@bongos/core 1.17.0 → 1.17.2

package/tests/first_run_engine_check.mjs

@@ -0,0 +1,79 @@
+// tests/first_run_engine_check.mjs
+//
+// The SessionStart first-run engine check (task 2105): a freshly-cloned standalone
+// instance that hasn't run `npm install` has no `bongos`/tools, so a session used
+// to improvise against the wrong instance (the 2026-07-08 demo-session failure).
+// firstRunEngineCheck() detects that state and prints the two first-run commands.
+// It reads package.json + config/branding.json directly (never requires the missing
+// core), is inert on a source/monorepo checkout and once installed, and is injectable
+// (projectDir + log) so it unit-tests standalone. Run: node tests/first_run_engine_check.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { firstRunEngineCheck } = require('../.claude/hooks/session-start.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL ${name}\n     ${e.message}`); }
+}
+
+// Build a temp instance dir; deps + whether node_modules/<dep> exists + branding are configurable.
+function mkInstance({ dep, installed = false, branding } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), 'fre-'));
+  writeFileSync(join(dir, 'package.json'), JSON.stringify({ name: 'x', dependencies: dep ? { [dep]: 'file:vendor/x.tgz' } : { express: '^4' } }));
+  if (installed && dep) mkdirSync(join(dir, 'node_modules', dep), { recursive: true });
+  if (branding) { mkdirSync(join(dir, 'config'), { recursive: true }); writeFileSync(join(dir, 'config', 'branding.json'), JSON.stringify(branding)); }
+  return dir;
+}
+const run = (dir) => { const lines = []; const fired = firstRunEngineCheck(dir, { log: (s) => lines.push(s) }); return { fired, out: lines.join('\n') }; };
+
+t('consumer instance, engine NOT installed → prints the two first-run commands + the login origin', () => {
+  const dir = mkInstance({ dep: '@cloudbongos/core', installed: false, branding: { envPrefix: 'CLOUDBONGOS', domains: { publicOrigin: 'https://demo.cloudbongos.com' } } });
+  const { fired, out } = run(dir);
+  assert.equal(fired, true);
+  assert.ok(out.includes("engine isn't installed"), 'names the problem');
+  assert.ok(out.includes('npm install'), 'step 1');
+  assert.ok(out.includes('npx bongos login https://demo.cloudbongos.com'), 'step 2 with the instance origin');
+  assert.ok(out.includes('[cloudbongos]'), 'tag from branding envPrefix');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('source / monorepo checkout (no core dependency) → INERT (no output)', () => {
+  const dir = mkInstance({ dep: null });
+  const { fired, out } = run(dir);
+  assert.equal(fired, false);
+  assert.equal(out, '');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('consumer instance, engine INSTALLED → INERT (nothing to say)', () => {
+  const dir = mkInstance({ dep: '@cloudbongos/core', installed: true, branding: { domains: { publicOrigin: 'https://demo.cloudbongos.com' } } });
+  const { fired } = run(dir);
+  assert.equal(fired, false);
+  rmSync(dir, { recursive: true, force: true });
+});
+
+t('accepts the @bongos/core and cloudbongos dependency names too', () => {
+  for (const dep of ['@bongos/core', 'cloudbongos']) {
+    const dir = mkInstance({ dep, installed: false, branding: { domains: { publicOrigin: 'https://x.example.com' } } });
+    assert.equal(run(dir).fired, true, `${dep} recognized as the core dep`);
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+t('missing config/branding.json → still fires, with a placeholder login target (never crashes)', () => {
+  const dir = mkInstance({ dep: '@cloudbongos/core', installed: false });
+  const { fired, out } = run(dir);
+  assert.equal(fired, true);
+  assert.ok(out.includes('npx bongos login <this-instance-url>'), 'placeholder when origin unknown');
+  rmSync(dir, { recursive: true, force: true });
+});
+
+console.log(`\nfirst-run engine check (task 2105): ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/goal_membership_requests.mjs

