@bongos/core 1.19.1081 → 1.20.2

package/tests/pin_write_key.mjs

@@ -0,0 +1,383 @@
+// tests/pin_write_key.mjs — the hub's per-project WRITE deploy key (task 1004291, ADR 0350,
+// amending ADR 0176).
+//
+// A hosted project's upgraded pin must reach its GitHub repo days after the owner's
+// one-hour token is gone. The hub holds a second, WRITABLE deploy key per project, kept
+// outside every checkout, readable by the runner alone. What these pin, in the order it
+// would hurt if wrong:
+//   * the key is never readable by the project's own account: outside the checkout, in a
+//     0700 directory, mode 0600, the modes VERIFIED — and a project with no account of its
+//     own (same uid as the runner) is refused a key altogether
+//   * it is registered read_only:false under its own title (distinct from the pull key)
+//   * pushUpgradePin tries it first, then the owner token, then origin, never forced
+//   * teardown (which disconnect runs first) and its no-token path remove it
+//   * /deploy tells the owner reconnecting sets up LASTING access
+// Hermetic: recording fakes for exec, GitHub and the filesystem — no ssh-keygen, no git,
+// no network.
+//
+// Run:  node tests/pin_write_key.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+// ESM named imports: knip credits a CJS export only when a test imports it this way.
+import { pushUpgradePin } from '../scripts/gds/provision-core-upgrade.js';
+import { ensurePinWriteKey, pinKeyDir, pinKeyPath, pinKeyTitle } from '../scripts/gds/provision-pin-key.js';
+
+const require = createRequire(import.meta.url);
+process.env.PROVISION_APP_USER = 'appsvc';
+process.env.PROVISION_PROCESS_MANAGER = 'systemd';
+const RP = require('../scripts/gds/provision-repo.js');
+const R = require('../scripts/gds/provision-core-upgrade.js');
+const P = require('../scripts/gds/provision.js');
+
+let passed = 0, failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+const KEYDIR = '/var/lib/cb-pin-keys';
+const PUB = 'ssh-ed25519 AAAApinkey cloudbongos-pin-acme-site';
+const inst = (over = {}) => ({ id: 9, slug: 'acme-site', hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 5, target_ref: 'acme/site', port: 3011, db_name: 'acme-site', ...over });
+
+// One bag: recorded shell, a fake GitHub, an in-memory "filesystem" of key files.
+function rig({ account = true, accountSaid = null, token = 'ghu_TOK', priv = true, admin = true, keys = [], files = [], modes = '700 600', addReadOnly = false, addThrows = [], apply = true } = {}) {
+  const cmds = [], api = [], logs = [];
+  const present = new Set(files);
+  const throwQueue = [...addThrows];
+  const deps = {
+    apply, pinKeyDir: KEYDIR, log: (l) => logs.push(String(l)),
+    getGithubToken: async () => (token ? { token } : null),
+    exec: (cmd) => {
+      cmds.push(cmd);
+      if (/^id -u /.test(cmd)) return account ? { ok: true, stdout: '1001\n' } : { ok: true, softFailed: true, stdout: '', stderr: accountSaid || 'id: bongos-acme-site: no such user' };
+      if (/ssh-keygen/.test(cmd)) { const m = /-f (\S+)\)/.exec(cmd); present.add(m[1]); present.add(`${m[1]}.pub`); }
+      if (/^stat -c/.test(cmd)) return { ok: true, stdout: `${modes.split(' ').join('\n')}\n` };
+      if (/^rm -f /.test(cmd)) for (const p of cmd.slice(6).split(' ')) present.delete(p);
+      return { ok: true, stdout: '' };
+    },
+    fsImpl: { existsSync: (p) => present.has(p), readFileSync: () => `${PUB}\n` },
+    githubRepos: {
+      getUserRepo: async (_t, a) => { api.push(['get', `${a.owner}/${a.name}`]); return { private: priv, admin }; },
+      listDeployKeys: async () => { api.push(['list']); return keys; },
+      addDeployKey: async (_t, a) => {
+        api.push(['add', a.title, a.key, a.readOnly]);
+        const e = throwQueue.shift(); if (e) throw Object.assign(new Error(e), { code: e });
+        return { id: 77, title: a.title, read_only: addReadOnly };
+      },
+      deleteDeployKey: async (_t, a) => { api.push(['del', a.keyId]); return true; },
+    },
+  };
