@bongos/core 1.19.847 → 1.19.849

package/tests/paste_token_session_store.mjs

@@ -0,0 +1,188 @@
+// tests/paste_token_session_store.mjs — a paste must not destroy the OTHER instance's
+// session (task 1004003, ADR 0269).
+//
+// THE BUG. `scripts/gds/paste-token.js` wrote the session with a bare
+// `fs.writeFileSync(SESSION_PATH, ...)`. SESSION_PATH is the ACTIVE POINTER and nothing
+// else. Under ADR 0269 a machine has several instances, and `saveSession()` in cli-lib is
+// the only writer that knows it: it archives the OUTGOING session into the host-keyed
+// store before overwriting the pointer, and files the incoming one there too. Writing the
+// pointer directly skipped both steps, so pasting a token for instance B while signed in
+// to instance A overwrote A with no archive. `bongos login <A>` exists precisely to switch
+// back without a fresh device flow — it reads that store, found no entry, and the switch
+// back cost a full re-auth. Nothing was recoverable, because the pointer is the very file
+// that was overwritten.
+//
+// WHY THIS IS END-TO-END AND NOT A SOURCE SCAN. The divergence between the two write paths
+// went unnoticed for a release precisely because no test ever ran a paste and then looked
+// for the other instance. A grep for `saveSession` would pass on a call that is there and
+// wrong; running the script and reading the store is the only assertion that cannot.
+// paste-token verifies the token against `<base>/api/bongos/me` before it writes anything,
+// so the "instance" below is a real local HTTP server and the flow is the real one.
+//
+// Run:  node --test tests/paste_token_session_store.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import os from 'node:os';
+import fs from 'node:fs';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { spawn, spawnSync } from 'node:child_process';
+
+const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const ic = require(path.join(REPO_ROOT, 'src', 'instance-config.js'));
+const PASTE_TOKEN = path.join(REPO_ROOT, 'scripts', 'gds', 'paste-token.js');
+
+// SETTING `HOME` ALONE IS NOT ISOLATION (task 1003760, learned the expensive way in
+// tests/cli_sessions.mjs): on Windows os.homedir() reads USERPROFILE and never consults
+// HOME, so a HOME-only override writes the fixtures into the developer's REAL session
+// store and overwrites their live credentials. Override every variable a platform might
+// read, and — because the child here is paste-token itself and cannot carry an inline
+// guard — prove the relocation with a probe child BEFORE anything writes (see `sandbox`).
+function sandboxEnv(home) {
+  const { root } = path.parse(home);
+  return {
+    ...process.env,
+    HOME: home,
+    USERPROFILE: home,                          // Windows: what os.homedir() actually reads
+    HOMEDRIVE: root.replace(/[\\/]+$/, ''),     // legacy Windows fallback pair
+    HOMEPATH: home.slice(root.length - 1) || '\\',
+  };
+}
+
+// A throwaway home plus the two paths paste-token will resolve inside it. Both are read
+// from the child, not computed here: the parent's own SESSION_PATH froze at module load
+// against the REAL home, so any path this process derives would name the wrong file.
+function sandbox() {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-paste-'));
+  const probe = spawnSync(process.execPath, ['-e', `
+    const os = require('node:os');
+    if (os.homedir() !== ${JSON.stringify(home)}) { console.error('ESCAPE ' + os.homedir()); process.exit(2); }
+    const ic = require(${JSON.stringify(path.join(REPO_ROOT, 'src', 'instance-config.js').replace(/\\/g, '/'))});
+    console.log(JSON.stringify({
+      active: ic.configPath(ic.SESSION_FILENAMES[0]),
+      store: require('node:path').join(os.homedir(), '.config', ic.FALLBACK_DIR, 'instances'),
+    }));`], { encoding: 'utf8', env: sandboxEnv(home) });
+  if (probe.status !== 0) {
+    fs.rmSync(home, { recursive: true, force: true });
+    // Loud, never skipped: a test whose whole job is writing a session store must prove
+    // it cannot reach the real one rather than quietly running anyway.
