@bongos/core 1.19.724 → 1.19.726

package/tests/government_protected_surfaces.mjs

@@ -518,3 +518,140 @@ test('the floor decision reads the hit\'s registry floor, so a re-map takes effe
   const atFloor = ppc.checkPermissionPaths({ changedFiles: ['migrations/001.sql'], builderRank: 'metic' });
   assert.equal(atFloor.hardFail, false);
 });
+
+
+// ---------------------------------------------------------------------------
+// task 1002874 — NFC + case-folding, the last piece of R101's ADR 0151 §4 scope.
+//
+// R101 shipped the registry with matching left exact-BYTES, deliberately and
+// declared: its hard constraint was byte-identical behaviour, and normalisation
+// changes what matches. This IS that change, so these come in two halves — the
+// wall must now hold against a re-spelling, and nothing protected before may have
+// stopped being protected.
+// ---------------------------------------------------------------------------
+
+// A real literal surface from the registry, not a fixture: this cannot pass
+// against a glob that no longer exists.
+const LITERAL = ppc.PROTECTED_SURFACES.find((s) => !s.glob.includes('*') && !s.glob.endsWith('/'));
+
+test('a CASE variant of a protected path is still protected', () => {
+  assert.ok(LITERAL, 'no literal surface in the registry — this test is reading the wrong shape');
+  assert.ok(ppc.surfaceFor(LITERAL.glob), 'the exact spelling must match (sanity)');
+  // macOS by default and Windows are case-INsensitive: this names the SAME file.
+  assert.ok(ppc.surfaceFor(LITERAL.glob.toUpperCase()),
+    'an uppercased spelling of a protected file must not step over the wall');
+  const mixed = LITERAL.glob.replace(/(^|\/)([a-z])/g, (m, s, c) => s + c.toUpperCase());
+  assert.ok(ppc.surfaceFor(mixed), `a mixed-case spelling must not step over the wall: ${mixed}`);
+});
+
+test('the REPORTED path keeps its original case — only matching is folded', () => {
+  const shouty = LITERAL.glob.toUpperCase();
+  const [hit] = ppc.matchProtected([shouty]);
+  assert.ok(hit, 'the case variant must be caught');
+  assert.equal(hit.file, shouty,
+    'findings, refusals and grader issues all carry this path; a lowercased one names '
+    + 'nothing on a case-SENSITIVE filesystem (Linux, i.e. CI) and would ENOENT for a file that exists');
+  assert.equal(hit.glob, LITERAL.glob, 'and the registry glob is reported verbatim, not folded');
+});
+
+test('an NFD-composed path matches its NFC glob', () => {
+  // The registry is pure ASCII today, so this exercises the mechanism directly:
+  // one filename, two different byte strings, either of which a checkout can hand you.
+  const nfc = 'modules/caf\u00e9/secret.js';
+  const nfd = 'modules/cafe\u0301/secret.js';
+  assert.notEqual(nfc, nfd, 'the two spellings must really differ in bytes, or this proves nothing');
+  const fold = (s) => s.normalize('NFC').toLowerCase();
+  const re = ppc.globToRegExp(fold(nfc));
+  assert.ok(re.test(fold(nfd)), 'NFD and NFC spellings of one filename must match the same glob');
+  assert.ok(re.test(fold(nfc.toUpperCase())), 'and case must not separate them either');
+});
+
+test('STRICTLY WIDENING: every glob still matches a path it matched before', () => {
+  // The regression that would matter is a path silently becoming UNprotected, so
+  // walk the whole registry and synthesise a concrete path from each glob.
+  let checked = 0;
+  for (const s of ppc.PROTECTED_SURFACES) {
+    const sample = s.glob.endsWith('/')
+      ? `${s.glob}probe.js`
+      : s.glob.replace(/\*\*/g, 'x/y').replace(/\*/g, 'z');
+    assert.ok(ppc.surfaceFor(sample), `${s.glob} no longer protects ${sample} — this change must never narrow`);
+    checked += 1;
+  }
+  assert.ok(checked >= 40, `only ${checked} surfaces walked — the registry read is not working`);
+});
+
+test('an UNprotected path is still unprotected — folding must not over-reach', () => {
+  for (const p of ['README.md', 'docs/notes.md', 'tests/example.mjs']) {
+    assert.equal(ppc.surfaceFor(p), null, `${p} must not become protected by normalisation`);
+  }
+});
+
+test('the matcher never uses a LOCALE-sensitive case fold (the Turkish-I hazard)', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'permission-path-check.js'), 'utf8')
