@bongos/core 1.19.932 → 1.19.934

package/tests/update_subscription_engine.mjs

@@ -356,12 +356,74 @@ test('every commitPin call site in the lane decides about push', () => {
   }
 });
 
-test('the direct-upgrade fallback withholds --commit-pin unless the mode is push', () => {
+test('the direct-upgrade fallback asks pinFlagsFor rather than deciding inline', () => {
   const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
-  // --commit-pin makes upgrade.js commit AND push, so the fallback has to gate it too — the
-  // policy must not depend on which engine the instance's core happened to support.
-  assert.match(src, /if \(canCommitPin && pinMode === 'push'\) upArgs\.push\('--commit-pin'\)/,
-    'the fallback path would push a co-tenant pin through upgrade.js instead of the lane');
+  // The fourth version of this assertion. It used to pin the inline `if` verbatim, which froze
+  // the bug of task 1004122 in place: the line was correct about NOT pushing a co-tenant pin and
+  // wrong about how, and a test that quotes an expression can only ever confirm it is still there.
+  assert.match(src, /upArgs\.push\(\.\.\.pinFlagsFor\(\{ pinMode, canCommitPin, canPinNoPush \}\)\)/,
+    'the fallback decides its pin flags inline again, where no test can reach them');
+});
+
+// ---------------------------------------------------------------------------
+// 8b. pinFlagsFor — the fallback's pin policy, and the cross-file contract (task 1004122)
+//
+// go-live.js is the PREFERRED engine and the fallback must not apply a weaker policy just
+// because an instance's core could not support it. It did: the fallback withheld --commit-pin
+// on `local-commit`, so upgrade.js left the `.claude/` it had just rewritten uncommitted, the
+// lane's own net can stage nothing but PIN_FILES, and the next sweep halted on those files
+// forever. The instance took exactly one upgrade and then needed a human.
+// ---------------------------------------------------------------------------
+
+test('pinFlagsFor: local-commit commits the bump WITHOUT pushing — the fix for the one-upgrade wedge', () => {
+  assert.deepEqual(
+    S.pinFlagsFor({ pinMode: 'local-commit', canCommitPin: true, canPinNoPush: true }),
+    ['--commit-pin', '--pin-no-push'],
+    'upgrade.js commits the pin AND the .claude/ it materialized, and pushes nothing');
+});
+
+test('pinFlagsFor: push keeps --commit-pin alone, leave-dirty still commits nothing', () => {
+  assert.deepEqual(S.pinFlagsFor({ pinMode: 'push', canCommitPin: true, canPinNoPush: true }), ['--commit-pin']);
+  // --pin-no-push WITHOUT --commit-pin: nothing is committed, and upgrade.js's pull-deploy alarm
+  // drops to a note, because on this target no reset is coming to revert the bump.
+  assert.deepEqual(S.pinFlagsFor({ pinMode: 'leave-dirty', canCommitPin: true, canPinNoPush: true }), ['--pin-no-push']);
+});
+
+test('pinFlagsFor: an old core that lacks --pin-no-push gets NOTHING, never the lone --commit-pin', () => {
+  // parseArgs silently ignores an unknown flag, so the pair would degrade to a bare --commit-pin
+  // and push the bump into the CUSTOMER's repo. Fail closed: keep today's behaviour instead.
+  assert.deepEqual(S.pinFlagsFor({ pinMode: 'local-commit', canCommitPin: true, canPinNoPush: false }), []);
+  assert.deepEqual(S.pinFlagsFor({ pinMode: 'leave-dirty', canCommitPin: true, canPinNoPush: false }), []);
+  // …and a core with no --commit-pin at all is never asked to commit.
+  for (const mode of ['push', 'local-commit', 'leave-dirty']) {
+    assert.ok(!S.pinFlagsFor({ pinMode: mode, canCommitPin: false, canPinNoPush: true }).includes('--commit-pin'), `mode ${mode}`);
+  }
+});
+
+test('pinFlagsFor mirrors go-live.js upgradeCommand() mode for mode', () => {
+  // The cross-file contract, pinned at the source in the same way GO_LIVE_REQUIRED is: go-live
+  // builds a command STRING on a box, so the two can only be compared through its source.
+  const src = readFileSync(path.join(ROOT, 'scripts', 'gds', 'go-live.js'), 'utf8');
+  const body = src.slice(src.indexOf('function upgradeCommand('));
+  const commitPinModes = /\.\.\.\(mode === 'leave-dirty' \? \[\] : \['--commit-pin'\]\)/.test(body);
+  const noPushModes = /\.\.\.\(mode === 'push' \? \[\] : \['--pin-no-push'\]\)/.test(body);
+  assert.ok(commitPinModes && noPushModes, 'go-live.js upgradeCommand() moved — re-derive pinFlagsFor from it');
+  for (const mode of ['push', 'local-commit', 'leave-dirty']) {
+    const goLive = [
+      ...(mode === 'leave-dirty' ? [] : ['--commit-pin']),
+      ...(mode === 'push' ? [] : ['--pin-no-push']),
+    ];
+    assert.deepEqual(
+      S.pinFlagsFor({ pinMode: mode, canCommitPin: true, canPinNoPush: true }), goLive,
+      `mode ${mode}: the fallback applies a different pin policy from the engine it stands in for`);
+  }
+});
+
+test('supportsPinNoPush probes the file, and is fail-closed on anything it cannot read', () => {
+  assert.equal(S.supportsPinNoPush('/x/upgrade.js', () => 'usage: --commit-pin --pin-no-push'), true);
+  assert.equal(S.supportsPinNoPush('/x/upgrade.js', () => 'usage: --commit-pin'), false, 'a core that predates the flag');
+  assert.equal(S.supportsPinNoPush(null, () => '--pin-no-push'), false);
+  assert.equal(S.supportsPinNoPush('/x/upgrade.js', () => { throw new Error('ENOENT'); }), false);
 });
 