@@ -40,6 +40,7 @@ const {
   authorizeCreateJoinRequest,
   authorizeInvitationResponse,
   authorizeJoinRequestResponse,
+  authorizeWithdrawJoinRequest,
 } = require('../modules/lifecycle/routes/goals.js');
 const { MODULE_EXPECTED_RANKS } = require('../src/bongos/route-rank-check.js');
 
@@ -310,12 +311,39 @@ await test('authorizeJoinRequestResponse: an Archon (non-member) resolves → AL
   assert.deepEqual(authorizeJoinRequestResponse({ goal: OWNER_GOAL, actorId: 42, actorRank: 'archon', actorMembership: null, request: REQUEST, goalId: 5 }), { ok: true });
 });
 
+// authorizeWithdrawJoinRequest — only the requester withdraws their own pending
+// join-request (task 1953), a symmetric mirror of authorizeInvitationResponse.
+const REQUEST_FOR_WITHDRAW = { id: 11, goal_id: '5', builder_id: '2', kind: 'request', status: 'pending' };
+await test('authorizeWithdrawJoinRequest: unknown request → 404', () => {
+  const d = authorizeWithdrawJoinRequest({ request: null, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 404); assert.equal(d.body.error, 'request_not_found');
+});
+await test('authorizeWithdrawJoinRequest: request on a different goal → 404 (containment)', () => {
+  const d = authorizeWithdrawJoinRequest({ request: { ...REQUEST_FOR_WITHDRAW, goal_id: '99' }, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 404);
+});
+await test('authorizeWithdrawJoinRequest: row is an invitation, not a request → 400', () => {
+  const d = authorizeWithdrawJoinRequest({ request: { ...REQUEST_FOR_WITHDRAW, kind: 'invite' }, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 400); assert.equal(d.body.error, 'not_a_join_request');
+});
+await test('authorizeWithdrawJoinRequest: already resolved → 409 not_pending', () => {
+  const d = authorizeWithdrawJoinRequest({ request: { ...REQUEST_FOR_WITHDRAW, status: 'accepted' }, goalId: 5, actorId: 2 });
+  assert.equal(d.status, 409); assert.equal(d.body.error, 'not_pending');
+});
+await test('authorizeWithdrawJoinRequest: someone else withdrawing my request → 403 not_your_request', () => {
+  const d = authorizeWithdrawJoinRequest({ request: REQUEST_FOR_WITHDRAW, goalId: 5, actorId: 7 });
+  assert.equal(d.status, 403); assert.equal(d.body.error, 'not_your_request');
+});
+await test('authorizeWithdrawJoinRequest: the requester (string vs number id) → ALLOW', () => {
+  assert.deepEqual(authorizeWithdrawJoinRequest({ request: REQUEST_FOR_WITHDRAW, goalId: '5', actorId: 2 }), { ok: true });
+});
+
 // =========================================================================
-// route-rank pins (task 1952) — the walls are in-handler, so the routes stay
-// 'any-builder'; an accidental requireRank re-gate must be a red build.
+// route-rank pins (task 1952/1953) — the walls are in-handler, so the routes
+// stay 'any-builder'; an accidental requireRank re-gate must be a red build.
 // =========================================================================
 
-await test('route-rank pins: the six new routes are pinned any-builder', () => {
+await test('route-rank pins: the eight private-goal routes are pinned any-builder', () => {
   const pins = MODULE_EXPECTED_RANKS.lifecycle;
   for (const r of [
     'GET /goals/inbox',
@@ -324,6 +352,8 @@ await test('route-rank pins: the six new routes are pinned any-builder', () => {
     'POST /goals/:id/requests/:reqId/respond',
     'POST /goals/:id/invitations',
     'POST /goals/:id/invitations/:reqId/respond',
+    'GET /goals/:id/requests',
+    'POST /goals/:id/requests/:reqId/withdraw',
   ]) {
     assert.equal(pins[r], 'any-builder', `${r} must be pinned any-builder (wall is in-handler)`);
   }

