@bongos/core 1.19.583 → 1.19.585

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.583",
+  "version": "1.19.585",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/src/module-api.js

@@ -55,7 +55,7 @@ const { buildInfo } = require('./build-info');
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.583'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.585'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/hub_map_orb_states.mjs

@@ -0,0 +1,255 @@
+// tests/hub_map_orb_states.mjs — the hub map draws the VISIBILITY render-type,
+// EXECUTED (BV1.R09, task 1002328; ADR 0182 D1/D2a, criterion proj-visibility-states).
+//
+// R06 (task 1002325) made the feed answer what each project draws as — `orb` is
+// planet / star / black-hole, derived server-side from the join door, with stealth
+// rows redacted before they leave the server and dark matter excluded in SQL. R07
+// (task 1002326) dogfooded it on the Explore page. This file pins the surface a
+// visitor actually lands on: the hub map at modules/public-landing/public/projects.html,
+// in both its views — the sky and the table.
+//
+// The original R09 scoped this to a separate-repo static gate site; that gate was
+// retired (src/platform-server.js: the apex 302 into /gate/ "is gone with the gate
+// itself"), and the orb sky became a view inside the hub. So the criterion's last
+// clause lands here.
+//
+// Harness: the tests/project_door_ui.mjs pattern — there is no jsdom in this repo,
+// so the real region is sliced out of the page verbatim, run in a vm under a narrow
+// DOM stub, and the markup it writes is parsed back. Both slice boundaries are
+// asserted so a rename can never leave this file executing an empty string.
+//
+// What it proves, and why each matters:
+//   • the three states draw as three different things — a private project stopped
+//     being indistinguishable from a public one
+//   • a black hole is drawn from NOTHING but its existence: no name, no address,
+//     no per-project artwork, and nothing to click. The server already redacted the
+//     row; this asserts the page cannot re-identify it from what it kept
+//   • an unrecognised render-type is DROPPED, not drawn — the fail-closed choice
+//     projects-feed.js makes for the same question, so a fourth state added later
+//     can never inherit the public planet
+//   • the mapping is never re-derived client-side from `state` — one copy, server-side
+//   • the search box cannot surface a black hole
+//   • the viewer's OWN provisioning rows, which carry no feed `orb`, still draw —
+//     fail-closed must not delete the owner's own sky
+//
+// Run:  node --test --test-reporter=tap tests/hub_map_orb_states.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8');
+const SCRIPT = (HUB.match(/<script>([\s\S]*?)<\/script>\s*<\/body>/) || [, ''])[1];
+
+// ── the region under test, sliced verbatim ───────────────────────────────────
+const START = SCRIPT.indexOf('var ORB_SLOTS = [');
+const END = SCRIPT.indexOf('function applyMapFilter(');
+assert.ok(START > 0, 'the map-render region must start at ORB_SLOTS');
+assert.ok(END > START, 'the map-render region must end before applyMapFilter');
+const REGION = SCRIPT.slice(START, END);
+for (const fn of ['var ORB_STATE = {', 'function drawableCatalogRow(', 'function renderOrbs(', 'function renderRows(']) {
+  assert.ok(REGION.includes(fn), `the region must carry ${fn}`);
+}
+
+// planetAttrs() lives further down the page (it is shared with the manage cards),
+// so it is sliced in rather than re-typed — a hand-copied stub would drift from the
+// thing whose output this file asserts about.
+const PA_START = SCRIPT.indexOf('function planetAttrs(');
+const PA_END = SCRIPT.indexOf('var PLANET_SHAPE_WORDS');
+assert.ok(PA_START > 0 && PA_END > PA_START, 'planetAttrs must still be sliceable');
+const PLANET_ATTRS = SCRIPT.slice(PA_START, PA_END);
+
+// ── the DOM stub ─────────────────────────────────────────────────────────────
+// Narrow on purpose: it supports exactly what the region touches, so it stays
+// honest about what it can prove.
