@bongos/core 1.19.876 → 1.19.878

package/tests/deploy_audit_gate.mjs

@@ -0,0 +1,154 @@
+// tests/deploy_audit_gate.mjs
+//
+// The deployed marker advances ONLY on success (task 1001426, SEC #863 / ADR 0043).
+//
+// The gate audits what a deploy pulled, so it can only run AFTER the working tree has moved
+// to the new commit. That ordering is what the original row calls the marker-bypass: refuse
+// the deploy, exit, and leave the tree sitting on the refused commit, and the NEXT deploy
+// computes its "previously deployed" SHA from the poison. That delta is then never audited
+// again — and it is already checked out. The gate closes it by putting the tree back.
+//
+// There is no marker FILE on a standalone instance; the marker is the checked-out HEAD.
+// These cases pin that, against a stub auditor so the assertions are about the gate's own
+// control flow and never about rank resolution (covered in tests/main_audit_db_roster.mjs).
+//
+// Run:  node --test tests/deploy_audit_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { execFileSync, spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GATE = path.join(ROOT, 'scripts', 'gds', 'deploy-main-audit-gate.sh');
+
+// A throwaway repo with two commits, checked out at the second — the state a deploy is in
+// when the gate runs: PREV is what was deployed, HEAD is what was just pulled.
+function makeRepo({ auditor = 'exit 0' } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-gate-'));
+  const git = (...args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8' });
+  git('init', '-q', '-b', 'main');
+  git('config', 'user.email', 'test@example.com');
+  git('config', 'user.name', 'Test');
+  fs.writeFileSync(path.join(dir, 'a.txt'), 'one\n');
+  git('add', '-A'); git('commit', '-q', '-m', 'one');
+  const prev = git('rev-parse', 'HEAD').trim();
+  fs.writeFileSync(path.join(dir, 'a.txt'), 'two\n');
+  git('add', '-A'); git('commit', '-q', '-m', 'two (the pulled commit)');
+  const head = git('rev-parse', 'HEAD').trim();
+
+  if (auditor !== null) {
+    const gdsDir = path.join(dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(gdsDir, { recursive: true });
+    fs.writeFileSync(path.join(gdsDir, 'main-audit.js'), `process.${auditor.replace('exit ', 'exit(')});\n`);
+  }
+  return { dir, prev, head, git };
+}
+
+function runGate(repo, env = {}) {
+  const r = spawnSync('sh', [GATE], {
+    cwd: repo.dir, encoding: 'utf8',
+    env: { ...process.env, ...env },
+  });
+  return { code: r.status, out: `${r.stdout || ''}${r.stderr || ''}` };
+}
+
+const headOf = (repo) => repo.git('rev-parse', 'HEAD').trim();
+
+test('a CLEAN audit leaves the deploy on the new commit and exits 0', () => {
+  const repo = makeRepo({ auditor: 'exit 0' });
+  try {
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(r.code, 0, r.out);
+    assert.equal(headOf(repo), repo.head, 'a passing gate must not move the tree');
+    assert.match(r.out, /exact deploy delta/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('THE BUG: a REFUSED audit puts the checkout back, so the next deploy re-audits the same delta', () => {
+  const repo = makeRepo({ auditor: 'exit 1' });
+  try {
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(r.code, 1, 'a refusal must abort the deploy');
+    assert.equal(
+      headOf(repo), repo.prev,
+      'the tree must be restored to the previously-deployed SHA. Left advanced, the next '
+      + "deploy's OTB_DEPLOY_PREV_SHA is the POISONED commit and its delta is never re-audited",
+    );
+    assert.match(r.out, /DEPLOY ABORTED/);
+    assert.match(r.out, /advances only on success/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('the range handed to the auditor is the exact deploy delta, not a window', () => {
+  // Pinned because the whole row is named for an audit range that could be slipped under.
+  const repo = makeRepo({ auditor: null });
+  try {
+    const gdsDir = path.join(repo.dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(gdsDir, { recursive: true });
+    fs.writeFileSync(path.join(gdsDir, 'main-audit.js'),
+      'require("fs").writeFileSync("range.txt", process.env.OTB_AUDIT_RANGE || "UNSET");\n');
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(r.code, 0, r.out);
+    assert.equal(
+      fs.readFileSync(path.join(repo.dir, 'range.txt'), 'utf8'), `${repo.prev}..HEAD`,
+      'the auditor must receive <previously-deployed>..HEAD',
+    );
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('with no previous SHA there is nothing to restore to, and the gate says so', () => {
+  // The degraded mode: still audits (wide window), still refuses, but cannot undo the move.
+  // It must not pretend otherwise — a silent non-restore is the bug wearing a disguise.
+  const repo = makeRepo({ auditor: 'exit 1' });
+  try {
+    const r = runGate(repo, {});
+    assert.equal(r.code, 1);
+    assert.equal(headOf(repo), repo.head, 'nothing to restore to');
+    assert.match(r.out, /OTB_DEPLOY_PREV_SHA not set/);
+    assert.match(r.out, /cannot put the tree back/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('OTB_GATE_NO_RESTORE=1 leaves the tree to a caller that restores it itself', () => {
+  const repo = makeRepo({ auditor: 'exit 1' });
+  try {
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev, OTB_GATE_NO_RESTORE: '1' });
+    assert.equal(r.code, 1);
+    assert.equal(headOf(repo), repo.head, 'the opt-out must actually opt out');
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('a missing auditor FAILS CLOSED — it never waves the deploy through', () => {
+  // The failure mode that would quietly disarm every instance: upgrade the core, lose the
+  // script, and a gate that treated "not found" as "nothing to report" would pass forever.
+  const repo = makeRepo({ auditor: null });
+  try {
+    const r = runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(r.code, 1, 'no auditor must abort the deploy, not permit it');
+    assert.match(r.out, /main-audit\.js not found/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});
+
+test('OTB_AUDIT_STRICT=1 is passed through, and is OFF by default', () => {
+  const repo = makeRepo({ auditor: null });
+  try {
+    const gdsDir = path.join(repo.dir, 'node_modules', '@bongos', 'core', 'scripts', 'gds');
+    fs.mkdirSync(gdsDir, { recursive: true });
+    fs.writeFileSync(path.join(gdsDir, 'main-audit.js'),
+      'require("fs").writeFileSync("argv.txt", process.argv.slice(2).join(" "));\n');
+
+    runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev });
+    assert.equal(
+      fs.readFileSync(path.join(repo.dir, 'argv.txt'), 'utf8').includes('--strict'), false,
+      'strict must default OFF: a lane committing under display names resolves to nothing, '
+      + 'so strict would block every deploy forever',
+    );
+
+    runGate(repo, { OTB_DEPLOY_PREV_SHA: repo.prev, OTB_AUDIT_STRICT: '1' });
+    assert.match(fs.readFileSync(path.join(repo.dir, 'argv.txt'), 'utf8'), /--strict/);
+  } finally { fs.rmSync(repo.dir, { recursive: true, force: true }); }
+});

