@bongos/core 1.19.319 → 1.19.320

package/scripts/status-probe.mjs

@@ -34,10 +34,30 @@ import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
+import { createRequire } from 'node:module';
+
+// Target + User-Agent come from the INSTANCE's own branding pack (task 1002757).
+// Both were founder literals, so another instance's uptime CI probed the founder
+// host and reported ITS health as their own. No literal fallback for the target:
+// a probe with nothing to probe must say so, not silently watch someone else.
+const requireCjs = createRequire(import.meta.url);
+const brandingSafe = () => { try { return requireCjs('../src/branding'); } catch { return null; } };
+const defaultTarget = () => {
+  const b = brandingSafe();
+  try {
+    const origin = b && b.branding().domains?.publicOrigin;
+    return origin ? `${String(origin).replace(/\/+$/, '')}/healthz` : null;
+  } catch { return null; }
+};
+const defaultUserAgent = () => {
+  const b = brandingSafe();
+  try { return `${b.userAgent().split('/')[0]}-status-probe/1.0 (+github-actions)`; }
+  catch { return 'cloud-bongos-status-probe/1.0 (+github-actions)'; }
+};
 
 const DEFAULTS = {
   dir: '.',
-  target: 'https://amazonprimea.com/healthz',
+  target: defaultTarget(),
   attempts: 3,
   'timeout-ms': 15000,
   'gap-ms': 10000,
@@ -70,7 +90,7 @@ async function attempt(target, timeoutMs) {
     const res = await fetch(target, {
       signal: ac.signal,
       redirect: 'manual', // a 200 must come from the origin, not a redirect chain
-      headers: { 'User-Agent': 'amazonprimea-status-probe/1.0 (+github-actions)' },
+      headers: { 'User-Agent': defaultUserAgent() },
     });
     return { ok: res.status === 200, httpStatus: res.status, latencyMs: Date.now() - start };
   } catch (_) {
@@ -125,6 +145,14 @@ async function main() {
   const historyFile = path.join(dir, 'history.jsonl');
   const statusFile = path.join(dir, 'status.json');
 
+  // No target means the branding pack names no public origin and none was passed
+  // (task 1002757 — there is deliberately no founder-host fallback to probe).
+  if (!args.target) {
+    console.error('status-probe: no target. Pass --target <url>, or give this instance a domains.publicOrigin in config/branding.json.');
+    process.exitCode = 2;
+    return;
+  }
+
   const result = await probe({
     target: args.target,
     attempts: args.attempts,

package/src/module-api.js

@@ -1065,8 +1065,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.317 with no explicit bump. run 32669798745. (task 1002620)
 //   1.19.319 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.318 with no explicit bump. run 32670195088. (task 1002620)
+//   1.19.320 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.319 with no explicit bump. run 32678147546. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.319'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.320'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/helpers.mjs

@@ -142,3 +142,16 @@ export function lifecycleDbSource(modulesDir = path.join(ROOT, 'modules')) {
     .sort();
   return files.map((f) => fs.readFileSync(path.join(dir, f), 'utf8')).join('\n');
 }
+
+// shipCliSource — the ship CLI as one source string.
+//
+// The companion to lifecycleDbSource above, for the same reason: task 1003205
+// carved the 4,613-line scripts/gds/ship.js into ship.js (a re-export facade +
+// the CLI entry point) plus ship-*.js phase modules. Tests that assert "the ship
+// CLI does X" by regexing its source mean the CLI as a whole, not one file.
+export function shipCliSource(scriptsDir = path.join(ROOT, 'scripts', 'gds')) {
+  const files = fs.readdirSync(scriptsDir)
+    .filter((f) => f === 'ship.js' || (f.startsWith('ship-') && f.endsWith('.js')))
+    .sort();
+  return files.map((f) => fs.readFileSync(path.join(scriptsDir, f), 'utf8')).join('\n');
+}

