@bongos/core 1.19.968 → 1.19.970

package/tests/merge_driver_register.mjs

@@ -0,0 +1,150 @@
+// tests/merge_driver_register.mjs
+//
+// Task 1003846 — registerMergeDriver wrote two git-config keys in sequence inside one
+// try, `.name` first. If the first succeeded and the second threw, the half-written
+// section SURVIVED, and git does not treat a named driver with no command as "fall back
+// to a text merge" — it treats it as fatal:
+//
+//     fatal: custom merge driver otb-regen lacks command line.
+//
+// exit 128, no unmerged paths. Every merge touching any `merge=otb-regen` path then dies
+// — the root CLAUDE.md, the file/session-log maps, two nested CLAUDE.md files, the
+// copy-registry pair and the nine generated API artifacts. So the partial-write state was
+// strictly WORSE than not registering at all, which merely yields an ordinary conflict.
+//
+// This file pins BOTH halves of the fix, and pins them against real git rather than a
+// mock, because the whole finding rests on how git itself reads a partial section — a
+// mock would only assert what we already believe. The first two tests would have passed
+// on the buggy code too if they were written against a stub; they are written against a
+// throwaway repo on disk precisely so they cannot.
+//
+// Run:  node --test tests/merge_driver_register.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+// fileURLToPath, never URL.pathname — on Windows the latter yields '/C:/…', which is not
+// a usable path. Enforced by fitness.js (task 1002889).
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { classifyMergeDriverState, registerMergeDriver, MERGE_DRIVER_NAME } =
+  require(path.join(REPO_ROOT, 'scripts/gds/install-git-hooks.js'));
+
+// A throwaway repo with one file attributed to the driver and two divergent branches,
+// so `git merge` actually has to consult the driver config.
+function scratchRepo() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'mergedriver-'));
+  const git = (args) => execFileSync('git', args, { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+  git(['init', '-q', '.']);
+  git(['config', 'user.email', 'test@example.com']);
+  git(['config', 'user.name', 'test']);
+  fs.writeFileSync(path.join(dir, 'f.md'), 'base\n');
+  fs.writeFileSync(path.join(dir, '.gitattributes'), `f.md merge=${MERGE_DRIVER_NAME}\n`);
+  git(['add', '-A']);
+  git(['commit', '-qm', 'base']);
+  const base = git(['branch', '--show-current']).trim();
+  git(['checkout', '-qb', 'other']);
+  fs.writeFileSync(path.join(dir, 'f.md'), 'theirs\n');
+  git(['commit', '-qam', 'other']);
+  git(['checkout', '-q', base]);
+  fs.writeFileSync(path.join(dir, 'f.md'), 'ours\n');
+  git(['commit', '-qam', 'mine']);
+  return { dir, git };
+}
+
+// Returns null on a clean merge, or git's stderr on failure.
+function tryMerge(dir) {
+  try {
+    execFileSync('git', ['merge', 'other'], { cwd: dir, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    return null;
+  } catch (e) {
+    return String(e.stderr || e.message);
+  }
+}
+
+test('THE BUG: a section with .name and no .driver makes every merge fatal', () => {
+  const { dir, git } = scratchRepo();
+  git(['config', `merge.${MERGE_DRIVER_NAME}.name`, 'half-written']);
+  const err = tryMerge(dir);
+  assert.ok(err, 'merge must FAIL in the half-written state — if this passes, the premise is gone');
+  assert.match(err, /lacks command line/,
+    'git must reject a named driver with no command (this is why .name cannot be written first)');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+test('THE FIX RESTS ON THIS: a section with only .driver is valid and runs', () => {
+  const { dir, git } = scratchRepo();
+  // `cp %B %A` stands in for git-merge-regen.js: it resolves by taking theirs, which is
+  // observable in the file afterwards, so this asserts the driver RAN — not merely that
+  // the merge exited 0, which a fallback text merge would also do.
+  git(['config', `merge.${MERGE_DRIVER_NAME}.driver`, 'cp %B %A']);
+  assert.equal(tryMerge(dir), null, 'a driver-only section must merge cleanly');
+  assert.equal(fs.readFileSync(path.join(dir, 'f.md'), 'utf8'), 'theirs\n',
+    'the custom driver must have run — otherwise this proves nothing about ordering');
+  fs.rmSync(dir, { recursive: true, force: true });
+});
+
+test('registerMergeDriver writes .driver BEFORE .name', () => {
+  const order = [];
+  const run = (_bin, args) => { order.push(args[1]); };
+  const res = registerMergeDriver('/nowhere', { run });
+  assert.equal(res.ok, true);
+  assert.deepEqual(order, [`merge.${MERGE_DRIVER_NAME}.driver`, `merge.${MERGE_DRIVER_NAME}.name`],
+    'order is the fix: the intermediate state after write #1 must be the SAFE one');
+});
+
+test('a failure mid-registration removes the whole section, leaving no trace', () => {
+  const calls = [];
+  const run = (_bin, args) => {
+    calls.push(args);
+    // Fail on the SECOND write (.name) — the exact partial-write this task is about.
+    if (args[1] === `merge.${MERGE_DRIVER_NAME}.name`) throw new Error('simulated config failure');
+  };
+  const res = registerMergeDriver('/nowhere', { run });
+  assert.equal(res.ok, false, 'a failed registration must report failure');
+  assert.match(res.error, /simulated config failure/, 'and must report the ORIGINAL error, not the cleanup');
+  assert.deepEqual(calls[calls.length - 1], ['config', '--remove-section', `merge.${MERGE_DRIVER_NAME}`],
+    'the last action must be removing the section, so nothing partial survives');
+});
+
+test('cleanup failing does not mask the original error', () => {
+  const run = (_bin, args) => {
+    if (args[1] === `merge.${MERGE_DRIVER_NAME}.name`) throw new Error('original failure');
+    if (args[1] === '--remove-section') throw new Error('cleanup also failed');
+  };
+  const res = registerMergeDriver('/nowhere', { run });
+  assert.equal(res.ok, false);
+  assert.match(res.error, /original failure/, 'the reported error must be the one that matters');
+});
+
+test('classifyMergeDriverState: name without driver is the FAIL doctor must surface', () => {
+  const v = classifyMergeDriverState({ name: 'something', driver: '' });
+  assert.equal(v.status, 'fail');
+  assert.equal(v.code, 'name-without-driver');
+  assert.match(v.message, /lacks command line/, 'the message must quote the fatal a builder will actually see');
+  assert.match(v.message, /--remove-section/, 'and must give a way out');
+});
+
+test('classifyMergeDriverState: driver present is ok, with or without a name', () => {
+  assert.equal(classifyMergeDriverState({ name: 'n', driver: 'd' }).status, 'ok');
+  assert.equal(classifyMergeDriverState({ name: '', driver: 'd' }).status, 'ok',
+    'driver-only is a WORKING section (proved against real git above), so it must not be reported as a fault');
+});
+
+test('classifyMergeDriverState: neither set is a warn, not a fail', () => {
+  const v = classifyMergeDriverState({ name: '', driver: '' });
+  assert.equal(v.status, 'warn');
+  assert.equal(v.code, 'unregistered');
+  assert.match(v.message, /ship\.js still self-heals/, 'absent is not a hole in the walls — say so');
+});
+
+test('whitespace-only config values count as absent', () => {
+  assert.equal(classifyMergeDriverState({ name: '   ', driver: '  ' }).code, 'unregistered');
+  assert.equal(classifyMergeDriverState({ name: 'n', driver: '   ' }).code, 'name-without-driver');
+});

