@bongos/core 1.18.3 → 1.18.19

package/tests/override_attribution.mjs

@@ -95,15 +95,17 @@ await test('approve: tasks.shipped_by is attributed to the REQUESTER, not the Ar
     'must not re-SELECT the requester row already locked by the UPDATE');
 });
 
-await test('approve: the task.confirmed credit_log row is for the REQUESTER', async () => {
+await test('approve: ADR 0120 pay-on-land — NO credit at override-approval; the reward waits for the land', async () => {
   const pool = fakePool({ requesterId: REQUESTER, decision: 'approve', task: TASK });
-  await decideOverrideRequest({ requestId: 1, archonId: ARCHON, decision: 'approve' }, { pool });
-
-  const credit = find(pool._client.queries, /INSERT INTO credit_log/);
-  assert.ok(credit, 'a credit_log INSERT must run');
-  assert.equal(credit.params[0], REQUESTER, 'credit_log.builder_id must be the requester');
-  assert.equal(credit.params[1], TASK.id, 'credit_log.task_id must be the task');
-  assert.ok(credit.params[2] > 0, 'credit delta must be positive');
+  const out = await decideOverrideRequest({ requestId: 1, archonId: ARCHON, decision: 'approve' }, { pool });
+
+  // The override-approval flips completed→confirmed and attributes shipped_by to
+  // the requester (asserted above), but the per-task credit now lands at the
+  // confirmed→shipped flip (shipTask → awardLandingCredit), NOT here — so a
+  // stranded override-confirmed task pays nothing until its code is on `main`.
+  assert.equal(out.confirmResult.creditsAwarded, 0, 'no per-task credit lands at override-approval');
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0,
+    'override-approval must run ZERO credit_log INSERTs — the reward waits for the land');
 });
 
 await test('approve: transaction commits (not rolls back)', async () => {

package/tests/override_request_ownership.mjs

@@ -183,10 +183,14 @@ await test('approve: credit + tasks.shipped_by go to the CLAIM HOLDER, not the r
   assert.deepEqual(taskUpdate.params, [TASK.id, WORKER],
     `shipped_by must bind to the claim holder ${WORKER}, got ${JSON.stringify(taskUpdate.params)}`);
 
-  const credit = find(pool._client.queries, /INSERT INTO credit_log/);
-  assert.ok(credit, 'a credit_log INSERT must run');
-  assert.equal(credit.params[0], WORKER, 'credit_log.builder_id must be the claim holder');
-  assert.ok(credit.params[2] > 0, 'credit delta must be positive');
+  // ADR 0120 pay-on-land: the per-task credit no longer lands at
+  // override-approval — it lands at the confirmed→shipped flip (shipTask). The
+  // credit-theft guard this test exists for is still intact: creditedBuilderId +
+  // shipped_by are the CLAIM HOLDER (asserted above), so when the credit DOES
+  // land at ship it lands on the worker, never the requester/Archon.
+  assert.equal(out.confirmResult.creditsAwarded, 0, 'no per-task credit lands at override-approval');
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0,
+    'override-approval must run ZERO credit_log INSERTs — the reward waits for the land');
 });
 
 await test('approve: the claim-holder lookup happens BEFORE the tasks UPDATE binds shipped_by', async () => {

package/tests/parse_cookie_decode.mjs

@@ -0,0 +1,42 @@
+// tests/parse_cookie_decode.mjs — regression for the post-login redirect landing
+// on /gate/ instead of the requested page (task 1002241).
+//
+// The onboarding wizard's "Connect GitHub" button hits /auth/web/start?return=/create,
+// which stores the return target via `res.cookie(RETURN_COOKIE, '/create', …)`. Express
+// `res.cookie` percent-ENCODES the value, so the wire cookie is `gds_return=%2Fcreate`.
+// parseCookie() must DECODE symmetrically on read — else the callback runs
+// safeReturnTo('%2Fcreate'), which (not starting with '/') is parsed as a URL, throws,
+// returns null, and the post-login redirect silently falls through to the default
+// landing (cloudbongos.com → /gate/). Decoding is a no-op for hex/simple values, so it
+// can't regress the state/session/repos cookies.
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { parseCookie } = require('../src/bongos/routes/_helpers.js');
+
+let pass = 0, fail = 0;
+const ok = (cond, msg) => { if (cond) { pass++; console.log('  ok ', msg); } else { fail++; console.log('  FAIL', msg); } };
+const req = (cookie) => ({ headers: { cookie } });
+
+console.log('parseCookie — decodes percent-encoded values (task 1002241):');
+ok(parseCookie(req('gds_return=%2Fcreate'), 'gds_return') === '/create',
+   '"%2Fcreate" → "/create" (the Connect-GitHub return bug)');
+ok(parseCookie(req('gds_return=https%3A%2F%2Fbuilders.cloudbongos.com%2Fx'), 'gds_return')
+     === 'https://builders.cloudbongos.com/x',
+   'encoded full https URL round-trips (the #726 subdomain return, same latent bug)');
+
+console.log('\nparseCookie — no-op / safe for the other cookies:');
+ok(parseCookie(req('gds_oauth_state=03e92dd24cad3219c637e50fc9f115ef'), 'gds_oauth_state')
+     === '03e92dd24cad3219c637e50fc9f115ef', 'hex state value unchanged');
+ok(parseCookie(req('gds_session=' + 'a'.repeat(64)), 'gds_session') === 'a'.repeat(64),
+   'hex session token unchanged');
+ok(parseCookie(req('gds_oauth_repos=1'), 'gds_oauth_repos') === '1', 'repos "1" unchanged');
+
+console.log('\nparseCookie — misc:');
+ok(parseCookie(req(''), 'gds_return') === null, 'no cookies → null');
+ok(parseCookie(req('other=x; gds_return=%2Fcreate'), 'gds_return') === '/create',
+   'finds the named cookie among several');
+ok(parseCookie(req('gds_return=%E0%A4%A'), 'gds_return') === '%E0%A4%A',
+   'malformed percent-escape falls back to the raw value (no throw)');
+
+console.log(`\nparseCookie decode tests: ${pass} passed, ${fail} failed`);
+if (fail) process.exit(1);

