@bongos/core 1.17.0

package/tests/rate_limit_public.mjs

@@ -0,0 +1,217 @@
+// tests/rate_limit_public.mjs
+//
+// Unit + integration smoke for the public-read rate limiter (red-team #604 /
+// task 1035). The unauthenticated /api/gds/public/* surface had ZERO rate
+// limiting — the global write limiter bypasses reads by design — so the 90-day
+// aggregate endpoints (/public/uptime, /public/repo-health) were a DoS / cost-
+// amplification target. publicReadRateLimitMiddleware caps reads at
+// PUBLIC_READ_LIMIT / 60s per IP.
+//
+// Verifies:
+//   1. Counting: the first PUBLIC_READ_LIMIT reads from one IP pass; the next
+//      trips a 429 with Retry-After + X-RateLimit-Scope:public-read.
+//   2. Per-IP isolation: exhausting one IP does not throttle another.
+//   3. HEAD is metered (Express runs the GET handler for a HEAD).
+//   4. Non-read methods bypass this limiter entirely (no read slot consumed).
+//   5. Wiring: mounted under /public AFTER the CORS block, a 429 still carries
+//      Access-Control-Allow-Origin so the cross-origin dashboard can read it.
+//
+// The counting tests call the middleware directly with fake req/res (fast,
+// deterministic, no ports). The module keeps one shared in-memory bucket Map,
+// so each test uses distinct IPs to avoid cross-contamination.
+//
+// Run:  node tests/rate_limit_public.mjs
+
+import { strict as assert } from 'node:assert';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+const {
+  publicReadRateLimitMiddleware,
+  PUBLIC_READ_LIMIT,
+  PUBLIC_READ_WINDOW_MS,
+} = require('../src/bongos/middleware/rate-limit.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  return Promise.resolve()
+    .then(() => fn())
+    .then(() => { passed++; console.log(`  PASS  ${name}`); })
+    .catch((e) => { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); });
+}
+
+// ---------------------------------------------------------------------------
+// Direct-call helpers (no HTTP).
+// ---------------------------------------------------------------------------
+function fakeRes() {
+  const headers = {};
+  const res = {
+    statusCode: 200,
+    headers,
+    body: undefined,
+    ended: false,
+    set(k, v) { headers[k.toLowerCase()] = String(v); return this; },
+    status(c) { this.statusCode = c; return this; },
+    json(obj) { this.body = obj; this.ended = true; return this; },
+  };
+  attachFail({}, res, () => {}); // install res.fail() exactly as the router does (task 1991)
+  return res;
+}
+function runMw(method, ip) {
+  const req = { method, ip, headers: {}, socket: { remoteAddress: ip } };
+  const res = fakeRes();
+  let nexted = false;
+  publicReadRateLimitMiddleware(req, res, () => { nexted = true; });
+  return { res, nexted };
+}
+
+// ---------------------------------------------------------------------------
+// 1. Counting + the 429 shape.
+// ---------------------------------------------------------------------------
+await t('exported limit is a sane positive integer', () => {
+  assert.ok(Number.isInteger(PUBLIC_READ_LIMIT) && PUBLIC_READ_LIMIT > 0, 'limit');
+  assert.ok(Number.isInteger(PUBLIC_READ_WINDOW_MS) && PUBLIC_READ_WINDOW_MS > 0, 'window');
+});
+
+await t('first PUBLIC_READ_LIMIT reads from one IP pass, the next trips 429', () => {
+  const ip = '203.0.113.7';
+  for (let i = 0; i < PUBLIC_READ_LIMIT; i++) {
+    const { res, nexted } = runMw('GET', ip);
+    assert.equal(nexted, true, `read ${i + 1} within the limit must call next`);
+    assert.notEqual(res.statusCode, 429, `read ${i + 1} must not be throttled`);
+  }
+  const { res, nexted } = runMw('GET', ip);
+  assert.equal(nexted, false, 'the over-limit read must NOT call next');
+  assert.equal(res.statusCode, 429);
+  assert.equal(res.body.error.code, 'rate_limited');
+  assert.equal(res.body.error.details.scope, 'public-read');
+  assert.ok(res.body.error.details.retry_after_seconds >= 1, 'retry_after_seconds >= 1');
+  assert.ok(res.body.error.details.retry_after_seconds <= PUBLIC_READ_WINDOW_MS / 1000, 'retry_after bounded by window');
+  assert.equal(res.headers['x-ratelimit-scope'], 'public-read');
+  assert.equal(res.headers['x-ratelimit-limit'], String(PUBLIC_READ_LIMIT));
+  assert.equal(res.headers['x-ratelimit-window-seconds'], String(PUBLIC_READ_WINDOW_MS / 1000));
+  assert.ok(res.headers['retry-after'], 'Retry-After header set');
+});
+
+// ---------------------------------------------------------------------------
+// 2. Per-IP isolation.
