@bongos/core 1.19.120 → 1.19.122

package/tests/provisioning_default_domain.mjs

@@ -0,0 +1,331 @@
+// tests/provisioning_default_domain.mjs
+//
+// Auto-assign at creation (task 1002704, the owner's 2026-08-12 decision): every
+// new project gets <slug>.<instanceBase> at creation so its hall is reachable day
+// one; `no_address: true` is the explicit opt-out; an explicit body.domain
+// (bring-your-own) wins. Also closes the create path's validation gap — the
+// attach route normalized + uniqueness-checked its domain (task 1002692) while
+// create inserted body.domain raw — and adds the reserved-name guard that keeps
+// a project slug ('www', 'get', …) from UPSERTing over the platform's own DNS
+// once every create carries an address.
+//
+// Covers:
+//   • defaultDomainForSlug / isReservedHostname — the pure helpers
+//   • POST /provisioning/instances — assign-by-default, opt-out, BYO-wins,
+//     bad_domain, domain_taken, domain_reserved, blank-apex degradation,
+//     re-request honesty (no phantom domain_ignored from the derived default;
+//     no_address_ignored when the opt-out can't apply)
+//   • POST /provisioning/instances/:id/domain — the same reserved-name refusal
+//
+// DB-free: data-access fns are stubbed on the cached module object (the
+// provisioning_domain_attach.mjs harness). No network.
+//
+// Run:  node tests/provisioning_default_domain.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const provisioning = require('../modules/provisioning/provisioning.js');
+
+let passed = 0, failed = 0;
+function t(name, fn) {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+console.log('pure helpers — defaultDomainForSlug / isReservedHostname:');
+
+t('defaultDomainForSlug: <slug>.<apex>, normalized', () => {
+  assert.equal(provisioning.defaultDomainForSlug('spike', 'cloudbongos.com'), 'spike.cloudbongos.com');
+  assert.equal(provisioning.defaultDomainForSlug('spike', 'CloudBongos.com.'), 'spike.cloudbongos.com');
+});
+
+t('defaultDomainForSlug: blank/absent apex → null (self-host degrades to domainless)', () => {
+  assert.equal(provisioning.defaultDomainForSlug('spike', ''), null);
+  assert.equal(provisioning.defaultDomainForSlug('spike', null), null);
+  assert.equal(provisioning.defaultDomainForSlug('spike', undefined), null);
+});
+
+t('defaultDomainForSlug: invalid slug or unparseable apex → null', () => {
+  assert.equal(provisioning.defaultDomainForSlug('', 'cloudbongos.com'), null);
+  assert.equal(provisioning.defaultDomainForSlug('-bad-', 'cloudbongos.com'), null);
+  assert.equal(provisioning.defaultDomainForSlug('spike', '???'), null);
+});
+
+t('isReservedHostname: platform labels + box prefixes under the apex are reserved', () => {
+  for (const h of ['www.cloudbongos.com', 'get.cloudbongos.com', 'status.cloudbongos.com',
+    'term-alice.cloudbongos.com', 'sandbox-bob.cloudbongos.com', 'cloudbongos.com']) {
+    assert.equal(provisioning.isReservedHostname(h, 'cloudbongos.com'), true, `${h} should be reserved`);
+  }
+});
+
+t('isReservedHostname: ordinary one-label projects and foreign zones are not reserved', () => {
+  assert.equal(provisioning.isReservedHostname('spike.cloudbongos.com', 'cloudbongos.com'), false);
+  assert.equal(provisioning.isReservedHostname('www.example.com', 'cloudbongos.com'), false, 'BYO on a foreign zone is fine');
+  assert.equal(provisioning.isReservedHostname('spike.cloudbongos.com', ''), false, 'no apex configured → nothing to protect');
+});
+
+t('isReservedHostname: deeper than one label under the apex is reserved (breaks the wildcard cert; nothing legitimate creates it)', () => {
+  assert.equal(provisioning.isReservedHostname('a.b.cloudbongos.com', 'cloudbongos.com'), true);
+});
+
+// ── the create route, over a real mounted router (stubbed data access) ───────────
+let domainHolder = null;         // what getInstanceByDomain returns
+let existingRow = null;          // what getInstanceBySlug returns (re-request tests)
+let createCalls = [];            // what createInstance was asked to insert