package/tests/deploy_divergence_line.mjs

@@ -23,11 +23,13 @@ import { spawnSync } from 'node:child_process';
 import { createRequire } from 'node:module';
 import fs from 'node:fs';
 import path from 'node:path';
+import { childEnv, API_BASE_ENV_PREFIXES } from './helpers.mjs';
 import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const { line } = require('../scripts/gds/deploy-divergence.js');
+const ic = require('../src/instance-config.js');
 const SCRIPT = path.join(ROOT, 'scripts/gds/deploy-divergence.js');
 
 // Run `--line` exactly as SessionStart does. Returns {status, stdout} instead of
@@ -36,7 +38,7 @@ function runLine(env = {}) {
   const res = spawnSync(
     process.execPath,
     [SCRIPT, '--line', '--timeout-ms', '2500'],
-    { cwd: ROOT, encoding: 'utf8', timeout: 30000, env: { ...process.env, ...env } },
+    { cwd: ROOT, encoding: 'utf8', timeout: 30000, env: childEnv(env) },
   );
   return { status: res.status, stdout: String(res.stdout || '').trim(), stderr: String(res.stderr || '') };
 }
@@ -101,6 +103,50 @@ test('--line exits 0 and stays silent when the instance is unreachable', () => {
   assert.equal(r.stdout, '', 'an unreachable instance must print NOTHING to stdout');
 });
 
