@bongos/core 1.19.710 → 1.19.712

package/tests/sandbox_stage.mjs

@@ -57,7 +57,7 @@ t('previewUrl: reads box.env via injected fs; null when unreadable', () => {
 
 // ---------- previewable surfaces ----------
 t('isPreviewableFile: game surfaces yes, internal surfaces no', () => {
-  for (const f of ['public/game/main.js', 'src/world/terrain.js', 'src/rooms/WorldRoom.js', 'server.js']) {
+  for (const f of ['modules/game/public/game/main.js', 'modules/game/world/terrain.js', 'modules/game/rooms/WorldRoom.js', 'server.js']) {
     assert.equal(sbx.isPreviewableFile(f), true, `${f} should be previewable`);
   }
   for (const f of ['scripts/gds/ship.js', 'modules/dev-box/routes/box.js', 'docs/adr/0046.md', 'modules/status-ui/public/index.html', 'modules/hall-ui/public/hall.js', 'migrations/075.sql', 'tests/sandbox_stage.mjs', 'server.js.bak']) {
@@ -66,7 +66,7 @@ t('isPreviewableFile: game surfaces yes, internal surfaces no', () => {
 });
 
 t('anyPreviewable: mixed diff counts as previewable; empty/none does not', () => {
-  assert.equal(sbx.anyPreviewable(['docs/x.md', 'public/game/a.js']), true);
+  assert.equal(sbx.anyPreviewable(['docs/x.md', 'modules/game/public/game/a.js']), true);
   assert.equal(sbx.anyPreviewable(['docs/x.md', 'scripts/gds/y.js']), false);
   assert.equal(sbx.anyPreviewable([]), false);
   assert.equal(sbx.anyPreviewable(null), false);
@@ -162,9 +162,9 @@ function git(...args) { execFileSync('git', args, { cwd: tmp, encoding: 'utf8' }
 git('init', '-q');
 git('config', 'user.email', 'test@example.com');
 git('config', 'user.name', 'test');
-fs.mkdirSync(path.join(tmp, 'public'));
+fs.mkdirSync(path.join(tmp, 'modules', 'game', 'public'), { recursive: true });
 fs.mkdirSync(path.join(tmp, 'docs'));
-fs.writeFileSync(path.join(tmp, 'public', 'game.js'), 'one\n');
+fs.writeFileSync(path.join(tmp, 'modules', 'game', 'public', 'game.js'), 'one\n');
 fs.writeFileSync(path.join(tmp, 'server.js'), 'srv\n');
 fs.writeFileSync(path.join(tmp, 'docs', 'notes.md'), 'doc\n');
 git('add', '.');
@@ -181,7 +181,7 @@ t('computeTreeStamp: content-stable, scoped to game surfaces', () => {
   assert.equal(sbx.computeTreeStamp({ cwd: tmp }), s1, 'docs edit → stamp unchanged');
 
   // A game-surface edit produces a new stamp...
-  fs.writeFileSync(path.join(tmp, 'public', 'game.js'), 'two\n');
+  fs.writeFileSync(path.join(tmp, 'modules', 'game', 'public', 'game.js'), 'two\n');
   const s3 = sbx.computeTreeStamp({ cwd: tmp });
   assert.notEqual(s3, s1, 'game edit → new stamp');
 
@@ -192,10 +192,10 @@ t('computeTreeStamp: content-stable, scoped to game surfaces', () => {
   assert.equal(sbx.computeTreeStamp({ cwd: tmp }), s3, 'commit of same content → stamp unchanged');
 
   // An untracked game file counts.
-  fs.writeFileSync(path.join(tmp, 'public', 'new-tile.js'), 'untracked\n');
+  fs.writeFileSync(path.join(tmp, 'modules', 'game', 'public', 'new-tile.js'), 'untracked\n');
   const s4 = sbx.computeTreeStamp({ cwd: tmp });
   assert.notEqual(s4, s3, 'untracked game file → new stamp');
-  fs.rmSync(path.join(tmp, 'public', 'new-tile.js'));
+  fs.rmSync(path.join(tmp, 'modules', 'game', 'public', 'new-tile.js'));
   assert.equal(sbx.computeTreeStamp({ cwd: tmp }), s3, 'removing it restores the stamp');
 
