@bongos/core 1.19.1041 → 1.19.1043

package/src/bongos/routes/core-update.js

@@ -17,11 +17,21 @@
 //      press the button is a worse experience than showing nothing.
 // The gate costs its real audience nothing: an owner holds the atom on their own
 // instance by construction.
+//
+// GET /software-update (task 1004296) is the exception, and deliberately so: it is the
+// Settings panel's read, and the owner asked for the version and what's new to be shown in
+// EVERY builder's Settings, like a phone's Software Update screen. It discloses nothing the
+// public GET /version does not already publish (the running core) or npm does not (what is
+// newer, and its release notes), so the vulnerability-window reason above does not apply to
+// it — and it offers no act itself. Who may press Update is still the door's decision; this
+// only says, cosmetically, whether the viewer holds the atom the door checks.
 
 const express = require('express');
 const { asyncHandler } = require('./_helpers');
 const auth = require('../auth');
 const { readCoreUpdate, readCoreUpgrades } = require('../core-update');
+const { readSoftwareUpdate } = require('../software-update');
+const seams = require('../../module-seams');
 const { loadIdpConfig } = require('../auth-config');
 
 // WHERE A HOSTED PROJECT'S OWNER TAKES THE UPGRADE (task 1004174, ADR 0339): the hub's
@@ -30,7 +40,9 @@ const { loadIdpConfig } = require('../auth-config');
 // no capability. Both halves are already here on a federated project: provisioning
 // writes the hub origin and this project's hub client id, which IS its slug (ADR 0246),
 // into web.env. null when this instance is not federated with a hub — a self-hosted
-// instance, or the hub itself — so the hall offers no link rather than a wrong one.
+// instance, or the hub itself — so the hall offers no link rather than a wrong one. Since
+// task 1004296 it is the Settings panel's Update button that carries it (updateDoor below),
+// not the banner or the rail.
 // Only the origin and the client id are read; the client secret never leaves auth-config.
 function hubDeployUrl(config) {
   if (!config || typeof config.origin !== 'string' || !config.clientId) return null;
@@ -38,6 +50,35 @@ function hubDeployUrl(config) {
   return `${config.origin.replace(/\/+$/, '')}/deploy?project=${encodeURIComponent(String(config.clientId))}`;
 }
 
+// WHERE THIS PROJECT'S UPDATE BUTTON GOES (task 1004296). The act itself never happens in
+// Settings: it is the deploy door's two-step confirm and auto-rollback (ADR 0293), and that
+// door is the provisioning module's — so only a hall that runs provisioning has one.
+//   local — this hall runs the door: its own /deploy.
+//   hub   — a hosted project: the hub's door for this project (ADR 0339 D3).
+//   cli   — neither: a self-hosted instance, upgraded on its server with `bongos upgrade`.
+function updateDoor({ provisioning, idp }) {
+  if (provisioning) return { kind: 'local', url: '/deploy' };
+  const url = hubDeployUrl(idp);
+  return url ? { kind: 'hub', url } : { kind: 'cli', url: null };
+}
+
+function provisioningEnabled() {
+  try { return require('../../modules').isModuleEnabled('provisioning'); } catch { return false; }
+}
+
+// Does the viewer hold `core.pin.move`? COSMETIC — it decides whether the panel draws the
+// Update button, never whether an update may happen; the door re-checks per request. The
+// same read GET /me's nav permissions make, and the same fail-closed reading: authority that
+// cannot be established is "no".
+async function holdsCorePin(req) {
+  try {
+    const government = seams.resolveOptional('government');
+    if (!government || typeof government.resolveBuilderPermissions !== 'function') return false;
+    const held = (await government.resolveBuilderPermissions(req.builder && req.builder.id)) || [];
+    return held.includes('core.pin.move');
+  } catch { return false; }
+}
+
 function safeIdpConfig() {
   try { return loadIdpConfig(); } catch { return null; }
 }
@@ -49,7 +90,12 @@ function upgradesLimit(raw) {
   return Math.min(100, Math.max(1, n));
 }
 
