@bongos/core 1.20.35 → 1.20.37

package/tests/deploy_page_projects.mjs

@@ -517,7 +517,7 @@ test('the runner’s shell output is folded behind a disclosure, never the headl
   }) });
   await b.settle();
   const html = b.panel();
-  assert.match(html, /<details class="dp-settled__detail"><summary>What the upgrade said<\/summary>/, 'folded');
+  assert.match(html, /<details class="dp-settled__detail"><summary>Technical detail — what the upgrade said<\/summary>/, 'folded');
   assert.match(html, /working tree not clean/, 'and the words are still all there');
   assert.ok(html.indexOf('did not land') < html.indexOf('<details'), 'the plain sentence comes first');
 });
@@ -645,3 +645,167 @@ test('the reconnect link returns to the page\u2019s full https address when ther
   await b.settle();
   assert.ok(b.panel().includes(`return=${encodeURIComponent(here)}`), b.panel());
 });
+
+// ── why a move stopped, by kind; the update rule; waiting is not moving (task 1004450) ──
+
+// A body built inside the vm is another realm's object; compare its data, not its prototype.
+const plain = (o) => JSON.parse(JSON.stringify(o));
+const soon = (mins) => new Date(Date.now() + mins * 60000).toISOString();
+const failedAs = (cls, reason, over = {}) => ({
+  target_version: '1.19.871', state: 'error', at: new Date().toISOString(), error: 'raw runner words', superseded: false,
+  failure: { class: cls, reason }, ...over,
+});
+const waitingIntent = (cls, reason, mins = 60) => ({
+  action: 'core-upgrade', state: 'pending', target_version: '1.19.871', not_before: soon(mins),
+  last_error: 'x', failure: cls ? { class: cls, reason } : null,
+});
+
+test('a move waiting out a temporary failure says WHEN it tries again, and offers to try now', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { open_intent: waitingIntent('transient', 'not_published') }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /dp-settled--waiting/);
+  assert.match(html, /Waiting to try core 1\.19\.871 again at .*in about 60 min/);
+  assert.match(html, /not published yet/, 'the reason, in plain words');
+  assert.match(html, /usually temporary/);
+  assert.doesNotMatch(html, /is pending for this box/, 'not the generic busy line');
+  b.els.get('dp-retry-1')._on.click();
+  await b.settle();
+  const post = b.posts.find((p) => /core-upgrade$/.test(p.path));
+  assert.deepEqual(post && plain(post.body), { to: '1.19.871' }, 'Try now asks for the SAME move');
+});
+
+test('a known snag the runner just fixed says what it did, and that it tries once more', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { open_intent: waitingIntent('known_wedge', 'dirty_tree', 2) }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /A known snag stopped the move/);
+  assert.match(html, /unsaved file changes/);
+  assert.match(html, /saved those changes on its own/);
+  assert.match(html, /tries the move once more/);
+});
+
+test('a pending move with a PAST not_before is still a move under way, not a wait', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { open_intent: waitingIntent('transient', 'not_published', -5) }) });
+  await b.settle();
+  assert.doesNotMatch(b.panel(), /dp-settled--waiting/);
+  assert.match(b.panel(), /is pending for this box/);
+});
+
+test('a move that falls into a WAIT stops the poll at once, with no "still working" toast', async () => {
+  const b = boot({
+    scope: 'hoodify-finance', moveTries: 50,
+    instanceOver: (inst, n) => (n >= 2 ? { open_intent: waitingIntent('transient', 'registry_unreadable') } : {}),
+  });
+  await b.settle();
+  b.els.get('dp-preview-32')._on.click();
+  b.els.get('dp-confirm-32')._on.click();
+  for (let i = 0; i < 4; i++) await b.settle();
+  assert.match(b.panel(), /dp-settled--waiting/, 'the row shows the wait');
+  assert.doesNotMatch(b.panel(), /dp-moving/, 'and is no longer painted as moving');
+  assert.ok(!b.toasts.some((t) => /Still working/.test(t)), `no false "still working": ${b.toasts}`);
+  assert.ok(b.reads.get('32') < 10, `the poll stopped early (read ${b.reads.get('32')} times, bound 50)`);
+});
+
+test('a refusal by the update rule offers ONE click: allow new releases, then move', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { update_channel: 'patch', last_move: failedAs('needs_decision', 'outside_channel', { target_version: '1.20.1' }) }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /dp-settled--decision/);
+  assert.match(html, /Your call/);
+  assert.match(html, /outside this project’s update rule/);
+  assert.match(html, /Allow new releases and move to 1\.20\.1/);
+  b.els.get('dp-allow-1')._on.click();
+  await b.settle();
+  const paths = b.posts.map((p) => p.path);
+  const rule = paths.indexOf('/provisioning/instances/1/update-channel');
