@bongos/core 1.19.993 → 1.19.995

package/tests/update_subscription_engine.mjs

@@ -35,6 +35,7 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
 import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
@@ -475,3 +476,293 @@ test('both commitPin successes report committed:true', () => {
   assert.equal(S.commitPin({ dir: '/srv/demo', message: 'm' }, fakeGit({ dirty: [] }).run, () => {}).committed, undefined,
     'an already-clean tree committed nothing and must not be counted as a heal');
 });
+
+// ---------------------------------------------------------------------------
+// 10. the THIRD bucket — what the lane itself generated (task 1003968)
+//
+// pinState sorted a dirty worktree two ways: "the pin" (ours to commit) and
+// "everything else" (a human's work — halt). An upgrade's OWN output is neither,
+// and every bump produces it: materializeClaude rewrites `.claude/` and
+// regenerateApiArtifacts rewrites the OpenAPI spec + typed client. So on any run
+// that did not commit that output, the lane halted on its own exhaust:
+//
+//   • pinMode `leave-dirty` — which commits NOTHING by definition — reached
+//     healDecision's `other`-first check on every sweep after its first upgrade
+//     and returned `halt` for a mode whose entire premise is that the tree may
+//     stay dirty. The `by-design` branch beneath it was unreachable.
+//   • the direct engine on a core too old for --pin-no-push, where pinFlagsFor
+//     correctly withholds every flag and leaves the same output behind.
+//
+// The fix is a provenance answer, not a wider guard: laneGeneratedPaths asks the
+// instance's OWN core what this upgrade rewrites, pinState sorts by it, and
+// commitPin stages that bucket while its refusal stays keyed on everything else.
+// ---------------------------------------------------------------------------
+
+// A resolveFrom/load pair standing in for the target instance's core, so the probe is
+// exercised without a second core on disk.
+function fakeCore({ api, willRewrite, upgradeThrows = false, materializeThrows = false } = {}) {
+  const seen = [];
+  const resolveFrom = (dir, rel) => {
+    if (rel === 'scripts/gds/upgrade.js' && api === null) return null;
+    if (rel === 'scripts/gds/claude-materialize.js' && willRewrite === null) return null;
+    return path.join(dir, 'node_modules', '@bongos', 'core', rel);
+  };
+  const load = (p) => {
+    if (p.endsWith('upgrade.js')) {
+      if (upgradeThrows) throw new Error('an older core cannot be loaded here');
+      return { API_ARTIFACT_FILES: api || {} };
+    }
+    if (materializeThrows) throw new Error('materialize blew up');
+    return { materializeWillRewrite: willRewrite === undefined ? undefined : (args) => { seen.push(args); return willRewrite; } };
+  };
+  return { resolveFrom, load, seen };
+}
+
+test('laneGeneratedPaths unions the API artifacts with what materialize WOULD rewrite', () => {
+  const core = fakeCore({
+    api: { 'gen-api-docs.js': ['docs/api/openapi.json'], 'gen-api-client.js': ['clients/bongos-client/index.mjs'] },
+    willRewrite: ['.claude/skills/builder-ship/SKILL.md', '.claude/settings.json'],
+  });
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', core).sort(), [
+    '.claude/settings.json',
+    '.claude/skills/builder-ship/SKILL.md',
+    'clients/bongos-client/index.mjs',
+    'docs/api/openapi.json',
+  ]);
+});
+
+test('laneGeneratedPaths derives coreRoot from where the module RESOLVED', () => {
+  // Not from a package-name guess: an instance may carry the core under any of its
+  // published names, and materializeWillRewrite's own default only knows the first.
+  const core = fakeCore({ api: {}, willRewrite: [] });
+  S.laneGeneratedPaths('/srv/demo', core);
+  assert.equal(core.seen.length, 1);
+  assert.equal(core.seen[0].instanceDir, '/srv/demo');
+  assert.equal(path.resolve(core.seen[0].coreRoot), path.resolve('/srv/demo/node_modules/@bongos/core'));
+});
+
+test('laneGeneratedPaths is FAIL-SOFT in every direction — an empty set, never a guessed one', () => {
+  // The direction matters. An instance this cannot interrogate keeps the OLD, stricter guard
+  // (still wedged, and visibly so), rather than gaining a looser one that commits a stranger's work.
