@bongos/core 1.19.257 → 1.19.258

package/tests/publish_reconciler.mjs

@@ -1547,6 +1547,148 @@ test('1002723 a shipped task appears in the dispositions line as shipped', async
 });
 
 // Drain the microtask queue, then report + exit with the right code.
+
+// ===========================================================================
+// task 1001427 — PHANTOM SHIP: `shipped` must mean the code is on main.
+//
+// The task described two vectors that left a task status=shipped with its PR
+// still open:
+//   (1) the reconciler flipping confirmed->shipped on mergeIfGreen alone,
+//       without confirming the commit is an ancestor of origin/main;
+//   (2) under GRADER_BYPASS_ENABLED, shipped_at stamped at CONFIRM time,
+//       before any merge.
+//
+// Both were closed by later work — the per-task land proof (1313 / 1547 /
+// 1002615 / 1002724) and ADR 0120's move of the payout and the shipped_at stamp
+// to the land. Neither was pinned by a test keyed on THIS invariant, though, so
+// nothing would catch a regression that reopened either one. These do.
+//
+// The invariant, stated once: THE SWEEP CALLS db.shipTask ONLY WHEN THE LAND IS
+// PROVEN. Not when a merge was attempted, not when a merge was reported, not
+// when a PR looks green — proven.
+// ===========================================================================
+
+// EVERY assertion below reads deps._calls.ship, not out.reconciled.
+//
+// That is deliberate and was learned the hard way while writing these: a first
+// draft used a shipTask stub that THREW on any call, on the theory that a
+// phantom ship should be impossible to miss. It is exactly backwards — the sweep
+// isolates per-row failures on purpose (one bad row must not stop the rest), so
+// the throw was swallowed, counted as an error, and `reconciled` stayed 0. The
+// test passed while a phantom ship happened. `reconciled` is a summary of what
+// the sweep BELIEVES it did; the recorded call is what it actually did to the
+// ledger, and only the second one can answer this question.
+
+test('vector 1: a green merge is NOT a land — mergeIfGreen alone never ships', async () => {
+  // The exact 1409/1410 shape: the server merges the PR itself (auto-merge
+  // stall), but the status still reports not-landed and no ancestry proof
+  // exists. A merge ATTEMPT is not evidence the commit reached main.
+  const deps = mkDeps({
+    rows: [{ task_id: 4001, builder_id: 7, worktree_name: 'wt-4001', published_head_sha: NOT_ON_MAIN }],
+    statusByBranch: { 'claude/wt-4001': PENDING },
+    mergeByBranch: { 'claude/wt-4001': { merged_now: true, number: 900 } },
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  await reconciler.runSweep(deps);
+  assert.deepEqual(deps._calls.ship, [],
+    'a merged-now PR with no ancestry proof must never reach db.shipTask');
+  assert.ok(deps._calls.merge.includes('claude/wt-4001'),
+    'the sweep still nudges the merge — it just does not treat the nudge as evidence');
+});
+
+test('vector 1: the SAME row ships once the tip is provably on main', async () => {
+  // The control for the test above. Identical inputs except the ancestry answer,
+  // so the assertion isolates exactly the proof — not some unrelated refusal.
+  const deps = mkDeps({
+    rows: [{ task_id: 4002, builder_id: 7, worktree_name: 'wt-4002', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-4002': PENDING },
+    mergeByBranch: { 'claude/wt-4002': { merged_now: true, number: 901 } },
+    ancestryBySha: { [ON_MAIN]: true },
+  });
+  const out = await reconciler.runSweep(deps);
+  assert.equal(out.reconciled, 1);
+  assert.deepEqual(deps._calls.ship, [{ taskId: 4002, builderId: 7 }]);
+});
+
+test('vector 1: an OPEN PR with no proof strands rather than ships', async () => {
+  // "shipped while the PR was still open" was the reported symptom. A row the
+  // sweep cannot prove must leave the ledger alone and be counted unprovable.
+  const deps = mkDeps({
+    rows: [{ task_id: 4003, builder_id: 7, worktree_name: 'wt-4003', published_head_sha: NOT_ON_MAIN }],
+    statusByBranch: { 'claude/wt-4003': PENDING },
+    ancestryBySha: { [NOT_ON_MAIN]: false },
+  });