+  const mv = paths.indexOf('/provisioning/instances/1/core-upgrade');
+  assert.ok(rule >= 0 && mv > rule, `the rule changes FIRST, then the move is queued: ${paths}`);
+  assert.deepEqual(plain(b.posts[rule].body), { channel: 'minor' });
+  assert.deepEqual(plain(b.posts[mv].body), { to: '1.20.1' });
+});
+
+test('under the widest rule already, the refusal offers no allow button', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { update_channel: 'minor', last_move: failedAs('needs_decision', 'outside_channel') }) });
+  await b.settle();
+  assert.doesNotMatch(b.panel(), /dp-allow-1/);
+});
+
+test('the other decisions say what the owner can do, with no button that cannot help', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('needs_decision', 'artist_gate') }) });
+  await b.settle();
+  assert.match(b.panel(), /Approve the artist review/);
+  assert.doesNotMatch(b.panel(), /dp-allow-1/);
+});
+
+test('a failure nothing automatic can fix points at the blocker filed for it', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('unknown', 'health') }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /nothing automatic can fix it/);
+  assert.match(html, /did not answer after restarting/);
+  assert.match(html, /href="\/blockers"/);
+  assert.match(html, /<details class="dp-settled__detail">/, 'the runner’s words are still one click away');
+});
+
+test('a failed ROLLBACK says the project may be down', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('unknown', 'rollback_failed') }) });
+  await b.settle();
+  assert.match(b.panel(), /may be down/);
+  assert.match(b.panel(), /href="\/blockers"/);
+});
+
+test('a temporary failure that ran out of retries offers to try again — only for the move on offer', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('transient', 'npm_install') }) });
+  await b.settle();
+  assert.match(b.panel(), /kept stopping/);
+  assert.match(b.panel(), /dp-again-1/);
+  const other = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('transient', 'npm_install', { target_version: '1.19.850' }) }) });
+  await other.settle();
+  assert.doesNotMatch(other.panel(), /dp-again-1/, 'a try-again for a version no longer on offer would be a different move');
+});
+
+test('the update rule is shown in words and can be changed from the page', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { update_channel: 'patch' }) });
+  await b.settle();
+  const html = b.panel();
+  assert.match(html, /Update rule: Fixes only/);
+  assert.match(html, /<option value="patch" selected>/);
+  b.els.set('dp-rule-sel-1', { value: 'minor' });
+  b.els.get('dp-rule-save-1')._on.click();
+  await b.settle();
+  const post = b.posts.find((p) => /update-channel$/.test(p.path));
+  assert.deepEqual(post && plain(post.body), { channel: 'minor' });
+  assert.ok(b.toasts.length, 'the server’s sentence is shown');
+});
+
+test('a preview with no rule reading shows no rule control, rather than a guessed one', async () => {
+  const b = boot();
+  await b.settle();
+  assert.doesNotMatch(b.panel(), /Update rule/);
+});
+
+test('every reason the runner can give has owner words on this page — none falls to the fallback', async () => {
+  // upgrade-outcome.js's REASON_CLASS is the vocabulary; a reason added there with no
+  // sentence here would reach the owner as "no words for this yet".
+  const { createRequire } = await import('node:module');
+  const req = createRequire(import.meta.url);
+  const vocab = Object.keys(req(path.join(ROOT, 'scripts/gds/upgrade-outcome.js')).REASON_CLASS || {});
+  assert.ok(vocab.length > 20, 'the vocabulary was read');
+  const block = SRC.slice(SRC.indexOf('const REASON_WORDS = {'), SRC.indexOf('const reasonWords'));
+  const missing = vocab.filter((k) => !new RegExp(`\\b${k}:`).test(block));
+  assert.deepEqual(missing, [], `reasons with no owner words: ${missing}`);
+});
+
+test('a module that is not ready says what the owner can do about it', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('needs_decision', 'module_incompatible') }) });
+  await b.settle();
+  assert.match(b.panel(), /Turn that module off/);
+});
+
+test('a known snag it could not fix names the next step, and does NOT point at a blocker that was never filed', async () => {
+  const b = boot({ controlPlane: preview('1', 'cloudbongos', { last_move: failedAs('known_wedge', 'disk_full') }) });
+  await b.settle();
+  assert.match(b.panel(), /whoever runs that machine clears the snag/);
+  assert.doesNotMatch(b.panel(), /href="\/blockers"/, 'move-escalation files no blocker for this class');
+});

package/tests/module_assess_tests.mjs

@@ -0,0 +1,232 @@
+// tests/module_assess_tests.mjs — the Tests assessment signal (task 1003791, ADR 0343).
