@bongos/core 1.19.368 → 1.19.369

package/tests/platform_visibility_gate.mjs

@@ -0,0 +1,280 @@
+// tests/platform_visibility_gate.mjs — the project's member door (task 1003043).
+//
+// A gate that is wrong in either direction is worse than none: too open and a
+// "members only" project is readable by anyone; too closed and it locks out the
+// sign-in that admits the members, the health probe the deploy waits on, or the
+// manifest the platform's runner reads to learn whether the setting took. Two
+// layers here:
+//
+//   1. The middleware alone, with the mode and the session lookup injected —
+//      both modes, every refusal shape, fail-closed, the inactive-builder rule,
+//      the private-cache mark on what a member is shown.
+//   2. The REAL booted app with the branding pack set to 'gated' BEFORE the
+//      first require (branding() memoizes for the process lifetime, which is the
+//      same reason a live project applies the setting by restarting): proves
+//      the gate is mounted early enough to cover surfaces registered elsewhere,
+//      and that the exempt ones still answer. The 'public' boot is every other
+//      boot test in this suite (tests/platform_boot.mjs, tests/stealth_gate.mjs
+//      run with the default pack and expect the surfaces to answer a stranger).
+//
+// Run:  node --test tests/platform_visibility_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { platformVisibilityGate, isGated, isExempt, mode, signInHref, privateCacheControl } from '../src/bongos/platform-visibility-gate.js';
+
+const require = createRequire(import.meta.url);
+
+// set BEFORE the app (and branding) is first required
+const brandingFile = path.join(os.tmpdir(), `bongos-pvg-${process.pid}.json`);
+fs.writeFileSync(brandingFile, JSON.stringify({
+  identity: { productName: 'Spike Harbor' },
+  project: { platformVisibility: 'gated', joinability: 'apply' },
+}));
+process.env.GDS_BRANDING_FILE = brandingFile;
+
+const platformMod = require('../src/platform-server.js');
+
+// ── 1. the middleware alone ──────────────────────────────────────────────────
+
+function fakeReq({ path: p = '/', method = 'GET', headers = {} } = {}) {
+  return { path: p, originalUrl: p, method, headers: { host: 'spike.test', ...headers }, secure: false };
+}
+function fakeRes() {
+  const r = { statusCode: 200, headers: {}, body: undefined, failed: null, headersSent: false, wrote: null };
+  r.set = (k, v) => { r.headers[k.toLowerCase()] = v; return r; };
+  r.setHeader = (k, v) => { r.headers[k.toLowerCase()] = v; };
+  r.getHeader = (k) => r.headers[k.toLowerCase()];
+  r.writeHead = (code) => { r.wrote = code; r.headersSent = true; return r; };
+  r.status = (c) => { r.statusCode = c; return r; };
+  r.type = () => r;
+  r.send = (b) => { r.body = b; return r; };
+  r.json = (b) => { r.body = b; return r; };
+  r.fail = (code, status) => { r.failed = { code, status }; r.statusCode = status; return r; };
+  return r;
+}
+async function run(mw, req) {
+  const res = fakeRes();
+  let nexted = false;
+  mw(req, res, () => { nexted = true; });
+  // the middleware answers on a microtask after the (fake) lookup resolves
+  await new Promise((r) => setImmediate(r));
+  return { res, nexted };
+}
+
+const member = { builder_id: 7, status: 'active' };
+const gatedWith = (session) => platformVisibilityGate({ isGated: () => true, resolveSession: async () => session });
+
+test('public mode: the gate is inert — nothing is looked up, everything passes', async () => {
+  let looked = 0;
+  const mw = platformVisibilityGate({ isGated: () => false, resolveSession: async () => { looked += 1; return null; } });
+  for (const p of ['/', '/projects', '/builders', '/api/bongos/public/progress', '/status.css']) {
+    const { nexted } = await run(mw, fakeReq({ path: p }));
+    assert.equal(nexted, true, `${p} passes in public mode`);
+  }
+  assert.equal(looked, 0, 'a public project never pays a session lookup for the gate');
+});
+