+let createResult = null;         // what createInstance reports
+let enqueueCalls = [];
+provisioning.getInstanceByDomain = async (_db, _d) => domainHolder;
+provisioning.getInstanceBySlug = async (_db, _s) => existingRow;
+provisioning.getInstanceById = async () => null;
+provisioning.updateInstanceDomain = async (_db, id, domain) => ({ id, domain });
+provisioning.createInstance = async (_db, args) => { createCalls.push(args); return createResult; };
+provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
+  enqueueCalls.push({ id, action, requestedBy });
+  return { intent: { id: 9, action, state: 'pending' }, created: true };
+};
+provisioning.getOpenIntent = async () => null;
+provisioning.recordEvent = async () => {};
+
+const api = require('../src/module-api.js');
+api.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'owner' }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+let brandingDomains = { publicOrigin: 'https://cb.test', instanceBase: 'cloudbongos.com' };
+api.branding = () => ({ domains: brandingDomains, identity: { productName: 'Cloud Bongos' } });
+
+const express = require('express');
+const provisioningRoutes = require('../modules/provisioning/routes/provisioning.js');
+const app = express();
+app.use(express.json());
+app.use((_req, res, next) => {
+  res.fail = (code, opts, details) => {
+    const status = typeof opts === 'number' ? opts : (opts && opts.status) || 400;
+    res.status(status).json({ error: { code, ...(typeof opts === 'object' ? opts : {}), ...(details || {}) } });
+  };
+  next();
+});
+app.use('/api/bongos', provisioningRoutes());
+
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+
+function post(path, body = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${path}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => { let j = null; try { j = JSON.parse(d); } catch { /* non-JSON */ } resolve({ status: res.statusCode, body: j, raw: d }); });
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+
+const freshRow = (over = {}) => ({
+  id: 41, owner_builder_id: 7, slug: 'spike', status: 'requested', hosting_shape: 'standalone',
+  domain: 'spike.cloudbongos.com', onboard_mode: 'greenfield', type: null, created_at: '', updated_at: '', ...over,
+});
+
+function reset() {
+  domainHolder = null;
+  existingRow = null;
+  createCalls = [];
+  enqueueCalls = [];
+  createResult = { instance: freshRow(), created: true };
+}
+
+console.log('\nPOST /provisioning/instances — auto-assign, opt-out, BYO wins:');
+
+await ta('no domain in the body → the assigned <slug>.<instanceBase> is created (the API-first gap, N2)', async () => {
+  reset();
+  const res = await post('/provisioning/instances', { slug: 'spike' });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(createCalls[0].domain, 'spike.cloudbongos.com');
+});
+
+await ta('no_address: true → deliberately domainless (the opt-out survives the server default)', async () => {
+  reset();
+  createResult = { instance: freshRow({ domain: null }), created: true };
+  const res = await post('/provisioning/instances', { slug: 'spike', no_address: true });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(createCalls[0].domain == null, true, 'no domain may be assigned');
+});
+
+await ta('an explicit domain (bring-your-own) wins over the default, normalized', async () => {
+  reset();
+  createResult = { instance: freshRow({ domain: 'spike.example.com' }), created: true };
+  const res = await post('/provisioning/instances', { slug: 'spike', domain: 'Spike.Example.com.' });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(createCalls[0].domain, 'spike.example.com');
+});
+
+await ta('a malformed explicit domain → 400 bad_domain, nothing created (create now matches attach)', async () => {
+  reset();
+  const res = await post('/provisioning/instances', { slug: 'spike', domain: 'not a hostname' });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'bad_domain');
+  assert.equal(createCalls.length, 0);
+});
+
