@bongos/core 1.19.692 → 1.19.694

package/src/bongos/routes/me.js

@@ -433,6 +433,14 @@ module.exports = function buildMeRouter() {
       // builder is uncapped (no cap set — the default; ADR 0085), in which case
       // level is always 'ok'. The whole object is null only if the read errored.
       cost: costStatus,
+      // task 1003453: the task-kind vocabulary, so a surface that offers a kind
+      // filter BUILDS it from the enum instead of retyping it. The board and the
+      // goals page each carried their own hardcoded copy, and both had gone stale
+      // against the DB — 'verify' existed, was claimable, and could not be
+      // filtered for. The lifecycle port's VALID_KINDS is the SSOT; [] when the
+      // lifecycle module is off, which reads as "no vocabulary served" and leaves
+      // the filter with just its '— any —' row rather than a wrong list.
+      task_kinds: lc() ? lc().TASK_KINDS : [],
       // task 1268: the per-builder "wandering" knob, resolved to an effective
       // level (clamped by rank) + its behavior contract. The Conductor + the
       // /settings UI read this; the builder-settings port's describeWandering is

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.692'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.694'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/linkify_refs.mjs

@@ -13,7 +13,7 @@ import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
-const { linkifyText, RESOLVER_BASE, RESOLVER_BASE_IDEA, RESOLVER_BASE_BLOCKER, discoverDocs } =
+const { linkifyText, RESOLVER_BASE, RESOLVER_BASE_IDEA, RESOLVER_BASE_BLOCKER, discoverDocs, isLoopbackOrigin } =
   require('../scripts/gds/linkify-refs.js');
 
 let passed = 0;
@@ -31,6 +31,44 @@ t('a bare task ref is linkified', () => {
   assert.equal(run('shipped in #475 today'), `shipped in ${link(475)} today`);
 });
 
+// task 1003542: every live id on this instance is SEVEN digits — imported tasks were
+// renumbered +1,000,000 — but the matcher was \d{1,5}, a PRE-IMPORT width. So the
+// --check CI gate passed trivially on a doc containing a bare #1003365: it matched
+// nothing and reported clean, which looks exactly like a gate that works.
+t('a bare SEVEN-digit task ref is linkified — the width every live id here has', () => {
+  const ids = new Set([1003365]);
+  assert.equal(run('the fix landed in #1003365.', ids), `the fix landed in ${link(1003365)}.`);
+});
+
+t('an EIGHT-digit number is still left bare — widening did not become "match anything"', () => {
+  // The bound still exists: a long bare number in prose must not be rewritten into
+  // a resolver link just because it is long.
+  assert.equal(run('the run took 10033650 ms', new Set([1003365])), 'the run took 10033650 ms');
+});
+
+// task 1003542: --apply WRITES these links into committed markdown, so the resolver
+// base must never be a dev origin. config/branding.neutral.json — the neutral core's
+// own default — sets buildersOrigin to http://localhost:3000, so before this guard a
+// core checkout rewrote refs into http://localhost:3000/builders#/task/N. It only
+// stayed hidden because the matcher was too narrow to rewrite anything here; widening
+// it in this task is what made the leak reachable.
+t('a loopback origin is refused as a resolver base (root-relative instead)', () => {
+  for (const o of ['http://localhost:3000', 'https://127.0.0.1:8443', 'http://0.0.0.0:80',
+    'http://[::1]:3000', 'http://app.localhost:3000']) {
+    assert.equal(isLoopbackOrigin(o), true, `${o} must not be written into a committed doc`);
+  }
+});
+
+t('a real instance origin is still used as the resolver base', () => {
+  for (const o of ['https://cloudbongos.com', 'https://hermeslines-marketing.cloudbongos.com']) {
+    assert.equal(isLoopbackOrigin(o), false, `${o} is a real host and must survive`);
+  }
+  // Not a parseable absolute URL — the caller already handles '' / root-relative,
+  // and this must not throw on the way past.
+  assert.equal(isLoopbackOrigin('/builders#'), false);
+  assert.equal(isLoopbackOrigin(''), false);
+});
+
 t('a parenthesized task ref is linkified (these are task refs here, not PRs)', () => {
   assert.equal(run('R01-followup (#308, 2026-05-13)'), `R01-followup (${link(308)}, 2026-05-13)`);
 });

package/tests/stop_refcheck.mjs

@@ -45,11 +45,30 @@ function t(name, fn) {
 
 // 286/526/870 are "real task ids" for this test; 5/84 stand in for ids that may
 // also be a blocker/migration number (entity classification ignores id membership).
-const IDS = new Set([5, 84, 170, 286, 526, 870]);
+const IDS = new Set([5, 84, 170, 286, 526, 870, 1003365]);
 const ev = (s) => evaluate(s, IDS);
 
+// task 1003542: 1003365 is the SEVEN-digit shape every live id on this instance
+// has, after imported tasks were renumbered +1,000,000. Both enforcement points
+// matched only \d{1,5} — a PRE-IMPORT width — so this hook fast-path-exited on
+// REF_RE before it even fetched the allow-list, and the turn-end nudge could
+// never fire for a real id. A guard that matches nothing reports clean, which is
+// indistinguishable from a guard that works, so the width needs a case of its own.
+
 // ---- blocks (a bare ref that would 404 in chat) ----------------------------
 
