@bongos/core 1.19.579 → 1.19.581

package/tests/applicant_profile_read_bounds.mjs

@@ -0,0 +1,95 @@
+// tests/applicant_profile_read_bounds.mjs — the one hub call that FANS OUT is
+// bounded in time (task 1003681, from a grader finding).
+//
+// THE DEFECT. `readApplicantProfileFromHub()` had no timeout on its fetch to the
+// hub. Its own doc-comment already promised the outcome — "a queue that fails to
+// load because the hub is slow is a broken one" — but nothing enforced it.
+//
+// WHY IT MATTERS MORE HERE THAN FOR ITS TWO SIBLINGS. reportMembershipCheckIn
+// and reportActivityRollup fire at most once per sign-in or per ship. This one
+// runs up to MAX_LIVE_PROFILE_READS (25) times CONCURRENTLY inside the
+// Promise.all that `GET /access-requests` awaits before responding (D7 resolves
+// the profile live on every render, deliberately — a snapshot would keep
+// publishing a consent since withdrawn). So one unresponsive hub held the whole
+// reviewer queue open for as long as the sockets lived, 25 at a time.
+//
+// The fix is a bound, not a behaviour change: every other failure mode here
+// already answers `null`, so a timeout simply joins them.
+//
+// DB-free and network-free: auth-config is pinned in require.cache so the
+// federation config resolves without env, and global fetch is a spy.
+//
+// Run:  node --test --test-reporter=tap tests/applicant_profile_read_bounds.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// Pin the federation config BEFORE auth-admission loads, so loadIdpConfig()
+// answers without HUB_* env (the tests/profile_route.mjs require.cache idiom).
+const cfgPath = require.resolve('../src/bongos/auth-config.js');
+const realCfg = require('../src/bongos/auth-config.js');
+require.cache[cfgPath] = {
+  id: cfgPath,
+  filename: cfgPath,
+  loaded: true,
+  exports: {
+    ...realCfg,
+    loadIdpConfig: () => ({ origin: 'https://hub.example', clientId: 'cid', clientSecret: 'sec' }),
+  },
+};
+
+const admission = require('../src/bongos/auth-admission.js');
+
+function withFetch(impl, run) {
+  const real = globalThis.fetch;
+  globalThis.fetch = impl;
+  return Promise.resolve(run()).finally(() => { globalThis.fetch = real; });
+}
+
+test('the hub read carries an abort signal — the queue can never wait on it forever', async () => {
+  // Arrange
+  let seen = null;
+  const ok = { ok: true, json: async () => ({ profile: { bio: 'hi' } }) };
+
+  // Act
+  const profile = await withFetch(async (_url, init) => { seen = init; return ok; },
+    () => admission.readApplicantProfileFromHub(42));
+
+  // Assert
+  assert.deepEqual(profile, { bio: 'hi' }, 'the happy path still returns the hub’s view');
+  assert.ok(seen, 'fetch was called');
+  assert.ok(seen.signal, 'an AbortSignal must be passed — without one the call is unbounded');
+  assert.equal(typeof seen.signal.aborted, 'boolean', 'and it must be a real AbortSignal');
+  assert.equal(seen.signal.aborted, false, 'not already aborted when the request goes out');
+});
+
+test('a timed-out hub answers null, exactly like every other failure here', async () => {
+  // Arrange — what AbortSignal.timeout produces when the budget expires
+  const abortErr = Object.assign(new Error('This operation was aborted'), { name: 'TimeoutError' });
+
+  // Act
+  const profile = await withFetch(async () => { throw abortErr; },
+    () => admission.readApplicantProfileFromHub(42));
+
+  // Assert — a degraded queue, never a broken one
+  assert.equal(profile, null, 'an abort must fail soft to null, not reject into the route');
+});
+
+test('the timeout is a real, small budget — a 25-wide fan-out cannot outlive it', () => {
+  // Structural: the constant is the bound the route inherits, so it is pinned
+  // rather than measured (a real 5s wait would make this suite sleep).
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'auth-admission.js'), 'utf8');
+  const m = /const APPLICANT_PROFILE_TIMEOUT_MS = (\d+);/.exec(src);
+  assert.ok(m, 'the budget must be a named constant, not an inline number');
+  const ms = Number(m[1]);
+  assert.ok(ms > 0 && ms <= 10000, `the budget must be small and real (got ${ms}ms)`);
+  assert.match(src, /signal: AbortSignal\.timeout\(APPLICANT_PROFILE_TIMEOUT_MS\)/,
+    'and the fetch must actually use it — the constant alone bounds nothing');
+});