 // ---------------------------------------------------------------------------

package/tests/upgrade.mjs

@@ -171,6 +171,58 @@ t('guard: dirty tree refuses (unless --force)', async () => {
   assert.match(res.error, /not clean/);
 });
 
+// task 1004122 — the pre-flight must not refuse on what step 5 is about to overwrite anyway.
+// An instance upgraded before task 1003957 carries ~40 modified `.claude/skills/*` nobody
+// edited, and provision-core-upgrade.js (the Deploy page) passes --commit-pin but NOT --force,
+// so the button stayed dead forever. The waiver is scoped to what a dry-run materialize on THIS
+// instance says it rewrites; anything else still halts.
+t('guard: a dirty tree that is ONLY this upgrade\'s own .claude/ materialization proceeds', async () => {
+  const src = mkdtempSync(join(tmpdir(), 'src-'));
+  writeFileSync(join(src, 'bongos-core-1.15.0.tgz'), 'TGZ');
+  const dir = scratchConsumer();
+  const dryRuns = [];
+  const res = await u.runUpgrade(
+    { to: '1.15.0', from: join(src, 'bongos-core-1.15.0.tgz'), instance: dir, healthCheck: false, skipMigrate: true },
+    {
+      log: () => {}, err: () => {},
+      run: fakeRun([], { dirty: ' M .claude/skills/builder-end/SKILL.md\n M .claude/settings.json', installTo: '1.15.0', dir }),
+      materialize: (a) => { if (a.dryRun) dryRuns.push(a); return { skills: 2, writtenPaths: ['.claude/skills/builder-end/SKILL.md', '.claude/settings.json'] }; },
+      regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.equal(res.ok, true, 'the bump runs, and step 5 rewrites those same files');
+  assert.equal(dryRuns.length, 1, 'the pre-flight previewed the materialization exactly once');
+  assert.equal(dryRuns[0].instanceDir, dir);
+  assert.ok(dryRuns[0].coreRoot.endsWith(join('node_modules', '@bongos', 'core')), 'against the core the instance has NOW — the target is not installed yet');
+});
+
+t('guard: a dirty tree with anything ELSE in it still refuses', async () => {
+  const dir = scratchConsumer();
+  const res = await u.runUpgrade({ to: '1.15.0', instance: dir }, {
+    log: () => {}, err: () => {},
+    run: fakeRun([], { dirty: ' M .claude/settings.json\n M migrations/core_253_wip.sql' }),
+    materialize: () => ({ skills: 1, writtenPaths: ['.claude/settings.json'] }),
+  });
+  assert.equal(res.ok, false);
+  assert.match(res.error, /not clean/);
+  assert.match(res.error, /migrations\/core_253_wip\.sql/, 'and it names the path that is genuinely a human\'s');
+  assert.ok(!res.error.includes('.claude/settings.json'), 'without re-listing the half it waived');
+});
+
+t('guard: --skip-materialize waives nothing — step 5 rewrites nothing, so every dirty path is real', async () => {
+  const dir = scratchConsumer();
+  let asked = 0;
+  const res = await u.runUpgrade({ to: '1.15.0', instance: dir, skipMaterialize: true }, {
+    log: () => {}, err: () => {},
+    run: fakeRun([], { dirty: ' M .claude/settings.json' }),
+    materialize: () => { asked += 1; return { skills: 1, writtenPaths: ['.claude/settings.json'] }; },
+  });
+  assert.equal(res.ok, false);
+  assert.match(res.error, /not clean/);
+  assert.equal(asked, 0, 'and materialize was never even asked');
+});
+
 t('guard: already on the target refuses (unless --force)', async () => {
   const dir = scratchConsumer({ installed: '1.15.0' });
   const res = await u.runUpgrade({ to: '1.15.0', instance: dir }, { log: () => {}, err: () => {}, run: fakeRun([], { dirty: '' }) });

