@bongos/core 1.18.19 → 1.19.3

package/tests/ship_broadcast_server.mjs

@@ -171,5 +171,67 @@ test('laptop deploy mode → never server-handled, even with server push (false)
   });
 });
 
-console.log(`\nship broadcast server (task 1045) tests: ${passed} passed, ${failed} failed`);
+// ---- 3. task 1002606: the strand notice (task.strand-flagged → Discord) ----
+// A strand previously had NO push channel — Discord fired only on task.shipped, so
+// a builder learned of a dead land at their next /builder-start, up to a session
+// later. These pin the poster the reconciler's task.strand-flagged listener fires.
+
+test('1002606 chooseStrandTargets: non-security strand → #ship-feed; line does NOT lead with #<id>', () => {
+  const t = shipBroadcast.chooseStrandTargets({ securitySensitive: false, taskId: 88, reason: 'strand:pr_closed_unmerged' });
+  assert.equal(t.length, 1);
+  assert.equal(t[0].channel, 'ship_feed');
+  assert.match(t[0].line, /task 88/);
+  assert.match(t[0].line, /strand:pr_closed_unmerged/);
+  // A LEADING #<id> is the applause marker (discord-reaction.parseShipMarker) —
+  // a strand must never collect 👍-votes as if it were shipped work.
+  assert.ok(!/^\s*#\d/.test(t[0].line), 'strand line must not start with a #<id> ship marker');
+});
+
+test('1002606 chooseStrandTargets: security strand → ONLY #security-ship-feed (reason can name an unpatched fix)', () => {
+  const t = shipBroadcast.chooseStrandTargets({ securitySensitive: true, taskId: 91, reason: 'strand:unresolvable_conflict:src/gds/auth.js' });
+  assert.equal(t.length, 1);
+  assert.equal(t[0].channel, 'security_ship_feed');
+  for (const { channel } of t) assert.ok(!PUBLIC_CHANNELS.has(channel));
+});
+
+await atest('1002606 postStrandNotice: posts to #ship-feed for a plain strand', async () => {
+  const { fn, calls } = fakePoster();
+  const res = await shipBroadcast.postStrandNotice(
+    { id: 88, builder_id: 7, security_sensitive: false, reason: 'strand:pr_closed_unmerged' },
+    { postWebhook: fn, log: quietLog }
+  );
+  assert.deepEqual(res.posted, ['ship_feed']);
+  assert.equal(calls.length, 1);
+  assert.match(calls[0].line, /task 88/);
+});
+
+await atest('1002606 postStrandNotice: indeterminate security flag → FAIL CLOSED (no post)', async () => {
+  for (const sec of [null, undefined, 'true', 1]) {
+    const { fn, calls } = fakePoster();
+    const res = await shipBroadcast.postStrandNotice(
+      { id: 9, security_sensitive: sec, reason: 'strand:x' },
+      { postWebhook: fn, log: quietLog }
+    );
+    assert.equal(calls.length, 0, `flag=${String(sec)} must suppress`);
+    assert.equal(res.skipped, 'security_flag_indeterminate');
+  }
+});
+
+await atest('1002606 postStrandNotice: best-effort — a throwing webhook never propagates; no task → no_task', async () => {
+  const boom = async () => { throw new Error('webhook down'); };
+  let threw = false;
+  let res;
+  try {
+    res = await shipBroadcast.postStrandNotice(
+      { id: 10, security_sensitive: false, reason: 'strand:y' },
+      { postWebhook: boom, log: quietLog }
+    );
+  } catch (_) { threw = true; }
+  assert.equal(threw, false, 'postStrandNotice must never throw');
+  assert.deepEqual(res.posted, [], 'a failed post is not recorded as posted');
+  const { fn } = fakePoster();
+  assert.equal((await shipBroadcast.postStrandNotice(null, { postWebhook: fn, log: quietLog })).skipped, 'no_task');
+});
+
+console.log(`\nship broadcast server (task 1045 + 1002606) tests: ${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);

package/tests/ship_card.mjs

@@ -105,6 +105,72 @@ test('confirmed: info tone, auto-landing deploy, merge-mode override action', ()
   assert.equal(m.action.cmd, '/merge-mode');               // kept as an optional manual override
 });
 
