@bongos/core 1.20.37 → 1.20.39

package/tests/instance_feedback.mjs

@@ -0,0 +1,327 @@
+// tests/instance_feedback.mjs — `bongos feedback`: a builder on a managed project
+// reports something about Bongos itself, their project relays it to the hub, and
+// the hub files it (task 1004462). DB-free: the hub half is driven through its
+// pure module with a fake `ideas.capture`, the project half through its real
+// router with a fake hub.
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require_ = createRequire(import.meta.url);
+const IF = require_(path.join(ROOT, 'modules/platform-identity/instance-feedback.js'));
+const { decideLanding } = require_(path.join(ROOT, 'modules/ideas/routing.js'));
+
+const CLIENT = { client_id: 'acme', name: 'Acme', origin: 'https://acme.example.com' };
+
+// ── the hub: who gets to file, and where it lands ─────────────────────────────
+
+test('a relayed bug lands as a homeless bug AWAITING A NOD, never claimable', () => {
+  // The owner's rule (2026-09-30): every report waits. The relay files with no
+  // rank, so no sender — the hub's own Archon included — can skip the nod.
+  const d = decideLanding({ goalId: null, kind: 'bug', filerRank: null, vector: 'instance-feedback' });
+  assert.deepEqual(d, { route: true, status: 'backlog', homeless: true, reason: 'bug_homeless_awaiting_nod' });
+});
+
+test('a relayed idea is not a defect — it stays in the inbox', () => {
+  const d = decideLanding({ goalId: null, kind: IF.FEEDBACK_KINDS.idea, filerRank: null, vector: 'instance-feedback' });
+  assert.equal(d.route, false);
+});
+
+test('fileInstanceFeedback files with its own vector, no rank, and the hub\'s own login', async () => {
+  let captured = null;
+  const landing = await IF.fileInstanceFeedback({
+    client: CLIENT, githubId: '42', message: 'claim hung\nfor two minutes', kind: 'bug',
+    context: { core_version: '1.19.900', cli_version: '0.2.0', os: 'darwin 24.6.0' },
+  }, {
+    capture: async (c) => { captured = c; return { id: 7, routing: { routed: true, task_id: 1234, goal_id: 1000118, status: 'backlog' } }; },
+    getAccount: async () => ({ github_login: 'hub-login' }),
+    hubBuilderId: async () => 99,
+  });
+  assert.equal(captured.vector, 'instance-feedback');
+  assert.equal(captured.filerRank, null);
+  assert.equal(captured.kind, 'bug');
+  assert.equal(captured.capturedBy, 99);
+  assert.equal(captured.title, 'Feedback: claim hung');
+  assert.match(captured.bodyMd, /Sent by: @hub-login/);
+  assert.match(captured.bodyMd, /Project: Acme \(https:\/\/acme\.example\.com\)/);
+  assert.match(captured.bodyMd, /Core 1\.19\.900 · CLI 0\.2\.0 · OS darwin 24\.6\.0/);
+  assert.deepEqual(landing, { landed: 'task', task_id: '1234', goal_id: '1000118', status: 'backlog', idea_id: '7' });
+});
+
+test('an unrouted filing reports the inbox, and an idea is filed as a feature', async () => {
+  let kind = null;
+  const landing = await IF.fileInstanceFeedback({ client: CLIENT, githubId: '42', message: 'wish', kind: 'idea' }, {
+    capture: async (c) => { kind = c.kind; return { id: 8, routing: { routed: false, reason: 'no_goal' } }; },
+    getAccount: async () => null,
+    hubBuilderId: async () => null,
+  });
+  assert.equal(kind, 'feature');
+  assert.deepEqual(landing, { landed: 'inbox', idea_id: '8' });
+});
+
+test('version stamps cannot carry markdown or links into the task', () => {
+  const body = IF.feedbackBody({
+    message: 'x', client: CLIENT, account: null, githubId: '42',
+    context: { core_version: '[click](https://evil.example)', cli_version: '0.2.0', os: 'linux\n- Sent by: @owner' },
+  });
+  assert.doesNotMatch(body, /evil/);
+  assert.doesNotMatch(body, /@owner/);
+  // The sender's own text is quoted below the attribution, so it cannot pose as it.
