@bongos/core 1.19.870 → 1.19.872

package/tests/blockers_hall.mjs

@@ -72,15 +72,29 @@ test('blockers.js renders rows through the SAME shared lib the attention slice u
   assert.match(BLOCKERS_JS_SRC, /lib\.blockerFacts\(/);
 });
 
-test('blockers.js pages through OTBKit — makePager/paginate/wirePager/pagerBarHtml — not by hand', () => {
+test('blockers.js pages through OTBKit\'s SERVER-OFFSET pager, not a client-held fetch-then-slice', () => {
+  // task 1003983: `?limit=200` fetched once and sliced client-side with
+  // kit.paginate() silently dropped everything past the 200th open blocker
+  // (200 is _helpers.js parsePagination's MAX_LIMIT) with no notice, and the
+  // headline pill counted the fetched (possibly-truncated) array's length
+  // rather than the route's own `page.total`. The fix asks for one page at a
+  // time — the profile activity-log / session-ledger serverPager precedent
+  // (hall-ui/CLAUDE.md) — so the browser never holds more than one page's
+  // worth of rows.
   assert.match(BLOCKERS_JS_SRC, /kit\.makePager\(/);
-  assert.match(BLOCKERS_JS_SRC, /kit\.paginate\(/);
   assert.match(BLOCKERS_JS_SRC, /kit\.wirePager\(/);
   assert.match(BLOCKERS_JS_SRC, /kit\.pagerBarHtml\(/);
-  // The negative half: no hand-rolled slice math (start/end arithmetic) sitting
-  // beside the kit call, which is what "paged through OTBKit rather than
-  // hand-rolled" would otherwise silently tolerate.
-  assert.doesNotMatch(BLOCKERS_JS_SRC, /\.slice\(\s*\(?\s*pager\.page/);
+  assert.match(BLOCKERS_JS_SRC, /kit\.pageOffset\(/);
+  assert.match(BLOCKERS_JS_SRC, /kit\.renderServerPage\(/);
+  // The negative half: no client-side pager.paginate() slicing, and no fixed
+  // `?limit=200` fetch — both are the truncation shape this task removes.
+  assert.doesNotMatch(BLOCKERS_JS_SRC, /kit\.paginate\(/);
+  assert.doesNotMatch(BLOCKERS_JS_SRC, /\?limit=200/);
+});
+
+test('blockers.js reads the server\'s own page.total for the headline count, never a held array\'s length', () => {
+  assert.match(BLOCKERS_JS_SRC, /data\.page\.total/);
+  assert.doesNotMatch(BLOCKERS_JS_SRC, /all\.length/);
 });
 