+// ---- task 1002541: the card must never claim a bailed merge is landing ----
+//
+// The bug: deployText came from the STATUS alone, so a 'confirmed' task printed
+// "landing automatically" even when auto-merge had already given up — no PR, no
+// merge, and (ADR 0120, pay on land) no credits. The failure announced itself as
+// success, which is why these strands survived for days.
+const bailed = {
+  ...shippedInput,
+  postGradeStatus: 'confirmed',
+  land: { ok: false, pending: false, reason: 'the main checkout is on claude/foo, not main', nextStep: '/merge-mode' },
+};
+
+test('confirmed + bailed land: says NOT landed, names the reason, warns', () => {
+  const m = card.buildCardModel(bailed);
+  assert.equal(m.stage, 'confirmed');
+  assert.equal(row(m, 'Deploy'), 'NOT landed — the main checkout is on claude/foo, not main');
+  assert.equal(m.cfg.tone, 'warning');           // not the reassuring 'info'
+  assert.equal(m.cfg.statusWord, 'Not landed');
+  assert.match(m.cfg.headline(1266), /NOT landed/);
+});
+
+test('confirmed + bailed land: the bail reaches the printed monospace card', () => {
+  // The monospace card is the ALWAYS-printed fallback (headless, cron, dev box).
+  // If the reason stops at the model, the builder still never sees it.
+  const out = card.renderMonospaceCard(card.buildCardModel(bailed));
+  assert.match(out, /NOT landed/);
+  assert.ok(!/landing automatically/.test(out), 'the lie must not survive anywhere on the card');
+});
+
+test('confirmed + bailed land: the action is the bail-specific recovery command', () => {
+  const m = card.buildCardModel({
+    ...bailed,
+    land: { ok: false, pending: false, reason: 'no commits ahead of main', nextStep: 'node scripts/gds/ship.js 7 --db-only' },
+  });
+  assert.equal(m.action.cmd, 'node scripts/gds/ship.js 7 --db-only'); // beats the generic /merge-mode
+});
+
+test('confirmed + PENDING land still reads "landing automatically"', () => {
+  // A poll timeout with auto-merge armed is success-PENDING (task 1049): CI or the
+  // server reconciler really does finish it. Crying failure here would be a NEW
+  // lie in the opposite direction, and would train builders to ignore the warning.
+  const m = card.buildCardModel({ ...bailed, land: { ok: false, pending: true, reason: null, nextStep: null } });
+  assert.equal(row(m, 'Deploy'), 'landing automatically');
+  assert.equal(m.cfg.tone, 'info');
+  assert.equal(m.cfg.statusWord, 'Confirmed');
+});
+
+test('confirmed with NO land info is unchanged (back-compat)', () => {
+  // Older land-watch breadcrumbs replay stored cardInputs that have no `land` key,
+  // and other callers (resumeMerge, the claim card) may pass none. Absent ⇒ the
+  // pre-existing behaviour, byte for byte.
+  const m = card.buildCardModel({ ...shippedInput, postGradeStatus: 'confirmed', land: null });
+  assert.equal(row(m, 'Deploy'), 'landing automatically');
+  assert.equal(m.cfg.tone, 'info');
+  assert.equal(m.action.cmd, '/merge-mode');
+});
+
+test('a stale bailed land never overrides a task that DID reach shipped', () => {
+  // land-watch replays the breadcrumb after the server lands it; the status is
+  // then 'shipped' and the old bail is history. The card must show live, not NOT-landed.
+  const m = card.buildCardModel({ ...bailed, postGradeStatus: 'shipped' });
+  assert.equal(m.stage, 'shipped');
+  assert.equal(row(m, 'Deploy'), 'live · 967fb4a');
+  assert.equal(m.cfg.tone, 'success');
+});
+
 test('failed: danger tone, no credits, issue count, regrade action', () => {
   const m = card.buildCardModel({
     ...shippedInput, postGradeStatus: 'completed',

package/tests/ship_ci_deploy.mjs

@@ -44,7 +44,7 @@ function test(name, fn) {
   }
 }
 
-const { parseDeployMode, effectiveDeployMode, buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded, shouldBailOnFetchFailure, classifyLandOutcome, strandNextStep, pickStaleGateReviewRun, landPollAfterAutoMerge, reconciledCardStatus } = ship;
+const { parseDeployMode, effectiveDeployMode, buildPrCreateArgv, buildPrMergeArgv, deployRunSucceeded, shouldBailOnFetchFailure, classifyLandOutcome, strandNextStep, pickStaleGateReviewRun, landPollAfterAutoMerge, reconciledCardStatus, landed, landPending, landBailed, strandCommand, landPendingLines } = ship;
 
