@bongos/core 1.19.474 → 1.19.476

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.474",
+  "version": "1.19.476",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -34,7 +34,7 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.474'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.476'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hall_board_world.mjs

@@ -34,6 +34,7 @@ import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import fs from 'node:fs';
 import path from 'node:path';
+import vm from 'node:vm';
 import { fileURLToPath } from 'node:url';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
@@ -151,3 +152,71 @@ test('both re-skinned pages have a states file, so the floors are reproducible',
     assert.ok(Object.keys(json.states).length >= 4, `${f} renders more than the default state`);
   }
 });
+
+// ---- 7. the way INTO a record is the title ----------------------------------
+//
+// task 1003468. Since 1759/1869 the card body toggles selection (bulk claim is
+// the primary card interaction) and the only door into the record was a 26px ⤢
+// glyph in --ink-faint — one the owner never found. The title is now a real
+// link on both surfaces that render the card, the board and the goal pane, and
+// the glyph is gone. A title that becomes a control owes the 24px floor on both
+// axes, and the card's line must not re-space to pay for it. The link also
+// carries WHERE it was opened from, which is the record's way back (§10 of
+// tests/hall_record_world.mjs).
+
+const cardWorkJs = read('work.js');
+const cardGoalsRenderJs = read('goals-render.js');
+const cardGoalsPageJs = read('goals-page.js');
+const cardTaskDetailJs = read('task-detail.js');
+
+test('the task title is a link on the board and on the goal pane, and the ⤢ glyph is gone', () => {
+  for (const [name, src] of [['work.js', cardWorkJs], ['goals-render.js', cardGoalsRenderJs]]) {
+    assert.match(src, /<p class="task__title"><a class="task__link" href="\$\{escapeHtml\(taskHref\(/,
+      `${name} renders the title as the door`);
+    assert.doesNotMatch(src, /task__open/, `${name} still renders the glyph`);
+  }
+  assert.doesNotMatch(cardGoalsPageJs, /task__open/, 'goals-page.js still listens for the glyph');
+  assert.doesNotMatch(styleCss.replace(/\/\*[\s\S]*?\*\//g, ''), /\.task__open/, 'style.css still styles a glyph nothing renders');
+});
+
+test('both click handlers let the title link through instead of toggling selection under it', () => {
+  for (const [name, src] of [['work.js', cardWorkJs], ['goals-page.js', cardGoalsPageJs]]) {
+    assert.match(src, /if \(e\.target\.closest\('\.task__link'\)\) return;/, `${name} returns before the card-body toggle`);
+  }
+});
+
+test('.task__link buys the 24px floor on both axes and hands the room back', () => {
+  const link = rule(styleCss, '.task__link');
+  assert.ok(link, '.task__link has a rule');
+  assert.match(link, /display:\s*inline-block/, 'inline-block, so min-height applies to a run of text');
+  assert.match(link, /min-width:\s*24px/, 'width is half the floor');
+  assert.match(link, /min-height:\s*24px/, 'height is the other half');
+  const pad = /padding:\s*(\d+)px\s+(\d+)px/.exec(link);
+  const mar = /margin:\s*-(\d+)px\s+-(\d+)px/.exec(link);
+  assert.ok(pad && mar, 'padding and a negative margin are both declared');
+  assert.deepEqual([mar[1], mar[2]], [pad[1], pad[2]], 'the negative margin equals the padding, so the card does not re-space');
+  assert.match(link, /color:\s*inherit/, 'ink at rest — sixty accent titles would take the board over');
+});
+
+test('the link a list writes carries WHERE it was opened from — path, query and hash', () => {
+  const sandbox = {
+    window: { BongosClient: { createClient: () => ({}) }, addEventListener() {}, OTB: {} },
+    document: { readyState: 'complete', addEventListener() {}, getElementById() { return null; }, body: {} },
+    location: { hostname: 'cloudbongos.com', pathname: '/builders/goals', search: '', hash: '#/goal/1000081', href: '' },
+    sessionStorage: { getItem() { return null; }, setItem() {}, removeItem() {} },
+    console, setTimeout, clearTimeout, Date,
+  };
+  sandbox.globalThis = sandbox;
+  sandbox.window.location = sandbox.location;
+  vm.createContext(sandbox);
+  vm.runInContext(cardTaskDetailJs, sandbox, { filename: 'task-detail.js' });
+  const api = sandbox.window.OTBTaskDetail;
+  assert.equal(api.href('1003468'), '/builders/task/1003468?from=%2Fbuilders%2Fgoals%23%2Fgoal%2F1000081',
+    'the goal\'s #/goal/N rides the query, where a reload and a copied link keep it');
+  api.open('1003468');
+  assert.equal(sandbox.location.href, api.href('1003468'), 'open() navigates to the same link the title carries');
+  sandbox.location.hostname = 'builders.cloudbongos.com';
+  sandbox.location.pathname = '/work';
+  sandbox.location.hash = '#backlog';
+  assert.equal(api.href('7'), '/task/7?from=%2Fwork%23backlog', 'on the builders host the hall is mounted at /');
+});

package/tests/hall_nav.mjs

@@ -42,11 +42,17 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
     return el;
   };
 