package/tests/hook_core_resolve.mjs

@@ -0,0 +1,125 @@
+// tests/hook_core_resolve.mjs
+//
+// Task 2139 — the materialized .claude/hooks resolve CORE modules (src/bongos/*,
+// scripts/gds/*) in BOTH layouts: the repo root today, and the pinned @bongos/core
+// package post-split (ADR 0108). Before this, conductor.js's UNGUARDED
+// require('../../src/bongos/…') MODULE_NOT_FOUND'd on EVERY UserPromptSubmit once
+// src/ left the instance root; the guarded hooks silently killed their feature.
+//
+// _core-resolve.coreModulePathFrom(instanceRoot, rel) is the whole mechanism, so
+// it takes the root as an argument and this suite diverges it against synthetic
+// trees (impossible to prove with the real single checkout, where root == core).
+// Locks:
+//   1. finds a core file inside node_modules/@bongos/core when it is NOT at the
+//      repo root — the post-split consumer layout, the point of the task;
+//   2. repo root WINS when the file exists in both (today = byte-identical);
+//   3. absent in every layout → null (fresh clone → callers degrade, never crash);
+//   4. all three published core package names resolve;
+//   5. requireCore loads a real core module today + throws a tagged error when absent;
+//   6. conductor.js, loaded in a core-LESS instance root, does NOT crash and still
+//      emits its methodology nudges (the "conductor no longer hard-crashes" done-when).
+//
+// DB-free + no network → part of the unit gate. Run:  node tests/hook_core_resolve.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, mkdirSync, cpSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const resolver = require('../.claude/hooks/_core-resolve.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// Build a throwaway instance root from { relPath: contents }.
+function makeTree(files) {
+  const root = mkdtempSync(join(tmpdir(), 'hook-core-'));
+  for (const [rel, body] of Object.entries(files)) {
+    const abs = join(root, rel);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, body);
+  }
+  return root;
+}
+
+// 1. Post-split: the core file exists ONLY inside the installed package.
+t('resolves a core module inside node_modules/@bongos/core (post-split layout)', () => {
+  const root = makeTree({ 'node_modules/@bongos/core/src/bongos/path-match.js': 'module.exports={};' });
+  const p = resolver.coreModulePathFrom(root, 'src/bongos/path-match');
+  assert.ok(p, 'expected a resolution');
+  assert.ok(p.includes(join('node_modules', '@bongos', 'core')), `expected a node_modules path, got ${p}`);
+});
+
+// 2. Priority: repo root wins when present in both (today's single checkout — unchanged).
+t('prefers the repo root when a core file exists at both root and node_modules', () => {
+  const root = makeTree({
+    'scripts/gds/cli-lib.js': 'module.exports={root:true};',
+    'node_modules/@bongos/core/scripts/gds/cli-lib.js': 'module.exports={pkg:true};',
+  });
+  const p = resolver.coreModulePathFrom(root, 'scripts/gds/cli-lib');
+  assert.ok(p && !p.includes('node_modules'), `expected the root copy, got ${p}`);
+});
+
+// 3. Absent everywhere → null (fresh clone pre-`npm install`; callers degrade).
+t('returns null when the core file exists in no layout', () => {
+  const root = makeTree({ 'README.md': '# empty instance' });
+  assert.equal(resolver.coreModulePathFrom(root, 'src/bongos/path-match'), null);
+});
+
+// 4. Every published core package name is honored (scoped-private, scoped-public, bare).
+for (const pkg of resolver.CORE_PKG_NAMES) {
+  t(`resolves via published package name "${pkg}"`, () => {
+    const root = makeTree({ [`node_modules/${pkg}/scripts/gds/x.js`]: 'module.exports={};' });
+    const p = resolver.coreModulePathFrom(root, 'scripts/gds/x.js');
+    const frag = join('node_modules', ...pkg.split('/'));
+    assert.ok(p && p.includes(frag), `expected "${frag}" in ${p}`);
+  });
+}
+
+// 5. requireCore: loads a real core module at the repo root today; throws tagged when absent.
+t('requireCore loads a real core module at the repo root today', () => {
+  const cli = resolver.requireCore('scripts/gds/cli-lib');
+  assert.equal(typeof cli.apiCall, 'function', 'expected cli-lib.apiCall');
+});
+t('requireCore throws CORE_MODULE_NOT_FOUND when the core module is absent', () => {
+  assert.throws(
+    () => resolver.requireCore('src/bongos/__does_not_exist_2139__'),
+    (e) => e && e.code === 'CORE_MODULE_NOT_FOUND',
+  );
+});
+
+// 6. The headline done-when: conductor.js in a core-LESS instance root does not crash
+//    and still emits methodology nudges (the sensitive-surface advisory degrades off).
+//    Runs in a child process with CLAUDE_PROJECT_DIR pointed at the core-less root so
+//    _core-resolve computes that root (this process's env points at the real repo).
+t('conductor.js in a core-less instance root does not crash and still nudges', () => {
+  const root = mkdtempSync(join(tmpdir(), 'hook-coreless-'));
+  const hooks = join(root, '.claude', 'hooks');
+  mkdirSync(hooks, { recursive: true });
+  cpSync(join(ROOT, '.claude', 'hooks', 'conductor.js'), join(hooks, 'conductor.js'));
+  cpSync(join(ROOT, '.claude', 'hooks', '_core-resolve.js'), join(hooks, '_core-resolve.js'));
+  const snippet =
+    `const c = require(${JSON.stringify(join(hooks, 'conductor.js'))});` +
+    `const out = c.evaluateTriggers({ changedFiles: ['src/bongos/sensitive-surfaces.js'], prompt: 'ship it', activeClaims: [] });` +
+    `process.stdout.write(JSON.stringify(out.map((a) => a.id)));`;
+  const stdout = execFileSync(process.execPath, ['-e', snippet], {
+    encoding: 'utf8',
+    env: { ...process.env, CLAUDE_PROJECT_DIR: root },
+  });
+  const ids = JSON.parse(stdout);
+  assert.ok(ids.includes('no-claim'), 'still emits the no-claim methodology nudge without the core');
+  assert.ok(ids.includes('ship-intent'), 'still emits the ship-intent nudge without the core');
+  assert.ok(!ids.includes('sensitive-surface'), 'sensitive-surface degrades off (isSensitive fallback) when the core is absent');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/hook_user_agents.mjs

