@bongos/core 1.19.665 → 1.19.667

package/tests/conductor.mjs

@@ -372,6 +372,112 @@ test('bestMatchingClaim: single claim returned; empty/null → null', () => {
   assert.equal(dispatch.bestMatchingClaim(null, ['x']), null);
 });
 
+// ---------------------------------------------------------------------------
+// Attribution: which claim does this diff belong to? (task 1003834)
+//
+// The regression these pin is not hypothetical — it happened, and the fixture
+// below is the real data from 2026-09-10.
+// ---------------------------------------------------------------------------
+
+// The observed failure, verbatim. Reviewing task 1003829's diff from its own
+// worktree, the dispatch announced task 1003704 — a concurrent rename claim
+// whose touches[] are four coarse directory prefixes. The reviewer was briefed
+// on unrelated work and had to reason its way out.
+const CLAIM_1003704 = {
+  task_id: '1003704',
+  title: 'C3b: rename gds-session.json and the gds_session cookie',
+  worktree_name: 'task-1003704',
+  touches: ['scripts/gds/', 'src/bongos/', 'modules/', 'clients/'],
+};
+const CLAIM_1003829 = {
+  task_id: '1003829',
+  title: 'The Studio shows an artist no visuals',
+  worktree_name: 'task-1003829',
+  touches: ['modules/hall-ui/public/studio.js', 'modules/hall-ui/public/studio.html', 'modules/hall-ui/public/studio.css'],
+};
+// The diff as it actually was: three studio files plus the wider blast radius a
+// real change carries. Under a RAW COUNT, 1003704 matches 8 of these and
+// 1003829 only 3 — which is how the wrong task won.
+const DIFF_1003829 = [
+  'modules/hall-ui/public/studio.js',
+  'modules/hall-ui/public/studio.html',
+  'modules/hall-ui/public/studio.css',
+  'modules/hall-ui/public/hall-kit.js',
+  'modules/hall-ui/public/studio.states.json',
+  'scripts/hall-preview/server.js',
+  'scripts/hall-preview/task-visual.js',
+  'scripts/hall-preview/fixtures/tasks__detail.json',
+  'docs/copy-inventory.md',
+  'docs/copy-registry.json',
+  'tests/hall_studio_world.mjs',
+  'tests/task_visuals.mjs',
+];
+
+test('attribution: the worktree decides, even when another claim out-matches the diff', () => {
+  const claims = [CLAIM_1003704, CLAIM_1003829];
+  const got = dispatch.attributeClaim(claims, DIFF_1003829, 'task-1003829');
+  assert.equal(got.claim.task_id, '1003829', 'the claim BOUND to this worktree wins');
+  assert.equal(got.signal, 'worktree');
+  // And it wins regardless of claim order, so this cannot pass by accident.
+  assert.equal(dispatch.attributeClaim([CLAIM_1003829, CLAIM_1003704], DIFF_1003829, 'task-1003704').claim.task_id, '1003704');
+});
+
+test('attribution: specificity beats breadth, so the honest touches[] no longer loses', () => {
+  // The same fixture with NO worktree signal — running from the main checkout,
+  // or a pre-worktree_name claim. The heuristic alone must now get it right.
+  const got = dispatch.attributeClaim([CLAIM_1003704, CLAIM_1003829], DIFF_1003829, null);
+  assert.equal(got.claim.task_id, '1003829', 'three exact paths outweigh four directory prefixes');
+  assert.equal(got.signal, 'overlap');
+  // Proof the OLD scoring is what was wrong: by raw count, 1003704 matches more.
+  const rawCount = (c) => DIFF_1003829.filter((f) => (c.touches || []).some((t) => f === t || f.startsWith(t.endsWith('/') ? t : t + '/'))).length;
+  assert.ok(rawCount(CLAIM_1003704) > rawCount(CLAIM_1003829), 'the broad claim really does match more files');
+  assert.ok(dispatch.claimOverlapScore(CLAIM_1003829, DIFF_1003829) > dispatch.claimOverlapScore(CLAIM_1003704, DIFF_1003829), 'and still scores lower');
+});
+
+test('attribution: volume still counts — a genuinely broad claim keeps its diff', () => {
+  // Specificity must not invert the heuristic: a rename touching fifty files
+  // under scripts/gds/ should not lose to a claim sharing one exact file.
+  const broad = { task_id: 'broad', touches: ['scripts/gds/'] };
+  const narrow = { task_id: 'narrow', touches: ['scripts/gds/one.js'] };
+  const files = Array.from({ length: 50 }, (_, i) => `scripts/gds/f${i}.js`).concat('scripts/gds/one.js');
+  assert.equal(dispatch.attributeClaim([narrow, broad], files, null).claim.task_id, 'broad');
+});
+
+test('attribution: an empty touches[] is unreachable by overlap — the worktree saves it', () => {
+  // Most tasks in this repo declare no touches at all, so they score zero
+  // against every diff. That is the other half of why the worktree leads.
+  const bare = { task_id: 'bare', worktree_name: 'task-bare', touches: [] };
+  assert.equal(dispatch.claimOverlapScore(bare, ['a.js', 'b.js']), 0);
+  assert.equal(dispatch.attributeClaim([CLAIM_1003704, bare], ['a.js'], 'task-bare').claim.task_id, 'bare');
+  // With no worktree match it cannot win, and the signal says the answer is weak.
+  const guess = dispatch.attributeClaim([bare, CLAIM_1003704], ['docs/x.md'], 'somewhere-else');
+  assert.equal(guess.signal, 'fallback', 'zero overlap everywhere is reported as no signal, not as a match');
+});
+
+test('attribution: a worktree bound to no claim does not borrow one silently', () => {
+  const claims = [CLAIM_1003704, CLAIM_1003829];
+  const got = dispatch.attributeClaim(claims, DIFF_1003829, 'baseline-main-2');
+  assert.equal(got.signal, 'overlap', 'it falls back rather than refusing');
+  // …and the header SAYS so, which is the part that would have saved the reader.
+  const note = dispatch.attributionNote({ id: got.claim.task_id, attribution: got.signal, claim_count: claims.length });
+  assert.match(note, /attribution: guessed from touches\[\] overlap, across 2 open claims/);
+  assert.match(note, /discount findings about intent/);
+});
+
+test('attribution: the note stays quiet when it would only add noise', () => {
+  // Certain attribution, and the single-claim case, have nothing to warn about.
+  assert.equal(dispatch.attributionNote({ id: '1', attribution: 'worktree', claim_count: 4 }), '');
+  assert.equal(dispatch.attributionNote({ id: '1', attribution: 'overlap', claim_count: 1 }), '');
+  assert.equal(dispatch.attributionNote({ id: null, attribution: 'overlap', claim_count: 9 }), '');
+});
+
+test('attribution: claimForWorktree ignores claims with no recorded worktree', () => {
+  // Pre-column claims carry null; they must not match an absent cwd name.
+  assert.equal(dispatch.claimForWorktree([{ task_id: 'x', worktree_name: null }], 'task-x'), null);
+  assert.equal(dispatch.claimForWorktree([{ task_id: 'x', worktree_name: 'task-x' }], null), null);
+  assert.equal(dispatch.claimForWorktree(null, 'task-x'), null);
+});
+
 test('isCovered now delegates to the canonical matcher (still correct)', () => {
   // Regression guard for the dedup: isCovered is a thin wrapper over
   // path-match.matchOne (relocated from the deleted touches-scan in task 879),

