@bongos/core 1.19.1033 → 1.19.1034

package/tests/ship_preflight.mjs

@@ -17,7 +17,7 @@ const {
   untrackedPaths, untrackedLeftBehind, untrackedWarningLines,
 } = require('../modules/lifecycle/ship-preflight.js');
 // task 1001436: the preflight step itself + the ship-input resolver it is handed.
-const { preflight, shipInputPaths } = require('../scripts/gds/ship-preflight-steps.js');
+const { preflight, shipInputPaths, staleToolingFiles, TOOLING_PATHSPECS } = require('../scripts/gds/ship-preflight-steps.js');
 
 const tests = [];
 const test = (name, fn) => tests.push({ name, fn });
@@ -509,6 +509,72 @@ test('preflight (real git): nothing committed on the branch → no untracked war
   });
 });
 
+// ---- stale ship-tooling guard (task 1004273) ----
+// The guard named ship.js + grader.js only; two carves moved the logic into ship-*.js
+// and grader-*.js / grader-workers/ / grade-engine.js, so a branch behind main on any
+// of those shipped with a stale copy — the #662 shape the guard exists for.
+
+test('stale-tooling guard: every tracked ship*.js and grader file is covered by TOOLING_PATHSPECS', () => {
+  const root = path.resolve(import.meta.dirname, '..');
+  const ls = (...spec) => execSync(`git ls-files -z -- ${spec.map((s) => `'${s}'`).join(' ')}`, { cwd: root, encoding: 'utf8' })
+    .split('\0').filter(Boolean);
+  // Chosen by an independent rule (the filename), then asked of git's own pathspec matcher.
+  const shipTooling = ls('scripts/gds', 'modules/grading').filter((f) =>
+    /^scripts\/gds\/ship[^/]*\.js$/.test(f) || /^modules\/grading\/(?:grader|grade-engine)/.test(f));
+  assert.ok(shipTooling.length >= 25, `only ${shipTooling.length} ship/grader file(s) found — the scan is reading the wrong tree`);
+  assert.ok(shipTooling.includes('scripts/gds/ship-land.js') && shipTooling.includes('modules/grading/grader-score.js'));
+  const covered = new Set(ls(...TOOLING_PATHSPECS));
+  const missed = shipTooling.filter((f) => !covered.has(f));
+  assert.deepEqual(missed, [], `ship/grade tooling the stale-tooling guard would not refuse: ${missed.join(', ')}`);
+});
+
+// Publish the throwaway repo's main to its local bare "origin".
+const publishMain = (run) => run(['git', 'push', '-q', 'origin', 'main'].join(' '));
+
+test('preflight (real git): main moved a carved ship-*.js and added a new grader file → refused stale-tooling', () => {
+  withPreflightRepo(({ work, run }) => {
+    fs.mkdirSync(path.join(work, 'scripts', 'gds'), { recursive: true });
+    fs.mkdirSync(path.join(work, 'modules', 'grading'), { recursive: true });
+    fs.writeFileSync(path.join(work, 'scripts', 'gds', 'ship-land.js'), '// v1\n');
+    fs.writeFileSync(path.join(work, 'modules', 'grading', 'grader-score.js'), '// v1\n');
+    run('git add -A && git commit -q -m tooling');
+    publishMain(run);
+    run('git checkout -q -b feature');
+    fs.writeFileSync(path.join(work, 'src.txt'), 'the branch\'s own work\n');
+    run('git add -A && git commit -q -m work');
+    // main moves: one carved file changes, one file appears that this checkout never had.
+    run('git checkout -q main');
+    fs.writeFileSync(path.join(work, 'scripts', 'gds', 'ship-land.js'), '// v2\n');
+    fs.writeFileSync(path.join(work, 'modules', 'grading', 'grader-new.js'), '// new carve\n');
+    run('git add -A && git commit -q -m "main moves the tooling"');
+    publishMain(run);
+    run('git checkout -q feature');
+    assert.ok(!fs.existsSync(path.join(work, 'modules', 'grading', 'grader-new.js')), 'the new file is on main only');
+
+    const { result, out } = capturePreflight({ task_id: 4244, head_sha: null }, {});
+    assert.equal(result.ok, false);
+    assert.equal(result.reason, 'stale-tooling');
+    assert.match(out, /- scripts\/gds\/ship-land\.js/, 'a carved ship-*.js is tooling');
+    assert.match(out, /- modules\/grading\/grader-new\.js/, 'a file only main has is still matched');
+    assert.deepEqual(staleToolingFiles({ cwd: work }).sort(), ['modules/grading/grader-new.js', 'scripts/gds/ship-land.js']);
+  });
+});
+
+test('preflight (real git): the branch\'s OWN edit to a ship-*.js is not stale tooling', () => {
+  withPreflightRepo(({ work, run }) => {
+    fs.mkdirSync(path.join(work, 'scripts', 'gds'), { recursive: true });
+    fs.writeFileSync(path.join(work, 'scripts', 'gds', 'ship-land.js'), '// v1\n');
+    run('git add -A && git commit -q -m tooling');
+    publishMain(run);
+    run('git checkout -q -b feature');
+    fs.writeFileSync(path.join(work, 'scripts', 'gds', 'ship-land.js'), '// the fix this task ships\n');
+    run('git add -A && git commit -q -m "fix the land"');
+    const { result } = capturePreflight({ task_id: 4245, head_sha: null }, {});
+    assert.equal(result.ok, true);
+    assert.deepEqual(staleToolingFiles({ cwd: work }), []);
+  });
+});
+
 // ---- runner ----
 
 let pass = 0;

package/tests/start_env_guard.mjs

@@ -118,6 +118,22 @@ t('a hosted origin says the core installs with no token, and never re-offers the
   assert.doesNotMatch(card, /\bprivate\b/i, 'must not call the package private');
 });
 