-function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
+function buildCoreUpdateRouter({
+  upgrades = readCoreUpgrades,
+  softwareUpdate = readSoftwareUpdate,
+  canUpdate = holdsCorePin,
+  doorInputs = () => ({ provisioning: provisioningEnabled(), idp: safeIdpConfig() }),
+} = {}) {
   const router = express.Router();
 
   router.get(
@@ -67,7 +113,9 @@ function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
       // that cannot name its own core reports `no_answer` and renders no banner.
       let running = null;
       try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
-      res.json({ ok: true, update: await readCoreUpdate({ running }), deploy_url: hubDeployUrl(safeIdpConfig()) });
+      // No `deploy_url` any more (task 1004296): the banner on a hall without a door of its
+      // own links to Settings → Software update, and the hand-off lives on GET /software-update.
+      res.json({ ok: true, update: await readCoreUpdate({ running }) });
     }, { errorCode: 'core_update_failed', message: false }),
   );
 
@@ -89,6 +137,20 @@ function buildCoreUpdateRouter({ upgrades = readCoreUpgrades } = {}) {
     }, { errorCode: 'core_upgrades_unreadable', message: false }),
   );
 
+  // GET /software-update — Settings → Software update (task 1004296): this project's core,
+  // the newest release its channel allows, what the versions between them carry, and where
+  // this project's Update button leads. Any signed-in builder (see the header).
+  router.get(
+    '/software-update',
+    auth.requireBuilder,
+    asyncHandler('GET /software-update', async (req, res) => {
+      let running = null;
+      try { running = require('../../module-api').CORE_VERSION; } catch { /* version unknown */ }
+      const [update, can] = await Promise.all([softwareUpdate({ running }), canUpdate(req)]);
+      res.json({ ok: true, update, door: updateDoor(doorInputs()), can_update: can === true });
+    }, { errorCode: 'software_update_failed', message: false }),
+  );
+
   return router;
 }
 

package/src/bongos/serve-internal.js

@@ -443,14 +443,17 @@ function clientBundleScriptTag() {
 // module's widget is never injected (it vanishes); contributeHallWidget is the second
 // gate (it no-ops a widget whose module is off). `scripts` is the loader projection
 // [{ key, src }]; default reads the live enabled set. Pure + exported for the test.
-function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled: isModuleEnabled })) {
+function injectModuleHallWidgets(html, scripts = hallWidgetScripts({ isEnabled: isModuleEnabled }), consumer = 'builders') {
   if (!Array.isArray(scripts) || scripts.length === 0) return html;
   const tags = scripts
     .map((s) => `<script src="${s.src}" defer></script>`)
     .join('');
-  // Anchor on builders.js's <script> regardless of its ?v= stamp so the module
-  // widgets always land immediately before the consumer that mounts them.
-  const anchor = html.match(/<script src="\/builders\/builders\.js[^"]*"[^>]*><\/script>/);
+  // Anchor on the consuming page script's <script> (builders.js on the index, task.js on
+  // a task's page — task 1004301) regardless of its ?v= stamp, so the module widgets
+  // always land immediately before the consumer: both are `defer`, so they run in
+  // document order, and a widget's listener exists before the page first announces.
+  const name = /^[a-z-]+$/.test(consumer) ? consumer : 'builders';
+  const anchor = html.match(new RegExp(`<script src="\\/builders\\/${name}\\.js[^"]*"[^>]*><\\/script>`));
   if (anchor) return html.replace(anchor[0], tags + anchor[0]);
   return html.includes('</body>') ? html.replace('</body>', `${tags}</body>`) : html + tags;
 }
@@ -975,6 +978,23 @@ function mountInternalSurfaces(app) {
     return res.redirect(301, `${isBuildersHost(req) ? '' : '/builders'}/people${qs}`);
   });
 
