@bongos/core 1.19.1073 → 1.19.1075

package/tests/docs_scrubber_damage.mjs

@@ -1,111 +0,0 @@
-// tests/docs_scrubber_damage.mjs — the secret-scrubber ate real prose in
-// docs/recipes/managed-settings-remote-control.md (task 1004027, part 4 of the
-// damage family after 1004021 / 1004022).
-//
-// Two distinct repairs, and the SECOND is the trap. A scrubber pass replaced
-// two pieces of ordinary content with the literal `<redacted>`:
-//   - an in-page anchor target, so the link went nowhere;
-//   - an `infra/*.sh` script name, so the doc pointed at no script at all.
-// But four OTHER `<redacted>` occurrences in the same file are DELIBERATE — they
-// stand in for real secrets (a tunnel credential, two tokens, a trust seed).
-// A global sweep "fixes" the two and destroys the four, and nothing in the repo
-// would notice, because the anchor lint only ever looks at link targets.
-//
-// So this file pins BOTH halves: the anchor and the script path resolve, AND the
-// placeholder count stays at exactly four. The second assertion is the one that
-// makes a future sweep fail loudly instead of quietly.
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-import { createRequire } from 'node:module';
-import { fileURLToPath } from 'node:url';
-import fs from 'node:fs';
-import path from 'node:path';
-
-const require = createRequire(import.meta.url);
-const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const { parseFile } = require(path.join(ROOT, 'scripts', 'gds', 'docs-entropy.js'));
-
-const REL = 'docs/recipes/managed-settings-remote-control.md';
-const ABS = path.join(ROOT, REL);
-const raw = () => fs.readFileSync(ABS, 'utf8');
-
-// The doc is only worth asserting against while it exists at this path.
-test('the recipe under repair is still tracked at its documented path', () => {
-  assert.ok(fs.existsSync(ABS), `${REL} is missing — move this test with it`);
-});
-
-test('every in-page anchor in the recipe resolves to a heading it actually has', () => {
-  // The damaged link read `[named-tunnel automation](#<redacted>)`. Resolve
-  // through the SAME parser docs-entropy.js uses, so the slug this asserts is
-  // the slug the lint computes — a test with its own slug rule would let the
-  // doc pass here and still red the ratchet.
-  const { headings, links } = parseFile(ABS);
-  const slugs = new Set(headings.map((h) => h.slug));
-  const inPage = links.filter((l) => l.href.startsWith('#'));
-
-  assert.ok(inPage.length > 0, 'fixture sanity: the recipe does link to its own sections');
-  const broken = inPage.filter((l) => !slugs.has(l.href.slice(1)));
-  assert.deepEqual(
-    broken.map((l) => `${l.line}: ${l.href}`), [],
-    'an in-page anchor points at no heading in this file — this is what doc_broken_anchors counts',
-  );
-});
-
-test('the key-sync cron names a script the cloud-init renderer actually installs', () => {
-  // The damaged line read `infra/<redacted>.sh`. The authority for the real name
-  // is not prose anywhere: it is the renderer that bakes the script into the
-  // cloud-init, so assert the doc against THAT rather than against a literal.
-  const line = raw().split(/\r?\n/).find((l) => l.includes('GET /box/authorized-keys'))
-    ?? raw().split(/\r?\n/).find((l) => l.includes('keeps `authorized_keys` in sync'));
-  assert.ok(line, 'fixture sanity: the recipe still describes the authorized_keys sync cron');
-
-  const named = [...raw().matchAll(/`infra\/([a-z0-9-]+\.sh)`/g)].map((m) => m[1]);
-  assert.ok(
-    named.includes('box-authorized-keys-fetch.sh'),
-    `the recipe names no authorized-keys script; found ${JSON.stringify(named)}`,
-  );
-
-  // Scoped to the repaired name on purpose. Other `infra/*.sh` the recipe cites
-  // (box-connect.sh) are builder-side scripts absent from this checkout for an
-  // unrelated, pre-existing reason (idea 1000895) — asserting over all of them
-  // would red this test on a gap it is not about.
