@bongos/core 1.19.347 → 1.19.349

package/tests/client_baseurl_guard.mjs

@@ -0,0 +1,122 @@
+// tests/client_baseurl_guard.mjs — the guard that stops a page 404ing every call
+// (task 1003263).
+//
+// Three pages shipped the defect this guard exists to catch: ideas.js and idea.js
+// were dead in production from the day they shipped, and collab.js was caught one
+// commit before it would have joined them. So the guard itself is worth testing on
+// synthetic sources rather than only on the live tree — a scan that passes because
+// the tree happens to be clean today proves nothing about what it would REFUSE.
+//
+// Every case below is an in-memory file: no fixtures on disk, no dependence on the
+// current state of modules/hall-ui/public/.
+//
+// Run:  node tests/client_baseurl_guard.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { checkClientBaseUrl, scanPages } = require('../scripts/gds/client-baseurl-guard.js');
+
+let passed = 0;
+let failed = 0;
+function test(name, fn) {
+  try { fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.error(`  FAIL ${name}\n    ${err.message}`); }
+}
+
+const from = (map) => ({
+  files: Object.keys(map),
+  read: (rel) => (rel in map ? map[rel] : null),
+});
+
+// --- THE DEFECT ------------------------------------------------------------
+
+test('the exact shipped defect is refused: baseUrl:\'\' plus a namespaced call', () => {
+  const { violations } = scanPages(...Object.values(from({
+    'modules/hall-ui/public/bad.js':
+      "const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin' });\n"
+      + 'const r = await api.inbox.getInboxTemplate({});\n',
+  })));
+  assert.equal(violations.length, 1);
+  assert.match(violations[0], /bad\.js/);
+  assert.match(violations[0], /site root/, 'the message says WHY it is wrong, not just that it is');
+  assert.match(violations[0], /Drop the baseUrl override/, 'and what to do about it');
+});
+
+test('double-quoted and backtick empty bases are the same defect', () => {
+  for (const empty of ['""', '``']) {
+    const { violations } = scanPages(...Object.values(from({
+      'public/p.js': `const api = createClient({ baseUrl: ${empty} });\napi.me.getMe({});\n`,
+    })));
+    assert.equal(violations.length, 1, `baseUrl: ${empty} must be caught`);
+  }
+});
+
+// --- WHAT IT MUST NOT FLAG -------------------------------------------------
+// A guard that fires on correct code gets suppressed, and then it protects nothing.
+
+test("the escape-hatch style is CORRECT with baseUrl:'' — never flagged", () => {
+  // work.js, copy-desk.js and most of the hall do exactly this: empty base, but
+  // every path written out in full. Flagging it would be a false positive on the
+  // majority of the hall.
+  const { violations } = scanPages(...Object.values(from({
+    'modules/hall-ui/public/work.js':
+      "const API = '/api/bongos';\n"
+      + "const api = window.BongosClient.createClient({ baseUrl: '', credentials: 'same-origin' });\n"
+      + "const res = await api.request('GET', `${API}/tasks`);\n",
+  })));
+  assert.deepEqual(violations, []);
+});
+
+test('the fix itself passes — omitting baseUrl with namespaced calls is correct', () => {
+  const { violations } = scanPages(...Object.values(from({
+    'modules/hall-ui/public/ideas.js':
+      "const api = window.BongosClient.createClient({ credentials: 'same-origin', throwOnError: false });\n"
+      + 'await api.inbox.getInboxTemplate({});\n',
+  })));
+  assert.deepEqual(violations, [], 'the shipped fix must not trip the guard that motivated it');
+});
+
+test('a non-empty baseUrl is a deliberate choice, not the defect', () => {
+  const { violations } = scanPages(...Object.values(from({
+    'public/ext.js':
+      "const api = createClient({ baseUrl: 'https://other.example/api/bongos/v1' });\n"
+      + 'api.me.getMe({});\n',
+  })));
+  assert.deepEqual(violations, []);
+});
+
+test('a page that builds no client at all is ignored', () => {
+  const { violations, usingClient } = scanPages(...Object.values(from({
+    'public/static.js': "document.querySelector('#x').textContent = 'hi';\n",
+  })));
+  assert.deepEqual(violations, []);
+  assert.equal(usingClient, 0);
+});
+
+// --- THE SCAN MUST NOT SILENTLY SUCCEED ------------------------------------
+
+test('an empty enumeration is a hard FAIL, not a clean pass', () => {
+  // The failure mode that makes a guard worthless: git ls-files returns nothing,
+  // zero files are scanned, and the check reports green forever.
+  const r = checkClientBaseUrl({ files: [], read: () => null });
+  assert.equal(r.hardFail, true);
+  assert.match(r.violations[0], /scan defect/);
+});
+
+test('an unreadable file is skipped without being counted as scanned', () => {
+  const { scanned } = scanPages(['gone.js'], () => null);
+  assert.equal(scanned, 0);
+});
+
+test('the check reports hardFail so CI actually stops', () => {
+  const r = checkClientBaseUrl(from({
+    'public/bad.js': "createClient({ baseUrl: '' });\napi.inbox.postInbox({});\n",
+  }));
+  assert.equal(r.ok, false);
+  assert.equal(r.hardFail, true, 'a page dead in prod is not a warning');
+});
+
+console.log(`\nclient_baseurl_guard: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);