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ api: null, willRewrite: null })), []);
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ api: {}, willRewrite: undefined })), []);
+  assert.deepEqual(S.laneGeneratedPaths('/srv/demo', fakeCore({ upgradeThrows: true, materializeThrows: true })), []);
+  // A core that exports API_ARTIFACT_FILES but whose materialize throws still contributes the
+  // half it could answer for.
+  assert.deepEqual(
+    S.laneGeneratedPaths('/srv/demo', fakeCore({ api: { g: ['docs/api/openapi.json'] }, materializeThrows: true })),
+    ['docs/api/openapi.json'],
+  );
+});
+
+test('the core still exports the two things the probe reads', () => {
+  // laneGeneratedPaths reads them BY NAME off a module it resolves at runtime, so a rename in the
+  // core degrades it silently to the empty set — the pre-fix wedge, back again and invisible.
+  // This is the cross-file contract, pinned here the way GO_LIVE_REQUIRED is.
+  const up = require('../scripts/gds/upgrade.js');
+  const mat = require('../scripts/gds/claude-materialize.js');
+  assert.equal(typeof up.API_ARTIFACT_FILES, 'object', 'upgrade.js no longer exports API_ARTIFACT_FILES');
+  assert.ok(Object.values(up.API_ARTIFACT_FILES).flat().includes('docs/api/openapi.json'));
+  assert.equal(typeof mat.materializeWillRewrite, 'function', 'claude-materialize.js no longer exports materializeWillRewrite');
+});
+
+test('pinState sorts the lane\'s own output into its own bucket, and nothing else with it', () => {
+  const g = fakeGit({ dirty: ['package.json', '.claude/settings.json', 'config/branding.json'] });
+  const st = S.pinState('/srv/demo', g.run, ['.claude/settings.json']);
+  assert.deepEqual(st.pin.map((e) => e.file), ['package.json']);
+  assert.deepEqual(st.generated.map((e) => e.file), ['.claude/settings.json']);
+  assert.deepEqual(st.other.map((e) => e.file), ['config/branding.json'], 'an owner edit is still a human\'s work');
+});
+
+test('pinState called with no generated set behaves exactly as it always did', () => {
+  // Every pre-existing caller passes two arguments; the third bucket must be opt-in.
+  const g = fakeGit({ dirty: ['package.json', '.claude/settings.json'] });
+  const st = S.pinState('/srv/demo', g.run);
+  assert.deepEqual(st.generated, []);
+  assert.deepEqual(st.other.map((e) => e.file), ['.claude/settings.json']);
+});
+
+test('healDecision: leave-dirty finally reaches by-design, because the dirt is the lane\'s own', () => {
+  const pre = S.pinState('/srv/demo', fakeGit({ dirty: ['package.json', '.claude/settings.json'] }).run, ['.claude/settings.json']);
+  assert.deepEqual(S.healDecision(pre, 'leave-dirty'), { action: 'by-design' });
+  assert.deepEqual(S.healDecision(pre, 'local-commit'), { action: 'commit', push: false });
+  assert.deepEqual(S.healDecision(pre, 'push'), { action: 'commit', push: true });
+});
+
+test('healDecision: an owner\'s edit still halts EVERY mode, leave-dirty included', () => {
+  // leave-dirty licenses the LANE's dirt, not a stranger's. That is why the order inside
+  // healDecision stays dirt-before-mode rather than being flipped.