-  const renderer = fs.readFileSync(path.join(ROOT, 'scripts', 'gds', 'box-infra.js'), 'utf8');
-  assert.ok(
-    renderer.includes('box-authorized-keys-fetch.sh'),
-    'box-infra.js no longer bakes box-authorized-keys-fetch.sh into the cloud-init — '
-    + 'the recipe now names a script nothing installs, so fix the doc to match the renderer',
-  );
-});
-
-test('the four deliberate <redacted> secret placeholders survive — a global sweep must fail here', () => {
-  // This is the anti-fix assertion. Each of these stands in for a real secret and
-  // is correct as written; "repairing" them is the damage, not the cure.
-  const lines = raw().split(/\r?\n/);
-  const placeholders = lines
-    .map((text, i) => ({ line: i + 1, text }))
-    .filter((l) => l.text.includes('<redacted>'));
-
-  assert.equal(
-    placeholders.length, 4,
-    'expected exactly the four secret placeholders, got:\n'
-    + placeholders.map((p) => `  ${p.line}: ${p.text.trim().slice(0, 110)}`).join('\n'),
-  );
-
-  // Named by CONTEXT, not by line number, so ordinary edits above them don't red this.
-  const contexts = ['"credential"', 'BOX_TUNNEL_TOKEN', 'BOX_SOURCE_FULL_TOKEN', '/root/.claude.json'];
-  for (const ctx of contexts) {
-    assert.ok(
-      placeholders.some((p) => p.text.includes(ctx)),
-      `the deliberate placeholder for ${ctx} is gone — a <redacted> sweep took a real secret stand-in with it`,
-    );
-  }
-
-  // And no placeholder may sit in a link target or a path again: those two shapes
-  // are exactly what the scrubber damaged.
-  for (const p of placeholders) {
-    assert.ok(
-      !/\(#<redacted>\)/.test(p.text) && !/infra\/<redacted>/.test(p.text),
-      `line ${p.line} carries scrubber damage, not a secret placeholder: ${p.text.trim().slice(0, 110)}`,
-    );
-  }
-});

package/tests/module_scope_active_claims.mjs

@@ -1,94 +0,0 @@
-// tests/module_scope_active_claims.mjs
-//
-// Unit guard for db.moduleScopeForActiveClaims (goal 1000051 / R92, ADR 0148 §2) —
-// the lifecycle-port resolver the dev-box source-access path (R93/R94) reads to
-// derive a builder's TASK-scoped sparse-checkout: the union of module KEYS across
-// the builder's active claims' goals (claims → tasks → goals.scope_modules).
-//
-// DB-free, same posture as goal_achievement.mjs: the function honours the #538
-// deps.pool injection seam (ONLY when NODE_ENV==='test'), so a SQL-aware fake
-// client drives it with no live Postgres. We assert the query SHAPE (joins
-// claims→tasks→goals, unnests scope_modules, filters ACTIVE claims), the bound
-// params, the rows→keys mapping, and the numeric-input guard. The actual
-// set-union/dedup is Postgres's DISTINCT (exercised end-to-end once box-access is
-// wired — R95); here we prove the port method's contract.
-//
-// Run:  node tests/module_scope_active_claims.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import { makeRunner, makeSqlAwareClient } from './helpers.mjs';
-
-process.env.NODE_ENV = 'test';
-
-const require = createRequire(import.meta.url);
-const { moduleScopeForActiveClaims } = require('../modules/lifecycle/db.js');
-
-const { test, summary } = makeRunner();
-
-function fakePool(handler) {
-  const c = makeSqlAwareClient(handler);
-  return { query: (sql, params) => c._client.query(sql, params), connect: c.connect, queries: c._client.queries };
-}
-const norm = (s) => String(s).replace(/\s+/g, ' ').trim();
-const find = (queries, re) => queries.find((q) => re.test(norm(q.sql)));
-
-// The one read this function issues: claims → tasks → goals, unnest scope_modules,
-// active claims only. The fake returns whatever module-key rows we hand it (the
-// DISTINCT/ORDER BY is Postgres's job — here we just prove the plumbing).