package/tests/landing_page.mjs

@@ -45,6 +45,7 @@ const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
 const HTML = fs.readFileSync(path.join(LANDING, 'index.html'), 'utf8');
 const WORLD = fs.readFileSync(path.join(LANDING, 'assets', 'world.css'), 'utf8');
 
+const { SESSION_COOKIE_NAMES } = require('../src/bongos/auth.js');
 const { stripApexOnly } = require('../src/platform-server.js');
 const { applyBrandTokens } = require('../src/bongos/serve-internal.js');
 
@@ -484,7 +485,10 @@ test('sign out POSTs, and expires both cookies in both Domain forms', () => {
   // only matches the cookie whose Domain attribute it names, so the host-only
   // and apex-scoped forms must BOTH be expired (#726).
   assert.match(CODE, /fetch\(API \+ '\/auth\/logout', \{ method: 'POST', credentials: 'same-origin' \}\)/);
-  assert.match(CODE, /\['gds_session', 'pms_session'\]/);
+  // Every accepted cookie name must be expired, not just the newest: a browser arriving with an
+  // older name would otherwise keep a live cookie through "sign out". Derived from the canonical
+  // list so this follows the rename chain (task 1003704, and again at 1003706).
+  assert.match(CODE, new RegExp('\\[' + SESSION_COOKIE_NAMES.map((n) => `'${n}'`).join(', ') + '\\]'));
   assert.match(CODE, /name \+ '=; Max-Age=0; path=\/';/);
   assert.match(CODE, /name \+ '=; Max-Age=0; path=\/; Domain=\.' \+ apex/);
   // it runs whether the POST lands or not

package/tests/lib_sh_resolution.mjs

@@ -35,6 +35,12 @@ const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const GDS = path.join(ROOT, 'scripts', 'gds');
 const fitness = require(path.join(GDS, 'fitness.js'));
+// The CURRENT session filename, so the expectations below follow the rename chain
+// (task 1003704 renamed the file; 1003706 retires the old names) instead of being
+// re-edited at each step. SESSION_FILENAMES[0] is what the CLI WRITES; the tail is
+// what it still accepts on read.
+const ic = require(path.join(ROOT, 'src', 'instance-config.js'));
+const SESSION_FILE = ic.SESSION_FILENAMES[0];
 
