@bongos/core 1.19.952 → 1.19.954

package/src/module-api.js

@@ -71,7 +71,7 @@ const { responsibilityFor, ROLE_RESPONSIBILITIES } = require('./role-responsibil
 // there. scripts/gds/bump-version.js still rewrites the literal below; it appends
 // the entry to that file. Look for a version's history there, not here.
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.952'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.19.954'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/core_update_banner.mjs

@@ -202,7 +202,7 @@ test('a real request through the assembled router returns the verdict, not a 500
 
 // ── the banner ────────────────────────────────────────────────────────────────
 
-function boot({ permissions, update, status = 200, dismissed = null, provisioning = true } = {}) {
+function boot({ permissions, update, status = 200, dismissed = null, provisioning = true, pathname = '/settings' } = {}) {
   const els = new Map();
   const inserted = [];
   const stored = {};
@@ -227,7 +227,7 @@ function boot({ permissions, update, status = 200, dismissed = null, provisionin
     addEventListener() {}, dispatchEvent() {},
     get cookie() { return ''; }, set cookie(_v) {},
   };
-  const location = { hostname: 'h', origin: 'https://h', pathname: '/settings', hash: '', assign() {}, replace() {} };
+  const location = { hostname: 'h', origin: 'https://h', pathname, hash: '', assign() {}, replace() {} };
   const windowObj = {
     __BRANDING__: {}, __MODULES__: { enabled: { provisioning } },
     BongosClient: {
@@ -334,3 +334,31 @@ test('the banner renders from the projection /me ACTUALLY sends, not one written
     'gates on is outside NAV_PERMISSION_ATOMS and the feature is dead for everyone (task 1004118)',
   );
 });
+
+// ── the banner must not offer the page you are on (task 1004145) ──────────────
+// The owner pressed this on /deploy and reported "I clicked update, but I didn't see
+// anything happen". Nothing had: it is an <a href="/deploy"> styled as a button and
+// labelled with the verb, so on /deploy it navigates to the current page and does
+// nothing at all. No request was ever made — verified against the live box, which had
+// no core-upgrade POST in three hours and no queued intent from that press.
+
+test('on /deploy the banner points at the control instead of linking to /deploy', async () => {
+  const b = boot({ pathname: '/deploy', permissions: { 'core.pin.move': true }, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  const html = b.banner().innerHTML;
+  assert.doesNotMatch(html, /href="\/deploy"/, 'no link to the page already open');
+  assert.match(html, /control below/i, 'it says where the real control is');
+  assert.match(html, /1\.19\.871/, 'and still announces the release');
+});
+
+test('everywhere else the banner still offers the link', async () => {
+  const b = boot({ pathname: '/settings', permissions: { 'core.pin.move': true }, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.match(b.banner().innerHTML, /href="\/deploy"/, 'the action is real from any other page');
+});
+
+test('a trailing slash is still /deploy', async () => {
+  const b = boot({ pathname: '/deploy/', permissions: { 'core.pin.move': true }, update: BEHIND });
+  await new Promise((r) => setTimeout(r, 0));
+  assert.doesNotMatch(b.banner().innerHTML, /href="\/deploy"/);
+});

package/tests/core_upgrade_door.mjs

@@ -697,5 +697,55 @@ await t('every strict body schema in this module declares each field its handler
     'under strict, a field the schema does not name is a 400 BEFORE the handler runs, so reading it is unreachable code and a broken endpoint');
 });
 
