@bongos/core 1.19.1074 → 1.19.1075

package/tests/host_topology_skips.mjs

@@ -3,7 +3,7 @@
 // tests/ is publishable, but some tests assert paths the neutral core deliberately does
 // not carry: publish-manifest.js's PROTECTED_TOPOLOGY_EXCLUDE (`.claude/hooks/`,
 // `.claude/settings.json`, `infra/`, `.github/`, `scripts/deploy/`) plus instance-only
-// content (`devbox-app/`, `config/<instance>.json`, an uninstalled module). Those files
+// content (`config/<instance>.json`, an uninstalled module). Those files
 // used to CRASH at import and red-X the unit gate for every consumer; they now skip
 // cleanly via the helpers in tests/helpers.mjs and run in full wherever the topology is
 // materialized.
@@ -33,7 +33,7 @@ const ALLOWED = {
   allow_rule_guard: '.claude/hooks/allow-rule-guard.js (package-excluded)',
   art_stage: 'scripts/gds/art-stage.js (art-pipeline tooling, not in the core)',
   bongos_downloads: 'config/bongos-cli.json (instance content)',
-  box_ship_permissions: '.claude/settings.json (package-excluded)',
+  cli_allowlist_permissions: '.claude/settings.json (package-excluded)',
   conductor: '.claude/hooks/conductor.js (package-excluded)',
   deploy_instance: 'scripts/deploy/deploy-instance.sh (host topology)',
   eviction_policy: '.claude/hooks/eviction-policy.js (package-excluded)',

package/tests/migration_namespace.mjs

@@ -46,8 +46,8 @@ t('parseMigrationName: core_NNN_slug.sql', () => {
 });
 
 t('parseMigrationName: multi-word module prefix splits at the number, not greedily', () => {
-  const p = ns.parseMigrationName('dev_box_003_add_col.sql');
-  assert.equal(p.prefix, 'dev_box', 'dev_box_003 → prefix dev_box, not dev');
+  const p = ns.parseMigrationName('platform_identity_003_add_col.sql');
+  assert.equal(p.prefix, 'platform_identity', 'platform_identity_003 → prefix platform_identity, not platform');
   assert.equal(p.number, 3);
   assert.equal(p.slug, 'add_col');
 });
@@ -114,10 +114,10 @@ t('filenameViolation: NEW module migration must be <key>_-prefixed', () => {
 });
 
 t('filenameViolation: hyphenated module key maps to underscore prefix', () => {
-  assert.equal(ns.sqlNamespace('dev-box'), 'dev_box');
-  assert.equal(ns.filenameViolation('module', 'dev_box_003_x.sql', { moduleKey: 'dev-box' }), null);
-  const v = ns.filenameViolation('module', '003_x.sql', { moduleKey: 'dev-box' });
-  assert.ok(v && /dev_box_-prefixed|dev_box_003_x/.test(v));
+  assert.equal(ns.sqlNamespace('platform-identity'), 'platform_identity');
+  assert.equal(ns.filenameViolation('module', 'platform_identity_003_x.sql', { moduleKey: 'platform-identity' }), null);
+  const v = ns.filenameViolation('module', '003_x.sql', { moduleKey: 'platform-identity' });
+  assert.ok(v && /platform_identity_-prefixed|platform_identity_003_x/.test(v));
 });
 
 // ---- stemCollisions --------------------------------------------------------

package/tests/module_api.mjs

@@ -16,8 +16,8 @@ const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
 // removing/renaming a key is normally a MAJOR bump (a breaking change to every
 // module). Exception (BV1.R68 / ADR 0091 §3): relocating a DOMAIN query whose
 // sole in-repo consumer moves in lockstep is treated as MINOR — e.g.
-// `setBuilderBoxBlocked` left for modules/dev-box/db.js at 1.5.0, when `withTx`
-// was added; no enabled module at its pinned coreVersion lost a capability.
+// a per-builder setter left the kernel for its own module's db.js at 1.5.0, when
+// `withTx` was added; no enabled module at its pinned coreVersion lost a capability.
 const PUBLISHED_SURFACE = [
   'CORE_VERSION',
   'requireBuilder', 'requireRank', 'rankMeetsThreshold', 'requireBfgPrincipal', 'allowBoxScope', 'resolveSession',