+t('a bare SEVEN-digit task ref blocks — the width every live id on this instance has', () => {
+  const r = ev('the fix for that landed in #1003365.');
+  assert.equal(r.block, true, 'a 7-digit bare ref must be caught, not fast-path-skipped');
+  assert.ok(r.refs.includes('#1003365'), 'and must be surfaced by its full 7 digits');
+});
+
+t('an EIGHT-digit number is still left alone — widening did not become "match anything"', () => {
+  // The upper bound still exists. Nothing on this instance is 8 digits, and a long
+  // bare number in prose (a timestamp, an amount) must not start blocking turns.
+  assert.equal(ev('the run took 10033650 ms').block, false);
+});
+
 t('a bare task ref blocks', () => {
   const r = ev('So the only genuine C9 code remaining is landing #286.');
   assert.equal(r.block, true);

package/tests/task_classifier_vocab.mjs

@@ -5,8 +5,12 @@
 // drive the pure builder + the generic core rule with no disk I/O.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import { readFileSync, readdirSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import classifier from '../modules/lifecycle/task-classifier.js';
 
+const require = createRequire(import.meta.url);
+
 const { classifyTaskKind, buildBlockerVendorRe } = classifier;
 
 test('buildBlockerVendorRe: empty / non-array → null (vanilla has no vendors)', () => {
@@ -39,3 +43,53 @@ test('generic blocker terms still classify without any vendor config', () => {
   assert.equal(classifyTaskKind('Unblock the release', '').kind, 'blocker-resolution');
   assert.equal(classifyTaskKind('Rotate the API key', '').kind, 'blocker-resolution');
 });
+
+// ---- the kind vocabulary is ONE list, and everything reads it (task 1003453) --
+//
+// The board's Kind filter hardcoded its options and had gone stale: 'verify' was
+// added to VALID_KINDS (and to the DB CHECK by migration 187) but never to the
+// filter, so verify tasks existed, were claimable, and could not be filtered for.
+// The goals page carried a second copy of the same stale list. Both now build the
+// lens from the vocabulary the server serves, and these pin every hop of that.
+
+test('the DB CHECK constraint lists exactly VALID_KINDS', () => {
+  // Migration 187's own header records this drift in the other direction — the
+  // app gained 'verify', the CHECK did not, and POST /tasks 500'd for months.
+  // Comparing the two is the guard neither side had.
+  const sql = readFileSync(new URL('../migrations/187_tasks_kind_check_add_verify.sql', import.meta.url), 'utf8');
+  const inClause = /CHECK \(kind IN \(([\s\S]*?)\)\)/.exec(sql);
+  assert.ok(inClause, 'the CHECK constraint is still written as `kind IN (...)`');
+  const fromSql = [...inClause[1].matchAll(/'([a-z-]+)'/g)].map((m) => m[1]);
+  assert.deepEqual([...fromSql].sort(), [...classifier.VALID_KINDS].sort(),
+    'the DB CHECK and VALID_KINDS must name the same kinds — this is the drift migration 187 exists to record');
+});
+
+test('the lifecycle port serves the vocabulary as a JSON-safe array', () => {
+  const lifecycle = require('../modules/lifecycle/lifecycle.js');
+  const kinds = lifecycle.TASK_KINDS;
+  assert.ok(Array.isArray(kinds), 'an array — a Set does not survive JSON.stringify, which is how it reaches the hall');
+  assert.deepEqual([...kinds].sort(), [...classifier.VALID_KINDS].sort());
+  assert.ok(kinds.includes('verify'), 'the kind this whole task is about');
+  assert.notEqual(kinds, lifecycle.TASK_KINDS, 'a fresh copy each read — a caller must not be able to mutate the vocabulary');
+});
+
+// Scans the WHOLE surface — every .js AND .html — because the first cut of this
+// test read .js only and matched a JS array literal, so it could not see the third
+// copy: a static <option> list in ideas.html carrying the identical stale
+// vocabulary. A guard that cannot see one of the places the bug lives is worse
+// than no guard, because it is read as coverage. The grader caught that; this is
+// the shape that would have caught it first.
+test('no hall page carries its own copy of the kind list', () => {
+  const dir = new URL('../modules/hall-ui/public/', import.meta.url);
+  const pages = readdirSync(dir).filter((f) => f.endsWith('.js') || f.endsWith('.html'));
+  assert.ok(pages.length > 20, 'the surface was found — an empty scan must not pass silently');
+  // Three kinds in sequence is the signature of a spelled-out vocabulary, in a JS
+  // array ('cleanup', 'decision', …) or in markup (value="cleanup" … value="decision").
+  const SPELLED = /(['"])cleanup\1[\s\S]{0,80}?(['"])decision\2[\s\S]{0,120}?(['"])blocker-resolution\3/;
+  for (const page of pages) {
+    if (page === 'dom-utils.js') continue; // the one filler is allowed to name them
+    const src = readFileSync(new URL(page, dir), 'utf8');
+    assert.doesNotMatch(src, SPELLED,
+      `${page} spells out the kind vocabulary — fill it from /me task_kinds via OTB.fillKindFilter instead`);
+  }
+});