+
+console.log('\nthe last move, whatever became of it (task 1004145):');
+
+const SNAP = { served_version: '1.19.900', available: ['1.19.900', '1.19.949'], recommended: '1.19.949', observed_at: new Date().toISOString() };
+
+await t('a FAILED move is visible — the payload is no longer identical to before it', () => {
+  // open_intent is `state IN ('pending','running')` by the index's own definition, so an
+  // errored intent is not open. Before last_move, the payload after a rolled-back
+  // upgrade matched the payload before it exactly, and the owner's only signal was a
+  // number that never changed — indistinguishable from never having pressed.
+  const failed = { action: 'core-upgrade', state: 'error', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: 'working tree not clean — commit/stash first, or pass --force.' };
+  const p = CU.previewFromSnapshot(ACTIVE, SNAP, null, failed);
+  assert.equal(p.open_intent, null, 'it is not an OPEN intent');
+  assert.equal(p.last_move.state, 'error');
+  assert.equal(p.last_move.target_version, '1.19.949');
+  assert.match(p.last_move.error, /working tree not clean/, 'and the reason travels');
+});
+
+await t('a SUCCESSFUL move is attributable, not merely finished', () => {
+  const done = { action: 'core-upgrade', state: 'done', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: null };
+  const p = CU.previewFromSnapshot({ ...ACTIVE }, { ...SNAP, served_version: '1.19.949', recommended: null }, null, done);
+  assert.equal(p.last_move.state, 'done');
+  assert.equal(p.last_move.target_version, p.served_version, 'the move names the version the box now serves');
+  assert.equal(p.last_move.error, null);
+});
+
+await t('a long refusal is truncated — it reaches a DOM', () => {
+  // The dirty-tree refusal carries a whole `git status`; test4's ran to dozens of lines.
+  const huge = { action: 'core-upgrade', state: 'error', target_version: '1.19.949', resolved_at: new Date().toISOString(), last_error: 'x'.repeat(5000) };
+  const p = CU.previewFromSnapshot(ACTIVE, SNAP, null, huge);
+  assert.ok(p.last_move.error.length <= 600, `bounded — got ${p.last_move.error.length}`);
+});
+
+await t('no move ever made is null, not an invented success', () => {
+  const p = CU.previewFromSnapshot(ACTIVE, SNAP, null, null);
+  assert.equal(p.last_move, null);
+});
+
+await t('lastCoreMove reads MOVES only — a preview refusal is not a failed deploy', async () => {
+  // Folding core-upgrade-preflight in here would let a dry run's refusal render as
+  // "the move did not land". The preview reports itself through `preflight`.
+  const seen = [];
+  const pool = { query: async (sql, params) => { seen.push({ sql, params }); return { rows: [] }; } };
+  await CU.lastCoreMove(pool, 41);
+  assert.match(seen[0].sql, /action = 'core-upgrade'/, 'scoped to the move action');
+  assert.doesNotMatch(seen[0].sql, /preflight/, 'and never widened to the preview');
+  assert.doesNotMatch(seen[0].sql, /state IN/, 'and not filtered to open states — the point is the terminal ones');
+  assert.deepEqual(seen[0].params, [41]);
+});
+
 console.log(`\ncore_upgrade_door: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);

package/tests/deploy_page_projects.mjs

@@ -32,10 +32,15 @@ const FLEET = [
   { id: '35', slug: 'unreadable-one', status: 'active', hosting_shape: 'standalone' },
 ];
 
