@bongos/core 1.17.0

package/tests/setup_smoke.mjs

@@ -0,0 +1,154 @@
+// Smoke test for scripts/gds/setup.js — verifies a "fresh user" on a different
+// machine can run /builder-setup end-to-end without hitting hardcoded paths or
+// names. We simulate that by spawning setup.js with HOME pointed at a throw-
+// away tmp dir, so os.homedir() returns that dir instead of the real one.
+//
+// The smoke test only exercises the no-network branch: `--dry-run`. The full
+// Device Flow needs a real GitHub round-trip and a real user opening a browser,
+// neither of which a CI smoke test can do. The dry-run branch is enough to
+// verify the things this audit cares about:
+//
+//   1. The script doesn't crash when no pre-existing session is present.
+//   2. The script resolves every path from $HOME (no /Users/larskristensen leak).
+//   3. The path it would write to is ~/.config/otb/gds-session.json under
+//      whatever HOME points at, not under the developer's real home.
+//   4. The script has no filesystem side effects in --dry-run (no dir created,
+//      no file written, no socket opened against the real GDS).
+//
+// Run: node tests/setup_smoke.mjs
+
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const REPO_ROOT = path.resolve(path.dirname(new URL(import.meta.url).pathname), '..');
+const SETUP_JS = path.join(REPO_ROOT, 'scripts/gds/setup.js');
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+// Build a fresh HOME for each spawn so tests can't leak state into each other.
+function makeFreshHome() {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'otb-setup-smoke-'));
+}
+
+function runSetup(args, env = {}) {
+  return spawnSync('node', [SETUP_JS, ...args], {
+    env: { ...process.env, ...env },
+    encoding: 'utf8',
+    timeout: 15000,
+  });
+}
+
+test('--dry-run with fresh HOME exits 0 and writes nothing', () => {
+  const fakeHome = makeFreshHome();
+  try {
+    const r = runSetup(['--dry-run'], { HOME: fakeHome });
+    assert.equal(r.status, 0, `exit status was ${r.status}, stderr: ${r.stderr}`);
+    assert.match(r.stdout, /Dry run/, 'should announce dry-run mode');
+    assert.match(r.stdout, /\[dry-run\]/, 'should print dry-run steps');
+    // The session-path message must reference the fake HOME, proving the code
+    // resolves the path from os.homedir() and not from a hardcoded literal.
+    assert.ok(
+      r.stdout.includes(path.join(fakeHome, '.config/otb/gds-session.json')),
+      `expected session path under ${fakeHome} in stdout, got:\n${r.stdout}`,
+    );
+    // No filesystem side effects: ~/.config/otb should not have been created.
+    assert.ok(
+      !fs.existsSync(path.join(fakeHome, '.config')),
+      '--dry-run must not create any files or directories',
+    );
+  } finally {
+    fs.rmSync(fakeHome, { recursive: true, force: true });
+  }
+});
+
+test('--dry-run output does not leak the real developer home path', () => {
+  const fakeHome = makeFreshHome();
+  try {
+    const r = runSetup(['--dry-run'], { HOME: fakeHome });
+    assert.equal(r.status, 0);
+    // The whole point of HOME override: the dry-run plan must talk about the
+    // overridden home, not the actual machine's home directory. If this fails
+    // it means somewhere in the code path a literal /Users/<somebody> snuck in.
+    const realHome = process.env.HOME || os.homedir();
+    if (realHome && realHome !== fakeHome) {
+      assert.ok(
+        !r.stdout.includes(realHome),
+        `dry-run output leaked the developer's real HOME (${realHome}). It should only reference ${fakeHome}.`,
+      );
+    }
+  } finally {
+    fs.rmSync(fakeHome, { recursive: true, force: true });
+  }
+});
+
+test('--dry-run mentions the device flow but does not actually contact GitHub', () => {
+  const fakeHome = makeFreshHome();
+  try {
+    // GDS_API_BASE pointed at an unroutable address. If the script were
+    // accidentally making real network calls in --dry-run, this would either
+    // timeout or fail with a connect error and surface in stderr.
+    const r = runSetup(['--dry-run'], {
+      HOME: fakeHome,
+      GDS_API_BASE: 'http://127.0.0.1:1',
+    });
+    assert.equal(r.status, 0, `dry-run must exit 0 even with a bad GDS_API_BASE; got ${r.status}, stderr: ${r.stderr}`);
+    assert.match(r.stdout, /device\/start/, 'dry-run plan should mention the device-flow start endpoint');
+    assert.match(r.stdout, /device\/poll/, 'dry-run plan should mention the device-flow poll endpoint');
+    // No connect-error chatter; the script must not have hit the network.