+test('gated mode: a stranger meets the door on a page, with the way in on it', async () => {
+  const { res, nexted } = await run(gatedWith(null), fakeReq({ path: '/projects?view=map' }));
+  assert.equal(nexted, false);
+  assert.equal(res.statusCode, 401, 'a refused knock is a 401, not a 200 or a redirect');
+  assert.match(res.body, /Sign in/, 'the door carries the way in');
+  assert.match(res.body, /href="\/api\/gds\/auth\/web\/start\?return=%2Fprojects%3Fview%3Dmap"/,
+    'the sign-in start returns the member to the page they knocked on — RELATIVE, which safeReturnTo honours everywhere');
+  assert.match(res.body, /Spike Harbor/, 'it names the project');
+  assert.match(res.body, /noindex/, 'a members-only project is not indexed');
+  assert.equal(res.headers['cache-control'], 'no-store');
+});
+
+test('the door leaks nothing of the product: no stylesheet, no branding bundle, no script', async () => {
+  const { res } = await run(gatedWith(null), fakeReq({ path: '/' }));
+  assert.doesNotMatch(res.body, /cosmos\.css/);
+  assert.doesNotMatch(res.body, /__BRANDING__/);
+  assert.doesNotMatch(res.body, /<script/);
+});
+
+test('gated mode: a stranger on the API gets the 401 envelope requireBuilder uses — whatever the spelling', async () => {
+  for (const p of ['/api/bongos/public/progress', '/API/bongos/public/progress']) {
+    const { res, nexted } = await run(gatedWith(null), fakeReq({ path: p }));
+    assert.equal(nexted, false, p);
+    assert.deepEqual(res.failed, { code: 'unauthenticated', status: 401 }, `${p} gets the envelope, not the door`);
+  }
+});
+
+test('gated mode: a member passes everywhere, and what they are shown leaves private — with its freshness kept', async () => {
+  for (const p of ['/', '/projects', '/builders', '/api/bongos/public/progress', '/api/bongos/tasks/1']) {
+    const { res, nexted } = await run(gatedWith(member), fakeReq({ path: p }));
+    assert.equal(nexted, true, `${p} opens to a member`);
+    // the route behind sets its own public max-age; the gate changes the SCOPE on
+    // the way out, not the freshness — the member's browser may keep it, an edge may not
+    res.setHeader('Cache-Control', 'public, max-age=3600');
+    res.setHeader('Vary', 'Accept-Encoding');
+    res.writeHead(200);
+    assert.equal(res.headers['cache-control'], 'private, max-age=3600', `${p}: a member's answer must never sit in a shared cache`);
+    assert.equal(res.headers['vary'], 'Accept-Encoding, Cookie');
+    assert.equal(res.wrote, 200, 'the original writeHead still runs');
+  }
+});
+
+test('the private rewrite keeps the route’s freshness and drops only what a shared cache would honour', () => {
+  assert.equal(privateCacheControl('public, max-age=3600'), 'private, max-age=3600', 'the browser keeps it, the edge does not');
+  assert.equal(privateCacheControl('public, s-maxage=600, max-age=60'), 'private, max-age=60', 's-maxage is a shared-cache directive — gone');
+  assert.equal(privateCacheControl('max-age=0, must-revalidate'), 'private, max-age=0, must-revalidate');
+  assert.equal(privateCacheControl('private, max-age=30'), 'private, max-age=30', 'already private stays as it was');
+  assert.equal(privateCacheControl('no-store'), 'no-store', 'a route that forbade caching is not loosened');
+  assert.equal(privateCacheControl(undefined), 'private, no-cache', 'no policy named → revalidate, never share');
+});
+
+test('a branding pack that cannot be read fails CLOSED — the gate treats the project as gated', () => {
+  assert.equal(mode(() => { throw new Error('pack unreadable'); }), 'gated');
+  assert.equal(mode(() => ({ project: { platformVisibility: 'public' } })), 'public');
+  assert.equal(mode(() => ({})), 'public', 'a pack with no project block is today’s behaviour');
+});
+
+test('gated mode: a deactivated builder keeps no door (the task 871 rule), an unknown status does', async () => {
+  const gone = await run(gatedWith({ builder_id: 7, status: 'inactive' }), fakeReq({ path: '/api/bongos/public/progress' }));