+// No database: the module's tests really run (real node child processes, from a REAL
+// packed tarball verified by module-artifact.js), and the signal row goes to a fake
+// pg client, so what is pinned is the outcome vocabulary core_265 stores:
+//   no tests      -> no_data, never a fail
+//   tests ran     -> scored, round(100 x passing files / files), sample_size = files
+//   unreadable    -> not_scored
+// plus the two safety properties: the sandbox is always removed, and a module's test
+// process never inherits the parent's credentials. And it runs regardless of whether
+// the module is enabled — nothing here consults isModuleEnabled.
+//
+// Run:  node tests/module_assess_tests.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const { discoverTestFiles, assessTests, recordTestsSignal, insertSignal, runRefusal, testEnv, SANDBOX_PREFIX } = require('../scripts/gds/module-assess-tests.js');
+const { packModule, verifyModuleArtifact } = require('../scripts/gds/module-artifact.js');
+const { relativeArtifactPath } = require('../src/bongos/module-store.js');
+
+const PASS = "import assert from 'node:assert'; assert.equal(1 + 1, 2); console.log('1 passed, 0 failed');\n";
+const FAIL = "import assert from 'node:assert'; assert.equal(1 + 1, 3);\n";
+const file = (p, text) => ({ path: p, buf: Buffer.from(text) });
+const tmpRoot = () => fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-root-'));
+const sandboxesIn = (root) => fs.readdirSync(root).filter((n) => n.startsWith(SANDBOX_PREFIX));
+
+test('only tests/*.mjs at the top of tests/ count, as in the unit gate', () => {
+  assert.deepEqual(
+    discoverTestFiles(['module.json', 'tests/b.mjs', 'tests/a.mjs', 'tests/fixtures/x.mjs', 'tests/helper.js', 'lib/tests/c.mjs']),
+    ['tests/a.mjs', 'tests/b.mjs']);
+});
+
+test('a module that declares no tests is no_data, not a fail', async () => {
+  const root = tmpRoot();
+  const s = await assessTests('weather', [file('module.json', '{}'), file('index.js', '')], { trusted: true, root });
+  assert.equal(s.outcome, 'no_data');
+  assert.equal(s.score, null, 'no_data carries no number (core_265: score exactly when scored)');
+  assert.equal(s.sample_size, 0);
+  assert.match(s.reason, /declares no tests/);
+  assert.deepEqual(sandboxesIn(root), [], 'nothing is unpacked when there is nothing to run');
+});
+
+test('all passing scores 100; one of two failing scores 50', async () => {
+  const root = tmpRoot();
+  const all = await assessTests('weather', [file('tests/a.mjs', PASS), file('tests/b.mjs', PASS)], { trusted: true, root });
+  assert.equal(all.outcome, 'scored');
+  assert.equal(all.score, 100);
+  assert.equal(all.sample_size, 2);
+
+  const half = await assessTests('weather', [file('tests/a.mjs', PASS), file('tests/b.mjs', FAIL)], { trusted: true, root });
+  assert.equal(half.outcome, 'scored');
+  assert.equal(half.score, 50);
+  assert.equal(half.sample_size, 2);
+  assert.match(half.reason, /1 of 2/);
+  const failed = half.detail.files.find((f) => f.file === 'tests/b.mjs');
+  assert.equal(failed.passed, false);
+  assert.match(failed.tail, /AssertionError|assert/i, 'a failing file keeps a bounded tail of why');
+  assert.deepEqual(sandboxesIn(root), [], 'the sandbox is removed after every run');
+});
+
+test('every failing still scores 0 — distinct from no_data', async () => {
+  const s = await assessTests('weather', [file('tests/a.mjs', FAIL)], { trusted: true, root: tmpRoot() });
+  assert.equal(s.outcome, 'scored');
+  assert.equal(s.score, 0);
+});
+
+test('a module test reaches its own files by relative path, at the modules/<key>/ depth', async () => {
+  const s = await assessTests('weather', [
+    file('lib/add.js', 'module.exports = (a, b) => a + b;\n'),
+    file('tests/a.mjs', "import { createRequire } from 'node:module'; import assert from 'node:assert';\nconst add = createRequire(import.meta.url)('../lib/add.js'); assert.equal(add(2, 2), 4);\n"),
