@bongos/core 1.19.307 → 1.19.309

package/src/bongos/routes/healthz.js

@@ -4,7 +4,7 @@ const auth = require('../auth');
 module.exports = function buildHealthzRouter() {
   const router = express.Router();
 
-  // rank: public — liveness probe; status.amazonprimea.com hits this anonymously.
+  // rank: public — liveness probe; the status dashboard (status.<apex>) hits this anonymously.
   router.get('/healthz', async (_req, res) => {
     res.json({
       ok: true,

package/src/bongos/routes/public.js

@@ -140,7 +140,7 @@ module.exports = function buildPublicRouter() {
     res.json(clientModules());
   });
 
-  // rank: public — read-only surface for status.amazonprimea.com.
+  // rank: public — read-only surface for the status dashboard (status.<apex>).
   router.get('/public/versions', async (req, res) => {
     // R14 (#2001 / ADR 0119): adopt the shared pagination contract (was unbounded).
     // Small list → fetch + slice; `page` is additive (readers of .versions unchanged).
@@ -378,7 +378,7 @@ module.exports = function buildPublicRouter() {
   // Single-task resolver for "#NNN" deep links. Our docs reference GDS task IDs
   // as bare "#NNN"; read on github.com those collide with GitHub's own PR/issue
   // autolinker (a separate number space) and mis-link, so they are rewritten to
-  // status-dashboard permalinks (status.amazonprimea.com/#/task/N) that resolve
+  // status-dashboard permalinks (status.<apex>/#/task/N) that resolve
   // here. Privacy gate: a full title/summary is exposed ONLY for
   // already-public work (status shipped|confirmed — same surface as
   // /public/recent-shipped). In-flight tasks return status + version with the

package/src/module-api.js

@@ -1041,8 +1041,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.305 with no explicit bump. run 32662000590. (task 1002620)
 //   1.19.307 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.306 with no explicit bump. run 32663876767. (task 1002620)
+//   1.19.308 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.307 with no explicit bump. run 32664559221. (task 1002620)
+//   1.19.309 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.308 with no explicit bump. run 32664868080. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.307'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.309'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/claude_materialize.mjs

@@ -200,6 +200,25 @@ t('buildRebrandRules: partial target (only publicOrigin) → subdomains fall bac
   assert.equal(out, 'acme.example.org', 'no builders.acme.example.org mangling');
 });
 
+// task 1002672: the bare UA brand token (no TLD — none of the host rules match it).
+// A founder-branded hook UA like `amazonprimea-gds-cli/1.0` must neutralize on
+// materialize; a bare founder word in prose (no `-gds` suffix) must NOT be touched.
+t('buildRebrandRules: User-Agent brand token rewritten; bare brand word in prose untouched', () => {
+  const from = { ...OTB, repo: { name: 'amazonprimea' } };
+  const to = { domains: { publicOrigin: 'https://acme.example.org' }, envPrefix: 'ACME', repo: { name: 'acme-city' } };
+  const rules = m.buildRebrandRules(from, to);
+  assert.equal(m.rebrandText(`'User-Agent': 'amazonprimea-gds-cli/1.0'`, rules), `'User-Agent': 'acme-city-gds-cli/1.0'`);
+  assert.equal(m.rebrandText('amazonprimea-gds/1.0', rules), 'acme-city-gds/1.0');
+  assert.equal(m.rebrandText('the amazonprimea style guide', rules), 'the amazonprimea style guide', 'prose token without -gds suffix stays');
+  // envPrefix fallback when repo.name is absent on either side.
+  const rules2 = m.buildRebrandRules(OTB, { domains: { publicOrigin: 'https://acme.example.org' }, envPrefix: 'ACME' });
+  assert.equal(m.rebrandText('otb-gds-cli/1.0', rules2), 'acme-gds-cli/1.0');
+  // No degenerate bare `-gds` rule when a side resolves to nothing.
+  const rules3 = m.buildRebrandRules({ domains: {} }, { domains: { publicOrigin: 'https://acme.example.org' }, envPrefix: 'ACME' });
+  assert.ok(!rules3.some((r) => r.pattern.source === '-gds'), 'no bare -gds rule');
+  assert.equal(m.rebrandText('plain-gds/1.0 text', m.buildRebrandRules({}, {})), 'plain-gds/1.0 text');
+});
+
 t('buildRebrandRules: source === target is an empty ruleset → rebrandText is a no-op', () => {
   assert.equal(m.buildRebrandRules(OTB, OTB).length, 0);
   const s = 'https://amazonprimea.com ~/.config/otb';