+  return { deps, cmds, api, logs, present };
+}
+const keyPath = (i = inst()) => `${KEYDIR}/${i.slug}.key`;
+
+console.log('\nminting the write key:');
+
+await t('the key is minted OUTSIDE the checkout, in a 0700 directory, 0600, with a umask, and the modes are CHECKED', async () => {
+  const { deps, cmds } = rig();
+  const r = await ensurePinWriteKey(inst(), deps);
+  assert.equal(r.minted, true);
+  assert.equal(r.keyPath, keyPath());
+  assert.ok(!keyPath().startsWith(RP.standaloneRoot(inst())), 'never inside the project checkout');
+  assert.ok(!keyPath().includes(RP.deployKeyPath(inst())), 'and not the read-only pull key\'s location');
+  const all = cmds.join('\n');
+  assert.match(all, new RegExp(`umask 077 && mkdir -p ${KEYDIR}\\) && chmod 700 ${KEYDIR}`), 'directory 0700');
+  assert.match(all, /umask 077 && ssh-keygen -q -t ed25519 -N '' -C cloudbongos-pin-acme-site -f \S+acme-site\.key/, 'ed25519, no passphrase, born under umask 077');
+  assert.match(all, new RegExp(`chmod 600 ${keyPath()}`), 'key 0600');
+  assert.match(all, new RegExp(`stat -c '%a' ${KEYDIR} ${keyPath()}`), 'and the modes are read back');
+  assert.ok(!cmds.some((c) => c.includes('cloudbongos-deploy-key')), 'the read-only pull key is left exactly as it was');
+});
+
+await t('a key whose modes cannot be confirmed as 700/600 is DELETED and never registered', async () => {
+  for (const modes of ['700 644', '755 600', '700 640']) {
+    const { deps, cmds, api } = rig({ modes });
+    const r = await ensurePinWriteKey(inst(), deps);
+    assert.equal(r.skipped, 'failed', modes);
+    assert.ok(!api.some((c) => c[0] === 'add'), `${modes}: nothing was registered`);
+    assert.ok(cmds.some((c) => c === `rm -f ${keyPath()} ${keyPath()}.pub`), `${modes}: the loose key is removed`);
+  }
+});
+
+await t('it is registered WRITABLE (read_only:false) under its OWN title, distinct from the pull key', async () => {
+  const { deps, api } = rig();
+  await ensurePinWriteKey(inst(), deps);
+  const add = api.find((c) => c[0] === 'add');
+  assert.equal(add[1], 'cloudbongos-pin-acme-site');
+  assert.notEqual(add[1], RP.deployKeyTitle(inst()));
+  assert.equal(add[3], false, 'a write key: read_only false');
+  assert.equal(add[2], PUB, 'the local public half');
+});
+
+await t('a PUBLIC repo gets one too — today it has no per-repo key at all', async () => {
+  const { deps, api } = rig({ priv: false });
+  const r = await ensurePinWriteKey(inst(), deps);
+  assert.equal(r.minted, true);
+  assert.ok(api.some((c) => c[0] === 'add'));
+});
+
+await t('idempotent: an already-registered, current, writable key is left alone', async () => {
+  const { deps, api, cmds } = rig({ files: [keyPath(), `${keyPath()}.pub`], keys: [{ id: 5, title: 'cloudbongos-pin-acme-site', key: 'ssh-ed25519 AAAApinkey', read_only: false }] });
+  const r = await ensurePinWriteKey(inst(), deps);
+  assert.equal(r.minted, false);
+  assert.ok(!api.some((c) => c[0] === 'add' || c[0] === 'del'));
+  assert.ok(!cmds.some((c) => /ssh-keygen/.test(c)), 'no new keypair');
+});
+
+await t('a same-title key registered READ-ONLY (or stale) is replaced, never accumulated', async () => {
+  for (const stale of [{ key: 'ssh-ed25519 AAAApinkey', read_only: true }, { key: 'ssh-ed25519 AAAAother', read_only: false }]) {
+    const { deps, api } = rig({ files: [keyPath(), `${keyPath()}.pub`], keys: [{ id: 5, title: 'cloudbongos-pin-acme-site', ...stale }] });
+    const r = await ensurePinWriteKey(inst(), deps);
+    assert.equal(r.minted, true);
+    assert.deepEqual(api.filter((c) => c[0] === 'del'), [['del', 5]]);
+    assert.equal(api.find((c) => c[0] === 'add')[3], false);
+  }
+});
+
+await t('GitHub holding the key elsewhere (422): a fresh pair is minted and tried ONCE', async () => {
+  const { deps, api, cmds } = rig({ addThrows: ['key_in_use'] });
+  const r = await ensurePinWriteKey(inst(), deps);
+  assert.equal(r.minted, true);
+  assert.equal(api.filter((c) => c[0] === 'add').length, 2);
+  assert.equal(cmds.filter((c) => /ssh-keygen/.test(c)).length, 2);
