@bongos/core 1.17.1 → 1.17.2

package/tests/cutover_codemod.mjs

@@ -0,0 +1,184 @@
+// tests/cutover_codemod.mjs
+//
+// R89 cutover codemod (task 2159 [F1], task 2161 [F3]): rewrite HOST files' core-internal
+// require()s to @bongos/core/* subpaths at cutover. Guards the pure transform (quote-preserving,
+// idempotent, table-driven), the host-only scope oracle, the post-split precondition, and the
+// end-to-end plan over a simulated consumer tree.
+//
+// Run:  node tests/cutover_codemod.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const cm = require('../scripts/gds/cutover-codemod.js');
+const { rewriteCoreRequires, isHostFile, looksLikeConsumer, planCodemod, CORE_INTERNAL_MAP } = cm;
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); }
+}
+
+// ---- rewriteCoreRequires: the pure transform (F1 — module-api) --------------
+
+t('rewrites ../../src/module-api → @bongos/core/module-api', () => {
+  const r = rewriteCoreRequires(`const { pool } = require('../../src/module-api');`);
+  assert.equal(r.text, `const { pool } = require('@bongos/core/module-api');`);
+  assert.equal(r.changes.length, 1);
+  assert.equal(r.changes[0].key, 'module-api');
+});
+
+t('rewrites deeper ../../../src/module-api (routes depth) too', () => {
+  const r = rewriteCoreRequires(`const { registerProvider } = require('../../../src/module-api');`);
+  assert.equal(r.text, `const { registerProvider } = require('@bongos/core/module-api');`);
+});
+
+t('preserves double quotes', () => {
+  const r = rewriteCoreRequires(`const api = require("../../src/module-api");`);
+  assert.equal(r.text, `const api = require("@bongos/core/module-api");`);
+});
+
+t('is idempotent — a rewritten @bongos/core require is not matched again', () => {
+  const once = rewriteCoreRequires(`const api = require('../../src/module-api');`).text;
+  const twice = rewriteCoreRequires(once);
+  assert.equal(twice.text, once);
+  assert.equal(twice.changes.length, 0);
+});
+
+t('leaves an npm/sibling require untouched', () => {
+  const src = `const express = require('express');\nconst helper = require('./helper');\n`;
+  const r = rewriteCoreRequires(src);
+  assert.equal(r.text, src);
+  assert.equal(r.changes.length, 0);
+  assert.equal(r.unmapped.length, 0);
+});
+
+t('trailing member access is preserved (only the require() call is replaced)', () => {
+  const r = rewriteCoreRequires(`const pool = require('../../src/module-api').pool;`);
+  assert.equal(r.text, `const pool = require('@bongos/core/module-api').pool;`);
+});
+
+t('an UNMAPPED core-internal require is left unchanged AND reported', () => {
+  // A core internal NOT in the table (host code should never import it raw) — flagged, not guessed.
+  const src = `const brand = require('../../src/branding');`;
+  const r = rewriteCoreRequires(src);
+  assert.equal(r.text, src, 'must not guess a specifier for an unmapped internal');
+  assert.equal(r.changes.length, 0);
+  assert.equal(r.unmapped.length, 1);
+  assert.equal(r.unmapped[0].key, 'branding');
+});
+
+t('rewrites every mapped entry in the table', () => {
+  for (const [key, mapped] of Object.entries(CORE_INTERNAL_MAP)) {
+    const r = rewriteCoreRequires(`require('../../src/${key}')`);
+    assert.equal(r.text, `require('@bongos/core/${mapped}')`, `key ${key}`);
+  }
+});
+
+// ---- F3 (task 2161): server.js core internals --------------------------------
+
+t('F3: rewrites server.js core internals from ./src/* form', () => {
+  assert.equal(rewriteCoreRequires(`const p = require('./src/bongos/api-path-404');`).text,
+    `const p = require('@bongos/core/bongos/api-path-404');`);
+  assert.equal(rewriteCoreRequires(`const u = require('./src/bongos/uptime-poller');`).text,
+    `const u = require('@bongos/core/bongos/uptime-poller');`);
+  assert.equal(rewriteCoreRequires(`const l = require('./src/module-loader/loader');`).text,
+    `const l = require('@bongos/core/module-loader/loader');`);
+  assert.equal(rewriteCoreRequires(`const m = require('./src/modules');`).text,
+    `const m = require('@bongos/core/modules');`);
+  assert.equal(rewriteCoreRequires(`const s = require('./src/module-seams');`).text,
+    `const s = require('@bongos/core/module-seams');`);
+});
+
+t('F3: serve-internal maps to its curated export name, NOT ./bongos/serve-internal', () => {
+  // The file is src/bongos/serve-internal.js but the package exports it as ./serve-internal.
+  const r = rewriteCoreRequires(`const { mountInternalSurfaces } = require('./src/bongos/serve-internal');`);
+  assert.equal(r.text, `const { mountInternalSurfaces } = require('@bongos/core/serve-internal');`);
+});
+
+// ---- scope oracle -----------------------------------------------------------