 test('blockers.html loads blockers-lib.js BEFORE blockers.js', () => {

package/tests/blockers_kit_pager.mjs

@@ -0,0 +1,260 @@
+// tests/blockers_kit_pager.mjs — task 1003983: blockers.js's server-offset
+// paging, EXECUTED against the real kit and the real page, not just pinned by
+// call-shape regex (tests/blockers_hall.mjs does that half).
+//
+// WHY THIS FILE EXISTS. blockers.js used to fetch the whole open-blocker
+// queue at `?limit=200` once and slice it client-side with `kit.paginate` —
+// past 200 rows it silently dropped everything beyond the 200th and
+// undercounted its own headline pill from that truncated array. The fix
+// moved it onto the kit's server-offset pager primitives, hand-wired the way
+// sessions.js wires them (tests/sessions_kit_pager.mjs is this file's direct
+// model). The first version of that migration shipped WITHOUT sessions.js's
+// rollback behaviour — a failed page-turn wiped the whole list and pager and
+// never restored `pager.page`/`perPage`, so one failed click left the page
+// dead until reload. This file runs the REAL hall-kit.js + the REAL
+// blockers.js in one vm against a stub DOM and a stub `fetch`, so what is
+// asserted is the request the page actually issues and the bar a reader
+// actually sees.
+//
+// Run:  node tests/blockers_kit_pager.mjs
+import { strict as assert } from 'node:assert';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const KIT_JS = read('modules/hall-ui/public/hall-kit.js');
+const BLOCKERS_JS = read('modules/hall-ui/public/blockers.js');
+
+const { test, summary } = makeRunner();
+const tick = () => new Promise((r) => setTimeout(r, 0));
+
+function makeEl(id) {
+  const listeners = new Map();
+  return {
+    id,
+    innerHTML: '', textContent: '', className: '', value: '',
+    hidden: false, disabled: false,
+    options: [], style: {}, dataset: {},
+    classList: { add() {}, remove() {}, toggle() {} },
+    addEventListener(ev, fn) {
+      if (!listeners.has(ev)) listeners.set(ev, []);
+      listeners.get(ev).push(fn);
+    },
+    fire(ev, arg) { for (const fn of listeners.get(ev) || []) fn(arg); },
+  };
+}
+
+// `b(id)` is a minimal blocker row — enough for blockerFacts() (loaded as
+// window.OTBBlockersLib) to render without throwing.
+const b = (id) => ({ id, title: `Blocker ${id}`, body_md: '', created_at: '2026-08-01T00:00:00Z', blocking_task_ids: [] });
+
+function harness({ total = 57, failAfter = null, perPagePref = null } = {}) {
+  const els = new Map();
+  const getEl = (id) => {
+    if (!els.has(id)) els.set(id, makeEl(id));
+    return els.get(id);
+  };
+  const documentObj = {
+    getElementById: getEl,
+    querySelector(sel) { return getEl(String(sel).replace(/^#/, '')); },
+    addEventListener() {},
+  };
+
+  const requests = [];
+  let calls = 0;
+  const rowsFor = (limit, offset) => Array.from(
+    { length: Math.max(0, Math.min(limit, total - offset)) },
+    (_, i) => b(offset + i + 1)
+  );
+
+  const fetchImpl = async (url) => {
+    requests.push(url);
+    calls += 1;
+    if (failAfter != null && calls > failAfter) {
+      return { ok: false, status: 500, json: async () => ({}) };
+    }
+    const q = new URLSearchParams(url.split('?')[1] || '');
+    const limit = Number(q.get('limit'));
+    const offset = Number(q.get('offset'));
+    return {
+      ok: true,
+      status: 200,
+      json: async () => ({ blockers: rowsFor(limit, offset), page: { limit, offset, total } }),
+    };
+  };
+
+  const store = new Map();
+  if (perPagePref != null) store.set('hall-blockers-per-page', String(perPagePref));
+