+});
+
+await t('GitHub answering read-only for the "writable" key: it is removed and reported, not trusted', async () => {
+  const { deps, api } = rig({ addReadOnly: true });
+  const r = await ensurePinWriteKey(inst(), deps);
+  assert.equal(r.skipped, 'registered_read_only');
+  assert.deepEqual(api.filter((c) => c[0] === 'del'), [['del', 77]]);
+});
+
+await t('no token, or a token that is not repository admin: nothing is registered, and nothing throws', async () => {
+  const a = rig({ token: null });
+  assert.equal((await ensurePinWriteKey(inst(), a.deps)).skipped, 'no_token');
+  assert.ok(!a.api.length);
+  const b = rig({ admin: false });
+  assert.equal((await ensurePinWriteKey(inst(), b.deps)).skipped, 'not_admin');
+  assert.ok(!b.api.some((c) => c[0] === 'add'));
+});
+
+await t('a dry run plans only: no shell, no GitHub', async () => {
+  const { deps, cmds, api } = rig({ apply: false });
+  const r = await ensurePinWriteKey(inst(), deps);
+  assert.equal(r.planned, true);
+  assert.equal(cmds.length, 0);
+  assert.equal(api.length, 0);
+});
+
+console.log('\na project with no account of its own is refused a key:');
+
+await t('SHARED-UID project: refused "needs its own account first", and neither key-making nor GitHub is touched', async () => {
+  for (const account of [{ account: false }, { account: false, accountSaid: 'sudo: timed out' }]) {
+    const { deps, cmds, api } = rig(account);
+    const r = await ensurePinWriteKey(inst(), deps);
+    assert.equal(r.skipped, 'needs_own_account');
+    assert.match(r.note, /needs its own account first/);
+    assert.ok(!cmds.some((c) => /ssh-keygen|mkdir/.test(c)), 'no key was made');
+    assert.equal(api.length, 0, 'GitHub was not asked');
+  }
+});
+
+await t('the account probe asks for the project\'s own bongos-<slug> user, not the runner\'s', async () => {
+  const { deps, cmds } = rig();
+  await ensurePinWriteKey(inst(), deps);
+  assert.ok(cmds.includes(`id -u ${RP.instanceUser(inst())}`));
+  assert.notEqual(RP.instanceUser(inst()), 'appsvc');
+});
+
+await t('only a hosted (cloud-host) project with a repo is ever considered', async () => {
+  const a = rig();
+  assert.equal((await ensurePinWriteKey(inst({ hosting_shape: 'co-tenant' }), a.deps)).skipped, 'shape');
+  assert.equal((await ensurePinWriteKey(inst({ target_ref: null }), a.deps)).skipped, 'no_repo');
+  assert.equal(a.cmds.length, 0);
+});
+
+await t('the default key directory is the runner\'s own home, never under the projects\' base', () => {
+  const dir = pinKeyDir({});
+  assert.ok(!dir.startsWith(RP.standaloneRoot({ slug: 'x' }).replace(/\/x$/, '')), dir);
+  assert.match(dir, /cloudbongos\/pin-keys$/);
+});
+
+console.log('\npushUpgradePin prefers it, and still falls back in order:');
+
+// Drives pushUpgradePin directly: exec answers each command shape from a script.
+function pushRig({ token = 'ghu_TOK', hasKey = true, keyPush = null, tokenPush = null, originPush = null, account = true, gh = {} } = {}) {
+  const r = rig({ token, account, files: hasKey ? [keyPath(), `${keyPath()}.pub`] : [], ...gh });
+  const ran = [];
+  const base = r.deps.exec;
+  r.deps.exec = (cmd, opts) => {
+    ran.push({ cmd, env: opts && opts.env });
+    if (/symbolic-ref/.test(cmd)) return { ok: true, stdout: 'main\n' };
+    if (/core\.sshCommand=/.test(cmd)) return keyPush || { ok: true, stdout: '' };
+    if (/push https:\/\/x-access-token@/.test(cmd)) return tokenPush || { ok: true, stdout: '' };
+    if (/ push origin /.test(cmd)) return originPush || { ok: true, stdout: '' };
+    return base(cmd, opts);
+  };
+  r.deps.controlWriteFile = () => ({ ok: true });
+  r.ran = ran;
+  return r;
+}
+const refused = (stderr) => ({ ok: true, softFailed: true, stdout: '', stderr });
+const call = (r, re) => r.ran.find((c) => re.test(c.cmd));
+const push = (r) => pushUpgradePin(inst(), r.deps, { instanceDir: RP.standaloneRoot(inst()) });
+
+await t('the WRITE KEY is tried FIRST, pinned to the key alone, over ssh, hardened, never forced', async () => {