+  const pre = S.pinState('/srv/demo', fakeGit({ dirty: ['package.json', '.claude/settings.json', 'src/thing.js'] }).run, ['.claude/settings.json']);
+  for (const mode of S.PIN_MODES) assert.deepEqual(S.healDecision(pre, mode), { action: 'halt' }, `mode ${mode}`);
+});
+
+test('preflightFlagsFor: only leave-dirty gets --force, and it gets nothing else', () => {
+  assert.deepEqual(S.preflightFlagsFor('leave-dirty'), ['--force']);
+  assert.deepEqual(S.preflightFlagsFor('local-commit'), []);
+  assert.deepEqual(S.preflightFlagsFor('push'), []);
+  assert.deepEqual(S.preflightFlagsFor(undefined), []);
+});
+
+test('preflightFlagsFor has the precedent it claims — go-live.js really does send --force', () => {
+  const body = readFileSync(path.join(ROOT, 'scripts', 'gds', 'go-live.js'), 'utf8')
+    .split('function upgradeCommand(')[1].split('\n}')[0];
+  assert.match(body, /'--force'/, 'go-live upgradeCommand() no longer sends --force — re-derive preflightFlagsFor from it');
+});
+
+test('the direct-upgrade fallback asks preflightFlagsFor rather than deciding inline', () => {
+  const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
+  assert.match(src, /upArgs\.push\(\.\.\.preflightFlagsFor\(pinMode\)\)/,
+    'the clean-tree policy is a pin-mode decision and must go through the named function');
+});
+
+test('every commitPin call site in the lane also decides what the upgrade generated', () => {
+  // The sibling of the push assertion in section 8, and for the same reason: a site that inherits
+  // the `generated = []` default silently reverts to the two-bucket guard that wedged the lane.
+  const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
+  const calls = [];
+  const re = /commitPin\(\{/g;
+  let m;
+  while ((m = re.exec(src)) !== null) {
+    if (src.slice(Math.max(0, m.index - 9), m.index) === 'function ') continue;
+    let depth = 0, end = m.index;
+    for (let i = src.indexOf('{', m.index); i < src.length; i++) {
+      if (src[i] === '{') depth++;
+      else if (src[i] === '}' && --depth === 0) { end = i + 1; break; }
+    }
+    calls.push(src.slice(m.index, end));
+  }
+  assert.ok(calls.length >= 3, `expected the three known pin-writing call sites, found ${calls.length}`);
+  for (const c of calls) assert.match(c, /generated(: generatedAfter)?,/, `a commitPin call site does not pass the generated set:\n${c}`);
+});
+
+// ---------------------------------------------------------------------------
+// 11. real git — the wedge, and the un-wedge
+//
+// The cases above pin each decision on its own; these drive the same three functions
+// against a real repository, because the failure was never inside one decision. It was
+// that all three agreed on a sorting which did not describe what an upgrade leaves
+// behind — and a hand-written `git status` cannot show that.
+// ---------------------------------------------------------------------------
+
+function realGit(dir, ...args) { return spawnSync('git', ['-C', dir, ...args], { encoding: 'utf8' }); }
+function put(dir, rel, body) {
+  const p = path.join(dir, rel);
+  mkdirSync(path.dirname(p), { recursive: true });
+  writeFileSync(p, body);
+}
+
+// A provisioned co-tenant mid-lane: scaffolded + committed, then ONE upgrade applied that moved
+// the pin, re-materialized `.claude/` and regenerated the API artifacts — committing none of it,
+// which is exactly what pinMode leave-dirty asks for.
+function coTenantAfterOneUpgrade() {
+  const dir = mkdtempSync(path.join(tmpdir(), 'lane-cotenant-'));
+  realGit(dir, 'init', '-q');
+  realGit(dir, 'config', 'user.email', 'lane-test@example.invalid');
+  realGit(dir, 'config', 'user.name', 'lane test');
+  realGit(dir, 'config', 'core.autocrlf', 'false');
+  put(dir, 'package.json', JSON.stringify({ dependencies: { '@bongos/core': '1.19.737' } }));
+  put(dir, 'package-lock.json', 'lock 1.19.737\n');
+  put(dir, '.claude/settings.json', '{"from":"1.19.737"}\n');
+  put(dir, '.claude/skills/builder-ship/SKILL.md', '# builder-ship (1.19.737)\n');
+  put(dir, 'docs/api/openapi.json', '{"core":"1.19.737"}\n');
+  put(dir, 'config/branding.json', '{"identity":{}}\n');
+  realGit(dir, 'add', '-A');
+  realGit(dir, 'commit', '-q', '-m', 'scaffold');
+  // …then one upgrade, with nothing committed after it.