+  // /deploy EXISTS ONLY WHERE THE DOOR DOES (task 1004296). The owner, 2026-09-25: /deploy is
+  // "only for bongos builders hall itself, not for all production ones". Every datum and
+  // both acts on that page are provisioning-module routes, so a hall that does not run the
+  // module — a hosted project, a self-hosted instance — was serving a page with nothing
+  // behind it. It now answers with Settings → Software update, where every hall reads its
+  // version and takes its update. Like the /scouting redirect above it carries no gate: the
+  // redirect discloses nothing, and Settings' own wall applies the moment it is followed.
+  app.use((req, res, next) => {
+    if (isModuleSurfaceHost(req)) return next();
+    if (req.method !== 'GET' && req.method !== 'HEAD') return next();
+    if (!DEPLOY_PAGE_RE.test(path.posix.normalize(req.path))) return next();
+    let door = false;
+    try { door = isModuleEnabled('provisioning'); } catch { door = false; }
+    if (door) return next();
+    return res.redirect(302, `${isBuildersHost(req) ? '' : '/builders'}/settings#software-update`);
+  });
+
   app.use((req, res, next) => {
     if (isModuleSurfaceHost(req)) return next();
     if (!req.path.startsWith('/builders')) return next();
@@ -1053,6 +1073,17 @@ function mountInternalSurfaces(app) {
   if (buildersHtml['index.html']) {
     buildersHtml['index.html'] = injectModuleHallWidgets(buildersHtml['index.html']);
   }
+  // task 1004301: the same seam for a task's own page. A module that ships
+  // public/task-widget.js is loaded just before task.js, and fills the slot task.js
+  // renders and announces (`otb:task-shown`). The page names no module; with none
+  // enabled, nothing is injected and the slot stays empty.
+  if (buildersHtml['task.html']) {
+    buildersHtml['task.html'] = injectModuleHallWidgets(
+      buildersHtml['task.html'],
+      hallWidgetScripts({ isEnabled: isModuleEnabled, file: 'task-widget.js' }),
+      'task',
+    );
+  }
 
   // Serve enabled modules' browser assets at /modules/<key>/public/* — the URL the
   // loader's hallWidgetScripts projection points at. Mounted BEFORE the /builders