@@ -0,0 +1,62 @@
+// tests/hook_user_agents.mjs
+//
+// task 2122 (demo-audit fix B) — the scaffolded .claude/hooks must NOT hardcode a
+// founder-instance brand in their outbound HTTP User-Agent. Those hooks are copied
+// into a consumer instance by claude-materialize, whose rebrand maps domain HOSTS
+// (amazonprimea.com), config dirs, and env prefixes — but NOT a bare brand token
+// like `amazonprimea-gds-cli` (no TLD). So a branded UA there leaks the founder's
+// host-brand into every scaffolded instance (criterion gcarry-prod-vanilla).
+//
+// Invariant: every `'User-Agent': '<value>'` literal in .claude/hooks/*.js uses the
+// platform-neutral `cloud-bongos-` prefix (matching src/branding.js userAgent()'s
+// neutral fallback), never an instance brand. Hermetic: reads files only, no DB/net.
+//
+// Run:  node tests/hook_user_agents.mjs
+
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const HOOKS_DIR = path.join(HERE, '..', '.claude', 'hooks');
+
+// Every User-Agent request-header literal, single- or double-quoted.
+const UA_RE = /['"]User-Agent['"]\s*:\s*['"]([^'"]+)['"]/g;
+const NEUTRAL_PREFIX = 'cloud-bongos-';
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const hookFiles = fs.existsSync(HOOKS_DIR)
+  ? fs.readdirSync(HOOKS_DIR).filter((f) => f.endsWith('.js')).sort()
+  : [];
+
+t('.claude/hooks exists and has hook files to check', () => {
+  assert.ok(hookFiles.length > 0, `no hook .js files found under ${HOOKS_DIR}`);
+});
+
+t('every hook User-Agent uses the neutral cloud-bongos- prefix (no founder-brand leak)', () => {
+  const offenders = [];
+  let uaCount = 0;
+  for (const f of hookFiles) {
+    const src = fs.readFileSync(path.join(HOOKS_DIR, f), 'utf8');
+    for (const m of src.matchAll(UA_RE)) {
+      uaCount++;
+      const ua = m[1];
+      if (!ua.startsWith(NEUTRAL_PREFIX)) offenders.push(`${f}: '${ua}'`);
+    }
+  }
+  assert.ok(uaCount > 0, 'expected at least one User-Agent literal across the hooks (regex drift?)');
+  assert.equal(
+    offenders.length, 0,
+    `hook User-Agent(s) not neutral (must start with "${NEUTRAL_PREFIX}"):\n  ${offenders.join('\n  ')}`
+  );
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/infra_exec_paths.mjs