+// ---------------------------------------------------------------------------
+await t('exhausting one IP does not throttle another', () => {
+  const ipA = '198.51.100.1';
+  const ipB = '198.51.100.2';
+  for (let i = 0; i < PUBLIC_READ_LIMIT; i++) runMw('GET', ipA);
+  assert.equal(runMw('GET', ipA).res.statusCode, 429, 'A is exhausted');
+  const b = runMw('GET', ipB);
+  assert.equal(b.nexted, true, 'B has its own bucket and is unaffected');
+  assert.notEqual(b.res.statusCode, 429);
+});
+
+// ---------------------------------------------------------------------------
+// 3. HEAD is metered (same handler cost as GET).
+// ---------------------------------------------------------------------------
+await t('HEAD requests count toward the read limit', () => {
+  const ip = '198.51.100.50';
+  for (let i = 0; i < PUBLIC_READ_LIMIT; i++) runMw('HEAD', ip);
+  assert.equal(runMw('HEAD', ip).res.statusCode, 429, 'HEAD must be metered like GET');
+});
+
+// ---------------------------------------------------------------------------
+// 4. Non-read methods bypass this limiter (the global write limiter owns them).
+// ---------------------------------------------------------------------------
+await t('POST/PATCH/PUT/DELETE bypass the public-read limiter', () => {
+  const ip = '198.51.100.99';
+  // Far more than the read limit — none should ever trip here.
+  for (let i = 0; i < PUBLIC_READ_LIMIT + 5; i++) {
+    for (const m of ['POST', 'PATCH', 'PUT', 'DELETE']) {
+      const { res, nexted } = runMw(m, ip);
+      assert.equal(nexted, true, `${m} must pass through`);
+      assert.notEqual(res.statusCode, 429, `${m} must not be throttled by the read limiter`);
+    }
+  }
+  // And those writes consumed no read slots: a fresh read on the same IP passes.
+  assert.equal(runMw('GET', ip).nexted, true, 'writes must not consume read slots');
+});
+
+// ---------------------------------------------------------------------------
+// 5. HTTP wiring: mounted after CORS; a 429 still carries the ACAO header.
+// ---------------------------------------------------------------------------
+function buildApp() {
+  const app = express();
+  app.set('trust proxy', 1); // one hop (Caddy) → req.ip = the XFF client address
+  app.use(attachFail); // install res.fail() as the real app does (task 1991)
+  const router = express.Router();
+  // Mirror routes/public.js ordering: CORS first (sets ACAO, answers OPTIONS),
+  // then the read limiter, then the routes.
+  router.use('/public', (req, res, next) => {
+    res.set('Access-Control-Allow-Origin', '*');
+    if (req.method === 'OPTIONS') return res.sendStatus(204);
+    next();
+  });
+  router.use('/public', publicReadRateLimitMiddleware);
+  router.get('/public/ping', (_req, res) => res.json({ ok: true }));
+  app.use(router);
+  return app;
+}
+
+function listen(app) {
+  return new Promise((resolve) => {
+    const server = app.listen(0, '127.0.0.1', () => resolve({ server, port: server.address().port }));
+  });
+}
+
+function get(port, xff) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      { host: '127.0.0.1', port, method: 'GET', path: '/public/ping', headers: { 'x-forwarded-for': xff } },
+      (res) => {
+        const chunks = [];
+        res.on('data', (c) => chunks.push(c));
+        res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, text: Buffer.concat(chunks).toString('utf8') }));
+      }
+    );
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+await t('HTTP: a fresh-IP read returns 200 with the CORS header', async () => {
+  const app = buildApp();
+  const { server, port } = await listen(app);
+  try {
+    const r = await get(port, '192.0.2.201');
+    assert.equal(r.status, 200);
+    assert.equal(JSON.parse(r.text).ok, true);
+    assert.equal(r.headers['access-control-allow-origin'], '*');
+  } finally {
+    server.close();
+  }
+});
+
+await t('HTTP: a throttled read 429s AND still carries Access-Control-Allow-Origin', async () => {
+  const throttledIp = '192.0.2.200';
+  // Pre-exhaust this IP's shared bucket in-process (trust proxy=1 + this XFF →
+  // req.ip === throttledIp), so a single real HTTP read trips the 429. This
+  // also proves the limiter and the HTTP req.ip resolution agree on the key.