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/\/\/[^\n]*/g, '');
+  assert.ok(src.length > 1000, `comment-stripping left only ${src.length} chars — the scan is reading nothing`);
+  assert.ok(!/toLocaleLowerCase|toLocaleUpperCase/.test(src),
+    'toLocaleLowerCase("tr") maps I to dotless i — measured — so a Turkish locale would fold '
+    + 'two different paths together. Plain toLowerCase is locale-independent by specification '
+    + 'and is the correct primitive here; the ADR note warning against it does not apply to JS.');
+  assert.match(src, /toLowerCase\(\)/, 'and the fold must actually be applied');
+  assert.match(src, /normalize\('NFC'\)/, 'as must NFC composition');
+});
+
+
+// ---------------------------------------------------------------------------
+// task 1002874, round 2 — the fold has to reach every PROTECTED matcher, not just
+// the one in permission-path-check.
+//
+// Round 1 fixed matchProtected/surfaceFor and trusted the task description's claim
+// that all eleven substrate consumers route through them. They do not.
+// gate-review.js — the CI ESCALATE / HARD_FLOOR classifier — imported the RAW
+// PROTECTED_GLOBS plus globToRegExp and compiled its own byte-exact regexes, so an
+// uppercased spelling of a gate surface still walked past the auto-merge gate after
+// the wall itself was fixed. Its isCanonicalPath() rejects non-NFC and non-ASCII
+// but does not case-fold, so it never covered this.
+// ---------------------------------------------------------------------------
+
+test('compileGlobMatcher folds BOTH sides', () => {
+  const m = ppc.compileGlobMatcher(['src/bongos/auth.js', 'migrations/']);
+  assert.ok(m('src/bongos/auth.js'), 'exact still matches');
+  assert.ok(m('SRC/BONGOS/AUTH.JS'), 'case variant matches');
+  assert.ok(m('Migrations/001.sql'), 'a folded subtree prefix still matches');
+  assert.ok(!m('docs/readme.md'), 'and an unrelated path does not');
+  assert.ok(!m(''), 'empty is never a match');
+  assert.ok(!m(null), 'nor is a missing path');
+});
+
+test('gate-review classifies a CASE-VARIANT gate surface as hard-floor', () => {
+  const gr = require(path.join(ROOT, 'scripts', 'gds', 'gate-review.js'));
+  const literal = gr.HARD_FLOOR_GLOBS.find((g) => !g.includes('*') && !g.endsWith('/'));
+  assert.ok(literal, 'no literal hard-floor glob — this test is reading the wrong shape');
+  assert.ok(gr.matchesHardFloor(literal), 'the exact spelling must escalate (sanity)');
+  assert.ok(gr.matchesHardFloor(literal.toUpperCase()),
+    'an uppercased gate surface must still escalate — otherwise CI auto-merge is bypassable '
+    + 'by re-spelling, which is the hole this task exists to close');
+});
+
+test('no consumer compiles a PROTECTED glob list byte-exact', () => {
+  // The drift guard. Both globToRegExp and the raw glob lists are exported, so a
+  // consumer can rebuild the byte-exact matcher by accident — which is exactly what
+  // gate-review had done. globToRegExp stays exported because ALLOW-lists
+  // legitimately need it: folding publish-manifest's PUBLISH_ALLOWLIST would widen
+  // what reaches the public OSS mirror, i.e. publish MORE. So the ban is narrow —
+  // pairing a PROTECTED list with the raw compiler in one file.
+  const dir = path.join(ROOT, 'scripts', 'gds');
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith('.js'));
+  assert.ok(files.length > 20, `only ${files.length} scripts scanned — the sweep is not reading the CLI directory`);
+  const offenders = [];
+  for (const f of files) {
+    const src = fs.readFileSync(path.join(dir, f), 'utf8')
+      .replace(/\/\*[\s\S]*?\*\//g, '').replace(/\/\/[^\n]*/g, '');
+    const usesRawCompiler = /globToRegExp\s*\(/.test(src);
+    const usesProtectedList = /(PROTECTED_GLOBS|HARD_FLOOR_GLOBS)\s*\.\s*map/.test(src);
+    if (usesRawCompiler && usesProtectedList) offenders.push(f);
+  }
+  assert.deepEqual(offenders, [],
+    `these compile a protected-surface list with the raw byte-exact compiler; use `
+    + `compileGlobMatcher so the fold reaches them too: ${offenders.join(', ')}`);
+});