package/tests/go_live.mjs

@@ -0,0 +1,362 @@
+// tests/go_live.mjs
+//
+// task 1003189 — go-live is one command.
+//
+// What is worth pinning here is NOT the happy path (that needs a real box) but the
+// REFUSALS. The whole value of this script is that it stops instead of guessing, and
+// every halt below is a trap this pipeline has actually paid for at least once:
+//
+//   UNRELEASED_ON_MAIN      — the ten-day stale-prod incident (blocker 1000097), and
+//                             the publish push-race that leaves main's code carried by
+//                             no release at all.
+//   MARKER_ABSENT           — "the release current when your fix merges usually does
+//                             NOT contain your fix" (ADR 0161 carriers bump on their
+//                             own cadence). Deploying it is a clean go-live that
+//                             changes nothing, and every downstream check agrees.
+//   ALREADY_LIVE / LIVE_AHEAD — a no-op bump reported as success.
+//   DIRTY_CHECKOUT          — CORE_VERSION read from a dirty tree is not what shipped.
+//
+// The shell-safety tests are the other half. This script composes a command that runs
+// as root over ssh, so a config value carrying `$(...)`, a backtick or a `;` must be
+// REFUSED, not quoted-and-hoped-for (the #681 injection class).
+//
+// Run:  node --test tests/go_live.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const G = require('../scripts/gds/go-live.js');
+
+const okTarget = {
+  ssh: 'my-box',
+  instanceDir: '/home/me/inst',
+  service: 'inst.service',
+  healthUrl: 'http://127.0.0.1:3002/healthz',
+  versionUrl: 'http://127.0.0.1:3002/version',
+  deployTimer: 'inst-deploy.timer',
+};
+
+// A divergence result shaped like deploy-divergence.check() returns.
+const div = (over = {}) => ({
+  ok: true, onMain: '1.19.306', live: { coreVersion: '1.19.305' },
+  hasUnreleased: false, unreleased: { count: 0 }, ...over,
+});
+
+// ---------------------------------------------------------------------------
+// Halt matrix
+// ---------------------------------------------------------------------------
+
+test('a clean gap plans with no halts', () => {
+  const p = G.planGoLive({ div: div(), target: okTarget, targetVersion: '1.19.306' });
+  assert.equal(p.halts.length, 0, JSON.stringify(p.halts));
+  assert.equal(p.from, '1.19.305');
+});
+
+test('unreleased commits on main HALT the go-live', () => {
+  const p = G.planGoLive({
+    div: div({ hasUnreleased: true, unreleased: { count: 7 } }),
+    target: okTarget, targetVersion: '1.19.306',
+  });
+  const h = p.halts.find((x) => x.code === 'UNRELEASED_ON_MAIN');
+  assert.ok(h, 'expected UNRELEASED_ON_MAIN');
+  // The detail must name the push-race, or the reader assumes it is only timing.
+  assert.match(h.detail, /publish/i);
+  assert.match(h.detail, /7 commit/);
+});
+
+test('--allow-unreleased downgrades that halt to a note rather than dropping it', () => {
+  const p = G.planGoLive({
+    div: div({ hasUnreleased: true, unreleased: { count: 7 } }),
+    target: okTarget, targetVersion: '1.19.306', allowUnreleased: true,
+  });
+  assert.equal(p.halts.find((x) => x.code === 'UNRELEASED_ON_MAIN'), undefined);
+  const n = p.notes.find((x) => x.code === 'UNRELEASED_ON_MAIN');
+  assert.ok(n && n.downgraded, 'the condition must still be REPORTED, just not fatal');
+});
+
+test('a no-op bump is a halt, not a success', () => {
+  const p = G.planGoLive({
+    div: div({ live: { coreVersion: '1.19.306' } }), target: okTarget, targetVersion: '1.19.306',
+  });
+  assert.ok(p.halts.find((x) => x.code === 'ALREADY_LIVE'));
+});
+
+test('live ahead of the target halts rather than silently downgrading', () => {
+  const p = G.planGoLive({
+    div: div({ live: { coreVersion: '1.19.310' } }), target: okTarget, targetVersion: '1.19.306',
+  });
+  assert.ok(p.halts.find((x) => x.code === 'LIVE_AHEAD'));
+});
+
+test('a dirty core checkout halts — CORE_VERSION there is not what shipped', () => {
+  const p = G.planGoLive({
+    div: div(), target: okTarget, targetVersion: '1.19.306', dirtyCheckout: ' M src/module-api.js',