package/tests/plain_cards.mjs

@@ -181,7 +181,11 @@ test('the sign-in printers, the release refusals and the claim guard each print
 
 test('every way start.js can refuse or fail prints a card', () => {
   const src = read('scripts/gds/start.js');
-  const codes = [...src.matchAll(/\.error === '([A-Za-z_]+)'/g)].map((m) => m[1]);
+  // BOTH spellings, or this assertion pins the bug it was written above: ADR 0116
+  // nests the slug as `{ error: { code } }`, so the flat `.error === 'slug'` compares
+  // an object to a string and is never true. Task 1003658 moved the live site to
+  // errCode(); matching only the flat form made the FIX read as "the branch moved".
+  const codes = [...src.matchAll(/(?:\.error|errCode\([^)]*\)) === '([A-Za-z_]+)'/g)].map((m) => m[1]);
   assert.ok(codes.includes('stage_required'), 'start.js no longer names its refusal — has the branch moved?');
   assert.deepEqual(missing(codes), []);
   for (const code of [...new Set(codes)]) assert.ok(src.includes(`plainCardLines('${code}')`), `start.js never prints the ${code} card`);

package/tests/provision.mjs

@@ -2858,6 +2858,111 @@ await ta('ensurePrivateRepoAccess(dry-run): fully OFFLINE — no token read, no
   assert.equal(tokenReads, 0, 'not even the credential read');
 });
 
