@bongos/core 1.19.493 → 1.19.495

package/tests/redteam_followup_kind.mjs

@@ -0,0 +1,44 @@
+// tests/redteam_followup_kind.mjs — task 1003452.
+//
+// /builder-redteam's optional follow-up idea_inbox POST filed kind:'security-finding',
+// which is not in idea_inbox's CHECK constraint (migrations/042_criterion_proposal_workflow.sql
+// mirrored at modules/ideas/inbox.js VALID_KINDS) — the POST 400s every time, and because
+// the primary vulnerability_reports write already succeeded, the failure is silent (the
+// report lands, the fix idea never files). Fixed by filing kind:'bug' instead — a red-team
+// finding is a bug in the platform's own walls.
+//
+// Static: reads the skill's own committed idea.json shape (CRLF-normalised) and asserts the
+// kind it files is a real member of the enum, imported (not duplicated) from the module that
+// owns it — so a future enum change or a re-broken skill both fail this test honestly.
+//
+// Run:  node --test --test-reporter=tap tests/redteam_followup_kind.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { VALID_KINDS } from '../modules/ideas/inbox.js';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SKILL_MD = path.join(ROOT, '.claude', 'skills', 'builder-redteam', 'SKILL.md');
+
+function readNormalized(p) {
+  return fs.readFileSync(p, 'utf8').replace(/\r\n/g, '\n');
+}
+
+test('the follow-up idea.json files a kind that is a real member of VALID_KINDS', () => {
+  const md = readNormalized(SKILL_MD);
+  const m = md.match(/"kind":\s*"([^"]+)"/);
+  assert.ok(m, 'SKILL.md must show the literal idea.json shape with a "kind" field');
+  const filedKind = m[1];
+  assert.ok(
+    VALID_KINDS.includes(filedKind),
+    `SKILL.md files kind:'${filedKind}', which is not in VALID_KINDS (${VALID_KINDS.join(', ')})`
+  );
+});
+
+test('SKILL.md does not still describe the dead kind=\'security-finding\' value anywhere', () => {
+  const md = readNormalized(SKILL_MD);
+  assert.doesNotMatch(md, /security-finding/, 'the invalid kind must not linger in prose either');
+});