+await ta("an address held by ANOTHER instance → 409 domain_taken (create had no uniqueness check)", async () => {
+  reset();
+  domainHolder = freshRow({ id: 99, slug: 'other' });
+  const res = await post('/provisioning/instances', { slug: 'spike' });
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'domain_taken');
+  assert.equal(createCalls.length, 0);
+});
+
+await ta('the holder being this slug’s own row (a re-request) is not a collision', async () => {
+  reset();
+  domainHolder = freshRow();
+  createResult = { instance: freshRow(), created: false };
+  const res = await post('/provisioning/instances', { slug: 'spike' });
+  assert.equal(res.status, 200, res.raw);
+});
+
+await ta('a BYO domain under the apex that is not the slug’s own address → 400 (squat on another handle)', async () => {
+  reset();
+  const res = await post('/provisioning/instances', { slug: 'spike', domain: 'victim.cloudbongos.com' });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'domain_reserved');
+  assert.equal(createCalls.length, 0);
+});
+
+await ta('an explicit domain equal to the slug’s own assigned address is fine (the wizard sends exactly this)', async () => {
+  reset();
+  const res = await post('/provisioning/instances', { slug: 'spike', domain: 'spike.cloudbongos.com' });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(createCalls[0].domain, 'spike.cloudbongos.com');
+});
+
+await ta('a reserved label under the apex → 400 domain_reserved (auto-assign path)', async () => {
+  reset();
+  const res = await post('/provisioning/instances', { slug: 'www' });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'domain_reserved');
+  assert.equal(createCalls.length, 0);
+});
+
+await ta('a reserved hostname as BYO → 400 domain_reserved (same guard, explicit path)', async () => {
+  reset();
+  const res = await post('/provisioning/instances', { slug: 'spike', domain: 'GET.cloudbongos.com' });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'domain_reserved');
+});
+
+await ta('a reserved slug WITH no_address is fine — no hostname is being claimed', async () => {
+  reset();
+  createResult = { instance: freshRow({ slug: 'www', domain: null }), created: true };
+  const res = await post('/provisioning/instances', { slug: 'www', no_address: true });
+  assert.equal(res.status, 201, res.raw);
+});
+
+await ta('blank instanceBase (self-host / unconfigured) → domainless create, no guessing', async () => {
+  reset();
+  brandingDomains = { publicOrigin: 'http://localhost:3000' };
+  createResult = { instance: freshRow({ domain: null }), created: true };
+  const res = await post('/provisioning/instances', { slug: 'spike' });
+  assert.equal(res.status, 201, res.raw);
+  assert.equal(createCalls[0].domain == null, true, 'no apex → nothing to assign');
+  brandingDomains = { publicOrigin: 'https://cb.test', instanceBase: 'cloudbongos.com' };
+});
+
+console.log('\nre-requests skip the birth-time guards (Try again / Bring it back must keep working):');
+
+await ta('a re-request of an EXISTING reserved-label row → 200 with its provision intent (not domain_reserved)', async () => {
+  reset();
+  existingRow = freshRow({ slug: 'demo', domain: 'demo.cloudbongos.com', status: 'error' });
+  createResult = { instance: existingRow, created: false };
+  const res = await post('/provisioning/instances', { slug: 'demo', domain: 'demo.cloudbongos.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.deepEqual(enqueueCalls.map((c) => c.action), ['provision'], "the 'error' row re-enqueues its provision intent");
+});
+
+await ta('a re-request is never 409ed against its own (or anyone’s) address — createInstance won’t write one', async () => {
+  reset();
+  existingRow = freshRow();
+  domainHolder = freshRow({ id: 99, slug: 'other' });
+  createResult = { instance: freshRow(), created: false };
+  const res = await post('/provisioning/instances', { slug: 'spike' });
+  assert.equal(res.status, 200, res.raw);
+});
+
+console.log('\nre-request honesty:');
+
+await ta('a re-request with NO explicit domain never reports domain_ignored (the derived default is not an ask)', async () => {