+console.log('\nflip-to-private: wiring BEFORE the flip (task 1004167):');
+
+// The flip must wire first and flip second — a deploy key authenticates fine against a
+// still-public repo, so wiring first leaves no broken window, whereas flipping first
+// breaks the very next deploy pull. But at wire time GitHub still answers `private:
+// false`, and the function branches on that OBSERVED value. `intendedPrivate` is the
+// caller's declaration of where the repo is going.
+
+await ta('intendedPrivate: wires a repo GitHub still reports PUBLIC — the pre-flip window', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ priv: false, existing: false });
+  deps.intendedPrivate = true;
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.private, true, 'the declared INTENT decides, not the current visibility');
+  const add = apiCalls.find((c) => c[0] === 'add');
+  assert.ok(add, 'the key registers while the repo is still public — it authenticates either way');
+  assert.equal(add[3], true, 'still read-only: the override widens WHEN we wire, never what the key may do');
+  const joined = cmds.join('\n');
+  assert.match(joined, /ssh-keygen -q -t ed25519/);
+  assert.match(joined, /remote set-url origin git@github\.com:example-owner\/demo\.git/);
+  assert.match(joined, /config core\.sshCommand/);
+});
+
+await ta('intendedPrivate: does NOT un-wire an existing key — the un-wire branch is what made pre-flip wiring impossible', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({
+    priv: false, existing: true,
+    keys: [{ id: 11, title: 'cloudbongos-deploy-demo', key: 'ssh-ed25519 AAAAlocal', read_only: true }],
+  });
+  deps.intendedPrivate = true;
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.ok(!r.unwired, 'the caller asked for wiring; tearing it down is the exact opposite');
+  assert.ok(!apiCalls.some((c) => c[0] === 'del'), 'the registered key survives');
+  const joined = cmds.join('\n');
+  assert.ok(!/config --unset core\.sshCommand/.test(joined), 'sshCommand stays pinned');
+  assert.ok(!/remote set-url origin git@github-deploy:/.test(joined), 'origin is not returned to the shared alias');
+});
+
+await ta('intendedPrivate does NOT bypass the admin precondition', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ priv: false, existing: false });
+  deps.intendedPrivate = true;
+  deps.githubRepos.getUserRepo = async () => ({ full_name: 'example-owner/demo', private: false, admin: false });
+  await assert.rejects(() => P.ensurePrivateRepoAccess(privInst, deps), /repository access is not admin: .*ADMIN/);
+  assert.ok(!cmds.some((c) => /ssh-keygen/.test(c)), 'no key minted for a credential that cannot register it');
+  assert.ok(!apiCalls.some((c) => c[0] === 'add'));
+});
+
+await ta('no override → every existing path is byte-identical (the override is opt-in only)', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ priv: false, existing: false });
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.private, false);
+  assert.equal(cmds.length, 0);
+  assert.deepEqual(apiCalls.map((c) => c[0]), ['get'], 'still one visibility read and nothing else');
+});
+
+// A declared intent changes what a soft skip MEANS. Without it, "no credential" is a
+// warning about a repo that merely might be private. With it, the caller is about to
+// flip — so skipping quietly hands back an unwired checkout and the flip then breaks
+// the recurring pull for good (walk finding N4, the thing ADR 0176 exists to prevent).
+
+await ta('intendedPrivate + no token: REFUSES rather than skipping — a silent skip would break the next pull', async () => {
+  const { deps, cmds, apiCalls } = repoAuthDeps({ token: null });
+  deps.intendedPrivate = true;
+  await assert.rejects(() => P.ensurePrivateRepoAccess(privInst, deps), /cannot be made private[\s\S]*credential/i);
+  assert.equal(cmds.length, 0);
+  assert.equal(apiCalls.length, 0);
+});
+
+await ta('intendedPrivate + unreachable GitHub: REFUSES rather than skipping', async () => {
+  const { deps, cmds } = repoAuthDeps({ existing: false });
+  deps.intendedPrivate = true;
+  deps.githubRepos.getUserRepo = async () => { throw new Error('socket hang up'); };
+  await assert.rejects(() => P.ensurePrivateRepoAccess(privInst, deps), /cannot be made private[\s\S]*try again/i);
+  assert.ok(!cmds.some((c) => /ssh-keygen/.test(c)), 'nothing wired on a read we could not complete');
+});
+
+await ta('without the intent, both soft skips stay soft (unchanged for every existing caller)', async () => {
+  const noTok = repoAuthDeps({ token: null });
+  assert.equal((await P.ensurePrivateRepoAccess(privInst, noTok.deps)).skipped, 'no_token');
+  const unreach = repoAuthDeps({ existing: false });
+  unreach.deps.githubRepos.getUserRepo = async () => { throw new Error('socket hang up'); };
+  assert.equal((await P.ensurePrivateRepoAccess(privInst, unreach.deps)).skipped, 'github_unreachable');
+});
+
+await ta('intendedPrivate: the apply-path log does not claim the repo IS private when GitHub says otherwise', async () => {
+  const lines = [];
+  const { deps } = repoAuthDeps({ priv: false, existing: false });
+  deps.intendedPrivate = true;
+  deps.log = (m) => lines.push(String(m));
+  await P.ensurePrivateRepoAccess(privInst, deps);
+  const joined = lines.join('\n');
+  assert.doesNotMatch(joined, /is PRIVATE/, 'GitHub reported it public — the ops log must not misstate that');
+  assert.match(joined, /ABOUT TO BE MADE PRIVATE/);
+});
+
+await ta('intendedPrivate(dry-run): names the pre-flip intent in the plan line, and stays OFFLINE', async () => {
+  const lines = [];
+  const { deps, cmds, apiCalls } = repoAuthDeps({ apply: false, priv: false, existing: false });
+  deps.intendedPrivate = true;
+  deps.log = (m) => lines.push(String(m));
+  const r = await P.ensurePrivateRepoAccess(privInst, deps);
+  assert.equal(r.planned, true);
+  assert.equal(cmds.length, 0, 'no mutation in dry-run');
+  assert.deepEqual(apiCalls, [], 'a plan run stays a safe inspection tool');
+  assert.match(lines.join('\n'), /ABOUT TO BE MADE PRIVATE/, 'the plan says which intent it planned for');
+});
+
 await ta('provisionInstance(standalone): the private-repo wiring lands BETWEEN the scaffold and the step-2 pull', async () => {
   const { deps, cmds } = repoAuthDeps({ existing: false });
   const r = await P.provisionInstance({ ...coTenant, hosting_shape: 'standalone', target_ref: 'example-owner/mercury' }, deps);