+
+t('isHostFile is true only when isPublishable(rel) === false', () => {
+  const fakePub = (rel) => rel.startsWith('src/') || rel.startsWith('modules/lifecycle/');
+  assert.equal(isHostFile('modules/game/db.js', fakePub), true);
+  assert.equal(isHostFile('server.js', fakePub), true);
+  assert.equal(isHostFile('modules/lifecycle/db.js', fakePub), false);
+  assert.equal(isHostFile('src/module-api.js', fakePub), false);
+});
+
+// ---- precondition -----------------------------------------------------------
+
+t('looksLikeConsumer: false in the monolith (src/module-api.js present), true post-split', () => {
+  const monolith = looksLikeConsumer('/repo', { existsFn: (p) => p.endsWith('/src/module-api.js') });
+  const consumer = looksLikeConsumer('/repo', { existsFn: () => false });
+  assert.equal(monolith, false);
+  assert.equal(consumer, true);
+});
+
+// ---- planCodemod over a simulated consumer tree -----------------------------
+
+t('planCodemod rewrites host files, skips core files, reports unmapped', () => {
+  // A fake post-split consumer: host modules + server.js kept; a core module also present
+  // (as if partition had not yet run) to prove the scope oracle skips it regardless.
+  const tree = {
+    'modules/game/db.js': `const { pool } = require('../../src/module-api');`,
+    'modules/art-pipeline/routes/art-key.js': `const api = require('../../../src/module-api');`,
+    'server.js': `const seams = require('./src/module-seams');`,               // F3 — now mapped → rewritten
+    'modules/game/experimental.js': `const b = require('../../src/branding');`, // unmapped → reported, not rewritten
+    'modules/lifecycle/db.js': `const api = require('../../src/module-api');`,   // CORE — must be skipped
+    'README.md': 'not a js file',
+  };
+  const fsImpl = {
+    readdirSync: (dir, opts) => {
+      // minimal shim: list immediate children of `dir` within the flat `tree`
+      const rootPrefix = '/consumer';
+      const rel = dir === rootPrefix ? '' : dir.slice(rootPrefix.length + 1);
+      const names = new Set();
+      for (const p of Object.keys(tree)) {
+        if (rel && !p.startsWith(rel + '/')) continue;
+        const rest = rel ? p.slice(rel.length + 1) : p;
+        const seg = rest.split('/')[0];
+        const isDir = rest.includes('/');
+        names.add(seg + (isDir ? '/' : ''));
+      }
+      return [...names].map((n) => {
+        const isDir = n.endsWith('/');
+        const name = isDir ? n.slice(0, -1) : n;
+        return { name, isDirectory: () => isDir, isFile: () => !isDir };
+      });
+    },
+    readFileSync: (abs) => tree[abs.slice('/consumer/'.length)],
+  };
+  const isPub = (rel) => rel.startsWith('modules/lifecycle/') || rel.startsWith('src/');
+  // Force the filesystem-walk path (no git) so the injected fake fs is exercised.
+  const runGit = () => { throw new Error('no git in test'); };
+  const plan = planCodemod({ root: '/consumer', fsImpl, runGit, isPublishableFn: isPub });
+
+  const changed = plan.files.map((f) => f.rel).sort();
+  assert.deepEqual(changed, ['modules/art-pipeline/routes/art-key.js', 'modules/game/db.js', 'server.js']);
+  // core module skipped even though it has the same relative require
+  assert.ok(!changed.includes('modules/lifecycle/db.js'), 'core module must be skipped');
+  // a host file with an UNMAPPED core internal is reported, never rewritten
+  assert.ok(!changed.includes('modules/game/experimental.js'), 'unmapped internal must not be rewritten');
+  assert.ok(plan.unmapped.some((u) => u.rel === 'modules/game/experimental.js' && u.key === 'branding'));
+  // the rewritten text is correct for both a host module (F1) and server.js (F3)
+  const game = plan.files.find((f) => f.rel === 'modules/game/db.js');
+  assert.equal(game.newText, `const { pool } = require('@bongos/core/module-api');`);
+  const srv = plan.files.find((f) => f.rel === 'server.js');
+  assert.equal(srv.newText, `const seams = require('@bongos/core/module-seams');`);
+});
+
+// ---- invariant: every mapped target is an actual @bongos/core export ---------
+
+t('every CORE_INTERNAL_MAP target is exported by the core package (a rewrite never outruns an export)', () => {
+  const { buildPackageJson } = require('../scripts/gds/package-core.js');
+  const pkg = buildPackageJson({ version: '0.0.0-test', sourceDeps: { express: '^4.0.0', pg: '^8.0.0' } });
+  for (const mapped of Object.values(CORE_INTERNAL_MAP)) {
+    assert.ok(pkg.exports[`./${mapped}`], `@bongos/core must export ./${mapped} (targeted by the codemod)`);
+  }
+});
+
+console.log(`\ncutover_codemod: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/device_flow_start.mjs