+
+function makeNode(tag) {
+  return {
+    tagName: String(tag).toUpperCase(),
+    _attrs: {},
+    _children: [],
+    className: '',
+    tabIndex: 0,
+    style: { cssText: '' },
+    innerHTML: '',
+    setAttribute(k, v) { this._attrs[k] = String(v); },
+    getAttribute(k) { return Object.prototype.hasOwnProperty.call(this._attrs, k) ? this._attrs[k] : null; },
+    hasAttribute(k) { return Object.prototype.hasOwnProperty.call(this._attrs, k); },
+    appendChild(n) { this._children.push(n); return n; },
+    querySelectorAll() { return []; },
+  };
+}
+
+function boot() {
+  const sky = makeNode('div');
+  let rowsHtml = '';
+  const rows = makeNode('ul');
+  rows.insertAdjacentHTML = (_where, html) => { rowsHtml += html; };
+
+  const els = { skyCam: sky, mapRows: rows };
+  const sandbox = {
+    // safeHttpUrl() (inside the region) scheme-checks through the URL parser — a vm
+    // context has no globals of its own, so it is handed the real one
+    URL,
+    document: { createElement: makeNode, getElementById: (id) => els[id] || null },
+    $: (id) => els[id] || null,
+    esc: (s) => String(s == null ? '' : s).replace(/[&<>"']/g, (c) => (
+      { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c])),
+    productName: 'Cloud Bongos',
+    // the surrounding page's own helpers, narrowed to what the region reads back
+    chipFor: () => '<span class="chip"></span>',
+    hallGlyphHtml: () => '',
+    shippedFigure: () => '',
+    listedDate: (iso) => String(iso),
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(PLANET_ATTRS + '\n' + REGION, sandbox);
+  return {
+    sandbox,
+    sky,
+    rowsHtml: () => rowsHtml,
+    orbs: () => sky._children,
+  };
+}
+
+// A feed row as the server actually shapes it (projects-feed.js): `state` and `orb`
+// on every row, and a stealth row nulled down to those two keys.
+const PUBLIC_ROW = {
+  origin: 'https://demo.example.com', name: 'Demo', tagline: 'a demo project',
+  art_url: null, created_at: '2026-01-01T00:00:00.000Z', builders: 3, tags: [],
+  type: null, state: 'public', orb: 'planet',
+};
+const PRIVATE_ROW = {
+  origin: 'https://circles.example.com', name: 'Circles', tagline: 'invite only',
+  art_url: null, created_at: '2026-01-02T00:00:00.000Z', builders: 2, tags: [],
+  type: null, state: 'private', orb: 'star',
+};
+const STEALTH_ROW = {
+  origin: null, name: null, tagline: null, art_url: null, created_at: null,
+  builders: null, tags: null, type: null, state: 'stealth', orb: 'black-hole',
+};
+
+test('the three states draw as three different orbs', () => {
+  const h = boot();
+  h.sandbox.renderOrbs([PUBLIC_ROW, PRIVATE_ROW, STEALTH_ROW], []);
+  const drawn = h.orbs();
+  assert.equal(drawn.length, 3, 'every drawable row reaches the sky');
+  assert.deepEqual(drawn.map((n) => n.getAttribute('data-orb')),
+    ['planet', 'star', 'black-hole'],
+    'each orb carries the render-type the feed derived');
+});
+
+test('a public project keeps its planet: name, address and artwork', () => {
+  const h = boot();
+  h.sandbox.renderOrbs([PUBLIC_ROW], []);
+  const [orb] = h.orbs();
+  assert.equal(orb.tagName, 'A', 'a public project is a real link');
+  assert.equal(orb.href, 'https://demo.example.com/');
+  assert.match(orb.innerHTML, /Demo/, 'it is named');
+  assert.ok(orb.getAttribute('data-template'), 'it carries its planet artwork');
+});
+
+test('a private project is a star, and is still itself', () => {
+  const h = boot();
+  h.sandbox.renderOrbs([PRIVATE_ROW], []);
+  const [orb] = h.orbs();
+  assert.equal(orb.getAttribute('data-orb'), 'star');
+  // identified, per ADR 0182 D1: private is on the map UNDER ITS NAME — what
+  // changes is the door, not the anonymity
+  assert.match(orb.innerHTML, /Circles/);
+  assert.equal(orb.href, 'https://circles.example.com/');
+  assert.ok(orb.getAttribute('data-template'), 'it keeps its planet artwork');
+});
+
+test('a black hole is existence without identity — nothing to read, nothing to click', () => {
+  const h = boot();
+  h.sandbox.renderOrbs([STEALTH_ROW], []);
+  const [orb] = h.orbs();
+  assert.equal(orb.getAttribute('data-orb'), 'black-hole');
+  assert.notEqual(orb.tagName, 'A', 'a black hole is not a link — there is nowhere to go');
+  assert.ok(!orb.href, 'and it carries no address');
+  assert.equal(orb.getAttribute('data-origin'), null, 'not even as a data attribute');
+  // no per-project artwork: the shape/material walk is an IDENTITY the page
+  // assigns, and assigning one to a black hole would make interchangeable rows
+  // individually recognisable across snapshots
+  for (const a of ['data-template', 'data-shape', 'data-material', 'data-style']) {
+    assert.equal(orb.getAttribute(a), null, `a black hole must not carry ${a}`);
+  }
+  assert.doesNotMatch(orb.innerHTML, /class="badge"|class="chip"/, 'no badge, no liveness chip');
+});
+
+test('an unrecognised render-type is dropped, not drawn (fail-closed)', () => {
+  const { sandbox } = boot();
+  for (const orb of ['planet', 'star', 'black-hole']) {
+    assert.equal(sandbox.drawableCatalogRow({ orb }), true, `${orb} is drawable`);
+  }
+  // the shape of the risk: a fourth state shipped by a newer server, read by an
+  // older page. It must not inherit the public planet.