package/tests/provision.mjs

@@ -144,10 +144,16 @@ t('buildCorePinRefreshCommit (the commit step): git sequence, token-URL push, an
     root: '/srv/bongos/spike-harbor', fromVersion: '1.19.2', toVersion: '1.19.196',
     repo, ownerToken: 'ghs_xxx', credFile: '/tmp/cred',
   });
+  // task 1002757: the bot email is RESOLVED (env → instance apex → neutral
+  // .invalid), never the hub's own address hardcoded — a self-hosted provisioner
+  // must not attribute its commits to the hub. Assert against the resolver so
+  // this pins the behaviour, not one instance's literal.
   assert.deepEqual(withTok.config, [
     'git -C /srv/bongos/spike-harbor config user.name "Cloud Bongos"',
-    'git -C /srv/bongos/spike-harbor config user.email "bot@cloudbongos.com"',
+    `git -C /srv/bongos/spike-harbor config user.email "${P.provisionerBotEmail()}"`,
   ]);
+  assert.equal(P.provisionerBotEmail({ PROVISION_BOT_EMAIL: 'ops@acme.test' }), 'ops@acme.test', 'env override wins');
+  assert.doesNotMatch(P.provisionerBotEmail({}), /amazonprimea/i, 'never a founder-host address');
   assert.equal(withTok.add, 'git -C /srv/bongos/spike-harbor add -A');
   assert.match(withTok.commit, /@bongos\/core 1\.19\.2 -> 1\.19\.196 \(task 1003050\)/);
   assert.match(withTok.push, /store --file=\/tmp\/cred.*x-access-token@github\.com\/jaxri\/spike-harbor\.git HEAD:main/);

package/tests/regrade_eligibility.mjs

@@ -198,5 +198,48 @@ test('buildGradePayload confidence defaults to null when signals omit it', () =>
   assert.equal(body.subagent_output.confidence, null);
 });
 
+// ---------- task 1003221: don't prescribe a command the caller can't run ----------
+//
+// The 'confirmed' answer hardcoded "run /merge-mode", which lands by pushing main
+// via push-main.js (SEC #863 / ADR 0043) and needs an authenticated gh plus a main
+// checkout. A server-mediated builder (pushVia()==='server' — every dev box) has
+// neither, so the advice was unreachable by construction. It cost a real builder
+// 163 minutes on 2026-08-21. strandNextStep already had the right wording for both
+// modes; these pin that the two modes now diverge and that neither regresses.
+
+test('1003221 a server-mediated builder is NOT told to run /merge-mode', () => {
+  const v = evaluateRegradeEligibility({
+    task: { id: 601, title: 't', status: 'confirmed' },
+    lastClaim: null,
+    builder: { id: 7, rank: 'archon' },
+    pushMode: 'server',
+  });
+  assert.equal(v.ok, false);
+  assert.match(v.reason, /already 'confirmed'/, 'still says why a re-grade is refused');
+  assert.doesNotMatch(v.reason, /run \/merge-mode/, 'must not prescribe the unreachable command');
+  assert.match(v.reason, /ship\.js 601/, 'names the command that DOES work here');
+  assert.match(v.reason, /NOT available here/, 'and says plainly why /merge-mode is out');
+});
+
+test('1003221 a laptop builder still gets /merge-mode (no regression)', () => {
+  const v = evaluateRegradeEligibility({
+    task: { id: 602, title: 't', status: 'confirmed' },
+    lastClaim: null,
+    builder: { id: 7, rank: 'archon' },
+    pushMode: 'local',
+  });
+  assert.match(v.reason, /\/merge-mode/, 'the laptop path keeps its working advice');
+  assert.match(v.reason, /ship\.js 602/, 'and still offers the resume alternative');
+});
+
+test('1003221 omitting pushMode keeps the historical wording (backward compatible)', () => {
+  const v = evaluateRegradeEligibility({
+    task: { id: 603, title: 't', status: 'confirmed' },
+    lastClaim: null,
+    builder: { id: 7, rank: 'archon' },
+  });
+  assert.match(v.reason, /\/merge-mode/, 'an old caller/test that passes no pushMode is unchanged');
+});
+
 console.log(`\n--regrade eligibility (#678) tests: ${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);