package/tests/idea_hall_composer.mjs

@@ -112,6 +112,17 @@ await test('the page gets both the FORM and the METER from the server', () => {
   assert.match(IDEAS_JS, /getInboxTemplate/, 'the form is rendered from GET /inbox/template');
   assert.match(IDEAS_JS, /postInboxScore/, 'the meter is filled from POST /inbox/score');
   assert.match(IDEAS_JS, /postInbox\b/, 'and it files through POST /inbox');
+
+  // ...AND THOSE CALLS MUST REACH THE API. The three assertions above are regexes
+  // over the SOURCE TEXT, so they passed for months while the page 404'd on every
+  // one of them: baseUrl:'' told the client the API-relative templates were already
+  // absolute, and each request went to the site root. Naming a method proves the
+  // call is written, never that it is addressed — task 1003263.
+  assert.doesNotMatch(
+    IDEAS_JS,
+    /createClient\(\s*\{[^}]*baseUrl\s*:\s*(''|"")/,
+    "baseUrl:'' sends the generated client's API-relative paths to the site root",
+  );
 });
 
 await test('the page does not print a pass bar — that rule lives in economy', () => {

package/tests/ship_publish_error.mjs

@@ -99,7 +99,19 @@ test('a "fetch first" rejection names the branch and the reset-onto-origin remed
   assert.match(out, /reset/i, 'names the reset');
   assert.match(out, /generator/i, 'and the regenerate step before re-shipping');
   assert.match(out, /re-ship|fast-forward/i, 'and why: so the push fast-forwards');
-  assert.ok(!/\n/.test(out), 'multi-line git stderr is collapsed — this goes mid-sentence into one log line');
+  // CONTRACT CHANGED, task 1003222. This used to assert the OPPOSITE — that the
+  // whole thing collapsed to one line — which was right while the server clipped
+  // stderr to 200 chars, and wrong once it stopped. The summary line is still
+  // collapsed and scannable; the verbatim text is quoted BELOW it, because git puts
+  // the line that names the cause last and a one-line squash buries it.
+  const [summary] = out.split('\n');
+  assert.ok(!/\n/.test(summary), 'the SUMMARY is still one scannable line');
+  assert.match(summary, /reason:/, 'and still carries a reason inline');
+  assert.match(out, /what the remote actually said/, 'the untruncated stderr is quoted below');
+  assert.ok(
+    out.includes("error: failed to push some refs to 'github.com/org/repo.git'"),
+    'the remote message survives VERBATIM, on its own line — the whole point of the task',
+  );
 });
 
 test('the "non-fast-forward" wording triggers the same hint through the envelope', () => {
@@ -158,5 +170,77 @@ test('1003221 a non-NFF failure gains no hint from either flag', () => {
   }
 });
 