+  const r = pushRig();
+  const out = await push(r);
+  assert.equal(out.pushed, true);
+  assert.equal(out.via, 'write-key');
+  const c = call(r, /core\.sshCommand=/);
+  assert.ok(c.cmd.includes(`core.sshCommand="ssh -F /dev/null -i ${keyPath()} -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"`), c.cmd);
+  assert.ok(c.cmd.includes('push git@github.com:acme/site.git HEAD:main'), c.cmd);
+  assert.match(c.cmd, /-c core\.hooksPath=\/dev\/null /);
+  assert.equal(c.env.GIT_TERMINAL_PROMPT, '0');
+  assert.doesNotMatch(c.cmd, /--force|\+HEAD/);
+  assert.ok(!call(r, /x-access-token/), 'the owner token was not needed, so it was not used');
+  assert.ok(!call(r, / push origin /));
+});
+
+await t('write key REFUSED → the owner token is tried next', async () => {
+  const r = pushRig({ keyPush: refused('git@github.com: Permission denied (publickey).') });
+  const out = await push(r);
+  assert.equal(out.via, 'owner-token');
+  const at = (re) => r.ran.findIndex((c) => re.test(c.cmd));
+  assert.ok(at(/core\.sshCommand=/) < at(/x-access-token@/), 'key, then token');
+});
+
+await t('write key refused and NO token → the checkout\'s own remote is the last resort', async () => {
+  const r = pushRig({ token: null, keyPush: refused('Permission denied (publickey)') });
+  const out = await push(r);
+  assert.equal(out.via, 'origin');
+  const at = (re) => r.ran.findIndex((c) => re.test(c.cmd));
+  assert.ok(at(/core\.sshCommand=/) < at(/ push origin /));
+});
+
+await t('GitHub AHEAD of the box (rejected non-fast-forward) on the write key: reported "behind", no other credential is tried', async () => {
+  const r = pushRig({ keyPush: refused(' ! [rejected]        HEAD -> main (fetch first)') });
+  const out = await push(r);
+  assert.equal(out.pushed, false);
+  assert.equal(out.code, 'behind');
+  assert.ok(!call(r, /x-access-token@/) && !call(r, / push origin /));
+});
+
+await t('NO KEY yet but a FRESH TOKEN: the key is minted first (reconnecting is enough), then used', async () => {
+  const r = pushRig({ hasKey: false });
+  const out = await push(r);
+  assert.equal(out.via, 'write-key');
+  assert.ok(r.api.some((c) => c[0] === 'add' && c[3] === false), 'registered writable on the way');
+  assert.ok(r.ran.findIndex((c) => /ssh-keygen/.test(c.cmd)) < r.ran.findIndex((c) => /core\.sshCommand=/.test(c.cmd)));
+});
+
+await t('NO KEY and the mint cannot happen: the push still falls back to the token, as before', async () => {
+  const r = pushRig({ hasKey: false, gh: { admin: false } });
+  const out = await push(r);
+  assert.equal(out.via, 'owner-token');
+  assert.ok(!call(r, /core\.sshCommand=/), 'no key, so no key push');
+});
+
+await t('NO KEY, NO TOKEN, refused: the note says reconnecting sets up LASTING access', async () => {
+  const r = pushRig({ hasKey: false, token: null, originPush: refused('ERROR: The key you are authenticating with has been marked as read only.') });
+  const out = await push(r);
+  assert.equal(out.code, 'no_access');
+  assert.match(out.note, /Reconnecting GitHub with repository access sets up lasting access/);
+});
+
+await t('a SHARED-UID project that cannot get a key is told it "needs its own account first", not to reconnect', async () => {
+  const r = pushRig({ hasKey: false, token: null, account: false, originPush: refused('ERROR: The key you are authenticating with has been marked as read only.') });
+  const out = await push(r);
+  assert.equal(out.code, 'needs_account');
+  assert.match(out.note, /needs its own account/);
+  const web = require('../modules/provisioning/core-upgrade.js').parseRepoNote(out.note);
+  assert.equal(web.code, 'needs_account', 'and the web tier reads it back');
+});
+
+console.log('\na slug that is not a plain slug never reaches a shell:');
+
+const EVIL = 'acme;touch /tmp/pwn';
+
+await t('minting refuses an invalid slug before running anything', async () => {
+  const { deps, cmds, api } = rig();
+  const r = await ensurePinWriteKey(inst({ slug: EVIL }), deps);
+  assert.equal(r.skipped, 'invalid_slug');