+  put(dir, 'package.json', JSON.stringify({ dependencies: { '@bongos/core': '1.19.785' } }));
+  put(dir, 'package-lock.json', 'lock 1.19.785\n');
+  put(dir, '.claude/settings.json', '{"from":"1.19.785"}\n');
+  put(dir, '.claude/skills/builder-ship/SKILL.md', '# builder-ship (1.19.785)\n');
+  put(dir, '.claude/skills/new-in-785/SKILL.md', '# a skill this core added\n'); // untracked
+  put(dir, 'docs/api/openapi.json', '{"core":"1.19.785"}\n');
+  return dir;
+}
+
+// What laneGeneratedPaths answers for that upgrade.
+const GENERATED = [
+  '.claude/settings.json', '.claude/skills/builder-ship/SKILL.md',
+  '.claude/skills/new-in-785/SKILL.md', 'docs/api/openapi.json',
+];
+
+test('real git: the WEDGE — under the old two-way sorting every mode halts, leave-dirty included', () => {
+  const dir = coTenantAfterOneUpgrade();
+  const pre = S.pinState(dir, spawnSync); // no generated set = the pre-fix behaviour
+  assert.ok(pre.other.length, 'the upgrade\'s own output landed in the human-work bucket');
+  for (const mode of S.PIN_MODES) {
+    assert.deepEqual(S.healDecision(pre, mode), { action: 'halt' }, `mode ${mode} halted here, every sweep, forever`);
+  }
+});
+
+test('real git: the UN-WEDGE — leave-dirty takes a second sweep with no human hands', () => {
+  const dir = coTenantAfterOneUpgrade();
+  const pre = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(pre.other, [], 'nothing dirty here is a human\'s work');
+  assert.deepEqual(S.healDecision(pre, 'leave-dirty'), { action: 'by-design' });
+  // …and the sweep then hands upgrade.js the flag that lets the bump past its own clean-tree
+  // pre-flight, which the deliberately-dirty pin would otherwise refuse.
+  assert.deepEqual(S.preflightFlagsFor('leave-dirty'), ['--force']);
+});
+
+test('real git: local-commit heals the lane\'s own leftovers, tracked and untracked', () => {
+  const dir = coTenantAfterOneUpgrade();
+  const pre = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(S.healDecision(pre, 'local-commit'), { action: 'commit', push: false });
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.ok, true, r.reason);
+  assert.equal(r.action, 'committed-local');
+  assert.equal(realGit(dir, 'status', '--porcelain').stdout, '', 'the next sweep finds a clean tree');
+  const committed = realGit(dir, 'show', '--name-only', '--format=', 'HEAD').stdout;
+  for (const f of ['package.json', 'package-lock.json', ...GENERATED]) {
+    assert.ok(committed.includes(f), `${f} rode the pin commit`);
+  }
+});
+
+test('real git: an OWNER\'s edit is still never swept into the lane\'s commit', () => {
+  const dir = coTenantAfterOneUpgrade();
+  put(dir, 'config/branding.json', '{"the owner":"was here"}\n');          // tracked
+  put(dir, '.claude/skills/my-own-skill/SKILL.md', 'hand-written\n');      // untracked
+  const st = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(st.other.map((e) => e.file).sort(), ['.claude/skills/my-own-skill/SKILL.md', 'config/branding.json']);
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.ok, false);
+  assert.equal(r.action, 'refused');
+  assert.equal(realGit(dir, 'rev-list', '--count', 'HEAD').stdout.trim(), '1', 'nothing was committed at all');
+  assert.match(realGit(dir, 'status', '--porcelain').stdout, /config\/branding\.json/, 'and the edit is still theirs');
+});
+
+test('real git: a tree holding ONLY the lane\'s own output still commits — the pin need not be dirty', () => {
+  // The shape a rollback leaves behind: the pin restored to what is committed, the regenerated
+  // artifacts not. Answering `already-clean` here would strand them and wedge the next sweep.