@@ -0,0 +1,104 @@
+// tests/infra_exec_paths.mjs — task 2137 (ADR 0108 configurable-root).
+//
+// Two proofs that the host systemd units resolve their CORE scripts in a consumer layout after the
+// R89 split:
+//   A. lint-infra-exec: every infra/*.service ExecStart that runs a core script goes through
+//      infra/core-node.sh AND names a PUBLISHABLE core file (ships in @bongos/core → present at
+//      node_modules/@bongos/core post-install) that also exists at the core root today. No unit
+//      still uses the bare repo-relative `node scripts/…` form.
+//   B. core-node.sh actually resolves both layouts: it prefers the instance root (monolith) and
+//      falls back to node_modules/@bongos/core (consumer), driven by $BONGOS_INSTANCE_ROOT.
+//
+// DB-free, no network. Run: node tests/infra_exec_paths.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const { lintInfraExec } = require('../scripts/gds/lint-infra-exec.js');
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO = path.resolve(__dirname, '..');
+const LAUNCHER = path.join(REPO, 'infra', 'core-node.sh');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); console.log(`  ok  ${name}`); passed++; }
+  catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
+}
+
+// ---- A. the lint is green on the real tree, and covers all 11 core-script units ----------------
+test('lint-infra-exec: every core-script unit resolves in a consumer layout (publishable + present)', () => {
+  const r = lintInfraExec({ instanceRoot: REPO, coreRoot: REPO });
+  assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations)}`);
+  assert.ok(r.ok, 'lint should pass');
+  assert.equal(r.checked.length, 11, `expected all 11 core-script units repointed + resolving, got ${r.checked.length}`);
+  // The three core CLIs the units invoke are all covered.
+  const rels = new Set(r.checked.map((c) => c.rel));
+  for (const rel of ['scripts/gds/box.js', 'scripts/gds/provision.js', 'scripts/gds/search-ingest-db.js']) {
+    assert.ok(rels.has(rel), `expected a unit routing through ${rel}`);
+  }
+});
+
+test('lint-infra-exec: a bare repo-relative core ExecStart is flagged (counterfactual)', () => {
+  // Synthetic infra/ with the OLD form → must be reported as a violation.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'infra-lint-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'infra'), { recursive: true });
+    fs.mkdirSync(path.join(tmp, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'box.js'), '// probe\n');
+    fs.writeFileSync(path.join(tmp, 'infra', 'legacy.service'),
+      '[Service]\nExecStart=/usr/bin/node scripts/gds/box.js run-intents --apply\n');
+    const r = lintInfraExec({ instanceRoot: tmp, coreRoot: tmp });
+    assert.ok(!r.ok, 'a bare repo-relative core ExecStart must fail the lint');
+    assert.equal(r.violations.length, 1);
+    assert.match(r.violations[0].why, /core-node\.sh/);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+// ---- B. the launcher resolves BOTH layouts ------------------------------------------------------
+function runLauncher(rel, instanceRoot) {
+  return execFileSync('bash', [LAUNCHER, rel], {
+    encoding: 'utf8',
+    env: { ...process.env, BONGOS_INSTANCE_ROOT: instanceRoot },
+  }).trim();
+}
+
+test('core-node.sh resolves the monolith layout (script at the instance root)', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cn-mono-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'probe.js'), 'console.log("MONOLITH");\n');
+    assert.equal(runLauncher('scripts/gds/probe.js', tmp), 'MONOLITH');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('core-node.sh falls back to the consumer layout (script only under node_modules/@bongos/core)', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cn-cons-'));
+  try {
+    const pkgDir = path.join(tmp, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(pkgDir, { recursive: true });
+    fs.writeFileSync(path.join(pkgDir, 'probe.js'), 'console.log("CONSUMER");\n');
+    // No scripts/gds/probe.js at the instance root → the resolver must reach node_modules.
+    assert.equal(runLauncher('scripts/gds/probe.js', tmp), 'CONSUMER');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('core-node.sh exits non-zero when the script is in NO layout', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cn-none-'));
+  let threw = false;
+  try {
+    execFileSync('bash', [LAUNCHER, 'scripts/gds/nope.js'], {
+      encoding: 'utf8', stdio: 'pipe', env: { ...process.env, BONGOS_INSTANCE_ROOT: tmp },
+    });
+  } catch (_) { threw = true; }
+  finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+  assert.ok(threw, 'expected a non-zero exit when the core script resolves in no layout');
+});
+
+console.log(`\ninfra_exec_paths: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/init.mjs