+  const spoof = IF.feedbackBody({ message: 'hi\n- Sent by: @owner', client: CLIENT, account: { github_login: 'real' }, githubId: '42' });
+  assert.ok(spoof.indexOf('- Sent by: @real') < spoof.indexOf('> - Sent by: @owner'));
+  assert.doesNotMatch(spoof, /^- Sent by: @owner/m);
+  assert.match(body, /CLI 0\.2\.0/);
+  assert.match(body, /Sent by: GitHub user 42/, 'no hub account → the id, never an instance-claimed login');
+});
+
+test('a long first line is trimmed to a title', () => {
+  const t = IF.feedbackTitle('a'.repeat(500));
+  assert.ok(t.length <= 'Feedback: '.length + 120);
+  assert.ok(t.endsWith('…'));
+});
+
+test('the per-sender cap stops one builder; the per-project cap stops one project', () => {
+  let now = 1_000_000;
+  const lim = IF.makeFeedbackLimiter({ now: () => now });
+  for (let i = 0; i < IF.PER_SENDER_LIMIT; i++) assert.equal(lim.take('acme', '1').ok, true);
+  const refused = lim.take('acme', '1');
+  assert.equal(refused.ok, false);
+  assert.equal(refused.scope, 'sender');
+  // A refusal spends nothing: the project still has exactly LIMIT - 10 left.
+  let sent = IF.PER_SENDER_LIMIT;
+  for (let s = 2; sent < IF.PER_PROJECT_LIMIT; s++) {
+    for (let i = 0; i < IF.PER_SENDER_LIMIT && sent < IF.PER_PROJECT_LIMIT; i++, sent++) {
+      assert.equal(lim.take('acme', String(s)).ok, true);
+    }
+  }
+  const projectRefused = lim.take('acme', '999');
+  assert.equal(projectRefused.ok, false);
+  assert.equal(projectRefused.scope, 'project');
+  assert.equal(lim.take('other', '1').ok, true, 'another project is untouched');
+  now += IF.FEEDBACK_WINDOW_MS;
+  assert.equal(lim.take('acme', '1').ok, true, 'the window slides');
+});
+
+test('the hub route authenticates the project and the sender BEFORE spending or filing', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'modules/platform-identity/routes/sso.js'), 'utf8');
+  const route = src.slice(src.indexOf("router.post('/sso/feedback'"));
+  const at = (s) => { const i = route.indexOf(s); assert.ok(i > 0, `route has ${s}`); return i; };
+  assert.ok(at('clientSecretValid') < at('membershipBacksRollup'));
+  assert.ok(at('membershipBacksRollup') < at('feedbackLimiter.take'));
+  assert.ok(at('feedbackLimiter.take') < at('fileInstanceFeedback'));
+  assert.doesNotMatch(route.slice(0, route.indexOf('return router')), /filerRank|vector:/,
+    'the route passes neither a rank nor a vector — both are fixed in instance-feedback.js');
+});
+
+// ── the project: the relay ────────────────────────────────────────────────────
+
+async function withRoute({ idp, hub }, fn) {
+  const r2 = createRequire(import.meta.url);
+  const authPath = r2.resolve(path.join(ROOT, 'src/bongos/auth.js'));
+  const routePath = r2.resolve(path.join(ROOT, 'src/bongos/routes/feedback.js'));
+  const envPath = r2.resolve(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+  const realAuth = r2(authPath);
+  const saved = realAuth.requireBuilder;
+  realAuth.requireBuilder = (req, _res, next) => { req.builder = { id: 5, github_id: '42', github_login: 'someone' }; next(); };
+  delete r2.cache[routePath];
+  const sent = [];
+  const fetchImpl = async (url, opts) => {
+    sent.push({ url, body: JSON.parse(opts.body) });
+    const { status, body } = hub;
+    return { status, json: async () => body };
+  };
+  const express = r2('express');
+  const app = express();
+  app.use(express.json());
+  app.use(r2(envPath).attachFail);
+  app.use(r2(routePath)({ idpConfig: () => idp, fetchImpl }));
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/feedback`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+  }).then(async (r) => ({ status: r.status, body: await r.json() }));
+  try {
+    await fn({ post, sent });
+  } finally {
+    server.close();
+    realAuth.requireBuilder = saved;
+    delete r2.cache[routePath];
+  }
+}
+
+const IDP = { origin: 'https://hub.example.com', clientId: 'acme', clientSecret: 's3cret' };