 // ---- 1. parseDeployMode precedence + safe default ----
 
@@ -266,6 +266,44 @@ test('reconciledCardStatus: status read failed (null) → keep the pre-merge sta
   assert.equal(reconciledCardStatus(undefined, 'confirmed'), 'confirmed');
 });
 
+// ---- 3d. the land outcome: why this is a 3-way object, not a boolean ----
+// task 1002541. The land chain used to answer true/false, so every bail site's
+// precise reason was discarded and the card fell back to the STATUS — printing
+// "landing automatically" over a merge that had already given up.
+
+test('landBailed carries the reason + the recovery command', () => {
+  const o = landBailed('the main checkout is on claude/foo, not main', '/merge-mode');
+  assert.equal(o.ok, false);
+  assert.equal(o.pending, false);
+  assert.equal(o.reason, 'the main checkout is on claude/foo, not main');
+  assert.equal(o.nextStep, '/merge-mode');
+});
+
+test('THE TRAP: every outcome is truthy, so consumers must test .ok', () => {
+  // mergeAndDeploy's guard used to be `if (!merged) return;`. With objects that
+  // check NEVER fires, so a bailed ship would fall through and POST /ship for a
+  // task that never landed. This is the assertion that catches a re-introduction.
+  assert.ok(landBailed('nope', '/merge-mode'), 'a bail object is truthy — !merged cannot detect it');
+  assert.ok(landPending(), 'a pending object is truthy too');
+  assert.equal(landBailed('nope', '/merge-mode').ok, false);
+  assert.equal(landPending().ok, false);
+  assert.equal(landed().ok, true);
+});
+
+test('pending is NOT a bail: no reason, so the card keeps "landing automatically"', () => {
+  // A poll timeout with auto-merge armed is success-pending (task 1049) — it does
+  // land on its own. The card gates its warning on `reason`, so this stays quiet.
+  const o = landPending();
+  assert.equal(o.pending, true);
+  assert.equal(o.reason, null);
+});
+
+test('strandCommand: a box gets the resume, a laptop gets /merge-mode', () => {
+  // /merge-mode needs gh + a main checkout a dev box doesn't have (task 1052).
+  assert.equal(strandCommand(77, 'server'), 'node scripts/gds/ship.js 77');
+  assert.equal(strandCommand(77, 'local'), '/merge-mode');
+});
+
 test('reconciledCardStatus: already shipped stays shipped', () => {
   assert.equal(reconciledCardStatus('shipped', 'shipped'), 'shipped');
 });
@@ -506,6 +544,33 @@ test('effectiveDeployMode: tolerates a missing options object (defaults to no fa
   assert.equal(effectiveDeployMode('laptop'), 'ci'); // canPushLocally undefined ⇒ falsy ⇒ fall back
 });
 
+// ---- task 1002606: the success-pending banner carries the strand-detection story ----
+// Finding P-3: the banner ended at "This is NOT a failure", so when a land DID die
+// (hand-written conflict, dead PR, red check) the builder's last signal said all was
+// well. The banner must keep the reassurance AND say how a real failure reaches them.
+
+test('1002606 landPendingLines: keeps the "NOT a failure" reassurance + the resume command', () => {
+  const lines = landPendingLines(940).join('\n');
+  assert.match(lines, /NOT a failure/);
+  assert.match(lines, /node scripts\/gds\/ship\.js 940/, 'the resume command names THIS task');
+});
+
+test('1002606 landPendingLines: tells the builder how a strand WILL reach them (needs_rebase + /builder-start)', () => {
+  const lines = landPendingLines(940).join('\n');
+  assert.match(lines, /CANNOT land on its own/i, 'the failure story is present');
+  assert.match(lines, /needs_rebase/, 'names the flag the reconciler sets');
+  assert.match(lines, /\/builder-start/, 'names WHERE the warning appears');
+  assert.match(lines, /release/, 'names the release exit too');
+});
+
+test('1002606 landPendingLines: merged variant says deploy-only', () => {
+  const merged = landPendingLines(1, { merged: true }).join('\n');
+  assert.match(merged, /and the PR has merged/);
+  assert.match(merged, /GitHub will deploy automatically/);
+  const unmerged = landPendingLines(1, {}).join('\n');
+  assert.match(unmerged, /GitHub will merge \+ deploy automatically/);
+});
+
 console.log('');
 console.log(`ship_ci_deploy: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);