package/tests/module_cli.mjs

@@ -63,11 +63,11 @@ test('scaffoldModule: writes a valid, loader-discoverable module with no core ed
 
 test('scaffoldModule: a kebab-case key produces matching dir, route file, and title', () => {
   const root = tmpModulesRoot();
-  const { dir, manifest } = mod.scaffoldModule({ key: 'dev-box', modulesDir: root, core: '1.0.0' });
-  assert.equal(manifest.title, 'Dev Box');
-  assert.deepEqual(manifest.contributes.routes, ['dev-box']);
-  assert.ok(fs.existsSync(path.join(dir, 'routes', 'dev-box.js')));
-  assert.match(fs.readFileSync(path.join(dir, 'routes', 'dev-box.js'), 'utf8'), /devBoxRoutes/);
+  const { dir, manifest } = mod.scaffoldModule({ key: 'copy-desk', modulesDir: root, core: '1.0.0' });
+  assert.equal(manifest.title, 'Copy Desk');
+  assert.deepEqual(manifest.contributes.routes, ['copy-desk']);
+  assert.ok(fs.existsSync(path.join(dir, 'routes', 'copy-desk.js')));
+  assert.match(fs.readFileSync(path.join(dir, 'routes', 'copy-desk.js'), 'utf8'), /copyDeskRoutes/);
 });
 
 test('scaffoldModule: rejects an invalid key', () => {

package/tests/module_manifest.mjs

@@ -12,11 +12,11 @@ const { satisfies, isValidRange, parseVersion } = require(path.join(ROOT, 'src',
 const { validateManifest, assertValidManifest } = require(path.join(ROOT, 'src', 'module-loader', 'manifest-schema.js'));
 
 const baseManifest = () => ({
-  key: 'dev-box',
-  title: 'Dev boxes',
-  description: 'Per-builder cloud dev environments.',
+  key: 'discord',
+  title: 'Discord',
+  description: 'A bridge to the team chat.',
   version: '1.0.0', coreVersion: '^1.0.0',
-  contributes: { routes: ['box'], pollers: ['box-lifecycle'], uiSections: ['boxes'] },
+  contributes: { routes: ['discord'], pollers: ['discord-bot'], uiSections: ['chat'] },
 });
 
 // --- semver ---
@@ -91,7 +91,7 @@ test('missing required fields each produce an error', () => {
 });
 
 test('bad key format is rejected', () => {
-  const r = validateManifest({ ...baseManifest(), key: 'Dev_Box' });
+  const r = validateManifest({ ...baseManifest(), key: 'Discord_Bot' });
   assert.equal(r.valid, false);
   assert.ok(r.errors.some((e) => e.startsWith('key')));
 });
@@ -112,13 +112,13 @@ test('version must be an exact X.Y.Z — a range or junk is rejected (task 10037
 });
 
 test('unknown contributes key is rejected (typo guard)', () => {
-  const r = validateManifest({ ...baseManifest(), contributes: { routs: ['box'] } });
+  const r = validateManifest({ ...baseManifest(), contributes: { routs: ['discord'] } });
   assert.equal(r.valid, false);
   assert.ok(r.errors.some((e) => e.includes('contributes.routs')));
 });
 