package/tests/pay_on_land.mjs

@@ -0,0 +1,129 @@
+// tests/pay_on_land.mjs
+//
+// ADR 0120 part 1 (pay-on-land) — the per-task credit + idea-promotion bonus
+// are booked at the confirmed→SHIPPED flip (db.shipTask → awardLandingCredit),
+// NOT at confirm. This is the mirror of confirm_attribution.mjs / override_
+// attribution.mjs / grade_attribution.mjs, which now assert NO credit at their
+// (confirm-time) transition; here we assert the credit lands at ship.
+//
+// The contract this pins:
+//   • ship awards a positive per-task credit, reason='task.shipped'
+//   • the credit is attributed to the CLAIM HOLDER (the builder who did the
+//     work), even when a DIFFERENT builder (the reconciler / a supervisor)
+//     triggers the ship
+//   • idempotent on (task_id, 'task.shipped'): a re-ship / reconciler re-sweep
+//     books nothing a second time
+//   • credits_reward = 0 → no credit_log INSERT
+//   • a task not in 'confirmed' state throws TASK_NOT_CONFIRMED, awards nothing
+//
+// shipTask honors the #538 `deps.pool` seam under NODE_ENV==='test', so we drive
+// it with a SQL-aware fakeClient — no live DB.
+//
+// Run:  node tests/pay_on_land.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
+
+process.env.NODE_ENV = 'test';
+
+const require = createRequire(import.meta.url);
+// shipTask resolves the `reward` port for the credit grant + achievement
+// reconcile. Register it; stub the gamification hooks to no-ops so the test
+// isolates the credit path (the real credits.js SQL still runs against the fake).
+const achievements = require('../modules/economy/achievements.js');
+achievements.evaluateAfterShip = async () => [];
+achievements.evaluateAfterCreditAward = async () => [];
+achievements.reconcileBuilderAchievements = async () => [];
+const seams = require('../src/module-seams.js');
+if (!seams.hasProvider('reward')) seams.registerProvider('reward', require('../modules/economy/reward.js'));
+const db = require('../modules/lifecycle/db.js');
+const { shipTask } = db;
+
+const { test, summary } = makeRunner();
+
+// SQL-aware fake covering shipTask's transaction. Knobs:
+//   claimHolderId       → who mostRecentClaimHolderId resolves (null = none)
+//   shippedBy           → tasks.shipped_by on the returned shipped row
+//   creditsReward, kind → the task's reward inputs
+//   confirmed=false     → the UPDATE tasks matches nothing (TASK_NOT_CONFIRMED)
+//   priorShipCredit     → a 'task.shipped' credit_log row already exists (idempotent)
+function fakePool({ claimHolderId, shippedBy, creditsReward = 15, kind = 'feature', confirmed = true, priorShipCredit = false }) {
+  return makeSqlAwareClient((s) => {
+      if (/^UPDATE tasks/.test(s)) {
+        return {
+          rows: confirmed
+            ? [{ id: TASK.id, title: TASK.title, status: 'shipped', shipped_at: new Date(0).toISOString(),
+                 shipped_by: shippedBy, security_sensitive: false, value_summary: null,
+                 credits_reward: creditsReward, kind }]
+            : [],
+        };
+      }
+      if (/^UPDATE claims/.test(s)) return { rows: [] };                 // no open claims to heal
+      if (/UPDATE builders SET first_ship_at/.test(s)) return { rows: [] };
+      if (/SELECT rank FROM builders/.test(s)) return { rows: [{ rank: 'thetes' }] }; // not xenos → no graduation
+      if (/SELECT builder_id FROM claims/.test(s)) {
+        return { rows: claimHolderId == null ? [] : [{ builder_id: claimHolderId }] };
+      }
+      if (/SELECT 1 FROM credit_log .* 'task\.shipped'/.test(s)) {
+        return { rows: priorShipCredit ? [{ '?column?': 1 }] : [] };
+      }
+      if (/SELECT 1 FROM credit_log .* 'idea_promotion_bonus'/.test(s)) return { rows: [] };
+      if (/FROM idea_inbox/.test(s)) return { rows: [] };                // no idea lineage