@@ -37,14 +37,37 @@ async function t(name, fn) {
   finally { globalThis.fetch = realFetch; }
 }
 
-await t('device_flow_disabled (HTTP 200 + error body) → throws an actionable, named error', async () => {
+await t('device_flow_disabled (HTTP 200 + error body) → throws an actionable error deep-linking the GitHub-App settings (task 2129)', async () => {
   stubFetch(200, { error: 'device_flow_disabled', error_description: 'Device Flow is not enabled for this app.' });
   await assert.rejects(
     () => auth.startDeviceFlow(),
-    (err) => /device_flow_disabled/.test(err.message) && /device-flow start/i.test(err.message),
+    (err) => /device_flow_disabled/.test(err.message)
+      && /device-flow start/i.test(err.message)
+      // creds client_id is Iv1.* (a GitHub App) → point at the Apps listing + the exact toggle.
+      && /github\.com\/settings\/apps/.test(err.message)
+      && /Enable Device Flow/i.test(err.message),
   );
 });
 
+await t('device_flow_disabled on an OAuth App (Ov* client_id) → deep-links OAuth developer settings, not /settings/apps (task 2129)', async () => {
+  const saved = {};
+  for (const p of ['GDS', 'OTB', 'CLOUDBONGOS']) {
+    saved[p] = process.env[`${p}_GITHUB_CLIENT_ID`];
+    process.env[`${p}_GITHUB_CLIENT_ID`] = 'Ov23liOAuthClientId0';
+  }
+  try {
+    stubFetch(200, { error: 'device_flow_disabled', error_description: 'Device Flow is not enabled for this app.' });
+    await assert.rejects(
+      () => auth.startDeviceFlow(),
+      (err) => /github\.com\/settings\/developers/.test(err.message)
+        && !/settings\/apps/.test(err.message)
+        && /Enable Device Flow/i.test(err.message),
+    );
+  } finally {
+    for (const p of ['GDS', 'OTB', 'CLOUDBONGOS']) process.env[`${p}_GITHUB_CLIENT_ID`] = saved[p];
+  }
+});
+
 await t('incorrect_client_credentials (HTTP 200 + error) → throws, names the error', async () => {
   stubFetch(200, { error: 'incorrect_client_credentials', error_description: 'The client_id is not valid.' });
   await assert.rejects(() => auth.startDeviceFlow(), (err) => /incorrect_client_credentials/.test(err.message));

