@bongos/core 1.19.1072 → 1.19.1074

package/tests/box_sync_scope_report.mjs

@@ -1,126 +0,0 @@
-// tests/box_sync_scope_report.mjs
-//
-// Task 1002731 — the scope read-out that makes a too-narrow box VISIBLE.
-//
-// The failure being guarded is a silent one: a box comes up holding only the
-// base slice (no modules/ at all) and nothing tells the builder. Live, that was
-// 247 of 248 source grants on the cloudbongos fleet — including an Archon
-// holding 7 active claims — and the only way to see it was reading box_events
-// on the control plane.
-//
-// formatScopeReport is PURE (takes the GET /box/scope body, returns lines), so
-// this needs no box, no network and no DB.
-//
-// Run:  node tests/box_sync_scope_report.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const { formatScopeReport } = require('../scripts/gds/box-sync.js');
-// task 1003087 — the widen read-out lives in the same module.
-const sync = require('../scripts/gds/box-sync.js');
-
-let passed = 0;
-let failed = 0;
-function t(name, fn) {
-  try { fn(); passed++; console.log(`  PASS  ${name}`); }
-  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-}
-const joined = (scope) => formatScopeReport(scope).join('\n');
-
-t('base-only is stated in plain words, with a why and a fix', () => {
-  const out = joined({ scope: 'base', mode: 'sparse', modules: [], sparse_paths: ['docs', 'scripts'], task_scope: true });
-  assert.match(out, /BASE ONLY/, 'the degraded state is named, not buried');
-  assert.match(out, /no modules\/ code at all/, 'says what is actually missing');
-  assert.match(out, /Why:/, 'explains the cause');
-  assert.match(out, /builder-claim/, 'gives the builder the actual next step');
-});
-
-t('task scope names the modules the box holds', () => {
-  const out = joined({ scope: 'task', mode: 'sparse', modules: ['dev-box', 'hall-ui'], sparse_paths: ['a', 'b', 'c'], task_scope: true });
-  assert.match(out, /scope: task/);
-  assert.match(out, /dev-box, hall-ui/, 'names them rather than just counting');
-  assert.match(out, /3 sparse entries/);
-});
-
-t('full + EMPTY modules surfaces the 1002729 fallback rather than looking healthy', () => {
-  // The exact live shape: claims held, but their goals declare no scope_modules.
-  // The box works, so nothing complains — but task-scoping is not doing anything,
-  // and that is worth telling someone.
-  const out = joined({ scope: 'full', mode: 'full', modules: [], sparse_paths: null, task_scope: true });
-  assert.match(out, /scope: full/);
-  assert.match(out, /declares no module scope/, 'names why it fell back');
-  assert.match(out, /scope_modules/, 'points at the thing to fix');
-});
-
-t('full with real modules does NOT nag about the fallback', () => {
-  const out = joined({ scope: 'full', mode: 'full', modules: ['kernel'], sparse_paths: null, task_scope: false });
-  assert.match(out, /scope: full/);
-  assert.ok(!/declares no module scope/.test(out), 'no false alarm when nothing is wrong');
-});
-
-t('starter is distinguished from a claim-scoped box', () => {
-  const out = joined({ scope: 'starter', mode: 'sparse', modules: null, sparse_paths: ['x'], task_scope: false });
-  assert.match(out, /starter/);
-  assert.match(out, /not scoped to your claim/);
-});
-
-t('a missing or malformed body degrades to one honest line, never a throw', () => {
-  // This runs on an already-degraded path; it must not be the thing that fails.
-  for (const bad of [null, undefined, 'nope', 42, []]) {
-    const lines = formatScopeReport(bad);
-    assert.ok(Array.isArray(lines) && lines.length >= 1, `handled ${JSON.stringify(bad)}`);
-  }
-  assert.match(joined(null), /could not read/);
-});
-
-t('an unknown scope value is reported verbatim rather than swallowed', () => {
-  assert.match(joined({ scope: 'something-new', sparse_paths: [] }), /something-new/);
-});
-
-// ---------------------------------------------------------------------------
-// task 1003087 — the --widen read-out
-//
-// The whole feature exists because a widen that silently stops applying is
-// indistinguishable from one that works. So the report must say when the server
-// stored a path it will NOT apply (outside the caller's rank scope) — otherwise
-// this fix reintroduces its own bug one layer up.