+      if (/INSERT INTO credit_log/.test(s)) return { rows: [] };
+      return { rows: [] };                                              // BEGIN/COMMIT/SAVEPOINT/etc.
+  });
+}
+
+const find = (queries, re) => queries.find((q) => re.test(String(q.sql).replace(/\s+/g, ' ')));
+const all = (queries, re) => queries.filter((q) => re.test(String(q.sql).replace(/\s+/g, ' ')));
+
+const RECONCILER = 999;  // the builder_id the reconciler passes to shipTask
+const WORKER = 25;       // the claim holder who actually did the work
+const TASK = { id: 660, title: 'fixture task' };
+
+// =========================================================================
+await test('ship: the per-task credit lands at SHIP (reason=task.shipped), attributed to the claim holder', async () => {
+  // shipped_by was set to the claim holder at confirm; the reconciler triggers
+  // the ship with its own builderId — attribution must still be the worker.
+  const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, creditsReward: 15, kind: 'feature' });
+  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool });
+
+  assert.equal(out.status, 'shipped', 'task flips to shipped');
+  assert.equal(out.creditedBuilderId, WORKER, 'credit attributed to the claim holder, not the reconciler');
+  assert.ok(out.creditsAwarded > 0, 'a positive per-task credit must be awarded at ship');
+
+  const insert = find(pool._client.queries, /INSERT INTO credit_log/);
+  assert.ok(insert, 'a credit_log INSERT must run at ship');
+  assert.equal(insert.params[0], WORKER, 'credit_log.builder_id = claim holder');
+  assert.notEqual(insert.params[0], RECONCILER, 'credit must NOT go to the ship trigger');
+  assert.equal(insert.params[1], TASK.id, 'credit_log.task_id = the task');
+  assert.equal(insert.params[3], 'task.shipped', "reason must be 'task.shipped' (ADR 0120), not 'task.confirmed'");
+});
+
+await test('ship: idempotent — a prior task.shipped credit means no second INSERT', async () => {
+  const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, priorShipCredit: true });
+  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool });
+  assert.equal(out.creditsAwarded, 0, 'no fresh credit on a re-ship / reconciler re-sweep');
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0, 'must not double-insert credit');
+});
+
+await test('ship: credits_reward = 0 → no credit_log INSERT', async () => {
+  const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, creditsReward: 0 });
+  const out = await shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool });
+  assert.equal(out.creditsAwarded, 0, 'a zero-reward task pays nothing');
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0, 'no INSERT for a 0-reward task');
+});
+
+await test('ship: not in confirmed state → throws TASK_NOT_CONFIRMED, awards nothing', async () => {
+  const pool = fakePool({ claimHolderId: WORKER, shippedBy: WORKER, confirmed: false });
+  await assert.rejects(
+    () => shipTask({ taskId: TASK.id, builderId: RECONCILER }, { pool }),
+    (err) => err.code === 'TASK_NOT_CONFIRMED',
+    'must throw TASK_NOT_CONFIRMED when the UPDATE matches no confirmed row'
+  );
+  assert.equal(all(pool._client.queries, /INSERT INTO credit_log/).length, 0, 'must not award credit on a failed ship');
+});
+
+// -------------------------------------------------------------------------
+summary();

package/tests/platform_boot.mjs

@@ -10,9 +10,16 @@
 import assert from 'node:assert/strict';
 import { test, before, after } from 'node:test';
 import http from 'node:http';
+import net from 'node:net';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
 import platformMod from '../src/platform-server.js';
+import loader from '../src/module-loader/loader.js';
 