+  assert.deepEqual(gone.res.failed, { code: 'builder_inactive', status: 403 });
+  const page = await run(gatedWith({ builder_id: 7, status: 'inactive' }), fakeReq({ path: '/builders' }));
+  assert.equal(page.res.statusCode, 401, 'a page refusal is the door either way');
+  const unknown = await run(gatedWith({ builder_id: 7 }), fakeReq({ path: '/builders' }));
+  assert.equal(unknown.nexted, true, 'deny only on the KNOWN inactive status — never lock an active builder out');
+});
+
+test('gated mode: a session lookup that throws fails CLOSED', async () => {
+  const mw = platformVisibilityGate({ isGated: () => true, resolveSession: async () => { throw new Error('db down'); } });
+  const page = await run(mw, fakeReq({ path: '/' }));
+  assert.equal(page.nexted, false);
+  assert.equal(page.res.statusCode, 401);
+  const api = await run(mw, fakeReq({ path: '/api/bongos/public/progress' }));
+  assert.deepEqual(api.res.failed, { code: 'unauthenticated', status: 401 });
+});
+
+test('the exempt list: the door, the manifest, the probes, the downloads — on every API prefix — and nothing wider', () => {
+  for (const p of [
+    '/api/gds/auth/web/start', '/api/bongos/auth/web/callback', '/api/gds/auth/device/start', '/api/gds/auth',
+    '/api/bongos/v1/auth/device/start', '/api/bongos/v1/instance', '/api/bongos/v1/healthz',
+    '/api/gds/instance', '/api/bongos/instance', '/api/gds/healthz',
+    '/api/bongos/provisioning/tls-check', '/api/gds/provisioning/health',
+    '/healthz', '/version', '/metrics', '/__stealth',
+    '/downloads/bongos/install.sh', '/downloads/devbox/latest.json',
+    // Express routes case-insensitively and with a trailing slash — the list sees what the router sees
+    '/API/GDS/INSTANCE', '/api/gds/instance/', '/HEALTHZ', '/api/bongos/auth/',
+  ]) assert.equal(isExempt(p), true, `${p} must answer a stranger`);
+  for (const p of [
+    '/', '/projects', '/builders', '/builders/hall.css', '/docs', '/lib/bongos-client.js',
+    '/api/bongos/public/progress', '/api/gds/public/leaderboard', '/api/bongos/instances', '/api/gds/authors',
+    '/api/bongos/v1/public/progress', '/api/gds/instance/anything', '/instance', '/healthzz', '/downloads',
+    '/api/other/instance', '/api/bongos/provisioning/instances',
+  ]) assert.equal(isExempt(p), false, `${p} must be gated`);
+});
+
+test('gated mode: an exempt path is never looked up, and a CORS preflight passes', async () => {
+  let looked = 0;
+  const mw = platformVisibilityGate({ isGated: () => true, resolveSession: async () => { looked += 1; return null; } });
+  for (const p of ['/healthz', '/api/gds/instance', '/api/bongos/v1/auth/device/start', '/downloads/bongos/install.sh']) {
+    const { nexted } = await run(mw, fakeReq({ path: p }));
+    assert.equal(nexted, true, `${p} passes`);
+  }
+  const pre = await run(mw, fakeReq({ path: '/api/bongos/public/progress', method: 'OPTIONS' }));
+  assert.equal(pre.nexted, true, 'a preflight carries no identity and admits nothing');
+  assert.equal(looked, 0, 'the probes and the door cost no session lookup');
+});
+
+test('the sign-in return is the knocked-on page for GET/HEAD only, relative, and never a foreign host', () => {
+  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap' })), '/api/gds/auth/web/start?return=%2Fbuilders%2Froadmap');
+  assert.equal(signInHref(fakeReq({ path: '/builders/roadmap', method: 'POST' })), '/api/gds/auth/web/start', 'a write has nothing safe to replay');
+  assert.equal(signInHref(fakeReq({ path: '//evil.example/x' })), '/api/gds/auth/web/start', 'a protocol-relative path is dropped');
+  assert.equal(signInHref(fakeReq({ path: '/' })), '/api/gds/auth/web/start', 'the front page needs no return');
+});
+
+// ── 2. the real booted app, pack = gated ─────────────────────────────────────
+
+let server, port;
+before(async () => {
+  server = http.createServer(platformMod.buildPlatformApp());
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => {
+  await new Promise((r) => server.close(r));