   assert.equal(sbx.computeTreeStamp({ cwd: os.tmpdir() }), null, 'not a repo → null');
@@ -265,7 +265,7 @@ await ta('runShipGate: no sandbox available (not a box, no local game entry) →
   // is present — a partial clone with no game. (A full local clone WITH the game
   // is covered by the LOCAL tests below, where it DOES stage.)
   const r = await sbx.runShipGate(
-    { taskId: 1, files: ['public/game/a.js'], skipStage: false, tty: true },
+    { taskId: 1, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true },
     { fs: { existsSync: () => false } }
   );
   assert.equal(r.ok, true);
@@ -281,7 +281,7 @@ await ta('runShipGate: box + non-game diff → ok, no staging', async () => {
 await ta('runShipGate: box + game diff + TTY, reviewer says yes → stages then ok, records tty sign-off', async () => {
   const mp = path.join(markerDir, 'm2.json');
   const deps = boxDeps(mp, { promptYesNo: async () => true });
-  const r = await sbx.runShipGate({ taskId: 927, files: ['src/world/terrain.js'], skipStage: false, tty: true }, deps);
+  const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/world/terrain.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, true);
   const m = JSON.parse(fs.readFileSync(mp, 'utf8'));
   assert.equal(m.url, 'https://sandbox-test.example.com');
@@ -295,7 +295,7 @@ await ta('runShipGate: box + game diff + TTY, reviewer says yes → stages then
 await ta('runShipGate: reviewer says NO → aborts with claim-preserving reason', async () => {
   const mp = path.join(markerDir, 'm3.json');
   const deps = boxDeps(mp, { promptYesNo: async () => false });
-  const r = await sbx.runShipGate({ taskId: 927, files: ['public/game/a.js'], skipStage: false, tty: true }, deps);
+  const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, false);
   assert.match(r.reason, /sandbox review declined/);
 });
@@ -321,14 +321,14 @@ await ta('runShipGate: stale marker forces a re-stage (stamp mismatch)', async (
 await ta('runShipGate: non-TTY → stages then ABORTS with the review URL (no prompt, no hang)', async () => {
   const mp = path.join(markerDir, 'm6.json');
   const deps = boxDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
-  const r = await sbx.runShipGate({ taskId: 927, files: ['public/game/a.js'], skipStage: false, tty: false }, deps);
+  const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: false, tty: false }, deps);
   assert.equal(r.ok, false, 'unreviewed game work must not ship non-interactively');
   assert.equal(r.review, true, 'abort is flagged as a review pause');
   assert.match(r.reason, /staged at https:\/\/sandbox-test\.example\.com/i);
   assert.ok(fs.existsSync(mp), 'work is staged so the human can review at the URL');
   // ...and after the (notional) review, a bare re-run passes on the fresh marker
   // but records NO sign-off (no --approved) — back-compat / failure-open.
-  const r2 = await sbx.runShipGate({ taskId: 927, files: ['public/game/a.js'], skipStage: false, tty: false }, deps);
+  const r2 = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: false, tty: false }, deps);
   assert.equal(r2.ok, true, 're-run after staging passes (marker fresh)');
   assert.equal(r2.sandboxReview, undefined, 'bare re-run records no sign-off');
 });
@@ -336,16 +336,16 @@ await ta('runShipGate: non-TTY → stages then ABORTS with the review URL (no pr
 await ta('runShipGate: uncommitted game edit counts as previewable even when committed diff does not', async () => {
   const mp = path.join(markerDir, 'm9.json');
   const deps = boxDeps(mp, { promptYesNo: async () => true });
-  fs.writeFileSync(path.join(tmp, 'public', 'game.js'), 'dirty working tree\n');
+  fs.writeFileSync(path.join(tmp, 'modules', 'game', 'public', 'game.js'), 'dirty working tree\n');
   const r = await sbx.runShipGate({ taskId: 927, files: ['docs/x.md'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, true);
   assert.ok(fs.existsSync(mp), 'gate staged the dirty game surface');
-  git('checkout', '--', 'public/game.js');
+  git('checkout', '--', 'modules/game/public/game.js');
 });
 