package/tests/cli_surface.mjs

@@ -0,0 +1,146 @@
+// tests/cli_surface.mjs — the CLI addresses the reader it actually has (task 1003680).
+//
+// Two obligations, and the second is the one that could silently break the whole methodology:
+//
+//  1. A terminal reader never sees output written to a model — no `[otb-card]` directive, no
+//     `/builder-*` slash command (those exist only inside Claude Code), no raw markdown link.
+//
+//  2. The AGENT shape is unchanged. The skills and the card-delivery hook relay `start.js`'s
+//     stdout verbatim and branch on its first character; a stray difference there breaks the card
+//     contract for every session. So the agent cases below assert the exact old strings.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const surface = require(path.join(REPO_ROOT, 'scripts', 'gds', 'surface.js'));
+
+const AGENT_ENV = {};
+const TERM_ENV = { BONGOS_SURFACE: 'terminal' };
+
+// ── 1. The signal itself ────────────────────────────────────────────────────────────────────
+
+test('agent is the default — nothing changes unless something opts out', () => {
+  assert.equal(surface.resolveSurface({}), 'agent');
+  assert.equal(surface.resolveSurface({ BONGOS_SURFACE: '' }), 'agent');
+  assert.equal(surface.resolveSurface({ BONGOS_SURFACE: 'nonsense' }), 'agent');
+  assert.equal(surface.isTerminal({}), false);
+});
+
+test('terminal is opt-in, case- and space-insensitive', () => {
+  assert.equal(surface.resolveSurface({ BONGOS_SURFACE: 'terminal' }), 'terminal');
+  assert.equal(surface.resolveSurface({ BONGOS_SURFACE: '  TERMINAL  ' }), 'terminal');
+  assert.equal(surface.isTerminal(TERM_ENV), true);
+});
+
+test('the surface is never inferred from isTTY', () => {
+  // A Claude Code session's stdout is not a TTY either, so TTY-sniffing would classify every
+  // agent run as a terminal and break the card contract. The module must not consult it.
+  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'surface.js'), 'utf8');
+  const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+  assert.ok(!/isTTY/.test(code), 'surface.js must not branch on isTTY');
+});
+
+// ── 2. What each reader gets ────────────────────────────────────────────────────────────────
+
+test('actions name a command the reader can actually run', () => {
+  assert.equal(surface.action('ship', 123, AGENT_ENV), '/builder-ship 123');
+  assert.equal(surface.action('ship', 123, TERM_ENV), 'bongos ship 123');
+  assert.equal(surface.action('start', null, AGENT_ENV), '/builder-start');
+  assert.equal(surface.action('start', null, TERM_ENV), 'bongos start');
+});
+
+test('task refs stay hall links for agents and go plain for terminals', () => {
+  const url = 'https://example.com/builders#/task/';
+  assert.equal(surface.taskRef(7, url, AGENT_ENV), '[#7](https://example.com/builders#/task/7)');
+  assert.equal(surface.taskRef(7, url, TERM_ENV), '#7');
+});
+
+test('emphasis is markdown for agents and bare text for terminals', () => {
+  assert.equal(surface.strong('hi', AGENT_ENV), '**hi**');
+  assert.equal(surface.strong('hi', TERM_ENV), 'hi');
+  assert.equal(surface.em('hi', AGENT_ENV), '_hi_');
+  assert.equal(surface.em('hi', TERM_ENV), 'hi');
+  assert.equal(surface.code('x', AGENT_ENV), '`x`');
+  assert.equal(surface.code('x', TERM_ENV), 'x');
+});
+
+test('the agent table is still GitHub-flavoured markdown, byte for byte', () => {
+  const out = surface.table(['#', 'What'], [['a', 'b']], AGENT_ENV);
+  assert.equal(out, '| # | What |\n|---|---|\n| a | b |');
+});
+
+test('the terminal table aligns into columns with no pipe soup', () => {
+  const out = surface.table(['#', 'What'], [['1', 'short'], ['22', 'a longer one']], TERM_ENV);
+  const lines = out.split('\n');
+  assert.ok(!out.includes('|'), `no pipes in a terminal table:\n${out}`);