-const { buildPlatformApp } = platformMod;
+const { buildPlatformApp, startBackgroundServices } = platformMod;
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
 let server;
 let port;
@@ -168,3 +175,95 @@ test('R60: the served hall injects window.__MODULES__ (feature-module flags) syn
   assert.equal(typeof parsed.enabled['dev-box'], 'boolean');
   assert.equal(typeof parsed.enabled.discord, 'boolean');
 });
+
+// ---------------------------------------------------------------------------
+// task 1002419 — the platform entrypoint must actually START the module pollers.
+//
+// Regression fixture for a silent, high-blast-radius outage: startModulePollers
+// had ZERO callers after the game entrypoint (server.js) was retired, so on a
+// standalone instance EVERY module poller was dead — most visibly the lifecycle
+// publish-reconciler, which is what drives 'confirmed' tasks to 'shipped'. Eleven
+// tasks stranded at 'confirmed' (oldest 6.2 days) with nothing in any log to say
+// why: a poller that is never started is indistinguishable from one with nothing
+// to do. Both tests below are DB-free.
+// ---------------------------------------------------------------------------
+
+test('task 1002419: startBackgroundServices starts the enabled modules’ pollers', async () => {
+  // The wiring resolves a real, ENABLED module poller. lifecycle is default:true
+  // and declares contributes.pollers:["publish-reconciler"], so it must appear.
+  loader._reset();
+  let keys = [];
+  try {
+    const started = startBackgroundServices();
+    keys = started.map((p) => `${p.key}/${p.poller}`);
+    assert.ok(
+      keys.includes('lifecycle/publish-reconciler'),
+      `the lifecycle publish-reconciler poller must start (got: ${keys.join(', ') || 'none'})`
+    );
+  } finally {
+    // Clear the real (unref'd) timers this just started so the suite leaves none.
+    // The stopped count is also the loader's own record of what it started, so it
+    // must match what startBackgroundServices reported.
+    const stopped = await loader.stopModulePollers();
+    assert.equal(stopped, keys.length, 'stopModulePollers stops exactly what was started');
+    loader._reset();
+  }
+});
+
+function freePort() {
+  return new Promise((resolve, reject) => {
+    const s = net.createServer();
+    s.on('error', reject);
+    s.listen(0, '127.0.0.1', () => {
+      const { port } = s.address();
+      s.close(() => resolve(port));
+    });
+  });
+}
+
+test('task 1002419: a real `node src/platform-server.js` boot announces the reconciler', async () => {
+  // The mutation-proof half. The test above would still pass if the entry block
+  // stopped calling startBackgroundServices(); this one spawns the entrypoint the
+  // way docker-entrypoint.sh does and asserts the poller announces itself in the
+  // boot log — so deleting the call site turns it red.
+  const port = await freePort();
+  const child = spawn(process.execPath, [path.join(REPO_ROOT, 'src', 'platform-server.js')], {
+    cwd: REPO_ROOT,
+    env: {
+      ...process.env,
+      PORT: String(port),
+      HOST: '127.0.0.1',
+      // Push every first-fire far past the life of this test: we assert the
+      // START announcement, never a sweep, so no poller ever touches Postgres.
+      PUBLISH_RECONCILE_FIRST_MS: '3600000',
+      ROUTINE_PEER_VOTE_FIRST_MS: '3600000',
+    },
+  });
+
+  try {
+    const log = await new Promise((resolve, reject) => {
+      let out = '';
+      const timer = setTimeout(
+        () => reject(new Error(`platform-server did not announce the reconciler within 20s. Log:\n${out}`)),
+        20_000
+      );
+      const onData = (d) => {
+        out += d;
+        if (/\[publish-reconciler\] started/.test(out)) {
+          clearTimeout(timer);
+          resolve(out);
+        }
+      };
+      child.stdout.on('data', onData);
+      child.stderr.on('data', onData);
+      child.on('error', (e) => { clearTimeout(timer); reject(e); });
+      child.on('exit', (code) => {
+        clearTimeout(timer);
+        reject(new Error(`platform-server exited early (code ${code}). Log:\n${out}`));
+      });
+    });
+    assert.match(log, /\[publish-reconciler\] started — sweeping confirmed→shipped every \d+s/);
+  } finally {
+    child.kill('SIGKILL');
+  }
+});

