@bongos/core 1.19.874 → 1.19.875

package/tests/autobongos_loop.mjs

@@ -253,7 +253,15 @@ test('a goal whose tasks cannot be read is reported, not silently skipped', asyn
 // running. These pin the shape that fixes it.
 
 const goodGauge = () => ({ decision: { go: true, unknown: false, sleepUntil: null, reason: 'headroom' } });
-const aTask = { id: 4242, title: 'Do the thing', kind: 'feature', description: 'd'.repeat(300) };
+const aTask = { id: 4242, title: 'Do the thing', kind: 'feature', description: 'd'.repeat(300), goal_id: 1000119, touches: [] };
+// The FENCE, faked (task 1003908). Step 0 of every iteration now reads the kill
+// switch, the allowlist and the grader's availability from the server; a test that
+// does not say what the fence holds is not describing a run. The fence's own
+// behaviour is tests/autobongos_fence.mjs — here it is a precondition.
+const openFence = () => ({
+  raw: { enabled: true, paused_reason: null, goals: [{ goal_id: 1000119 }] },
+  graderBypassed: false,
+});
 
 function harness(over = {}) {
   const calls = [];
@@ -261,6 +269,7 @@ function harness(over = {}) {
   const blockers = [];
   const deps = {
     gauge: over.gauge || goodGauge,
+    readFence: over.readFence || (async () => openFence()),
     // The LEDGER, faked. iteration() now reads the task back from Bongos after
     // every worker (task 1003903) instead of believing the worker's own verdict,
     // so a test that does not say what the ledger holds is not describing a run.
@@ -288,6 +297,56 @@ function harness(over = {}) {
 }
 const opts = { goals: [1000119], maxTasks: 1, dryRun: false, model: 'm', timeoutMs: 1000 };
 
+test('the fence is read BEFORE the gauge, and a closed one claims nothing', async () => {
+  // Order matters: three of the fence's four gates make every task refusable, so
+  // paying for a capacity read first would be wasted — and a fence checked after
+  // something is claimed is not a fence.
+  let gaugeRead = false;
+  const h = harness({
+    gauge: () => { gaugeRead = true; return goodGauge(); },
+    readFence: async () => ({ raw: { enabled: false, paused_reason: 'owner stopped it' }, graderBypassed: false }),
+  });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.event, 'fenced');
+  assert.equal(row.code, 'kill_switch');
+  assert.match(row.reason, /owner stopped it/);
+  assert.equal(gaugeRead, false, 'the gauge must not be consulted for a run the fence already refused');
+  assert.deepEqual(h.calls, [], 'nothing may be created or claimed behind a closed fence');
+});
+
+test('a bypassed grader stops the runner rather than shipping unreviewed', async () => {
+  const h = harness({ readFence: async () => ({ ...openFence(), graderBypassed: true }) });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.event, 'fenced');
+  assert.equal(row.code, 'grader_unavailable');
+  assert.deepEqual(h.calls, []);
+});
+
+test('the loop picks from the ALLOWLIST, not from what the command line asked for', async () => {
+  let sawGoals = null;
+  const h = harness({ pickTask: async (goals) => { sawGoals = goals; return { task: aTask, goalId: 1000119, skipped: [] }; } });
+  // The operator asks for an allowlisted goal AND one that is not on the list.
+  await runner.iteration({ ...opts, goals: [1000119, 9999999] }, h.deps);
+  assert.deepEqual(sawGoals, [1000119], 'a goal the database does not allow must never reach the picker');
+});
+
+test('a picked task in a non-allowlisted goal is refused before it is claimed', async () => {
+  const h = harness({ pickTask: async () => ({ task: { ...aTask, goal_id: 9999999 }, goalId: 9999999, skipped: [] }) });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.event, 'fenced');
+  assert.equal(row.code, 'goal_not_allowlisted');
+  assert.deepEqual(h.calls, [], 'no worktree, no claim, no worker');
+});
+
+test('a picked task touching a protected path is refused before it is claimed', async () => {
+  const h = harness({ pickTask: async () => ({ task: { ...aTask, touches: ['migrations/999_x.sql', 'docs/canonical-permissions.md'] }, goalId: 1000119, skipped: [] }) });
+  const row = await runner.iteration(opts, h.deps);
+  assert.equal(row.event, 'fenced');
+  assert.equal(row.code, 'protected_path');
+  assert.ok(row.globs.length, 'the refusal must name the surface it hit');
+  assert.deepEqual(h.calls, []);
+});
+
 test('an unknown gauge holds before anything is claimed', async () => {
   const h = harness({ gauge: () => ({ decision: { go: false, unknown: true, reason: 'no gauge file', sleepUntil: null } }) });
   const row = await runner.iteration(opts, h.deps);
@@ -444,3 +503,63 @@ test('each task gets a worktree name that cannot collide with another claim', ()
   assert.notEqual(a, b, 'a collision makes the server store a name the ship lock can never match (task 1004031)');
 });
 