+  });
+  assert.ok(p.halts.find((x) => x.code === 'DIRTY_CHECKOUT'));
+});
+
+test('an undetermined divergence halts and does not fall through to a bump', () => {
+  const p = G.planGoLive({
+    div: { undetermined: true, reason: 'could not read /version' }, target: okTarget, targetVersion: '1.19.306',
+  });
+  assert.equal(p.halts.length, 1);
+  assert.equal(p.halts[0].code, 'DIVERGENCE_UNDETERMINED');
+  assert.equal(p.from, null, 'must not invent a from-version');
+});
+
+// ---------------------------------------------------------------------------
+// Shell safety — this builds a command that runs as root over ssh
+// ---------------------------------------------------------------------------
+
+test('config values carrying shell metacharacters are REFUSED', () => {
+  for (const evil of [
+    '$(touch /tmp/pwned)',
+    '`id`',
+    'box; rm -rf /',
+    'box && curl evil.example',
+    'box\nrm -rf /',
+    'box|tee /etc/passwd',
+    "box'quote",
+  ]) {
+    const errs = G.validateTarget('t', { ...okTarget, ssh: evil });
+    assert.ok(errs.length > 0, `expected refusal for ${JSON.stringify(evil)}`);
+    assert.match(errs.join(' '), /unsafe in a shell/);
+  }
+});
+
+test('env values and keys are validated too', () => {
+  assert.ok(G.validateTarget('t', { ...okTarget, env: { PGDATABASE: '$(id)' } }).length > 0);
+  assert.ok(G.validateTarget('t', { ...okTarget, env: { 'BAD KEY': 'x' } }).length > 0);
+  assert.equal(G.validateTarget('t', { ...okTarget, env: { PGDATABASE: 'mydb' } }).length, 0);
+});
+
+test('a typo’d field is reported, never silently ignored', () => {
+  // A misspelled healthUrl that is quietly dropped would DISABLE the health gate —
+  // exactly the quiet failure this pipeline keeps being bitten by.
+  const errs = G.validateTarget('t', { ...okTarget, healthURL: 'http://x/healthz' });
+  assert.match(errs.join(' '), /unknown field "healthURL"/);
+});
+
+test('missing required fields are named individually', () => {
+  const errs = G.validateTarget('t', { ssh: 'box' });
+  for (const f of ['instanceDir', 'service', 'healthUrl', 'versionUrl', 'deployTimer']) {
+    assert.match(errs.join(' '), new RegExp(`missing required field "${f}"`));
+  }
+});
+
+test('a valid target passes clean', () => {
+  assert.deepEqual(G.validateTarget('t', okTarget), []);
+});
+
+test('asOwner composes the documented sudo -u … env … shape', () => {
+  const cmd = G.asOwner({ runAs: 'me', env: { PGDATABASE: 'mydb' } }, 'echo hi');
+  assert.match(cmd, /^sudo -u me -H env PGDATABASE=mydb HOME=\/home\/me echo hi$/);
+  // PGDATABASE is load-bearing: without it migrate targets a stale default and
+  // the upgrade auto-rolls-back. It must survive into the command.
+  assert.ok(cmd.includes('PGDATABASE=mydb'));
+});
+
+test('asOwner with no runAs still carries env', () => {
+  assert.equal(G.asOwner({ env: { A: 'b' } }, 'x'), 'env A=b x');
+  assert.equal(G.asOwner({}, 'x'), 'x');
+});
+
+// ---------------------------------------------------------------------------
+// Config loading
+// ---------------------------------------------------------------------------
+
+test('an absent config reports NO_TARGET_CONFIG with a template, not a stack trace', () => {
+  const r = G.loadConfig({ configPath: 'config/definitely-not-here.json', exists: () => false });
+  assert.equal(r.error, 'NO_TARGET_CONFIG');
+  assert.ok(r.template.includes('instanceDir'));
+});
+
+test('a malformed config is reported as malformed, not treated as empty', () => {
+  const r = G.loadConfig({ configPath: 'x.json', exists: () => true, readFile: () => '{ not json' });
+  assert.equal(r.error, 'CONFIG_MALFORMED');
+});
+
+test('a config without targets is malformed rather than a silent no-op', () => {
+  const r = G.loadConfig({ configPath: 'x.json', exists: () => true, readFile: () => '{"defaultTarget":"web"}' });
+  assert.equal(r.error, 'CONFIG_MALFORMED');
+  assert.match(r.detail, /targets/);
+});
+
+test('the shipped template is itself valid config', () => {