+  for (let i = 0; i < PUBLIC_READ_LIMIT; i++) runMw('GET', throttledIp);
+  const app = buildApp();
+  const { server, port } = await listen(app);
+  try {
+    const r = await get(port, throttledIp);
+    assert.equal(r.status, 429, 'pre-exhausted IP must be throttled over HTTP');
+    assert.equal(r.headers['x-ratelimit-scope'], 'public-read');
+    assert.ok(r.headers['retry-after'], 'Retry-After present');
+    // The cross-origin status dashboard must be able to read the 429.
+    assert.equal(r.headers['access-control-allow-origin'], '*', '429 must keep the CORS header');
+  } finally {
+    server.close();
+  }
+});
+
+// ---------------------------------------------------------------------------
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/read_session_export.mjs

@@ -0,0 +1,89 @@
+// tests/read_session_export.mjs — pure-core coverage for the session-export
+// reader (the /read-session-export skill). Hermetic: feeds record fixtures to
+// reduce() — no zip, no fs, no network. The ZIP byte-reader is exercised by
+// hand against real exports. Run: node tests/read_session_export.mjs (also in
+// the unit gate).
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { reduce } = require('../scripts/gds/read-session-export.js');
+
+let passed = 0, failed = 0;
+const t = (n, f) => { try { f(); passed++; console.log(`  PASS  ${n}`); } catch (e) { failed++; console.log(`  FAIL  ${n}\n        ${e.message}`); } };
+
+const user = (text) => ({ type: 'user', message: { role: 'user', content: text } });
+const asst = (content) => ({ type: 'assistant', message: { role: 'assistant', content } });
+const result = (id, content, isError = false) => ({ type: 'user', message: { content: [{ type: 'tool_result', tool_use_id: id, content, is_error: isError }] } });
+const think = (s) => ({ type: 'thinking', thinking: s, signature: 'sig' });
+const txt = (s) => ({ type: 'text', text: s });
+const tool = (id, name, input) => ({ type: 'tool_use', id, name, input });
+
+t('a user prompt becomes one user turn', () => {
+  const { turns, stats } = reduce([user('hello')]);
+  assert.equal(turns.length, 1);
+  assert.equal(turns[0].role, 'user');
+  assert.equal(turns[0].text, 'hello');
+  assert.equal(stats.prompts, 1);
+});
+
+t('counts visible vs redacted thinking', () => {
+  const { stats } = reduce([asst([think('reasoning')]), asst([think('   ')]), asst([{ type: 'redacted_thinking' }])]);
+  assert.equal(stats.visible, 1);
+  assert.equal(stats.redacted, 2); // whitespace-only + explicit redacted_thinking
+});
+
+t('attaches tool_result to its tool_use by id', () => {
+  const { turns, stats } = reduce([asst([tool('t1', 'Bash', { command: 'ls' })]), result('t1', 'a\nb')]);
+  const tb = turns[0].blocks.find((b) => b.k === 'tool');
+  assert.equal(tb.name, 'Bash');
+  assert.equal(tb.result, 'a\nb');
+  assert.equal(tb.isError, false);
+  assert.equal(stats.tools, 1);
+});
+
+t('flattens array tool_result content', () => {
+  const { turns } = reduce([asst([tool('t2', 'Read', { file_path: '/a' })]), result('t2', [{ type: 'text', text: 'x' }, { type: 'text', text: 'y' }])]);
+  assert.equal(turns[0].blocks.find((b) => b.k === 'tool').result, 'x\ny');
+});
+
+t('flags an error tool result', () => {
+  const { turns } = reduce([asst([tool('t3', 'Bash', { command: 'false' })]), result('t3', 'boom', true)]);
+  assert.equal(turns[0].blocks.find((b) => b.k === 'tool').isError, true);
+});
+
+t('tool-result carrier records are not rendered as user turns', () => {
+  const { turns, stats } = reduce([user('go'), asst([tool('t4', 'Bash', { command: 'x' })]), result('t4', 'ok')]);
+  assert.equal(turns.filter((x) => x.role === 'user').length, 1);
+  assert.equal(stats.prompts, 1);
+});
+
+t('merges consecutive assistant records into one turn', () => {
+  // think, text, tool each arrive as their own streamed record
