@bongos/core 1.19.875 → 1.19.877

package/modules/hall-ui/public/gate.js

@@ -254,7 +254,7 @@
     const el = document.getElementById('fence-state');
     el.innerHTML = `
       <div class="ov-foot" style="display:flex;align-items:center;gap:12px;flex-wrap:wrap;">
-        <strong>${on ? 'Running' : 'Stopped'}</strong>
+        <span class="fact-pill ${on ? 'fact-pill--ok' : 'fact-pill--warn'}">${on ? 'Allowed to work' : 'Stopped'}</span>
         <span>${on ? 'The runner may claim and work allowlisted goals.' : escapeHtml(fence.paused_reason || 'The runner is doing nothing.')}</span>
         <button type="button" id="fence-toggle" class="btn">${on ? 'Stop the runner' : 'Start the runner'}</button>
       </div>`;
@@ -317,6 +317,54 @@
     }
   }
 
+  // The runner's liveness (task 1003905). Rendered ABOVE the switch on purpose:
+  // "is it running at all" is the first question, and an owner who has just
+  // flipped the switch on wants to see the machine notice.
+  //
+  // The verdict is the SERVER's — modules/autonomy/runner-health.js decides what
+  // dead means and the route attaches it — so this page and any future alert
+  // cannot drift into two definitions of the same word.
+  // This page's OWN class vocabulary (style.css `.fact-pill--{ok,warn,danger}`),
+  // the same one renderRow spends for a PR's verdict. The first cut reached for
+  // inline `--color-text-*` tokens from a different design system: they do not
+  // exist here, resolved to inherited grey, and drew a dead runner in exactly the
+  // same colour as a healthy one. Named classes cannot fail that way silently —
+  // a missing class is visible in the stylesheet, a missing var is not.
+  const HEALTH_CLASS = { alive: 'fact-pill--ok', late: 'fact-pill--warn', dead: 'fact-pill--danger', never_seen: 'fact-pill--info' };
+
+  async function loadRunners() {
+    const el = document.getElementById('fence-runner');
+    if (!el) return;
+    let resp;
+    try {
+      resp = await fetchJson('/autonomy/runners');
+    } catch (err) {
+      if (err && err.kind === '401') return;
+      el.innerHTML = emptyStateHtml('Could not read the runner\u2019s check-ins just now.');
+      return;
+    }
+    const runners = resp.runners || [];
+    if (!runners.length) {
+      // never_seen, and the server said so rather than this page guessing. Not an
+      // alarm: nobody has set the host up yet.
+      el.innerHTML = `<p class="ov-foot">${escapeHtml(resp.none ? resp.none.detail : 'No runner has ever checked in.')}</p>`;
+      return;
+    }
+    el.innerHTML = runners.map((r) => {
+      const h = r.health || {};
+      const cls = HEALTH_CLASS[h.state] || 'fact-pill--info';
+      // NOT the word "running": the switch below already uses it for a different
+      // thing (allowed to work), and the two lines sit one above the other. A
+      // reader should never have to work out which sense is meant.
+      const label = { dead: 'Not checking in', late: 'Quiet', alive: 'Checking in' }[h.state] || 'Unknown';
+      return `<p class="ov-foot" style="display:flex;align-items:baseline;gap:10px;flex-wrap:wrap;">
+        <span class="fact-pill ${cls}">${escapeHtml(label)}</span>
+        <span>${escapeHtml(h.detail || '')}</span>
+        <span class="ov-fact">last check-in ${escapeHtml(h.age || 'unknown')} ago</span>
+      </p>`;
+    }).join('');
+  }
+
   async function loadFence() {
     let fence;
     try {
@@ -356,7 +404,8 @@
     document.getElementById('gate-body').hidden = false;
     if (rank === 'archon') {
       document.getElementById('fence-panel').hidden = false;
-      await loadFence();
+      // Independent reads, so one round trip rather than two.
+      await Promise.all([loadRunners(), loadFence()]);
     }
     await load();
   }

package/modules/security/tests/artifact_scan.mjs

@@ -31,10 +31,35 @@ const { createQuarantine, siteRefusal, isSyncBacked, isInside, REPO_ROOT, CAPS }
 const { buildManifest, verifyUnchanged, CapExceeded, KIND } = manifest;
 const { validateTargetUrl, hardeningConfig, hardenedEnv, parseLsFiles, fetchArtifact, blockedAddress, assertHostResolvesPublic } = fetchMod;
 