+  const toasts = [];
+  const windowObj = {
+    fetch: fetchImpl,
+    localStorage: {
+      getItem: (k) => (store.has(k) ? store.get(k) : null),
+      setItem: (k, v) => store.set(k, String(v)),
+    },
+    OTB: { toast: (msg) => toasts.push(msg) },
+    addEventListener() {},
+    // loadViewer() calls this for GET /me; signed-out (401) keeps isReviewer()
+    // false, which is fine for these paging tests — they don't inspect the
+    // Resolve/Link action column.
+    BongosClient: { createClient: () => ({ request: async () => ({ status: 401, ok: false, data: null }) }) },
+    OTBBlockersLib: {
+      esc: (s) => String(s ?? ''),
+      blockerFacts: (row) => ({
+        titleHtml: `<a>${row.title}</a>`, noteHtml: '', factsHtml: '<span></span>',
+      }),
+    },
+  };
+
+  const sandbox = {
+    window: windowObj, document: documentObj, fetch: fetchImpl,
+    console: { error() {}, warn() {}, log() {} },
+    setTimeout, clearTimeout, URLSearchParams,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(KIT_JS, sandbox, { filename: 'hall-kit.js' });
+  vm.runInContext(BLOCKERS_JS, sandbox, { filename: 'blockers.js' });
+
+  const q = (n) => {
+    const url = requests[n < 0 ? requests.length + n : n];
+    return Object.fromEntries(new URLSearchParams(url.split('?')[1]));
+  };
+  return { getEl, requests, q, store, toasts };
+}
+
+await test('the first load asks the SERVER for one page — the corpus is never held', async () => {
+  const h = harness({ total: 57 });
+  await tick(); await tick();
+  assert.equal(h.requests.length, 1);
+  const p = h.q(0);
+  assert.equal(p.offset, '0');
+  assert.equal(p.limit, '25', 'the page keeps its default per-page');
+});
+
+await test('the headline pill reads page.total, not the fetched rows\' own count', async () => {
+  const h = harness({ total: 57 });
+  await tick(); await tick();
+  assert.equal(h.getEl('blockers-count').textContent, '57');
+  assert.equal(h.getEl('blockers-count').hidden, false);
+});
+
+await test('Next moves the offset by the reader\'s per-page, and the bar says where they are', async () => {
+  const h = harness({ total: 57 });
+  await tick(); await tick();
+  h.getEl('blockers-next').fire('click');
+  await tick(); await tick();
+  assert.equal(h.requests.length, 2);
+  assert.equal(h.q(-1).offset, '25');
+  assert.equal(h.getEl('blockers-page').textContent, 'Page 2 of 3');
+  assert.equal(h.getEl('blockers-range').textContent, 'Showing 26–50 of 57');
+});
+
+await test('per-page is a real control: it re-asks, resets to page 1, and persists', async () => {
+  const h = harness({ total: 57 });
+  await tick(); await tick();
+  h.getEl('blockers-next').fire('click');
+  await tick(); await tick();
+  assert.equal(h.q(-1).offset, '25', 'sanity: on page 2');
+
+  h.getEl('blockers-per-page').fire('change', { target: { value: '50' } });
+  await tick(); await tick();
+  const p = h.q(-1);
+  assert.equal(p.limit, '50');
+  assert.equal(p.offset, '0', 'a per-page change returns to page 1');
+  assert.equal(h.store.get('hall-blockers-per-page'), '50');
+});
+
+await test('a remembered per-page is used on the very first request', async () => {
+  const h = harness({ total: 57, perPagePref: 10 });
+  await tick(); await tick();
+  assert.equal(h.requests.length, 1);
+  assert.equal(h.q(0).limit, '10');
+});
+
+// ---------------------------------------------------------------------------
+// the bug this task fixes: a failed PAGE-TURN used to wipe the whole list and
+// pager and never restore pager.page/perPage — one failed click left the page