+  const { turns } = reduce([
+    user('q'),
+    asst([think('t')]),
+    asst([txt('answer')]),
+    asst([tool('t5', 'Bash', { command: 'ls' })]),
+    result('t5', 'ok'),
+  ]);
+  const a = turns.filter((x) => x.role === 'assistant');
+  assert.equal(a.length, 1, 'three assistant records collapse to one turn');
+  assert.deepEqual(a[0].blocks.map((b) => b.k), ['think', 'text', 'tool']);
+});
+
+t('drops system / queue / last-prompt noise', () => {
+  const { turns } = reduce([{ type: 'system', subtype: 'hook' }, { type: 'queue-operation' }, { type: 'last-prompt' }, user('hi')]);
+  assert.equal(turns.length, 1);
+  assert.equal(turns[0].role, 'user');
+});
+
+t('captures attachments', () => {
+  const { turns } = reduce([{ type: 'attachment', attachment: { fileName: 'spec.pdf' } }]);
+  assert.equal(turns[0].role, 'attachment');
+  assert.equal(turns[0].label, 'spec.pdf');
+});
+
+console.log(`\nread_session_export: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/recall_cli.mjs

@@ -0,0 +1,82 @@
+// tests/recall_cli.mjs
+//
+// Unit tests for the /recall CLI arg parser (task 955, V4.R17). The query is the
+// free-text remainder of argv (quotes optional), with --limit / --kind / --json
+// flags in both `--flag val` and `--flag=val` forms. The CLI's network path is
+// exercised live against POST /api/gds/search; here we pin the pure parser.
+//
+// Run:  node tests/recall_cli.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { parseArgs, truncate } = require('../scripts/gds/recall.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+test('bare terms join into the query (quotes optional)', () => {
+  const a = parseArgs(['grader', 'bypass', 'ordering']);
+  assert.equal(a.q, 'grader bypass ordering');
+  assert.equal(a.limit, undefined);
+  assert.equal(a.kind, undefined);
+  assert.equal(a.json, false);
+});
+
+test('--limit and --kind in space form, interleaved with terms', () => {
+  const a = parseArgs(['trust', '--limit', '5', 'boundary', '--kind', 'doc']);
+  assert.equal(a.q, 'trust boundary');
+  assert.equal(a.limit, 5);
+  assert.equal(a.kind, 'doc');
+});
+
+test('--limit= and --kind= equals form', () => {
+  const a = parseArgs(['--limit=3', 'nightly', 'backup', '--kind=db']);
+  assert.equal(a.q, 'nightly backup');
+  assert.equal(a.limit, 3);
+  assert.equal(a.kind, 'db');
+});
+
+test('--json flag is captured and not treated as a query term', () => {
+  const a = parseArgs(['retrieval', 'layer', '--json']);
+  assert.equal(a.q, 'retrieval layer');
+  assert.equal(a.json, true);
+});
+
+test('--expand <id> (space form) parses the chunk id for the expand step', () => {
+  // Progressive disclosure step 2 (ADR 0095 C1 / task 1658): `recall --expand N`
+  // fetches one hit's full content. The id parses to a number; no query needed.
+  const a = parseArgs(['--expand', '1234']);
+  assert.equal(a.expand, 1234);
+  assert.equal(a.q, '');
+});
+
+test('--expand=<id> (equals form) parses the chunk id', () => {
+  const a = parseArgs(['--expand=42']);
+  assert.equal(a.expand, 42);
+});
+
+test('--expand coexists with --json without leaking into the query', () => {
+  const a = parseArgs(['--expand', '7', '--json']);
+  assert.equal(a.expand, 7);
+  assert.equal(a.json, true);
+  assert.equal(a.q, '');
+});
+
+test('empty argv → empty query (the CLI prints usage + exits)', () => {
+  assert.equal(parseArgs([]).q, '');
+});
+
+test('truncate collapses whitespace and caps length with an ellipsis', () => {
+  assert.equal(truncate('a   b\n c', 100), 'a b c');
+  assert.equal(truncate('abcdef', 4), 'abc…');
+  assert.equal(truncate(null, 10), '');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/recall_hints.mjs

@@ -0,0 +1,119 @@
+// tests/recall_hints.mjs
+//
+// V4.R25 / #963 — session-start recall hints. Criterion sessions-start-knowing.