+  // replace() is recorded, not ignored: task 1003441 retired the #leaderboard
+  // VIEW and route() answers that hash with location.replace('/roster'). A stub
+  // without it throws the moment a boot carries that hash, which is precisely
+  // why the redirect shipped untested the first time.
+  const replaced = [];
   const location = {
     hostname: 'builders.cloudbongos.com',
     origin: 'https://builders.cloudbongos.com',
     pathname, hash,
     assign() {},
+    replace(target) { replaced.push(String(target)); },
   };
 
   const documentObj = {
@@ -90,6 +96,7 @@ function boot({ page = 'settings', hash = '', pathname = '/settings' } = {}) {
     sidebarHtml: documentObj.getElementById('app-sidebar').innerHTML,
     viewHidden: (v) => documentObj.getElementById('view-' + v).hidden,
     shell: windowObj.OTBShell,
+    replaced,
   };
 }
 
@@ -155,7 +162,11 @@ test('sidebar groups read by audience, in order', () => {
   // First within the group because it is the one page here you ACT on; the
   // leaderboard and the directory are browsing surfaces. Updating this oracle is
   // the reviewed decision the pin exists to force.
-  assert.deepEqual(nav[2].items.map((i) => i.id), ['collab', 'leaderboard', 'people'], 'Community = everyone else');
+  // task 1003441: `leaderboard` → `roster`. The id changed because the THING
+  // changed: it was a hash view on index.html (href /#leaderboard, view:
+  // 'leaderboard') and is now a real page at /roster labelled Builders. That is
+  // what made this group read as one real page plus a link into the home page.
+  assert.deepEqual(nav[2].items.map((i) => i.id), ['collab', 'roster', 'people'], 'Community = everyone else');
   assert.deepEqual(nav[3].items.map((i) => i.id),
     ['primer', 'ranks', 'economy', 'diagrams', 'atlas', 'modules', 'apidocs'], 'Docs = reference material');
   // 'government' (the Permissions tab, BV1.R113) is the group's one archon-gated item.
@@ -194,6 +205,30 @@ test('group-gate check actually CATCHES a head gated wider than its items', () =
   assert.equal(headOutOfRange({ label: 'X', headGate: 'archon', items: [{ gate: 'archon' }] }), false);
 });
 
+test('#leaderboard REDIRECTS to /roster from the index, and only from the index', () => {
+  // task 1003441: the Roll became a page, so its hash has no host view to
+  // alias onto. Without the redirect viewFromHash returns nothing and route()
+  // leaves the reader on Home — a dead link that looks like it worked, which
+  // is the failure this pins. The nav item points at the page, not the hash.
+  const ids = parseNav(boot().sidebarHtml).flatMap((g) => g.items.map((i) => i.id));
+  assert.ok(!ids.includes('leaderboard'), 'the hash-view nav entry retired with the view');
+  assert.ok(ids.includes('roster'), 'the page took its place');
+
+  const onIndex = boot({ page: 'home', hash: '#leaderboard', pathname: '/' });
+  assert.deepEqual(onIndex.replaced, ['/roster'],
+    'the index answers the retired hash with a replace() to the page');
+
+  // The guard matters: the hash is not this shell’s to interpret on a page
+  // that has no views, and hijacking it there would break an in-page anchor
+  // that happens to be spelled the same.
+  const offIndex = boot({ page: 'settings', hash: '#leaderboard', pathname: '/settings' });
+  assert.deepEqual(offIndex.replaced, [], 'a non-index page redirects nothing');
+
+  // And a hash the map does not name is still left alone entirely.
+  const unknown = boot({ page: 'home', hash: '#nope', pathname: '/' });
+  assert.deepEqual(unknown.replaced, [], 'an unknown hash is not a redirect');
+});
+
 test('Achievements has no nav entry, but #achievements still routes to Standing', () => {
   const ids = parseNav(boot().sidebarHtml).flatMap((g) => g.items.map((i) => i.id));
   assert.ok(!ids.includes('achievements'), 'the nav entry retired with task 2175');