+  assert.equal(cmds.length, 0, 'no command was built from it');
+  assert.equal(api.length, 0);
+});
+
+await t('the key path and title builders throw on an invalid slug instead of interpolating it', () => {
+  assert.throws(() => pinKeyPath(inst({ slug: EVIL }), { pinKeyDir: KEYDIR }), /invalid slug/);
+  assert.throws(() => pinKeyTitle(inst({ slug: '../../etc' })), /invalid slug/);
+});
+
+await t('pushUpgradePin, called on its own, refuses an invalid slug before any git or key command', async () => {
+  const r = pushRig();
+  const out = await pushUpgradePin(inst({ slug: EVIL }), r.deps, { instanceDir: '/srv/x' });
+  assert.equal(out.pushed, false);
+  assert.equal(out.code, 'failed');
+  assert.ok(!r.ran.some((c) => /pwn/.test(c.cmd)), 'the name was refused, not interpolated');
+  assert.equal(r.ran.length, 0, 'nothing ran at all');
+});
+
+console.log('\nrevoked on teardown and disconnect:');
+
+function teardownRig(over = {}) {
+  const r = rig({ files: [keyPath(), `${keyPath()}.pub`], keys: [
+    { id: 11, title: 'cloudbongos-deploy-acme-site', key: 'x', read_only: true },
+    { id: 12, title: 'cloudbongos-pin-acme-site', key: 'y', read_only: false },
+  ], ...over });
+  Object.assign(r.deps, {
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: { setInstanceStatus: async () => {}, recordEvent: async () => {} },
+    processManager: { removeService: () => {} },
+    controlExec: r.deps.exec, apply: true,
+  });
+  return r;
+}
+
+await t('teardown revokes BOTH keys by title on GitHub and removes the write key\'s local half', async () => {
+  const r = teardownRig();
+  await P.teardownInstance(inst(), r.deps);
+  assert.deepEqual(r.api.filter((c) => c[0] === 'del').map((c) => c[1]).sort(), [11, 12]);
+  assert.ok(r.cmds.includes(`rm -f ${keyPath()} ${keyPath()}.pub`), 'the private key does not outlive the teardown');
+});
+
+await t('teardown with NO token still removes the local write key and names it for the owner to remove', async () => {
+  const r = teardownRig({ token: null });
+  await P.teardownInstance(inst(), r.deps);
+  assert.ok(r.cmds.includes(`rm -f ${keyPath()} ${keyPath()}.pub`));
+  assert.match(r.logs.join('\n'), /cloudbongos-pin-acme-site/);
+});
+
+await t('DISCONNECT runs the teardown first, so the write key goes with it', async () => {
+  const D = require('../scripts/gds/provision-disconnect.js');
+  const r = teardownRig();
+  r.deps.catalog = { forget: async () => ({ ok: true }) };
+  await D.disconnectInstance(inst({ status: 'torn_down' }), r.deps).catch(() => {});
+  assert.ok(r.api.some((c) => c[0] === 'del' && c[1] === 12), 'the writable key was revoked');
+  assert.ok(r.cmds.includes(`rm -f ${keyPath()} ${keyPath()}.pub`));
+});
+
+await t('provisioning a project mints the key at standup, after the scaffold and the pull-key wiring', async () => {
+  const src = readFileSync(new URL('../scripts/gds/provision.js', import.meta.url), 'utf8');
+  const i = src.indexOf('await ensurePrivateRepoAccess(inst, deps);');
+  const j = src.indexOf('ensurePinWriteKey(inst, deps)');
+  assert.ok(i > 0 && j > i && j - i < 400, 'ensurePinWriteKey follows ensurePrivateRepoAccess in the standalone branch');
+});
+
+console.log('\nthe /deploy copy describes a LASTING fix:');
+
+await t('the deploy page says reconnecting sets up lasting access — not an hour', () => {
+  const js = readFileSync(new URL('../modules/hall-ui/public/deploy.js', import.meta.url), 'utf8');
+  const reconnect = js.slice(js.indexOf('function reconnectHtml'), js.indexOf('function stepOneHtml'));
+  assert.match(reconnect, /Reconnecting sets up <strong>lasting<\/strong> access/);
+  assert.doesNotMatch(reconnect, /about an hour|within the hour/);
+});
+
+await t('the no_access note the page shows says the same', () => {
+  assert.match(R.REPO_NOTES.no_access, /sets up lasting access/);
+  assert.match(R.REPO_NOTES.needs_account, /needs its own account/);
+});
+
+console.log(`\npin_write_key: ${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/planning_session_skill.mjs