+    throw new Error(`sandbox did not relocate os.homedir() on this platform: ${probe.stdout}${probe.stderr}`);
+  }
+  const { active, store } = JSON.parse(probe.stdout.trim().split('\n').pop());
+  assert.ok(active.startsWith(home), `the active pointer resolved OUTSIDE the sandbox: ${active}`);
+  assert.ok(store.startsWith(home), `the session store resolved OUTSIDE the sandbox: ${store}`);
+  return { home, active, store };
+}
+
+// One instance, as far as paste-token can tell: it only ever calls GET /api/bongos/me.
+async function withInstance(body) {
+  const server = http.createServer((req, res) => {
+    if (!req.url.startsWith('/api/bongos/me')) { res.writeHead(404).end('{}'); return; }
+    if (req.headers.authorization !== 'Bearer ' + 'B'.repeat(64)) { res.writeHead(401).end('{}'); return; }
+    res.writeHead(200, { 'content-type': 'application/json' });
+    res.end(JSON.stringify({ builder: { id: 42, github_login: 'paster', rank: 'metic' } }));
+  });
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  try { return await body(base); } finally { await new Promise((r) => server.close(r)); }
+}
+
+// ASYNC ON PURPOSE, and it must stay that way: spawnSync blocks this process's event
+// loop, so the instance server above — which lives in THIS process — can never accept the
+// child's verify call, and the paste hangs until the suite times out. The two deadlock
+// each other, which reads exactly like a hung test rather than a wrong one.
+function runPaste(home, args) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [PASTE_TOKEN, ...args], { env: sandboxEnv(home) });
+    let out = '';
+    child.stdout.on('data', (d) => { out += d; });
+    child.stderr.on('data', (d) => { out += d; });
+    child.on('close', (status) => resolve({ status, out }));
+  });
+}
+
+function readJson(p) {
+  try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch (_) { return null; }
+}
+
+test('pasting a token for instance B PRESERVES instance A — the bug this closes', async () => {
+  const { home, active, store } = sandbox();
+  try {
+    await withInstance(async (base) => {
+      // Signed in to A, the way a builder actually is: an active pointer and nothing else
+      // — the pre-store shape saveSession's archive step exists to rescue.
+      fs.mkdirSync(path.dirname(active), { recursive: true });
+      fs.writeFileSync(active, JSON.stringify({
+        token: 'TOKEN-A', api_base: 'https://a.example.com',
+        builder: { github_login: 'someone' }, gemini_api_key: 'KEY-KEEP-ME',
+      }), { mode: 0o600 });
+
+      const r = await runPaste(home, ['B'.repeat(64), '--api-base', base]);
+      assert.equal(r.status, 0, `paste failed: ${r.out}`);
+
+      // 1. THE REGRESSION. A is archived under its own host and is still readable, so
+      //    `bongos login https://a.example.com` can switch back with no device flow.
+      const archived = readJson(path.join(store, 'a.example.com.json'));
+      assert.ok(archived, 'instance A was not archived — a paste destroyed it, the bug is back');
+      assert.equal(archived.token, 'TOKEN-A');
+      assert.equal(archived.api_base, 'https://a.example.com');
+
+      // 2. B is filed in the store too, not only at the pointer — otherwise the NEXT
+      //    paste has nothing of B's to archive and the same loss happens one step later.
+      const key = `127.0.0.1_${new URL(base).port}.json`;
+      const stored = readJson(path.join(store, key));
+      assert.ok(stored, `instance B was not filed in the store (looked for ${key})`);
+      assert.equal(stored.token, 'B'.repeat(64));
+
+      // 3. The active pointer still follows the paste, in the same place every existing
+      //    reader (skills, hooks, the dev box) looks. The fix is additive or it is a
+      //    different, quieter outage.
+      const pointer = readJson(active);
+      assert.equal(pointer.api_base, base, 'the active pointer must follow the paste');
+      assert.equal(pointer.token, 'B'.repeat(64));
+      assert.equal(pointer.builder.github_login, 'paster');
+
+      // 4. The merge contract paste-token already owed (task 1003704) survives the
+      //    reroute: a re-auth must never silently un-register a builder's art key.