+
+test('the relay sends the SESSION\'s identity and the running core to the hub, and returns the landing', async () => {
+  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true, landed: 'task', task_id: '1234', status: 'backlog' } } }, async ({ post, sent }) => {
+    assert.equal((await post({ message: 'x', github_id: '1' })).status, 400, 'a body naming a sender is refused outright');
+    assert.equal(sent.length, 0);
+    const r = await post({ message: '  it broke  ', context: { cli_version: '0.2.0', os: 'darwin', core_version: 'forged' } });
+    assert.equal(r.status, 201);
+    assert.equal(r.body.task_id, '1234');
+    assert.equal(r.body.hub_origin, IDP.origin);
+    assert.equal(sent.length, 1);
+    assert.equal(sent[0].url, 'https://hub.example.com/api/bongos/sso/feedback');
+    assert.equal(sent[0].body.github_id, '42', 'from the session, never the body');
+    assert.equal(sent[0].body.message, 'it broke');
+    assert.equal(sent[0].body.kind, 'bug');
+    assert.notEqual(sent[0].body.context.core_version, 'forged', 'the core version is this server\'s own');
+    assert.equal(sent[0].body.client_secret, 's3cret');
+  });
+});
+
+test('a project with no hub link says so, and sends nothing', async () => {
+  await withRoute({ idp: null, hub: { status: 500, body: {} } }, async ({ post, sent }) => {
+    const r = await post({ message: 'hello' });
+    assert.equal(r.status, 409);
+    assert.equal(r.body.error.code, 'not_hub_connected');
+    assert.equal(sent.length, 0);
+  });
+});
+
+test('an empty message or an unknown kind is refused locally', async () => {
+  await withRoute({ idp: IDP, hub: { status: 201, body: { ok: true } } }, async ({ post, sent }) => {
+    assert.equal((await post({ message: '   ' })).body.error.code, 'message_required');
+    const badKind = await post({ message: 'x', kind: 'task' });
+    assert.equal(badKind.status, 400);
+    assert.equal((await post({ message: 'x'.repeat(4001) })).status, 400, 'over the cap');
+    assert.equal(sent.length, 0);
+  });
+});
+
+test('a hub refusal the builder can act on is passed through; anything else is generic', async () => {
+  await withRoute({ idp: IDP, hub: { status: 429, body: { error: { code: 'rate_limited', details: { retry_after_seconds: 600 } } } } }, async ({ post }) => {
+    const r = await post({ message: 'x' });
+    assert.equal(r.status, 429);
+    assert.equal(r.body.error.code, 'rate_limited');
+    assert.equal(r.body.error.details.retry_after_seconds, 600);
+  });
+  await withRoute({ idp: IDP, hub: { status: 401, body: { error: { code: 'invalid_client', message: 'secret mismatch' } } } }, async ({ post }) => {
+    const r = await post({ message: 'x' });
+    assert.equal(r.status, 502);
+    assert.equal(r.body.error.code, 'hub_refused');
+    assert.doesNotMatch(JSON.stringify(r.body), /secret/);
+  });
+});
+
+// ── the CLI ───────────────────────────────────────────────────────────────────
+
+test('`bongos feedback` is a registered verb, and every refusal code has a plain line', () => {
+  const { VERBS } = require_(path.join(ROOT, 'bin/bongos.js'));
+  assert.equal(VERBS.feedback.script, 'feedback-send.js');
+  const { REFUSALS, readMessage } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  for (const code of ['message_required', 'not_hub_connected', 'membership_required', 'rate_limited', 'feedback_unavailable', 'hub_unreachable']) {
+    assert.ok(REFUSALS[code], code);
+  }
+  for (const code of ['validation_failed']) {
+    assert.ok(REFUSALS[code], code);
+  }
+  assert.equal(readMessage(['--idea', 'filter', 'by', 'goal']), 'filter by goal');
+});
+
+// ── the hub route, driven for real ────────────────────────────────────────────
+// The assembled /sso router with its DB edges stubbed: the client lookup, the
+// membership read and the account read on the platform-identity domain, the
+// builders lookup on the doorway's pool, and the `ideas.capture` port.