+  reset();
+  createResult = { instance: freshRow({ domain: 'custom.example.com' }), created: false };
+  const res = await post('/provisioning/instances', { slug: 'spike' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.domain_ignored, undefined);
+});
+
+await ta('a re-request with an explicit different domain still reports domain_ignored', async () => {
+  reset();
+  createResult = { instance: freshRow({ domain: 'custom.example.com' }), created: false };
+  const res = await post('/provisioning/instances', { slug: 'spike', domain: 'spike.other.org' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.domain_ignored.requested, 'spike.other.org');
+});
+
+await ta("a re-request with no_address on an addressed instance says so (no_address_ignored)", async () => {
+  reset();
+  domainHolder = freshRow();
+  createResult = { instance: freshRow(), created: false };
+  const res = await post('/provisioning/instances', { slug: 'spike', no_address: true });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.no_address_ignored.current, 'spike.cloudbongos.com');
+});
+
+console.log('\nPOST /provisioning/instances/:id/domain — the reserved guard applies to attach too:');
+
+await ta('attaching a reserved hostname under the apex → 400 domain_reserved', async () => {
+  reset();
+  provisioning.getInstanceById = async (_db, id) => freshRow({ id, domain: null, status: 'active' });
+  const res = await post('/provisioning/instances/41/domain', { domain: 'www.cloudbongos.com' });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'domain_reserved');
+});
+
+await ta('attaching another handle’s address under the apex → 400 (squat, same rule as create)', async () => {
+  reset();
+  provisioning.getInstanceById = async (_db, id) => freshRow({ id, domain: null, status: 'active' });
+  const res = await post('/provisioning/instances/41/domain', { domain: 'victim.cloudbongos.com' });
+  assert.equal(res.status, 400, res.raw);
+  assert.equal(res.body.error.code, 'domain_reserved');
+});
+
+console.log('\nthe assigned default may be upgraded to a bring-your-own domain (the decision’s upgrade path):');
+
+await ta('re-pointing AWAY from the platform-assigned address → recorded + domain-attach intent', async () => {
+  reset();
+  provisioning.getInstanceById = async (_db, id) => freshRow({ id, domain: 'spike.cloudbongos.com', status: 'active' });
+  const res = await post('/provisioning/instances/41/domain', { domain: 'spike.example.com' });
+  assert.equal(res.status, 200, res.raw);
+  assert.equal(res.body.domain, 'spike.example.com');
+  assert.deepEqual(enqueueCalls.map((c) => c.action), ['domain-attach']);
+});
+
+await ta('a genuine bring-your-own address still refuses to re-point (unchanged)', async () => {
+  reset();
+  provisioning.getInstanceById = async (_db, id) => freshRow({ id, domain: 'spike.example.com', status: 'active' });
+  const res = await post('/provisioning/instances/41/domain', { domain: 'another.example.com' });
+  assert.equal(res.status, 409, res.raw);
+  assert.equal(res.body.error.code, 'domain_already_set');
+});
+
+server.close();
+console.log(`\n${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/provisioning_domain_attach.mjs

@@ -91,6 +91,7 @@ provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
 };
 provisioning.getOpenIntent = async () => null;
 provisioning.createInstance = async () => createResult;
+provisioning.getInstanceBySlug = async () => null;   // the task-1002704 birth-time pre-check
 provisioning.recordEvent = async () => {};
 provisioning.createOAuthManifest = async (_db, row) => { manifestRows.push(row); return { id: 1, ...row }; };
 provisioning.getLatestOAuthManifestForInstance = async () => null;

package/tests/provisioning_teardown_intent.mjs

@@ -148,6 +148,7 @@ provisioning.enqueueIntent = async (_db, id, action, requestedBy) => {
 };
 provisioning.getOpenIntent = async () => null;
 provisioning.createInstance = async () => createResult;