+    assert.ok(
+      !/ECONNREFUSED|ENOTFOUND|fetch failed/i.test(r.stderr || ''),
+      `--dry-run must not perform network I/O. stderr was:\n${r.stderr}`,
+    );
+  } finally {
+    fs.rmSync(fakeHome, { recursive: true, force: true });
+  }
+});
+
+test('--dry-run respects a pre-existing valid-looking session in HOME', () => {
+  const fakeHome = makeFreshHome();
+  try {
+    const cfgDir = path.join(fakeHome, '.config/otb');
+    fs.mkdirSync(cfgDir, { recursive: true });
+    const sessionPath = path.join(cfgDir, 'gds-session.json');
+    fs.writeFileSync(sessionPath, JSON.stringify({ token: 'fake-token-for-smoke', builder: { id: 999, github_login: 'smoke-tester' } }), { mode: 0o600 });
+    const r = runSetup(['--dry-run'], { HOME: fakeHome });
+    assert.equal(r.status, 0, `exit status was ${r.status}, stderr: ${r.stderr}`);
+    // The dry-run plan should branch on the pre-existing session.
+    assert.match(
+      r.stdout,
+      /Would verify existing session|existing session/,
+      'dry-run should mention the pre-existing session in the plan',
+    );
+    // #533 multi-builder gate: with a valid session present, the plan must
+    // describe the continue/switch question rather than a silent early exit.
+    // (Confirms the silent "exit early" wording was replaced by the gate.)
+    assert.match(
+      r.stdout,
+      /would ASK whether to continue/i,
+      'dry-run should describe the continue-or-switch gate when a session already exists',
+    );
+  } finally {
+    fs.rmSync(fakeHome, { recursive: true, force: true });
+  }
+});
+
+// ---- runner ----
+
+let failed = 0;
+for (const t of tests) {
+  try {
+    await t.fn();
+    console.log(`  ok    ${t.name}`);
+  } catch (err) {
+    failed += 1;
+    console.error(`  FAIL  ${t.name}`);
+    console.error(`        ${err.message}`);
+  }
+}
+console.log('');
+console.log(`${tests.length - failed}/${tests.length} passed`);
+process.exit(failed === 0 ? 0 : 1);

package/tests/ship_autolinkify.mjs

@@ -0,0 +1,60 @@
+// tests/ship_autolinkify.mjs
+//
+// #747 — ship.js auto-linkifies the docs a ship itself changed BEFORE the merge,
+// so bare "#NNN" task refs never reach main and trip the post-merge
+// doc-ref-linkify CI gate. The orchestration (git + the linkifier subprocess)
+// is covered by the live ship smoke; here we pin down the pure path predicate
+// that decides WHICH changed files fall in the linkifier's domain — the only
+// part that can silently widen/narrow scope and (mis)introduce scanner drift.
+//
+// Pure function — no API, no git, no filesystem.
+//
+// Run:  node tests/ship_autolinkify.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { isLinkifiableDocPath } = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+t('root CLAUDE.md is in-domain', () => {
+  assert.equal(isLinkifiableDocPath('CLAUDE.md'), true);
+});
+t('root README.md is in-domain', () => {
+  assert.equal(isLinkifiableDocPath('README.md'), true);
+});
+t('docs/** markdown is in-domain', () => {
+  assert.equal(isLinkifiableDocPath('docs/adr/0037-discord-channel-management.md'), true);
+  assert.equal(isLinkifiableDocPath('docs/session-logs/2026-06-06-x.md'), true);
+});
+
+// Out of domain — these must be left alone so the auto-commit can never touch
+// a file the builder didn't change in a doc sense (no scanner-drift surprise).
+t('code files are out of domain', () => {
+  assert.equal(isLinkifiableDocPath('scripts/gds/ship.js'), false);
+  assert.equal(isLinkifiableDocPath('src/bongos/routes/tasks.js'), false);
+});
+t('non-docs markdown outside the roots is out of domain', () => {
+  assert.equal(isLinkifiableDocPath('art/template/style_guide.md'), false);
+  assert.equal(isLinkifiableDocPath('limitations/v1-shipped.md'), false);
+});
+t('non-markdown under docs/ is out of domain', () => {
+  assert.equal(isLinkifiableDocPath('docs/onboarding/diagrams/assertions.json'), false);
+});
+t('a path merely containing docs/ is not matched', () => {
+  assert.equal(isLinkifiableDocPath('modules/hall-ui/public/docs/help.md'), false);
+});
+t('non-string input is rejected', () => {
+  assert.equal(isLinkifiableDocPath(undefined), false);
+  assert.equal(isLinkifiableDocPath(null), false);
+});
+
+console.log(`\nship_autolinkify: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/ship_automerge_injection.mjs

@@ -0,0 +1,174 @@
+// tests/ship_automerge_injection.mjs
+//
+// Regression test for the shell-injection fix in ship.js autoMerge() (#681).