package/tests/hall_page_gate_map.mjs

@@ -79,6 +79,14 @@ const ORACLE = {
 
   // Deliberately UNGATED — the landing card, the rank ladder, the reward
   // schedule and a builder's public portfolio all render for a stranger.
+  //
+  // /roster joins them (task 1003441): it is this project’s own ledger, and its
+  // one data source — GET /leaderboard — is deliberately unauthenticated,
+  // mirroring the public status surface. The page must not be gated tighter than
+  // the API it fronts, which is the same rule that puts /people at
+  // project.curate. It was reachable to a stranger as the #leaderboard view on
+  // the ungated index, so this preserves the audience rather than widening it.
+  '/builders/roster': null,
   '/builders/': null,
   '/builders/ranks': null,
   '/builders/drachmae': null,

package/tests/hall_record_world.mjs

@@ -259,7 +259,7 @@ test('the preview harness can reach both record pages', () => {
 // re-implementation of it.
 const TASK_SRC = read('task.js');
 
-function renderTask(task, { lastClaim = null, viewer = null, goal = null, status = 200 } = {}) {
+function renderTask(task, { lastClaim = null, viewer = null, goal = null, status = 200, search = '', referrer = '' } = {}) {
   const els = new Map();
   const makeEl = () => ({
     dataset: {}, style: {}, textContent: '', hidden: false, disabled: false, _html: '',
@@ -273,6 +273,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, status
   let onReady = null;
   const documentObj = {
     title: 'Task — Cloud Bongos',
+    referrer,
     body: { dataset: { page: 'task' } },
     documentElement: { dataset: {}, style: {}, classList: { add() {}, remove() {} } },
     getElementById(id) { if (!els.has(id)) els.set(id, makeEl()); return els.get(id); },
@@ -302,17 +303,22 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, status
       categoryChip: () => '',
       toast() {},
     },
-    location: { hostname: 'builders.cloudbongos.com', pathname: `/task/${task && task.id ? task.id : '1'}`, origin: 'https://builders.cloudbongos.com', assign() {} },
+    location: { hostname: 'builders.cloudbongos.com', pathname: `/task/${task && task.id ? task.id : '1'}`, search, origin: 'https://builders.cloudbongos.com', assign() {} },
     addEventListener() {},
     confirm: () => true,
     navigator: { clipboard: { writeText: async () => {} } },
   };
-  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Date };
+  const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Date, URL, URLSearchParams };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(TASK_SRC, sandbox, { filename: 'task.js' });
   assert.ok(onReady, 'task.js registers its DOMContentLoaded boot');
-  return { boot: onReady, html: () => documentObj.getElementById('task-body').innerHTML, sub: () => documentObj.getElementById('task-sub').textContent };
+  return {
+    boot: onReady,
+    html: () => documentObj.getElementById('task-body').innerHTML,
+    sub: () => documentObj.getElementById('task-sub').textContent,
+    el: (id) => documentObj.getElementById(id),
+  };
 }
 
