@bongos/core 1.19.948 → 1.19.949

package/tests/cli_package.mjs

@@ -1,299 +0,0 @@
-// tests/cli_package.mjs — the public @cloudbongos/cli package is client-only AND actually runs.
-//
-// Guards task 1003679. Two halves, and the second is the one that matters:
-//
-//  1. Shape: the generated tree carries no server surface, and the redaction gate really fails
-//     a build when instance identity or a credential shape appears in it.
-//
-//  2. BEHAVIOUR: pack the tarball, install it into an empty directory with NO repo present, and
-//     run every advertised verb. This is the only instrument that can prove the file list is
-//     complete. A static require-closure cannot: src/module-api.js is the module doorway
-//     (ADR 0083) and by design *names* every kernel capability, so a static walk sees the whole
-//     server even though the getters are lazy and never resolve. If a real code path needs a
-//     file the manifest omits, the verb exits with MODULE_NOT_FOUND and this test says so.
-
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { fileURLToPath, pathToFileURL } from 'node:url';
-import { childEnv } from './helpers.mjs';
-
-const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
-
-// HOME ALONE IS NOT ISOLATION ON WINDOWS (task 1003763).
-//
-// os.homedir() reads USERPROFILE on win32 and never consults HOME, so
-// `env: { ...process.env, HOME: home }` isolated nothing there: the installed CLI
-// saw the DEVELOPER'S REAL session file. That is precisely the false green the
-// comment below guards against — an unauthenticated-path assertion passing because
-// the machine happens to be signed in.
-//
-// HOMEDRIVE/HOMEPATH are os.homedir()'s second win32 source, so all four go. Named
-// rather than inlined twice: this is the third site in the repo to need it (after
-// tests/cli_sessions.mjs in task 1003760 and tests/cli_surface.mjs in task 1003941),
-// and every one of them got it half-right first.
-//
-// AND AN INHERITED API BASE IS NOT ISOLATION EITHER (task 1004049). The same
-// shape of hole, one env var over: resolveApiBase() reads the CANONICAL
-// <PREFIX>_API_BASE before any legacy spelling, so the `CLOUDBONGOS_API_BASE:
-// 'http://127.0.0.1:45999'` the verbs below rely on to be a DEAD port is silently
-// shadowed on any box that exports the canonical one — every Bongos session box.
-// The verbs then made real calls to the live instance instead of failing fast
-// against a closed port, which is why this test ran for minutes and timed out
-// rather than failing with something readable. childEnv strips every spelling.
-function homelessEnv(home, extra = {}) {
-  return childEnv({ HOME: home, USERPROFILE: home, HOMEDRIVE: '', HOMEPATH: home, ...extra });
-}
-const BUILDER = path.join(REPO_ROOT, 'scripts', 'gds', 'build-cli-package.js');
-// Running npm from a test (task 1003529). On Windows `npm` is a .cmd shim: bare
-// 'npm' is ENOENT and 'npm.cmd' is EINVAL under Node 24's CVE-2024-27980 mitigation,
-// both surfacing as an inscrutable `null !== 0`. `shell: true` clears it but
-// concatenates args unescaped (DEP0190), which breaks on any tmp path with a space.
-// So invoke npm's own entrypoint through node: no shell, args stay arrays.
-const NPM_CLI = [
-  path.join(path.dirname(process.execPath), 'node_modules', 'npm', 'bin', 'npm-cli.js'),
-  path.join(path.dirname(process.execPath), '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
-].find((p) => fs.existsSync(p));
-const npm = (args, opts) => (NPM_CLI
-  ? spawnSync(process.execPath, [NPM_CLI, ...args], opts)
-  : spawnSync('npm', args, opts));
-
-// import() takes a URL, not a filesystem path: on win32 a bare 'C:\…' is read as
-// the 'c:' protocol and throws ERR_UNSUPPORTED_ESM_URL_SCHEME before any test runs
-// (task 1003529). pathToFileURL is the portable spelling.