package/src/bongos/software-update.js

@@ -0,0 +1,127 @@
+'use strict';
+
+// src/bongos/software-update.js — Settings → Software update (task 1004296): this project's
+// running core, the newest release its update channel lets it take, and what is in the
+// versions between the two.
+//
+// The owner, 2026-09-25: "each builders hall settings has a version description where they
+// can pull the latest release. Just like iOS does." So this is the one place any project —
+// the platform included — reads its version and what an update would bring. It is the CORE's,
+// not a module's, because every project installs releases.
+//
+// WHAT'S NEW COMES FROM THE PACKAGE'S OWN RELEASE NOTES, never from the changelog. Every CI
+// version's changelog line reads "carrier for merges landed since X", which names no work;
+// release-notes.json (scripts/gds/release-notes.js, task 1004218) is the one per-version
+// list of what landed, and the newest package carries the whole history. The running core's
+// own copy stops at its own version, so an update's notes always come off the registry
+// (package-registry.js: streamed, cached, fail-soft).
+//
+// THE CHANNEL RULE IS NOT RESTATED HERE, as in core-update.js: `resolveChannelTarget` is the
+// upgrade runner's own function, so this never offers a version the runner would refuse.
+// No channel is passed, exactly as the banner passes none: an instance does not store its
+// own channel, and the runner's default is what it would get.
+//
+// A READING, NEVER A GUESS. `reading` is 'ok' only when the registry answered; "up to date"
+// is `offered: null` on an ok reading and nothing else. Notes that could not be read say so,
+// and a version whose notes are missing is shown as missing rather than as empty.
+
+const {
+  CORE_PKG,
+  DEFAULT_CHANNEL,
+  normalizeChannel,
+  resolveChannelTarget,
+  compareSemver,
+} = require('../../scripts/gds/update-channel.js');
+const { readRegistry } = require('./package-registry');
+
+const VERSION_RE = /^\d+\.\d+\.\d+$/;
+// The same bound the deploy page puts on a line: a release note is a sentence, and one that
+// came off the network is re-checked before it is drawn.
+const TEXT_MAX = 400;
+// A project months behind can be hundreds of versions short. The panel lists the newest
+// ones and counts the rest; every one of them is still in the update.
+const VERSIONS_MAX = 40;
+
+function boundText(text) {
+  const t = String(text || '').trim();
+  return t.length > TEXT_MAX ? `${t.slice(0, TEXT_MAX - 1)}…` : t;
+}
+
+/** One version's entries, re-checked; null when the notes do not list the version at all. */
+function entriesFor(notes, version) {
+  const list = notes && Object.prototype.hasOwnProperty.call(notes, version) ? notes[version] : undefined;
+  if (!Array.isArray(list)) return null;
+  const out = [];
+  for (const e of list) {
+    const text = boundText(e && e.text);
+    if (!text) continue;
+    const id = e && /^\d{1,12}$/.test(String(e.id == null ? '' : e.id)) ? String(e.id) : null;
+    out.push({ id, text });
+  }
+  return out;
+}
+
+/**
+ * The panel's whole answer, from one registry reading. PURE — no clock, no I/O.
+ *
+ * `registry` and `notes` are package-registry.js's `readRegistry` result. Versions in the
+ * update are the published ones above `running` and at or below `offered`, newest first.
+ */
+function softwareUpdateVerdict({ running, channel, registry, notes, checkedAt }) {
+  const ch = normalizeChannel(channel == null ? DEFAULT_CHANNEL : channel);
+  const base = { checked_at: checkedAt, running: running || null, channel: ch };
+  if (!running || !VERSION_RE.test(String(running))) {
+    return { ...base, reading: 'no_answer', error: 'this project could not name the version it runs', offered: null, newest: null, whats_new: null };
+  }
+  if (!registry || !registry.ok) {
+    return { ...base, reading: 'no_answer', error: (registry && registry.error) || 'the registry could not be read', offered: null, newest: null, whats_new: null };
+  }
+  const offered = resolveChannelTarget({ installed: running, channel: ch, available: registry.versions }) || null;
+  const published = registry.published || {};
+  const answer = {
+    ...base,
+    reading: 'ok',
+    error: null,
+    offered,
+    offered_published_at: offered ? published[offered] || null : null,
+    newest: registry.newest || null,
+    whats_new: null,
+  };
+  if (!offered) return answer;
+
+  const inUpdate = registry.versions
+    .filter((v) => compareSemver(v, running) > 0 && compareSemver(v, offered) <= 0)
+    .sort((a, b) => compareSemver(b, a));
+  const shown = inUpdate.slice(0, VERSIONS_MAX);
+  const ok = !!(notes && notes.ok);
+  answer.whats_new = {
+    ok,
+    error: ok ? null : ((notes && notes.error) || 'the release notes could not be read'),
+    count: inUpdate.length,
+    more: inUpdate.length - shown.length,
+    versions: shown.map((version) => ({
+      version,
+      published_at: published[version] || null,
+      entries: ok ? entriesFor(notes.notes, version) : null,
+    })),
+  };
+  return answer;
+}
+
+/**
+ * What GET /api/bongos/software-update answers — and this file's one export.
+ *
+ * `get`/`now`/`store` pass through to the registry reader, so a test drives the real
+ * packument parsing, the real tarball stream and the real cache rather than a stub.
+ */
+async function readSoftwareUpdate({ running, channel, get, now = Date.now, store } = {}) {
+  const t = now();
+  const { registry, notes } = await readRegistry({
+    pkg: CORE_PKG, get, now, store,
+    // Nothing to describe when nothing newer is published: skip the download.
+    haveNotesFor: (newest) => !VERSION_RE.test(String(running || '')) || compareSemver(newest, running) <= 0,
+  });
+  return softwareUpdateVerdict({ running, channel, registry, notes, checkedAt: new Date(t).toISOString() });
+}
+
+module.exports = { readSoftwareUpdate };

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.1041'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.1043'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');
@@ -494,6 +494,15 @@ module.exports = {
   responsibilityFor,
   ROLE_RESPONSIBILITIES,
 