-// ---------------------------------------------------------------------------
-
-const widenLines = (body) => sync.formatWidenReport(body).join('\n');
-
-t('an empty widen set says so plainly rather than printing nothing', () => {
-  assert.match(widenLines({ widen_paths: [], ignored: [] }), /nothing kept/i);
-});
-
-t('a kept set names the paths and the count', () => {
-  const out = widenLines({ widen_paths: ['docs', 'modules/game'], ignored: [] });
-  assert.match(out, /2 path/);
-  assert.match(out, /docs/);
-  assert.match(out, /modules\/game/);
-});
-
-t('an IGNORED path is called out loudly, not folded into the kept list', () => {
-  const out = widenLines({ widen_paths: ['docs', 'modules/game'], ignored: ['modules/game'] });
-  assert.match(out, /IGNORED/);
-  assert.match(out, /rank scope/i,
-    'the reason must be named — "stored but not applied" with no why is the silent failure again');
-});
-
-t('a garbage / missing body degrades to one honest line rather than throwing', () => {
-  for (const bad of [null, undefined, 'nope', 42, []]) {
-    assert.match(widenLines(bad), /could not read/i);
-  }
-});
-
-t('valueAfter reads the argument after a flag, and refuses the next flag as a value', () => {
-  assert.equal(sync.valueAfter(['--widen', 'docs'], '--widen'), 'docs');
-  assert.equal(sync.valueAfter(['--widen', '--dry-run'], '--widen'), null,
-    'consuming the next FLAG as a path would silently widen to something nobody typed');
-  assert.equal(sync.valueAfter(['--widen'], '--widen'), null);
-  assert.equal(sync.valueAfter([], '--widen'), null);
-});
-
-console.log(`\nbox_sync_scope_report.mjs: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);

package/tests/box_task_scope.mjs

@@ -1,169 +0,0 @@
-// tests/box_task_scope.mjs
-//
-// R95 (goal 1000051, ADR 0148) — the end-to-end PURE decision for task-scoped
-// source access, composing the two halves shipped in R92 + R93:
-//   lifecycle.moduleScopeForActiveClaims (claims → tasks → goals.scope_modules)
-//     → box-access.decideSourceAccess({ scopeKeys, moduleScopeMap })
-// Proves R95's done-when as named behavior: 0 active claims → BASE-only; N active
-// claims → BASE ∪ the union of ALL N goals' module scopes.
-//
-// DB-free: moduleScopeForActiveClaims honours the #538 deps.pool seam
-// (NODE_ENV==='test'), so a SQL-aware fake pool stands in for Postgres — we hand it
-// the rows the DISTINCT-union query would return (the union itself is Postgres's
-// job, shape-proven in module_scope_active_claims.mjs) and assert the WHOLE chain
-// down to the sparse-checkout paths. The real module-scope-map (a pure core module)
-// is the map the route passes in.
-//
-// Run:  node tests/box_task_scope.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
-
-process.env.NODE_ENV = 'test';
-
-const require = createRequire(import.meta.url);
-const db = require('../modules/lifecycle/db.js');
-const access = require('../modules/dev-box/box-access.js');
-const scopeMap = require('../src/bongos/module-scope-map.js');
-
-const { test, summary } = makeRunner();
-const BASE = access.BASE_SPARSE_PATHS;
-
-// Fake pool: the resolver issues ONE query (claims→tasks→goals, unnest
-// scope_modules); return the module-key rows a builder's active claims would
-// produce (already DISTINCT-unioned + ORDER BY m, as Postgres would).
-function poolReturning(moduleKeyRows) {
-  const c = makeSqlAwareClient((s) =>
-    (/FROM claims c/.test(s) && /unnest\(g\.scope_modules\)/.test(s)) ? { rows: moduleKeyRows } : null);
-  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
-}
-
-// The full chain a box-fetch runs: resolve the active-claim scope, then decide the
-// source spec from it (rank still gates ALLOW/DENY).