package/tests/hook_core_resolve.mjs

@@ -0,0 +1,125 @@
+// tests/hook_core_resolve.mjs
+//
+// Task 2139 — the materialized .claude/hooks resolve CORE modules (src/bongos/*,
+// scripts/gds/*) in BOTH layouts: the repo root today, and the pinned @bongos/core
+// package post-split (ADR 0108). Before this, conductor.js's UNGUARDED
+// require('../../src/bongos/…') MODULE_NOT_FOUND'd on EVERY UserPromptSubmit once
+// src/ left the instance root; the guarded hooks silently killed their feature.
+//
+// _core-resolve.coreModulePathFrom(instanceRoot, rel) is the whole mechanism, so
+// it takes the root as an argument and this suite diverges it against synthetic
+// trees (impossible to prove with the real single checkout, where root == core).
+// Locks:
+//   1. finds a core file inside node_modules/@bongos/core when it is NOT at the
+//      repo root — the post-split consumer layout, the point of the task;
+//   2. repo root WINS when the file exists in both (today = byte-identical);
+//   3. absent in every layout → null (fresh clone → callers degrade, never crash);
+//   4. all three published core package names resolve;
+//   5. requireCore loads a real core module today + throws a tagged error when absent;
+//   6. conductor.js, loaded in a core-LESS instance root, does NOT crash and still
+//      emits its methodology nudges (the "conductor no longer hard-crashes" done-when).
+//
+// DB-free + no network → part of the unit gate. Run:  node tests/hook_core_resolve.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, mkdirSync, cpSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..');
+const resolver = require('../.claude/hooks/_core-resolve.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+// Build a throwaway instance root from { relPath: contents }.
+function makeTree(files) {
+  const root = mkdtempSync(join(tmpdir(), 'hook-core-'));
+  for (const [rel, body] of Object.entries(files)) {
+    const abs = join(root, rel);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, body);
+  }
+  return root;
+}
+
+// 1. Post-split: the core file exists ONLY inside the installed package.
+t('resolves a core module inside node_modules/@bongos/core (post-split layout)', () => {
+  const root = makeTree({ 'node_modules/@bongos/core/src/bongos/path-match.js': 'module.exports={};' });
+  const p = resolver.coreModulePathFrom(root, 'src/bongos/path-match');
+  assert.ok(p, 'expected a resolution');
+  assert.ok(p.includes(join('node_modules', '@bongos', 'core')), `expected a node_modules path, got ${p}`);
+});
+
+// 2. Priority: repo root wins when present in both (today's single checkout — unchanged).
+t('prefers the repo root when a core file exists at both root and node_modules', () => {
+  const root = makeTree({
+    'scripts/gds/cli-lib.js': 'module.exports={root:true};',
+    'node_modules/@bongos/core/scripts/gds/cli-lib.js': 'module.exports={pkg:true};',
+  });
+  const p = resolver.coreModulePathFrom(root, 'scripts/gds/cli-lib');
+  assert.ok(p && !p.includes('node_modules'), `expected the root copy, got ${p}`);
+});
+
+// 3. Absent everywhere → null (fresh clone pre-`npm install`; callers degrade).
+t('returns null when the core file exists in no layout', () => {
+  const root = makeTree({ 'README.md': '# empty instance' });
+  assert.equal(resolver.coreModulePathFrom(root, 'src/bongos/path-match'), null);
+});
+
+// 4. Every published core package name is honored (scoped-private, scoped-public, bare).
+for (const pkg of resolver.CORE_PKG_NAMES) {
+  t(`resolves via published package name "${pkg}"`, () => {
+    const root = makeTree({ [`node_modules/${pkg}/scripts/gds/x.js`]: 'module.exports={};' });
+    const p = resolver.coreModulePathFrom(root, 'scripts/gds/x.js');
+    const frag = join('node_modules', ...pkg.split('/'));
+    assert.ok(p && p.includes(frag), `expected "${frag}" in ${p}`);
+  });
+}
+
+// 5. requireCore: loads a real core module at the repo root today; throws tagged when absent.
+t('requireCore loads a real core module at the repo root today', () => {
+  const cli = resolver.requireCore('scripts/gds/cli-lib');
+  assert.equal(typeof cli.apiCall, 'function', 'expected cli-lib.apiCall');
+});
+t('requireCore throws CORE_MODULE_NOT_FOUND when the core module is absent', () => {
+  assert.throws(
+    () => resolver.requireCore('src/bongos/__does_not_exist_2139__'),
+    (e) => e && e.code === 'CORE_MODULE_NOT_FOUND',
+  );
+});
+
+// 6. The headline done-when: conductor.js in a core-LESS instance root does not crash
+//    and still emits methodology nudges (the sensitive-surface advisory degrades off).
+//    Runs in a child process with CLAUDE_PROJECT_DIR pointed at the core-less root so
+//    _core-resolve computes that root (this process's env points at the real repo).
+t('conductor.js in a core-less instance root does not crash and still nudges', () => {
+  const root = mkdtempSync(join(tmpdir(), 'hook-coreless-'));
+  const hooks = join(root, '.claude', 'hooks');
+  mkdirSync(hooks, { recursive: true });
+  cpSync(join(ROOT, '.claude', 'hooks', 'conductor.js'), join(hooks, 'conductor.js'));
+  cpSync(join(ROOT, '.claude', 'hooks', '_core-resolve.js'), join(hooks, '_core-resolve.js'));
+  const snippet =
+    `const c = require(${JSON.stringify(join(hooks, 'conductor.js'))});` +
+    `const out = c.evaluateTriggers({ changedFiles: ['src/bongos/sensitive-surfaces.js'], prompt: 'ship it', activeClaims: [] });` +
+    `process.stdout.write(JSON.stringify(out.map((a) => a.id)));`;
+  const stdout = execFileSync(process.execPath, ['-e', snippet], {
+    encoding: 'utf8',
+    env: { ...process.env, CLAUDE_PROJECT_DIR: root },
+  });
+  const ids = JSON.parse(stdout);
+  assert.ok(ids.includes('no-claim'), 'still emits the no-claim methodology nudge without the core');
+  assert.ok(ids.includes('ship-intent'), 'still emits the ship-intent nudge without the core');
+  assert.ok(!ids.includes('sensitive-surface'), 'sensitive-surface degrades off (isSensitive fallback) when the core is absent');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/infra_exec_paths.mjs