 test('non-array contributes.routes is rejected', () => {
-  const r = validateManifest({ ...baseManifest(), contributes: { routes: 'box' } });
+  const r = validateManifest({ ...baseManifest(), contributes: { routes: 'discord' } });
   assert.equal(r.valid, false);
   assert.ok(r.errors.some((e) => e.includes('contributes.routes')));
 });
@@ -296,7 +296,7 @@ test('every bundled module declares a maintenance posture (the catalog has no un
 test('declarativeSeams: a valid exemption naming a declared seam + entry passes', () => {
   const r = validateManifest({
     ...baseManifest(),
-    declarativeSeams: { pollers: ['box-lifecycle'], uiSections: ['boxes'] },
+    declarativeSeams: { pollers: ['discord-bot'], uiSections: ['chat'] },
   });
   assert.equal(r.valid, true, r.errors.join('; '));
 });
@@ -304,8 +304,8 @@ test('declarativeSeams: a valid exemption naming a declared seam + entry passes'
 test('declarativeSeams: an exemption for a seam the module does not declare is an ERROR', () => {
   const r = validateManifest({
     ...baseManifest(),
-    contributes: { routes: ['box'] }, // no pollers declared
-    declarativeSeams: { pollers: ['box-lifecycle'] },
+    contributes: { routes: ['discord'] }, // no pollers declared
+    declarativeSeams: { pollers: ['discord-bot'] },
   });
   assert.equal(r.valid, false);
   assert.ok(r.errors.some((e) => /does not declare contributes\.pollers/.test(e)), r.errors.join('; '));
@@ -314,10 +314,10 @@ test('declarativeSeams: an exemption for a seam the module does not declare is a
 test('declarativeSeams: an exemption naming an ENTRY the module does not list is an ERROR (the typo case)', () => {
   const r = validateManifest({
     ...baseManifest(),
-    declarativeSeams: { pollers: ['box-lifecyle'] }, // transposed letters
+    declarativeSeams: { pollers: ['discord-bto'] }, // transposed letters
   });
   assert.equal(r.valid, false);
-  assert.ok(r.errors.some((e) => /"box-lifecyle" is not in contributes\.pollers/.test(e)), r.errors.join('; '));
+  assert.ok(r.errors.some((e) => /"discord-bto" is not in contributes\.pollers/.test(e)), r.errors.join('; '));
 });
 
 test('declarativeSeams: the per-entry check spans EVERY seam, not just bare string arrays', () => {
@@ -344,7 +344,7 @@ test('declarativeSeams: an unknown seam key is an ERROR, not a silent no-op', ()
 
 test('declarativeSeams: shape errors — non-object block, non-string-array entries', () => {
   assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: ['pollers'] }).valid, false);
-  assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: { pollers: 'box-lifecycle' } }).valid, false);
+  assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: { pollers: 'discord-bot' } }).valid, false);
   assert.equal(validateManifest({ ...baseManifest(), declarativeSeams: { pollers: [''] } }).valid, false);
 });
 

package/tests/module_route_rank.mjs

@@ -91,9 +91,9 @@ test('checkRouteRanks: an absent modules/ dir leaves the core result clean (byte
 
 // ---- the grade-time trigger fires on a module route change ----
 test('ROUTE_FILE_RE matches a module route path (a module route change triggers the rank pre-pass)', () => {
-  assert.match('modules/dev-box/routes/box.js', rrc.ROUTE_FILE_RE);
+  assert.match('modules/discord/routes/discord.js', rrc.ROUTE_FILE_RE);
   assert.match('src/bongos/routes/tasks.js', rrc.ROUTE_FILE_RE); // core still matches
-  assert.ok(!rrc.ROUTE_FILE_RE.test('modules/dev-box/module.json'), 'a non-route module file does not trigger the pre-pass');
+  assert.ok(!rrc.ROUTE_FILE_RE.test('modules/discord/module.json'), 'a non-route module file does not trigger the pre-pass');
 });
 
 // ---- a rank DRIFT on a pinned MODULE route reds the build (BV1.R61) ----

package/tests/modules_route_wiring.mjs

@@ -79,7 +79,7 @@ test('1002857: POST /modules/:key/enable rejects a non-boolean before touching t
   // is why the next assertion matters more than this one.
   const router = buildModulesRouter();
   const res = await invoke(handlerFor(router, 'post', '/modules/:key/enable'), {
-    params: { key: 'dev-box' }, query: {}, body: { enabled: 'yes-please' }, builder: { id: 1 },
+    params: { key: 'discord' }, query: {}, body: { enabled: 'yes-please' }, builder: { id: 1 },
   });
   assert.equal(res.body.error, 'invalid_body');
 });

package/tests/onboarding_route_signals.mjs

@@ -137,7 +137,7 @@ await t('no live signals → discord/cli both uncleared, and no retired box step
   assert.equal(r.status, 200);
   assert.equal(stepCleared(r.json, 'join_discord'), false);
   assert.equal(stepCleared(r.json, 'cli_setup'), false);
-  assert.equal(stepCleared(r.json, 'box_connect'), undefined, 'the dev-box step left the checklist (task 1004310)');
+  assert.equal(stepCleared(r.json, 'box_connect'), undefined, 'the retired box_connect step is no longer on the checklist (task 1004310)');
 });
 
 await t('discord linked → join_discord clears from ITS OWN signal [the scootermack regression]', async () => {

package/tests/paste_token_session_store.mjs

@@ -139,7 +139,7 @@ test('pasting a token for instance B PRESERVES instance A — the bug this close
       assert.equal(stored.token, 'B'.repeat(64));
 