-const mod = await import(pathToFileURL(BUILDER).href);
-const { build, FILES, VERBS, CHECKOUT_ONLY, ALLOWED_SRC_BONGOS, PACKAGE_NAME } = mod.default ?? mod;
-
-function tmpdir(tag) {
-  return fs.mkdtempSync(path.join(os.tmpdir(), `cli-pkg-${tag}-`));
-}
-
-// ── 1. Shape ────────────────────────────────────────────────────────────────────────────────
-
-test('the generated package contains no server surface', () => {
-  const out = tmpdir('shape');
-  const { files } = build({ out, quiet: true });
-
-  const kernel = files.filter((f) => f.startsWith('src/bongos/'));
-  assert.deepEqual(kernel, [...ALLOWED_SRC_BONGOS],
-    `only ${[...ALLOWED_SRC_BONGOS].join(', ')} may ship from the kernel, got ${kernel.join(', ')}`);
-
-  for (const f of files) {
-    assert.ok(!f.startsWith('src/bongos/routes/'), `${f}: routes must never ship`);
-    assert.ok(!/(^|\/)(pool|db|server|serve-internal)\.js$/.test(f), `${f}: server surface must never ship`);
-    assert.ok(!f.startsWith('migrations/'), `${f}: migrations must never ship`);
-    assert.ok(!f.startsWith('infra/'), `${f}: infra must never ship`);
-  }
-  fs.rmSync(out, { recursive: true, force: true });
-});
-
-test('the one kernel file that ships imports nothing', () => {
-  const src = fs.readFileSync(path.join(REPO_ROOT, 'src', 'bongos', 'api-prefix.js'), 'utf8');
-  const rel = [...src.matchAll(/require\(\s*['"](\.[^'"]+)['"]\s*\)/g)].map((m) => m[1]);
-  assert.deepEqual(rel, [], `api-prefix.js must stay dependency-free, found: ${rel.join(', ')}`);
-});
-
-test('every file in the manifest exists', () => {
-  for (const rel of FILES) {
-    assert.ok(fs.existsSync(path.join(REPO_ROOT, rel)), `manifest names a missing file: ${rel}`);
-  }
-});
-
-test('every advertised verb maps to a script the manifest ships', () => {
-  for (const [verb, def] of Object.entries(VERBS)) {
-    assert.ok(FILES.includes(`scripts/gds/${def.script}`),
-      `verb "${verb}" runs scripts/gds/${def.script}, which the manifest does not ship`);
-  }
-});
-
-test('the redaction gate fails the build on an injected needle and on a credential shape', () => {
-  const out = tmpdir('gate');
-
-  // A domain that really is in the tree, supplied as forbidden → must refuse to emit.
-  const withNeedle = spawnSync(process.execPath, [BUILDER, '--out', out, '--quiet'], {
-    cwd: REPO_ROOT, encoding: 'utf8',
-    env: { ...process.env, CLI_PACKAGE_FORBIDDEN: 'cli-lib' },
-  });
-  assert.notEqual(withNeedle.status, 0, 'an instance needle present in the tree must fail the build');
-  assert.match(withNeedle.stderr, /redaction gate FAILED/);
-
-  // A planted credential shape must fail too, with no needle configured at all.
-  const planted = path.join(REPO_ROOT, 'scripts', 'gds', '.cli-pkg-gate-probe.js');
-  const victim = path.join(REPO_ROOT, 'scripts', 'gds', 'preflight.js');
-  const original = fs.readFileSync(victim, 'utf8');
-  try {
-    fs.writeFileSync(victim, `${original}\n// ghp_0123456789abcdefghijABCDEFGHIJ0123\n`);
-    const withToken = spawnSync(process.execPath, [BUILDER, '--out', out, '--quiet'], {
-      cwd: REPO_ROOT, encoding: 'utf8',
-    });
-    assert.notEqual(withToken.status, 0, 'a github token shape must fail the build');
-    assert.match(withToken.stderr, /github token/);
-  } finally {
-    fs.writeFileSync(victim, original);
-    fs.rmSync(planted, { force: true });
-  }
-  fs.rmSync(out, { recursive: true, force: true });
-});
-
-test('a clean build emits and reports itself', () => {
-  const out = tmpdir('clean');
-  const res = spawnSync(process.execPath, [BUILDER, '--out', out], { cwd: REPO_ROOT, encoding: 'utf8' });
-  assert.equal(res.status, 0, `clean build failed:\n${res.stderr}`);
-  assert.match(res.stdout, /redaction gate: clean/);
-  assert.ok(fs.existsSync(path.join(out, 'package.json')));
-  assert.ok(fs.existsSync(path.join(out, 'bin', 'bongos.js')));
-
-  const pkg = JSON.parse(fs.readFileSync(path.join(out, 'package.json'), 'utf8'));
-  assert.equal(pkg.name, PACKAGE_NAME);
-  assert.deepEqual(Object.keys(pkg.dependencies), ['undici'], 'exactly one runtime dependency');
-  assert.equal(pkg.bin.bongos, 'bin/bongos.js');
-  assert.equal(pkg.publishConfig.access, 'public');
-  assert.ok(!('repository' in pkg), 'no repository URL while the core repo is private');
-  fs.rmSync(out, { recursive: true, force: true });
-});
-
-// ── 2. Behaviour: install the tarball where there is no repo, and run it ─────────────────────
-
-test('the packed tarball installs and every verb runs with no repo present', (t) => {
-  const buildOut = tmpdir('pack');
-  const home = tmpdir('home');
-  const site = tmpdir('site');
-
-  const built = spawnSync(process.execPath, [BUILDER, '--out', buildOut, '--quiet'], {
-    cwd: REPO_ROOT, encoding: 'utf8',
-  });
-  assert.equal(built.status, 0, `build failed:\n${built.stderr}`);
-
-  const packed = npm(['pack', '--silent', '--pack-destination', site], {
-    cwd: buildOut, encoding: 'utf8',
-  });
-  assert.equal(packed.status, 0, `npm pack failed:\n${packed.stderr}`);
-  const tarball = fs.readdirSync(site).find((f) => f.endsWith('.tgz'));
-  assert.ok(tarball, `no tarball produced in ${site}`);
-
-  // An empty directory: no repo, no core, no config, and a HOME of its own so a real session
-  // file on this machine cannot make a verb look healthier than it is.