+// When a session opens holding a claim, surface top recall hits for it. These
+// tests pin the pure helpers (query cleaning, latest-claim selection, render),
+// which carry all the logic; the network leg is a thin raw fetch with a shared
+// deadline and is exercised by the live smoke run, not here (no network in CI).
+//
+// Run:  node tests/recall_hints.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { taskQuery, pickActiveClaim, formatHints, DEADLINE_MS } =
+  require('../.claude/hooks/recall-hints.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// ---- taskQuery: strip planning chrome --------------------------------------
+t('taskQuery: strips the "V4.R25 — " rank prefix and trailing parenthetical', () => {
+  assert.equal(
+    taskQuery('V4.R25 — Session-start recall hints (kill-switched, like the memory pull)'),
+    'Session-start recall hints'
+  );
+});
+
+t('taskQuery: handles a hyphen separator and no parenthetical', () => {
+  assert.equal(taskQuery('R04 - Claim-time context pack'), 'Claim-time context pack');
+});
+
+t('taskQuery: a plain title passes through untouched', () => {
+  assert.equal(taskQuery('Fix the walk animation seam'), 'Fix the walk animation seam');
+});
+
+t('taskQuery: never returns empty — falls back to the raw title', () => {
+  // A pathological title that is ONLY a prefix should not strip to ''.
+  assert.equal(taskQuery('(only an aside)'), '(only an aside)');
+  assert.equal(taskQuery(''), '');
+});
+
+// ---- pickActiveClaim: newest claim wins ------------------------------------
+t('pickActiveClaim: picks the most recently claimed of several', () => {
+  const me = {
+    active_claims: [
+      { task_id: 1, title: 'old', claimed_at: '2026-06-01T00:00:00Z' },
+      { task_id: 2, title: 'newest', claimed_at: '2026-06-18T00:00:00Z' },
+      { task_id: 3, title: 'mid', claimed_at: '2026-06-10T00:00:00Z' },
+    ],
+  };
+  assert.equal(pickActiveClaim(me).task_id, 2);
+});
+
+t('pickActiveClaim: supports the singular active_claim shape', () => {
+  assert.equal(pickActiveClaim({ active_claim: { task_id: 7, title: 'x' } }).task_id, 7);
+});
+
+t('pickActiveClaim: no claims → null (hook stays silent)', () => {
+  assert.equal(pickActiveClaim({ active_claims: [] }), null);
+  assert.equal(pickActiveClaim({}), null);
+  assert.equal(pickActiveClaim(null), null);
+});
+
+// ---- formatHints: render or stay silent ------------------------------------
+t('formatHints: renders claim id, titles, source, and the /recall pointer', () => {
+  const out = formatHints(
+    { task_id: 963, title: 'Session-start recall hints' },
+    [
+      { title: 'ADR 0060 — GDS retrieval layer', heading_path: 'docs/adr/0060-gds-retrieval-layer.md' },
+      { title: 'recall skill', source_ref: 'scripts/gds/recall.js' },
+    ]
+  );
+  assert.match(out, /#963/);
+  assert.match(out, /ADR 0060/);
+  assert.match(out, /docs\/adr\/0060/);
+  assert.match(out, /\/recall/);
+  assert.ok(!/undefined/.test(out));
+});
+
+t('formatHints: caps at HINT_LIMIT (3) results', () => {
+  const many = Array.from({ length: 9 }, (_, i) => ({ title: `r${i}`, source_ref: `s${i}` }));
+  const out = formatHints({ task_id: 1, title: 't' }, many);
+  const bullets = out.split('\n').filter((l) => l.trim().startsWith('•'));
+  assert.equal(bullets.length, 3);
+});
+
+t('formatHints: drops the claim\'s own indexed task chunk (task:<id>)', () => {
+  const out = formatHints(
+    { task_id: 963, title: 'Session-start recall hints' },
+    [
+      { title: 'self', source_ref: 'task:963' },                 // must be dropped
+      { title: 'ADR 0060', source_ref: 'docs/adr/0060-x.md' },