       // 3. The active pointer still follows the paste, in the same place every existing
-      //    reader (skills, hooks, the dev box) looks. The fix is additive or it is a
+      //    reader (skills, hooks) looks. The fix is additive or it is a
       //    different, quieter outage.
       const pointer = readJson(active);
       assert.equal(pointer.api_base, base, 'the active pointer must follow the paste');

package/tests/platform_visibility_gate.mjs

@@ -162,7 +162,7 @@ test('the exempt list: the door, the manifest, the probes, the downloads — on
     '/api/gds/instance', '/api/bongos/instance', '/api/gds/healthz',
     '/api/bongos/provisioning/tls-check', '/api/gds/provisioning/health',
     '/healthz', '/version', '/metrics', '/__stealth',
-    '/downloads/bongos/install.sh', '/downloads/devbox/latest.json',
+    '/downloads/bongos/install.sh', '/downloads/bongos/latest.json',
     // Express routes case-insensitively and with a trailing slash — the list sees what the router sees
     '/API/GDS/INSTANCE', '/api/gds/instance/', '/HEALTHZ', '/api/bongos/auth/',
   ]) assert.equal(isExempt(p), true, `${p} must answer a stranger`);

package/tests/project_modules_ui.mjs

@@ -56,7 +56,7 @@ for (const fn of ['function ensureModsCatalog(', 'function renderMods(', 'functi
 const CATALOG = {
   core: ['memory', 'lifecycle', 'hall-ui'],
   optional: [
-    { key: 'dev-box', label: 'Dev box', summary: 'A shared machine your builders work on.' },
+    { key: 'npm-release', label: 'npm release', summary: 'Publishes each release of your project to npm.' },
     { key: 'discord', label: 'Discord', summary: 'Mirrors what ships into a Discord channel.' },
     { key: 'agents', label: 'Agents', summary: 'Lets AI builders claim and ship work on their own.' },
   ],
@@ -76,7 +76,7 @@ function parseRows(html) {
 
 // Boot the region against a scripted catalog + detail channel and hand back the
 // handles a test drives it with.
-function boot({ selected = ['dev-box'], source = 'chosen', catalog = CATALOG, catalogOk = true, patchAnswer } = {}) {
+function boot({ selected = ['npm-release'], source = 'chosen', catalog = CATALOG, catalogOk = true, patchAnswer } = {}) {
   const requests = [];
   const els = new Map();
   const listeners = new Map();
@@ -156,14 +156,14 @@ function boot({ selected = ['dev-box'], source = 'chosen', catalog = CATALOG, ca
 
 test('the band renders the optional catalog the server offered — a row and a sentence each', async () => {
   // Arrange
-  const ui = boot({ selected: ['dev-box'] });
+  const ui = boot({ selected: ['npm-release'] });
 
   // Act
   await ui.render();
 
   // Assert
-  assert.deepEqual(ui.rows().map((r) => r.key), ['dev-box', 'discord', 'agents']);
-  assert.deepEqual(ui.rows().map((r) => r.label), ['Dev box', 'Discord', 'Agents']);
+  assert.deepEqual(ui.rows().map((r) => r.key), ['npm-release', 'discord', 'agents']);
+  assert.deepEqual(ui.rows().map((r) => r.label), ['npm release', 'Discord', 'Agents']);
   for (const r of ui.rows()) assert.ok(r.summary.length > 20, `${r.label} says what it is for`);
 });
 
@@ -171,11 +171,11 @@ test('what the project runs today is what is switched on — resolved by the ser
   // A project that SKIPPED the picker reads as its own starter bundle, and the
   // band must show that set rather than an empty one: the whole point of
   // effectiveModules resolving `source: 'bundle'` on the way out.
-  const ui = boot({ selected: ['dev-box', 'discord'], source: 'bundle' });
+  const ui = boot({ selected: ['npm-release', 'discord'], source: 'bundle' });
 
   await ui.render();
 