package/tests/upgrade_persist_pin.mjs

@@ -365,11 +365,10 @@ test('real git: an owner edit outside the generated files is never swept into th
 // when anything but the pin is dirty, which is simultaneously the `failed=1` on a successful
 // upgrade and the next sweep's permanent halt.
 
-const { materializeClaude } = require('../scripts/gds/claude-materialize.js');
+const { materializeClaude, materializeWillRewrite } = require('../scripts/gds/claude-materialize.js');
 
 // A minimal core package: just the .claude/ tree materialize copies out of it.
-function scratchCore(version) {
-  const dir = mkdtempSync(join(tmpdir(), 'upgrade-core-'));
+function coreAt(dir, version) {
   put(dir, 'package.json', JSON.stringify({ name: '@bongos/core', version }));
   put(dir, 'config/branding.json', JSON.stringify({ identity: {} }));
   put(dir, '.claude/skills/builder-end/SKILL.md', `# builder-end (core ${version})\n`);
@@ -378,6 +377,13 @@ function scratchCore(version) {
   put(dir, '.claude/hooks/stop.js', `// hook for ${version}\n`);
   return dir;
 }
+function scratchCore(version) {
+  return coreAt(mkdtempSync(join(tmpdir(), 'upgrade-core-')), version);
+}
+// The same tree where an instance really carries it — what materializeWillRewrite probes.
+function installCore(instanceDir, version) {
+  return coreAt(join(instanceDir, 'node_modules', '@bongos', 'core'), version);
+}
 