+  assert.ok(!/\|---/.test(out), 'no markdown separator row');
+  assert.match(lines[1], /^─+ {2}─+$/, 'a rule under the header');
+  // Column two must start at the same offset on every row.
+  const col2 = lines.filter((_, i) => i !== 1).map((l) => l.indexOf(l.trim().split(/\s{2,}/)[1]));
+  assert.equal(new Set(col2).size, 1, `column 2 misaligned:\n${out}`);
+});
+
+test('no trailing whitespace on a terminal row', () => {
+  const out = surface.table(['a', 'bbbb'], [['x', 'y']], TERM_ENV);
+  for (const line of out.split('\n')) assert.ok(!/\s$/.test(line), `trailing space: ${JSON.stringify(line)}`);
+});
+
+// ── 3. The call sites ───────────────────────────────────────────────────────────────────────
+
+test('start.js routes every reader-facing idiom through the surface', () => {
+  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'start.js'), 'utf8');
+  const code = src.split('\n').filter((l) => !l.trim().startsWith('//')).join('\n');
+
+  // Two exemptions, both agent-only BY CONSTRUCTION:
+  //   • CARD_DIRECTIVE describes the card TO the model, so naming the slash command is correct.
+  //   • the `--widget` HTML renderer only ever runs for a session with show_widget; its markup
+  //     is identifiable by hesc()/class="bs-" and never reaches a terminal.
+  const scanned = code
+    .replace(/const CARD_DIRECTIVE = \{[\s\S]*?\};/, '')
+    .split('\n')
+    .filter((l) => !l.includes('hesc(') && !l.includes('class="bs-'))
+    .join('\n');
+  const slashes = [...scanned.matchAll(/\/builder-[a-z-]+/g)].map((m) => m[0]);
+  assert.deepEqual(slashes, [], `hard-coded slash commands left in start.js: ${slashes.join(', ')}`);
+
+  // A hall link built by hand would bypass the switch.
+  const rawRefs = [...code.matchAll(/\[#\$\{[^}]+\}\]\(/g)].map((m) => m[0]);
+  assert.deepEqual(rawRefs, [], 'hand-built markdown task links left in start.js');
+});
+
+test('the card directive is suppressed for a terminal reader', () => {
+  const src = require('node:fs').readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'start.js'), 'utf8');
+  assert.match(
+    src,
+    /function emitCardDirective\(form\) \{[\s\S]{0,400}?surface\.isTerminal\(\)\) return;/,
+    'emitCardDirective must return early on a terminal surface',
+  );
+});
+
+test('only the dispatchers declare the terminal surface', () => {
+  const fs = require('node:fs');
+  const dispatcher = fs.readFileSync(path.join(REPO_ROOT, 'bin', 'bongos.js'), 'utf8');
+  assert.match(dispatcher, /BONGOS_SURFACE: 'terminal'/, 'bin/bongos.js must mark verb spawns as terminal');
+
+  // `exec` is the agent's escape hatch into a core script and must NOT be marked.
+  const execLine = dispatcher.split('\n').find((l) => l.includes('args.slice(2)') && l.includes('spawnSync'));
+  assert.ok(execLine, 'could not find the exec spawn');
+  assert.ok(!execLine.includes('BONGOS_SURFACE'), '`bongos exec` must stay on the agent surface');
+
+  const builder = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', 'build-cli-package.js'), 'utf8');
+  assert.match(builder, /BONGOS_SURFACE: 'terminal'/, 'the generated dispatcher must mark spawns as terminal');
+  assert.match(builder, /'scripts\/gds\/surface\.js'/, 'surface.js must ship in the package');
+});
+
+test('the skills still invoke the scripts directly, which is what keeps agents on the agent surface', () => {
+  // If a skill ever routed through `bongos <verb>`, it would silently inherit the terminal
+  // surface and the card contract would break with no test failing anywhere else.
+  const fs = require('node:fs');
+  const skill = fs.readFileSync(path.join(REPO_ROOT, '.claude', 'skills', 'builder-start', 'SKILL.md'), 'utf8');
+  assert.match(skill, /node scripts\/gds\/start\.js/, 'builder-start must call the script directly');
+});