+  const r = G.loadConfig({ configPath: 'x.json', exists: () => true, readFile: () => G.CONFIG_TEMPLATE });
+  assert.ok(r.ok, `template did not parse: ${r.detail || ''}`);
+  const sel = G.selectTarget(r.config, undefined);
+  assert.ok(sel.ok, `template target invalid: ${sel.detail || ''}`);
+  assert.equal(sel.name, 'web');
+});
+
+test('an unknown target names what IS available', () => {
+  const r = G.loadConfig({ configPath: 'x.json', exists: () => true, readFile: () => G.CONFIG_TEMPLATE });
+  const sel = G.selectTarget(r.config, 'nope');
+  assert.equal(sel.error, 'UNKNOWN_TARGET');
+  assert.match(sel.detail, /web/);
+});
+
+// ---------------------------------------------------------------------------
+// Markers + version parsing
+// ---------------------------------------------------------------------------
+
+test('parseMarker splits on the FIRST = so a needle may contain one', () => {
+  assert.deepEqual(G.parseMarker('src/a.js=const X = 1'), { path: 'src/a.js', needle: 'const X = 1' });
+});
+
+test('a malformed marker is rejected', () => {
+  assert.ok(G.parseMarker('noequals').error);
+  assert.ok(G.parseMarker('=needle').error);
+  assert.ok(G.parseMarker('path=').error);
+  assert.equal(G.parseMarker(''), null);
+});
+
+test('the version pattern accepts releases and rejects free text', () => {
+  for (const v of ['1.19.306', '1.0.0', '2.3.4-rc.1']) assert.ok(G.SEMVER_RE.test(v), v);
+  for (const v of ['latest', '1.19', 'v1.19.306', '1.19.306; rm -rf /', '']) assert.ok(!G.SEMVER_RE.test(v), v);
+});
+
+// ---------------------------------------------------------------------------
+// Rendering — the report is the product; it must not claim more than it proved
+// ---------------------------------------------------------------------------
+
+test('the plan names every halt it found', () => {
+  const p = G.planGoLive({
+    div: div({ hasUnreleased: true, unreleased: { count: 3 } }),
+    target: okTarget, targetVersion: '1.19.306', dirtyCheckout: ' M x',
+  });
+  const out = G.renderPlan(p, { targetName: 'web' });
+  assert.match(out, /UNRELEASED_ON_MAIN/);
+  assert.match(out, /DIRTY_CHECKOUT/);
+  assert.match(out, /will NOT proceed/);
+});
+
+test('a clean plan tells you the next command', () => {
+  const out = G.renderPlan(G.planGoLive({ div: div(), target: okTarget, targetVersion: '1.19.306' }), { targetName: 'web' });
+  assert.match(out, /--apply/);
+});
+
+test('an uncommitted pin is reported as the durability failure it is', () => {
+  const out = G.renderReport({
+    targetName: 'web', from: '1.19.305', to: '1.19.306', liveVersion: '1.19.306',
+    pinCommitted: false, steps: [],
+  });
+  assert.match(out, /revert this bump/);
+});
+
+// ---------------------------------------------------------------------------
+// The content proof must fail CLOSED
+//
+// This is the bug that got through twice. `grep -c` PRINTS 0 and EXITS 1 on no
+// match, so the obvious `|| echo 0` emitted "0\n0" — which Number() turns into
+// NaN, and NaN === 0 is false, so an ABSENT marker sailed through as no-halt.
+// A content proof that fails open is worse than none: it certifies a release
+// that does not contain the change, and every downstream check agrees.
+// ---------------------------------------------------------------------------
+
+test('a clean count reads as that count', () => {
+  assert.equal(G.parseMarkerHits('3'), 3);
+  assert.equal(G.parseMarkerHits('0'), 0);
+  assert.equal(G.parseMarkerHits(' 12 \n'), 12);
+});
+
+test('a double-printed zero reads as 0 (absent), never NaN', () => {
+  const v = G.parseMarkerHits('0\n0');
+  assert.equal(v, 0);
+  assert.ok(!Number.isNaN(v), 'NaN here is what let an absent marker pass');
+});
+
+test('anything that is not a count is UNCHECKED, never a confident 0', () => {
+  for (const junk of ['', null, undefined, 'PACK_FAILED', 'PACK_FAILED npm error E404', 'tar: not found', 'abc']) {
+    assert.equal(G.parseMarkerHits(junk), 'PACK_FAILED', JSON.stringify(junk));
+  }
+});
+
+test("'could not check' is a distinct halt from 'absent'", () => {
+  // They must never collapse: one says fix your fetch, the other says pick a