@@ -336,12 +336,12 @@ test('buildInstancePackageJson: no package.json → mints a private one with the
   assert.equal(pkg.scripts.start, init.INSTANCE_START_SCRIPT);
   assert.equal(pkg.scripts.migrate, init.INSTANCE_MIGRATE_SCRIPT);
   // the start/migrate scripts must target the installed core package so `npm ci` output is runnable
-  assert.match(pkg.scripts.start, /node_modules\/@cloudbongos\/core\/src\/platform-server\.js$/);
-  assert.match(pkg.scripts.migrate, /node_modules\/@cloudbongos\/core\/scripts\/migrate\.sh$/);
+  assert.match(pkg.scripts.start, /node_modules\/@bongos\/core\/src\/platform-server\.js$/);
+  assert.match(pkg.scripts.migrate, /node_modules\/@bongos\/core\/scripts\/migrate\.sh$/);
 });
 
 test('buildInstancePackageJson: coreDep (file: tarball pin) → the dep is the file: pin, not the caret', () => {
-  const pin = 'file:vendor/cloudbongos-core-1.17.0.tgz';
+  const pin = 'file:vendor/bongos-core-1.17.0.tgz';
   const pkg = init.buildInstancePackageJson(null, { name: 'demo', coreDep: pin });
   assert.equal(pkg.dependencies[init.CORE_PKG], pin);
   assert.notEqual(pkg.dependencies[init.CORE_PKG], init.coreDepRange());
@@ -349,13 +349,60 @@ test('buildInstancePackageJson: coreDep (file: tarball pin) → the dep is the f
 
