@bongos/core 1.19.326 → 1.19.328

package/src/module-api.js

@@ -1079,8 +1079,12 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.324 with no explicit bump. run 32738897943. (task 1002620)
 //   1.19.326 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.325 with no explicit bump. run 32777788032. (task 1002620)
+//   1.19.327 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.326 with no explicit bump. run 32782353048. (task 1002620)
+//   1.19.328 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.327 with no explicit bump. run 32786284063. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.326'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.328'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/projects_hub_pre_uat.mjs

@@ -0,0 +1,223 @@
+// tests/projects_hub_pre_uat.mjs — the pre-UAT tweak pass over the project hub
+// (task 1003232, goal 1000058). Each block pins one thing the 2026-08-24 review
+// found a stranger would be misled by, so a later edit cannot quietly bring it
+// back. Static analysis on purpose, like tests/projects_hub.mjs: the claims are
+// about the FILE (copy, gates, order), not about a booted server.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+// LF-normalised: a Windows checkout (core.autocrlf) hands back CRLF, and the
+// anchored regexes below reason about line ends
+const HUB = fs.readFileSync(path.join(ROOT, 'public-landing', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const COSMOS = fs.readFileSync(path.join(ROOT, 'public-landing', 'assets', 'cosmos.css'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+
+// a function's text runs from its declaration to the next declaration in the
+// file (none of the functions pinned here nest a named function of their own)
+const fn = (name) => {
+  const start = SCRIPT.indexOf(`function ${name}(`);
+  assert.ok(start >= 0, `${name}() must exist`);
+  const rest = SCRIPT.slice(start + 1);
+  const next = rest.search(/\n\s*function \w+\(/);
+  return next < 0 ? rest : rest.slice(0, next);
+};
+
+/* ── the gate says why GitHub will ask for repository access ── */
+test('the gate explains the repo scope BEFORE GitHub does — on the path every founder takes', () => {
+  const gate = (HUB.match(/<section class="panel" id="panel-gate"[\s\S]*?<\/section>/) || [''])[0];
+  assert.ok(gate, '#panel-gate exists');
+  const signin = gate.indexOf('id="wizSignin"');
+  const note = gate.indexOf('id="wizScopeNote"');
+  const agpl = gate.indexOf('agpl-3.0');
+  assert.ok(signin > 0 && note > signin && agpl > note, 'the scope note sits between the sign-in button and the AGPL line');
+  assert.match(gate, /all<\/em> your repositories/, 'it names GitHub’s own wording');
+  assert.match(gate, /Nothing else is touched/, 'and bounds what the access is used for');
+  assert.doesNotMatch(gate, /public_repo/, 'the stale scope comment is gone (ADR 0155 widened it to repo)');
+});
+
+/* ── the address row tells the truth in every state ── */
+test('addressRow branches by state before it trusts the domain — torn down and snagged never "answer once live"', () => {
+  const body = fn('addressRow');
+  const stateFirst = body.indexOf("inst.status === 'torn_down' || inst.status === 'tearing_down'");
+  const domainTest = body.indexOf('if (inst.domain)');
+  assert.ok(stateFirst >= 0 && stateFirst < domainTest, 'the torn-down test comes before the domain test');
+  assert.match(body, /stays reserved for this project — it shows an error page until you bring it back/, 'torn down: the address is reserved, not answering');
+  assert.match(body, /if \(inst\.status === 'error'\) return 'Address <code>/, 'snagged has its own line');
+  assert.match(body, /nothing is answering there yet/);
+  assert.equal((body.match(/— it answers there once the instance is live\.'/g) || []).length, 1, 'the standup promise survives only for queued / standing-up');
+  assert.match(body, /We keep checking every few minutes/, 'an unreachable project says what the platform is doing');
+});
+
+test('"live" is ONE rule — chip, orb and address row all read freshUp()', () => {