package/tests/post_login_landing.mjs

@@ -0,0 +1,42 @@
+// tests/post_login_landing.mjs — the configurable post-sign-in landing (task 1002240).
+//
+// postLoginLanding(brand) resolves the redirect target used after a successful
+// web sign-in when NO explicit ?return= / same-apex Referer was carried. It is
+// the ONE seam that lets a platform-home instance (cloudbongos.com) land a
+// visitor back on its orbs (/gate/) instead of the builders' hall, while every
+// other instance keeps the portable '/builders' default (the hall always
+// exists; a /gate/ orbs site does not). Pure over an injected brand pack, and
+// hardened through the SAME open-redirect allowlist as ?return= (safeReturnTo),
+// so a misconfigured landing can never become an open redirect.
+//
+// Pure function, no DB — requiring the route module does not open a pool.
+
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { postLoginLanding } = require('../src/bongos/routes/auth.js');
+
+let pass = 0, fail = 0;
+function ok(cond, msg) {
+  if (cond) { pass++; console.log(`  ok  ${msg}`); }
+  else { fail++; console.log(`  FAIL ${msg}`); }
+}
+
+console.log('\npostLoginLanding — portable default is the hall:');
+ok(postLoginLanding({}) === '/builders', 'no landing config → /builders');
+ok(postLoginLanding({ landing: {} }) === '/builders', 'empty landing block → /builders');
+// No-arg path reads the real committed neutral pack, which ships postLogin:'/builders'.
+ok(postLoginLanding() === '/builders', 'committed neutral pack → /builders');
+
+console.log('\npostLoginLanding — an instance lands visitors on its own front door:');
+ok(postLoginLanding({ landing: { postLogin: '/gate/' } }) === '/gate/', 'cloudbongos orbs → /gate/');
+ok(postLoginLanding({ landing: { postLogin: '/gate/?entered=1' } }) === '/gate/?entered=1', 'relative path with query preserved');
+
+console.log('\npostLoginLanding — a misconfigured landing can never become an open redirect:');
+ok(postLoginLanding({ landing: { postLogin: 'https://evil.com/' } }) === '/builders', 'foreign https origin → fallback');
+ok(postLoginLanding({ landing: { postLogin: '//evil.com' } }) === '/builders', 'protocol-relative → fallback');
+ok(postLoginLanding({ landing: { postLogin: 'javascript:alert(1)' } }) === '/builders', 'javascript: scheme → fallback');
+ok(postLoginLanding({ landing: { postLogin: '/a\\b' } }) === '/builders', 'backslash path → fallback');
+ok(postLoginLanding({ landing: { postLogin: 42 } }) === '/builders', 'non-string value → fallback');
+
+console.log(`\nPost-login-landing tests: ${pass} passed, ${fail} failed`);
+if (fail) process.exit(1);

package/tests/preflight_checks.mjs

@@ -0,0 +1,72 @@
+// tests/preflight_checks.mjs
+//
+// Unit test for scripts/gds/preflight.js `preflightChecks()` (task 1002401,
+// onboarding-audit area 4) — the pure onboarding environment preflight shared by
+// /builder-setup and `bongos doctor`. DB-free and does zero real I/O: node
+// version, fs, and child_process are all injected, so we assert the real
+// decision logic (levels + fixes) without touching the machine.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { preflightChecks, formatPreflight } = require('../scripts/gds/preflight.js');
+
+const okSpawn = () => ({ status: 0, stdout: '1.2.3 (Claude Code)\n' });
+const badSpawn = () => ({ error: Object.assign(new Error('spawn claude ENOENT'), { code: 'ENOENT' }) });
+const fsWith = (present) => ({ existsSync: () => present });
+const find = (results, title) => results.find((r) => r.title === title);
+
+test('all green: node>=22, deps present, claude launches', () => {
+  const r = preflightChecks({ nodeVersion: 'v22.5.0', fs: fsWith(true), spawn: okSpawn, env: {} });
+  assert.equal(find(r, 'Node').level, 'ok');
+  assert.equal(find(r, 'Dependencies').level, 'ok');
+  assert.equal(find(r, 'claude CLI').level, 'ok');
+});
+
+test('node below v22 → fail with an upgrade fix', () => {
+  const r = preflightChecks({ nodeVersion: 'v18.19.0', fs: fsWith(true), spawn: okSpawn, env: {} });
+  const node = find(r, 'Node');
+  assert.equal(node.level, 'fail');
+  assert.match(node.fix, /22|nvm|nodejs/);
+});
+
+test('missing node_modules → warn (non-fatal) with `npm ci` fix', () => {
+  const r = preflightChecks({ nodeVersion: 'v22.0.0', fs: fsWith(false), spawn: okSpawn, env: {} });
+  const deps = find(r, 'Dependencies');
+  assert.equal(deps.level, 'warn');
+  assert.match(deps.fix, /npm ci/);
+});
+
+test('claude not launchable → fail naming SUBAGENT_SPAWN_FAILED + install fix', () => {
+  const r = preflightChecks({ nodeVersion: 'v22.0.0', fs: fsWith(true), spawn: badSpawn, env: {} });
+  const claude = find(r, 'claude CLI');
+  assert.equal(claude.level, 'fail');
+  assert.match(claude.detail, /SUBAGENT_SPAWN_FAILED/);
+  assert.match(claude.fix, /@anthropic-ai\/claude-code|OTB_CLAUDE_BIN/);
+});
+
+test('OTB_CLAUDE_BIN is used as the probe binary and labelled', () => {
+  let seenBin = null;
+  const spy = (bin) => { seenBin = bin; return { status: 0, stdout: 'x\n' }; };
+  const r = preflightChecks({ nodeVersion: 'v22.0.0', fs: fsWith(true), spawn: spy, env: { OTB_CLAUDE_BIN: '/opt/claude' } });
+  assert.equal(seenBin, '/opt/claude');
+  assert.match(find(r, 'claude CLI').detail, /via OTB_CLAUDE_BIN/);
+});
+
+test('a thrown existsSync is treated as deps-missing, never crashes', () => {
+  const fsThrows = { existsSync: () => { throw new Error('boom'); } };
+  const r = preflightChecks({ nodeVersion: 'v22.0.0', fs: fsThrows, spawn: okSpawn, env: {} });
+  assert.equal(find(r, 'Dependencies').level, 'warn');
+});
+
+test('formatPreflight renders glyphs + fixes and stays plain (no ANSI) by default', () => {
+  const r = preflightChecks({ nodeVersion: 'v18.0.0', fs: fsWith(false), spawn: badSpawn, env: {} });
+  const s = formatPreflight(r, { heading: true });
+  assert.match(s, /Checking your environment/);
+  assert.match(s, /✖ Node/);
+  assert.match(s, /! Dependencies/);
+  assert.match(s, /→ .*npm ci/);
+  assert.doesNotMatch(s, /\x1b\[/); // color:false ⇒ no ANSI escapes
+});