package/tests/module_api.mjs

@@ -38,6 +38,7 @@ const PUBLISHED_SURFACE = [
   'resolveRotDays', 'projectSettings', // added by task 1003279 (ADR 0232; goal 1000072): the ROT timer + the live knob store behind it. A DIFFERENT question from the stale-claim timer above — days not hours, DB not env, work nobody picked up rather than a builder who went quiet, and it only ever ASKS a human where that one ACTS. Both ride the doorway so no module hardcodes either.
   'joinabilityMode', // added by task 1003044 (ADR 0194; the carrier after 1.19.374): the project's membership door, one reader for the sign-in gate AND the onboarding module's public POST
   'projectJoinDoor', // added by task 1002331 (ADR 0182 D6 / ADR 0247): the COMPOSED join/apply door — visibility × join grant × joinability, one answer, so a module reading a single knob cannot re-open a door the other two closed
+  'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',
   'on', 'emit', 'emitAsync', 'listEvents', 'seamSnapshot',

package/tests/recruiter_sliver_boundary.mjs

@@ -803,6 +803,25 @@ test('each route spells its OWN gate in its OWN middleware list', () => {
 // 7. IT GRANTS NOTHING (ADR 0016)
 // ===========================================================================
 
+// The first-party files allowed to read the sliver module, each with the reason
+// it is not a DECIDER. The list is the assertion: a new name here is a claim
+// that must be argued, not a line added to make a red test green.
+//
+//   routes/scouting.js       serializes the sliver onto its one archon-gated
+//                            route. The original sole reader.
+//   applicant-profile.js     reuses the PROJECTION for the D7 applicant view
+//                            (task 1002972) and supplies its own consent floor —
+//                            see sliverShapeFor's contract. Sharing the
+//                            projection is what keeps D7's "no new disclosure
+//                            class" literally true: the alternative was a second
+//                            five-key object free to drift from this one field
+//                            by field, which this whitelist proof would not
+//                            cover. It reads the shape; it decides nothing.
+const SLIVER_READERS = [
+  'modules/platform-identity/applicant-profile.js',
+  'modules/platform-identity/routes/scouting.js',
+];
+
 test('the sliver module is read by exactly one first-party server file — the one that serializes it', () => {
   const files = [];
   const walk = (dir) => {
@@ -817,8 +836,22 @@ test('the sliver module is read by exactly one first-party server file — the o
   const readers = files
     .filter((f) => /require\(\s*['"][^'"]*recruiter-sliver['"]\s*\)/.test(fs.readFileSync(f, 'utf8')))
     .map((f) => path.relative(ROOT, f).split(path.sep).join('/'));
-  assert.deepEqual(readers, ['modules/platform-identity/routes/scouting.js'],
-    'nothing may consult the sliver to DECIDE anything: cross-project numbers are descriptive analytics, never authority (ADR 0016)');
+  assert.deepEqual(readers, SLIVER_READERS,
+    'nothing may consult the sliver to DECIDE anything: cross-project numbers are descriptive analytics, never authority (ADR 0016). '
+    + 'A new reader needs a stated reason in SLIVER_READERS — and it must serialize the shape, never branch on it.');
+
+  // The reason each allowance rests on, enforced rather than trusted: a reader
+  // may PROJECT the sliver, never READ A VALUE OUT OF IT to decide something. A
+  // comparison against a sliver field is what "authority" would look like here,
+  // so the shape of that mistake is what this refuses.
+  for (const rel of SLIVER_READERS) {
+    const code = fs.readFileSync(path.join(ROOT, rel), 'utf8')
+      .replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
+    for (const key of SLIVER_KEYS) {
+      assert.doesNotMatch(code, new RegExp(`\\.${key}\\s*(?:===|!==|==|!=|>|<)`),
+        `${rel} compares a sliver's \`${key}\` — a reader that BRANCHES on this data is consulting descriptive analytics as authority (ADR 0016)`);
+    }
+  }
 });
 
 test('no rank, role, permission or membership travels with the sliver, under any name', async () => {

package/tests/watch_applications_queue.mjs

@@ -378,4 +378,98 @@ await test('the section lede tells the owner the queue is more than one decision
   assert.match(h.lede(), /decided/i);
 });
 