+provisioning.getInstanceBySlug = async () => null;   // the task-1002704 birth-time pre-check
 provisioning.recordEvent = async () => {};
 
 const api = require('../src/module-api.js');

package/tests/ship_post_land_verify.mjs

@@ -0,0 +1,114 @@
+// tests/ship_post_land_verify.mjs
+//
+// Unit tests for the post-land ship-call outcome (task 1002809). After a
+// successful merge, ship.js POSTs /tasks/<id>/ship; the server may have landed
+// the task first (reconcile-on-read, or the ~5-min reconciler racing this call),
+// in which case it refuses with task_not_confirmed. The old code compared
+// `ship.data.error === 'task_not_confirmed'` — the legacy FLAT shape — but the
+// live server emits the ADR 0116 (R01) envelope `{ error: { code, … } }`, so the
+// string test never matched and an already-landed SUCCESS rendered as
+// "merged, but the ship call failed — [object Object]" (the HANDOFF-apex-ui
+// '400 task_not_confirmed AFTER a successful land' gotcha). Same bug class as
+// claim.js task 1476 / cli-lib isBoxScope task 1002162.
+//
+// What we prove here (pure helpers only — the live GET verify is exercised by
+// every real ship):
+//   1. normalizeApiError reads BOTH body shapes (envelope + flat) and survives
+//      missing/odd bodies.
+//   2. postLandShipOutcome: a live status of 'shipped' is SUCCESS whatever the
+//      error code or HTTP status was (the GET verify is authoritative).
+//   3. task_not_confirmed with the verify GET unavailable keeps the task-1049
+//      benefit-of-the-doubt success (the server reconciled it).
+//   4. A known live status that is NOT shipped stays a loud failure — never
+//      paper over a genuinely stranded task.
+//
+// Run:  node tests/ship_post_land_verify.mjs
+
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const ship = require('../scripts/gds/ship.js');
+const { normalizeApiError, postLandShipOutcome } = ship;
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+function eq(actual, expected, msg) {
+  if (actual !== expected) throw new Error(`${msg || 'mismatch'}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+}
+
+// ---- 1. normalizeApiError: both wire shapes ----
+
+test('normalizeApiError reads the R01 envelope', () => {
+  const { code, message } = normalizeApiError({ error: { code: 'task_not_confirmed', message: 'not at confirmed' } });
+  eq(code, 'task_not_confirmed');
+  eq(message, 'not at confirmed');
+});
+
+test('normalizeApiError reads the legacy flat shape', () => {
+  const { code, message } = normalizeApiError({ error: 'task_not_confirmed' });
+  eq(code, 'task_not_confirmed');
+  eq(message, undefined);
+});
+
+test('normalizeApiError survives missing/odd bodies', () => {
+  eq(normalizeApiError(null).code, undefined);
+  eq(normalizeApiError({}).code, undefined);
+  eq(normalizeApiError({ error: { message: 'no code' } }).message, 'no code');
+});
+
+test('normalizeApiError survives { error: null } (typeof null is object)', () => {
+  eq(normalizeApiError({ error: null }).code, null);
+  eq(normalizeApiError({ error: null }).message, undefined);
+});
+
+// ---- 2. live status 'shipped' is success regardless of code/status ----
+
+test('verified shipped ⇒ success even on an unexpected code', () => {
+  const out = postLandShipOutcome({ code: 'internal_error', liveStatus: 'shipped' });
+  eq(out.alreadyShipped, true);
+  if (!out.why || typeof out.why !== 'string') throw new Error('expected a human why-line');
+});
+
+test('verified shipped ⇒ success on task_not_confirmed (409 or 400 alike)', () => {
+  eq(postLandShipOutcome({ code: 'task_not_confirmed', liveStatus: 'shipped' }).alreadyShipped, true);
+});
+
+// ---- 3. verify GET unavailable: keep the task-1049 reconcile success ----
+
+test('task_not_confirmed with no live status keeps the reconciled success', () => {
+  const out = postLandShipOutcome({ code: 'task_not_confirmed', liveStatus: null });
+  eq(out.alreadyShipped, true);
+  // The why feeds `shipped (${why})` directly — an absent why prints
+  // "shipped (undefined)", the same garbage-output class this task fixes.