@@ -0,0 +1,104 @@
+// tests/infra_exec_paths.mjs — task 2137 (ADR 0108 configurable-root).
+//
+// Two proofs that the host systemd units resolve their CORE scripts in a consumer layout after the
+// R89 split:
+//   A. lint-infra-exec: every infra/*.service ExecStart that runs a core script goes through
+//      infra/core-node.sh AND names a PUBLISHABLE core file (ships in @bongos/core → present at
+//      node_modules/@bongos/core post-install) that also exists at the core root today. No unit
+//      still uses the bare repo-relative `node scripts/…` form.
+//   B. core-node.sh actually resolves both layouts: it prefers the instance root (monolith) and
+//      falls back to node_modules/@bongos/core (consumer), driven by $BONGOS_INSTANCE_ROOT.
+//
+// DB-free, no network. Run: node tests/infra_exec_paths.mjs
+
+import { strict as assert } from 'node:assert';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const { lintInfraExec } = require('../scripts/gds/lint-infra-exec.js');
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const REPO = path.resolve(__dirname, '..');
+const LAUNCHER = path.join(REPO, 'infra', 'core-node.sh');
+
+let passed = 0, failed = 0;
+function test(name, fn) {
+  try { fn(); console.log(`  ok  ${name}`); passed++; }
+  catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
+}
+
+// ---- A. the lint is green on the real tree, and covers all 11 core-script units ----------------
+test('lint-infra-exec: every core-script unit resolves in a consumer layout (publishable + present)', () => {
+  const r = lintInfraExec({ instanceRoot: REPO, coreRoot: REPO });
+  assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations)}`);
+  assert.ok(r.ok, 'lint should pass');
+  assert.equal(r.checked.length, 11, `expected all 11 core-script units repointed + resolving, got ${r.checked.length}`);
+  // The three core CLIs the units invoke are all covered.
+  const rels = new Set(r.checked.map((c) => c.rel));
+  for (const rel of ['scripts/gds/box.js', 'scripts/gds/provision.js', 'scripts/gds/search-ingest-db.js']) {
+    assert.ok(rels.has(rel), `expected a unit routing through ${rel}`);
+  }
+});
+
+test('lint-infra-exec: a bare repo-relative core ExecStart is flagged (counterfactual)', () => {
+  // Synthetic infra/ with the OLD form → must be reported as a violation.
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'infra-lint-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'infra'), { recursive: true });
+    fs.mkdirSync(path.join(tmp, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'box.js'), '// probe\n');
+    fs.writeFileSync(path.join(tmp, 'infra', 'legacy.service'),
+      '[Service]\nExecStart=/usr/bin/node scripts/gds/box.js run-intents --apply\n');
+    const r = lintInfraExec({ instanceRoot: tmp, coreRoot: tmp });
+    assert.ok(!r.ok, 'a bare repo-relative core ExecStart must fail the lint');
+    assert.equal(r.violations.length, 1);
+    assert.match(r.violations[0].why, /core-node\.sh/);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+// ---- B. the launcher resolves BOTH layouts ------------------------------------------------------
+function runLauncher(rel, instanceRoot) {
+  return execFileSync('bash', [LAUNCHER, rel], {
+    encoding: 'utf8',
+    env: { ...process.env, BONGOS_INSTANCE_ROOT: instanceRoot },
+  }).trim();
+}
+
+test('core-node.sh resolves the monolith layout (script at the instance root)', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cn-mono-'));
+  try {
+    fs.mkdirSync(path.join(tmp, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(tmp, 'scripts', 'gds', 'probe.js'), 'console.log("MONOLITH");\n');
+    assert.equal(runLauncher('scripts/gds/probe.js', tmp), 'MONOLITH');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('core-node.sh falls back to the consumer layout (script only under node_modules/@bongos/core)', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cn-cons-'));
+  try {
+    const pkgDir = path.join(tmp, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(pkgDir, { recursive: true });
+    fs.writeFileSync(path.join(pkgDir, 'probe.js'), 'console.log("CONSUMER");\n');
+    // No scripts/gds/probe.js at the instance root → the resolver must reach node_modules.
+    assert.equal(runLauncher('scripts/gds/probe.js', tmp), 'CONSUMER');
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('core-node.sh exits non-zero when the script is in NO layout', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cn-none-'));
+  let threw = false;
+  try {
+    execFileSync('bash', [LAUNCHER, 'scripts/gds/nope.js'], {
+      encoding: 'utf8', stdio: 'pipe', env: { ...process.env, BONGOS_INSTANCE_ROOT: tmp },
+    });
+  } catch (_) { threw = true; }
+  finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+  assert.ok(threw, 'expected a non-zero exit when the core script resolves in no layout');
+});
+
+console.log(`\ninfra_exec_paths: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/init.mjs