+  // --- readPackageRegistry({ pkg, haveNotesFor, get, now, store }) — what the npm
+  //     registry says about a package: its versions, their publish dates, the
+  //     `latest` label, and the release notes the newest version was packed with
+  //     (task 1004296). The core owns it because Settings → Software update needs
+  //     it in every hall; a module that publishes a package reads the same answer
+  //     and the same process-local cache through here. Fail-soft: it resolves
+  //     `{ registry, notes }` with `ok:false` and a sentence, never a throw.
+  readPackageRegistry: (...a) => require('./bongos/package-registry').readRegistry(...a),
+
   // --- logging
   logger,
 };

package/src/module-loader/loader.js

@@ -213,15 +213,25 @@ function mountModuleRoutes(router, { isEnabled } = {}, opts) {
 // never injected), and contributeHallWidget itself no-ops a stale widget whose module
 // is off. No-op (empty list) until a module ships a hall widget — same SAFE-BY-
 // CONSTRUCTION posture as every other seam here. Returns [{ key, src }].
-function hallWidgetScripts({ isEnabled } = {}, opts) {
+//
+// ONE SEAM, ONE FILE PER PAGE (task 1004301). `file` names which page's widget is being
+// asked for: hall-widget.js for the hall index (the default, and the only caller until
+// then), task-widget.js for a task's own page. Same declaration (uiSections), same
+// enabled-only asset mount, same "a disabled module simply is not there" — so a module
+// adds a line to the task page without the page's own code ever naming it. The name is
+// matched against PAGE_WIDGET_FILES rather than trusted, so no caller can turn this into
+// a way to serve an arbitrary file.
+const PAGE_WIDGET_FILES = Object.freeze(['hall-widget.js', 'task-widget.js']);
+function hallWidgetScripts({ isEnabled, file = 'hall-widget.js' } = {}, opts) {
+  if (!PAGE_WIDGET_FILES.includes(file)) return [];
   const out = [];
   for (const { key, dir, manifest } of discovered(opts).loaded) {
     if (typeof isEnabled === 'function' && !isEnabled(key)) continue;
     const sections = (manifest.contributes && manifest.contributes.uiSections) || [];
     if (sections.length === 0) continue;
-    const scriptPath = path.join(dir, 'public', 'hall-widget.js');
+    const scriptPath = path.join(dir, 'public', file);
     if (!fs.existsSync(scriptPath)) continue; // declarative-only uiSections (e.g. status-page section)
-    out.push({ key, src: `/modules/${key}/public/hall-widget.js` });
+    out.push({ key, src: `/modules/${key}/public/${file}` });
   }
   return out;
 }

package/tests/core_upgrade_owner_door.mjs

@@ -342,8 +342,9 @@ await t('deploy_url is the hub origin plus this project\'s slug, and null withou
 const SHELL = fs.readFileSync(path.join(ROOT, 'modules/hall-ui/public/shell.js'), 'utf8');
 
 // The real shell.js in a DOM stub (the tests/core_update_banner.mjs harness), with the
-// /core-update answer carrying a deploy_url and elements that remember their attributes.
-function boot({ provisioning, deployUrl }) {
+// /core-update answer optionally carrying a deploy_url — an older server still sends one —
+// and elements that remember their attributes.
+function boot({ provisioning, deployUrl, pathname = '/settings', hash = '' }) {
   const els = new Map();
   const inserted = [];
   const makeEl = () => ({
@@ -372,7 +373,7 @@ function boot({ provisioning, deployUrl }) {
     addEventListener() {}, dispatchEvent() {},
     get cookie() { return ''; }, set cookie(_v) {},
   };
-  const location = { hostname: 'h', origin: 'https://h', pathname: '/settings', hash: '', assign() {}, replace() {} };
+  const location = { hostname: 'h', origin: 'https://h', pathname, hash, assign() {}, replace() {} };
   const update = { running: '1.19.871', latest: '1.19.1033', behind: true, reading: 'ok' };
   const windowObj = {
     __BRANDING__: {}, __MODULES__: { enabled: { provisioning } },
@@ -401,40 +402,48 @@ function boot({ provisioning, deployUrl }) {
 const settle = () => new Promise((r) => setTimeout(r, 0));
 const HUB = 'https://cloudbongos.com/deploy?project=hoodify-finance';
 