-function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200 } = {}) {
+function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus = 200, fleet = FLEET, fleetStatus = 200, instanceOver = null, moveTries = 4, postStatus = 200 } = {}) {
   const els = new Map();
   const posts = [];
   const gets = [];
+  // How many times each box has been re-read. A move POLLS, so a test of the move has to
+  // be able to change what the server says between reads — otherwise the only reachable
+  // assertion is "it asked", never "it noticed".
+  const reads = new Map();
+  const toasts = [];
   const makeEl = () => ({
     _on: {}, _html: '', hidden: false, textContent: '', disabled: false,
     addEventListener(ev, fn) { this._on[ev] = fn; },
@@ -48,7 +53,13 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   const request = async (method, url, opts) => {
     const p = url.replace('/api/bongos', '');
     if (method === 'GET') gets.push(p);
-    if (method === 'POST') { posts.push({ path: p, body: opts && opts.body }); return { ok: true, status: 200, data: { message: 'Queued.' } }; }
+    if (method === 'POST') {
+      posts.push({ path: p, body: opts && opts.body });
+      if (postStatus !== 200) {
+        return { ok: false, status: postStatus, data: { error: { code: 'intent_conflict', message: 'A core-upgrade run is currently running for this project.' } } };
+      }
+      return { ok: true, status: 200, data: { message: 'Queued.' } };
+    }
     if (p === '/provisioning/control-plane') {
       if (controlPlaneStatus !== 200) {
         return { ok: false, status: controlPlaneStatus, data: { error: { code: 'control_plane_not_enrolled', message: 'This platform has no deploy door yet. Run enroll-control-plane.js once.' } } };
@@ -66,13 +77,16 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
       if (!inst || inst.slug === 'unreadable-one') {
         return { ok: false, status: 500, data: { error: { code: 'core_upgrade_preview_failed', message: 'internal error' } } };
       }
-      return { ok: true, status: 200, data: { preview: preview(inst.id, inst.slug, { hosting_shape: inst.hosting_shape }) } };
+      const n = (reads.get(inst.id) || 0) + 1;
+      reads.set(inst.id, n);
+      const over = instanceOver ? instanceOver(inst, n) : {};
+      return { ok: true, status: 200, data: { preview: preview(inst.id, inst.slug, { hosting_shape: inst.hosting_shape, ...over }) } };
     }
     return { ok: false, status: 404, data: { error: { code: 'not_found' } } };
   };
   const windowObj = {
     BongosClient: { createClient: () => ({ request }) },
-    OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast() {} },
+    OTB: { escapeHtml: (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c])), toast(m) { toasts.push(String(m)); } },
     location: { assign() {} },
   };
   // The page's poll interval, driven rather than slept through. Injecting the REAL
@@ -81,13 +95,18 @@ function boot({ controlPlane = preview('1', 'cloudbongos'), controlPlaneStatus =
   // flaky against a torn-down sandbox.
   windowObj.__deployPollMs = 0;
   windowObj.__deployPollTries = 3;
+  windowObj.__deployMoveTries = moveTries;
   const sandbox = { window: windowObj, document: documentObj, console, setTimeout, clearTimeout, queueMicrotask, Date, Set, Map, Promise };
   sandbox.globalThis = sandbox;
   vm.createContext(sandbox);
   vm.runInContext(SRC, sandbox, { filename: 'deploy.js' });
   documentObj._ready();
   const settle = async () => { for (let i = 0; i < 40; i++) await new Promise((r) => setTimeout(r, 0)); };
-  return { els, posts, gets, settle, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
+  // A SHORT advance, for observing a state that exists only while the poll is running.
+  // `settle` drains the whole loop (POLL_MS is 0 here), so an assertion about the
+  // in-flight row has to look before the loop finishes, not after it.
+  const tick = async (n = 3) => { for (let i = 0; i < n; i++) await new Promise((r) => setTimeout(r, 0)); };
+  return { els, posts, gets, reads, toasts, settle, tick, panel: () => els.get('dp-panel').innerHTML, sub: () => els.get('dp-sub').textContent };
 }
 
 test('the platform AND every live hosted project get a row', async () => {
@@ -189,8 +208,12 @@ test('a move re-reads ONLY the box it moved, not every project again', async ()
   b.els.get('dp-confirm-32')._on.click();
   await b.settle();
   const previewReads = b.gets.filter((g) => g.endsWith('/core-upgrade'));
-  assert.deepEqual(previewReads, ['/provisioning/instances/32/core-upgrade'],
-    'exactly one preview re-read, and it is the moved box');
+  // Since task 1004145 a move POLLS, so the count is no longer one — and the count was
+  // only ever a proxy for the thing that matters. Asserted directly instead: every
+  // re-read is the moved box, and no other box is touched.
+  assert.ok(previewReads.length > 0, 'the moved box is re-read');
+  assert.deepEqual([...new Set(previewReads)], ['/provisioning/instances/32/core-upgrade'],
+    'and it is the ONLY box re-read — no fan-out across the fleet');
   assert.ok(!b.gets.includes('/provisioning/fleet'), 'the fleet is not re-listed');
 });
 