@@ -358,6 +358,53 @@ test('buildInstancePackageJson: preserves existing fields + never clobbers a cus
   assert.equal(pkg.dependencies[init.CORE_PKG], 'file:vendor/bongos-core-1.17.0.tgz'); // dep (re)pinned
 });
 
+// --- enabled-module dep composition (ADR 0138 / task 2160) --------------------
+
+test('enabledModuleDeps: merges only the ENABLED modules’ declared deps', () => {
+  const readDeps = (k) => ({
+    discord: { 'discord.js': '^14.26.4' },
+    game: { colyseus: '^0.16.5', phaser: '^3.87.0' },
+    'art-pipeline': { sharp: '^0.34.5' },
+  }[k] || {});
+  const merged = init.enabledModuleDeps(
+    { modules: { discord: true, game: false, 'art-pipeline': true, 'dev-box': false } },
+    { readDeps }
+  );
+  assert.deepEqual(merged, { 'discord.js': '^14.26.4', sharp: '^0.34.5' }); // game excluded (off)
+});
+
+test('enabledModuleDeps: no enabled modules → empty object', () => {
+  assert.deepEqual(init.enabledModuleDeps({ modules: { discord: false } }, { readDeps: () => ({ 'discord.js': '^14' }) }), {});
+});
+
+test('buildInstancePackageJson: composes moduleDeps (fills), but an existing pin WINS and core is always set', () => {
+  const existing = { dependencies: { 'discord.js': '^14.0.0', express: '^4' } }; // instance pinned discord.js older
+  const moduleDeps = { 'discord.js': '^14.26.4', sharp: '^0.34.5' };
+  const pkg = init.buildInstancePackageJson(existing, { name: 'demo', coreDep: 'file:x.tgz', moduleDeps });
+  assert.equal(pkg.dependencies['discord.js'], '^14.0.0');    // existing pin wins over the module range
+  assert.equal(pkg.dependencies.sharp, '^0.34.5');            // module dep fills what was missing
+  assert.equal(pkg.dependencies.express, '^4');               // untouched host dep preserved
+  assert.equal(pkg.dependencies[init.CORE_PKG], 'file:x.tgz'); // core always (re)set
+});
+
+test('buildInstancePackageJson: no moduleDeps → byte-identical to the pre-composition behavior', () => {
+  const existing = { dependencies: { express: '^4' } };
+  const a = init.buildInstancePackageJson(existing, { name: 'demo', coreDep: 'file:x.tgz' });
+  const b = init.buildInstancePackageJson(existing, { name: 'demo', coreDep: 'file:x.tgz', moduleDeps: {} });
+  assert.deepEqual(a.dependencies, b.dependencies);
+  assert.deepEqual(a.dependencies, { express: '^4', [init.CORE_PKG]: 'file:x.tgz' });
+});
+
+test('moduleDeclaredDeps: reads a module.json dependencies block; {} when absent', () => {
+  const readOk = (p) => JSON.stringify({ key: 'discord', dependencies: { 'discord.js': '^14.26.4' } });
+  assert.deepEqual(init.moduleDeclaredDeps('discord', { coreRoot: '/core', fsImpl: { readFileSync: readOk } }),
+    { 'discord.js': '^14.26.4' });
+  const readNone = () => JSON.stringify({ key: 'lifecycle', contributes: {} });
+  assert.deepEqual(init.moduleDeclaredDeps('lifecycle', { coreRoot: '/core', fsImpl: { readFileSync: readNone } }), {});
+  const readThrow = () => { throw new Error('ENOENT'); };
+  assert.deepEqual(init.moduleDeclaredDeps('ghost', { coreRoot: '/core', fsImpl: { readFileSync: readThrow } }), {});
+});
+
 test('writeConfigs (greenfield): mints package.json with the caret core dep + start/migrate scripts', () => {
   const dir = mkdtempSync(join(tmpdir(), 'greenfield-'));
   try {

package/tests/mirror_lineage_proof.mjs

@@ -22,6 +22,20 @@ test('migrationNumbersFromPaths picks CORE migrations only (not module/ADR numbe
   assert.deepEqual([...set].sort((a, b) => a - b), [3, 44, 60]);
 });
 