+
+// Test hook (task 1003993): forces the platform-cannot-symlink branch so the skip path is
+// reachable on a box where symlinks work. Throws exactly where fs.symlinkSync would.
+function symlinkOrRefuse(target, link) {
+  if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') throw new Error('EPERM (forced by BONGOS_TEST_FORCE_NO_SYMLINK)');
+  fs.symlinkSync(target, link);
+}
+
 let passed = 0;
 let failed = 0;
+let skipped = 0;
+
+// A case that did not run is NOT a case that passed (task 1003993). A bare `return` from a
+// case that found its platform unable to do the thing left the harness seeing a callback that
+// did not throw — so it printed `ok` and counted a pass for work never attempted. Returning
+// skipCase(why) instead is the same one-line exit, and it tells the truth.
+const SKIP = Symbol('skip');
+const skipCase = (why) => ({ [SKIP]: why });
+function noteSkip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
 async function test(name, fn) {
-  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  try {
+    const r = await fn();
+    if (r && r[SKIP]) { noteSkip(name, r[SKIP]); return; }
+    passed++; console.log(`  ok  ${name}`);
+  }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
 }
 
@@ -182,10 +207,9 @@ await test('a symlink is recorded by its link text and its target is NEVER opene
   fs.writeFileSync(secret, 'AKIA-SUPER-SECRET-TOKEN\n');
   fs.writeFileSync(path.join(root, 'README.md'), 'hi\n');
   try {
-    fs.symlinkSync(secret, path.join(root, 'stolen'));
+    symlinkOrRefuse(secret, path.join(root, 'stolen'));
   } catch {
-    console.log('     (skipped: this platform/account cannot create symlinks)');
-    return;
+    return skipCase('this platform/account cannot create symlinks');
   }
   const m = await buildManifest(root, { maxFiles: 100, maxBytes: 1e6 });
   const link = m.entries.find((e) => e.path === 'stolen');
@@ -542,11 +566,10 @@ await test('symlinks count against maxFiles too — a cap on regular files only
   const root = mkTmp();
   fs.writeFileSync(path.join(root, 'a.txt'), 'a');
   try {
-    fs.symlinkSync(path.join(root, 'a.txt'), path.join(root, 'l1'));
-    fs.symlinkSync(path.join(root, 'a.txt'), path.join(root, 'l2'));
+    symlinkOrRefuse(path.join(root, 'a.txt'), path.join(root, 'l1'));
+    symlinkOrRefuse(path.join(root, 'a.txt'), path.join(root, 'l2'));
   } catch {
-    console.log('     (skipped: this platform/account cannot create symlinks)');
-    return;
+    return skipCase('this platform/account cannot create symlinks');
   }
   await assert.rejects(() => buildManifest(root, { maxFiles: 2, maxBytes: 1e6 }), /entry cap/);
 });
@@ -588,5 +611,5 @@ await test('CAPS are finite — no accidental unlimited default', async () => {
 
 for (const d of tmpDirs) { try { fs.rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
 
-console.log(`\nartifact_scan: ${passed} passed, ${failed} failed`);
+console.log(`\nartifact_scan: ${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/modules/security/tests/mirror.mjs

@@ -35,14 +35,35 @@ const { scrubUntrusted, newFenceDelim, FENCE_MARKER, DANGEROUS_CHARS } = fenceLo
 
 let passed = 0;
 let failed = 0;
+let skipped = 0;
+
+// A case that did not run is NOT a case that passed (task 1003993). A bare `return` from a
+// case that found its platform unable to do the thing left the harness seeing a callback that
+// did not throw — so it printed `ok` and counted a pass for work never attempted. Returning
+// skipCase(why) instead is the same one-line exit, and it tells the truth.
+const SKIP = Symbol('skip');
+const skipCase = (why) => ({ [SKIP]: why });
+function noteSkip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
 async function test(name, fn) {
-  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  try {
+    const r = await fn();
+    if (r && r[SKIP]) { noteSkip(name, r[SKIP]); return; }
+    passed++; console.log(`  ok  ${name}`);
+  }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
 }
 