 await ta('runShipGate: --skip-stage → ok, untouched', async () => {
   const mp = path.join(markerDir, 'm7.json');
-  const r = await sbx.runShipGate({ taskId: 927, files: ['public/game/a.js'], skipStage: true, tty: true }, boxDeps(mp));
+  const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: true, tty: true }, boxDeps(mp));
   assert.equal(r.ok, true);
   assert.equal(fs.existsSync(mp), false);
 });
@@ -357,7 +357,7 @@ await ta('runShipGate: --skip-stage → ok, untouched', async () => {
 await ta('1002607 runShipGate: staging failure (health never green) ABORTS — review gate cannot silently turn itself off', async () => {
   const mp = path.join(markerDir, 'm8.json');
   const deps = boxDeps(mp, { fetchImpl: async () => ({ status: 502 }), timeoutMs: 10 });
-  const r = await sbx.runShipGate({ taskId: 927, files: ['public/game/a.js'], skipStage: false, tty: true }, deps);
+  const r = await sbx.runShipGate({ taskId: 927, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, false, 'a failed stage must not ship as if the review happened');
   assert.equal(r.review, undefined, 'a failure to present is NOT a calm review pause');
   assert.match(r.reason, /DID NOT run/, 'says plainly the review step did not run');
@@ -384,7 +384,7 @@ await ta('runShipGate: --approved cannot pre-approve an UNstaged change (still s
   const deps = boxDeps(mp, { promptYesNo: async () => { throw new Error('must not prompt'); } });
   // No marker → not staged-fresh → --approved is ignored; the gate still stages
   // + aborts for review. You cannot sign off on something never shown.
-  const r = await sbx.runShipGate({ taskId: 1048, files: ['public/game/a.js'], skipStage: false, tty: false, approved: true }, deps);
+  const r = await sbx.runShipGate({ taskId: 1048, files: ['modules/game/public/game/a.js'], skipStage: false, tty: false, approved: true }, deps);
   assert.equal(r.ok, false, '--approved must not bypass the first stage + review');
   assert.equal(r.review, true);
   assert.equal(r.sandboxReview, undefined, 'nothing recorded — nothing was staged to approve');
@@ -402,13 +402,13 @@ await ta('syncWorktreeToServed: brings the branch content into the served checko
   const g = (...a) => execFileSync('git', a, { cwd: served, encoding: 'utf8' });
   g('init', '-q');
   g('config', 'user.email', 't@e.com'); g('config', 'user.name', 't');
-  fs.mkdirSync(path.join(served, 'public'));
-  fs.writeFileSync(path.join(served, 'public', 'game.js'), 'MAIN content\n');
+  fs.mkdirSync(path.join(served, 'modules', 'game', 'public'), { recursive: true });
+  fs.writeFileSync(path.join(served, 'modules', 'game', 'public', 'game.js'), 'MAIN content\n');
   g('add', '.'); g('commit', '-qm', 'main');
   // a linked worktree on a feature branch with different game content
   const wt = fs.mkdtempSync(path.join(os.tmpdir(), 'otb-wt-')) + '/co';
   g('worktree', 'add', '-q', '-b', 'claude/feat', wt);
-  fs.writeFileSync(path.join(wt, 'public', 'game.js'), 'BRANCH content\n');
+  fs.writeFileSync(path.join(wt, 'modules', 'game', 'public', 'game.js'), 'BRANCH content\n');
   execFileSync('git', ['add', '.'], { cwd: wt });
   execFileSync('git', ['commit', '-qm', 'branch edit'], { cwd: wt });
 
@@ -419,7 +419,7 @@ await ta('syncWorktreeToServed: brings the branch content into the served checko
   // The claim is WHICH content landed, not how its lines end: git checks the fixture
   // out under the machine's own autocrlf, so on Windows the file comes back CRLF and a
   // byte-exact compare failed for a reason unrelated to the sync (task 1003529).
-  assert.ok(sameContent(fs.readFileSync(path.join(served, 'public', 'game.js'), 'utf8'), 'BRANCH content\n'),
+  assert.ok(sameContent(fs.readFileSync(path.join(served, 'modules', 'game', 'public', 'game.js'), 'utf8'), 'BRANCH content\n'),
     'served /workspace now shows the SESSION branch content, not stale main');
 
   g('worktree', 'remove', '--force', wt);
@@ -469,26 +469,26 @@ t('syncWorktreeToServed: detached HEAD / unresolvable branch → not ok', () =>
 
 await ta('verifyServedFresh: served bytes match worktree → ok/verified', async () => {
   // dirty a tracked game file so pickVerifyTarget selects it
-  fs.writeFileSync(path.join(tmp, 'public', 'game.js'), 'served-match\n');
+  fs.writeFileSync(path.join(tmp, 'modules', 'game', 'public', 'game.js'), 'served-match\n');
   const r = await sbx.verifyServedFresh({
     cwd: tmp,
     healthUrl: 'http://127.0.0.1:3000/',
     fetchImpl: async (url) => { assert.match(url, /\/game\.js$/); return { status: 200, text: async () => 'served-match\n' }; },
   });
   assert.equal(r.ok, true);
-  assert.equal(r.verified, 'public/game.js');
-  execFileSync('git', ['checkout', '--', 'public/game.js'], { cwd: tmp });
+  assert.equal(r.verified, 'modules/game/public/game.js');
+  execFileSync('git', ['checkout', '--', 'modules/game/public/game.js'], { cwd: tmp });
 });
 