+// permanently dead. sessions.js's contract (hall-ui/CLAUDE.md) is the fix.
+// ---------------------------------------------------------------------------
+
+await test('a failed page-turn ROLLS BACK — the bar never claims a page whose rows never came', async () => {
+  const h = harness({ total: 57, failAfter: 1 });
+  await tick(); await tick();
+  assert.equal(h.getEl('blockers-page').textContent, 'Page 1 of 3');
+
+  h.getEl('blockers-next').fire('click');
+  await tick(); await tick();
+  assert.equal(h.requests.length, 2, 'it did try');
+  assert.equal(h.getEl('blockers-page').textContent, 'Page 1 of 3',
+    'the failed page 2 must not be left showing in the bar');
+  assert.equal(h.getEl('blockers-range').textContent, 'Showing 1–25 of 57',
+    'and the range must still describe the rows actually on screen');
+});
+
+await test('a failed page-turn does NOT wipe the list — the reader can retry from the pager', async () => {
+  const h = harness({ total: 57, failAfter: 1 });
+  await tick(); await tick();
+  const before = h.getEl('blockers-list').innerHTML;
+  assert.ok(before.length > 0, 'sanity: rows painted');
+
+  h.getEl('blockers-next').fire('click');
+  await tick(); await tick();
+  assert.equal(h.getEl('blockers-list').innerHTML, before,
+    'the last successfully painted rows must still be on screen');
+  assert.equal(h.getEl('blockers-body').className, '',
+    'notice()\'s full-body wipe must not fire once something has painted');
+  assert.equal(h.toasts.length, 1, 'the reader is told, even though the list stays put');
+});
+
+await test('a failed FIRST load still shows the honest notice — nothing has painted to keep', async () => {
+  const h = harness({ total: 57, failAfter: 0 });
+  await tick(); await tick();
+  assert.equal(h.getEl('blockers-body').className, 'note');
+  assert.match(h.getEl('blockers-body').textContent, /couldn.t load/i);
+});
+
+await test('a failed per-page change rolls the SIZE back too', async () => {
+  const h = harness({ total: 57, failAfter: 1 });
+  await tick(); await tick();
+  h.getEl('blockers-per-page').fire('change', { target: { value: '10' } });
+  await tick(); await tick();
+  h.getEl('blockers-next').fire('click');
+  await tick(); await tick();
+  // Back on the 25-row page 1, the only page whose rows ever arrived, so Next
+  // asks for offset 25, not offset 10.
+  assert.equal(h.q(-1).limit, '25');
+});
+
+await test('nothing is pressable while a fetch is in flight', async () => {
+  const h = harness({ total: 57 });
+  await tick(); await tick();
+  assert.equal(h.getEl('blockers-per-page').disabled, false, 'idle: the control is live');
+  h.getEl('blockers-next').fire('click');
+  // deliberately not awaited — this is mid-flight
+  assert.equal(h.getEl('blockers-next').disabled, true, 'in flight: Next is dead');
+  assert.equal(h.getEl('blockers-prev').disabled, true, 'in flight: Prev is dead');
+  assert.equal(h.getEl('blockers-per-page').disabled, true, 'in flight: per-page is dead');
+  await tick(); await tick();
+  assert.equal(h.getEl('blockers-per-page').disabled, false, 'landed: live again');
+});
+
+await test('Prev stays dead on page 1 — the kit decides that, not the page', async () => {
+  const h = harness({ total: 57 });
+  await tick(); await tick();
+  assert.equal(h.getEl('blockers-prev').disabled, true);
+  assert.equal(h.getEl('blockers-next').disabled, false);
+});
+
+await test('a queue that fits one page shows no bar at all', async () => {
+  const h = harness({ total: 4 });
+  await tick(); await tick();
+  assert.equal(h.getEl('blockers-pager').hidden, true);
+});
+
+summary();