-function scopeHandler(rows) {
-  return (s) => {
-    if (/FROM claims c/.test(s) && /JOIN goals g/.test(s) && /unnest\(g\.scope_modules\)/.test(s)) {
-      return { rows };
-    }
-    return null;
-  };
-}
-
-// =========================================================================
-// Happy path — active claims put N goals' scope_modules in scope
-// =========================================================================
-await test('returns the module keys the active claims scope, in DB order', async () => {
-  const pool = fakePool(scopeHandler([{ module_key: 'dev-box' }, { module_key: 'kernel' }, { module_key: 'lifecycle' }]));
-  const keys = await moduleScopeForActiveClaims(3, { pool });
-  assert.deepEqual(keys, ['dev-box', 'kernel', 'lifecycle'], 'maps rows → module_key list');
-
-  const q = find(pool.queries, /FROM claims c JOIN tasks t .* JOIN goals g/);
-  assert.ok(q, 'issues the claims→tasks→goals scope read');
-  assert.match(norm(q.sql), /c\.builder_id = \$1 AND c\.released_at IS NULL/, 'active claims only, keyed on builder');
-  assert.match(norm(q.sql), /unnest\(g\.scope_modules\)/, 'unnests the goal scope_modules array');
-  assert.match(norm(q.sql), /SELECT DISTINCT/, 'DISTINCT dedupes the union across claims');
-  assert.deepEqual(q.params, [3], 'binds the builder id');
-});
-
-// =========================================================================
-// No active claim (or no scoped goal) → base-only signal ([])
-// =========================================================================
-await test('no active claim / no scoped goal → empty array (box falls back to BASE-only)', async () => {
-  const pool = fakePool(scopeHandler([]));
-  const keys = await moduleScopeForActiveClaims(3, { pool });
-  assert.deepEqual(keys, [], 'zero rows → []');
-});
-
-// =========================================================================
-// Input guard — a non-numeric builder id never reaches SQL
-// =========================================================================
-await test('non-numeric builderId throws before any query', async () => {
-  const pool = fakePool(scopeHandler([{ module_key: 'dev-box' }]));
-  await assert.rejects(() => moduleScopeForActiveClaims('not-a-number', { pool }), /must be numeric/);
-  await assert.rejects(() => moduleScopeForActiveClaims(NaN, { pool }), /must be numeric/);
-  assert.equal(pool.queries.length, 0, 'guard trips before the pool is touched');
-});
-
-// =========================================================================
-// The #538 deps.pool test seam is actually wired (we ARE in NODE_ENV==='test')
-// =========================================================================
-await test('honours the deps.pool test seam', async () => {
-  let touched = false;
-  const pool = fakePool((s) => { touched = true; return /unnest/.test(s) ? { rows: [{ module_key: 'game' }] } : null; });
-  const keys = await moduleScopeForActiveClaims(7, { pool });
-  assert.ok(touched, 'the injected pool was used');
-  assert.deepEqual(keys, ['game']);
-});
-
-summary();

package/tests/ship_api_client_pathspec.mjs

@@ -1,100 +0,0 @@
-// tests/ship_api_client_pathspec.mjs
-//
-// Unit tests for task 1002417 — ship.js named a git path that could not exist,
-// and it broke EVERY ship.
-//
-// regenerateApiClient() stages the regenerated typed client plus the devbox
-// Electron app's vendored CJS copy. After the app moved from a top-level
-// devbox-app/ to modules/dev-box/app/ (ADR 0145) the vendored path went stale.
-// The failure was asymmetric and therefore silent for a long time:
-//
-//   git status --porcelain <missing path>  → exit 0   (tolerated, so no signal)
-//   git add               <missing path>  → exit 128 (aborts the WHOLE stage)
-//
-// Because the `git add` aborts, the freshly regenerated clients/bongos-client is
-// never staged, the worktree stays dirty, and the ship's auto-merge then bails
-// with "main worktree busy" — stranding the task at `confirmed` with no PR.
-//
-// apiClientPathspec is the pure rule behind that: never name a path `git add`
-// cannot match. Proven here with an injected existsSync — no git, no fs.