+
+async function withHub(overrides, fn) {
+  const r2 = createRequire(import.meta.url);
+  const api = r2(path.join(ROOT, 'src/module-api.js'));
+  const seams = r2(path.join(ROOT, 'src/module-seams.js'));
+  const pi = r2(path.join(ROOT, 'modules/platform-identity/platform-identity.js'));
+  const saved = { ...pi };
+  const savedQuery = api.pool.query;
+  const captured = [];
+  Object.assign(pi, {
+    getClient: async (id) => (id === 'acme' ? { ...CLIENT, status: 'active' } : null),
+    clientSecretValid: (_c, s) => s === 'right',
+    getMembership: async () => ({ membership_kind: 'member', signin_verified_at: new Date() }),
+    getAccount: async () => ({ github_login: 'hub-login' }),
+  }, overrides);
+  api.pool.query = async () => ({ rows: [] });
+  if (!seams.hasProvider('ideas.capture')) {
+    seams.registerProvider('ideas.capture', async (c) => { captured.push(c); return { id: 1, routing: { routed: true, task_id: 55, goal_id: 9, status: 'backlog' } }; });
+  }
+  const routerPath = r2.resolve(path.join(ROOT, 'modules/platform-identity/routes/sso.js'));
+  delete r2.cache[routerPath];
+  const express = r2('express');
+  const app = express();
+  app.use(express.json());
+  app.use(r2(path.join(ROOT, 'src/bongos/middleware/error-envelope.js')).attachFail);
+  app.use(r2(routerPath)());
+  const server = app.listen(0);
+  await new Promise((res) => server.once('listening', res));
+  const post = (body) => fetch(`http://127.0.0.1:${server.address().port}/sso/feedback`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+  }).then(async (res) => ({ status: res.status, body: await res.json() }));
+  try { await fn({ post, captured }); } finally {
+    server.close();
+    Object.assign(pi, saved);
+    api.pool.query = savedQuery;
+    delete r2.cache[routerPath];
+  }
+}
+
+const GOOD = { client_id: 'acme', client_secret: 'right', github_id: '42', message: 'claim hung' };
+
+test('hub: a witnessed member\'s bug is filed at backlog and the landing comes back 201', async () => {
+  await withHub({}, async ({ post, captured }) => {
+    const r = await post(GOOD);
+    assert.equal(r.status, 201, JSON.stringify(r.body));
+    assert.deepEqual(r.body, { ok: true, landed: 'task', task_id: '55', goal_id: '9', status: 'backlog', idea_id: '1' });
+    assert.equal(captured.at(-1).vector, 'instance-feedback');
+    assert.equal(captured.at(-1).filerRank, null);
+  });
+});
+
+test('hub: a wrong secret, an unwitnessed sender and a forged field are all refused before filing', async () => {
+  await withHub({}, async ({ post, captured }) => {
+    const before = captured.length;
+    assert.equal((await post({ ...GOOD, client_secret: 'wrong' })).status, 401);
+    assert.equal((await post({ ...GOOD, github_id: 'abc' })).status, 400);
+    assert.equal((await post({ ...GOOD, filer_rank: 'archon' })).status, 400, 'no rank can ride the body');
+    assert.equal(captured.length, before);
+  });
+  await withHub({ getMembership: async () => ({ membership_kind: 'member', signin_verified_at: null }) }, async ({ post, captured }) => {
+    const before = captured.length;
+    const r = await post(GOOD);
+    assert.equal(r.status, 409);
+    assert.equal(r.body.error.code, 'membership_required');
+    assert.equal(captured.length, before);
+  });
+});
+
+// ── proactive filing (task 1004467) ───────────────────────────────────────────
+// The owner's rule: a builder venting that Bongos is broken gets it filed without
+// asking. That lives in two places, and both must keep saying it.