package/tests/provision.mjs

@@ -282,6 +282,10 @@ function recorder({ apply = false } = {}) {
     // Stub the DNS token-scope preflight (task 1980) so the composition stays hermetic
     // (no real CF call). Default: reachable; a test overrides it to exercise the block.
     checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    // Owner OAuth token lookup for the scaffold push (task 1002317). Default: none →
+    // the scaffold takes the SSH `origin` fallback (so existing push assertions hold
+    // without touching the real db module). A test overrides it to exercise the token path.
+    getGithubToken: async () => null,
   };
   return { deps, cmds, writes, statuses };
 }
@@ -337,8 +341,9 @@ await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + n
   const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'lars589/mercury' }, deps);
   assert.equal(r.ok, true);
   const joined = cmds.join('\n');
-  // scaffold leg (task 2055): clone → package-core → init --vendor-core → push
-  assert.match(joined, /git clone git@github-deploy:lars589\/mercury\.git/, 'clones the instance repo');
+  // scaffold leg (task 2055): git init → package-core → init --vendor-core → push
+  assert.match(joined, /git -C \S+ init -q/, 'inits the instance working tree (empty repo — nothing to clone)');
+  assert.match(joined, /git -C \S+ remote add origin git@github-deploy:lars589\/mercury\.git/, 'sets the instance repo as origin');
   assert.match(joined, /node scripts\/gds\/package-core\.js/, 'builds the core tarball');
   assert.match(joined, /init\.js --from .* --dir .* --no-seed --force --vendor-core /, 'materializes + file:-pins the core');
   assert.match(joined, /git -C .* push -u origin main/, 'pushes the scaffold');
@@ -349,9 +354,9 @@ await ta('provisionInstance(standalone) SCAFFOLDS its repo, then syncs (pull + n
   assert.match(joined, /node_modules\/@bongos\/core\/scripts\/migrate\.sh/, 'migrates from the INSTANCE root\'s core');
   assert.ok(!cmds.some((c) => /\.\/scripts\/migrate\.sh/.test(c)), 'standalone does NOT use the control-plane checkout migrate');
   assert.match(joined, /INSERT INTO versions/, 'standalone seeds its first version too (task 2119)');
-  // ordering: clone → package-core → init → push → pull → npm ci → migrate → service
+  // ordering: git init → package-core → init → push → pull → npm ci → migrate → service
   const idx = (re) => cmds.findIndex((c) => re.test(c));
-  assert.ok(idx(/git clone/) < idx(/package-core/), 'clone before tarball build');
+  assert.ok(idx(/git -C \S+ init -q/) < idx(/package-core/), 'git init before tarball build');
   assert.ok(idx(/package-core/) < idx(/init\.js/), 'tarball before init');
   assert.ok(idx(/init\.js/) < idx(/push -u origin main/), 'init before push');
   assert.ok(idx(/push -u origin main/) < idx(/git pull/), 'scaffold push before the deploy pull');
@@ -415,7 +420,7 @@ await ta('scaffoldStandaloneRepo: idempotent — a repo that already carries pac
     const { deps, cmds } = recorder({ apply: true });
     const res = await P.scaffoldStandaloneRepo({ slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo' }, deps);
     assert.equal(res.already, true);
-    assert.equal(cmds.length, 0, 'no clone/build/push when already scaffolded');
+    assert.equal(cmds.length, 0, 'no init/build/push when already scaffolded');
   } finally {
     P.CONFIG.standaloneBase = origBase;
     rmSync(tmp, { recursive: true, force: true });
@@ -431,9 +436,13 @@ async function scaffoldWithEnv(env) {
   P.CONFIG.standaloneBase = tmp;
   try {
     const { deps, cmds } = recorder({ apply: true });
+    // instanceRoot = the fresh base (no package.json → no `file:` core pin), so these
+    // vendored-path assertions stay deterministic: installedCoreTarball returns null and
+    // the scaffold rebuilds via package-core.js (task 1002275). A consumer-instance root
+    // (a real pin) takes the reuse path — covered by its own test below.
     await P.scaffoldStandaloneRepo(
       { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo' },
-      { ...deps, env },
+      { ...deps, env, instanceRoot: tmp },
     );
     return cmds.join('\n');
   } finally {
@@ -463,6 +472,122 @@ await ta('scaffoldStandaloneRepo: default (no registry env) stays on the vendore
   assert.ok(!/--registry-core/.test(joined));
 });
 