-async function specForClaims({ builderId = 3, rank = 'metic', status = 'active', moduleKeyRows }) {
-  const pool = poolReturning(moduleKeyRows);
-  const scopeKeys = await db.moduleScopeForActiveClaims(builderId, { pool });
-  return { scopeKeys, decision: access.decideSourceAccess({ rank, status, scopeKeys, moduleScopeMap: scopeMap }) };
-}
-
-// =========================================================================
-// 0 active claims → BASE-only (the pre-existing Bongos instance, nothing extra)
-// =========================================================================
-await test('0 active claims → base-only spec', async () => {
-  const { scopeKeys, decision } = await specForClaims({ moduleKeyRows: [] });
-  assert.deepEqual(scopeKeys, [], 'no active claim → no scope keys');
-  assert.equal(decision.allowed, true);
-  assert.equal(decision.scope, 'base');
-  assert.deepEqual(decision.spec.sparsePaths, [...BASE], 'the box carries only BASE');
-});
-
-// =========================================================================
-// N active claims across goals → BASE ∪ the UNION of all N goals' scopes
-// =========================================================================
-await test('N active claims → base ∪ the union of all their goals’ module scopes', async () => {
-  // Two claims: goal A scoped {dev-box, status-ui}, goal B scoped {hall-ui}.
-  // Postgres DISTINCT-unions + ORDER BY m to this key set:
-  const { scopeKeys, decision } = await specForClaims({
-    moduleKeyRows: [{ module_key: 'dev-box' }, { module_key: 'hall-ui' }, { module_key: 'status-ui' }],
-  });
-  assert.deepEqual(scopeKeys, ['dev-box', 'hall-ui', 'status-ui'], 'union across the active claims');
-  assert.equal(decision.scope, 'task');
-  // BASE ∪ each module's DIRECTORY globs (dev-box's box-CLI FILE globs cone-filtered out).
-  assert.deepEqual(
-    decision.spec.sparsePaths,
-    [...BASE, 'devbox-app', 'modules/dev-box', 'modules/hall-ui', 'modules/status-ui'],
-    'every claimed goal’s module dirs are materialized, deduped + sorted',
-  );
-  assert.ok(!decision.spec.sparsePaths.includes('scripts/gds/box.js'), 'file globs never enter the sparse set');
-});
-
-// =========================================================================
-// One claim, one goal → BASE ∪ that goal's scope (the single-claim base case)
-// =========================================================================
-await test('a single claim → base ∪ that one goal’s module scope', async () => {
-  const { decision } = await specForClaims({ moduleKeyRows: [{ module_key: 'status-ui' }] });
-  assert.equal(decision.scope, 'task');
-  assert.deepEqual(decision.spec.sparsePaths, [...BASE, 'modules/status-ui']);
-});
-
-// =========================================================================
-// Rank/status STILL gate ALLOW/DENY ahead of any task scope (ADR 0148 C4 posture)
-// =========================================================================
-await test('an inactive builder is denied even with claims in scope', async () => {
-  const inactive = await specForClaims({ status: 'inactive', moduleKeyRows: [{ module_key: 'dev-box' }] });
-  assert.equal(inactive.decision.allowed, false);
-  assert.equal(inactive.decision.reason, 'BUILDER_INACTIVE');
-});
-
-// =========================================================================
-// Task 1002729 — an EMPTY scope is two different situations, not one
-// =========================================================================
-// The live defect: moduleScopeForActiveClaims returns [] both for "holds no
-// claim" and for "holds claims whose goals declare no scope_modules". Reading
-// both as BASE handed working builders a box with no modules/ at all — 247 of
-// 248 grants on the live fleet, including an Archon with 7 active claims.
-
-// A pool that answers BOTH queries the resolver pair now issues: the
-// claims→goals→scope_modules unnest, and the plain active-claim count.