package/tests/blockers_page_ui.mjs

@@ -285,8 +285,9 @@ await test('a reviewer resolving a row posts to the real route, toasts, and relo
   assert.equal(posts.length, 1);
   assert.equal(posts[0].body.resolution_note, 'raised the budget');
   assert.ok(h.toasts.some((t) => t === 'Blocker #12 resolved.'));
-  // reload() re-fetches — a second GET /blockers beyond the initial boot fetch.
-  assert.ok(h.requestsTo('GET', /\/blockers\?limit=200$/).length >= 2, 'the queue reloads after a mutation');
+  // reload() re-fetches the current server page (task 1003983's server-offset
+  // paging) — a second GET beyond the initial boot fetch, same page/offset.
+  assert.ok(h.requestsTo('GET', /\/blockers\?limit=25&offset=0$/).length >= 2, 'the queue reloads after a mutation');
 });
 
 await test('a reviewer linking a row posts task_id as a NUMBER', async () => {
@@ -312,13 +313,13 @@ await test('a 403 on resolve renders HONEST copy and leaves the form open — ne
 
 await test('resolving through the shared #/blocker/N overlay (otb:blocker-resolved) reloads this page\'s queue too', async () => {
   const h = await boot({ rank: 'metic' });
-  const before = h.requestsTo('GET', /\/blockers\?limit=200$/).length;
+  const before = h.requestsTo('GET', /\/blockers\?limit=25&offset=0$/).length;
   // Simulate task-detail.js's blockerPanel firing the event on THIS window —
   // the SAME event the overlay dispatches when a builder resolves a blocker
   // from the deep-link card opened on top of this page.
   h.dispatchWindowEvent('otb:blocker-resolved');
   await h.settle();
-  const after = h.requestsTo('GET', /\/blockers\?limit=200$/).length;
+  const after = h.requestsTo('GET', /\/blockers\?limit=25&offset=0$/).length;
   assert.equal(after, before + 1, 'the queue re-fetched exactly once in response to the event');
 });
 

package/tests/box_ship_permissions.mjs

@@ -92,6 +92,7 @@ function allowCovers(allow, command) {
   return parts.every((part) => allow.some((rule) => ruleCovers(rule, part)));
 }
 const isBlocked = (command) => guard.decide({ tool_name: 'Bash', tool_input: { command } }, {}).block;
+const isBlockedPwsh = (command) => guard.decide({ tool_name: 'PowerShell', tool_input: { command } }, {}).block;
 
 // At least one sample per git-guard rule, keyed by the rule's own name.
 const BLOCKED_SAMPLES = {
@@ -101,13 +102,42 @@ const BLOCKED_SAMPLES = {
   'git branch -D': ['git branch -D task-1', 'git branch --list -D task-1', 'git branch -a -D task-1'],
 };
 
+// The samples above are all Bash-shaped, and replaying them against PowerShell would
+// prove nothing: they are the one spelling that already matched (task 1004028). A
+// Windows session writes the executable in whatever case it likes, appends `.exe`,
+// and may carry a backtick that vanishes — so each rule owns a sample in a spelling
+// only PowerShell resolves, and a new rule cannot be added without one.
+const BLOCKED_SAMPLES_PWSH = {
+  'git stash': ['Git stash', 'GIT.EXE stash pop'],
+  'git worktree remove': ['git.exe worktree remove ../wt', 'Git worktree remove --force ../wt'],
+  'git push origin main': ['g`it push origin main', 'GIT push -u origin HEAD:main'],
+  'git branch -D': ['GIT branch -D task-1', 'Git.exe branch -a -D task-1'],
+};
+
 test('every git-guard rule has blocked samples here (a new rule forces a new sample)', () => {
   for (const [name] of guard.RULES) {
     assert.ok((BLOCKED_SAMPLES[name] || []).length, `no blocked sample for git-guard rule "${name}"`);
+    assert.ok((BLOCKED_SAMPLES_PWSH[name] || []).length, `no PowerShell-spelled sample for git-guard rule "${name}"`);
   }
   for (const samples of Object.values(BLOCKED_SAMPLES)) {
     for (const cmd of samples) assert.ok(isBlocked(cmd), `sample is not actually blocked by git-guard: ${cmd}`);
   }
+  for (const samples of Object.values(BLOCKED_SAMPLES_PWSH)) {
+    for (const cmd of samples) {
+      assert.ok(isBlockedPwsh(cmd), `PowerShell sample is not actually blocked by git-guard: ${cmd}`);
+    }
+  }
+});
+
+// Each PowerShell sample must be spelled in a way the Bash-shaped list does not
+// already cover — otherwise the new list is a copy and proves nothing. Every one
+// differs from a plain `git …` in the executable token alone.
+test('the PowerShell samples are genuinely different spellings, not a copy', () => {
+  const bashSamples = new Set(Object.values(BLOCKED_SAMPLES).flat());
+  for (const cmd of Object.values(BLOCKED_SAMPLES_PWSH).flat()) {
+    assert.ok(!bashSamples.has(cmd), `PowerShell sample repeats a Bash sample verbatim: ${cmd}`);
+    assert.ok(!/^git /.test(cmd), `PowerShell sample uses the one spelling that always matched: ${cmd}`);
+  }
 });
 
 test('no allow-rule covers a command git-guard blocks', () => {