@@ -290,3 +313,104 @@ test('a verdict already in hand is NOT re-requested', async () => {
   assert.equal(b.posts.filter((x) => x.body && x.body.dry_run).length, 0, 'no check requested');
   assert.match(b.panel(), /nothing blocks this move/i, 'the held verdict is shown');
 });
+
+// ── the press has to show something (task 1004145) ────────────────────────────
+// The owner pressed Upgrade and reported "I didn't see anything happen". Two reasons:
+// the banner's Upgrade is a link to /deploy (fixed in shell.js), and move() refreshed
+// once — before the runner's tick — then fell silent for the whole upgrade.
+
+test('confirming a move says so IMMEDIATELY, naming the version it is taking', async () => {
+  const b = boot();
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.tick();
+  const html = b.panel();
+  assert.match(html, /Moving to core/i, 'the row reports the move, rather than snapping back');
+  assert.match(html, /1\.19\.871/, 'and names the target');
+  assert.match(html, /restarts as part of this/i, 'and warns what it costs');
+});
+
+test('the in-flight state survives the poll — it does not close under the reader', async () => {
+  // refreshOne() returns a row to step one, which is right after a move and wrong
+  // DURING one; without keepStep the poll wipes its own message on the first interval.
+  // Observed after a poll has actually run, but before the bound is exhausted.
+  // A long bound so the loop cannot exhaust mid-assertion: the state under test exists
+  // only WHILE it polls.
+  const b = boot({ moveTries: 500, instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.tick(8);
+  assert.ok(b.reads.get('32') >= 1, 'at least one poll has landed');
+  assert.match(b.panel(), /Moving to core/i, 'still reporting after a refresh');
+  assert.doesNotMatch(b.panel(), /id="dp-preview-32"/, 'and has not reverted to step one');
+});
+
+test('when the box lands on the new core, it CONFIRMS it', async () => {
+  // The whole ask: "confirmation when it updates". A changed number is not a
+  // confirmation — nothing tied it to the press.
+  const b = boot({
+    instanceOver: (inst, n) => (n >= 2
+      ? { served_version: '1.19.871', behind: false, open_intent: null, last_move: { target_version: '1.19.871', state: 'done', at: new Date().toISOString(), error: null } }
+      : { open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }),
+  });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /Now running core 1\.19\.871/i, 'the move is confirmed, not merely finished');
+  assert.doesNotMatch(html, /Moving to core/i, 'and the in-flight state is gone');
+});
+
+test('a FAILED move is reported, with the reason, instead of looking untouched', async () => {
+  // An errored intent is not an OPEN intent, so before last_move existed the payload
+  // after a rolled-back upgrade was identical to the payload before it.
+  const b = boot({
+    instanceOver: (inst, n) => (n >= 2
+      ? { open_intent: null, last_move: { target_version: '1.19.871', state: 'error', at: new Date().toISOString(), error: 'working tree not clean — commit/stash first, or pass --force.' } }
+      : { open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }),
+  });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /did not land/i, 'the failure is stated');
+  assert.match(html, /working tree not clean/, 'and carries the runner’s own reason');
+  assert.match(html, /put back on 1\.19\.800/i, 'and says the project is still running');
+});
+
+test('a poll that runs out says it is still working, not that it failed', async () => {
+  // MOVE_TRIES is a bound on this page's patience, not on the runner's work.
+  const b = boot({ instanceOver: () => ({ open_intent: { action: 'core-upgrade', state: 'running', target_version: '1.19.871' } }) });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  for (let i = 0; i < 6; i++) await b.settle();
+  assert.ok(b.toasts.some((t) => /Still working on core 1\.19\.871/i.test(t)),
+    `it says where things stand — got ${JSON.stringify(b.toasts)}`);
+  assert.doesNotMatch(b.panel(), /did not land/i, 'and never claims a failure it did not see');
+});
+
+test('a queue that is REFUSED leaves no in-flight state to wait on', async () => {
+  // THIS TEST USED TO PASS WITHOUT CLICKING ANYTHING. Its setup read
+  // `b.els.get('dp-confirm-32')._on = el._on` — a self-assignment no-op — and set
+  // `b.postFails`, a property the harness never read. So it asserted "no in-flight
+  // state" on a row where no move had been attempted, which is true of every row on the
+  // page. The grader caught it. It now refuses the POST for real and presses the button.
+  const b = boot({ postStatus: 409 });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  await b.settle();
+  // Counted on the MOVE specifically: arming the row also POSTs a dry_run pre-flight,
+  // so a bare posts.length would have been satisfied by the preview alone — the same
+  // class of mistake this test is being fixed for.
+  const moves = b.posts.filter((x) => !(x.body && x.body.dry_run));
+  assert.equal(moves.length, 1, `the press really happened — posts: ${JSON.stringify(b.posts)}`);
+  assert.doesNotMatch(b.panel(), /Moving to core/i, 'nothing was queued, so nothing is watched');
+  assert.ok(b.toasts.some((t) => /currently running/i.test(t)), 'and the refusal is reported');
+  assert.match(b.panel(), /id="dp-confirm-32"/, 'the button comes back so it can be retried');
+});

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '8a93e0b4ca715b9c';
+const SHELL_SHA = '02de48ca2ae07995';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);