+test('childEnv strips EVERY spelling of the api base, so an offline stub cannot be shadowed', () => {
+  // THE BUG THIS PINS (task 1004049). The case above sets only LEGACY spellings.
+  // resolveApiBase() reads the canonical `<PREFIX>_API_BASE` FIRST, so on any box
+  // that exports it — every Bongos session box — the legacy stub was silently
+  // shadowed and `--line` went and read the LIVE instance. The assertion then
+  // compared production's real divergence banner against '' and failed. It passed in
+  // CI, where the canonical var is unset, which is why it survived: the test was only
+  // ever in control on the one machine nobody was debugging on.
+  //
+  // This is asserted against childEnv directly rather than by spawning --line at a
+  // real host, and the reason is the subject of this very task: an end-to-end version
+  // would pass or fail according to whether production happened to be mid-release at
+  // the time, which is another ambient dependency. The mechanism is what must hold,
+  // so the mechanism is what is pinned.
+  // The stub prefix is TAKEN FROM the imported list rather than typed, for the same
+  // single-source reason childEnv imports it — and because the repo's rename ratchet
+  // (goal 1000073 C5) counts a typed legacy prefix as a new literal.
+  const STUB = ic.LEGACY_ENV_PREFIXES.at(-1);
+  const STUB_VAR = `${STUB}_API_BASE`;
+  const DEAD = 'http://127.0.0.1:9';
+
+  // Every OTHER spelling points at a host that would answer — the shape of a real
+  // session box — so a survivor is the difference between offline and not.
+  const box = { PATH: process.env.PATH };
+  for (const prefix of API_BASE_ENV_PREFIXES) box[`${prefix}_API_BASE`] = 'https://example.invalid';
+
+  const out = childEnv({ [STUB_VAR]: DEAD }, { base: box });
+
+  for (const prefix of API_BASE_ENV_PREFIXES.filter((p) => p !== STUB)) {
+    assert.equal(out[`${prefix}_API_BASE`], undefined,
+      `${prefix}_API_BASE survived — it would shadow the stub the test set`);
+  }
+  assert.equal(out[STUB_VAR], DEAD, 'the override the test set must survive');
+  assert.equal(out.PATH, process.env.PATH, 'unrelated environment must be passed through untouched');
+
+  // The list is derived from instance-config, not copied here: a prefix added or
+  // sunset there must not need an edit in the test suite to keep working.
+  assert.ok(API_BASE_ENV_PREFIXES.includes(ic.envPrefix() || ic.FALLBACK_ENV_PREFIX),
+    'the canonical prefix must be among those stripped');
+  for (const legacy of ic.LEGACY_ENV_PREFIXES) {
+    assert.ok(API_BASE_ENV_PREFIXES.includes(legacy), `legacy prefix ${legacy} must be stripped too`);
+  }
+});
+
 test('--line exits 0 against the REAL instance (the 127 regression)', { timeout: 60000 }, () => {
   // The success path is the one that broke: a live socket to tear down is exactly
   // what process.exit() raced. Skips only if the network is unavailable, so it

package/tests/helpers.mjs

@@ -70,6 +70,8 @@ export function makeSqlAwareClient(handler) {
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { execFileSync } from 'node:child_process';
 