package/tests/init.mjs

@@ -535,10 +535,60 @@ test('writeConfigs (greenfield): writes a root README START-HERE, never clobberi
     const md = readFileSync(res.readmePath, 'utf8');
     assert.ok(/## Start here/.test(md) && md.includes('npm install'), 'is the START-HERE guide');
 
-    // A --force re-init must NOT clobber a README the owner has since edited.
+    // A --force re-init must NOT clobber a README the owner has since edited. It APPENDS
+    // the start-here section instead of skipping (the old behaviour silently owed the
+    // `npm install` instruction to every repo that already had a README).
     writeFileSync(res.readmePath, '# my own readme\n');
     init.writeConfigs(fullSpec(), { dir, force: true, dryRun: false, log: () => {} });
-    assert.equal(readFileSync(res.readmePath, 'utf8'), '# my own readme\n', 'existing README left untouched on --force');
+    const after = readFileSync(res.readmePath, 'utf8');
+    assert.ok(after.startsWith('# my own readme\n'), 'the owner\'s own README content is never clobbered');
+    assert.ok(after.includes('npm install'), 'and the first-run instruction is still delivered');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('appendReadmeSection: appends once, then is idempotent', () => {
+  const section = init.buildReadmeSection({ identity: { productName: 'Mercury' } });
+  const own = '# hermes_inventory_management\nInventory Management\n';
+  const first = init.appendReadmeSection(own, section);
+  assert.equal(first.action, 'appended');
+  assert.ok(first.text.startsWith(own), 'the owner\'s content stays at the top, byte-identical');
+  assert.ok(first.text.includes('npm install'), 'delivers the first-run instruction');
+
+  const second = init.appendReadmeSection(first.text, section);
+  assert.equal(second.action, 'present', 're-running init must not stack duplicate sections');
+  assert.equal(second.text, first.text, 'and must not rewrite the file at all');
+});
+
+test('buildReadmeSection: nests under the owner\'s README — no second H1', () => {
+  const section = init.buildReadmeSection({ identity: { productName: 'Mercury' } });
+  assert.ok(!/^# /m.test(section), 'no H1 that would compete with the owner\'s title');
+  assert.ok(section.includes(init.README_MARKER), 'carries the marker that makes re-runs idempotent');
+});
+
+test('layerReadme (adopt): an existing README GETS the start-here section, not a skip', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'adopt-readme-'));
+  try {
+    // The exact shape that broke: a brownfield repo whose own README predates adoption.
+    writeFileSync(join(dir, 'README.md'), '# hermes_inventory_management\nInventory Management\n');
+    const action = init.layerReadme({ identity: { productName: 'Mercury' } }, { dir, dryRun: false, log: () => {} });
+    assert.equal(action, 'appended');
+    const md = readFileSync(join(dir, 'README.md'), 'utf8');
+    assert.ok(md.startsWith('# hermes_inventory_management'), 'owner content preserved');
+    assert.ok(md.includes('npm install'), 'THE FIX: adopt no longer silently owes the first-run guide');
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test('layerReadme (dry-run): reports the append but writes nothing', () => {
+  const dir = mkdtempSync(join(tmpdir(), 'adopt-readme-dry-'));
+  try {
+    writeFileSync(join(dir, 'README.md'), '# mine\n');
+    const action = init.layerReadme({ identity: { productName: 'Mercury' } }, { dir, dryRun: true, log: () => {} });
+    assert.equal(action, 'appended');
+    assert.equal(readFileSync(join(dir, 'README.md'), 'utf8'), '# mine\n', 'dry-run writes nothing');
   } finally {
     rmSync(dir, { recursive: true, force: true });
   }