-function poolReturningWithClaims(moduleKeyRows, claimCount) {
-  const c = makeSqlAwareClient((s) => {
-    if (/FROM claims c/.test(s) && /unnest\(g\.scope_modules\)/.test(s)) return { rows: moduleKeyRows };
-    if (/count\(\*\)/.test(s) && /FROM claims/.test(s)) return { rows: [{ n: claimCount }] };
-    return null;
-  });
-  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
-}
-
-async function specForClaimsWithCount({ builderId = 3, rank = 'metic', status = 'active', moduleKeyRows, claimCount }) {
-  const pool = poolReturningWithClaims(moduleKeyRows, claimCount);
-  const scopeKeys = await db.moduleScopeForActiveClaims(builderId, { pool });
-  const hasActiveClaims = (await db.activeClaimCountForBuilder(builderId, { pool })) > 0;
-  return { scopeKeys, hasActiveClaims, decision: access.decideSourceAccess({ rank, status, scopeKeys, hasActiveClaims, moduleScopeMap: scopeMap }) };
-}
-
-await test('claims held but every goal wall empty → RANK scope, never a stripped box', async () => {
-  // Exactly Lars's live shape: 7 active claims, all on goals with scope_modules={}.
-  const { scopeKeys, hasActiveClaims, decision } = await specForClaimsWithCount({
-    rank: 'archon', moduleKeyRows: [], claimCount: 7,
-  });
-  assert.deepEqual(scopeKeys, [], 'the union query still yields nothing — the goals declare no wall');
-  assert.equal(hasActiveClaims, true, 'but the builder IS working');
-  assert.equal(decision.scope, 'full', 'an Archon mid-claim gets the full surface, not base');
-  assert.equal(decision.spec.mode, 'full');
-  assert.notEqual(decision.scope, 'base', 'the regression this test exists to prevent');
-});
-
-await test('no claims at all → BASE-only is preserved (least privilege holds)', async () => {
-  const { hasActiveClaims, decision } = await specForClaimsWithCount({
-    rank: 'archon', moduleKeyRows: [], claimCount: 0,
-  });
-  assert.equal(hasActiveClaims, false);
-  assert.equal(decision.scope, 'base', 'an idle box is still not handed the repo');
-  assert.deepEqual(decision.spec.sparsePaths, [...BASE]);
-});
-
-await test('a declared goal wall still wins over the rank fallback', async () => {
-  // Claims AND a wall → task scope, exactly as before; the fix must not widen this.
-  const { decision } = await specForClaimsWithCount({
-    rank: 'archon', moduleKeyRows: [{ module_key: 'status-ui' }], claimCount: 2,
-  });
-  assert.equal(decision.scope, 'task', 'a real wall is still honoured, not overridden by rank');
-  assert.deepEqual(decision.spec.sparsePaths, [...BASE, 'modules/status-ui']);
-});
-
-await test('a Thetes mid-claim with no wall gets STARTER, not full — rank still bounds it', async () => {
-  const { decision } = await specForClaimsWithCount({
-    rank: 'thetes', moduleKeyRows: [], claimCount: 1,
-  });
-  assert.equal(decision.scope, 'starter', 'the fallback is rank-bounded; it is not a blanket widen');
-});
-
-await test('activeClaimCountForBuilder rejects a non-numeric builder id', async () => {
-  await assert.rejects(
-    () => db.activeClaimCountForBuilder('not-a-number', { pool: poolReturningWithClaims([], 0) }),
-    /must be numeric/,
-  );
-});
-
-summary();

package/tests/box_task_scope_pause.mjs

@@ -1,66 +0,0 @@
-// tests/box_task_scope_pause.mjs
-//
-// Regression guard for task 1003285 / ADR 0193 — the task-scoping PAUSE.
-// The owner decision: a box serves its RANK scope (full repo for Metic+),
-// not the claim-derived slice, unless BOX_TASK_SCOPE=on re-enables ADR 0148.
-//
-// Two layers, per the goal-1000077 lesson (a guard must assert the wiring,
-// not just the helper): (1) taskScopingPaused()'s env semantics — paused by
-// DEFAULT, only an explicit "on" re-enables; (2) the route source keeps BOTH
-// lifecycle scope-resolution sites (source-access + /box/scope) behind the
-// helper, and /box/scope keeps reporting task_scoping_paused — so deleting a
-// gate or the report fails here instead of silently reviving the slice.