package/tests/ship_smoke_gate.mjs

@@ -0,0 +1,76 @@
+// tests/ship_smoke_gate.mjs
+//
+// task 1002605 (choke-point map finding G-18): a FAILED production smoke run used
+// to fall silently through into the claim resolve — the claim was consumed, the
+// grader silently skipped, the task parked at 'completed', and ship.js exited 0
+// printing "Done." The fix aborts BEFORE the resolve (claim intact) unless the
+// builder passes --allow-smoke-fail, and both paths now say exactly what happened.
+// This pins the loudness contract via the pure smokeGateMessages export, so a
+// future edit can't quietly regress the gate back to silence.
+//
+// Run:  node tests/ship_smoke_gate.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { smokeGateMessages } = require('../scripts/gds/ship.js');
+
+let passed = 0;
+let failed = 0;
+function t(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  PASS  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL  ${name}`);
+    console.log(`        ${err.message}`);
+  }
+}
+
+const m = smokeGateMessages(1234);
+const abortText = m.abort.join('\n');
+const parkedText = m.parked.join('\n');
+
+t('abort: says the ship ABORTED because smoke FAILED', () => {
+  assert.match(abortText, /ABORTED/);
+  assert.match(abortText, /smoke test FAILED/);
+});
+
+t('abort: says the claim is still active and nothing changed', () => {
+  assert.match(abortText, /claim is still active/);
+  assert.match(abortText, /No claim resolved/);
+});
+
+t('abort: names the re-run and the deliberate --allow-smoke-fail continuation', () => {
+  assert.match(abortText, /ship\.js 1234(?!\S)/);
+  assert.match(abortText, /ship\.js 1234 --allow-smoke-fail/);
+});
+
+t('abort: explains the smoke suite hits live endpoints (the change is not deployed yet)', () => {
+  assert.match(abortText, /LIVE endpoints/);
+  assert.match(abortText, /not deployed yet/);
+});
+
+t('parked: names the deliberate stop, the exact status, and that nothing was paid', () => {
+  assert.match(parkedText, /--allow-smoke-fail/);
+  assert.match(parkedText, /Task #1234 is parked at 'completed'/);
+  assert.match(parkedText, /ungraded/);
+  assert.match(parkedText, /no credits/i);
+});
+
+t('parked: names the resume path (--regrade)', () => {
+  assert.match(parkedText, /ship\.js 1234 --regrade/);
+});
+
+t('both message sets are non-empty arrays of strings (printable as-is)', () => {
+  for (const set of [m.abort, m.parked]) {
+    assert.ok(Array.isArray(set) && set.length > 0);
+    for (const line of set) assert.equal(typeof line, 'string');
+  }
+});
+
+console.log(`\nship smoke gate (task 1002605): ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/versions_route.mjs

@@ -28,6 +28,7 @@ const VERSIONS_POST_SCHEMA = {
   id: { required: true, type: 'string', maxLength: 64, minLength: 1 },
   name: { required: true, type: 'string', maxLength: 200, minLength: 1 },
   status: { type: 'string', maxLength: 32 },
+  track: { type: 'string', maxLength: 16 },
   done_when: { type: 'string', maxLength: 8000 },
   scope_doc_path: { type: 'string', maxLength: 256 },
   criteria: { type: 'array', maxItems: 100 },
@@ -62,6 +63,20 @@ test('INIT: unknown extra fields pass through (forward-compat)', () => {
   assert.equal(validate({ id: 'V1', name: 'x', future_field: 42 }, VERSIONS_POST_SCHEMA), null);
 });
 