package/tests/module_api.mjs

@@ -48,6 +48,7 @@ const PUBLISHED_SURFACE = [
   'artistGate', // added by task 1003575 (ADR 0241): the artist gate — off | advisory | strict, plus the pure verdict helpers over it. Two modules ask it two different questions ("file this review?" and "does an open one hold the deploy?") and both must resolve the knob through this one reader, never branding().project
   'readApplicantProfileFromHub', // added by task 1002972 (privacy spec D7): the reviewer queue's LIVE per-render read of one applicant's hub profile view. NARROW by design — the underlying call is authenticated with this instance's hub client secret, and loadIdpConfig stays OFF the doorway so no module ever holds the credential that speaks for the whole project
   'enabledDisciplines', // BV1.R81: instance offered-disciplines (1.9.0; onboarding restock backstop)
+  'isModuleEnabled', // task 1003400: is ANOTHER module present? onboarding's Discord approve/decline control is only actionable when the `discord` module's reaction handler is loaded, so the posting half has to be able to ask
   'registerProvider', 'hasProvider', 'resolve', 'resolveOptional', 'listPorts', 'verifyPortsSatisfied',
   'on', 'emit', 'emitAsync', 'listEvents', 'seamSnapshot',
   'contribute', 'contributions', 'collectContributions', 'listContributionPoints',

package/tests/repo_info_binding.mjs

@@ -208,6 +208,88 @@ test('a good bind still produces the blob/tree bases callers rely on', () => {
   }
 });
 