-//
-// Run:  node tests/ship_api_client_pathspec.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import path from 'node:path';
-
-const require = createRequire(import.meta.url);
-const ship = require('../scripts/gds/ship.js');
-const { apiClientPathspec, VENDORED_CLIENT_REL } = ship;
-
-let passed = 0;
-let failed = 0;
-function test(name, fn) {
-  try {
-    fn();
-    passed++;
-    console.log(`  ok  ${name}`);
-  } catch (err) {
-    failed++;
-    console.log(`  FAIL ${name}`);
-    console.log(`     ${err.message}`);
-  }
-}
-
-const ROOT = path.join('/repo');
-const never = () => false;
-const always = () => true;
-
-test('the vendored copy lives inside the dev-box module, not at the old top level', () => {
-  assert.equal(VENDORED_CLIENT_REL, 'modules/dev-box/app/src/vendor/bongos-client.cjs');
-  assert.ok(!VENDORED_CLIENT_REL.startsWith('devbox-app/'), 'must not use the pre-ADR-0145 path');
-});
-
-test('the generated client is always staged', () => {
-  assert.ok(apiClientPathspec({ worktreeRoot: ROOT, existsSync: never }).includes('clients/bongos-client'));
-  assert.ok(apiClientPathspec({ worktreeRoot: ROOT, existsSync: always }).includes('clients/bongos-client'));
-});
-
-test('vendored copy present → it is staged too', () => {
-  const p = apiClientPathspec({ worktreeRoot: ROOT, existsSync: always });
-  assert.deepEqual(p, ['clients/bongos-client', VENDORED_CLIENT_REL]);
-});
-
-// The regression. Before the fix this returned the vendored path unconditionally,
-// so `git add` exited 128 and left the worktree dirty.
-test('vendored copy ABSENT → it is omitted (git add would abort on it)', () => {
-  const p = apiClientPathspec({ worktreeRoot: ROOT, existsSync: never });
-  assert.deepEqual(p, ['clients/bongos-client']);
-  assert.ok(!p.some((x) => x.includes('vendor')), 'no unmatched pathspec may reach git add');
-});
-
-test('existence is probed at the vendored path under the given worktree root', () => {
-  const seen = [];
-  apiClientPathspec({
-    worktreeRoot: ROOT,
-    existsSync: (p) => { seen.push(p); return false; },
-  });
-  assert.equal(seen.length, 1);
-  assert.equal(seen[0], path.join(ROOT, VENDORED_CLIENT_REL));
-});
-
-// A ship can run from a linked worktree, where the main checkout is a different
-// tree (the task-2060 rationale). The probe must follow the root it is handed.
-test('probes the worktree it was handed, not a fixed root', () => {
-  const seen = [];
-  apiClientPathspec({
-    worktreeRoot: path.join('/linked-worktree'),
-    existsSync: (p) => { seen.push(p); return false; },
-  });
-  assert.equal(seen[0], path.join('/linked-worktree', VENDORED_CLIENT_REL));
-});
-
-test('every returned entry is repo-relative (git pathspecs, not absolute paths)', () => {
-  for (const p of apiClientPathspec({ worktreeRoot: ROOT, existsSync: always })) {
-    assert.ok(!path.isAbsolute(p), `${p} must be repo-relative`);
-  }
-});
-
-console.log(`\n${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);

package/tests/tree_preflight.mjs

@@ -1,243 +0,0 @@
-// tests/tree_preflight.mjs — the partial-checkout preflight (task 1003098).
-//
-// THE BUG. On a task-scoped dev box — a supported, server-driven configuration —
-// `scripts/gds/ship.js` died with a raw stack trace naming ONE missing module. Fix
-// that one, run again, learn the next. The filer lost a session to it, and their
-// workaround (`git sparse-checkout disable` plus disabling the re-scope cron) is
-// not something a builder should have to discover. Node's loader cannot do better:
-// it stops at the first unresolvable specifier and never reaches the second.
-//
-// THE TWO FAILURE DIRECTIONS, and both are tested, because only one is obvious:
-//
-//   under-reporting — the original bug: name one missing thing, hide the other six.