-await t('on a hosted project, the banner\'s Upgrade goes to the hub door for THIS project', async () => {
+// Task 1004296 moved the hand-off: a hall without a door of its own sends its owner to
+// Settings → Software update, whose Update button carries the hub address (GET
+// /software-update's `door`). The banner and the rail no longer link off-site.
+await t('on a hosted project, the banner\'s Upgrade goes to Settings → Software update, not off-site', async () => {
   const b = boot({ provisioning: false, deployUrl: HUB });
   await settle();
   assert.ok(b.banner(), 'the banner renders');
-  assert.ok(b.banner().innerHTML.includes(`href="${HUB}"`), 'Upgrade links to the hub');
-  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/, 'never the dead local page');
+  assert.match(b.banner().innerHTML, /href="\/settings#software-update"/, 'Upgrade opens the Software update panel');
+  assert.ok(!b.banner().innerHTML.includes(HUB), 'never the hub address directly, even when an older server sends one');
+  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/, 'never the local /deploy, which this hall no longer has');
 });
 
-await t('on a hosted project, the rail\'s Deploy item is re-pointed at the hub', async () => {
+await t('on a hosted project, the rail\'s Deploy item stays hidden — it is the platform hall\'s page', async () => {
   const b = boot({ provisioning: false, deployUrl: HUB });
   await settle();
   const item = b.deployItem();
-  assert.equal(item.getAttribute('href'), HUB);
-  assert.equal('module' in item.dataset, false, 'its module gate is lifted so the access loop stops hiding it');
-  assert.equal(item.hidden, false, 'an Archon on their own project sees it');
+  assert.equal(item.getAttribute('href'), null, 'not re-pointed at the hub');
+  assert.equal(item.dataset.module, 'provisioning', 'its module gate stays, so a hall without the door hides it');
 });
 
-await t('a hosted project with no hub, or a hub address that is not plain http(s), offers no link', async () => {
-  for (const url of [null, 'javascript:alert(1)', 'https://x.test/"><img src=x onerror=alert(1)>', 42]) {
+await t('a hall with no door of its own and no hub still links to Software update', async () => {
+  for (const url of [null, 'javascript:alert(1)', 42]) {
     const b = boot({ provisioning: false, deployUrl: url });
     await settle();
-    assert.ok(b.banner(), 'the news is still told');
-    assert.doesNotMatch(b.banner().innerHTML, /core-update-notice__action/, `no action for ${JSON.stringify(url)}`);
-    const item = b.deployItem();
-    assert.equal(item.getAttribute('href'), null, `the rail is not re-pointed for ${JSON.stringify(url)}`);
-    assert.equal(item.dataset.module, 'provisioning', 'and it keeps its module gate, so a hosted project still hides it');
+    assert.match(b.banner().innerHTML, /href="\/settings#software-update"/, `Software update for ${JSON.stringify(url)}`);
+    assert.doesNotMatch(b.banner().innerHTML, /javascript:/);
   }
 });
 
-await t('on the platform, the local door wins: the hub address is ignored', async () => {
+await t('on the Software update panel itself, the banner points rather than linking to the page it is on', async () => {
+  const b = boot({ provisioning: false, pathname: '/settings', hash: '#software-update' });
+  await settle();
+  assert.doesNotMatch(b.banner().innerHTML, /core-update-notice__action/, 'no link to where you already are');
+  assert.match(b.banner().innerHTML, /core-update-notice__hint/);
+});
+
+await t('on the platform, the local door wins: the banner links /deploy and the rail keeps it', async () => {
   const b = boot({ provisioning: true, deployUrl: HUB });
   await settle();
   assert.match(b.banner().innerHTML, /href="\/deploy"/);
   assert.ok(!b.banner().innerHTML.includes(HUB));
+  assert.ok(!b.banner().innerHTML.includes('software-update'), 'the platform takes its update at its own door');
   const item = b.deployItem();
   assert.notEqual(item.getAttribute('href'), HUB, 'the rail keeps the local /deploy');
   assert.equal(item.dataset.module, 'provisioning', 'and its module gate, which the platform satisfies');