+  delete process.env.GDS_BRANDING_FILE;
+  try { fs.unlinkSync(brandingFile); } catch { /* already gone */ }
+});
+
+function request(pathname, { method = 'GET', host = '127.0.0.1', cookie } = {}) {
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      host: '127.0.0.1', port, path: pathname, method,
+      headers: { host, ...(cookie ? { cookie } : {}) },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, headers: res.headers, body: data }));
+    });
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+test('booted gated: the pack the gate reads says so', () => {
+  assert.equal(mode(), 'gated');
+  assert.equal(isGated(), true);
+});
+
+test('booted gated: every human surface meets the door, not the product — assets included', async () => {
+  for (const p of ['/', '/projects', '/create', '/builders', '/docs', '/lib/bongos-client.js', '/favicon.ico']) {
+    const res = await request(p);
+    assert.equal(res.status, 401, `${p} must be gated`);
+    assert.match(res.body, /Sign in/, `${p} shows the door`);
+    assert.doesNotMatch(res.body, /id="projectsList"|__BRANDING__|window\.bongos/, `${p} must not render the product`);
+  }
+});
+
+test('booted gated: the public read API refuses a stranger with the API envelope, on every prefix', async () => {
+  for (const p of ['/api/bongos/public/progress', '/api/gds/public/progress', '/api/bongos/v1/public/progress']) {
+    const res = await request(p);
+    assert.equal(res.status, 401, p);
+    const j = JSON.parse(res.body);
+    assert.equal(j.error && j.error.code, 'unauthenticated', `${p}: the ADR 0116 envelope, as requireBuilder emits it`);
+  }
+});
+
+test('booted gated: the door, the manifest, the probes and the downloads still answer a stranger', async () => {
+  for (const p of ['/healthz', '/version']) {
+    const res = await request(p);
+    assert.equal(res.status, 200, `${p} must answer a stranger`);
+  }
+  // the manifest: what a stranger reads to learn how to sign in, and what the
+  // platform's runner reads to learn whether the setting was consumed — on the
+  // pinned contract prefix too (ADR 0117)
+  for (const p of ['/api/bongos/instance', '/api/bongos/v1/instance', '/api/gds/instance']) {
+    const m = await request(p);
+    assert.equal(m.status, 200, `${p}: the manifest stays public`);
+    const j = JSON.parse(m.body);
+    assert.equal(j.brand.project.platformVisibility, 'gated', 'and it carries the policy itself');
+  }
+  // the sign-in start must be reachable: it reaches the auth router (which may
+  // refuse for its own reasons — a missing OAuth app — but never with the door)
+  for (const p of ['/api/bongos/auth/web/start', '/api/bongos/v1/auth/web/start']) {
+    const s = await request(p);
+    assert.notEqual(s.status, 401, `${p}: the door must be openable`);
+    assert.doesNotMatch(s.body, /Sign in to continue/, 'the auth surface never renders the door');
+  }
+  // a cookie-less `curl … | sh` must not receive an HTML door
+  const dl = await request('/downloads/bongos/install.sh');
+  assert.notEqual(dl.status, 401, 'the installer is not a project surface');
+  assert.doesNotMatch(dl.body, /Sign in to continue/);
+});
+
+test('booted gated: a bogus session cookie is not a member', async () => {
+  // resolves to no session (or fails closed if there is no database here) —
+  // either way the stranger stays outside
+  const res = await request('/projects', { cookie: 'gds_session=notARealToken' });
+  assert.equal(res.status, 401);
+});

package/tests/projects_hub.mjs

@@ -1121,3 +1121,96 @@ test('a teardown does not silence the address — the copy says what the runner
     'the honest word, and the accurate one — a revive re-uses exactly this hostname');
   assert.match(fn, /repository is untouched/, 'what survives is still stated in both shapes');
 });
+
+/* ── who can see it (task 1003043): the platform-visibility toggle ───────────
+   Two reads kept apart: the CHOICE is the platform's settings row, and what the