-//
-// Run:  node --test tests/box_task_scope_pause.mjs
-
-import { strict as assert } from 'node:assert';
-import { test } from 'node:test';
-import { createRequire } from 'node:module';
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const require = createRequire(import.meta.url);
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { taskScopingPaused } = require('../modules/dev-box/routes/box.js');
-
-const withEnv = (value, fn) => {
-  const prev = process.env.BOX_TASK_SCOPE;
-  if (value === undefined) delete process.env.BOX_TASK_SCOPE;
-  else process.env.BOX_TASK_SCOPE = value;
-  try { return fn(); }
-  finally {
-    if (prev === undefined) delete process.env.BOX_TASK_SCOPE;
-    else process.env.BOX_TASK_SCOPE = prev;
-  }
-};
-
-test('paused by DEFAULT — an instance that sets nothing serves the rank scope', () => {
-  withEnv(undefined, () => assert.equal(taskScopingPaused(), true));
-  withEnv('', () => assert.equal(taskScopingPaused(), true));
-});
-
-test('only an explicit "on" re-enables the ADR 0148 slice (trim + case-insensitive)', () => {
-  withEnv('on', () => assert.equal(taskScopingPaused(), false));
-  withEnv(' ON ', () => assert.equal(taskScopingPaused(), false));
-});
-
-test('anything that is not "on" stays paused — no accidental re-enable', () => {
-  for (const v of ['off', 'true', '1', 'yes', 'paused', 'On!']) {
-    withEnv(v, () => assert.equal(taskScopingPaused(), true, `value ${JSON.stringify(v)} must stay paused`));
-  }
-});
-
-test('both lifecycle scope-resolution sites stay behind the pause gate', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'modules', 'dev-box', 'routes', 'box.js'), 'utf8');
-  const gated = src.match(/!taskScopingPaused\(\) && lifecycle && typeof lifecycle\.moduleScopeForActiveClaims === 'function'/g) || [];
-  const resolutionSites = src.match(/typeof lifecycle\.moduleScopeForActiveClaims === 'function'/g) || [];
-  assert.equal(resolutionSites.length, 2, 'expected exactly the two known resolution sites (source-access + /box/scope); a new one must take the gate too');
-  assert.equal(gated.length, 2, 'every moduleScopeForActiveClaims resolution must be gated by !taskScopingPaused()');
-});
-
-test('/box/scope keeps telling the truth about the pause', () => {
-  const src = fs.readFileSync(path.join(ROOT, 'modules', 'dev-box', 'routes', 'box.js'), 'utf8');
-  assert.ok(src.includes('task_scoping_paused: taskScopingPaused()'),
-    '/box/scope must report task_scoping_paused so the hall/app can explain a false task_scope');
-});

package/tests/box_terminal_ssrf.mjs

@@ -1,96 +0,0 @@
-// tests/box_terminal_ssrf.mjs
-//
-// SECURITY regression guard for #871 — the box web-terminal URL allow-list.
-// POST /box/terminal stores a builder-supplied URL and GET /box/terminal makes
-// the WEB TIER fetch it. The old guard (/^https:\/\/[^\s]+$/) accepted ANY https
-// host, so a builder could make the prod server probe internal/metadata
-// endpoints (SSRF). isSafeTerminalUrl(url, login) must allow ONLY the two real
-// tunnel shapes — `term-<login>.<apex>` (bound to the caller's login)
-// and `*.trycloudflare.com` — and reject everything else.
-//
-// Pure function, no server/DB/network.