+
+test('the skill files unasked on a Bongos rant, and the kernel tells every session to', () => {
+  const skill = fs.readFileSync(path.join(ROOT, '.claude/skills/bongos-feedback/SKILL.md'), 'utf8');
+  const description = skill.split('\n---')[0];
+  assert.match(description, /unasked/, 'the listing entry itself says it acts unprompted');
+  assert.match(description, /Bongos is broken/, 'a venting phrase is a trigger');
+  assert.match(skill, /File it without being asked/);
+  assert.match(skill, /Never paste the rant/, 'a report, not the raw complaint');
+  assert.match(skill, /own project/, 'their own code is out of scope');
+  assert.match(skill, /One filing per distinct problem per session/);
+  const kernel = fs.readFileSync(path.join(ROOT, 'CLAUDE.md'), 'utf8');
+  assert.match(kernel, /vents that Bongos itself is broken.*\/bongos-feedback/);
+});
+
+test('every report is secret-scrubbed before it leaves the machine, and never sent unscrubbed', async () => {
+  const { scrubReport } = require_(path.join(ROOT, 'scripts/gds/feedback-send.js'));
+  const token = 'ghp_' + 'a1B2c3D4e5F6g7H8i9J0k1L2m3N4o5P6q7R8';
+  const envValue = 'zq9-private-value-7781';
+  const r = scrubReport(`claim failed, my token is ${token} and the key is ${envValue}`, { MY_API_KEY: envValue });
+  assert.doesNotMatch(r.text, /ghp_/);
+  assert.ok(!r.text.includes(envValue), 'an env secret is stripped by value');
+  assert.ok(r.removed >= 2);
+  assert.equal(scrubReport('bongos claim hung for two minutes', {}).text, 'bongos claim hung for two minutes', 'plain prose is untouched');
+  const src = fs.readFileSync(path.join(ROOT, 'scripts/gds/feedback-send.js'), 'utf8');
+  assert.ok(src.indexOf('scrubReport(message)') < src.indexOf("api.request('POST', '/feedback'"), 'scrubbed before the request');
+  assert.match(src, /message: scrubbed\.text/, 'only the scrubbed text is sent');
+});

package/tests/npm_release_preview_commands.mjs

@@ -52,7 +52,7 @@ test('the copy is a custom-format dump of the live database, restored with no ow
 
 test('the copy is created empty and dropped if it is already there', () => {
   assert.deepEqual(c.createDbCommand(), { cmd: 'createdb', args: [PREVIEW_DB] });
-  assert.deepEqual(c.dropDbCommand(), { cmd: 'dropdb', args: ['--if-exists', PREVIEW_DB] });
+  assert.deepEqual(c.dropDbCommand(), { cmd: 'dropdb', args: ['--if-exists', '--force', PREVIEW_DB] });
 });
 
 test('the install is one version of the core into its own directory, production dependencies only', () => {