+
+// ── the production call shape ───────────────────────────────────────────────────
+//
+// THE GAP THIS CLOSES, and it is the point of the test rather than a footnote.
+// `harness()` always injects deps.run, so `const runCmd = deps.run || run` at the
+// top of iteration() short-circuits and never evaluates the module-level `run`
+// helper. A later `const run = …` in the same function shadowed that helper
+// through the whole body via its Temporal Dead Zone, so every real invocation —
+// main() calls iteration(opts) with NO deps — threw `ReferenceError: Cannot
+// access 'run' before initialization` on iteration's first meaningful line, while
+// the entire suite stayed green. Shipped code that no test ever calls the way
+// production calls it is untested code, whatever the count says.
+//
+// These drive iteration() with the MINIMUM injection: the two reads that would
+// otherwise touch the network, and nothing else. Anything that resolves from the
+// module scope must resolve for real.
+
+test('iteration() runs with no injected run/spawn — the shape main() actually calls', async () => {
+  const rows = [];
+  const row = await runner.iteration(opts, {
+    readFence: async () => ({ raw: { enabled: false, paused_reason: 'off for the test' }, graderBypassed: false }),
+    record: (r) => { rows.push(r); return r; },
+  });
+  assert.equal(row.event, 'fenced');
+  assert.equal(row.code, 'kill_switch');
+  assert.equal(rows.length, 1);
+});
+
+test('the fenced paths reach their decision with nothing injected but the reads', async () => {
+  // Every refusal that can be reached before the gauge, driven through the real
+  // module-scope bindings. A regression in ANY of them surfaces here as a throw
+  // rather than as a passing test against a fully-mocked function.
+  const cases = [
+    [{ raw: { enabled: true, goals: [{ goal_id: 1000119 }] }, graderBypassed: true }, 'grader_unavailable'],
+    // `opts` asks for goal 1000119, so an EMPTY allowlist refuses it by name.
+    [{ raw: { enabled: true, goals: [] }, graderBypassed: false }, 'goal_not_allowlisted'],
+    [{ raw: null, graderBypassed: false }, 'fence_unreadable'],
+    [{ raw: { enabled: false }, graderBypassed: false }, 'kill_switch'],
+  ];
+  for (const [fenceRead, code] of cases) {
+    const row = await runner.iteration(opts, { readFence: async () => fenceRead, record: (r) => r });
+    assert.equal(row.event, 'fenced', code);
+    assert.equal(row.code, code);
+  }
+});
+
+test('the module-level exec helper is reachable from inside iteration()', async () => {
+  // The narrow assertion the bug would have failed: get PAST the fence, so
+  // `deps.run || run` has to resolve the module-level helper for real, and stop at
+  // the next injected seam. A name that shadows `run` reds this immediately.
+  let picked = false;
+  const row = await runner.iteration(opts, {
+    readFence: async () => openFence(),
+    gauge: goodGauge,
+    pickTask: async () => { picked = true; return { none: true }; },
+    record: (r) => r,
+  });
+  assert.equal(picked, true, 'iteration must reach the picker without touching an un-injected binding');
+  assert.equal(row.event, 'nothing_claimable');
+});