+  if (!out.why || typeof out.why !== 'string') throw new Error('expected a human why-line');
+});
+
+test('an unknown code with no live status is a failure (no blind success)', () => {
+  eq(postLandShipOutcome({ code: 'internal_error', liveStatus: null }).alreadyShipped, false);
+});
+
+// ---- 4. a known non-shipped status stays a loud failure ----
+
+test('task_not_confirmed but live status confirmed ⇒ failure, not success', () => {
+  const out = postLandShipOutcome({ code: 'task_not_confirmed', liveStatus: 'confirmed' });
+  eq(out.alreadyShipped, false);
+});
+
+test('task_not_confirmed but live status completed ⇒ failure', () => {
+  eq(postLandShipOutcome({ code: 'task_not_confirmed', liveStatus: 'completed' }).alreadyShipped, false);
+});
+
+console.log('');
+console.log(`ship_post_land_verify: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);

package/tests/worktree_helper.mjs

@@ -0,0 +1,145 @@
+// tests/worktree_helper.mjs
+//
+// Unit tests for the pure decision helpers behind scripts/gds/worktree.js
+// (task 1002809) — the junction-safe worktree lifecycle for Windows builders.
+//
+// The trap this tooling kills: a worktree OUTSIDE the repo root (C:/tmp/wt-N,
+// used to dodge OneDrive locks) needs a node_modules junction back to the main
+// checkout; `cmd //c mklink` from Git Bash mangles quoted targets with spaces
+// (dead junction), and `git worktree remove` FOLLOWS the junction and deletes
+// the SHARED node_modules. The helper creates junctions with
+// fs.symlinkSync(..., 'junction') (no shell involved) and always removes the
+// junction BEFORE git worktree remove.
+//
+// What we prove here:
+//   1. worktreeNameFor: a numeric task id becomes task-<id>; an explicit name
+//      passes through; junk is rejected.
+//   2. needsJunction: only win32 AND a path outside the repo root.
+//   3. removalPlan: a junction is unlinked BEFORE git worktree remove; a real
+//      node_modules dir is never touched by us (git refuses; we surface that);
+//      absent node_modules goes straight to git worktree remove.
+//
+// Run:  node tests/worktree_helper.mjs
+
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { worktreeNameFor, needsJunction, removalPlan, nodeModulesState } = require('../scripts/gds/worktree.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try {
+    fn();
+    passed++;
+    console.log(`  ok  ${name}`);
+  } catch (err) {
+    failed++;
+    console.log(`  FAIL ${name}`);
+    console.log(`     ${err.message}`);
+  }
+}
+function eq(actual, expected, msg) {
+  if (actual !== expected) throw new Error(`${msg || 'mismatch'}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+}
+function eqArr(actual, expected, msg) {
+  eq(JSON.stringify(actual), JSON.stringify(expected), msg);
+}
+
+// ---- 1. worktreeNameFor ----
+
+test('numeric task id becomes task-<id>', () => {
+  eq(worktreeNameFor('1002809'), 'task-1002809');
+});
+
+test('an explicit task-N name passes through', () => {
+  eq(worktreeNameFor('task-77'), 'task-77');
+});
+
+test('a plain name passes through', () => {
+  eq(worktreeNameFor('spike-tiles'), 'spike-tiles');
+});
+
+test('junk (path separators, empty) is rejected with null', () => {
+  eq(worktreeNameFor('a/b'), null);
+  eq(worktreeNameFor('..'), null);
+  eq(worktreeNameFor(''), null);
+});
+
+// ---- 2. needsJunction ----
+