 test('buildInstancePackageJson: preserves existing fields + never clobbers a custom start/migrate', () => {
   const existing = { name: 'keep-me', version: '2.0.0', scripts: { start: 'node server.js' }, keywords: ['x'] };
-  const pkg = init.buildInstancePackageJson(existing, { name: 'ignored', coreDep: 'file:vendor/cloudbongos-core-1.17.0.tgz' });
+  const pkg = init.buildInstancePackageJson(existing, { name: 'ignored', coreDep: 'file:vendor/bongos-core-1.17.0.tgz' });
   assert.equal(pkg.name, 'keep-me');                         // existing name wins
   assert.equal(pkg.version, '2.0.0');                        // untouched field preserved
   assert.deepEqual(pkg.keywords, ['x']);
   assert.equal(pkg.scripts.start, 'node server.js');         // custom start NOT clobbered
   assert.equal(pkg.scripts.migrate, init.INSTANCE_MIGRATE_SCRIPT); // missing one is filled
-  assert.equal(pkg.dependencies[init.CORE_PKG], 'file:vendor/cloudbongos-core-1.17.0.tgz'); // dep (re)pinned
+  assert.equal(pkg.dependencies[init.CORE_PKG], 'file:vendor/bongos-core-1.17.0.tgz'); // dep (re)pinned
+});
+
+// --- enabled-module dep composition (ADR 0138 / task 2160) --------------------
+
+test('enabledModuleDeps: merges only the ENABLED modules’ declared deps', () => {
+  const readDeps = (k) => ({
+    discord: { 'discord.js': '^14.26.4' },
+    game: { colyseus: '^0.16.5', phaser: '^3.87.0' },
+    'art-pipeline': { sharp: '^0.34.5' },
+  }[k] || {});
+  const merged = init.enabledModuleDeps(
+    { modules: { discord: true, game: false, 'art-pipeline': true, 'dev-box': false } },
+    { readDeps }
+  );
+  assert.deepEqual(merged, { 'discord.js': '^14.26.4', sharp: '^0.34.5' }); // game excluded (off)
+});
+
+test('enabledModuleDeps: no enabled modules → empty object', () => {
+  assert.deepEqual(init.enabledModuleDeps({ modules: { discord: false } }, { readDeps: () => ({ 'discord.js': '^14' }) }), {});
+});
+
+test('buildInstancePackageJson: composes moduleDeps (fills), but an existing pin WINS and core is always set', () => {
+  const existing = { dependencies: { 'discord.js': '^14.0.0', express: '^4' } }; // instance pinned discord.js older
+  const moduleDeps = { 'discord.js': '^14.26.4', sharp: '^0.34.5' };
+  const pkg = init.buildInstancePackageJson(existing, { name: 'demo', coreDep: 'file:x.tgz', moduleDeps });
+  assert.equal(pkg.dependencies['discord.js'], '^14.0.0');    // existing pin wins over the module range
+  assert.equal(pkg.dependencies.sharp, '^0.34.5');            // module dep fills what was missing
+  assert.equal(pkg.dependencies.express, '^4');               // untouched host dep preserved
+  assert.equal(pkg.dependencies[init.CORE_PKG], 'file:x.tgz'); // core always (re)set
+});
+
+test('buildInstancePackageJson: no moduleDeps → byte-identical to the pre-composition behavior', () => {
+  const existing = { dependencies: { express: '^4' } };
+  const a = init.buildInstancePackageJson(existing, { name: 'demo', coreDep: 'file:x.tgz' });
+  const b = init.buildInstancePackageJson(existing, { name: 'demo', coreDep: 'file:x.tgz', moduleDeps: {} });
+  assert.deepEqual(a.dependencies, b.dependencies);
+  assert.deepEqual(a.dependencies, { express: '^4', [init.CORE_PKG]: 'file:x.tgz' });
+});
+
+test('moduleDeclaredDeps: reads a module.json dependencies block; {} when absent', () => {
+  const readOk = (p) => JSON.stringify({ key: 'discord', dependencies: { 'discord.js': '^14.26.4' } });
+  assert.deepEqual(init.moduleDeclaredDeps('discord', { coreRoot: '/core', fsImpl: { readFileSync: readOk } }),
+    { 'discord.js': '^14.26.4' });
+  const readNone = () => JSON.stringify({ key: 'lifecycle', contributes: {} });
+  assert.deepEqual(init.moduleDeclaredDeps('lifecycle', { coreRoot: '/core', fsImpl: { readFileSync: readNone } }), {});
+  const readThrow = () => { throw new Error('ENOENT'); };
+  assert.deepEqual(init.moduleDeclaredDeps('ghost', { coreRoot: '/core', fsImpl: { readFileSync: readThrow } }), {});
 });
 