package/tests/ship_assurance.mjs

@@ -33,6 +33,7 @@ import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
 import url from 'node:url';
+import { shipCliSource } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)));
@@ -178,8 +179,9 @@ await t('the CLI carries the declaration through its deliberate-empty path', ()
   // Without this, the gate would refuse exactly the --db-only / --allow-empty
   // flow CLAUDE.md calls a supported shape — turning a correctness fix into a
   // regression for the builders who rely on it.
-  const src = read('scripts/gds/ship.js');
-  assert.match(src, /no_artifact:\s*true/, 'ship.js must send the declaration on an empty land');
+  // task 1003205: the ship CLI is ship.js + ship-*.js now — read the family.
+  const src = shipCliSource();
+  assert.match(src, /no_artifact:\s*true/, 'the ship CLI must send the declaration on an empty land');
   assert.match(src, /landed\(\{ noArtifact: true/,
     'and the deliberate-empty land sites must mark themselves as such');
 });

package/tests/ship_publish_error.mjs

@@ -115,5 +115,48 @@ test('the "non-fast-forward" wording triggers the same hint through the envelope
 });
 
 console.log('');
+// ---------- task 1003221: a non-fast-forward has TWO causes ----------
+//
+// The hint used to give ONE diagnosis — "the server already moved <branch>" — and
+// prescribe `reset onto origin/<branch>`. That is right when the server is ahead
+// and DESTRUCTIVE when it is not: a builder who rebased or amended an
+// already-published branch would be told to throw away the commits they just made.
+// That was the real 2026-08-21 case. opts.localHistoryRewritten discriminates;
+// null (git could not tell) must keep the original wording rather than guess.
+const NFF = {
+  error: { code: 'publish_failed', message: 'publish_failed',
+           details: { step: 'push', reason: '! [rejected] main -> main (non-fast-forward)' } },
+};
+
+test('1003221 rewritten local history is told to MERGE, never reset', () => {
+  const out = ship.formatPublishFailure(NFF, 500, 'claude/x', { localHistoryRewritten: true });
+  assert.match(out, /APPEND-ONLY/);
+  assert.match(out, /git merge origin\/claude\/x/, 'names the merge that actually recovers');
+  assert.match(out, /Do NOT reset or re-rebase/, 'and forbids the lossy move explicitly');
+  assert.doesNotMatch(out, /reset onto/, 'must not carry the server-ahead remedy');
+});
+
+test('1003221 a server-ahead non-fast-forward keeps the reset remedy', () => {
+  const out = ship.formatPublishFailure(NFF, 500, 'claude/x', { localHistoryRewritten: false });
+  assert.match(out, /the server already moved claude\/x/);
+  assert.match(out, /reset onto origin\/claude\/x/);
+  assert.doesNotMatch(out, /APPEND-ONLY/);
+});
+
+test('1003221 an UNKNOWN cause (null) does not invent a diagnosis', () => {
+  const unknown = ship.formatPublishFailure(NFF, 500, 'claude/x', { localHistoryRewritten: null });
+  const legacy = ship.formatPublishFailure(NFF, 500, 'claude/x');
+  assert.equal(unknown, legacy, 'null must be byte-identical to the pre-fix wording');
+  assert.match(unknown, /reset onto/);
+});
+
+test('1003221 a non-NFF failure gains no hint from either flag', () => {
+  const other = { error: { code: 'publish_failed', details: { step: 'bundle', reason: 'bad object' } } };
+  for (const v of [true, false, null]) {
+    const out = ship.formatPublishFailure(other, 500, 'claude/x', { localHistoryRewritten: v });
+    assert.doesNotMatch(out, /APPEND-ONLY|reset onto/, `flag ${v} must not add a remedy to an unrelated failure`);
+  }
+});
+
 console.log(`ship_publish_error: ${passed} passed, ${failed} failed`);
 process.exit(failed === 0 ? 0 : 1);