 // A scaffolded co-tenant that already TRACKS the .claude/ a previous materialize landed.
 function scratchCoTenant(version = '1.19.737') {
@@ -390,6 +396,7 @@ function scratchCoTenant(version = '1.19.737') {
   put(dir, 'package-lock.json', `lock ${version}\n`);
   put(dir, 'config/branding.json', JSON.stringify({ identity: {} }));
   put(dir, 'CLAUDE.md', 'the instance owns this\n');
+  put(dir, '.gitignore', 'node_modules/\n');
   materializeClaude({ coreRoot: scratchCore(version), instanceDir: dir, log: quiet });
   git(dir, 'add', '-A');
   git(dir, 'commit', '-q', '-m', 'scaffold');
@@ -477,3 +484,90 @@ test('adopt mode records nothing, so `init --adopt` never commits over what it r
   assert.ok(!sum.writtenPaths.includes('.claude/settings.json'));
   assert.equal(readFileSync(join(dir, '.claude/skills/builder-end/SKILL.md'), 'utf8'), 'the adopting project already had this\n');
 });
+
+// ── the fleet that was ALREADY wedged (task 1004122) ────────────────────────────
+//
+// Task 1003957 above stops an upgrade CREATING the dirt. It does nothing for the instances
+// that were upgraded before it shipped: every one of them still carries ~40 modified
+// `.claude/skills/*` files nobody edited, and the clean-tree pre-flight refuses on them. So
+// `test4` (instance 11) failed its Deploy-page upgrade on 2026-09-20 — provision-core-upgrade.js
+// passes --commit-pin but NOT --force, so the button stays dead until someone commits by hand.
+//
+// The fix is that the pre-flight stops counting a path THIS upgrade is about to overwrite as
+// evidence of anything. The set is not an allow-list: it is what a dry-run materialize against
+// the core actually installed here says it would write.
+
+test('gitTreeClean: an ignored path stops counting, and is reported rather than hidden', () => {
+  const dir = scratchCoTenant();
+  writeFileSync(join(dir, '.claude/skills/builder-end/SKILL.md'), 'rewritten by an earlier upgrade\n');
+  assert.equal(gitTreeClean(dir).ok, false, 'by default it is dirt like any other');
+  const t = gitTreeClean(dir, spawnSync, ['.claude/skills/builder-end/SKILL.md']);
+  assert.equal(t.ok, true);
+  assert.equal(t.ignored, 1, 'and the caller can say how many it waived');
+  assert.equal(t.dirty, '');
+});
+
+test('gitTreeClean: ignoring the materialized paths never waives anything else', () => {
+  const dir = scratchCoTenant();
+  writeFileSync(join(dir, '.claude/skills/builder-end/SKILL.md'), 'rewritten by an earlier upgrade\n');
+  put(dir, 'config/branding.json', 'the owner was here\n');
+  const t = gitTreeClean(dir, spawnSync, ['.claude/skills/builder-end/SKILL.md']);
+  assert.equal(t.ok, false, 'the owner edit still halts the bump');
+  assert.match(t.dirty, /config\/branding\.json/);
+  assert.ok(!t.dirty.includes('builder-end'), 'and only the materialized half was waived');
+  assert.equal(t.ignored, 1);
+});
+
+test('materializeWillRewrite: the set comes from the core the instance actually has', () => {
+  const dir = scratchCoTenant();
+  installCore(dir, '1.19.785');
+  const paths = materializeWillRewrite({ instanceDir: dir, materialize: materializeClaude }, quiet);
+  assert.ok(paths.includes('.claude/skills/builder-end/SKILL.md'));
+  assert.ok(paths.includes('.claude/settings.json'));
+  assert.ok(paths.includes('.claude/hooks/stop.js'));
+  assert.ok(paths.includes('.claude/skills/.instance-skills.json'), 'the provenance manifest is rewritten every run too');
+  assert.ok(!paths.includes('CLAUDE.md'), 'a file materialize writes only when ABSENT is not rewritten — the instance owns it');
+  assert.equal(git(dir, 'status', '--porcelain').stdout, '', 'and previewing it changed nothing on disk');
+});
+
+test('materializeWillRewrite: no core installed → no skill is waived, and a throw waives nothing at all', () => {
+  const dir = scratchCoTenant();
+  // Nothing to copy out of: materialize reports only the provenance record it rewrites anyway.
+  const paths = materializeWillRewrite({ instanceDir: dir, materialize: materializeClaude }, quiet);
+  assert.ok(!paths.some((p) => p.startsWith('.claude/skills/builder-')), 'no skill file is waived on the strength of a core that is not there');
+
+  // And an outright failure is fail-SOFT in the strict direction — an empty set plus a note.
+  const notes = [];
+  const boom = () => { throw new Error('unreadable core tree'); };
+  assert.deepEqual(materializeWillRewrite({ instanceDir: dir, materialize: boom }, (m) => notes.push(m)), []);
+  assert.equal(notes.length, 1, 'it says so rather than failing silently');
+  assert.match(notes[0], /unreadable core tree/);
+});
+
+test('real git: an instance wedged by a pre-1003957 upgrade unwedges itself on the next bump', () => {
+  const dir = scratchCoTenant();
+  sweep(dir, '1.19.737', '1.19.785', { artifactPaths: [] }); // the upgrade that left the mess
+  installCore(dir, '1.19.785');                              // …and the core it installed
+  assert.equal(gitTreeClean(dir).ok, false, 'today: the next `bongos upgrade` refuses here');
+
+  // What runUpgrade's pre-flight now does.
+  const rewritable = materializeWillRewrite({ instanceDir: dir, materialize: materializeClaude }, quiet);
+  assert.equal(gitTreeClean(dir, spawnSync, rewritable).ok, true, 'the bump is allowed to proceed');
+
+  // …and proceeding is what cleans it up: step 5 rewrites those same paths and persistPin commits them.
+  const { pin } = sweep(dir, '1.19.785', '1.19.786');
+  assert.equal(pin.committed, true);
+  assert.equal(git(dir, 'status', '--porcelain').stdout, '', 'one bump, no human hands, tree clean');
+});
+
+test('real git: a wedged instance with an owner edit beside the mess still refuses', () => {
+  const dir = scratchCoTenant();
+  sweep(dir, '1.19.737', '1.19.785', { artifactPaths: [] });
+  installCore(dir, '1.19.785');
+  put(dir, 'core_999_half_written.sql', '-- not finished\n');
+  const rewritable = materializeWillRewrite({ instanceDir: dir, materialize: materializeClaude }, quiet);
+  const t = gitTreeClean(dir, spawnSync, rewritable);
+  assert.equal(t.ok, false, 'a human really does need to look');
+  assert.match(t.dirty, /core_999_half_written\.sql/);
+  assert.ok(!t.dirty.includes('.claude/skills/builder-end'), 'the materialization half is still waived');
+});