+//
+// autoMerge() used to build `git merge --no-ff <branch> -m "<msg>"` as a SHELL
+// STRING via execSync, escaping only double-quotes. The merge message embeds
+// the task value_summary (DB-sourced, untrusted), so `$(...)` / backticks in a
+// hostile value_summary expanded under bash and ran arbitrary commands on the
+// merge host at /builder-ship or /merge-mode time.
+//
+// The fix runs git via execFileSync with an argv array (no shell) and passes
+// the branch + merge message as literal argv elements. This test proves:
+//   1. buildMergeArgv carries the untrusted summary as ONE literal argv element.
+//   2. gitArgvOk runs a real merge with a command-injection payload in the
+//      value_summary and DOES NOT execute it (the sentinel file is never made),
+//      while the payload survives verbatim in the commit message.
+//   3. (contrast) the OLD shell-string approach WOULD have executed the payload
+//      — documents exactly what regressed and what the fix prevents.
+//
+// Run:  node tests/ship_automerge_injection.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { execFileSync, execSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+// Build a throwaway git repo with one commit on `main` and a `feature` branch
+// that adds a file, then return to `main` ready to be merged into.
+function makeRepo() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-merge-inj-'));
+  const git = (...args) => execFileSync('git', ['-C', dir, ...args], { stdio: 'pipe' });
+  git('init', '-b', 'main');
+  git('config', 'user.email', 'test@example.com');
+  git('config', 'user.name', 'Test');
+  git('config', 'commit.gpgsign', 'false');
+  fs.writeFileSync(path.join(dir, 'base.txt'), 'base\n');
+  git('add', '-A');
+  git('commit', '-m', 'base');
+  git('checkout', '-b', 'feature');
+  fs.writeFileSync(path.join(dir, 'feature.txt'), 'feature\n');
+  git('add', '-A');
+  git('commit', '-m', 'feature work');
+  git('checkout', 'main');
+  return { dir, git };
+}
+
+// ---- 1. buildMergeArgv: untrusted summary stays one literal argv element ----
+
+test('buildMergeArgv: payload value_summary is a single literal -m argument', () => {
+  const payload = '$(touch /tmp/should-never-run) `id`';
+  const argv = ship.buildMergeArgv('claude/some-branch', payload);
+  assert.deepEqual(argv.slice(0, 4), ['merge', '--no-ff', 'claude/some-branch', '-m']);
+  // The message is exactly "Merge <branch>: <summary>" — one element, verbatim,
+  // no escaping/mangling. Because it's an argv element, the shell never sees it.
+  assert.equal(argv.length, 5);
+  assert.equal(argv[4], `Merge claude/some-branch: ${payload}`);
+});
+
+test('buildMergeArgv: null summary falls back without throwing', () => {
+  const argv = ship.buildMergeArgv('b', null);
+  assert.equal(argv[4], 'Merge b: (no value summary)');
+});
+
+// ---- 1b. task 916: "#NNN" never reaches a GitHub-rendered commit message ----
+// GitHub autolinks bare "#NNN" in commit subjects to its OWN PR/issue number
+// space — a dead link for GDS task ids. ship.js de-#s commit/PR-bound text.
+
+test('sanitizeGitHubRefs: "#NNN" becomes "task NNN"; non-refs untouched', () => {
+  assert.equal(ship.sanitizeGitHubRefs('#914 straw hat (see #641)'),
+    'task 914 straw hat (see task 641)');
+  assert.equal(ship.sanitizeGitHubRefs('no refs here'), 'no refs here');
+  assert.equal(ship.sanitizeGitHubRefs(null), '');
+  // 6+ digits is not a task id (and #123456 could be a real cross-repo ref).