-//   OVER-reporting  — the regression a naive fix causes: several of the CLI's
-//                     module requires are deliberately try-guarded, so those
-//                     commands RUN on a scoped box. Refusing them would tell a
-//                     builder who could have shipped that they cannot, which is
-//                     worse than the trace it replaces.
-//
-// Pure: a fake file system throughout, per the task's own DONE-WHEN. The cases at
-// the end are the empirical anchor — they run the classifier against the REAL
-// scripts/gds files and pin it to behaviour observed on a simulated scoped tree:
-// start.js survives, claim.js dies on one module, ship.js on seven.
-//
-// Run:  node tests/tree_preflight.mjs
-
-import { strict as assert } from 'node:assert';
-import { createRequire } from 'node:module';
-import { fileURLToPath } from 'node:url';
-import { dirname, join } from 'node:path';
-
-const require = createRequire(import.meta.url);
-const tp = require('../scripts/gds/tree-preflight.js');
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const repoRoot = join(__dirname, '..');
-
-let passed = 0;
-let failed = 0;
-const t = (name, fn) => {
-  try { fn(); passed += 1; console.log(`  PASS  ${name}`); }
-  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
-};
-
-// A fake scripts/gds tree. Keys are absolute-ish paths as the walker resolves them.
-function fakeFs(files) {
-  return {
-    readFile: (f) => {
-      const key = String(f).replace(/\\/g, '/');
-      const hit = Object.keys(files).find((k) => key.endsWith(k));
-      if (hit === undefined) { const e = new Error('ENOENT'); e.code = 'ENOENT'; throw e; }
-      return files[hit];
-    },
-  };
-}
-
-console.log('\nthe walk — what the command actually needs:');
-
-t('collects a direct module require', () => {
-  const fs = fakeFs({ 'scripts/gds/a.js': "const x = require('../../modules/lifecycle/dead-deps.js');" });
-  assert.deepEqual(
-    tp.requiredModulePaths('/repo/scripts/gds/a.js', { ...fs, root: '/repo' }),
-    ['modules/lifecycle/dead-deps.js'],
-  );
-});
-
-t('FOLLOWS sibling requires — the whole reason a declared list would be wrong', () => {
-  // ship.js reaches its modules through sixteen ship-*.js phase files; a hand-kept
-  // list of "what ship.js needs" is a second copy of the require graph.
-  const fs = fakeFs({
-    'scripts/gds/entry.js': "const p = require('./phase.js');",
-    'scripts/gds/phase.js': "const g = require('../../modules/grading/grader.js');",
-  });
-  assert.deepEqual(
-    tp.requiredModulePaths('/repo/scripts/gds/entry.js', { ...fs, root: '/repo' }),
-    ['modules/grading/grader.js'],
-  );
-});
-
-t('a require cycle terminates', () => {
-  const fs = fakeFs({
-    'scripts/gds/a.js': "require('./b.js'); require('../../modules/lifecycle/one.js');",
-    'scripts/gds/b.js': "require('./a.js'); require('../../modules/lifecycle/two.js');",
-  });
-  assert.deepEqual(
-    tp.requiredModulePaths('/repo/scripts/gds/a.js', { ...fs, root: '/repo' }),
-    ['modules/lifecycle/one.js', 'modules/lifecycle/two.js'],
-  );
-});
-
-t('an unreadable file is skipped, never thrown on', () => {
-  // This runs on a checkout that is BY DEFINITION incomplete. A preflight that
-  // crashes while diagnosing a partial tree is worse than the trace it replaces.
-  const fs = fakeFs({ 'scripts/gds/a.js': "require('./gone.js'); require('../../modules/lifecycle/one.js');" });
-  assert.deepEqual(
-    tp.requiredModulePaths('/repo/scripts/gds/a.js', { ...fs, root: '/repo' }),
-    ['modules/lifecycle/one.js'],
-  );
-});
-
-t('a bare specifier gains .js; one that names an extension is left alone', () => {
-  const fs = fakeFs({
-    'scripts/gds/a.js': "require('../../modules/lifecycle/ship-preflight');require('../../modules/lifecycle/d.json');",
-  });
-  assert.deepEqual(
-    tp.requiredModulePaths('/repo/scripts/gds/a.js', { ...fs, root: '/repo' }),
-    ['modules/lifecycle/d.json', 'modules/lifecycle/ship-preflight.js'],
-  );
-});
-
-console.log('\nOVER-reporting — the regression a naive fix causes:');
-
-t('a try-guarded require is NOT a requirement', () => {
-  // context-pack.js and cli-lib.js both guard theirs and fall back honestly, which
-  // is why /builder-start works on a scoped box today. Reporting them would refuse
-  // a command that runs.