-  assert.deepEqual(ui.rows().filter((r) => r.on).map((r) => r.key), ['dev-box', 'discord']);
+  assert.deepEqual(ui.rows().filter((r) => r.on).map((r) => r.key), ['npm-release', 'discord']);
   assert.deepEqual(ui.rows().filter((r) => !r.on).map((r) => r.key), ['agents']);
 });
 
@@ -185,7 +185,7 @@ test('the always-on core is COUNTED and stated, and is not a row anyone can swit
   await ui.render();
 
   assert.match(ui.slot(), /the same 3 core parts/, 'the clause names how many, from the server\'s own list');
-  assert.deepEqual(ui.rows().map((r) => r.key), ['dev-box', 'discord', 'agents'], 'and no core key is on the band');
+  assert.deepEqual(ui.rows().map((r) => r.key), ['npm-release', 'discord', 'agents'], 'and no core key is on the band');
   for (const key of CATALOG.core) {
     assert.equal(ui.rows().some((r) => r.key === key), false, `${key} is not a choice`);
   }
@@ -196,26 +196,26 @@ test('a toggle issues the write — the WHOLE list, in catalog order, on the own
   const ui = boot({ selected: ['discord'] });
   await ui.render();
 
-  // Act — switch the dev box ON
-  await ui.click('dev-box');
+  // Act — switch npm release ON
+  await ui.click('npm-release');
 
   // Assert
   const patch = ui.requests.find((r) => r.method === 'PATCH');
   assert.ok(patch, 'a PATCH was sent');
   assert.equal(patch.url, '/api/bongos/provisioning/instances/18/detail');
-  assert.deepEqual(JSON.parse(patch.body), { modules: ['dev-box', 'discord'] },
+  assert.deepEqual(JSON.parse(patch.body), { modules: ['npm-release', 'discord'] },
     'catalog order, exactly as the column stores it — never append order');
   assert.equal(patch.credentials, 'same-origin', 'the cookie session is the auth — this page carries no token');
 });
 
 test('a toggle can REMOVE one too — the same list, one key shorter', async () => {
-  const ui = boot({ selected: ['dev-box', 'agents'] });
+  const ui = boot({ selected: ['npm-release', 'agents'] });
   await ui.render();
 
   await ui.click('agents');
 
   const patch = ui.requests.find((r) => r.method === 'PATCH');
-  assert.deepEqual(JSON.parse(patch.body), { modules: ['dev-box'] });
+  assert.deepEqual(JSON.parse(patch.body), { modules: ['npm-release'] });
 });
 
 test('switching the last one off sends an empty list — a real answer, not a skipped write', async () => {
@@ -243,8 +243,8 @@ test('the band repaints from the PLATFORM’S answer, and says the save changed
 
 test('a refusal is SAID in the server’s own words, and the band goes back to what the row still holds', async () => {
   const ui = boot({
-    selected: ['dev-box'],
-    patchAnswer: Promise.resolve({ ok: false, status: 400, _json: { error: { code: 'bad_modules', message: 'Unknown module "discrod" — the choices are: dev-box, discord, agents.' } } }),
+    selected: ['npm-release'],
+    patchAnswer: Promise.resolve({ ok: false, status: 400, _json: { error: { code: 'bad_modules', message: 'Unknown module "discrod" — the choices are: npm-release, discord, agents.' } } }),
   });
   await ui.render();
 
@@ -252,7 +252,7 @@ test('a refusal is SAID in the server’s own words, and the band goes back to w
 
   assert.equal(ui.msg().className, 'projMsg err');
   assert.match(ui.msg().textContent, /Unknown module "discrod"/);
-  assert.deepEqual(ui.rows().filter((r) => r.on).map((r) => r.key), ['dev-box'],
+  assert.deepEqual(ui.rows().filter((r) => r.on).map((r) => r.key), ['npm-release'],
     'a refused write leaves the band showing the project’s real set');
 });
 
@@ -269,7 +269,7 @@ test('a signed-out save offers a way back in rather than a dead end', async () =
 });
 
 test('a catalog that ANSWERED badly says so; nothing about the project is claimed to have changed', async () => {
-  const ui = boot({ selected: ['dev-box'], catalogOk: false });
+  const ui = boot({ selected: ['npm-release'], catalogOk: false });
 
   await ui.render();
   await ui.settle();