+
+// --- task 1003222: the remote's own words reach the builder ------------------
+//
+// The failure this closes: a builder saw `reason: error: failed` — clipped
+// mid-word by a 200-char slice on top of an earlier 500-char one — while the line
+// that named the cause (`remote: fatal error in commit_refs`) and the HTTP status
+// existed server-side only. That cost hours AND produced a wrong first diagnosis,
+// because the real message was never in the room.
+
+const LONG_STDERR = [
+  'To https://github.com/org/repo.git',
+  ' ! [remote rejected] b -> b (pre-receive hook declined)',
+  'error: failed to push some refs',
+  'remote: fatal error in commit_refs',   // git's useful line is LAST
+].join('\n');
+
+test('1003222 the LAST line survives — a head-truncation would have eaten it', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: LONG_STDERR });
+  assert.ok(
+    out.includes('remote: fatal error in commit_refs'),
+    'the cause git printed last must reach the builder',
+  );
+});
+
+test('1003222 the git exit code is reported — 128 and 1 are different remedies', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: 'boom', git_exit_code: 128 });
+  assert.match(out, /git exit 128/);
+});
+
+test('1003222 a GitHub HTTP status is reported when the API refused', () => {
+  const out = fmt({ error: 'pr_create_failed', github_status: 422, reason: 'No commits between main and b' });
+  assert.match(out, /GitHub HTTP 422/, '422 vs 403 vs 404 are three different fixes');
+});
+
+test('1003222 a timeout says so rather than looking like a rejection', () => {
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: 'killed', timed_out: true });
+  assert.match(out, /TIMED OUT/);
+});
+
+test('1003222 a single-line stderr is NOT repeated in a quote block', () => {
+  // It is already fully present in the summary; quoting it again is noise.
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: 'fatal: repository not found' });
+  assert.ok(!out.includes('what the remote actually said'), 'no block for a one-liner');
+  assert.match(out, /fatal: repository not found/);
+});
+
+test('1003222 an omitted middle is DECLARED, never silently clipped', () => {
+  const out = fmt({
+    error: 'publish_failed', step: 'push', reason: LONG_STDERR, reason_bytes: 99999,
+  });
+  assert.match(out, /99999 bytes at the server/, 'the reader is told text is missing');
+  assert.match(out, /omitted/);
+});
+
+test('1003222 the remedy precedes the quote block, not stranded under it', () => {
+  // The remedy is the actionable sentence. Below twenty lines of git chatter it
+  // reads as a footnote to the quotation and gets missed.
+  const out = fmt({ error: 'publish_failed', step: 'push', reason: NON_FF_STDERR });
+  const remedy = out.indexOf('reset onto');
+  const quote = out.indexOf('what the remote actually said');
+  assert.ok(remedy > -1 && quote > -1, 'both present');
+  assert.ok(remedy < quote, 'remedy comes first');
+});
+
+test('1003222 nothing regressed for a failure carrying no stderr at all', () => {
+  const out = fmt({ error: 'publish_failed' });
+  assert.match(out, /publish_failed/);
+  assert.ok(!out.includes('what the remote actually said'));
+  assert.ok(!/undefined|null|\[object/.test(out), 'no placeholder leakage');
+});
+
+
 console.log(`ship_publish_error: ${passed} passed, ${failed} failed`);
-process.exit(failed === 0 ? 0 : 1);
+process.exit(failed === 0 ? 0 : 1);

package/tests/update_channel.mjs

@@ -8,6 +8,8 @@
 //   4. parseNpmViewVersions — the array / bare-string / empty shapes npm view emits.
 //   5. listAvailableVersions — ok + fail-soft with an injected runner.
 //   6. loadSubscriptions — missing/malformed → empty; channel default + validate; env kept; dropless.
+//   7. describeRoster — an empty roster REPORTS WHY, and is an alarm on a control plane (task 1003158).
+//   8. subscriptionStaleness — releases the channel was entitled to and did not take = "the upgrader stopped".
 //
 // DB-free + network-free (every external is injected). Run:  node tests/update_channel.mjs
 
@@ -182,6 +184,129 @@ t('loadSubscriptions: an entry without a dir is dropped (cannot be upgraded)', (
   assert.equal(r.instances[0].slug, 'real');
 });
 