 const settle = () => new Promise((r) => setTimeout(r, 0));
@@ -410,3 +416,76 @@ test('the idea grade badge IS the archetype pill, not a private copy of it', ()
   assert.doesNotMatch(decomment(ideaCss), /\.ig-grade(?![\w-])/,
     'idea.css carried a near-verbatim copy of .rec-pill down to the token triples — a hundred lines waiting to drift');
 });
+
+// ---- 10. the way out — the record exits to where it was opened from ----------
+//
+// task 1003468. task.js hardcoded "Open the work board" in three places and
+// task.html's crumb a fourth, so a builder who walked goal → task had only the
+// browser's own Back, and the two failure renders sent them somewhere they had
+// never been. The list that opens a record now writes `?from=` on the link
+// (task-detail.js's href()) and the record offers THAT as its exit — in the
+// crumb before the fetch lands, and in the actions row of every render
+// including the two failures. A same-origin referrer is the fallback for a link
+// written without it; the board is the fallback for a reader with no history.
+// Every value is honoured only as a path on this host.
+
+const FROM_GOAL = '?from=' + encodeURIComponent('/goals#/goal/1000081');
+
+test('opened from a goal, the record exits to that goal — crumb and actions row alike', async () => {
+  const r = renderTask(BASE_TASK, { search: FROM_GOAL });
+  await r.boot(); await settle();
+  assert.match(r.html(), /<a class="td-btn" href="\/goals#\/goal\/1000081">Back to goal 1000081<\/a>/);
+  assert.doesNotMatch(r.html(), /Open the work board/, 'the hardcoded exit is gone from the happy path');
+  assert.equal(r.el('task-back').href, '/goals#/goal/1000081', 'the crumb points at the goal');
+  assert.equal(r.el('task-back-label').textContent, 'Back to goal 1000081');
+});
+
+test('opened from the board, the exit is the board — on the tab it was opened from', async () => {
+  const r = renderTask(BASE_TASK, { search: '?from=' + encodeURIComponent('/work#backlog') });
+  await r.boot(); await settle();
+  assert.match(r.html(), /href="\/work#backlog">Back to the work board</);
+});
+
+test('without ?from=, a same-origin referrer is the way back', async () => {
+  const r = renderTask(BASE_TASK, { referrer: 'https://builders.cloudbongos.com/sessions?page=2' });
+  await r.boot(); await settle();
+  assert.match(r.html(), /href="\/sessions\?page=2">Back to sessions</);
+});
+
+test('a cross-origin referrer, a broken one, or none, falls back to the work board', async () => {
+  for (const referrer of ['', 'https://example.org/elsewhere', 'not a url']) {
+    const r = renderTask(BASE_TASK, { referrer });
+    await r.boot(); await settle();
+    assert.match(r.html(), /href="\/work">Back to the work board</, `referrer ${JSON.stringify(referrer)}`);
+    assert.equal(r.el('task-back').href, '/work');
+  }
+});
+
+test('a hostile or useless ?from= is refused, never followed', async () => {
+  const bad = [
+    '//evil.example', '/\\evil.example', 'javascript:alert(1)', 'https://evil.example/x',
+    '/api/gds/auth/web/callback', '/lib/bongos-client.js',
+    '/task/1003305',          // this same record — a loop, not a way back
+    'work', '/ work', '',
+  ];
+  for (const from of bad) {
+    const r = renderTask(BASE_TASK, { search: '?from=' + encodeURIComponent(from) });
+    await r.boot(); await settle();
+    assert.match(r.html(), /href="\/work">Back to the work board</, `from=${JSON.stringify(from)}`);
+    assert.equal(r.el('task-back').href, '/work', `the crumb refuses from=${JSON.stringify(from)} too`);
+  }
+});
+
+test('the two honest failures exit the same way the record does', async () => {
+  for (const status of [404, 500]) {
+    const r = renderTask(BASE_TASK, { status, search: FROM_GOAL });
+    await r.boot(); await settle();
+    assert.match(r.html(), /href="\/goals#\/goal\/1000081">Back to goal 1000081</, `status ${status}`);
+    assert.doesNotMatch(r.html(), /Open the work board/, `status ${status} still hardcodes the board`);
+  }
+});
+
+test('the crumb is an element task.js can point, with its label apart from the icon', () => {
+  assert.match(taskHtml, /<a class="rec-back" id="task-back" href="\/work">/, 'the static href is the fallback the page ships with');
+  assert.match(taskHtml, /<span id="task-back-label">Back to tasks<\/span>/, 'the label is its own node, so the icon survives a relabel');
+});

package/tests/rank_tier_single_source.mjs

@@ -127,7 +127,12 @@ test('static ladder copies carry the exact canonical ladder', () => {
 // task 1003206 carved the hall page scripts up; the rank tier maps travelled with
 // the renderers that read them, so the pin and the allowlist follow the code.
 const HALL_SCRIPTS = ['modules/hall-ui/public/builders.js', 'modules/hall-ui/public/goals-page.js',
-  'modules/hall-ui/public/hall-render.js', 'modules/hall-ui/public/goals-render.js'];
+  'modules/hall-ui/public/hall-render.js', 'modules/hall-ui/public/goals-render.js',
+  // task 1003441: the Builders page ranks the roster and draws a rank badge, so
+  // it needs both the tier order (its `rank` sort lens) and the known-rank test
+  // (the badge variant class). Browser code cannot require db-kernel, so it takes
+  // the pinned-copy shape builders.js already takes.
+  'modules/hall-ui/public/roster.js'];
 // Filtered INSIDE the test, not at module scope: extractRankMaps is declared
 // further down, so calling it up here is a temporal-dead-zone crash.
 const staticMapFiles = () => HALL_SCRIPTS.filter(
@@ -160,6 +165,8 @@ const MAP_ALLOWLIST = new Set([
   // into goals-render.js — so goals-page.js is pruned and hall-render.js is never
   // added. The allowlist fails on a stale entry, which is the check working.
   'modules/hall-ui/public/goals-render.js',
+  // task 1003441 — see the HALL_SCRIPTS note above: pinned, not unchecked.
+  'modules/hall-ui/public/roster.js',
 ]);
 // Where a rank-ladder array literal is allowed to exist.
 const LADDER_ALLOWLIST = new Set([