 // Every bash script that resolves a GDS token or API base.
 const SMOKES = [
@@ -184,9 +190,13 @@ const boxCode = (f) => fitness.stripCommentsForIdentity(fs.readFileSync(path.joi
 test('every baked box script resolves the session across config dirs, not just the legacy one', () => {
   for (const f of BOX_SCRIPTS) {
     const src = boxCode(f);
-    assert.match(src, /\.config\/\*\/gds-session\.json/,
-      `${f} must fall back across ~/.config/*/ — without it a /builder-reauth into a `
-      + 'non-"otb" configDir strands the box on a dead token');
+    for (const name of ic.SESSION_FILENAMES.slice(0, 2)) {
+      assert.ok(src.includes(`.config/*/${name}`),
+        `${f} must scan ~/.config/*/${name} — without the glob a /builder-reauth into a `
+        + 'non-"otb" configDir strands the box on a dead token, and without BOTH names '
+        + 'half the fleet is unreadable: a box provisioned before the rename has only the '
+        + 'old name, one provisioned after has only the new (task 1003704)');
+    }
     // The legacy literal may survive ONLY as the last-resort default, never as the
     // sole source — i.e. it must be preceded by the glob scan.
     // The scan widens what these scripts will read, so each candidate must be owned
@@ -194,8 +204,8 @@ test('every baked box script resolves the session across config dirs, not just t
     // simply by being newest.
     assert.match(src, /\[ -O "\$_sess" \]/,
       `${f} must require candidate session files to be owned by the current user`);
-    const globAt = src.indexOf('.config/*/gds-session.json');
-    const legacyAt = src.indexOf('.config/otb/gds-session.json');
+    const globAt = src.indexOf('.config/*/');
+    const legacyAt = src.indexOf(`.config/otb/${SESSION_FILE}`);
     if (legacyAt !== -1) {
       assert.ok(globAt < legacyAt,
         `${f} reaches the legacy path before scanning ~/.config/*/ — the fallback must come first`);
@@ -217,10 +227,17 @@ test('every baked box script passes bash -n', (t) => {
 function resolverBlock(f) {
   const src = fs.readFileSync(path.join(INFRA, f), 'utf8');
   const start = src.indexOf('if [ -z "${GDS_SESSION:-}" ]; then');
-  const endMark = 'GDS_SESSION="${GDS_SESSION:-$HOME/.config/otb/gds-session.json}"';
-  const end = src.indexOf(endMark, start);
-  assert.ok(start !== -1 && end !== -1, `could not locate the resolver block in ${f}`);
-  return src.slice(start, end + endMark.length);
+  // Matched by PREFIX, up to the closing quote — never by the full line including the
+  // filename. The filename is the one thing a rename changes, so spelling it here made
+  // this test fail with "could not locate the resolver block" on a perfectly good
+  // rename, and on Windows (where it already failed for its own reason) that looked
+  // like no new failure at all (task 1003704).
+  const endPrefix = 'GDS_SESSION="${GDS_SESSION:-$HOME/.config/otb/';
+  const at = src.indexOf(endPrefix, start);
+  const close = at === -1 ? -1 : src.indexOf('"', at + endPrefix.length);
+  assert.ok(start !== -1 && at !== -1 && close !== -1,
+    `could not locate the resolver block in ${f}`);
+  return src.slice(start, close + 1);
 }
 
 test('the resolver prefers the most recently written session across config dirs', (t) => {
@@ -253,7 +270,7 @@ test('the resolver prefers the most recently written session across config dirs'
   const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'boxsess-empty-'));
   const r3 = spawnSync('bash', ['-c', `set -uo pipefail\n${block}\nprintf '%s' "$GDS_SESSION"`],
     { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: empty } });
-  assert.equal(r3.stdout, path.join(empty, '.config', 'otb', 'gds-session.json'));
+  assert.equal(r3.stdout, path.join(empty, '.config', 'otb', SESSION_FILE));
 