+  for (const orb of ['wormhole', 'nebula', '', null, undefined]) {
+    assert.equal(sandbox.drawableCatalogRow({ orb }), false,
+      `an unknown render-type (${String(orb)}) is not drawn`);
+  }
+  assert.equal(sandbox.drawableCatalogRow({}), false, 'a row with no render-type at all is not drawn');
+});
+
+test('the drop is wired into the browse list, not left as an orphan predicate', () => {
+  // behaviour above proves the predicate; this proves the page actually asks it,
+  // and asks it of the CATALOG (the viewer's own provisioning rows carry no feed
+  // `orb` and must survive)
+  assert.match(SCRIPT, /catalog\.filter\(drawableCatalogRow\)/,
+    'applyMapFilter must filter the catalog through drawableCatalogRow');
+});
+
+test("the viewer's own provisioning rows still draw — fail-closed must not empty the owner's sky", () => {
+  const h = boot();
+  // the synthetic row applyMapFilter pushes for an owned instance the catalog
+  // does not carry: no feed `orb`, because it never came from the feed
+  const owned = {
+    name: 'my-project', tagline: 'my-project.example.com',
+    origin: 'https://my-project.example.com', builders: null, tags: null, type: null,
+    _inst: { id: '42', slug: 'my-project', domain: 'my-project.example.com' },
+  };
+  h.sandbox.renderOrbs([owned], []);
+  const [orb] = h.orbs();
+  assert.equal(h.orbs().length, 1, 'an owned-only entry is drawn');
+  assert.equal(orb.getAttribute('data-orb'), null, 'and is not labelled with a state it never claimed');
+  assert.ok(orb.getAttribute('data-template'), 'it keeps its slug-walked planet');
+});
+
+test('the state→orb mapping is read from the feed, never re-derived here', () => {
+  // projects-feed.js owns ORB_BY_STATE. A second copy on the client is a copy
+  // that drifts — the explicit rule R07 already follows in explore.js.
+  assert.doesNotMatch(REGION, /['"]public['"]\s*:\s*['"]planet['"]/,
+    'the page must not carry its own state→orb table');
+  assert.match(REGION, /p\.orb|\bORB_STATE\b/, 'it reads the feed’s own orb field');
+});
+
+test('a black hole cannot be surfaced by the search box', () => {
+  const { sandbox } = boot();
+  // it publishes no text, so there is nothing for a query to match — asserted
+  // rather than assumed, because a future row that gained a searchable field
+  // would silently make stealth projects probeable by guessing names
+  for (const q of ['a', 'project', 'demo', 'circles']) {
+    assert.equal(sandbox.matchesMapQuery(STEALTH_ROW, q), false,
+      `a query (${q}) must never match a black hole`);
+  }
+});
+
+test('the table view says the same three things as the sky', () => {
+  const h = boot();
+  h.sandbox.renderRows([PUBLIC_ROW, PRIVATE_ROW, STEALTH_ROW]);
+  const html = h.rowsHtml();
+  for (const orb of ['planet', 'star', 'black-hole']) {
+    assert.ok(html.includes('data-orb="' + orb + '"'), `the table marks its ${orb} row`);
+  }
+  // the anonymous row is anonymous HERE too: the table is a peer view of the map,
+  // not a back door around D2a
+  const anon = html.slice(html.indexOf('data-orb="black-hole"'));
+  assert.doesNotMatch(anon, /class="rowGo"/, 'a black hole has no "view" door');
+  assert.doesNotMatch(anon, /data-template=/, 'and no per-project artwork');
+});

package/tests/wizard_draft_resume.mjs

@@ -0,0 +1,194 @@
+// tests/wizard_draft_resume.mjs — the create wizard survives a round-trip through GitHub
+// (task 1003683).
+//
+// Two defects on the Home step, both found while walking the R24 proof on live:
+//
+//   1. EVERY boot reset the draft to step 1. enter() deliberately renders the name step
+//      before /me settles ("deeper steps carry authenticated side effects"), and its own
+//      comment promises "onAuth() re-enters to the real draft step the moment /me answers".