+  const out = await reconciler.runSweep(deps);
+  assert.deepEqual(deps._calls.ship, [], 'an open PR with no proof must never reach db.shipTask');
+  assert.ok((out.unprovable ?? 0) >= 1, 'an unprovable row must be COUNTED, not silently skipped (blocker 47)');
+});
+
+test('vector 1: a transient proof error never resolves to "landed"', async () => {
+  // The compare API throwing is indistinguishable from "no proof yet", and the
+  // fail direction must be to wait. An exception that fell through to a ship
+  // would be the phantom-ship bug wearing an error handler.
+  const deps = mkDeps({
+    rows: [{ task_id: 4004, builder_id: 7, worktree_name: 'wt-4004', published_head_sha: ON_MAIN }],
+    statusByBranch: { 'claude/wt-4004': PENDING },
+    ancestryBySha: { [ON_MAIN]: new Error('compare API 502') },
+  });
+  await reconciler.runSweep(deps);
+  assert.deepEqual(deps._calls.ship, [],
+    'a throwing proof is indistinguishable from no proof — it must wait, never ship');
+});
+
+test('vector 2: shipped_at is stamped ONLY by shipTask, and shipTask requires confirmed', async () => {
+  // ADR 0120 moved the payout and the stamp to the land. The structural claim —
+  // that no other write path can stamp shipped_at on a task, and that the one
+  // that can refuses anything not already confirmed — is what closes the
+  // grader-bypass vector, so it is asserted against the SOURCE rather than
+  // re-argued in prose.
+  const fs = await import('node:fs');
+  const url = await import('node:url');
+  const path = await import('node:path');
+  const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
+  const dbSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/db.js'), 'utf8');
+
+  // Every statement that writes shipped_at, ignoring SELECT projections and comments.
+  const writes = [...dbSrc.matchAll(/shipped_at\s*=\s*now\(\)/g)];
+  assert.equal(writes.length, 1,
+    `shipped_at is written in ${writes.length} places — a second stamp site is how the grader-bypass vector reopens`);
+
+  // …and that one site is guarded on the confirmed state.
+  const stampIdx = dbSrc.indexOf('shipped_at = now()');
+  const window = dbSrc.slice(stampIdx, stampIdx + 500);
+  assert.match(window, /WHERE id = \$1 AND status = 'confirmed'/,
+    'the stamp must refuse any task not already confirmed — that is what stops a confirm-time ship');
+});
+
+test('vector 2: the grader-bypass confirm path lands at CONFIRMED, never shipped', async () => {
+  // The bypass relaxes WHO may confirm and whether a panel ran. It must not
+  // change WHERE the task lands: the route calls confirmTask, and only the
+  // proven-land path may call shipTask.
+  const fs = await import('node:fs');
+  const url = await import('node:url');
+  const path = await import('node:path');
+  const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
+  const routeSrc = fs.readFileSync(path.join(ROOT, 'modules/lifecycle/routes/tasks.js'), 'utf8');
+
+  // Anchor on the ROUTE, not on `graderBypassEnabled()`. That identifier appears
+  // three times — the function definition, a rank-gate relaxation, and the
+  // handler's log line — so an indexOf anchor measures whichever comes first and
+  // then reads the wrong window. Slice the confirm handler itself: from its
+  // registration to the next route registration.
+  const confirmIdx = routeSrc.indexOf("router.post('/tasks/:id/confirm'");
+  assert.ok(confirmIdx > -1, 'the confirm route must exist — update this test if it moved');
+  const afterIdx = routeSrc.indexOf('router.', confirmIdx + 20);
+  const handler = routeSrc.slice(confirmIdx, afterIdx > -1 ? afterIdx : confirmIdx + 3000);
+
+  assert.match(handler, /db\.confirmTask\(/,
+    'the confirm route must land the task at CONFIRMED via confirmTask');
+  assert.ok(!/db\.shipTask\(/.test(handler),
+    'a shipTask call on the confirm path IS the grader-bypass phantom-ship vector, reopened');
+  assert.ok(!/shipped_at/.test(handler),
+    'the confirm path must never touch shipped_at — that stamp belongs to the proven land');
+});
+
 setTimeout(() => {
   console.log(`\npublish reconciler (task 1134 + 1915) tests: ${passed} passed, ${failed} failed`);
   process.exit(failed > 0 ? 1 : 0);