+  const dir = coTenantAfterOneUpgrade();
+  realGit(dir, 'checkout', '--', 'package.json', 'package-lock.json');
+  const st = S.pinState(dir, spawnSync, GENERATED);
+  assert.deepEqual(st.pin, []);
+  assert.ok(st.generated.length);
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.ok, true, r.reason);
+  assert.equal(r.committed, true);
+  assert.equal(realGit(dir, 'status', '--porcelain').stdout, '');
+});
+
+test('real git: a genuinely clean tree is still a no-op', () => {
+  const dir = coTenantAfterOneUpgrade();
+  realGit(dir, 'add', '-A'); realGit(dir, 'commit', '-q', '-m', 'by hand');
+  const r = S.commitPin({ dir, message: 'heal', push: false, generated: GENERATED }, spawnSync, () => {});
+  assert.equal(r.action, 'already-clean');
+  assert.equal(r.committed, undefined);
+});
+
+test('the post-upgrade net re-probes, rather than reusing the set from before the bump', () => {
+  // A skill the NEW core adds is absent from the pre-upgrade answer, so reusing it would drop that
+  // file into `other` and wedge the lane one release later — this defect again, wearing the next
+  // version number. The heal, which runs BEFORE the bump, must keep using the pre-bump set.
+  const src = readFileSync(path.join(ROOT, '.claude', 'scheduled-tasks', 'core-update-subscription', 'subscribe.js'), 'utf8');
+  const afterSpawn = src.split('const generatedAfter = laneGeneratedPaths(inst.dir);')[1];
+  assert.ok(afterSpawn, 'the post-upgrade re-probe is gone');
+  assert.equal((afterSpawn.match(/generated: generatedAfter,/g) || []).length, 2,
+    'both post-upgrade commitPin sites (the rollback tidy and the durability net) must use the re-probed set');
+  assert.match(afterSpawn, /pinState\(inst\.dir, spawnSync, generatedAfter\)/);
+  const beforeSpawn = src.split('const generatedAfter = laneGeneratedPaths(inst.dir);')[0];
+  assert.match(beforeSpawn, /const pre = pinState\(inst\.dir, spawnSync, generated\);/,
+    'the heal runs before the bump, so it reads the core installed THEN');
+});

package/tests/visual_review.mjs

@@ -75,6 +75,7 @@ await test('a task that names a page file in its description is told to use /des
   assert.match(lines.join('\n'), /\/design/);
   assert.match(lines.join('\n'), /review-sheet\.js/);
   assert.match(lines.join('\n'), /OK/);
+  assert.match(lines.join('\n'), /\/ship-check renders the pages you changed/, 'the automatic fit check is named (task 1004203)');
 });
 
 await test('touches[], a UI module label, and the artist craft nudge too — the same predicate the review uses', () => {

package/tests/work_title_wrap.mjs

@@ -0,0 +1,38 @@
+// tests/work_title_wrap.mjs — a Work board title wraps inside its column (task 1004209).
+//
+// At 390 the backlog title "Watch redesign: … People/Operations/Security tabs" ran
+// 44px past its column: a slash-joined run offers the browser no break point. The
+// rendered check (scripts/gds/render-check.js) is what measures it; this pins the
+// two halves of the fix in source so neither is dropped by an unrelated edit.
+//
+// Run:  node tests/work_title_wrap.mjs
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { makeRunner } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8');
+const WORK_SRC = read('modules/hall-ui/public/work.js');
+const WORK_CSS = read('modules/hall-ui/public/work.css');
+
+const { test, summary } = makeRunner();
+
+await test('every history title breaks after a slash, and only after escaping', () => {
+  const sites = WORK_SRC.match(/<span class="history__title">[^\n]*/g) || [];
+  assert.equal(sites.length, 2, 'the backlog and completed rows both render a history title');
+  for (const s of sites) {
+    assert.ok(s.includes("escapeHtml(t.title || '(untitled)').replace(/\\//g, '/<wbr>')"),
+      `the <wbr> goes in AFTER escapeHtml, so a title cannot inject markup: ${s.trim()}`);
+  }
+});
+
+await test('the break-anything backstop stays on .history__title', () => {
+  const rule = WORK_CSS.match(/^\.history__title \{[^}]*\}/m);
+  assert.ok(rule, '.history__title rule present');
+  assert.match(rule[0], /overflow-wrap:\s*anywhere/, 'a run with no slash still wraps instead of running out of the column');
+  assert.match(rule[0], /min-width:\s*0/, 'a flex item needs min-width: 0 to shrink below its longest word');
+});
+
+summary();