+      assert.equal(pointer.gemini_api_key, 'KEY-KEEP-ME', 'the paste dropped a preserved field');
+    });
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('a rejected token writes nothing at all — not the pointer, not the store', async () => {
+  // The verify-before-write contract is what protects the session a bad paste was meant to
+  // REPLACE. Routing through saveSession must not move the write ahead of the check: that
+  // would turn a typo into the very cross-instance loss the first test closes.
+  const { home, active, store } = sandbox();
+  try {
+    await withInstance(async (base) => {
+      fs.mkdirSync(path.dirname(active), { recursive: true });
+      fs.writeFileSync(active, JSON.stringify({
+        token: 'TOKEN-A', api_base: 'https://a.example.com', builder: { github_login: 'someone' },
+      }), { mode: 0o600 });
+
+      const r = await runPaste(home, ['W'.repeat(64), '--api-base', base]);
+      assert.equal(r.status, 3, `a 401 must exit 3, got ${r.status}: ${r.out}`);
+      assert.equal(readJson(active).token, 'TOKEN-A', 'a rejected paste overwrote the live session');
+      assert.ok(!fs.existsSync(store), 'a rejected paste filed something in the store');
+    });
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('paste-token routes the write through saveSession, not a bare writeFileSync', () => {
+  // The behavioural tests above are the real assertion. This one names the mechanism, so a
+  // future edit that "simplifies" the call back to a direct write fails on the line it
+  // changed rather than on a store path three files away.
+  const src = fs.readFileSync(PASTE_TOKEN, 'utf8');
+  assert.match(src, /await saveSession\(next\)/, 'the session write must go through saveSession');
+  assert.ok(!/writeFileSync\(\s*SESSION_PATH/.test(src),
+    'SESSION_PATH is the ACTIVE POINTER — writing it directly skips the per-instance archive (ADR 0269)');
+});

package/tests/provision.mjs

@@ -816,6 +816,78 @@ t('installedCorePackDir: a registry-pinned consumer with an installed core → i
   [reg, filePinned, uninstalled, bare2, alt2].forEach((d) => rmSync(d, { recursive: true, force: true }));
 });
 
+// ── the git-less core checkout: rung 4 (task 1003995) ────────────────────────────
+// The shipped self-host image is a complete core source tree with NO .git (.dockerignore
+// excludes it by design), so package-core.js's `git ls-tree` enumeration has nothing to
+// read and the scaffold inside the container could never build the tarball it vendors
+// into a child. Rung 4 packs the working tree instead.
+t('coreCheckoutHasGit: a clone (.git dir) and a linked worktree (.git file) both have history; the image does not', () => {
+  const clone = mkdtempSync(join(tmpdir(), 'cchg-clone-'));
+  mkdirSync(join(clone, '.git'));
+  assert.equal(P.coreCheckoutHasGit({ repoRoot: clone }), true, 'a clone carries a .git DIRECTORY');
+
+  // A linked worktree's .git is a FILE pointing at the real gitdir — every claim in this
+  // project is worked in one, so treating it as history-less would take the wrong rung on
+  // the machine that runs these tests.
+  const wt = mkdtempSync(join(tmpdir(), 'cchg-worktree-'));
+  writeFileSync(join(wt, '.git'), 'gitdir: /somewhere/.git/worktrees/task-1\n');
+  assert.equal(P.coreCheckoutHasGit({ repoRoot: wt }), true, 'a linked worktree carries a .git FILE');
+
+  const image = mkdtempSync(join(tmpdir(), 'cchg-image-'));
+  assert.equal(P.coreCheckoutHasGit({ repoRoot: image }), false, 'the self-host image has no .git at all');
+
+  [clone, wt, image].forEach((d) => rmSync(d, { recursive: true, force: true }));
+});
+
+t('resolveVendorableCoreTarball: the ladder picks file: pin → registry pack → git source → worktree, in that order', () => {
+  // One helper per rung so the ONLY thing varying between cases is which shape the
+  // control-plane root presents. Asserting on the recorded commands is what proves the
+  // ORDER: a rung that fires early leaves the later rung's command unrun.