+// task 1004288: the card above was corrected when the core went public, but the SKILL that
+// routes the same fresh-clone wall kept teaching the old posture — "a PRIVATE package", "404s
+// on any machine with no NPM_TOKEN", "the expected tokenless outcome". An agent that believes
+// that reads a real 404 (a version never published, a mistyped name) as normal and moves on.
+t('the builder-start skill agrees with the card: the core is public, and a 404 is not normal', () => {
+  const { readFileSync } = require('node:fs');
+  const path = require('node:path');
+  const skill = readFileSync(path.join(import.meta.dirname, '..', '.claude', 'skills', 'builder-start', 'SKILL.md'), 'utf8');
+  assert.doesNotMatch(skill, /PRIVATE package|private package/i, 'must not call @bongos/core a private package (ADR 0283)');
+  assert.doesNotMatch(skill, /expected tokenless outcome/i, 'must not present a tokenless 404 as expected');
+  assert.doesNotMatch(skill, /404s on any machine with no `?NPM_TOKEN/i, 'must not tell the agent a tokenless install 404s');
+  assert.match(skill, /PUBLIC npm package/, 'names the core as public');
+  assert.match(skill, /ADR 0283/, 'cites the decision that made it public');
+  assert.match(skill, /404 on `@bongos\/core` is therefore \*\*not\*\* a normal outcome/, 'says a 404 now means something is wrong');
+});
+
 t('isLocalOrigin: loopback is local, everything else is remote', () => {
   for (const o of ['http://localhost:3000', 'http://app.localhost:3000', 'http://127.0.0.1:3000', 'http://[::1]:3000']) {
     assert.equal(isLocalOrigin(o), true, `${o} should be local`);

package/tests/upgrade.mjs

@@ -1543,7 +1543,7 @@ t('persistPin: a refused origin push on a WIRED private instance is loud — nam
   assert.equal(r.refused, 'read-only-deploy-key');
   // The tokenless refusal is a plain sentence, not the bare status line.
   assert.match(r.error, /read-only deploy key at \/srv\/bongos\/acme\/\.git\/cloudbongos-deploy-key/, 'names the key');
-  assert.match(r.error, /no owner GitHub token is stored/, 'and why nothing else was tried');
+  assert.match(r.error, /no owner GitHub token was available/, 'and why nothing else was tried');
   assert.notEqual(r.error, 'git push failed');
   const text = warnings.join('\n');
   assert.match(text, /PIN NOT PUSHED/, 'shouts');
@@ -1655,6 +1655,25 @@ t('resolvePinPushAuth: the owner token is spent only when one is stored AND the
   assert.equal(await u.resolvePinPushAuth(dir, { log: hush, instance: inst, getGithubToken: async () => { throw new Error('secret-box off'); } }, at('git@github.com:acme/widgets.git')), null);
 });
 
+t('resolvePinPushAuth: on a hosted project\u2019s own box a missing row SAYS WHY, instead of falling back silently (task 1004065)', async () => {
+  // The project's own database has no provisioning table (ADR 0281), so the lookup
+  // answers null there — and on a checkout wired with the read-only deploy key that is
+  // not "the origin path", it is a push that cannot succeed.
+  const dir = { instanceDir: '/srv/bongos/acme' };
+  const wired = { config: { status: 0, stdout: 'ssh -F /dev/null -i /srv/bongos/acme/.git/cloudbongos-deploy-key -o IdentitiesOnly=yes\n' }, remote: { status: 0, stdout: 'git@github.com:acme/widgets.git\n' } };
+  const said = [];
+  const r = await u.resolvePinPushAuth(dir, { log: (m) => said.push(m), getInstanceBySlug: async () => null }, pinRun(wired));
+  assert.equal(r, null, 'still the remote path — there is no token to use');
+  const line = said.join('\n');
+  assert.match(line, /no provisioning row is readable from this database/, 'names what is missing');
+  assert.match(line, /read-only deploy key at \/srv\/bongos\/acme\/\.git\/cloudbongos-deploy-key/, 'and why the fallback cannot work');
+  assert.match(line, /pushes the pin from the hub/, 'and where the push actually happens');
+  // An UNWIRED checkout with no row (a laptop, a public instance) is the real origin path: quiet.
+  const quiet = [];
+  await u.resolvePinPushAuth(dir, { log: (m) => quiet.push(m), getInstanceBySlug: async () => null }, pinRun({ remote: wired.remote }));
+  assert.deepEqual(quiet, [], 'no noise where the fallback is correct');
+});
+
 t('runUpgrade --commit-pin: on a wired private instance the pin lands via the owner token, end to end', async () => {
   const dir = scratchConsumer({ pinned: '1.14.1', installed: '1.14.1' });
   const src = mkdtempSync(join(tmpdir(), 'otb-upgrade-src-'));