 await ta('verifyServedFresh: served bytes DIFFER → not ok (serving stale code)', async () => {
-  fs.writeFileSync(path.join(tmp, 'public', 'game.js'), 'worktree-new\n');
+  fs.writeFileSync(path.join(tmp, 'modules', 'game', 'public', 'game.js'), 'worktree-new\n');
   const r = await sbx.verifyServedFresh({
     cwd: tmp,
     fetchImpl: async () => ({ status: 200, text: async () => 'stale-old\n' }),
   });
   assert.equal(r.ok, false);
   assert.match(r.reason, /serving stale code/);
-  execFileSync('git', ['checkout', '--', 'public/game.js'], { cwd: tmp });
+  execFileSync('git', ['checkout', '--', 'modules/game/public/game.js'], { cwd: tmp });
 });
 
 await ta('verifyServedFresh: no served static change → skipped (ok)', async () => {
@@ -506,7 +506,7 @@ await ta('stage(box): a HARD sync failure → {ok:false,hard:true}, no marker; r
   assert.equal(staged.hard, true);
   assert.equal(fs.existsSync(mp), false, 'no marker on a hard sync failure');
   // and the gate turns a hard failure into a claim-preserving abort
-  const r = await sbx.runShipGate({ taskId: 1068, files: ['public/game/a.js'], skipStage: false, tty: true }, deps);
+  const r = await sbx.runShipGate({ taskId: 1068, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, false);
   assert.equal(r.review, true);
   assert.match(r.reason, /could not be trusted/);
@@ -526,7 +526,7 @@ await ta('1002607 runShipGate(box): a SOFT failure (preview never healthy) now f
   // sync ok (injected), but health never green → the ship must NOT continue
   // as if the review ran (that was the silent-disable defect).
   const deps = boxDeps(mp, { fetchImpl: async () => ({ status: 502 }), timeoutMs: 10 });
-  const r = await sbx.runShipGate({ taskId: 1068, files: ['public/game/a.js'], skipStage: false, tty: true }, deps);
+  const r = await sbx.runShipGate({ taskId: 1068, files: ['modules/game/public/game/a.js'], skipStage: false, tty: true }, deps);
   assert.equal(r.ok, false, 'the soft failure aborts instead of silently skipping the review');
   assert.match(r.reason, /sandbox staging failed/);
 });
@@ -610,7 +610,7 @@ function localDeps(markerFile, overrides = {}) {
 
 await ta('runShipGate(local): game diff + non-TTY → stages then ABORTS with the localhost URL', async () => {
   const mp = path.join(markerDir, 'lm1.json');
-  const r = await sbx.runShipGate({ taskId: 1056, files: ['public/game/a.js'], skipStage: false, tty: false }, localDeps(mp));
+  const r = await sbx.runShipGate({ taskId: 1056, files: ['modules/game/public/game/a.js'], skipStage: false, tty: false }, localDeps(mp));
   assert.equal(r.ok, false, 'unreviewed game work must not ship non-interactively on a laptop');
   assert.equal(r.review, true);
   assert.match(r.reason, /staged at http:\/\/localhost:3100/i);
@@ -619,7 +619,7 @@ await ta('runShipGate(local): game diff + non-TTY → stages then ABORTS with th
 
 await ta('runShipGate(local): TTY yes → records a tty sign-off with the localhost URL + kind=local marker', async () => {
   const mp = path.join(markerDir, 'lm2.json');
-  const r = await sbx.runShipGate({ taskId: 1056, files: ['src/world/terrain.js'], skipStage: false, tty: true }, localDeps(mp, { promptYesNo: async () => true }));
+  const r = await sbx.runShipGate({ taskId: 1056, files: ['modules/game/world/terrain.js'], skipStage: false, tty: true }, localDeps(mp, { promptYesNo: async () => true }));
   assert.equal(r.ok, true);
   assert.equal(r.sandboxReview.method, 'tty');
   assert.equal(r.sandboxReview.url, 'http://localhost:3100');
@@ -648,5 +648,86 @@ await ta('runShipGate(local): non-game diff (clean tree) → skip, no staging',
 
 fs.rmSync(tmp, { recursive: true, force: true });
 
