classList.contains('visor--rest'), getComputedStyle(document.querySelector('.visor__main')).opacity]), [false, false, '1']);
+  await ctx.close();
+});