+  assert.equal(ship.sanitizeGitHubRefs('#123456'), '#123456');
+});
+
+test('buildMergeArgv: task refs in the summary are de-#-ed in the merge message', () => {
+  const argv = ship.buildMergeArgv('claude/x', '#914 straw hat + duck (#641 follow-up)');
+  assert.equal(argv[4], 'Merge claude/x: task 914 straw hat + duck (task 641 follow-up)');
+});
+
+// ---- 2. gitArgvOk merge with injection payload does NOT execute it ----
+
+test('gitArgvOk: a $(...) payload in value_summary is NOT executed during merge', () => {
+  const { dir } = makeRepo();
+  const sentinel = path.join(dir, 'PWNED');
+  try {
+    // If the summary were interpolated into a shell command, this would create
+    // the sentinel file. With argv + no shell it is just commit-message text.
+    const summary = `pwn $(touch ${JSON.stringify(sentinel)}) \`touch ${sentinel}\``;
+    const argv = ship.buildMergeArgv('feature', summary);
+    const ok = ship.gitArgvOk(argv, { cwd: dir, stdio: 'pipe' });
+    assert.equal(ok, true, 'merge should succeed');
+    assert.ok(!fs.existsSync(sentinel), 'injection payload must NOT have executed');
+    // And the payload survives verbatim in the merge commit message.
+    const msg = execFileSync('git', ['-C', dir, 'log', '-1', '--pretty=%B'], { encoding: 'utf8' });
+    assert.ok(msg.includes('$(touch'), 'payload text should land literally in the commit message');
+    // The merge actually happened — feature.txt is now on main.
+    assert.ok(fs.existsSync(path.join(dir, 'feature.txt')), 'feature branch should be merged');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('gitArgvOk: a caller passing { shell: true } CANNOT re-enable the shell', () => {
+  // The no-shell guarantee must not be overridable via opts — gitArgvOk forces
+  // shell:false AFTER the spread. Prove a hostile/buggy `{ shell: true }` opt is
+  // ignored: the payload still must not execute. (Grader #681 Hacker finding.)
+  const { dir } = makeRepo();
+  const sentinel = path.join(dir, 'SHELL-TRUE-PWNED');
+  try {
+    const summary = `pwn $(touch ${JSON.stringify(sentinel)})`;
+    const argv = ship.buildMergeArgv('feature', summary);
+    const ok = ship.gitArgvOk(argv, { cwd: dir, stdio: 'pipe', shell: true });
+    assert.equal(ok, true, 'merge should still succeed');
+    assert.ok(!fs.existsSync(sentinel), 'shell:true opt must NOT re-enable shell interpretation');
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('gitArgvOk: returns false on a failing git command (no throw)', () => {
+  const { dir } = makeRepo();
+  try {
+    // merging a non-existent branch fails cleanly → false, not an exception.
+    assert.equal(ship.gitArgvOk(['merge', 'no-such-branch'], { cwd: dir, stdio: 'pipe' }), false);
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+// ---- 3. Contrast: the OLD shell-string approach WOULD have executed it ----
+
+test('contrast: the pre-fix shell-string build DOES execute the payload (documents the bug)', () => {
+  const { dir } = makeRepo();
+  const sentinel = path.join(dir, 'OLD-PWNED');
+  try {
+    // Reconstruct the exact vulnerable construction the fix removed:
+    //   `git merge --no-ff ${branch} -m "${mergeMsg.replace(/"/g, '\\"')}"`
+    const summary = `x $(touch ${sentinel})`;
+    const mergeMsg = `Merge feature: ${summary}`;
+    const vulnerableCmd = `git merge --no-ff feature -m "${mergeMsg.replace(/"/g, '\\"')}"`;
+    execSync(vulnerableCmd, { cwd: dir, stdio: 'pipe' });
+    // The $(...) ran under the shell — proving the original code was injectable.
+    assert.ok(
+      fs.existsSync(sentinel),
+      'old shell-string path should have executed the payload (this is the bug the fix closes)'
+    );
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+console.log(`\nautoMerge shell-injection (#681) tests: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/tests/ship_broadcast_routing.mjs

@@ -0,0 +1,125 @@
+// tests/ship_broadcast_routing.mjs
+//
+// Regression test for the security-sensitive ship-broadcast routing in ship.js
+// chooseBroadcastTargets (task 990).
+//
+// The owner requirement: "Security updates should only be posted to Archons and
+// live in a separate Discord ship-feed channel." chooseBroadcastTargets is the
+// PURE decision point — given a shipped task's security flag, it returns the
+// list of { channel, line } pairs the deploy step posts. This test proves:
+//   1. security_sensitive=true  → ONLY the Archon-only #security-ship-feed.