 const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 
@@ -434,3 +436,62 @@ export function sqlColumnLines(sql) {
     // whose NAME contained a scanned word would otherwise read as a column.
     .filter((l) => l && !/^(CREATE TABLE|CONSTRAINT|CHECK|\))/.test(l));
 }
+
+// childEnv — build the environment for a spawned child so the API base the test
+// SETS is the API base the child USES (task 1004049).
+//
+// The trap this closes: `src/instance-config.js resolveApiBase()` reads the
+// CANONICAL `<PREFIX>_API_BASE` first and only then the legacy spellings. A test
+// that passes `{ ...process.env, <LEGACY>_API_BASE: stub }` is therefore only in
+// control on a box where the canonical var is UNSET. On a box where it is set —
+// which is every Bongos session box, the tooling exports it — the canonical value
+// wins, the test's stub is silently shadowed, and the child talks to the REAL
+// instance.
+//
+// That is not hypothetical. It is how tests/deploy_divergence_line.mjs came to
+// assert "stays silent when the instance is unreachable" while printing a live
+// reading of the production host; how tests/setup_device_flow_fallback.mjs came to
+// verify a token against the real /me instead of its local stub; and why
+// tests/cli_package.mjs ran every verb against production and timed out after
+// minutes instead of failing fast against a closed port (3.7s once fixed). All
+// three passed in CI, where the canonical var is unset, and failed everywhere else.
+//
+// The prefix list is IMPORTED, never copied: instance-config.js is the single
+// source that decides which spellings resolve, so a prefix added or sunset there
+// must not need a matching edit here — a stale copy would reintroduce exactly the
+// silent-shadowing bug this helper exists to prevent.
+const helperRequire = createRequire(import.meta.url);
+const ic = helperRequire(path.join(ROOT, 'src', 'instance-config.js'));
+export const API_BASE_ENV_PREFIXES = [ic.envPrefix(), ic.FALLBACK_ENV_PREFIX, ...ic.LEGACY_ENV_PREFIXES]
+  .filter(Boolean)
+  .filter((p, i, a) => a.indexOf(p) === i);
+
+export function childEnv(overrides = {}, { base = process.env } = {}) {
+  const env = { ...base };
+  for (const prefix of API_BASE_ENV_PREFIXES) delete env[`${prefix}_API_BASE`];
+  return { ...env, ...overrides };
+}
+
+// shallowCloneReason — why a history-reading test cannot run HERE, or null (task 1004049).
+//
+// A cloud session clones shallow, so a test that counts release commits or walks a
+// date window sees a truncated log and asserts against a number that was never going
+// to be right. That is not a defect in the code under test and must not read as one.
+//
+// It must not read as a PASS either. Task 1003993 (same goal) is open precisely
+// because sanitize_rebuild.mjs counted two SKIPPED cases as passed and reported
+// 760/760 while its only real coverage never ran. So the contract here is: return a
+// REASON, and let the caller hand it to node:test's t.skip(), which reports the case
+// under `# skipped` where a reader can see it — never a silent early return.
+export function shallowCloneReason(root = ROOT) {
+  let shallow = false;
+  try {
+    shallow = execFileSync('git', ['rev-parse', '--is-shallow-repository'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] })
+      .trim() === 'true';
+  } catch {
+    return null; // not a git checkout at all: let the test fail honestly rather than skip
+  }
+  if (!shallow) return null;
+  return 'shallow clone — full history is unavailable here, so this case cannot be evaluated '
+    + '(git fetch --unshallow to run it)';
+}

package/tests/main_audit_db_roster.mjs

@@ -0,0 +1,97 @@
+// tests/main_audit_db_roster.mjs
+//
+// main-audit.js `--db` must be able to REACH the roster (task 1001426).
+//
+// `--db` is the mode the deploy gate uses: the droplet has Postgres but no Bongos session,
+// so it resolves builder ranks straight from the database. It called
+// `require('../../src/bongos/db.js').getBuildersRoster(...)`. That function was carved out
+// of the core db.js into the lifecycle module (goal 1000010's per-domain split) and this
+// caller was not moved with it, so every `--db` run died with
+//
+//     main-audit: --db roster read failed (db.getBuildersRoster is not a function)
+//
+// and returned an EMPTY rank map. An empty map is not a neutral outcome for this tool: every
+// author then resolves to null, no blocker can fire, and the audit reports success — the
+// vacuous green this file's own comments warn about for the API path. Non-strict said
+// "clean" for the one reason it exists to catch; strict said BLOCKER on every commit.
+//
+// Two assertions, because the bug needed both to happen: the address must be live, and a
+// failure to read it must not be laundered into an empty map.
+//
+// Run:  node --test tests/main_audit_db_roster.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const audit = require('../scripts/gds/main-audit.js');
+
+test('the --db roster address is LIVE: that module really exports getBuildersRoster', () => {
+  // Resolved from main-audit.js's OWN directory, exactly as the lazy require() inside it
+  // does — so this fails for the same reason the gate would, and never for a different one.
+  const auditDir = path.dirname(require.resolve('../scripts/gds/main-audit.js'));
+  const mod = require(path.resolve(auditDir, audit.ROSTER_DB_MODULE));
+  assert.equal(
+    typeof mod.getBuildersRoster, 'function',
+    `${audit.ROSTER_DB_MODULE} must export getBuildersRoster — main-audit.js --db calls it, `
+    + 'and a moved export reads exactly like "no database" at the deploy gate',
+  );
+});
+
+test('the OLD address is genuinely dead — this is not a cosmetic rename', () => {
+  // Kept so the next reader can see the carve actually happened, rather than wondering
+  // whether the require was simply a typo that never worked.
+  const coreDb = require('../src/bongos/db.js');
+  assert.equal(
+    typeof coreDb.getBuildersRoster, 'undefined',
+    'src/bongos/db.js no longer owns the roster; if it does again, collapse the two paths '
+    + 'rather than leaving main-audit.js pointing at whichever one happens to answer',
+  );
+});
+
+test('rowsToMap keys ONLY on github_login — a display name must never resolve a rank', () => {
+  // #863-followup finding #6. display_name is builder-controlled, so keying it let one
+  // builder alias another login's rank. This is also WHY a deploy lane's own commits stay
+  // unresolved on a standalone instance: they are authored under a human display name,
+  // not a github_login.
+  const map = audit.rowsToMap([
+    { github_login: 'somebuilder', display_name: 'Someone Else', rank: 'xenos' },
+    { display_name: 'Firstname Lastname', rank: 'archon' },
+  ]);
+  assert.equal(map.somebuilder, 'xenos');
+  assert.equal(map['firstname lastname'], undefined, 'a display name must not carry a rank');
+  assert.equal(Object.keys(map).length, 1);
+});
+
+test('an unreadable --db roster does NOT resolve to an empty map in silence', async () => {
+  // The vacuous green, asserted directly. fetchRankMap({useDb:true}) is forced to fail by
+  // pointing it at a database that cannot exist, and must then FALL THROUGH to the
+  // API/public roster rather than returning {}. Offline (no network in the unit lane) the
+  // fallbacks also fail and the map is legitimately empty — so what is pinned here is that
+  // the failure was ANNOUNCED on stderr, which is what a gate operator needs in order to
+  // know the audit did not actually run.
+  const errs = [];
+  const realError = console.error;
+  console.error = (...a) => errs.push(a.join(' '));
+  const realPg = process.env.PGDATABASE;
+  process.env.PGDATABASE = 'cloudbongos_no_such_db_for_tests';
+  try {
+    const map = await audit.fetchRankMap({ useDb: true });
+    assert.equal(typeof map, 'object', 'still returns a map rather than throwing at the gate');
+  } finally {
+    console.error = realError;
+    if (realPg === undefined) delete process.env.PGDATABASE; else process.env.PGDATABASE = realPg;
+  }
+  const said = errs.join('\n');
+  assert.match(
+    said, /--db roster read (failed|returned NO builders)/,
+    'a --db roster that cannot be read must say so on stderr; silence here is what made '
+    + 'the dead require survive — the gate exits 0 and looks like a pass',
+  );
+  assert.match(
+    said, /falling through/,
+    'and it must say it is falling through, so nobody reads the empty map as "roster is empty"',
+  );
+});