+test('migrationNumbersFromPaths excludes migrations/instance/ seeds (task 2152)', () => {
+  // migrations/instance/*.sql are this instance's host seeds (ADR 0105), excluded from
+  // the publishable mirror (task 2140). Counting them as core put every instance seed in
+  // the PRIVATE set but not the MIRROR set → a false private⇄mirror divergence that
+  // red-lined the unit gate. Only the bare top-level core migration counts.
+  const set = migrationNumbersFromPaths([
+    'migrations/080_core_thing.sql',                    // bare core → counted
+    'migrations/instance/080_gds_v4_planning_seed.sql', // instance seed → NOT core
+    'migrations/instance/186_governance_seed.sql',      // instance seed → NOT core
+    'migrations/core_192_namespaced.sql',               // core_ prefix ≠ bare NNN_ form → not counted either
+  ]);
+  assert.deepEqual([...set].sort((a, b) => a - b), [80]);
+});
+
 test('parseEnumChecks extracts the quoted value-lists from CHECK (... IN (...))', () => {
   const sql = `
     CREATE TABLE tasks (

package/tests/module_loader.mjs

@@ -84,6 +84,48 @@ test('discoverModules: a missing modules/ root is empty, not an error', () => {
   assert.deepEqual(r, { loaded: [], skipped: [], errors: [] });
 });
 
+// --- task 2133 (R89-prereq): TWO-ROOT discovery. DEFAULT_ROOTS spans the core
+//     package's modules/ AND the consumer/instance's modules/, deduped by
+//     resolved path so a single checkout (roots coincide) never double-scans. ---
+
+test('discoverModules: UNIONs modules across two diverged roots (the post-split shape)', () => {
+  const core = fixtureRoot({ 'core-mod': { manifest: validManifest('core-mod') } });
+  const instance = fixtureRoot({ 'inst-mod': { manifest: validManifest('inst-mod') } });
+  const { loaded, errors, skipped } = loader.discoverModules({ roots: [core, instance], core: '1.0.0' });
+  assert.deepEqual(loaded.map((m) => m.key).sort(), ['core-mod', 'inst-mod'], 'both roots contribute');
+  assert.deepEqual(errors, []);
+  assert.deepEqual(skipped, []);
+});
+
+test('discoverModules: scanning the SAME root twice makes every key a duplicate-key ERROR (why dedupeRoots exists)', () => {
+  const root = fixtureRoot({ 'only-mod': { manifest: validManifest('only-mod') } });
+  const { loaded, errors } = loader.discoverModules({ roots: [root, root], core: '1.0.0' });
+  assert.equal(loaded.length, 1, 'the first scan loads it');
+  assert.equal(errors.length, 1, 'the second scan of the identical root is a duplicate-key error');
+  assert.match(errors[0].errors[0], /duplicate module key/);
+});
+
+test('dedupeRoots: collapses roots that resolve to the same path, preserving order', () => {
+  assert.deepEqual(
+    loader.dedupeRoots(['/a/modules', '/a/modules', '/b/modules']),
+    ['/a/modules', '/b/modules'],
+  );
+  assert.deepEqual(loader.dedupeRoots(['/a/modules', '/a/./modules']), ['/a/modules'], 'normalizes before comparing');
+  assert.equal(loader.dedupeRoots(['/a/modules', '/b/modules']).length, 2, 'a genuinely diverged pair is kept');
+});
+
+test('DEFAULT_ROOTS is deduped → the single checkout scans no root twice (zero dup-key errors)', () => {
+  // In a single checkout resolveInstanceRoot() falls back to cwd === resolveCoreRoot(),
+  // so the two candidate roots are identical and MUST collapse to one (a diverged
+  // consumer repo keeps both). The invariant: no resolved path appears twice.
+  const resolved = loader.DEFAULT_ROOTS.map((r) => path.resolve(r));
+  assert.equal(new Set(resolved).size, resolved.length, 'DEFAULT_ROOTS has no duplicate resolved paths');
+  loader._reset();
+  const snap = loader.loaderSnapshot();
+  assert.deepEqual(snap.errors, [], 'default-root discovery yields zero errors (no duplicate-key)');
+  loader._reset();
+});
+
 test('discoveredRegistry: shapes a loaded manifest like a MODULE_REGISTRY entry', () => {
   loader._reset();
   const root = fixtureRoot({ econ: { manifest: validManifest('econ', { default: true, provides: ['reward'], contributes: { disciplines: ['x'] } }) } });