+  assert.match(SCRIPT, /function freshUp\(inst\)/);
+  assert.match(fn('chipFor'), /freshUp\(inst\)/, 'the chip');
+  assert.match(fn('orbFor'), /!freshUp\(inst\)/, 'the orb');
+  const addr = fn('addressRow');
+  assert.match(addr, /if \(freshUp\(inst\)\) return 'Answering at '/, 'the address row claims "Answering" only when fresh');
+  assert.match(addr, /last answered/, 'an up-but-stale probe is dated, not asserted');
+  assert.doesNotMatch(addr, /if \(inst\.last_verified_up\) return 'Answering/, 'the bare truthy test is gone');
+});
+
+/* ── the queued strip is honest about which stage is current ── */
+test('a queued standup lights "Request filed", not "Standing it up" — on the card and on the done panel', () => {
+  const strip = fn('stripFor');
+  assert.match(strip, /if \(s === 'requested'\) \{[\s\S]*?stripMarkup\(revive \? 'revive' : 'standup', 0, 0,/, 'card: requested → stage 0 current');
+  assert.match(strip, /if \(s === 'provisioning'\) \{[\s\S]*?stripMarkup\(revive \? 'revive' : 'standup', 1, 1,/, 'card: provisioning → stage 1 current');
+  assert.match(SCRIPT, /if \(s === 'requested'\) \{\n\s*el\.innerHTML = progressMarkup\(0, 0,/, 'done panel: requested → stage 0 current');
+  assert.doesNotMatch(SCRIPT, /Waiting for a runner/, '"runner" is operator vocabulary');
+  assert.doesNotMatch(SCRIPT, /a runner picks it up/, '"runner" is operator vocabulary (retry message)');
+});
+
+/* ── the done panel never lies at the end of its watch, and never opens a door early ── */
+test('the 33-minute hand-off keeps a snag honest and keeps its flow', () => {
+  assert.match(SCRIPT, /if \(ticks > 400\) \{[\s\S]*?if \(live\.instStatus !== 'error'\) \{[\s\S]*?Still working[\s\S]*?watchFlow\);/, 'no "still building" over an error; the strip keeps its vocabulary');
+  assert.doesNotMatch(SCRIPT, /Still building — this tab will stop watching now/);
+  assert.match(SCRIPT, /progressMarkup\(1, 1, m\.slice\(5\), 'isErr', watchFlow\)/, 'the session-expiry message keeps its flow too');
+});
+
+test('First sign-in and Enter your builders hall unlock only when the project answers AND sign-in is wired', () => {
+  const first = fn('renderStepFirstSignIn');
+  const hall = fn('renderStepEnterHall');
+  for (const [name, body] of [['first-sign-in', first], ['enter-hall', hall]]) {
+    assert.match(body, /live\.instStatus !== 'active' \|\| live\.manifest !== 'done'/, `${name} gates on both`);
+    assert.match(body, /class="slocked"/, `${name} has a locked rendering`);
+  }
+  assert.match(first, /Unlocks once your project is answering and sign-in above is wired/);
+});
+
+test('the domainless build is standing, not "Live"', () => {
+  assert.match(SCRIPT, /progressMarkup\(-1, 2,\n\s*'The build finished — your project is standing, but it has no address yet/, 'two stages done, third unlit');
+  assert.doesNotMatch(SCRIPT, /has no address yet, so sign-in can’t be wired up[^']*', 'isLive'/, 'no green skin on a project that answers nowhere');
+});
+
+test('the fallback checklist carries every human step the canonical plan has', () => {
+  assert.match(SCRIPT, /FALLBACK_HUMAN_KEYS = \['github-repo', 'oauth-app', 'device-flow', 'app-install', 'first-sign-in', 'enter-hall'\]/);
+});
+
+/* ── the manifest leg: acknowledges GitHub, offers a way out, survives a reload ── */
+test('the manifest step acknowledges code_received, offers a restart after a stall, and rides the CREATED record', () => {
+  assert.match(SCRIPT, /if \(live\.manifest === 'code_received'\)/, 'GitHub’s half is acknowledged');
+  assert.match(SCRIPT, /GitHub’s part is done/);
+  assert.match(SCRIPT, /manifestStale \? '<button type="button" class="linklike" data-action="manifest-start">/, 'a stalled wait gets a restart door');
+  assert.match(SCRIPT, /\(Date\.now\(\) - manifestStartedAt\) > 90000/, 'after ~90 seconds');
+  assert.match(SCRIPT, /function rememberManifest\(stateToken, status, appSlug\)/);
+  assert.match(SCRIPT, /rememberManifest\(d\.state, 'pending'\)/, 'the token is remembered when GitHub is opened');