package/tests/publish_watch.mjs

@@ -10,9 +10,11 @@ import assert from 'node:assert/strict';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
 import { createRequire } from 'node:module';
+import { shallowCloneReason } from './helpers.mjs';
 
 const require = createRequire(import.meta.url);
 const ROOT = path.resolve(import.meta.dirname, '..');
+
 const pw = require(path.join(ROOT, 'scripts', 'gds', 'publish-watch.js'));
 
 const REL = (v, iso, sha = 'abcdef1234567890') =>
@@ -80,6 +82,13 @@ test('a read that returned nothing must not read as "nothing missing"', () => {
 });
 
 test('LIVE: replays the real 2026-09-13 publish outage from git + the registry', (t) => {
+  // Needs real history: a shallow clone's origin/main does not reach back to the
+  // incident window, so the log below comes back empty and the count reads 0 (task
+  // 1004049). Skipped with the reason stated, for the same reason the unreachable
+  // registry below is skipped rather than failed — and never as a silent pass.
+  const shallow = shallowCloneReason(ROOT);
+  if (shallow) { t.skip(shallow); return; }
+
   // The eight carrier commits exist on main...
   // Bounded: this runs on every ordinary suite run, so it reads a window around
   // the incident rather than the whole history.

package/tests/setup_device_flow_fallback.mjs

@@ -25,6 +25,7 @@
 // Run:  node tests/setup_device_flow_fallback.mjs
 
 import { strict as assert } from 'node:assert';
+import { childEnv } from './helpers.mjs';
 import { createRequire } from 'node:module';
 import { spawn } from 'node:child_process';
 import http from 'node:http';
@@ -144,7 +145,7 @@ fs.writeFileSync(driverPath, [
 function redeemInChild(token, home) {
   return new Promise((resolve) => {
     const child = spawn(process.execPath, [driverPath, token], {
-      env: { ...process.env, HOME: home, USERPROFILE: home, GDS_API_BASE: BASE, OTB_API_BASE: BASE },
+      env: childEnv({ HOME: home, USERPROFILE: home, GDS_API_BASE: BASE, OTB_API_BASE: BASE }),
     });
     let stdout = '', stderr = '';
     child.stdout.on('data', (c) => { stdout += c; });