+  const run = (instanceRoot, repoRoot) => {
+    const cmds = [];
+    const res = P.resolveVendorableCoreTarball({
+      instanceRoot, repoRoot, exec: (c) => { cmds.push(c); }, log: () => {}, coreV: '9.9.9',
+    });
+    return { cmds, ...res };
+  };
+  const gitRoot = mkdtempSync(join(tmpdir(), 'rvct-git-'));
+  mkdirSync(join(gitRoot, '.git'));
+  const bareRoot = mkdtempSync(join(tmpdir(), 'rvct-bare-'));   // no .git → the image shape
+
+  // Rung 1 — a file: pin wins even from a git-less root: nothing is rebuilt at all.
+  const filePinned = mkdtempSync(join(tmpdir(), 'rvct-file-'));
+  mkdirSync(join(filePinned, 'vendor'));
+  writeFileSync(join(filePinned, 'vendor', 'bongos-core-1.2.3.tgz'), 'x');
+  writeFileSync(join(filePinned, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': 'file:vendor/bongos-core-1.2.3.tgz' } }));
+  const r1 = run(filePinned, bareRoot);
+  assert.equal(r1.tgz, join(filePinned, 'vendor', 'bongos-core-1.2.3.tgz'));
+  assert.deepEqual(r1.cmds, [], 'rung 1 runs no command — it reuses bytes already on disk');
+
+  // Rung 2 — a registry-installed core packs, still without touching package-core.js.
+  const reg = mkdtempSync(join(tmpdir(), 'rvct-reg-'));
+  mkdirSync(join(reg, 'node_modules', '@bongos', 'core'), { recursive: true });
+  writeFileSync(join(reg, 'node_modules', '@bongos', 'core', 'package.json'), JSON.stringify({ name: '@bongos/core', version: '1.19.56' }));
+  writeFileSync(join(reg, 'package.json'), JSON.stringify({ dependencies: { '@bongos/core': '1.19.56' } }));
+  const r2 = run(reg, bareRoot);
+  assert.ok(r2.cmds.some((c) => c.startsWith('npm pack ')), 'rung 2 packs the installed core');
+  assert.ok(!r2.cmds.some((c) => /package-core\.js/.test(c)), 'rung 2 never reaches package-core.js');
+  assert.ok(r2.packDest, 'rung 2 returns the temp pack dir for the caller to clean up');
+
+  // Rung 3 — a source checkout WITH history rebuilds reproducibly from the ref.
+  const source = mkdtempSync(join(tmpdir(), 'rvct-src-'));
+  const r3 = run(source, gitRoot);
+  assert.deepEqual(r3.cmds, ['node scripts/gds/package-core.js'], 'history present → the ref build, NOT --from-worktree');
+  assert.equal(r3.tgz, join(gitRoot, 'dist', 'bongos-core-9.9.9.tgz'));
+  assert.equal(r3.packDest, null);
+
+  // Rung 4 — the same source checkout with its history stripped: the self-host image.
+  const r4 = run(source, bareRoot);
+  assert.deepEqual(r4.cmds, ['node scripts/gds/package-core.js --from-worktree'], 'no history → pack the working tree');
+  assert.equal(r4.tgz, join(bareRoot, 'dist', 'bongos-core-9.9.9.tgz'), 'the child still pins the running CORE_VERSION');
+
+  [gitRoot, bareRoot, filePinned, reg, source].forEach((d) => rmSync(d, { recursive: true, force: true }));
+});
+
 await ta('scaffoldStandaloneRepo: a REGISTRY-pinned consumer control plane PACKS its installed core — current version, no source rebuild (task 1002706)', async () => {
   const cp = mkdtempSync(join(tmpdir(), 'cpdir-cp-'));
   mkdirSync(join(cp, 'node_modules', '@bongos', 'core'), { recursive: true });