+    ]
+  );
+  assert.ok(!/self/.test(out), 'the task\'s own chunk must not appear');
+  assert.match(out, /ADR 0060/);
+});
+
+t('formatHints: a result set that is ONLY the self-match → null (silent)', () => {
+  assert.equal(formatHints({ task_id: 963, title: 't' }, [{ source_ref: 'task:963', title: 'self' }]), null);
+});
+
+t('formatHints: no results or no claim → null (silent)', () => {
+  assert.equal(formatHints({ task_id: 1, title: 't' }, []), null);
+  assert.equal(formatHints(null, [{ title: 'x' }]), null);
+});
+
+// ---- budget sanity ---------------------------------------------------------
+t('DEADLINE_MS stays under the 2s session-start ceiling', () => {
+  assert.ok(DEADLINE_MS < 2000, `deadline ${DEADLINE_MS} must be < 2000ms`);
+});
+
+console.log(`\nrecall_hints: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/recent_shipped_window.mjs

@@ -0,0 +1,80 @@
+// tests/recent_shipped_window.mjs
+//
+// #1033 — the GET /api/gds/public/recent-shipped row cap. The "Lately Inscribed"
+// tablet offers Last 7/30/90 days + All time, but ?days=all used to share the
+// null-days code path with the no-query default and inherit its 30-row cap —
+// so "All time" paradoxically showed FEWER rows than "Last 90 days" (which
+// returns up to 200). recentShippedWindow() is the pure (days, limit) decision;
+// this pins each branch.
+//
+// Run:  node tests/recent_shipped_window.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { recentShippedWindow } = require('../src/bongos/routes/public.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('?days=all → all-time, 200-row cap (the #1033 fix)', () => {
+  const w = recentShippedWindow('all');
+  assert.equal(w.days, null, 'all-time has no date window');
+  assert.equal(w.limit, 200, '"All time" must lift the 30-row default cap');
+  assert.equal(w.raw, 'all');
+});
+
+t('no query → historical 30-row "recent" feed', () => {
+  const w = recentShippedWindow(undefined);
+  assert.equal(w.days, null);
+  assert.equal(w.limit, 30, 'the default feed stays at 30');
+  assert.equal(w.raw, '');
+});
+
+t('empty string → default feed (not all-time)', () => {
+  const w = recentShippedWindow('');
+  assert.equal(w.days, null);
+  assert.equal(w.limit, 30);
+});
+
+t('numeric windows (7/30/90) → that window, 200-row cap', () => {
+  for (const n of [7, 30, 90]) {
+    const w = recentShippedWindow(String(n));
+    assert.equal(w.days, n, `days=${n}`);
+    assert.equal(w.limit, 200, `numeric window ${n} surfaces up to 200 rows`);
+  }
+});
+
+t('All time row cap is never less than a numeric window (the symptom #1033 reported)', () => {
+  assert.ok(recentShippedWindow('all').limit >= recentShippedWindow('90').limit,
+    '"All time" must show at least as many rows as "Last 90 days"');
+});
+
+t('case/whitespace-insensitive: " ALL " is treated as all-time', () => {
+  const w = recentShippedWindow(' ALL ');
+  assert.equal(w.limit, 200);
+  assert.equal(w.days, null);
+  assert.equal(w.raw, 'all');
+});
+
+t('garbage / non-positive values fall back to the default feed', () => {
+  for (const bad of ['nonsense', '0', '-5', 'NaN', 'abc']) {
+    const w = recentShippedWindow(bad);
+    assert.equal(w.limit, 30, `"${bad}" → default 30-row feed`);
+    assert.equal(w.days, null, `"${bad}" → no date window`);
+  }
+});
+
+t('parseInt-style prefixes: "30days" → 30-day window (parseInt leniency, documented)', () => {
+  const w = recentShippedWindow('30days');
+  assert.equal(w.days, 30, 'parseInt("30days") === 30');
+  assert.equal(w.limit, 200);
+});
+
+console.log(`\nrecent_shipped_window: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);