package/tests/search_ingest.mjs

@@ -54,10 +54,46 @@ test('CLAUDE.md is xenos (write-protected but READ-PUBLIC — the carve-out)', (
   assert.equal(minRankForDoc('CLAUDE.md'), 'xenos');
 });
 
-test('SENSITIVE_DOC_GLOBS is the curated source of truth (subtrees end with /)', () => {
-  assert.ok(SENSITIVE_DOC_GLOBS.includes('docs/security/'));
-  assert.ok(SENSITIVE_DOC_GLOBS.includes('docs/audits/'));
-  assert.ok(SENSITIVE_DOC_GLOBS.includes('docs/canonical-permissions.md'));
+// EXHAUSTIVE, not a spot-check (task 1002882). The old version asserted three of the
+// six entries with includes(), which meant the list could GAIN or LOSE an entry — a
+// whole read-gated subtree appearing or vanishing — with nothing red. docs/governance/
+// was added under task 1002598 and this test never noticed.
+//
+// A deepEqual pin makes every change to the read floor a deliberate, reviewed edit:
+// you cannot widen or narrow what a sub-Metic search can reach without also editing
+// this line and saying why. The functional assertions above already cover BEHAVIOUR
+// (minRankForDoc returns 'metic'); this one states the list's INTENT, which is the
+// half that was under-described.
+//
+// Keep it in sync with scripts/gds/publish-manifest.js:185, where SENSITIVE_DOC_EXCLUDE
+// is derived from this same array by filtering to docs/security + docs/audits — a
+// silent addition here changes the PUBLISH boundary too.
+test('SENSITIVE_DOC_GLOBS is the curated source of truth (exhaustive pin)', () => {
+  assert.deepEqual(SENSITIVE_DOC_GLOBS, [
+    'docs/canonical-permissions.md',
+    'docs/security/',
+    'docs/audits/',
+    'docs/governance/',
+    'docs/adr/0016-trust-boundary-server-enforced-permissions.md',
+    'docs/adr/0043-git-ssh-trust-boundary-and-rank-floor-on-permission-paths.md',
+  ], 'adding or removing a read-gated doc must be a deliberate edit here, not a silent one');
+
+  // A trailing '/' means "subtree" to the glob dialect this shares with
+  // permission-path-check; a missing one would gate only an exact file of that name.
+  for (const g of ['docs/security/', 'docs/audits/', 'docs/governance/']) {
+    assert.ok(SENSITIVE_DOC_GLOBS.includes(g), `${g} must keep its trailing slash to gate the subtree`);
+  }
+});
+
+// The publish boundary reads this same array, so a change here silently moves what the
+// public AGPL mirror ships. Pin the derivation, not just the source (task 1002882).
+test('SENSITIVE_DOC_EXCLUDE derives docs/security + docs/audits from the same array', () => {
+  const derived = SENSITIVE_DOC_GLOBS.filter(
+    (g) => g.startsWith('docs/security') || g.startsWith('docs/audits')
+  );
+  assert.deepEqual(derived, ['docs/security/', 'docs/audits/'],
+    'publish-manifest.js:185 applies exactly this filter — if the array gains another '
+    + 'docs/security* or docs/audits* entry, the publish denylist changes with it');
 });
 
 test('collectMarkdown finds the repo corpus but excludes node_modules/.git/worktrees/public', () => {