-  fs.writeFileSync(path.join(site, 'package.json'), JSON.stringify({ name: 'probe', private: true }));
-  const installed = npm(['install', '--no-audit', '--no-fund', '--silent', path.join(site, tarball)], {
-    cwd: site, encoding: 'utf8', env: homelessEnv(home),
-  });
-  assert.equal(installed.status, 0, `npm install failed:\n${installed.stderr}`);
-
-  // The installed shim proves npm wired `bin` up; the verbs then run through the
-  // real entrypoint rather than the shim, for the same Node-24-on-Windows reason as
-  // NPM_CLI above — spawning .bin/bongos.cmd is EINVAL (task 1003529).
-  const shim = path.join(site, 'node_modules', '.bin', process.platform === 'win32' ? 'bongos.cmd' : 'bongos');
-  assert.ok(fs.existsSync(shim), 'the package did not install a `bongos` binary');
-  const bongos = path.join(site, 'node_modules', PACKAGE_NAME, 'bin', 'bongos.js');
-  assert.ok(fs.existsSync(bongos), `the installed package has no bin/bongos.js at ${bongos}`);
-
-  const runVerb = (args) => spawnSync(process.execPath, [bongos, ...args], {
-    cwd: site, encoding: 'utf8', input: '',
-    env: homelessEnv(home, { CLOUDBONGOS_API_BASE: 'http://127.0.0.1:45999', NO_COLOR: '1' }),
-  });
-
-  // help and version must work with nothing configured at all.
-  const help = runVerb(['help']);
-  assert.equal(help.status, 0, `bongos help failed:\n${help.stderr}`);
-  assert.match(help.stdout, /bongos login https:\/\//, 'help must lead with how to sign in');
-
-  const version = runVerb(['version']);
-  assert.equal(version.status, 0);
-  assert.match(version.stdout, /^bongos \d+\.\d+\.\d+/m);
-
-  // Every advertised verb must actually LOAD its script. Args are chosen so the dispatcher
-  // cannot answer on the script's behalf — `--help` on a non-selfHelp verb is intercepted by
-  // the dispatcher and would leave the script untouched, which is how this test could pass
-  // while proving nothing. Each verb below reaches its own code, then fails on the dead API
-  // base or on missing arguments. Failing that way is fine; failing to find a file is not.
-  const LOAD_ARGS = {
-    login:   ['login'],
-    // `--no-open` is load-bearing, not cosmetic (task 1003909). HOME is a throwaway here, so
-    // there is no session and reauth takes its no-session path — which launches the builder's
-    // default browser at the dead API base (`rundll32 url.dll,FileProtocolHandler` on Windows).
-    // Without the flag, every run of this suite pops a connection-refused tab on the machine
-    // under test. The flag skips only the spawn: the script still loads, still prints its
-    // guidance, still exits 10, so every assertion below is unchanged.