-//
-// Run:  node tests/box_terminal_ssrf.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-
-const require = createRequire(import.meta.url);
-const { isSafeTerminalUrl } = require('../modules/dev-box/routes/box.js');
-
-let pass = 0, fail = 0;
-const test = (name, fn) => {
-  try { fn(); pass++; console.log(`PASS  ${name}`); }
-  catch (e) { fail++; console.log(`FAIL  ${name}\n      ${e.message}`); }
-};
-
-const LOGIN = 'example-owner';
-// The dev-box apex is INJECTED rather than taken from the live instance branding
-// (task 1002470). Two reasons: the neutral core has no example.com apex, so the
-// three allow-cases could not pass; and every reject-case below was passing for the
-// WRONG reason — an apex mismatch, not the rule it names. With a pinned apex,
-// 'rejects another builder's term- host' really does prove the login binding.
-const APEX = 'apex.example';
-
-// ---- allowed: the two legitimate tunnel shapes -------------------------------
-test('allows the named-tunnel apex host bound to the caller login', () => {
-  assert.equal(isSafeTerminalUrl(`https://term-example-owner.${APEX}`, LOGIN, APEX), true);
-});
-test(`allows the named-tunnel dev-zone host (term-<login>.dev.${APEX})`, () => {
-  assert.equal(isSafeTerminalUrl(`https://term-example-owner.dev.${APEX}/`, LOGIN, APEX), true);
-});
-test('allows a Cloudflare quick-tunnel host (*.trycloudflare.com)', () => {
-  assert.equal(isSafeTerminalUrl('https://random-words-1234.trycloudflare.com', LOGIN, APEX), true);
-});
-test('login match is case-insensitive (DNS is case-insensitive)', () => {
-  assert.equal(isSafeTerminalUrl(`https://term-LarsCode.${APEX}`, 'larscode', APEX), true);
-});
-
-// ---- rejected: SSRF targets --------------------------------------------------
-for (const bad of [
-  'https://127.0.0.1/admin',
-  'https://127.0.0.1:9443/',
-  'https://10.0.0.5:8443/',
-  'https://192.168.1.10/',
-  'https://172.16.0.9/',
-  'https://169.254.169.254/metadata/v1/',     // cloud metadata
-  'https://[::1]:443/',                        // ipv6 loopback literal
-  'https://localhost/',
-  'https://vault.internal:8200/',
-  'https://printer.local/',
-]) {
-  test(`rejects SSRF target ${bad}`, () => {
-    assert.equal(isSafeTerminalUrl(bad, LOGIN, APEX), false);
-  });
-}
-
-// ---- rejected: wrong scheme / shape / cross-login ----------------------------
-test('rejects http (must be https)', () => {
-  assert.equal(isSafeTerminalUrl(`http://term-example-owner.${APEX}`, LOGIN, APEX), false);
-});
-test('rejects embedded credentials (user:pass@host)', () => {
-  assert.equal(isSafeTerminalUrl(`https://user:pass@term-example-owner.${APEX}`, LOGIN, APEX), false);
-});
-test('rejects another builder\'s term- host (login binding)', () => {
-  assert.equal(isSafeTerminalUrl(`https://term-someoneelse.${APEX}`, LOGIN, APEX), false);
-});
-test('rejects a non-tunnel host on the project domain', () => {
-  assert.equal(isSafeTerminalUrl(`https://api.${APEX}`, LOGIN, APEX), false);
-});
-test('rejects an arbitrary external host', () => {
-  assert.equal(isSafeTerminalUrl('https://evil.example.com', LOGIN, APEX), false);
-});
-test('rejects a lookalike suffix (…trycloudflare.com.evil.com)', () => {
-  assert.equal(isSafeTerminalUrl('https://x.trycloudflare.com.evil.com', LOGIN, APEX), false);
-});
-test('rejects garbage / unparseable', () => {
-  assert.equal(isSafeTerminalUrl('not a url', LOGIN, APEX), false);
-  assert.equal(isSafeTerminalUrl('', LOGIN, APEX), false);
-  assert.equal(isSafeTerminalUrl(null, LOGIN, APEX), false);
-});
-test('rejects when login is empty (cannot bind the term- form)', () => {
-  assert.equal(isSafeTerminalUrl(`https://term-example-owner.${APEX}`, '', APEX), false);
-});
-
-console.log(`\n${pass} passed, ${fail} failed`);
-process.exit(fail === 0 ? 0 : 1);