+  ], { trusted: true, root: tmpRoot() });
+  assert.equal(s.score, 100, JSON.stringify(s.detail));
+});
+
+test('a module test process never inherits the parent\'s credentials', async () => {
+  process.env.DATABASE_URL = 'postgres://secret@host/db';
+  process.env.BONGOS_TOKEN = 'secret-token';
+  try {
+    const s = await assessTests('weather', [file('tests/env.mjs',
+      "import assert from 'node:assert'; assert.equal(process.env.DATABASE_URL, undefined); assert.equal(process.env.BONGOS_TOKEN, undefined); assert.equal(process.env.NODE_ENV, 'test');\n")],
+      { trusted: true, root: tmpRoot() });
+    assert.equal(s.score, 100, JSON.stringify(s.detail));
+  } finally {
+    delete process.env.DATABASE_URL;
+    delete process.env.BONGOS_TOKEN;
+  }
+});
+
+test('a hung test file is killed at the timeout and counted as failed', async () => {
+  const s = await assessTests('weather', [file('tests/hang.mjs', 'setInterval(() => {}, 1000);\n'), file('tests/ok.mjs', PASS)],
+    { trusted: true, root: tmpRoot(), timeoutMs: 1500 });
+  assert.equal(s.score, 50);
+  assert.equal(s.detail.files.find((f) => f.file === 'tests/hang.mjs').timed_out, true);
+});
+
+// ---- recordTestsSignal: tarball in, one appended row out ----
+
+const SANDBOX_ENV = { MODULE_TEST_SANDBOX: '1', PATH: process.env.PATH, SystemRoot: process.env.SystemRoot };
+
+test('outside the separate testing environment, a published module is never run', async () => {
+  let ran = false;
+  const db = { async query() { ran = true; return { rows: [] }; } };
+  for (const env of [{}, { MODULE_TEST_SANDBOX: 'true' }, { MODULE_TEST_SANDBOX: '0' }]) {
+    const res = await recordTestsSignal(42, { db, env, root: tmpRoot() });
+    assert.equal(res.ok, false);
+    assert.equal(res.code, 'not_in_test_sandbox');
+  }
+  assert.equal(ran, false, 'refused before reading the store or the tarball');
+});
+
+test('the test environment keeps no credential and pins HOME to the sandbox', () => {
+  process.env.SOME_API_KEY = 'x';
+  try {
+    const env = testEnv('/sb');
+    assert.equal(env.SOME_API_KEY, undefined);
+    assert.equal(env.HOME, '/sb');
+    assert.equal(env.NODE_ENV, 'test');
+  } finally { delete process.env.SOME_API_KEY; }
+});
+
+function fakeDb(versionRow) {
+  const inserts = [];
+  return {
+    inserts,
+    async query(sql, params) {
+      if (/FROM store_module_versions/.test(sql)) return { rows: versionRow ? [versionRow] : [] };
+      if (/INSERT INTO module_assessment_signals/.test(sql)) {
+        assert.doesNotMatch(sql, /UPDATE/i, 'append-only');
+        inserts.push(params);
+        const [version_id, outcome, score, sample_size, reason] = params;
+        return { rows: [{ id: 7, version_id, part: 'tests', outcome, score, sample_size, reason, measured_at: new Date() }] };
+      }
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+}
+
+function publishedFixture(extraFiles) {
+  const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-src-'));
+  const dir = path.join(src, 'weather');
+  fs.mkdirSync(path.join(dir, 'tests'), { recursive: true });
+  fs.writeFileSync(path.join(dir, 'module.json'), JSON.stringify({ key: 'weather', title: 'Weather', description: 'x', version: '1.2.0', coreVersion: '^1.0.0', contributes: {} }));
+  for (const [p, text] of Object.entries(extraFiles)) fs.writeFileSync(path.join(dir, ...p.split('/')), text);
+  const { tgz } = packModule('weather', { modulesDir: src, now: () => new Date('2026-09-30T00:00:00Z'), modeOf: () => '644' });
+  const storeDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-store-'));
+  const final = path.join(storeDir, 'weather', 'weather-1.2.0.tgz');
+  fs.mkdirSync(path.dirname(final), { recursive: true });
+  fs.writeFileSync(final, tgz);
+  return { storeDir, final, row: { id: 42, module_key: 'weather', version: '1.2.0', artifact_path: relativeArtifactPath(final, { dir: storeDir }) } };
+}
+
+test('a published version is tested from its tarball and one tests row is appended', async () => {
