@bongos/core 1.18.19 → 1.19.2

package/tests/ship_smoke_gate.mjs

@@ -0,0 +1,76 @@
+// tests/ship_smoke_gate.mjs
+//
+// task 1002605 (choke-point map finding G-18): a FAILED production smoke run used
+// to fall silently through into the claim resolve — the claim was consumed, the
+// grader silently skipped, the task parked at 'completed', and ship.js exited 0
+// printing "Done." The fix aborts BEFORE the resolve (claim intact) unless the
+// builder passes --allow-smoke-fail, and both paths now say exactly what happened.
+// This pins the loudness contract via the pure smokeGateMessages export, so a
+// future edit can't quietly regress the gate back to silence.
+//
+// Run:  node tests/ship_smoke_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { smokeGateMessages } = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  PASS  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL  ${name}`);
+    console.log(`        ${err.message}`);
+  }
+}
+
+const m = smokeGateMessages(1234);
+const abortText = m.abort.join('\n');
+const parkedText = m.parked.join('\n');
+
+t('abort: says the ship ABORTED because smoke FAILED', () => {
+  assert.match(abortText, /ABORTED/);
+  assert.match(abortText, /smoke test FAILED/);
+});
+
+t('abort: says the claim is still active and nothing changed', () => {
+  assert.match(abortText, /claim is still active/);
+  assert.match(abortText, /No claim resolved/);
+});
+
+t('abort: names the re-run and the deliberate --allow-smoke-fail continuation', () => {
+  assert.match(abortText, /ship\.js 1234(?!\S)/);
+  assert.match(abortText, /ship\.js 1234 --allow-smoke-fail/);
+});
+
+t('abort: explains the smoke suite hits live endpoints (the change is not deployed yet)', () => {
+  assert.match(abortText, /LIVE endpoints/);
+  assert.match(abortText, /not deployed yet/);
+});
+
+t('parked: names the deliberate stop, the exact status, and that nothing was paid', () => {
+  assert.match(parkedText, /--allow-smoke-fail/);
+  assert.match(parkedText, /Task #1234 is parked at 'completed'/);
+  assert.match(parkedText, /ungraded/);
+  assert.match(parkedText, /no credits/i);
+});
+
+t('parked: names the resume path (--regrade)', () => {
+  assert.match(parkedText, /ship\.js 1234 --regrade/);
+});
+
+t('both message sets are non-empty arrays of strings (printable as-is)', () => {
+  for (const set of [m.abort, m.parked]) {
+    assert.ok(Array.isArray(set) && set.length > 0);
+    for (const line of set) assert.equal(typeof line, 'string');
+  }
+});
+
+console.log(`\nship smoke gate (task 1002605): ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/versions_route.mjs

@@ -28,6 +28,7 @@ const VERSIONS_POST_SCHEMA = {
   id: { required: true, type: 'string', maxLength: 64, minLength: 1 },
   name: { required: true, type: 'string', maxLength: 200, minLength: 1 },
   status: { type: 'string', maxLength: 32 },
+  track: { type: 'string', maxLength: 16 },
   done_when: { type: 'string', maxLength: 8000 },
   scope_doc_path: { type: 'string', maxLength: 256 },
   criteria: { type: 'array', maxItems: 100 },
@@ -62,6 +63,20 @@ test('INIT: unknown extra fields pass through (forward-compat)', () => {
   assert.equal(validate({ id: 'V1', name: 'x', future_field: 42 }, VERSIONS_POST_SCHEMA), null);
 });
 
+// versions.track is NOT NULL with no DB default (migration 003) — the create
+// path must accept it so callers can choose, and default it so omitting it can
+// never again 500 the route (the @bongos/core 1.18.18 `bongos init` blocker).
+test('INIT: explicit track passes the schema guard (both tracks)', () => {
+  assert.equal(validate({ id: 'V1', name: 'x', track: 'product' }, VERSIONS_POST_SCHEMA), null);
+  assert.equal(validate({ id: 'GDS-V5', name: 'x', track: 'internal' }, VERSIONS_POST_SCHEMA), null);
+});
+
+test('BAD: non-string track → structured 400 shape, not a DB 500', () => {
+  const r = validate({ id: 'V1', name: 'x', track: 42 }, VERSIONS_POST_SCHEMA);
+  assert.ok(r);
+  assert.ok(r.details.some((d) => d.field === 'track'));
+});
+
 // ---- BAD shapes must return a structured 400, never throw / 500 ----
 test('BAD: missing id → missing', () => {
   const r = validate({ name: 'x' }, VERSIONS_POST_SCHEMA);

package/tests/workflow_exec_paths.mjs

@@ -23,14 +23,26 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.resolve(__dirname, '..');
 const CORE_PATH_SH = path.join(REPO, 'infra', 'core-path.sh');
 
+// infra/ + the gate workflows under .github/ are HOST topology (publish-manifest.js
+// PROTECTED_TOPOLOGY_EXCLUDE) — absent from a neutral core checkout (task 1002470).
+// The real-tree checks only mean something where that tree exists; the synthetic
+// counterfactual below always runs.
+const HAS_GATE_WORKFLOWS = fs.existsSync(path.join(REPO, '.github', 'workflows', 'gate-review.yml'));
+const HAS_CORE_PATH = fs.existsSync(CORE_PATH_SH);
+
 let passed = 0, failed = 0;
 function test(name, fn) {
   try { fn(); console.log(`  ok  ${name}`); passed++; }
   catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
 }
 
+function hostTest(name, present, fn) {
+  if (!present) { console.log(`  skip ${name} — the host topology it reads is absent in this checkout`); return; }
+  test(name, fn);
+}
+
 // ---- A. the workflow lint is green on the real tree ---------------------------------------------
-test('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', () => {
+hostTest('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', HAS_GATE_WORKFLOWS, () => {
   const r = lintWorkflowExec({ instanceRoot: REPO, coreRoot: REPO });
   assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations, null, 2)}`);
   assert.ok(r.ok, 'lint should pass');
@@ -63,7 +75,7 @@ function runCorePath(rel, instanceRoot) {
   }).trim();
 }
 
-test('core-path.sh prints the monolith path (script at the instance root)', () => {
+hostTest('core-path.sh prints the monolith path (script at the instance root)', HAS_CORE_PATH, () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cp-mono-'));
   try {
     fs.mkdirSync(path.join(tmp, 'scripts'), { recursive: true });
@@ -72,7 +84,7 @@ test('core-path.sh prints the monolith path (script at the instance root)', () =
   } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
 });
 
-test('core-path.sh falls back to the consumer path (script only under node_modules/@bongos/core)', () => {
+hostTest('core-path.sh falls back to the consumer path (script only under node_modules/@bongos/core)', HAS_CORE_PATH, () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cp-cons-'));
   try {
     const pkg = path.join(tmp, 'node_modules', '@bongos', 'core', 'scripts');
@@ -82,7 +94,7 @@ test('core-path.sh falls back to the consumer path (script only under node_modul
   } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
 });
 
-test('core-path.sh exits non-zero (no stdout) when the script is in NO layout', () => {
+hostTest('core-path.sh exits non-zero (no stdout) when the script is in NO layout', HAS_CORE_PATH, () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cp-none-'));
   let threw = false;
   try {

package/tests/worktree_guard.mjs

@@ -9,9 +9,10 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const { decideWorktreeGuard, isUnder } = require('../.claude/hooks/worktree-guard.js');
+const { decideWorktreeGuard, isUnder } = requireHostModule(require, '../.claude/hooks/worktree-guard.js');
 
 let passed = 0;
 let failed = 0;