+  assert.match(SCRIPT, /if \(created\.manifest\) \{ live\.manifest = created\.manifest; live\.appSlug = created\.app_slug \|\| null; \}/, 'enter() re-seeds the step');
+  assert.match(SCRIPT, /manifestState = created\.manifest_state; manifestPending = true;/, 'and resumes the poll');
+});
+
+test('"Start another project" asks before abandoning a standup still being watched', () => {
+  assert.match(SCRIPT, /if \(instanceId && pollTimer && !confirm\(/);
+});
+
+/* ── every recovery sign-in from the wizard keeps the repo scope ── */
+test('the wizard’s 401 recoveries keep the repo scope they already granted', () => {
+  const plain = (SCRIPT.match(/\/auth\/web\/start\?return=\/projects%3Fview%3Dnew'\)/g) || []).length;
+  assert.equal(plain, 0, 'no wizard redirect drops the scope');
+  assert.ok((SCRIPT.match(/\/auth\/web\/start\?return=\/projects%3Fview%3Dnew&repos=1'\); throw new Error\('signing in'\)/g) || []).length >= 2, 'create + manifest');
+  assert.match(SCRIPT, /projects%3Fview%3Dnew&amp;repos=1">sign in again<\/a> to keep watching/, 'the progress watch');
+  assert.match(fn('signInAgain'), /currentView === 'new' \? '\/projects%3Fview%3Dnew&amp;repos=1'/, 'signInAgain from the wizard');
+});
+
+test('a resumed draft past Home still probes repo access before Create', () => {
+  assert.match(SCRIPT, /else if \(step > 3 && step < 6 && authKnown && repoAccess === null\) ensureRepoAccess\(\);/);
+});
+
+test('a half-typed custom domain says why Next is dead; a taken handle silences the format cheer', () => {
+  assert.match(SCRIPT, /That doesn’t look like a domain yet \(e\.g\. mercury\.example\.com\) — fix it, or clear the field to use the address above\./);
+  assert.match(SCRIPT, /if \(avail === 'taken' \|\| avail === 'yours' \|\| avail === 'reserved'\) \{ var hs = \$\('h-slug'\); hs\.innerHTML = '&nbsp;'; hs\.className = 'hint'; \}/);
+});
+
+/* ── owner voice ── */
+test('no wall-clock promises, no operator vocabulary on the stranger’s path', () => {
+  assert.doesNotMatch(HUB, /about five minutes/, 'the empty state');
+  assert.doesNotMatch(HUB, /a runner does the real work/, 'the mine fine print');
+  assert.doesNotMatch(SCRIPT, /pinned platform core/, 'the review Shape row');
+  assert.match(SCRIPT, /\['Shape', 'Its own server, running the platform’s current release'\]/);
+  assert.doesNotMatch(HUB, /\/new-project<\/code> assistant/, 'the done panel’s closing line');
+  assert.match(HUB, /Sign-in switches on after the GitHub steps|switch sign-in on/, 'the address step does not promise sign-in "just works"');
+  assert.doesNotMatch(HUB, /Sign-in, sharing, everything just works/);
+});
+
+/* ── the manage view carries the card’s story, and its working sections come first ── */
+test('the manage view renders the strip, the snag and the doors from the same helpers the card uses', () => {
+  for (const id of ['mStrip', 'mErr', 'mMsg', 'mActs', 'mTitle']) assert.match(HUB, new RegExp(`id="${id}"`), `#${id} is real markup`);
+  const rm = fn('renderManage');
+  assert.match(rm, /\$\('mStrip'\)\.innerHTML = stripFor\(inst\)/);
+  assert.match(rm, /errMarkup\(inst\)/);
+  assert.match(rm, /canRetry\(inst\)[\s\S]*?data-m-retry/);
+  assert.match(rm, /canRevive\(inst\)[\s\S]*?data-m-revive/);
+  assert.match(rm, /Open site →/);
+  assert.match(rm, /document\.title = \(inst\.slug \? inst\.slug \+ ' — ' : ''\) \+ BASE_TITLE/, 'the tab names the project');
+  assert.match(SCRIPT, /function mReProvision\(verb\)/);
+});
+
+test('an in-flight project is watched on its own page; a settled one keeps the C8 rule', () => {
+  const tick = fn('manageWatchTick');
+  assert.match(tick, /document\.hidden \|\| currentView !== 'manage' \|\| !manageInst \|\| !shouldWatch\(manageInst\)/, 'guarded on stage + in flight');
+  assert.match(tick, /loadManage\(true, true\)/, 'quiet, and without re-asking GitHub');
+  assert.match(SCRIPT, /if \(!keepRepo\) loadRepoVisibility\(inst\);/, 'the GitHub read stays on entry + tab return');
+  assert.match(SCRIPT, /setInterval\(manageWatchTick, 5000\)/);
+});
+
+test('working sections come before the not-wired ones on manage, and the placeholders state today’s behavior', () => {