 test('writeConfigs (greenfield): mints package.json with the caret core dep + start/migrate scripts', () => {
@@ -377,7 +424,7 @@ test('writeConfigs (greenfield): mints package.json with the caret core dep + st
 test('writeConfigs (greenfield, --vendor-core): package.json pins the file: tarball instead of the caret', () => {
   const dir = mkdtempSync(join(tmpdir(), 'greenfield-'));
   try {
-    const pin = 'file:vendor/cloudbongos-core-1.17.0.tgz';
+    const pin = 'file:vendor/bongos-core-1.17.0.tgz';
     const res = init.writeConfigs(fullSpec(), { dir, force: false, dryRun: false, coreDep: pin, log: () => {} });
     const pkg = JSON.parse(readFileSync(res.pkgPath, 'utf8'));
     assert.equal(pkg.dependencies[init.CORE_PKG], pin);
@@ -456,7 +503,60 @@ async function runSeedTests() {
   });
 }
 
+// ---- greenfield registry-install path (ADR 0134, task 2090) ----------------
+// main() with --registry-core --dry-run only LOGS (no fs, no network), so we capture
+// console output and assert the plan. The real write+install path is proven by the
+// CLI scratch run in the session log; the pure gates live in tests/npmrc.mjs.
+async function runRegistryCoreTests() {
+  const at = async (name, fn) => {
+    try { await fn(); passed++; console.log(`  ok  ${name}`); }
+    catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+  };
+  const specFile = () => {
+    const dir = mkdtempSync(join(tmpdir(), 'init-reg-'));
+    const p = join(dir, 'spec.json');
+    writeFileSync(p, JSON.stringify({
+      identity: { productName: 'Reg Test' }, repo: { owner: 'acme', name: 'reg-test' }, firstAdmin: 'acme',
+      currency: { label: 'credits' }, domains: { publicOrigin: 'http://localhost:3000' }, modules: [],
+      version: { id: 'V1', name: 'V1', done_when: 'loop works' },
+    }));
+    return { dir, p };
+  };
+  // Run init.main() with console captured; returns { code, out }.
+  const capture = async (argv) => {
+    const lines = [];
+    const origLog = console.log, origErr = console.error;
+    console.log = (...a) => lines.push(a.join(' '));
+    console.error = (...a) => lines.push(a.join(' '));
+    let code;
+    try { code = await init.main(['node', 'init', ...argv]); }
+    finally { console.log = origLog; console.error = origErr; }
+    return { code, out: lines.join('\n') };
+  };
+
+  await at('main --registry-core --dry-run: plans the env-fed .npmrc; does NOT vendor a tarball', async () => {
+    const { dir, p } = specFile();
+    try {
+      const { code, out } = await capture(['--from', p, '--dir', join(dir, 'out'), '--no-seed', '--registry-core', '--dry-run']);
+      assert.equal(code, 0);
+      assert.match(out, /would write \.npmrc \(env-fed @bongos auth\)/);
+      assert.ok(!/vendor/i.test(out), 'no vendored-tarball step on the registry path');
+      assert.equal(existsSync(join(dir, 'out', '.npmrc')), false, 'dry-run writes nothing');
+    } finally { rmSync(dir, { recursive: true, force: true }); }
+  });
+
+  await at('main: --vendor-core + --registry-core is refused (mutually exclusive) → exit 1', async () => {
+    const { dir, p } = specFile();
+    try {
+      const { code, out } = await capture(['--from', p, '--dir', join(dir, 'out'), '--no-seed', '--vendor-core', '/tmp/x.tgz', '--registry-core', '--dry-run']);
+      assert.equal(code, 1);
+      assert.match(out, /mutually exclusive/);
+    } finally { rmSync(dir, { recursive: true, force: true }); }
+  });
+}
+
 await runSeedTests();
+await runRegistryCoreTests();
 
 console.log('');
 console.log(`init tests: ${passed} passed, ${failed} failed`);