+// ---- loadFromBranding: the source a standalone instance actually has -------
+//
+// An installed core sits in node_modules/@bongos/core, so loadFromGit correctly refuses
+// and nothing sets the env pin — which meant EVERY standalone instance served a 503 from
+// /public/repo-info while `config/branding.json` held the answer. These cases pin the new
+// source AND, just as importantly, pin that it did not disturb the two above it.
+
+const PACK = { repo: { owner: FIXTURE_OWNER, name: FIXTURE_REPO } };
+
+test('a branding pack with owner + name binds (repo.name maps to repo)', () => {
+  assert.deepEqual(ri.loadFromBranding({ branding: () => PACK }), {
+    owner: FIXTURE_OWNER,
+    repo: FIXTURE_REPO,
+  });
+});
+
+test('the neutral pack (empty strings) is NOT an answer', () => {
+  assert.equal(ri.loadFromBranding({ branding: () => ({ repo: { owner: '', name: '' } }) }), null);
+  assert.equal(ri.loadFromBranding({ branding: () => ({ repo: { owner: '  ', name: FIXTURE_REPO } }) }), null);
+});
+
+test('a pack with no repo key at all → null', () => {
+  assert.equal(ri.loadFromBranding({ branding: () => ({ identity: { productName: 'x' } }) }), null);
+  assert.equal(ri.loadFromBranding({ branding: () => null }), null);
+});
+
+test('a THROWING branding loader degrades to null, never a crash', () => {
+  assert.equal(ri.loadFromBranding({ branding: () => { throw new Error('malformed pack'); } }), null);
+});
+
+test('THE FIX: packaged instance, no env, no git → branding answers instead of 503', () => {
+  ri._resetCacheForTests();
+  try {
+    const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+    const info = ri.loadRepoInfo({
+      execSync: mkExec({ toplevel: path.resolve('/srv/instance') }), // git walks up → refused
+      packageRoot: root,
+      branding: () => PACK,
+    });
+    assert.equal(info.error, undefined, 'the instance declares its own repo — that is not an error case');
+    assert.equal(info.owner, FIXTURE_OWNER);
+    assert.equal(info.repo, FIXTURE_REPO);
+    assert.equal(info.blob_base, `https://github.com/${FIXTURE_OWNER}/${FIXTURE_REPO}/blob/main`);
+  } finally {
+    ri._resetCacheForTests();
+  }
+});
+
+test('git still WINS over branding (the core dev checkout is unchanged)', () => {
+  ri._resetCacheForTests();
+  try {
+    const root = path.resolve('/srv/cloud-bongos');
+    const info = ri.loadRepoInfo({
+      execSync: mkExec({ toplevel: root }), // the remote resolves → git answers
+      packageRoot: root,
+      branding: () => ({ repo: { owner: 'packowner', name: 'packrepo' } }),
+    });
+    assert.equal(info.owner, FIXTURE_OWNER, 'branding must never override a resolved git remote');
+  } finally {
+    ri._resetCacheForTests();
+  }
+});
+
+test('the env pin still WINS over branding (the operator override stays on top)', () => {
+  ri._resetCacheForTests();
+  process.env.OTB_GITHUB_OWNER = 'envowner';
+  process.env.OTB_GITHUB_REPO = 'envrepo';
+  try {
+    const root = path.resolve('/srv/instance/node_modules/@bongos/core');
+    const info = ri.loadRepoInfo({
+      execSync: mkExec({ toplevel: path.resolve('/srv/instance') }),
+      packageRoot: root,
+      branding: () => PACK,
+    });
+    assert.equal(info.owner, 'envowner');
+  } finally {
+    delete process.env.OTB_GITHUB_OWNER;
+    delete process.env.OTB_GITHUB_REPO;
+    ri._resetCacheForTests();
+  }
+});
+
 // ---- end-to-end canary: the regression this must never cause ---------------
 //
 // The only case that touches real git. It earns its place — an anchor rule that is too

package/tests/setup_device_flow_fallback.mjs

@@ -91,6 +91,22 @@ t('names the Settings page, CLI Access, and the owner checkbox repair', () => {
   assert.match(text, /Web sign-in is unaffected/i, 'says what still works');
 });
 
+t('the closing step adapts to the caller — setup pastes, login runs a one-liner', () => {
+  const forSetup = setup.deviceFlowFallbackLines('https://spike.cloudbongos.com').join('\n');
+  const forLogin = setup.deviceFlowFallbackLines('https://spike.cloudbongos.com', { finish: 'login' }).join('\n');
+
+  // The default must be byte-stable — setup's own prompt still says "paste it below".
+  assert.match(forSetup, /paste it below/, 'setup keeps its inline-paste wording');
+  assert.doesNotMatch(forLogin, /paste it below/, '`bongos login` has no paste prompt to point at');
+  assert.match(forLogin, /run it in this shell/, 'login tells you what actually works there');
+
+  // Everything that is genuinely shared stays shared — one source of truth.
+  for (const shared of [/Enable Device Flow/, /CLI Access/, /builders\/settings/]) {
+    assert.match(forSetup, shared);
+    assert.match(forLogin, shared);
+  }
+});
+
 // ── redeemCliToken in a hermetic child against a stubbed instance API ────────
 // A child process because API_BASE + the session path resolve at module load:
 // the child gets GDS_API_BASE → the stub and HOME/USERPROFILE → a throwaway