-  const fs = fakeFs({
-    'scripts/gds/a.js': "let c=null; try { c = require('../../modules/lifecycle/task-classifier'); } catch (_) {}",
-  });
-  assert.deepEqual(tp.requiredModulePaths('/repo/scripts/gds/a.js', { ...fs, root: '/repo' }), []);
-});
-
-t('a require AFTER a closed try is still a requirement', () => {
-  // The brace walk must pop. If it did not, one guarded require near the top would
-  // silently excuse every require below it in the file.
-  const fs = fakeFs({
-    'scripts/gds/a.js': "try { require('../../modules/lifecycle/opt.js'); } catch (_) {}\nrequire('../../modules/lifecycle/need.js');",
-  });
-  assert.deepEqual(
-    tp.requiredModulePaths('/repo/scripts/gds/a.js', { ...fs, root: '/repo' }),
-    ['modules/lifecycle/need.js'],
-  );
-});
-
-t('a require quoted inside a COMMENT is not walked', () => {
-  // tree-preflight.js's own header quotes the failing require verbatim to explain
-  // the bug. A raw-text scan would read that prose as a live edge — the defect
-  // filed as task 1003832 against a test that scanned raw source.
-  const fs = fakeFs({
-    'scripts/gds/a.js': "// require('../../modules/grading/nope.js')\n/* require('../../modules/grading/also.js') */\nrequire('../../modules/lifecycle/real.js');",
-  });
-  assert.deepEqual(
-    tp.requiredModulePaths('/repo/scripts/gds/a.js', { ...fs, root: '/repo' }),
-    ['modules/lifecycle/real.js'],
-  );
-});
-
-console.log('\nthe message — one run, every missing thing:');
-
-t('nothing missing → null, so a complete checkout is a silent no-op', () => {
-  assert.equal(tp.preflightMessage([], { command: '/builder-ship' }), null);
-  assert.equal(tp.preflightMessage(null, { command: '/builder-ship' }), null);
-});
-
-t('EVERY missing requirement is listed, not the first', () => {
-  // The whole ask. Seven for ship.js is seven guess-read-fix cycles avoided.
-  const missing = ['modules/a/one.js', 'modules/b/two.js', 'modules/b/three.js'];
-  const msg = tp.preflightMessage(missing, { command: '/builder-ship' });
-  for (const m of missing) assert.ok(msg.includes(m), `names ${m}`);
-  assert.match(msg, /Missing \(3\)/, 'and says how many');
-});
-
-t('it names the CONDITION and BOTH remedies', () => {
-  const msg = tp.preflightMessage(['modules/a/one.js'], { command: '/builder-ship' });
-  assert.match(msg, /task-scoped/i, 'names why the code is absent');
-  assert.match(msg, /not a broken install/i, 'and rules out the wrong diagnosis');
-  assert.match(msg, /box-sync\.js/, 're-scope');
-  assert.match(msg, /sparse-checkout disable/, 'or take the whole tree');
-  assert.match(msg, /\/builder-ship/, 'and says which command was refused');
-});
-
-t('it rolls the missing files up to whole directories', () => {
-  const msg = tp.preflightMessage(['modules/lifecycle/a.js', 'modules/lifecycle/b.js', 'modules/grading/c.js']);
-  assert.match(msg, /modules\/grading, modules\/lifecycle/, 'deduped and sorted');
-});
-
-console.log('\ncheckTree — what the entry points call:');
-
-t('a complete tree returns null', () => {
-  const fs = fakeFs({ 'scripts/gds/a.js': "require('../../modules/lifecycle/one.js');" });
-  assert.equal(tp.checkTree('/repo/scripts/gds/a.js', { ...fs, root: '/repo', exists: () => true }), null);
-});
-
-t('a partial tree returns the message', () => {
-  const fs = fakeFs({ 'scripts/gds/a.js': "require('../../modules/lifecycle/one.js');" });