package/tests/hall_record_world.mjs

@@ -305,6 +305,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
   const requests = [];
   const writes = [];
   const toasts = [];
+  const dispatched = [];   // task 1004301: what the page announced (otb:task-shown)
   const els = new Map();
   const makeEl = () => ({
     dataset: {}, style: {}, textContent: '', hidden: false, disabled: false, _html: '',
@@ -326,6 +327,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
     querySelectorAll() { return []; },
     createElement() { return makeEl(); },
     addEventListener(type, fn) { if (type === 'DOMContentLoaded') onReady = fn; },
+    dispatchEvent(e) { dispatched.push(e); return true; },
   };
   const client = {
     request: async (method, p, opts) => {
@@ -393,7 +395,8 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
     confirm: () => true,
     navigator: { clipboard: { writeText: async () => {} } },
   };
-  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Date, URL, URLSearchParams };
+  class CustomEvent { constructor(type, init) { this.type = type; this.detail = init && init.detail; } }
+  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Date, URL, URLSearchParams, CustomEvent };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   if (withReader) vm.runInContext(MD_SRC, sandbox, { filename: 'md-reader.js' });
@@ -407,6 +410,8 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
     requests,
     writes,
     toasts,
+    dispatched,
+    win: windowObj,
   };
 }
 
@@ -1052,3 +1057,20 @@ test("a move-to-goal refusal (403) surfaces the server's own sentence, verbatim"
     `the server's own sentence must reach the toast, not a generic fallback — got: ${r.toasts.join(' | ')}`);
   assert.equal(task.goal_id, 1000071, 'a refused PATCH must not move the task locally');
 });
+
+// task 1004301 — a slot a MODULE may fill, and the announcement that tells it which task.
+// The page names no module: it draws an empty #task-contrib under the lifecycle rail and
+// announces each render, and a module's task-widget.js does the rest.
+test('the task page renders an empty module slot and announces every render', async () => {
+  const r = renderTask({ ...BASE_TASK });
+  r.boot();
+  for (let i = 0; i < 5; i++) await settle();
+  const html = r.html();
+  assert.match(html, /<div class="tk-contrib" id="task-contrib" aria-live="polite"><\/div>/, 'an empty slot');
+  assert.ok(html.indexOf('id="task-contrib"') > html.indexOf('class="tk-rail"'), 'under the lifecycle rail');
+  const shown = r.dispatched.filter((e) => e.type === 'otb:task-shown');
+  assert.equal(shown.length, 1);
+  assert.deepEqual({ ...shown[0].detail }, { id: '1003305', status: 'shipped' }, 'only the id and the status travel');
+  assert.deepEqual({ ...r.win.OTBTaskShown }, { id: '1003305', status: 'shipped' }, 'left on window for a widget that loads late');
+  assert.doesNotMatch(read('task.js'), /npm-release/, 'the core page names no module');
+});