+  const repo = HUB.indexOf('id="mRepoVisibility"');
+  const vis = HUB.indexOf('id="mVisibility"');
+  const join = HUB.indexOf('id="mJoinability"');
+  const del = HUB.indexOf('id="mDelete"');
+  assert.ok(repo > 0 && repo < vis && vis < join && join < del, 'repo visibility → who can see it → how people join → delete');
+  assert.match(HUB, /For now, every project’s pages are open to everyone\./);
+  assert.match(HUB, /For now, people apply to join and you invite them\./);
+  assert.doesNotMatch(HUB, /It lands in one of the next updates/);
+});
+
+test('a live private-repo project is not told it is broken', () => {
+  const rv = fn('renderRepoVis');
+  assert.match(rv, /var snagged = !!\(manageInst && \(manageInst\.status === 'error' \|\| manageInst\.error_note\)\)/);
+  assert.match(rv, /snagged\n\s*\? '<div class="projMsg err">/, 'red only on a snag');
+  assert.match(rv, /Nothing to do here\./, 'a healthy project reads calm');
+  assert.match(rv, /class="btn small ghost" data-repo-public/, 'Make it public is no longer the loudest control');
+  assert.doesNotMatch(rv, /retry the standup from your projects page/, 'no pointer at a button that does not exist');
+});
+
+/* ── the shell: Back works, the pill stays lit, phones and laptops keep the header on one row ── */
+test('Back moves between views — a deliberate view change is a history entry', () => {
+  assert.match(SCRIPT, /history\.pushState\(null, '', '\?view=' \+ v \+ idPart\)/);
+  assert.match(SCRIPT, /history\.replaceState\(null, '', '\?view=' \+ v \+ idPart\)/, 'boot + background settles still rewrite in place');
+  assert.match(SCRIPT, /window\.addEventListener\('popstate', function \(\) \{ setView\(viewFromUrl\(\)\); \}\)/);
+  assert.match(SCRIPT, /else if \(v === 'manage' && a\.dataset\.nav === 'mine'\) a\.setAttribute\('aria-current', 'page'\)/, 'manage keeps the Your-projects pill lit');
+});
+
+test('the signed-in header shrinks inside a phone and stays one row on a laptop', () => {
+  assert.match(COSMOS, /@media \(max-width:1079px\)\{[\s\S]*?\.shell-right\{flex:0 1 auto;min-width:0;max-width:100%;/, 'the cluster may shrink and wrap');
+  assert.match(COSMOS, /@media \(min-width:1080px\)\{[\s\S]*?\.shell \.navrow\{position:absolute;left:50%;top:50%;transform:translate\(-50%,-50%\);\}/, 'the nav is centred absolutely, flanks size to content');
+  assert.doesNotMatch(COSMOS, /@media \(max-width:820px\)\{\n\s*\.shell\{justify-content:center;\}/, 'no band is left between the two rules');
+  assert.match(COSMOS, /\.who>span\{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:14ch;\}/, 'a long login truncates');
+  assert.match(COSMOS, /\.search:focus-within\{box-shadow:/, 'keyboard focus on the search pills is visible');
+  assert.match(COSMOS, /\.mineBar \.search \.count\{display:none;\}/, 'the count leaves the placeholder alone at 390px');
+  assert.match(COSMOS, /\.projMeta>span\+span::before\{content:'·'/, 'the meta separator rides its item');
+  assert.match(HUB, /#view-mine \.hero,#view-manage \.hero\{max-width:none;\}/, 'titles align with their cards');
+});
+
+test('card metadata is span-wrapped so a separator can never strand', () => {
+  assert.match(fn('renderCard'), /meta\.map\(function \(m\) \{ return '<span>' \+ m \+ '<\/span>'; \}\)\.join\(''\)/);
+  assert.match(fn('renderManage'), /meta\.map\(function \(m\) \{ return '<span>' \+ m \+ '<\/span>'; \}\)\.join\(''\)/);
+});
+
+test('an open teardown confirm survives the minute re-render', () => {
+  assert.match(SCRIPT, /var cardAsking = null;/);
+  assert.match(fn('renderCard'), /if \(cardAsking !== null && cardAsking === String\(inst\.id\)\) return;/);
+  assert.match(fn('askTeardown'), /cardAsking = String\(id\);/);
+  assert.match(SCRIPT, /function unAskTeardown\(id\) \{ cardAsking = null;/);
+});
+
+test('the inputs a stranger types into are labelled', () => {
+  assert.match(HUB, /id="ghSearch"[^>]*aria-label="Search your repositories"/);
+  assert.match(HUB, /id="ghNewName"[^>]*aria-label="New repository name"/);
+  assert.match(SCRIPT, /aria-label="A domain you own, for ' \+ esc\(inst\.slug\) \+ '"/);
+});