+   project RUNS is read from its own public manifest (brand.project, ADR 0190
+   §9). The save's reply is a receipt — shown verbatim, never painted as the live
+   state — because a change reaches a running project only by a restart. ── */
+
+// a function's text runs from its declaration to the next declaration (none of
+// the functions pinned here nest a named function of their own)
+const fnHub = (name) => {
+  const start = SCRIPT.indexOf(`function ${name}(`);
+  assert.ok(start >= 0, `${name}() must exist`);
+  const rest = SCRIPT.slice(start + 1);
+  const next = rest.search(/\n\s*function \w+\(/);
+  return next < 0 ? rest : rest.slice(0, next);
+};
+
+test('the visibility section is live markup with its body slot and a sibling fold (C7)', () => {
+  assert.match(HUB, /id="mVis"/, 'the volatile slot is real markup, not JS-built');
+  assert.match(HUB, /id="mVisWhat"/, 'the what-changes fold ships with the page');
+  const card = (HUB.match(/<div class="card" id="mVisibility">[\s\S]*?\n      <\/div>/) || [''])[0];
+  assert.ok(card, 'the visibility card must be extractable');
+  const slotAt = card.indexOf('id="mVis"');
+  const foldAt = card.indexOf('id="mVisWhat"');
+  assert.ok(slotAt > 0 && foldAt > slotAt, 'the fold sits outside the slot it must survive');
+  assert.doesNotMatch(card, /isn’t wired up/, 'the placeholder copy is gone — the section is real now');
+  const fold = (HUB.match(/<details class="finePrint" id="mVisWhat">[\s\S]*?<\/details>/) || [''])[0];
+  assert.match(fold, /door itself stays open/, 'the sign-in door is promised reachable — members can always get in');
+  assert.match(fold, /separate from the repository’s visibility/, 'the two visibilities are named as separate settings (owner decision 2026-08-16)');
+  assert.match(fold, /restarts the project/, 'the restart is said, not hidden (ADR 0190)');
+});
+
+test('the choices are the platform’s vocabulary, each in plain words, and the pick is a real radio group', () => {
+  assert.match(SCRIPT, /var VIS_OPTIONS = \{\s*public: \{ label: 'Everyone'/);
+  assert.match(SCRIPT, /gated: \{ label: 'Only signed-in members'/);
+  const render = fnHub('renderVis');
+  assert.match(render, /\(s\.options \|\| \[\]\)\.filter\(function \(v\) \{ return !!VIS_OPTIONS\[v\]; \}\)/,
+    'only values the page can describe are offered — the server’s options list is the source');
+  assert.match(render, /role="radiogroup"/);
+  assert.match(render, /type="radio" name="mVisPick"/);
+  assert.match(render, /data-vis-save/, 'one Save control');
+});
+
+test('the save sends the choice and shows the platform’s receipt verbatim — never the reply as the live state', () => {
+  const save = fnHub('doVisSave');
+  assert.match(save, /method: 'PATCH'/);
+  assert.match(save, /\/settings'/, 'PATCH /provisioning/instances/:id/settings');
+  assert.match(save, /JSON\.stringify\(\{ platform_visibility: value \}\)/, 'the body is the one key this section owns');
+  assert.match(save, /\(data\.push && data\.push\.message\)/, 'push.message is rendered as the server wrote it');
+  assert.doesNotMatch(save, /visRuns\(|mVisRuns/, 'the "runs" line is never written from the save reply');
+  assert.doesNotMatch(save, /data\.saved[^;]*Right now|applied/i, 'a save is a request, not a claim the project runs it');
+  assert.match(save, /e\.code === 'intent_conflict' \? 'projMsg' : 'projMsg err'/,
+    'a 409 intent_conflict is saved-but-waiting (details.recorded) — shown as the server’s sentence, not as a failure');
+  assert.match(save, /loadManage\(true, true\)/, 'the strip + in-flight line re-read open_intent after a save');
+});
+
+test('what the project RUNS comes only from its own manifest, and every answer is said', () => {
+  const runs = fnHub('loadVisRuns');
+  assert.match(runs, /inst\.status !== 'active' \|\| !inst\.domain/, 'only a live project with an address can be asked');
+  assert.match(runs, /'https:\/\/' \+ inst\.domain \+ '\/api\/gds\/instance'/,
+    'the same public GET /instance the platform’s runner reads after a restart');