+//      But show() PERSISTS whatever step it renders, so the placeholder overwrote the
+//      draft's real position with 1 — leaving onAuth() nothing to return to. Granting repo
+//      access from step 5 therefore dumped the visitor back at the name step, every time.
+//      Reproduced live on core 1.19.580: planting {step:5} and reloading read back step 1.
+//
+//   2. "or enter it manually" was a ONE-WAY door. #ghConnect renders only while repoAccess
+//      is 'need-connect', the toggle set repoAccess='manual', and nothing ever set it back
+//      — so the "Allow repo access" button vanished until a full page reload. Navigating
+//      back to step 4 and forward again did not restore it.
+//
+// Harness: there is no jsdom in this repo, so this follows tests/project_door_ui.mjs —
+// slice the real region out of the page's INLINE script and run it in a vm under a minimal
+// DOM stub. The slice boundaries are asserted, so a rename can never leave this file
+// quietly testing nothing.
+//
+// NOT covered here, deliberately: the team shape. The first draft of this task claimed the
+// OAuth hop dropped it; that was wrong — teamShape, projType and modules all survive a
+// reload (verified live). What looked like a drop was the documented "clicking the chosen
+// pill again UNSAYS it" toggle being re-clicked by hand.
+//
+// Run:  node --test --test-reporter=tap tests/wizard_draft_resume.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8');
+
+// ── slice 1 · the step-resolution block inside enter() ────────────────────────────
+const STEP_RE = /var step = authKnown &&[\s\S]*?show\(step, !!focus\);\r?\n\s*\}/;
+const stepSlice = (HUB.match(STEP_RE) || [null])[0];
+
+test('the step-resolution slice is still findable (a rename must fail loudly, not silently pass)', () => {
+  assert.ok(stepSlice, 'enter()\'s step-resolution block was not found in projects.html');
+  assert.match(stepSlice, /show\(1, false\)/, 'the pre-auth placeholder render is part of the slice');
+});
+
+// A faithful miniature of the real show(): the ONE behaviour that matters here is that it
+// writes state.step and then persists the whole state. If show() ever stops persisting,
+// this test still passes for the right reason — the draft keeps the real step either way.
+function runStep({ authKnown, draftStep }) {
+  const store = new Map();
+  const state = { step: draftStep, name: 'probe', teamShape: 'small-team' };
+  store.set('draft', JSON.stringify(state));
+  const rendered = [];
+  const sandbox = {
+    authKnown,
+    state,
+    focus: false,
+    saveDraft() { store.set('draft', JSON.stringify(state)); },
+    show(step) { state.step = step; rendered.push(step); sandbox.saveDraft(); },
+    $: () => ({ focus() {} }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(stepSlice, sandbox);
+  return { rendered, persisted: JSON.parse(store.get('draft')), state };
+}
+
+test('pre-auth: the placeholder renders step 1 but the draft KEEPS the real step', () => {
+  const { rendered, persisted } = runStep({ authKnown: false, draftStep: 5 });
+  assert.deepEqual(rendered, [1], 'still renders the name step before identity settles');
+  assert.equal(persisted.step, 5, 'the draft must not be overwritten with the placeholder');
+});
+
+test('pre-auth: the in-memory step is restored too, so onAuth() can re-enter to it', () => {
+  // onAuth() calls enter() again and reads state.step from MEMORY, not from storage — so
+  // restoring only the stored copy would fix nothing.
+  const { state } = runStep({ authKnown: false, draftStep: 6 });
+  assert.equal(state.step, 6);
+});
+
+test('post-auth: the real step is rendered', () => {
+  const { rendered, persisted } = runStep({ authKnown: true, draftStep: 5 });
+  assert.deepEqual(rendered, [5]);
+  assert.equal(persisted.step, 5);
+});
+
+test('a draft already at step 1 is unchanged, and an out-of-range step is not resurrected', () => {
+  assert.equal(runStep({ authKnown: false, draftStep: 1 }).persisted.step, 1);
+  // 8 is the done panel, reached by its own branch above this slice; 0 is the gate. Neither
+  // is a resumable wizard position, so the placeholder is allowed to stand.