package/tests/module_manifest.mjs

@@ -192,3 +192,22 @@ test('an empty-string attribution field is rejected', () => {
   assert.equal(r.valid, false);
   assert.ok(r.errors.some((e) => e.startsWith('author')));
 });
+
+// --- optional runtime dependencies (ADR 0138 / task 2160) ---
+
+test('dependencies: a valid { name: range } object passes', () => {
+  const r = validateManifest({ ...baseManifest(), dependencies: { 'discord.js': '^14.26.4' } });
+  assert.equal(r.valid, true, r.errors.join('; '));
+});
+
+test('dependencies: omitted is fine (optional)', () => {
+  assert.equal(validateManifest(baseManifest()).valid, true);
+});
+
+test('dependencies: a non-object, or a non-string range, is rejected', () => {
+  for (const bad of [['discord.js'], 'discord.js@14', { 'discord.js': 14 }, { '': '^1' }]) {
+    const r = validateManifest({ ...baseManifest(), dependencies: bad });
+    assert.equal(r.valid, false, `should reject ${JSON.stringify(bad)}`);
+    assert.ok(r.errors.some((e) => e.startsWith('dependencies')), `error should mention dependencies: ${r.errors}`);
+  }
+});

package/tests/onboard.mjs

@@ -117,3 +117,16 @@ test('the web forms (/create + hall wizard) declare EXACTLY the canonical human
     assert.deepEqual(uniq, humanKeys, `${name} (${rel}) must tag exactly the canonical human steps [${humanKeys}], found [${uniq}]`);
   }
 });
+
+test('the one-click GitHub-App manifest path surfaces the CLI-only Enable-Device-Flow step (task 2129)', () => {
+  // GitHub defaults Device Flow OFF and the manifest can't enable it, but `bongos login` needs
+  // it — so BOTH manifest surfaces must tell the owner to enable it after the one-click approval.
+  // Assert on a phrase DISTINCT to the one-click caveat: the manual OAuth path already mentions
+  // Device Flow (task 2127), so a bare "Device Flow" match wouldn't prove the manifest path carries it.
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const onboardSrc = readFileSync(path.join(import.meta.dirname, '..', 'scripts/gds/onboard.js'), 'utf8');
+  const wizardSrc = readFileSync(path.join(import.meta.dirname, '..', 'modules/hall-ui/public/new-project-wizard.js'), 'utf8');
+  assert.match(onboardSrc, /cannot enable Device Flow via the manifest/i, 'bongos onboard one-click caveat missing');
+  assert.match(wizardSrc, /Terminal CLI only: after approving, enable/i, 'hall wizard one-click caveat missing');
+});

package/tests/package_core.mjs

@@ -366,6 +366,14 @@ t('buildPackageJson: prunes to express+pg, keeps the source ranges + the undici
   assert.equal(pkg.exports['.'], './src/platform-server.js');
   assert.equal(pkg.exports['./serve-internal'], './src/bongos/serve-internal.js');
   assert.equal(pkg.exports['./module-api'], './src/module-api.js');
+  // rehearsal F3 / task 2161 — the game-host kit: the core internals a game-bearing
+  // instance's own entrypoint (server.js) wires. The cutover codemod rewrites server.js's
+  // relative ./src/* requires to exactly these subpaths, so they MUST be exported.
+  assert.equal(pkg.exports['./bongos/api-path-404'], './src/bongos/api-path-404.js');
+  assert.equal(pkg.exports['./bongos/uptime-poller'], './src/bongos/uptime-poller.js');
+  assert.equal(pkg.exports['./module-loader/loader'], './src/module-loader/loader.js');
+  assert.equal(pkg.exports['./modules'], './src/modules.js');
+  assert.equal(pkg.exports['./module-seams'], './src/module-seams.js');
   // task 2089 / ADR 0134 — the synthesized package publishes PRIVATE by default.
   assert.deepEqual(pkg.publishConfig, { access: 'restricted' });
 });