@@ -134,5 +134,32 @@ test('the operator is told to dry-run the SELECT before the UPDATE', () => {
   assert.ok(step.indexOf('SELECT id, title') < step.indexOf('UPDATE tasks'), 'the SELECT comes before the UPDATE');
 });
 
+// ---- task 1002865: a login that expires mid-session costs a re-auth, not the work ----
+// The retro: the token was valid at the rank gate (200) and dead by Phase 5
+// (401), and the whole interview was lost at seed time. An early probe ALONE
+// would not have caught it, so the skill must have both halves plus a spool.
+
+test('the gate probe names the expired-session case and routes to /builder-reauth before anything else', () => {
+  const gate = SKILL.slice(SKILL.indexOf('**Enforce the gate at the very top'), SKILL.indexOf('## The session — five phases'));
+  assert.match(gate, /401/, 'the gate says what an expired session looks like');
+  assert.match(gate, /no longer valid/, 'including the CLI\'s own words for it');
+  assert.match(gate, /\/builder-reauth/, 'and routes to the fast re-issue');
+});
+
+test('Phase 4 spools every answer to the spec file as it lands, so an expiry cannot lose the interview', () => {
+  const p4 = SKILL.slice(SKILL.indexOf('### Phase 4'), SKILL.indexOf('### Phase 5'));
+  assert.match(p4, /spec file/i);
+  assert.match(p4, /as (each|it) (answer )?lands|after every round|before the next round/i, 'written immediately, not at the end');
+});
+
+test('Phase 5 re-probes the session before the first write, and on a 401 re-auths and RESUMES rather than abandoning', () => {
+  const p5 = SKILL.slice(SKILL.indexOf('### Phase 5'));
+  assert.match(p5, /GET \/api\/bongos\/me/, 'a fresh probe right before the writes');
+  assert.match(p5, /401/);
+  assert.match(p5, /\/builder-reauth/);
+  assert.match(p5, /resume|re-run/i, 'the writes are resumed, not restarted from the interview');
+  assert.match(p5, /idempotent/i, 'and says why a re-run is safe');
+});
+
 console.log(`\nplanning_session_skill: ${passed} passed, ${failed} failed`);
 if (failed > 0) process.exit(1);