+  assert.match(runs, /m\.brand && m\.brand\.project/);
+  assert.match(runs, /doesn’t report this setting yet/, 'an older core is named, not shown as applied');
+  assert.match(runs, /hasn’t taken effect there yet/, 'a saved-but-not-applied value is said');
+  assert.match(runs, /Couldn’t reach the project/, 'an unreachable project is said');
+  assert.match(runs, /if \(!res\.ok\) throw new Error\('http:' \+ res\.status\)/, 'a refusal is not an older core');
+  assert.match(runs, /answered but didn’t share what it’s running/, 'a project that answered-and-refused is said as such');
+  assert.doesNotMatch(runs, /mVisSettings\.value\)\s*\+\s*'<\/b>'|runs as <b>' \+ esc\(VIS_OPTIONS\[want\]/,
+    'the platform’s stored choice is never painted as what the project runs');
+});
+
+test('the in-flight line reads open_intent only, and re-asks the manifest when the push settles', () => {
+  const st = fnHub('renderVisState');
+  assert.match(st, /if \(visPushOpen\(inst\)\)/, 'one predicate for "a push is open", shared with loadVisibility');
+  assert.match(fnHub('visPushOpen'), /open_intent\.action === 'settings-apply'/);
+  assert.match(st, /inst.open_intent.state === 'running'/);
+  assert.match(st, /Until then it keeps its current setting\./, 'a queued push does not claim the new value');
+  assert.doesNotMatch(st, /fetch\(/, 'fetch-free — the minute tick may call it');
+  assert.match(st, /visRuns\(inst\.open_intent\.state === 'running'/, 'the in-flight line goes through visRuns so a re-render keeps it');
+  assert.match(fnHub('loadVisibility'), /if \(!visPushOpen\(inst\)\) loadVisRuns\(inst\);/, 'entering during an open push keeps the intent line, not the stale manifest');
+  assert.match(fnHub('doVisSave'), /if \(data\.push && data\.push\.queued\) mVisPushSeen = true;/, 'a push that settles before the re-read still triggers the manifest read');
+  assert.match(st, /if \(mVisPushSeen\) \{ mVisPushSeen = false; loadVisRuns\(inst\); \}/,
+    'the manifest is asked again the moment the push is gone — the only source that can say the value took');
+  assert.match(fnHub('renderManage'), /renderVisState\(inst\);/, 'renderManage repaints it on every tick');
+});
+
+test('the settings reads fire on entry + tab return only — never on the in-flight tick', () => {
+  assert.match(SCRIPT, /if \(!keepRepo\) loadVisibility\(inst\);/);
+  const load = fnHub('loadVisibility');
+  assert.match(load, /\/settings', \{ credentials: 'same-origin' \}/, 'GET /provisioning/instances/:id/settings');
+  assert.match(load, /res\.status === 401 \? signInAgain\(\)/, 'a lapsed session is said as sign-in, not as an outage');
+  assert.match(load, /var asked = manageId;/, 'a stale answer must never describe a newer project');
+});

package/tests/projects_hub_pre_uat.mjs

@@ -166,13 +166,15 @@ test('an in-flight project is watched on its own page; a settled one keeps the C
   assert.match(SCRIPT, /setInterval\(manageWatchTick, 5000\)/);
 });
 
-test('working sections come before the not-wired ones on manage, and the placeholders state today’s behavior', () => {
+test('working sections come before the not-wired one on manage, and the placeholder states today’s behavior', () => {
   const repo = HUB.indexOf('id="mRepoVisibility"');
   const vis = HUB.indexOf('id="mVisibility"');
   const join = HUB.indexOf('id="mJoinability"');
   const del = HUB.indexOf('id="mDelete"');
   assert.ok(repo > 0 && repo < vis && vis < join && join < del, 'repo visibility → who can see it → how people join → delete');
-  assert.match(HUB, /For now, every project’s pages are open to everyone\./);
+  // "who can see it" is live since task 1003043 — its not-yet line is gone
+  const visCard = HUB.slice(vis, join);
+  assert.doesNotMatch(visCard, /isn’t wired up|For now, every project’s pages are open to everyone/);
   assert.match(HUB, /For now, people apply to join and you invite them\./);
   assert.doesNotMatch(HUB, /It lands in one of the next updates/);
 });