package/tests/helpers.mjs

@@ -73,6 +73,9 @@ import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 import { execFileSync } from 'node:child_process';
 import vm from 'node:vm';
+import zlib from 'node:zlib';
+import { EventEmitter } from 'node:events';
+import { Readable } from 'node:stream';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -1012,3 +1015,92 @@ export function macShapedTools(binDir) {
     '',
   ].join('\n'), { mode: 0o755 });
 }
+
+// ---- a fake npm registry (task 1002622; shared since task 1004296) -------------------
+//
+// A real gzipped tar built by hand, a packument, and an `https.get` stand-in that answers
+// in 777-byte chunks — so a reader under test runs its real gunzip, tar walk and JSON parse,
+// with headers landing across chunk boundaries. Used by tests/npm_release_work.mjs and
+// tests/software_update.mjs.
+
+function tarHeader(name, size, type = '0') {
+  const h = Buffer.alloc(512, 0);
+  h.write(name.slice(0, 100), 0, 'utf8');
+  h.write('0000644\0', 100, 'ascii');
+  h.write('0000000\0', 108, 'ascii');
+  h.write('0000000\0', 116, 'ascii');
+  h.write(`${size.toString(8).padStart(11, '0')}\0`, 124, 'ascii');
+  h.write('00000000000\0', 136, 'ascii');
+  h.write('        ', 148, 'ascii');
+  h.write(type, 156, 'ascii');
+  h.write('ustar\0', 257, 'ascii');
+  h.write('00', 263, 'ascii');
+  let sum = 0;
+  for (const b of h) sum += b;
+  h.write(`${sum.toString(8).padStart(6, '0')}\0 `, 148, 'ascii');
+  return h;
+}
+function tarEntry(name, data, type = '0') {
+  const body = Buffer.isBuffer(data) ? data : Buffer.from(data);
+  const pad = Buffer.alloc((512 - (body.length % 512)) % 512, 0);
+  return Buffer.concat([tarHeader(name, body.length, type), body, pad]);
+}
+function paxEntry(path) {
+  // A pax record is "<len> <key>=<value>\n", where <len> counts its own digits too.
+  const rec = (k, v) => {
+    const body = ` ${k}=${v}\n`;
+    let n = body.length + 1;
+    while (String(n).length + body.length !== n) n = String(n).length + body.length;
+    return `${n}${body}`;
+  };
+  return tarEntry('PaxHeader/x', rec('path', path), 'x');
+}
+/** A gzipped npm-shaped tarball. `notes` null leaves release-notes.json out. */
+export function npmTarball({ notes, padBytes = 40000, pax = false, pkg = '@bongos/core' } = {}) {
+  const parts = [
+    tarEntry('package/package.json', JSON.stringify({ name: pkg })),
+    // A large file BEFORE the notes, so the reader has to skip across many chunks.
+    tarEntry('package/big.js', Buffer.alloc(padBytes, 97)),
+  ];
+  if (notes) {
+    const json = JSON.stringify(notes);
+    if (pax) parts.push(paxEntry('package/release-notes.json'), tarEntry('package/SHORTNAME', json));
+    else parts.push(tarEntry('package/release-notes.json', json));
+  }
+  parts.push(Buffer.alloc(1024, 0));
+  return zlib.gzipSync(Buffer.concat(parts));
+}
+
+// ---- a fake registry -----------------------------------------------------------------
+
+export function npmPackument({ versions, latest, times, pkg = '@bongos/core', origin = 'https://registry.npmjs.org' }) {
+  const doc = { name: pkg, 'dist-tags': { latest }, versions: {}, time: {} };
+  for (const v of versions) {
+    doc.versions[v] = { version: v, dist: { tarball: `${origin}/${pkg}/-/${pkg.split('/').pop()}-${v}.tgz` } };
+    doc.time[v] = times[v];
+  }
+  return doc;
+}
+
+/** `get` answering from `routes` (url → { status, body }), recording every URL asked for. */
+export function fakeHttpsGet(routes) {
+  const asked = [];
+  const get = (url, opts, cb) => {
+    asked.push(url);
+    const req = new EventEmitter();
+    req.destroy = () => {};
+    setImmediate(() => {
+      const r = routes[url];
+      if (!r) { req.emit('error', new Error(`no route for ${url}`)); return; }
+      const body = Buffer.isBuffer(r.body) ? r.body : Buffer.from(typeof r.body === 'string' ? r.body : JSON.stringify(r.body));
+      // Small chunks, so a tar header lands across a chunk boundary.
+      const chunks = [];
+      for (let i = 0; i < body.length; i += 777) chunks.push(body.subarray(i, i + 777));
+      const res = Readable.from(chunks);
+      res.statusCode = r.status || 200;
+      cb(res);
+    });
+    return req;
+  };
+  return { get, asked };
+}