-  const msg = tp.checkTree('/repo/scripts/gds/a.js', { ...fs, root: '/repo', exists: () => false, command: '/builder-x' });
-  assert.match(msg, /modules\/lifecycle\/one\.js/);
-});
-
-t('a preflight that THROWS returns null rather than replacing one bad trace with another', () => {
-  const boom = { readFile: () => { throw new Error('boom'); }, exists: () => { throw new Error('boom'); } };
-  assert.equal(tp.checkTree('/repo/scripts/gds/a.js', { ...boom, root: '/repo' }), null);
-});
-
-console.log('\nthe empirical anchor — the REAL CLI files:');
-
-t('start.js needs NO unguarded module code, matching that it runs on a scoped box', () => {
-  // Observed: with modules/ hidden, start.js prints its card normally. If this
-  // list is ever non-empty, /builder-start starts refusing on a box where it works.
-  const req = tp.requiredModulePaths(join(repoRoot, 'scripts/gds/start.js'), { root: repoRoot });
-  assert.deepEqual(req, [], `start.js must survive a scoped box; got ${req.join(', ')}`);
-});
-
-t('claim.js and ship.js DO need module code, matching the traces they died with', () => {
-  const claim = tp.requiredModulePaths(join(repoRoot, 'scripts/gds/claim.js'), { root: repoRoot });
-  assert.ok(claim.includes('modules/lifecycle/dead-deps.js'),
-    'the exact module claim.js died on');
-  const ship = tp.requiredModulePaths(join(repoRoot, 'scripts/gds/ship.js'), { root: repoRoot });
-  assert.ok(ship.includes('modules/lifecycle/ship-preflight.js'),
-    'the exact module ship.js died on');
-  assert.ok(ship.length >= 5,
-    `ship.js fans out across phase files; the walk found ${ship.length}, so the one-per-run cost was real`);
-});
-
-t('the three entry points actually CALL the preflight, above their first require', () => {
-  // The check is worthless if it runs after the require that dies. Asserted by
-  // position, because that is the property — not merely that the call exists.
-  for (const f of ['start.js', 'claim.js', 'ship.js']) {
-    const src = require('node:fs').readFileSync(join(repoRoot, 'scripts/gds', f), 'utf8');
-    const call = src.indexOf('_checkTree(__filename');
-    assert.ok(call > 0, `${f} calls the preflight`);
-    const firstModuleRequire = src.search(/require\(\s*['"]\.\.\/\.\.\/modules\//);
-    if (firstModuleRequire > 0) {
-      assert.ok(call < firstModuleRequire, `${f}: the preflight must run BEFORE the first modules/ require`);
-    }
-  }
-});
-
-t('the preflight names the command for the READER, never a hard-coded slash command', () => {
-  // The message this preflight prints is reader-facing, and `/builder-ship` does not exist
-  // outside Claude Code — a person running the public `bongos` CLI would be handed a command
-  // they cannot type. tests/cli_surface.mjs scans start.js for exactly this, but nothing
-  // scanned claim.js or ship.js, and the first draft of this task hard-coded all three.
-  for (const f of ['start.js', 'claim.js', 'ship.js']) {
-    const src = require('node:fs').readFileSync(join(repoRoot, 'scripts/gds', f), 'utf8');
-    const line = src.split('\n').find((l) => l.includes('_checkTree(__filename'));
-    assert.ok(line, `${f} calls the preflight`);
-    assert.ok(!/\/builder-/.test(line), `${f}: hard-coded slash command in the preflight message`);
-    assert.match(line, /_surfaceAction\(/, `${f}: the command name must come from the surface switch`);
-  }
-});
-
-console.log(`\ntree_preflight: ${passed} passed, ${failed} failed`);
-if (failed) process.exit(1);