+//   2. security_sensitive=false → the builder #ship-feed only. (#ship-news is
+//      PAUSED — task 1749 / idea 458 — so a ship announces exactly once.)
+//   3. a falsy summary          → [] (the long-standing no-summary, no-broadcast).
+//   4. the security branch can NEVER return ship_news / ship_feed, for ANY
+//      taskId/summary — the load-bearing safety property (a leak here discloses
+//      an unpatched exploit on a public channel).
+//
+// Run:  node tests/ship_broadcast_routing.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+
+const PUBLIC_CHANNELS = new Set(['ship_news', 'ship_feed']);
+
+// ---- 1. security_sensitive → ONLY #security-ship-feed ----
+
+test('security_sensitive=true → exactly one target, the Archon-only channel', () => {
+  const targets = ship.chooseBroadcastTargets({
+    securitySensitive: true,
+    taskId: 990,
+    summary: 'patched the credit-theft hole',
+  });
+  assert.deepEqual(targets, [
+    { channel: 'security_ship_feed', line: '#990 shipped (security) — patched the credit-theft hole' },
+  ]);
+});
+
+test('security_sensitive=true NEVER posts to a public channel', () => {
+  const targets = ship.chooseBroadcastTargets({
+    securitySensitive: true,
+    taskId: 7,
+    summary: 'x',
+  });
+  for (const { channel } of targets) {
+    assert.ok(!PUBLIC_CHANNELS.has(channel), `security branch must not return public channel '${channel}'`);
+  }
+});
+
+// ---- 2. non-security → #ship-feed only (#ship-news paused, task 1749) ----
+
+test('security_sensitive=false → #ship-feed only (#id prefix); #ship-news paused', () => {
+  const targets = ship.chooseBroadcastTargets({
+    securitySensitive: false,
+    taskId: 669,
+    summary: 'the keeper has a name now',
+  });
+  assert.deepEqual(targets, [
+    { channel: 'ship_feed', line: '#669 shipped — the keeper has a name now' },
+  ]);
+});
+
+test('undefined securitySensitive falls through to the public path (#ship-feed only, #ship-news paused)', () => {
+  const targets = ship.chooseBroadcastTargets({
+    taskId: 42,
+    summary: 'routine fix',
+  });
+  assert.deepEqual(targets.map((t) => t.channel), ['ship_feed']);
+});
+
+// ---- 3. empty/falsy summary → no broadcast ----
+
+test('falsy summary → [] (no broadcast), regardless of the security flag', () => {
+  assert.deepEqual(ship.chooseBroadcastTargets({ securitySensitive: false, taskId: 1, summary: '' }), []);
+  assert.deepEqual(ship.chooseBroadcastTargets({ securitySensitive: true, taskId: 1, summary: '' }), []);
+  assert.deepEqual(ship.chooseBroadcastTargets({ securitySensitive: true, taskId: 1, summary: null }), []);
+  assert.deepEqual(ship.chooseBroadcastTargets({ securitySensitive: true, taskId: 1, summary: undefined }), []);
+});
+
+// ---- 4. exhaustive: the security branch is leak-proof across many inputs ----
+
+test('exhaustive: security_sensitive=true never leaks to ship_news/ship_feed for any id/summary', () => {
+  const summaries = ['x', 'a long-ish value summary with spaces', '#641 cross-ref in summary', '🛡️ unicode'];
+  for (const taskId of [1, 42, 990, 123456]) {
+    for (const summary of summaries) {
+      const targets = ship.chooseBroadcastTargets({ securitySensitive: true, taskId, summary });
+      assert.equal(targets.length, 1, 'security ship posts to exactly one channel');
+      assert.equal(targets[0].channel, 'security_ship_feed');
+      for (const { channel } of targets) {
+        assert.ok(!PUBLIC_CHANNELS.has(channel));
+      }
+    }
+  }
+});
+
+// ---- purity: same input → deeply-equal output, no shared mutable state ----
+
+test('pure: repeated calls return independent, deeply-equal arrays', () => {
+  const args = { securitySensitive: false, taskId: 5, summary: 's' };
+  const a = ship.chooseBroadcastTargets(args);
+  const b = ship.chooseBroadcastTargets(args);
+  assert.deepEqual(a, b);
+  a[0].channel = 'mutated';
+  // Mutating a returned array must not bleed into a fresh call's result.
+  assert.equal(ship.chooseBroadcastTargets(args)[0].channel, 'ship_feed');
+});
+
+console.log(`\nship broadcast routing (task 990) tests: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);