 // Symlink creation needs privileges on some Windows accounts — same skip idiom
 // as artifact_scan.mjs so the suite stays green everywhere.
 function canSymlink(dir) {
+  // Test hook (task 1003993): the skip branch is unreachable on any box that CAN symlink,
+  // which is every CI runner — exactly why the old fake-pass went unnoticed for so long.
+  // tests/skip_is_not_pass.mjs sets this to exercise the skip path anywhere.
+  if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') return false;
   const target = path.join(dir, 'symlink-probe-target');
   const link = path.join(dir, 'symlink-probe-link');
   try {
@@ -176,7 +197,7 @@ async function run() {
       const rel = `docs/${rlo}evil.md`;
       let wrote = true;
       try { writePristine(pen, rel, 'body'); } catch { wrote = false; }
-      if (!wrote) { console.log('     (skipped: this filesystem refuses bidi filenames)'); return; }
+      if (!wrote) return skipCase('this filesystem refuses bidi filenames');
       const res = await buildMirror({
         pristineDir: pen.pristineDir, mirrorDir: pen.mirrorDir, quarantineRoot: pen.root,
         entries: [fileEntry(rel, 4)],
@@ -313,7 +334,8 @@ async function run() {
       } finally { pen.cleanup(); }
     });
   } else {
-    console.log('     (skipped: this platform/account cannot create symlinks)');
+    noteSkip('a REAL on-disk symlink whose realpath escapes the pen is refused (defense in depth)',
+      'this platform/account cannot create symlinks');
   }
 
   // ---------- the index: the record downstream stages reduce over ----------
@@ -352,5 +374,5 @@ function* walkFiles(dir) {
 }
 
 await run();
-console.log(`\nmirror: ${passed} passed, ${failed} failed`);
+console.log(`\nmirror: ${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/modules/security/tests/sanitize_rebuild.mjs

@@ -25,11 +25,23 @@ const { excerpt } = require('../artifact-scan/detectors/shared.js');
 
 let passed = 0;
 let failed = 0;
+let skipped = 0;
 async function test(name, fn) {
   try { await fn(); passed++; console.log(`  ok  ${name}`); }
   catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.stack || err.message}`); }
 }
 
+// A case that did not run is NOT a case that passed (task 1003993). This prints SKIP rather
+// than `ok` and counts separately, so the difference between "verified" and "not attempted"
+// survives into the summary line and into run-unit-tests.js's roll-up. It takes the same
+// `name` the real case would have used, because "which coverage did I lose?" is the only
+// question worth answering here.
+function skip(name, why) {
+  skipped++;
+  console.log(`  SKIP ${name}`);
+  console.log(`     (not run: ${why})`);
+}
+
 const RAW_DANGEROUS_RE = new RegExp(
   '[\\u200b-\\u200f\\u2028\\u2029\\u202a-\\u202e\\u2060\\u2066-\\u2069\\ufeff]|[\\u{e0000}-\\u{e007f}]', 'u');
 
@@ -384,6 +396,11 @@ await test('a failed build leaves NO partial sanitized/ tree, and a retry is sti
 // Symlink creation needs privileges on some Windows accounts — same skip idiom
 // as mirror.mjs / artifact_scan.mjs so the suite stays green everywhere.
 function canSymlink(dir) {
+  // A test hook, because the branch below is unreachable on any box that CAN symlink — which
+  // is every CI runner and most dev machines, and is precisely why the old fake-pass survived
+  // so long unnoticed. tests/skip_is_not_pass.mjs sets this to exercise the skip path on a
+  // platform where the real probe succeeds.
+  if (process.env.BONGOS_TEST_FORCE_NO_SYMLINK === '1') return false;
   const target = path.join(dir, 'probe-target');
   const link = path.join(dir, 'probe-link');
   try {
@@ -434,9 +451,13 @@ function canSymlink(dir) {
       } finally { pen.cleanup(); fs.rmSync(farAway, { recursive: true, force: true }); }
     });
   } else {
-    console.log('  ok  physical-confinement symlink cases');
-    console.log('     (skipped: this platform/account cannot create symlinks)');
-    passed += 2;
+    // These two are the ONLY coverage of physical confinement, so losing them silently is
+    // how task 1003848 reached CI red while this box read 760/760: a change to isInside()
+    // collapsed the lexical/physical staging in sanitize.js, and the cases that would have
+    // caught it had been reporting `ok` without running for as long as anyone could remember.
+    const why = 'this platform/account cannot create symlinks';
+    skip('physical confinement: a real symlink the manifest calls a "file" is refused, and its target never reaches sanitized/', why);
+    skip('physical confinement: a symlink whose realpath escapes the QUARANTINE entirely is refused', why);
   }
 }
 
@@ -495,5 +516,5 @@ await test('an artifact with no docs still yields an honest spec — the no-docs
 });
 
 console.log('');
-console.log(`${passed} passed, ${failed} failed`);
+console.log(`${passed} passed, ${failed} failed, ${skipped} skipped`);
 if (failed > 0) process.exit(1);

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.875",
+  "version": "1.19.877",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.19.875",
+      "version": "1.19.877",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.19.875",
+  "version": "1.19.877",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",