+  for (const bad of [0, 8, 99]) {
+    assert.equal(runStep({ authKnown: false, draftStep: bad }).persisted.step, 1, `step ${bad} is not resumed`);
+  }
+});
+
+// ── slice 2 · syncHome's control over the way back ────────────────────────────────
+const SYNC_RE = /function syncHome\(\) \{[\s\S]*?\n {4}\}/;
+const syncSlice = (HUB.match(SYNC_RE) || [null])[0];
+
+test('the syncHome slice is still findable', () => {
+  assert.ok(syncSlice, 'syncHome() was not found in projects.html');
+  assert.match(syncSlice, /ghManualBack/, 'syncHome governs the way-back control');
+});
+
+function runSync(repoAccess) {
+  const els = {};
+  // Elements start HIDDEN so that "shown" is only ever the result of syncHome setting it.
+  // With a `hidden: false` default, a control syncHome never mentions reads as visible and
+  // the assertion below would pass against the unfixed page.
+  const el = (id) => (els[id] ||= {
+    id, hidden: true, textContent: '', _on: false,
+    classList: { toggle(_c, v) { els[id]._on = !!v; } },
+  });
+  const sandbox = {
+    repoAccess,
+    state: { mode: 'greenfield' },
+    $: el,
+    isManualHome: () => repoAccess === 'manual' || repoAccess === 'unavailable',
+    initAdoptPicker() {}, syncFresh() {},
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(syncSlice + '\nsyncHome();', sandbox);
+  return { connectShown: el('ghConnect')._on, manualShown: !el('manualHome').hidden, backShown: !el('ghManualBack').hidden };
+}
+
+test('choosing manual leaves a way back to the connect offer', () => {
+  const manual = runSync('manual');
+  assert.equal(manual.manualShown, true, 'the manual fields are up');
+  assert.equal(manual.connectShown, false, 'the connect box is down — that is what made it a trap');
+  assert.equal(manual.backShown, true, 'and the way back is offered');
+});
+
+test('a FORCED fallback offers no way back, because connecting cannot help', () => {
+  // 'unavailable' means the server could not store a token. Offering "use my GitHub
+  // repositories instead" there would send the visitor through a round-trip that lands
+  // them right back here — an offer that cannot be honoured is worse than none.
+  const forced = runSync('unavailable');
+  assert.equal(forced.manualShown, true);
+  assert.equal(forced.backShown, false);
+});
+
+test('while the connect offer is up, the way back is not', () => {
+  const need = runSync('need-connect');
+  assert.equal(need.connectShown, true);
+  assert.equal(need.backShown, false, 'no second, redundant control beside the button itself');
+});
+
+// ── slice 3 · why this task's original team-shape claim was wrong ─────────────────
+// The bug was filed claiming a GitHub round-trip drops the team shape. It does not: a
+// planted draft reads teamShape back intact after a reload (verified live on 1.19.580).
+// The real explanation is this handler — the pill is an UNSAY toggle, so re-clicking the
+// already-chosen shape clears it. During the R24 walk that second click was mine. Pinning
+// it here so the claim rests on the handler's actual behaviour rather than on prose.
+// Anchored on addEventListener: the same selector also appears inside paintTeam(), which
+// only writes aria-pressed. Matching that one instead yields a slice that will not parse.
+const TEAM_RE = /root\.querySelectorAll\('#teamCards \.tpill'\)\.forEach\(function \(b\) \{\s*b\.addEventListener[\s\S]*?\n {4}\}\);/;
+const teamSlice = (HUB.match(TEAM_RE) || [null])[0];
+
+test('the team-pill slice is still findable', () => {
+  assert.ok(teamSlice, 'the #teamCards pill handler was not found in projects.html');
+  assert.match(teamSlice, /state\.teamShape/, 'the handler owns the team-shape answer');
+});
+
+test('the team pill UNSAYS on a second click — the answer is not dropped, it is toggled off', () => {
+  const state = { teamShape: null };
+  const handlers = [];
+  const pill = (team) => ({
+    getAttribute: (a) => (a === 'data-team' ? team : null),
+    addEventListener: (_e, fn) => handlers.push({ team, fn }),
+  });
+  const sandbox = {
+    state,
+    root: { querySelectorAll: () => [pill('solo'), pill('small-team'), pill('community')] },
+    paintTeam() {}, paintDetail() {}, saveDraft() {},
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(teamSlice, sandbox);
+
+  const click = (team) => handlers.find((h) => h.team === team).fn();
+  click('small-team');
+  assert.equal(state.teamShape, 'small-team', 'first click answers');
+  click('small-team');
+  assert.equal(state.teamShape, null, 'the SAME pill again unsays it — this is the mis-read bug');
+  click('small-team');
+  assert.equal(state.teamShape, 'small-team', 'and a third click answers again');
+  click('community');
+  assert.equal(state.teamShape, 'community', 'a DIFFERENT pill replaces rather than clears');
+});