+// ---------- 1002062: the surface list must describe a REAL tree ----------
+//
+// WHY THESE EXIST. Every case above feeds sandbox-stage its own fixture paths,
+// so the previewable list matched NOTHING in the real repo for 69 days and all
+// 47 tests stayed green. A suite that supplies the paths it tests cannot notice
+// that the paths are wrong. These four look at the real thing instead.
+
+t('1002062 the three surface spellings are DERIVED, so they cannot drift apart', () => {
+  // They used to be three hand-maintained copies. The module carve updated none
+  // of them, and nothing compared them. Derivation is the fix; this pins it.
+  assert.deepEqual(
+    sbx.PREVIEWABLE_PATHSPECS,
+    [...sbx.PREVIEWABLE_DIRS, ...sbx.PREVIEWABLE_ENTRYPOINTS],
+    "PATHSPECS must be derived from DIRS + ENTRYPOINTS, not hand-listed"
+  );
+  for (const d of sbx.PREVIEWABLE_DIRS) {
+    assert.equal(sbx.isPreviewableFile(`${d}/some/file.js`), true, `${d} must match via the derived prefixes`);
+  }
+  for (const e of sbx.PREVIEWABLE_ENTRYPOINTS) {
+    assert.equal(sbx.isPreviewableFile(e), true, `${e} must match via the derived file set`);
+  }
+});
+
+t('1002062 no PRE-CARVE relic survives in the surface list', () => {
+  // The exact spellings that were stale: the carve (ADR 0083 / task 1418) moved
+  // them under modules/game/ and this list kept the old ones.
+  for (const relic of ['public', 'src/world', 'src/rooms']) {
+    assert.ok(
+      !sbx.PREVIEWABLE_PATHSPECS.includes(relic),
+      `${relic} is the pre-carve spelling and matches nothing — it must not be back`
+    );
+  }
+  assert.ok(sbx.PREVIEWABLE_STATIC_DIR.startsWith('modules/'), 'the served static dir is module-carved');
+});
+
+t('1002062 a client directory that matched NOTHING is reported, not swallowed', () => {
+  // THE ACTUAL BUG. The sync collapsed to one boolean, so a run that synced only
+  // the entrypoints and missed every client dir reported plain success — the
+  // reporter saw "synced previewable surfaces" and got a stale sandbox.
+  const served = fs.mkdtempSync(path.join(os.tmpdir(), "sbx-missed-"));
+  const session = fs.mkdtempSync(path.join(os.tmpdir(), "sbx-sess-"));
+  const calls = [];
+  const execFileSyncStub = (bin, args) => {
+    const a = args.join(" ");
+    if (a.includes("rev-parse")) return "feature-branch\n";
+    // Entrypoints resolve; every client directory is absent from the branch.
+    const ps = args[args.length - 1];
+    if (sbx.PREVIEWABLE_DIRS.includes(ps) && a.includes("feature-branch")) {
+      throw new Error(`pathspec ${ps} did not match any file(s) known to git`);
+    }
+    calls.push(a);
+    return "";
+  };
+  const r = sbx.syncWorktreeToServed({
+    execFileSync: execFileSyncStub,
+    servedRoot: served,
+    sessionRoot: session,
+    cwd: session,
+  });
+  assert.equal(r.ok, true, "the entrypoints synced, so the sync itself is not a hard failure");
+  assert.deepEqual(
+    r.missedDirs, sbx.PREVIEWABLE_DIRS,
+    "every client directory missed, and the caller must be told which"
+  );
+});
+
+t('1002062 pickVerifyTarget maps the CARVED static dir onto the served URL', () => {
+  // modules/game/public/game.js is served at /game.js. The old code stripped a
+  // hardcoded "public/" prefix, which post-carve would have left the whole
+  // modules/game/ path in the URL.
+  const rel = `${sbx.PREVIEWABLE_STATIC_DIR}/game.js`;
+  const target = sbx.pickVerifyTarget({
+    cwd: "/nowhere",
+    fs: { existsSync: () => true },
+    execFileSync: (bin, args) => (args.includes("--porcelain") ? ` M ${rel}\n` : ""),
+  });
+  assert.ok(target, "a changed file under the static dir must be pickable");
+  assert.equal(target.relPath, rel);
+  assert.equal(target.urlPath, "/game.js", "the carved prefix is stripped, not just \"public/\"");
+});
+
 console.log(`\nsandbox_stage: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);