+const REPO = 'C:\\Users\\rocke\\OneDrive\\Desktop\\Cloud Bongos\\cloud-bongos';
+
+test('outside-repo worktree on win32 needs a junction', () => {
+  eq(needsJunction({ wtPath: 'C:\\tmp\\task-9', repoRoot: REPO, platform: 'win32' }), true);
+});
+
+test('inside-repo worktree resolves node_modules by walking up — no junction', () => {
+  eq(needsJunction({ wtPath: REPO + '\\.claude\\worktrees\\task-9', repoRoot: REPO, platform: 'win32' }), false);
+});
+
+test('non-win32 never gets a junction (symlink semantics differ; not the trap)', () => {
+  eq(needsJunction({ wtPath: '/tmp/task-9', repoRoot: '/home/u/repo', platform: 'linux' }), false);
+});
+
+test('a sibling dir that merely shares the repo prefix is still outside', () => {
+  eq(needsJunction({ wtPath: REPO + '-other\\task-9', repoRoot: REPO, platform: 'win32' }), true);
+});
+
+test('path compare is case-insensitive (Windows filesystems are)', () => {
+  eq(needsJunction({ wtPath: REPO.toUpperCase() + '\\.CLAUDE\\WORKTREES\\TASK-9', repoRoot: REPO, platform: 'win32' }), false);
+  eq(needsJunction({ wtPath: 'c:\\TMP\\task-9', repoRoot: REPO, platform: 'win32' }), true);
+});
+
+// ---- 2b. nodeModulesState — the classifier that picks the removal order ----
+// Behavioural, against a real scratch dir: a dir-symlink stands in for the
+// junction (node's lstat reports both as symbolic links, on every platform).
+
+test('nodeModulesState: absent / real-dir / junction classified from disk', () => {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), 'wt-helper-test-'));
+  try {
+    eq(nodeModulesState(path.join(base, 'wt-absent')), 'absent');
+
+    const wtReal = path.join(base, 'wt-real');
+    fs.mkdirSync(path.join(wtReal, 'node_modules'), { recursive: true });
+    eq(nodeModulesState(wtReal), 'real-dir');
+
+    const target = path.join(base, 'shared-nm');
+    fs.mkdirSync(target);
+    fs.writeFileSync(path.join(target, 'canary.txt'), 'x');
+    const wtJct = path.join(base, 'wt-junction');
+    fs.mkdirSync(wtJct);
+    const link = path.join(wtJct, 'node_modules');
+    fs.symlinkSync(target, link, 'junction');
+    eq(nodeModulesState(wtJct), 'junction');
+
+    // Removing the link (the helper's unlink step) must not touch the target.
+    // win32 junctions need rmdir; a posix dir-symlink needs unlink — cover both
+    // so this file passes on Linux CI and the real Windows box alike.
+    try { fs.rmdirSync(link); } catch (_) { fs.unlinkSync(link); }
+    eq(fs.existsSync(path.join(target, 'canary.txt')), true, 'target survives link removal');
+  } finally {
+    fs.rmSync(base, { recursive: true, force: true });
+  }
+});
+
+// ---- 3. removalPlan — junction-first ordering is the whole point ----
+
+test('junction node_modules: unlink FIRST, then git worktree remove', () => {
+  eqArr(removalPlan({ nodeModulesState: 'junction' }), ['unlink-junction', 'git-worktree-remove']);
+});
+
+test('absent node_modules: straight to git worktree remove', () => {
+  eqArr(removalPlan({ nodeModulesState: 'absent' }), ['git-worktree-remove']);
+});
+
+test('a REAL node_modules dir is left for git to refuse — we never rm it', () => {
+  eqArr(removalPlan({ nodeModulesState: 'real-dir' }), ['git-worktree-remove']);
+});
+
+console.log('');
+console.log(`worktree_helper: ${passed} passed, ${failed} failed`);
+process.exit(failed > 0 ? 1 : 0);