+// ===========================================================================
+// The applicant's own profile beside their ask (task 1002972, privacy spec D7)
+// ===========================================================================
+//
+// The SERVER decides what may be disclosed — tests/applicant_profile_boundary.mjs
+// is that proof. What is asserted HERE is the half a reviewer actually sees: that
+// the row draws whichever shape it was handed, draws NOTHING when handed null,
+// and escapes the applicant's own words. A source-text assertion cannot see any
+// of that; this runs the real watch.js over the real markup.
+
+const PUBLIC_PROFILE = {
+  view: 'public',
+  account: {
+    handle: 'mona', github_login: 'octocat', display_name: 'Mona Lisa',
+    avatar_url: 'https://avatars.githubusercontent.com/u/583231?v=4',
+    member_since: '2025-01-01T00:00:00Z', bio: 'I draw maps.', links: null,
+  },
+  cross_project: {
+    totals: { projects: 3, credits: 4200, works_shipped: 41, karma: 7 },
+    disciplines: ['engineer', 'artist'], last_active: '2026-08-30T00:00:00Z',
+    projects: [], more_projects: 0,
+  },
+};
+const SLIVER_PROFILE = {
+  view: 'sliver',
+  sliver: { handle: 'quiet', display_name: 'Quiet Person', avatar_url: null, disciplines: ['engineer'], active_recently: true },
+};
+const withProfile = (profile, over = {}) => [{ ...WAITING[0], profile, ...over }];
+
+await test('a PUBLIC applicant renders their record beside the ask', async () => {
+  const h = await boot({ rows: { pending: withProfile(PUBLIC_PROFILE), invited: [], dismissed: [] } });
+  const block_ = h.rows()[0].querySelector('.ov-row__profile');
+  assert.ok(block_, 'the public applicant view rendered no profile block at all');
+  const text = block_.textContent;
+  assert.match(text, /I draw maps\./, 'the bio is part of what the public page already shows');
+  assert.match(text, /3 projects/);
+  assert.match(text, /41 shipped/);
+  assert.match(text, /engineer/);
+});
+
+await test('a PRIVATE applicant renders the sliver AND says why it is thin', async () => {
+  const h = await boot({ rows: { pending: withProfile(SLIVER_PROFILE), invited: [], dismissed: [] } });
+  const block_ = h.rows()[0].querySelector('.ov-row__profile');
+  assert.ok(block_, 'the sliver rendered no profile block');
+  const text = block_.textContent;
+  assert.match(text, /Private account/,
+    'a reviewer must not read the thinness as a poor record — it is a boundary, and applying is what opened even this much');
+  assert.match(text, /engineer/);
+  assert.match(text, /Active recently/);
+});
+
+await test('hidden stats: a public applicant keeps their name and says the record is hidden', async () => {
+  const hidden = { ...PUBLIC_PROFILE, cross_project: null };
+  const h = await boot({ rows: { pending: withProfile(hidden), invited: [], dismissed: [] } });
+  const text = h.rows()[0].querySelector('.ov-row__profile').textContent;
+  assert.match(text, /hides their cross-project record/,
+    'a blank would read as "this applicant has done nothing", which is a different claim entirely');
+});
+
+await test('NO profile is not an error — the row renders exactly as it always did', async () => {
+  const h = await boot({ rows: { pending: withProfile(null), invited: [], dismissed: [] } });
+  const row = h.rows()[0];
+  assert.equal(row.querySelector('.ov-row__profile'), null,
+    'null covers unvouched, no hub, hub down and hidden alike — none of them may draw a box');
+  assert.ok(row.querySelector('.fact-pill'), 'and the vouch pill still says whether anyone confirmed the name');
+  assert.match(row.textContent, /octocat/);
+});
+
+await test('an unrecognised view shape draws nothing rather than guessing', async () => {
+  const h = await boot({ rows: { pending: withProfile({ view: 'everything', account: { bio: 'x' } }), invited: [], dismissed: [] } });
+  assert.equal(h.rows()[0].querySelector('.ov-row__profile'), null,
+    'a shape this page does not know is a shape it must not render — fail closed');
+});
+
+await test('an applicant own words are ESCAPED, never linkified (the render contract)', async () => {
+  const nasty = {
+    ...PUBLIC_PROFILE,
+    account: { ...PUBLIC_PROFILE.account, bio: '<img src=x onerror=alert(1)>ping http://evil.example' },
+  };
+  const h = await boot({ rows: { pending: withProfile(nasty), invited: [], dismissed: [] } });
+  const block_ = h.rows()[0].querySelector('.ov-row__profile');
+  assert.equal(block_.querySelectorAll('img').length, 0, 'a bio is user content on a page an Archon reads');
+  assert.equal(block_.querySelectorAll('a').length, 0, 'the contract says never linkify — an Archon must not be handed a one-click link a stranger wrote');
+  assert.match(block_.textContent, /evil\.example/, 'the text itself is still shown, just inert');
+});
+
+await test('the profile changes what the row SAYS, never what it offers (ADR 0016)', async () => {
+  const rich = await boot({ rows: { pending: withProfile(PUBLIC_PROFILE), invited: [], dismissed: [] } });
+  const bare = await boot({ rows: { pending: withProfile(null), invited: [], dismissed: [] } });
+  const actionsOf = (h) => [...h.rows()[0].querySelectorAll('button')].map((b) => b.textContent.trim()).sort();
+  assert.deepEqual(actionsOf(rich), actionsOf(bare),
+    'a rich record is not a reason to admit and an empty one is not a reason to refuse — the decisions must be identical');
+});
+
 summary();