+// ── consumer control-plane core reuse (the empty-repo fix, task 1002275) ──────────
+// When the runner is ITSELF a consumer instance (its @bongos/core is a vendored npm dep,
+// not a source checkout), package-core.js can't rebuild the core from git (REPO_ROOT is
+// inside gitignored node_modules → an EMPTY core set → abort → no push → EMPTY repo, seen
+// live on cloudbongos.com for trial/test). Reuse the pinned tarball the instance runs.
+t('installedCoreTarball: reuses a consumer instance file: core pin; null on a source checkout', () => {
+  // consumer instance: package.json file:-pins the core AND the tarball is on disk → reuse it
+  const inst = mkdtempSync(join(tmpdir(), 'cptgz-consumer-'));
+  mkdirSync(join(inst, 'vendor'));
+  writeFileSync(join(inst, 'vendor', 'bongos-core-1.17.4.tgz'), 'x');
+  writeFileSync(join(inst, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': 'file:vendor/bongos-core-1.17.4.tgz' } }));
+  assert.equal(P.installedCoreTarball({ instanceRoot: inst }), join(inst, 'vendor', 'bongos-core-1.17.4.tgz'), 'reuses the pinned tarball');
+
+  // dangling pin (tarball pruned) → null, so the caller never points init at a missing file
+  rmSync(join(inst, 'vendor', 'bongos-core-1.17.4.tgz'));
+  assert.equal(P.installedCoreTarball({ instanceRoot: inst }), null, 'a dangling file: pin resolves to null');
+
+  // source checkout: a caret range (no file: pin) → null → the caller rebuilds via package-core.js
+  const src = mkdtempSync(join(tmpdir(), 'cptgz-source-'));
+  writeFileSync(join(src, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': '^1.17.4' } }));
+  assert.equal(P.installedCoreTarball({ instanceRoot: src }), null, 'a source checkout has no file: pin');
+
+  // no package.json at all → null
+  const bare = mkdtempSync(join(tmpdir(), 'cptgz-bare-'));
+  assert.equal(P.installedCoreTarball({ instanceRoot: bare }), null, 'no package.json → null');
+
+  // the @cloudbongos/core scope alias is honored too (infra/core-node.sh accepts both)
+  const alt = mkdtempSync(join(tmpdir(), 'cptgz-alt-'));
+  mkdirSync(join(alt, 'vendor'));
+  writeFileSync(join(alt, 'vendor', 'bongos-core-2.0.0.tgz'), 'x');
+  writeFileSync(join(alt, 'package.json'), JSON.stringify({ dependencies: { '@cloudbongos/core': 'file:vendor/bongos-core-2.0.0.tgz' } }));
+  assert.equal(P.installedCoreTarball({ instanceRoot: alt }), join(alt, 'vendor', 'bongos-core-2.0.0.tgz'), 'honors the @cloudbongos/core scope alias');
+
+  [inst, src, bare, alt].forEach((d) => rmSync(d, { recursive: true, force: true }));
+});
+
+await ta('scaffoldStandaloneRepo: on a consumer control plane it REUSES the pinned tarball — no package-core rebuild (task 1002275)', async () => {
+  // the control plane is itself a consumer instance: its package.json file:-pins the core
+  const cp = mkdtempSync(join(tmpdir(), 'cptgz-cp-'));
+  mkdirSync(join(cp, 'vendor'));
+  const pinned = join(cp, 'vendor', 'bongos-core-1.17.4.tgz');
+  writeFileSync(pinned, 'x');
+  writeFileSync(join(cp, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': 'file:vendor/bongos-core-1.17.4.tgz' } }));
+  const base = mkdtempSync(join(tmpdir(), 'cptgz-standalone-'));   // FRESH base → the scaffold proceeds
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    const { deps, cmds } = recorder({ apply: true });
+    await P.scaffoldStandaloneRepo(
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo' },
+      { ...deps, instanceRoot: cp },
+    );
+    const joined = cmds.join('\n');
+    assert.ok(!/package-core\.js/.test(joined), 'does NOT rebuild the core from source (the empty-set abort path)');
+    assert.match(joined, new RegExp('init\\.js --from .* --no-seed --force --vendor-core ' + reEsc(pinned)), 'feeds the PINNED tarball to init --vendor-core');
+    assert.match(joined, /git -C \S+ remote add origin git@github-deploy:lars589\/demo\.git/, 'still targets the repo as origin');
+    assert.match(joined, /push /, 'still pushes the scaffold');
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    [cp, base].forEach((d) => rmSync(d, { recursive: true, force: true }));
+  }
+});
+
+// ── scaffold push via the owner OAuth token (task 1002317) ────────────────────────