package/tests/platform_boot.mjs

@@ -16,6 +16,8 @@ import { spawn } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import platformMod from '../src/platform-server.js';
 import loader from '../src/module-loader/loader.js';
+import seams from '../src/module-seams.js';
+import bongosLogger from '../src/bongos/logger.js';
 
 const { buildPlatformApp, startBackgroundServices } = platformMod;
 
@@ -336,3 +338,72 @@ test('task 1003820: platform-server refuses to boot when an enabled module consu
     child.kill('SIGKILL');
   }
 });
+
+// ---------------------------------------------------------------------------------------
+// task 1004300 (ADR 0349): the optional request.divert seam. A module may take a request
+// before any surface answers; with no provider the kernel must not notice it exists.
+// These two cases stay LAST in this file: the second registers a provider, and the seam
+// registry has no unregister, so it clears the registry when it is done.
+// ---------------------------------------------------------------------------------------
+
+function requestWithCookie(pathname, cookie) {
+  return new Promise((resolve, reject) => {
+    const req = http.request(
+      { host: '127.0.0.1', port, path: pathname, method: 'GET', headers: { Host: '127.0.0.1', Cookie: cookie } },
+      (res) => {
+        let body = '';
+        res.on('data', (c) => (body += c));
+        res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body }));
+      }
+    );
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+test('task 1004300: with no request.divert provider a request falls straight through, cookie or not', async () => {
+  assert.equal(seams.hasProvider('request.divert'), false, 'nothing provides it in a vanilla boot');
+  // Fall-through must be the guard, not the error handler catching a call on nothing: a
+  // request that only survives because a TypeError was logged and swallowed has not fallen through.
+  const errors = [];
+  const realError = bongosLogger.logger.error;
+  bongosLogger.logger.error = (...a) => { errors.push(a); };
+  let plain;
+  let steered;
+  try {
+    plain = await request('/api/gds/healthz');
+    steered = await requestWithCookie('/api/gds/healthz', 'bongos_preview=1.19.1000');
+  } finally { bongosLogger.logger.error = realError; }
+  assert.deepEqual(errors, [], 'no provider is not an error');
+  assert.equal(plain.status, 200);
+  assert.equal(steered.status, 200);
+  assert.equal(steered.body, plain.body, 'byte-identical: the cookie means nothing without a provider');
+  assert.equal(steered.headers['set-cookie'], undefined);
+});
+
+test('task 1004300: a registered request.divert provider takes the request, is looked up per request, and can pass it on', async () => {
+  const seen = [];
+  seams.registerProvider('request.divert', (req, res, next) => {
+    seen.push(req.url);
+    if (/bongos_preview/.test(req.headers.cookie || '')) {
+      res.statusCode = 299;
+      res.end('diverted');
+      return undefined;
+    }
+    return next();
+  });
+  const taken = await requestWithCookie('/api/gds/healthz', 'bongos_preview=1.19.1000');
+  assert.equal(taken.status, 299);
+  assert.equal(taken.body, 'diverted');
+  const passed = await request('/api/gds/healthz');
+  assert.equal(passed.status, 200, 'a request the provider passes on is served as usual');
+  assert.deepEqual(seen, ['/api/gds/healthz', '/api/gds/healthz']);
+});
+
+test('task 1004300: a request.divert provider that throws is treated as absent for that request', async () => {
+  seams._reset();
+  seams.registerProvider('request.divert', () => { throw new Error('a broken preview'); });
+  const res = await request('/api/gds/healthz');
+  assert.equal(res.status, 200, 'the live hall is not taken down by a broken provider');
+  seams._reset();
+});

package/tests/profile_nudge_links.mjs

@@ -0,0 +1,86 @@
+// tests/profile_nudge_links.mjs — the "Complete your profile" nudge sends each
+// half to where it is actually edited (task 1003485, goal 1000110).
+//
+// The bug: the hall's nudge said "Add a short bio" and linked to /settings, which
+// has no bio field — the bio is a platform-account field, edited on the hub's
+// account page since task 1004259 (ADR 0337 D4.3). Now the bio half links to
+// <hubOrigin>/account, the kinds-of-work half to this hall's /settings#disciplines,
+// and a half with nowhere to go is not asked for at all.
+//
+// The page script is EXECUTED in a node:vm under a DOM stub (the vm-slice idiom),
+// so these pin what the line renders, not how the source spells it.
+//
+// Run:  node --test tests/profile_nudge_links.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const SRC = fs.readFileSync(path.join(HALL, 'profile-nudge.js'), 'utf8');
+const INDEX = fs.readFileSync(path.join(HALL, 'index.html'), 'utf8');
+
+// Boot the script with a hub origin (or none) and return its render() + the box.
+function boot(hub) {
+  const box = { innerHTML: 'stale' };
+  const escapeHtml = (v) => String(v).replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
+  const window = {
+    OTB: { escapeHtml, hubOrigin: () => hub },
+    BongosClient: { createClient: () => ({ request: async () => ({ ok: false, status: 404 }) }) },
+    OTBAttention: { refresh() {} },
+  };
+  const document = {
+    getElementById: (id) => (id === 'attention-profile' ? box : null),
+    addEventListener() {},
+  };
+  vm.runInNewContext(SRC, { window, document, console });
+  return { render: window.OTBProfileNudge.render, box };
+}
+const hrefs = (html) => [...html.matchAll(/<a class="ginbox__goal" href="([^"]+)">([^<]+)<\/a>/g)].map((m) => [m[1], m[2]]);
+
+test('both halves missing: the bio goes to the hub account page, the kinds of work to Settings', () => {
+  const { render, box } = boot('https://cloudbongos.com');
+  render({ show: true, missing: ['disciplines', 'bio'] });
+  assert.deepEqual(hrefs(box.innerHTML), [
+    ['https://cloudbongos.com/account', 'Add a short bio'],
+    ['/settings#disciplines', 'the kinds of work you want'],
+  ]);
+  assert.match(box.innerHTML, /<span><a [^>]+>Add a short bio<\/a> and <a [^>]+>the kinds of work you want<\/a><\/span>/,
+    'one flex item, so the line reads as one sentence');
+  assert.doesNotMatch(box.innerHTML, /href="\/settings"/, 'nothing is sent to a Settings page without the field');
+});
+
+test('only the bio missing: one link, to the hub account page', () => {
+  const { render, box } = boot('https://cloudbongos.com');
+  render({ show: true, missing: ['bio'] });
+  assert.deepEqual(hrefs(box.innerHTML), [['https://cloudbongos.com/account', 'Add a short bio']]);
+});
+
+test('only the kinds of work missing: one link, to this hall’s Settings', () => {
+  const { render, box } = boot(null);
+  render({ show: true, missing: ['disciplines'] });
+  assert.deepEqual(hrefs(box.innerHTML), [['/settings#disciplines', 'Add the kinds of work you want']]);
+});
+
+test('no hub origin: the bio is not asked for — no line points at a page that cannot answer it', () => {
+  const { render, box } = boot(null);
+  render({ show: true, missing: ['bio'] });
+  assert.equal(box.innerHTML, '');
+  render({ show: true, missing: ['bio', 'disciplines'] });
+  assert.deepEqual(hrefs(box.innerHTML), [['/settings#disciplines', 'Add the kinds of work you want']]);
+});
+
+test('dismissed or complete: nothing renders', () => {
+  const { render, box } = boot('https://cloudbongos.com');
+  render({ show: false, missing: ['bio'] });
+  assert.equal(box.innerHTML, '');
+});
+
+test('the hall home page stamps the hub origin the nudge reads', () => {
+  assert.match(INDEX, /<meta name="hub-origin" content="\{\{hubOrigin\}\}">/);
+  assert.match(SRC, /window\.OTB\.hubOrigin\(\)/, 'through the one shared reader, not a private copy');
+});