+  const { storeDir, row } = publishedFixture({ 'tests/a.mjs': PASS, 'tests/b.mjs': FAIL });
+  const db = fakeDb(row);
+  const res = await recordTestsSignal(42, { db, storeDir, root: tmpRoot(), env: SANDBOX_ENV });
+  assert.equal(res.ok, true);
+  assert.equal(db.inserts.length, 1);
+  const [versionId, outcome, score, sample, , detail] = db.inserts[0];
+  assert.equal(versionId, 42);
+  assert.equal(outcome, 'scored');
+  assert.equal(score, 50);
+  assert.equal(sample, 2);
+  assert.equal(JSON.parse(detail).files.length, 2);
+});
+
+test('a version whose tarball is missing or tampered is not_scored, not failed', async () => {
+  const { storeDir, final, row } = publishedFixture({ 'tests/a.mjs': PASS });
+  fs.writeFileSync(final, Buffer.from('not a tarball'));
+  const db = fakeDb(row);
+  const res = await recordTestsSignal(42, { db, storeDir, root: tmpRoot(), env: SANDBOX_ENV });
+  assert.equal(res.ok, true);
+  const [, outcome, score] = db.inserts[0];
+  assert.equal(outcome, 'not_scored');
+  assert.equal(score, null);
+
+  fs.rmSync(final);
+  const db2 = fakeDb(row);
+  await recordTestsSignal(42, { db: db2, storeDir, root: tmpRoot(), env: SANDBOX_ENV });
+  assert.equal(db2.inserts[0][1], 'not_scored');
+  assert.doesNotMatch(db2.inserts[0][4], /[\/]/, 'the stored reason carries an error code, never a local path');
+});
+
+test('an unknown version writes nothing', async () => {
+  const db = fakeDb(null);
+  const res = await recordTestsSignal(99, { db, root: tmpRoot(), env: SANDBOX_ENV });
+  assert.equal(res.ok, false);
+  assert.equal(res.code, 'version_not_found');
+  assert.equal(db.inserts.length, 0);
+});
+
+test('the runner never consults whether the module is enabled', () => {
+  const src = fs.readFileSync(new URL('../scripts/gds/module-assess-tests.js', import.meta.url), 'utf8').replace(/\/\/.*$/gm, '');
+  assert.doesNotMatch(src, /isModuleEnabled/);
+});
+
+test('the sandbox dir is gitignored in case a run is killed mid-way', () => {
+  const gi = fs.readFileSync(new URL('../.gitignore', import.meta.url), 'utf8');
+  assert.match(gi, /^\/\.module-assess-\*\/$/m);
+});
+
+test('the gate lives in the runner itself: assessTests refuses untrusted code outside the testing environment', async () => {
+  const root = tmpRoot();
+  await assert.rejects(assessTests('weather', [file('tests/a.mjs', PASS)], { root, env: {} }), { code: 'not_in_test_sandbox' });
+  assert.deepEqual(sandboxesIn(root), [], 'refused before anything is unpacked');
+});
+
+test('a mis-set flag on a machine that holds secrets is still refused', async () => {
+  const root = tmpRoot();
+  for (const k of ['DATABASE_URL', 'BONGOS_TOKEN', 'STRIPE_SECRET', 'OPENAI_API_KEY']) {
+    assert.equal(runRefusal({ env: { ...SANDBOX_ENV, [k]: 'x' }, root }).code, 'secrets_present', k);
+  }
+  assert.equal(runRefusal({ env: SANDBOX_ENV, root }), null, 'a clean testing environment may run');
+  fs.writeFileSync(path.join(root, '.env'), 'DATABASE_URL=x\n');
+  assert.equal(runRefusal({ env: SANDBOX_ENV, root }).code, 'secrets_present', 'a .env at the core root counts');
+  await assert.rejects(assessTests('weather', [file('tests/a.mjs', PASS)], { root, env: SANDBOX_ENV }), { code: 'secrets_present' });
+  assert.equal(runRefusal({ trusted: true, env: {}, root }), null, 'your own checkout (--dir) is trusted');
+});
+
+test('insertSignal appends exactly one tests row with the signal fields', async () => {
+  const seen = [];
+  const db = { async query(sql, params) { seen.push({ sql, params }); return { rows: [{ id: 1 }] }; } };
+  await insertSignal(5, { outcome: 'scored', score: 80, sample_size: 5, reason: 'r', detail: { files: [] } }, { db });
+  assert.equal(seen.length, 1);
+  assert.match(seen[0].sql, /INSERT INTO module_assessment_signals[\s\S]*'tests'/);
+  assert.doesNotMatch(seen[0].sql, /UPDATE/i);
+  assert.deepEqual(seen[0].params, [5, 'scored', 80, 5, 'r', '{"files":[]}']);
+});