   fs.rmSync(home, { recursive: true, force: true });
   fs.rmSync(empty, { recursive: true, force: true });
@@ -264,16 +281,25 @@ test('the resolver prefers the most recently written session across config dirs'
 // override but assigned to SF, so a caller that SET the override had it silently
 // dropped and fell through to the legacy default — the exact bug being fixed,
 // reintroduced through the back door. Pin all three branches.
+// box-heartbeat.sh's resolver, pulled straight out of the committed file. Shared by the
+// two tests below so there is a single extraction to fix when the names next move.
+function heartbeatSfBlock() {
+  const src = fs.readFileSync(path.join(INFRA, 'box-heartbeat.sh'), 'utf8');
+  const start = src.indexOf('SF="${OTB_GDS_SESSION:-}"');
+  // Prefix, not the whole line — see resolverBlock above.
+  const endPrefix = 'SF="${SF:-$HOME/.config/otb/';
+  const at = src.indexOf(endPrefix, start);
+  const close = at === -1 ? -1 : src.indexOf('"', at + endPrefix.length);
+  assert.ok(start !== -1 && at !== -1 && close !== -1,
+    'could not locate the SF resolver in box-heartbeat.sh');
+  return src.slice(start, close + 1);
+}
+
 test('box-heartbeat.sh honors OTB_GDS_SESSION, scans, then falls back', (t) => {
   const probe = bash(['-n', 'infra/box-heartbeat.sh']);
   if (!probe) return t.skip('bash not available on this machine');
 
-  const src = fs.readFileSync(path.join(INFRA, 'box-heartbeat.sh'), 'utf8');
-  const start = src.indexOf('SF="${OTB_GDS_SESSION:-}"');
-  const endMark = 'SF="${SF:-$HOME/.config/otb/gds-session.json}"';
-  const end = src.indexOf(endMark, start);
-  assert.ok(start !== -1 && end !== -1, 'could not locate the SF resolver in box-heartbeat.sh');
-  const block = src.slice(start, end + endMark.length);
+  const block = heartbeatSfBlock();
 
   const home = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-'));
   const configured = path.join(home, '.config', 'cloudbongos');
@@ -289,8 +315,49 @@ test('box-heartbeat.sh honors OTB_GDS_SESSION, scans, then falls back', (t) => {
   assert.equal(run({}), path.join(configured, 'gds-session.json'));
 
   const empty = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-empty-'));
-  assert.equal(run({}, empty), path.join(empty, '.config', 'otb', 'gds-session.json'));
+  assert.equal(run({}, empty), path.join(empty, '.config', 'otb', SESSION_FILE));
 
   fs.rmSync(home, { recursive: true, force: true });
   fs.rmSync(empty, { recursive: true, force: true });
 });
+
+// The rename leaves the fleet in FOUR states at once, and the two tests above only cover
+// the pre-rename half (their fixtures write the old name). These are the other two, and
+// they are the ones a rename actually breaks (task 1003704). Same extracted resolver — one
+// harness for this block, deliberately, so part 4 (task 1003706) has one place to change.
+test('the box resolver handles a post-rename box and a migrated one', (t) => {
+  const probe = bash(['-n', 'infra/box-heartbeat.sh']);
+  if (!probe) return t.skip('bash not available on this machine');
+
+  const block = heartbeatSfBlock();
+  const run = (h) => spawnSync('bash', ['-c', `set -euo pipefail\n${block}\nprintf '%s' "$SF"`],
+    { encoding: 'utf8', env: { PATH: process.env.PATH, HOME: h } }).stdout;
+
+  // A box provisioned AFTER the rename has ONLY the new name. Before the glob was widened
+  // this fell through to the historical default, which does not exist, so every heartbeat
+  // tick failed with a misleading "no session".
+  const fresh = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-new-'));
+  const freshCfg = path.join(fresh, '.config', 'cloudbongos');
+  fs.mkdirSync(freshCfg, { recursive: true });
+  fs.writeFileSync(path.join(freshCfg, SESSION_FILE), '{"token":"fresh"}');
+  const tail = (p) => p.replace(/\\/g, '/').split('/').slice(-2).join('/');
+  assert.equal(tail(run(fresh)), `cloudbongos/${SESSION_FILE}`,
+    'a box provisioned after the rename must resolve the new name');
+
+  // A MIGRATED box carries both, the new one written later by the CLI's migrate-on-read.
+  // Newest-wins must take the new one; taking the older would read a stale token and report
+  // the misleading "session expired" of task 1003252.
+  const both = fs.mkdtempSync(path.join(os.tmpdir(), 'hbsess-both-'));
+  const bothCfg = path.join(both, '.config', 'cloudbongos');
+  fs.mkdirSync(bothCfg, { recursive: true });
+  const legacyName = ic.SESSION_FILENAMES[1];
+  fs.writeFileSync(path.join(bothCfg, legacyName), '{"token":"stale"}');
+  fs.writeFileSync(path.join(bothCfg, SESSION_FILE), '{"token":"fresh"}');
+  const older = new Date(Date.now() - 60_000);
+  fs.utimesSync(path.join(bothCfg, legacyName), older, older);
+  assert.equal(tail(run(both)), `cloudbongos/${SESSION_FILE}`,
+    'a migrated box must prefer the newly written file, not the superseded one');
+
+  fs.rmSync(fresh, { recursive: true, force: true });
+  fs.rmSync(both, { recursive: true, force: true });
+});