package/tests/redteam_patrol.mjs

@@ -0,0 +1,67 @@
+// tests/redteam_patrol.mjs — the patrol's pure helpers (task 1003128, goal 1000076).
+// Hermetic: parsing, severity mapping, pin detection, report assembly. The live
+// scans (gitleaks/npm/network) and the --canary end-to-end pipe are exercised by
+// hand + the weekly cron, never in the DB-free suite.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const p = require(path.join(ROOT, 'scripts', 'gds', 'redteam-patrol.js'));
+
+test('parseGitleaksReport maps rows to high-severity findings; junk → []', () => {
+  const rows = JSON.stringify([{ RuleID: 'aws-key', File: 'x.js', Commit: 'abcdef1234567890' }]);
+  const f = p.parseGitleaksReport(rows);
+  assert.equal(f.length, 1);
+  assert.equal(f[0].severity, 'high');
+  assert.match(f[0].item, /aws-key in x\.js @ abcdef12/);
+  assert.deepEqual(p.parseGitleaksReport('not json'), []);
+  assert.deepEqual(p.parseGitleaksReport('{}'), []);
+});
+
+test('severity mapping: npm "moderate" → "medium"; unknowns floor to low; order respected', () => {
+  assert.equal(p.mapSeverity('moderate'), 'medium');
+  assert.equal(p.mapSeverity('HIGH'), 'high');
+  assert.equal(p.mapSeverity('weird'), 'low');
+  assert.equal(p.maxSeverity([{ severity: 'low' }, { severity: 'high' }, { severity: 'medium' }]), 'high');
+  assert.equal(p.maxSeverity([{ severity: 'low' }]), 'low');
+});
+
+test('unpinnedUses flags tags/branches, accepts 40-hex SHAs, skips local + docker refs', () => {
+  const yaml = [
+    '      - uses: actions/checkout@v4',
+    '      - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0',
+    '      - uses: ./.github/actions/local',
+    '        uses: actions/cache@main',
+  ].join('\n');
+  const bad = p.unpinnedUses(yaml);
+  assert.ok(bad.includes('actions/checkout@v4'));
+  assert.ok(bad.includes('actions/cache@main'));
+  assert.ok(!bad.some((r) => r.includes('setup-node')), 'a 40-hex SHA pin is accepted');
+  assert.ok(!bad.some((r) => r.includes('local')), 'local ./ ref skipped');
+});
+
+test('ageDays computes against a fixed now; bad dates → null', () => {
+  const now = Date.parse('2026-08-19T00:00:00Z');
+  assert.equal(Math.round(p.ageDays('2026-08-12T00:00:00Z', now)), 7);
+  assert.equal(p.ageDays('not-a-date', now), null);
+});
+
+test('lockedVersion reads the npm v3 lock shape', () => {
+  const lock = { packages: { 'node_modules/undici': { version: '6.27.0' } } };
+  assert.equal(p.lockedVersion(lock, 'undici'), '6.27.0');
+  assert.equal(p.lockedVersion(lock, 'absent'), undefined);
+});
+
+test('buildClassReport caps the item list, counts the remainder, and takes max severity', () => {
+  const findings = Array.from({ length: 13 }, (_, i) => ({ severity: i === 0 ? 'high' : 'low', item: `f${i}` }));
+  const r = p.buildClassReport('dependency-review', findings, ['a note']);
+  assert.equal(r.severity, 'high');
+  assert.equal(r.target, 'redteam-patrol/dependency-review');
+  assert.match(r.title, /13 finding/);
+  assert.match(r.repro_steps_md, /…and 3 more/);
+  assert.match(r.repro_steps_md, /Notes:/);
+});