+// ---- describeRoster: fails closed, no longer fails quiet (task 1003158) ----
+//
+// The regression these pin: before this, a missing manifest, a malformed manifest and a deliberately
+// empty roster were INDISTINGUISHABLE — all three returned a bare `instances: []` and the routine
+// shrugged. cloudbongos.com sat 36 releases behind for days because "nothing happened" looked
+// identical to "nothing needed to happen". Every empty roster must now say WHY, every run.
+
+t('loadSubscriptions: missing file reports reason manifest-absent (not just an empty list)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'otb-subs-none2-'));
+  const r = uc.loadSubscriptions({ instanceDir: dir });
+  assert.deepEqual(r.instances, []);
+  assert.equal(r.reason, uc.ROSTER_ABSENT);
+  assert.equal(r.dropped, 0);
+});
+
+t('loadSubscriptions: malformed JSON reports reason manifest-malformed + keeps the error', () => {
+  const dir = scratchWith('{ not valid');
+  const r = uc.loadSubscriptions({ instanceDir: dir });
+  assert.equal(r.reason, uc.ROSTER_MALFORMED);
+  assert.match(r.error, /malformed JSON/);
+});
+
+t('loadSubscriptions: parsed-but-unsubscribable reports roster-empty and COUNTS the drops', () => {
+  const dir = scratchWith({ instances: [{ slug: 'ghost' }, { slug: 'alsoghost' }] });
+  const r = uc.loadSubscriptions({ instanceDir: dir });
+  assert.deepEqual(r.instances, []);
+  assert.equal(r.reason, uc.ROSTER_EMPTY);
+  assert.equal(r.dropped, 2);
+});
+
+t('loadSubscriptions: a usable roster reports ok', () => {
+  const dir = scratchWith({ instances: [{ slug: 'cb', dir: '/srv/cb' }] });
+  const r = uc.loadSubscriptions({ instanceDir: dir });
+  assert.equal(r.reason, uc.ROSTER_OK);
+  assert.equal(r.dropped, 0);
+});
+
+t('describeRoster: an empty roster on a CONTROL PLANE is an alarm, not a shrug', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'otb-subs-cp-'));
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: dir }), { controlPlane: true });
+  assert.equal(d.level, 'alarm');
+  assert.match(d.message, /CONTROL PLANE/);
+  assert.match(d.message, /subscribing NOTHING/);
+});
+
+t('describeRoster: the same empty roster on a plain instance is only a warn (shipped default)', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'otb-subs-plain-'));
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: dir }));
+  assert.equal(d.level, 'warn');
+  assert.match(d.message, /shipped default/);
+});
+
+t('describeRoster: a malformed manifest is an alarm everywhere', () => {
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: scratchWith('{ nope') }));
+  assert.equal(d.level, 'alarm');
+  assert.match(d.message, /MALFORMED/);
+});
+
+t('describeRoster: partial loss is surfaced — a healthy-looking sweep that silently skips a row', () => {
+  const dir = scratchWith({ instances: [{ slug: 'cb', dir: '/srv/cb' }, { slug: 'ghost' }] });
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: dir }));
+  assert.equal(d.level, 'warn');
+  assert.equal(d.dropped, 1);
+  assert.match(d.message, /DROPPED/);
+});
+
+t('describeRoster: a clean roster is ok and says how many it holds', () => {
+  const dir = scratchWith({ instances: [{ slug: 'cb', dir: '/srv/cb' }] });
+  const d = uc.describeRoster(uc.loadSubscriptions({ instanceDir: dir }), { controlPlane: true });
+  assert.equal(d.level, 'ok');
+  assert.equal(d.count, 1);
+});
+
+// ---- subscriptionStaleness: watching the watcher ---------------------------
+
+const RELEASES = Array.from({ length: 41 }, (_, i) => `1.19.${250 + i}`); // 1.19.250 … 1.19.290
+
+t('subscriptionStaleness: reproduces the incident — 1.19.254 on patch is 36 releases behind, stale', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.254', channel: 'patch', available: RELEASES });
+  assert.equal(st.behind, 36);
+  assert.equal(st.target, '1.19.290');
+  assert.equal(st.stale, true);
+});
+
+t('subscriptionStaleness: a swept instance is 0 behind and not stale', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.290', channel: 'patch', available: RELEASES });
+  assert.equal(st.behind, 0);
+  assert.equal(st.target, null);
+  assert.equal(st.stale, false);
+});
+
+t('subscriptionStaleness: a busy publish-on-merge day under the threshold does NOT cry wolf', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.287', channel: 'patch', available: RELEASES });
+  assert.equal(st.behind, 3);
+  assert.equal(st.stale, false);
+});
+
+t('subscriptionStaleness: a pinned instance is never stale (declining is not neglect)', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.254', channel: 'pinned', available: RELEASES });
+  assert.equal(st.behind, 0);
+  assert.equal(st.stale, false);
+});
+
+t('subscriptionStaleness: counts only what the CHANNEL may take — minors/majors are not a backlog', () => {
+  const st = uc.subscriptionStaleness({ installed: '1.19.254', channel: 'patch', available: ['1.20.0', '1.20.7', '2.0.0'] });
+  assert.equal(st.behind, 0);
+  assert.equal(st.stale, false);
+  // the same list on the minor channel IS a backlog
+  assert.equal(uc.subscriptionStaleness({ installed: '1.19.254', channel: 'minor', available: ['1.20.0', '1.20.7', '2.0.0'] }).behind, 2);
+});
+
+t('subscriptionStaleness: threshold is overridable; a bad threshold falls back to the default', () => {
+  assert.equal(uc.subscriptionStaleness({ installed: '1.19.287', channel: 'patch', available: RELEASES, threshold: 1 }).stale, true);
+  assert.equal(uc.subscriptionStaleness({ installed: '1.19.287', channel: 'patch', available: RELEASES, threshold: 'nonsense' }).threshold, uc.DEFAULT_STALENESS_THRESHOLD);
+});
+
+t('describeStaleness: silent when healthy, explicit about "the upgrader stopped" when not', () => {
+  assert.equal(uc.describeStaleness(uc.subscriptionStaleness({ installed: '1.19.290', channel: 'patch', available: RELEASES })), null);
+  const msg = uc.describeStaleness(uc.subscriptionStaleness({ installed: '1.19.254', channel: 'patch', available: RELEASES }), { slug: 'cloudbongos.com' });
+  assert.match(msg, /cloudbongos\.com is 36 patch releases behind/);
+  assert.match(msg, /upgrader has most likely stopped/);
+});
+
 console.log(`\nupdate_channel: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);