+// versions.track is NOT NULL with no DB default (migration 003) — the create
+// path must accept it so callers can choose, and default it so omitting it can
+// never again 500 the route (the @bongos/core 1.18.18 `bongos init` blocker).
+test('INIT: explicit track passes the schema guard (both tracks)', () => {
+  assert.equal(validate({ id: 'V1', name: 'x', track: 'product' }, VERSIONS_POST_SCHEMA), null);
+  assert.equal(validate({ id: 'GDS-V5', name: 'x', track: 'internal' }, VERSIONS_POST_SCHEMA), null);
+});
+
+test('BAD: non-string track → structured 400 shape, not a DB 500', () => {
+  const r = validate({ id: 'V1', name: 'x', track: 42 }, VERSIONS_POST_SCHEMA);
+  assert.ok(r);
+  assert.ok(r.details.some((d) => d.field === 'track'));
+});
+
 // ---- BAD shapes must return a structured 400, never throw / 500 ----
 test('BAD: missing id → missing', () => {
   const r = validate({ name: 'x' }, VERSIONS_POST_SCHEMA);

package/tests/workflow_exec_paths.mjs

@@ -23,14 +23,26 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.resolve(__dirname, '..');
 const CORE_PATH_SH = path.join(REPO, 'infra', 'core-path.sh');
 
+// infra/ + the gate workflows under .github/ are HOST topology (publish-manifest.js
+// PROTECTED_TOPOLOGY_EXCLUDE) — absent from a neutral core checkout (task 1002470).
+// The real-tree checks only mean something where that tree exists; the synthetic
+// counterfactual below always runs.
+const HAS_GATE_WORKFLOWS = fs.existsSync(path.join(REPO, '.github', 'workflows', 'gate-review.yml'));
+const HAS_CORE_PATH = fs.existsSync(CORE_PATH_SH);
+
 let passed = 0, failed = 0;
 function test(name, fn) {
   try { fn(); console.log(`  ok  ${name}`); passed++; }
   catch (err) { console.error(`  FAIL ${name}`); console.error('    ', err.message); failed++; }
 }
 
+function hostTest(name, present, fn) {
+  if (!present) { console.log(`  skip ${name} — the host topology it reads is absent in this checkout`); return; }
+  test(name, fn);
+}
+
 // ---- A. the workflow lint is green on the real tree ---------------------------------------------
-test('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', () => {
+hostTest('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', HAS_GATE_WORKFLOWS, () => {
   const r = lintWorkflowExec({ instanceRoot: REPO, coreRoot: REPO });
   assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations, null, 2)}`);
   assert.ok(r.ok, 'lint should pass');
@@ -63,7 +75,7 @@ function runCorePath(rel, instanceRoot) {
   }).trim();
 }
 
-test('core-path.sh prints the monolith path (script at the instance root)', () => {
+hostTest('core-path.sh prints the monolith path (script at the instance root)', HAS_CORE_PATH, () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cp-mono-'));
   try {
     fs.mkdirSync(path.join(tmp, 'scripts'), { recursive: true });
@@ -72,7 +84,7 @@ test('core-path.sh prints the monolith path (script at the instance root)', () =
   } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
 });
 
-test('core-path.sh falls back to the consumer path (script only under node_modules/@bongos/core)', () => {
+hostTest('core-path.sh falls back to the consumer path (script only under node_modules/@bongos/core)', HAS_CORE_PATH, () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cp-cons-'));
   try {
     const pkg = path.join(tmp, 'node_modules', '@bongos', 'core', 'scripts');
@@ -82,7 +94,7 @@ test('core-path.sh falls back to the consumer path (script only under node_modul
   } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
 });
 
-test('core-path.sh exits non-zero (no stdout) when the script is in NO layout', () => {
+hostTest('core-path.sh exits non-zero (no stdout) when the script is in NO layout', HAS_CORE_PATH, () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'cp-none-'));
   let threw = false;
   try {

package/tests/worktree_guard.mjs

@@ -9,9 +9,10 @@
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
+import { requireHostModule } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
-const { decideWorktreeGuard, isUnder } = require('../.claude/hooks/worktree-guard.js');
+const { decideWorktreeGuard, isUnder } = requireHostModule(require, '../.claude/hooks/worktree-guard.js');
 
 let passed = 0;
 let failed = 0;