+// Deploy keys are per-repo; a shared key can't write to a NEW project repo. Push with the
+// owner's token (which created the repo) instead — WITHOUT leaking it into a logged command.
+await ta('scaffoldStandaloneRepo: pushes via the owner OAuth token (not SSH), token never in a logged command (task 1002317)', async () => {
+  const base = mkdtempSync(join(tmpdir(), 'push-tok-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    const { deps, cmds } = recorder({ apply: true });
+    const writes = [];
+    deps.writeFile = (p, body, opts) => { writes.push({ p, body, opts }); return { ok: true }; };
+    deps.getGithubToken = async () => ({ token: 'gho_SECRET_TOKEN_XYZ', scope: 'public_repo' });
+    await P.scaffoldStandaloneRepo(
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7 },
+      { ...deps, instanceRoot: base },
+    );
+    const joined = cmds.join('\n');
+    // SECURITY: the token must NEVER appear in a command string (makeExec logs commands)
+    assert.ok(!joined.includes('gho_SECRET_TOKEN_XYZ'), 'token never appears in any command string');
+    // pushes over HTTPS via the credential-store helper to HEAD:main, NOT the SSH origin
+    assert.match(joined, /credential\.helper='store --file=[^']*bongos-gitcred-demo[^']*' push https:\/\/x-access-token@github\.com\/lars589\/demo\.git HEAD:main/, 'pushes via the token credential-store helper');
+    assert.ok(!/push -u origin main/.test(joined), 'does NOT use the SSH origin push when a token is available');
+    // the credential file is written chmod 600, carries the token (content, NOT logged), then removed
+    const cred = writes.find((w) => /bongos-gitcred-demo/.test(w.p));
+    assert.ok(cred, 'wrote a credential-store file');
+    assert.equal(cred.opts && cred.opts.mode, 0o600, 'credential file is chmod 600');
+    assert.ok(String(cred.body).includes('gho_SECRET_TOKEN_XYZ'), 'credential file carries the token in its CONTENT (makeWriteFile logs only the path + byte count)');
+    assert.match(joined, /rm -f [^\n]*bongos-gitcred-demo/, 'removes the credential file after the push');
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
+await ta('scaffoldStandaloneRepo: no owner token → falls back to the SSH origin push (unchanged; task 1002317)', async () => {
+  const base = mkdtempSync(join(tmpdir(), 'push-ssh-'));
+  const origBase = P.CONFIG.standaloneBase;
+  P.CONFIG.standaloneBase = base;
+  try {
+    const { deps, cmds } = recorder({ apply: true });   // default getGithubToken → null
+    await P.scaffoldStandaloneRepo(
+      { slug: 'demo', hosting_shape: 'standalone', target_ref: 'lars589/demo', owner_builder_id: 7 },
+      { ...deps, instanceRoot: base },
+    );
+    const joined = cmds.join('\n');
+    assert.match(joined, /git -C [^\n]* push -u origin main/, 'falls back to the SSH origin push');
+    assert.ok(!/credential\.helper=/.test(joined), 'no token credential helper when there is no token');
+  } finally {
+    P.CONFIG.standaloneBase = origBase;
+    rmSync(base, { recursive: true, force: true });
+  }
+});
+
 await ta('provisionInstance is idempotent: an already-active instance is a no-op', async () => {
   const { deps, cmds } = recorder();
   const r = await P.provisionInstance({ ...coTenant, status: 'active' }, deps);
@@ -914,7 +1039,7 @@ await ta('provisionInstance(standalone, remote): EVERY box step runs control-pla
       assert.ok(!box.some((c) => re.test(c)), `${re} does NOT cross to the co-hosting box`);
     }
     // The scaffold leg was already control-local; confirm it stayed there.
-    assert.ok(control.some((c) => /git clone /.test(c)) && control.some((c) => /push -u origin main/.test(c)), 'scaffold clone+push stay control-local');
+    assert.ok(control.some((c) => /git -C \S+ init -q/.test(c)) && control.some((c) => /push -u origin main/.test(c)), 'scaffold init+push stay control-local');
     // NOTHING crosses to the remote box for a standalone — the whole point of the fix.
     assert.equal(box.length, 0, 'zero remote (co-hosting box) commands for a standalone');
     assert.equal(boxWrites.length, 0, 'zero remote writes for a standalone');