+  // later release. Conflating them sends you chasing a version that is not there.
+  assert.ok(G.HALTS.MARKER_UNCHECKED);
+  assert.ok(G.HALTS.MARKER_ABSENT);
+  assert.notEqual(G.HALTS.MARKER_UNCHECKED, G.HALTS.MARKER_ABSENT);
+});
+
+// ---------------------------------------------------------------------------
+// The NPM_TOKEN forwarding trap
+//
+// `bongos upgrade --registry` needs NPM_TOKEN or npm 404s the PRIVATE core and the
+// upgrade auto-rolls-back — which reads as "the release is broken" when it is only
+// "the token never arrived". Sourcing the root-only env file in the OUTER shell is
+// necessary and NOT sufficient: sudo's env_reset drops it, and an explicit
+// `env K=V` list that omits it drops it too. This cost a real failed go-live.
+// ---------------------------------------------------------------------------
+
+test('a forwarded var is passed BY REFERENCE, never by value', () => {
+  const cmd = G.asOwner({ runAs: 'lars', env: { PGDATABASE: 'cb' } }, 'npm install', { forward: ['NPM_TOKEN'] });
+  assert.match(cmd, /NPM_TOKEN="\$NPM_TOKEN"/);
+  // The point of by-reference: the secret's VALUE must never appear in the script text.
+  assert.ok(!cmd.includes('npm_'), 'a token value must never be interpolated here');
+});
+
+test('forwarding is only wired when the target names an env file to source from', () => {
+  // Otherwise K="$K" expands to empty and silently does nothing — a quiet no-op
+  // is worse than not trying.
+  assert.deepEqual(G.npmForward({ npmEnvFile: '/etc/x/npm.env' }), ['NPM_TOKEN']);
+  assert.deepEqual(G.npmForward({}), []);
+});
+
+test('an unvetted variable name is never interpolated', () => {
+  const cmd = G.asOwner({ runAs: 'me' }, 'x', { forward: ['GOOD', 'bad name', '$(id)', '1BAD'] });
+  assert.match(cmd, /GOOD="\$GOOD"/);
+  assert.ok(!cmd.includes('bad name') && !cmd.includes('$(id)') && !cmd.includes('1BAD'));
+});
+
+// ---------------------------------------------------------------------------
+// A failed run must say what the tool said
+// ---------------------------------------------------------------------------
+
+test('the report surfaces the failing tool’s own words', () => {
+  const out = G.renderReport({
+    ok: false, failedAt: 'UPGRADE', targetName: 'web', from: '1.19.305', to: '1.19.306',
+    rolledBack: true, steps: [{ name: 'upgrade', ok: false, detail: 'AUTO-ROLLBACK ran' }],
+    raw: { stdout: 'npm error 404 Not Found - GET https://registry.npmjs.org/@bongos%2fcore\nup to date in 2s', stderr: '' },
+  });
+  assert.match(out, /404 Not Found/, 'the diagnosis must reach the reader');
+  assert.match(out, /not broken/, 'a rollback must be distinguished from an outage');
+});
+
+test('failureExcerpt prefers diagnostic lines over trailing noise', () => {
+  const raw = { stdout: ['ok a', 'ok b', 'npm error code E404', 'up to date in 2s'].join('\n'), stderr: '' };
+  const ex = G.failureExcerpt(raw);
+  assert.ok(ex.some((l) => l.includes('E404')));
+  assert.ok(!ex.some((l) => l === 'ok a'));
+});
+
+test('failureExcerpt is safe on an empty or missing result', () => {
+  assert.deepEqual(G.failureExcerpt(null), []);
+  assert.deepEqual(G.failureExcerpt({ stdout: '', stderr: '' }), []);
+});
+
+// ---------------------------------------------------------------------------
+// A stale origin/main ref silently retargets the whole go-live
+// ---------------------------------------------------------------------------
+
+test('refreshMain reports a failed fetch instead of throwing', () => {
+  const r = G.refreshMain({ run: () => ({ status: 1, stderr: 'fatal: could not read from remote\n' }) });
+  assert.equal(r.ok, false);
+  assert.match(r.reason, /could not read from remote/);
+});
+
+test('refreshMain succeeds quietly', () => {
+  assert.deepEqual(G.refreshMain({ run: () => ({ status: 0, stdout: '', stderr: '' }) }), { ok: true });
+});
+
+test('a spawn error is handled, not thrown', () => {
+  const r = G.refreshMain({ run: () => ({ error: new Error('ENOENT'), status: null }) });
+  assert.equal(r.ok, false);
+});