-    reauth:  ['reauth', '--no-open'],
-    setup:   ['setup'],
-    start:   ['start'],
-    status:  ['status'],
-    task:    ['task', 'show', '1'],
-    recall:  ['recall', 'probe'],
-    cost:    ['cost'],
-    release: ['release'],
-    api:     ['api', 'GET', '/api/gds/me'],
-  };
-  assert.deepEqual(
-    Object.keys(LOAD_ARGS).sort(), Object.keys(VERBS).sort(),
-    'every advertised verb needs an entry here, or it goes unexercised',
-  );
-
-  // No verb may launch a GUI on the machine running the suite (task 1003909). A script that can
-  // spawn a browser has two ways to be safe here, and it must pick one:
-  //   * it offers an opt-out flag   → the LOAD_ARGS entry above passes it, or
-  //   * it stops short of the launch → STOPS_SHORT_OF_LAUNCH names a marker that must stay absent.
-  // Proving it, rather than assuming it, is the point: a verb that starts reaching its launcher
-  // fails here instead of on someone's desktop.
-  const LAUNCHES_BROWSER = /FileProtocolHandler|xdg-open/;
-  const OPT_OUT = '--no-open';
-  const STOPS_SHORT_OF_LAUNCH = {
-    // `bongos login` opens a browser from inside the device flow, several network steps past the
-    // instance-URL prompt — and with empty stdin that prompt is never answered, so the process
-    // ends right there. `▸ Connecting to` is the first thing printed once a URL is accepted, so
-    // its ABSENCE is the proof this run stopped well short of the launch.
-    login: /Connecting to/,
-  };
-  const mustStopShort = {};
-  for (const [verb, args] of Object.entries(LOAD_ARGS)) {
-    const src = fs.readFileSync(path.join(REPO_ROOT, 'scripts', 'gds', VERBS[verb].script), 'utf8');
-    if (!LAUNCHES_BROWSER.test(src)) continue;
-    if (src.includes(OPT_OUT)) {
-      assert.ok(args.includes(OPT_OUT),
-        `bongos ${verb} can spawn a browser and accepts ${OPT_OUT} — pass it in LOAD_ARGS, or this suite opens a window on the builder's machine`);
-      continue;
-    }
-    assert.ok(STOPS_SHORT_OF_LAUNCH[verb],
-      `bongos ${verb} can spawn a browser and has no ${OPT_OUT} — give it one, or add a STOPS_SHORT_OF_LAUNCH entry proving this run never reaches the launch`);
-    mustStopShort[verb] = STOPS_SHORT_OF_LAUNCH[verb];
-  }
-
-  for (const [verb, args] of Object.entries(LOAD_ARGS)) {
-    const res = runVerb(args);
-    const all = `${res.stdout}\n${res.stderr}`;
-    if (mustStopShort[verb]) {
-      assert.doesNotMatch(all, mustStopShort[verb],
-        `bongos ${verb} got past the point where it can spawn a browser on this machine:\n${all}`);
-    }
-    assert.ok(!/Cannot find module|MODULE_NOT_FOUND|ERR_MODULE_NOT_FOUND/.test(all),
-      `bongos ${verb} hit a missing file — the manifest is incomplete:\n${all}`);
-    assert.ok(!/ERR_REQUIRE_ESM|SyntaxError|ReferenceError/.test(all),
-      `bongos ${verb} failed to load:\n${all}`);
-    // `TypeError: fetch failed` is what an unreachable API base looks like and is expected
-    // here; any OTHER TypeError means the package itself is broken.
-    assert.ok(!/TypeError(?!: fetch failed)/.test(all),
-      `bongos ${verb} threw a real TypeError:\n${all}`);
-    assert.notEqual(res.status, null, `bongos ${verb} was killed by a signal:\n${all}`);
-    // The dispatcher's own help card is proof the script was never reached.
-    assert.ok(!/^bongos \w+ — .*\nForwards to scripts/m.test(all),
-      `bongos ${verb} was answered by the dispatcher instead of loading:\n${all}`);
-  }
-
-  // The excluded verbs must teach the next step, not print a bare "unknown command".
-  for (const verb of Object.keys(CHECKOUT_ONLY)) {
-    const res = runVerb([verb]);
-    const all = `${res.stdout}\n${res.stderr}`;
-    assert.match(all, /is not in the public CLI/, `bongos ${verb} must say why it is absent`);
-    assert.match(all, /checkout of the project repo/, `bongos ${verb} must point at a way to get a checkout`);
-    assert.ok(!/unknown command/.test(all), `bongos ${verb} must not read as a typo`);
-  }
-
-  // An unknown verb still behaves like one.
-  const bogus = runVerb(['definitely-not-a-verb']);
-  assert.match(bogus.stderr, /unknown command/);
-
-  for (const d of [buildOut, home, site]) fs.rmSync(d, { recursive: true, force: true });
-});