package/tests/profile_ui_cross_project.mjs

@@ -143,7 +143,7 @@ test('cross_project null, self view via ?id= → private line + the Settings lin
   const { $ } = await boot({ search: '?id=7', me: meOk('7'), profile: profileOk(data) });
   const html = $('#xp-body').innerHTML;
   assert.match(html, /keeps their track record private/);
-  assert.ok(html.includes('/settings#cross-project'), 'the self hide-toggle links to Settings → Cross-project record');
+  assert.ok(html.includes('/settings#cross-project'), 'the self hide-toggle links to Settings → Profile and privacy');
 });
 
 test('self view with no ?id= (own-profile path) also gets the Settings link', async () => {

package/tests/projects_hub.mjs

@@ -2165,8 +2165,8 @@ test('the wizard\'s own structures wear the world: hairline fields, cells of one
   const at = STYLE.indexOf('the create wizard (task 1002763');
   assert.ok(at > -1, 'the wizard block is still the page\'s own');
   const block = STYLE.slice(at);
-  assert.match(block, /#view-new input\[type=text\], #view-new textarea\{\s*width:100%;[^}]*border:0;border-bottom:1px solid var\(--rule\);border-radius:0;/, 'a field is one bottom hairline');
-  assert.match(block, /#view-new input\[type=text\]:focus, #view-new textarea:focus\{border-bottom-color:var\(--ink\);box-shadow:none;\}/, 'focus takes ink, never a glow');
+  assert.match(block, /#view-new input\[type=text\], #view-new input\[type=password\], #view-new textarea\{\s*width:100%;[^}]*border:0;border-bottom:1px solid var\(--rule\);border-radius:0;/, 'a field is one bottom hairline');
+  assert.match(block, /#view-new input\[type=text\]:focus, #view-new input\[type=password\]:focus, #view-new textarea:focus\{border-bottom-color:var\(--ink\);box-shadow:none;\}/, 'focus takes ink, never a glow');
   assert.match(block, /\.typeCards\{display:grid;[^}]*border-top:1px solid var\(--rule\);border-bottom:1px solid var\(--rule\);/, 'the type and team choices are cells of one band');
   assert.match(block, /\.tpill\[aria-pressed=true\]::before\{background:var\(--accent\);/, 'the chosen cell carries the dot');
   assert.match(block, /\.choices\{display:grid;grid-template-columns:1fr 1fr;gap:0;border-top:1px solid var\(--rule\);/, 'start fresh / adopt are two cells of one band');