@bongos/core 1.21.113 → 1.21.114

package/tests/government_act_alone_buildings.mjs

@@ -271,6 +271,7 @@ const REQUESTS = {
   'POST /render-deploy/act': ['POST', '/render-deploy/act', { action: 'launch' }],
   'POST /npm-release/release': ['POST', '/npm-release/release', { version: 'v-next' }],
   'PATCH /builders/:id/budget': ['PATCH', `/builders/${BAD}/budget`, { monthly_budget_usd: 5 }],
+  'PATCH /project-settings/spend-cap': ['PATCH', '/project-settings/spend-cap', { usd: 'lots' }],
 };
 
 test('every listed route has a request in this test (a new act cannot go unexercised)', () => {

package/tests/government_agent_asks.mjs

@@ -0,0 +1,322 @@
+// tests/government_agent_asks.mjs — AGENTS WRITE ASKS LIKE HUMANS (task 1004704,
+// goal 1000111). The ask's shape and its server-side refusal are task 1004703
+// (tests/government_asks.mjs); this file guards the agent side of it.
+//
+// WHAT IT GUARDS.
+//   1. Real past asks come out as short cards: every request in the past-asks
+//      corpus (tests/fixtures/government-ask-cards.json) that was written as
+//      prose (the 238-word override ask among them)
+//      reads, as its card, in a question of at most twelve words and a handful of
+//      lines; the prose itself, sent as the ask, is refused.
+//   2. An agent that files prose is refused and rewrites: through the real
+//      routers, a blocker an AI (CLI) session files by hand without an ask
+//      answers 400 `ask_required`; prose sent as the ask answers `ask_refused`
+//      naming every fix; the helper (scripts/gds/ask.js check) shows the same
+//      fixes; the rewritten card passes the helper and files, stored. A person on
+//      the hall (a web session) and the unattended scripts still file without one.
+//   3. The scripts that file templated blockers send a card that has the shape,
+//      for every input they can see, and their sources are exactly the route's
+//      allow-list; a card the server refuses never costs the blocker.
+//   4. The Conductor reminder fires when a session is about to ask a person, stays
+//      quiet otherwise, and states the ask's own numbers.
+//
+// DB-free: every read and write is stubbed by property.
+// Run:  node --test --test-reporter=tap tests/government_agent_asks.mjs
+
+import { strict as assert } from 'node:assert';
+import { test, after } from 'node:test';
+import http from 'node:http';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const GOV = path.join(ROOT, 'modules', 'government');
+const FX = path.join(ROOT, 'scripts', 'hall-preview', 'fixtures');
+const fx = (name) => JSON.parse(fs.readFileSync(path.join(FX, name + '.json'), 'utf8'));
+// real past asks as the cards they should have been (test data; the hall never reads it)
+const CARDS = JSON.parse(fs.readFileSync(path.join(ROOT, 'tests', 'fixtures', 'government-ask-cards.json'), 'utf8')).cards;
+
+const asks = require(path.join(GOV, 'asks.js'));
+const asksDb = require(path.join(GOV, 'asks-db.js'));
+const askCli = require(path.join(ROOT, 'scripts', 'gds', 'ask.js'));
+const shipEscalation = require(path.join(ROOT, 'scripts', 'gds', 'ship-escalation.js'));
+const artifactAudit = require(path.join(ROOT, 'scripts', 'gds', 'artifact-audit.js'));
+const autobongosVerify = require(path.join(ROOT, 'scripts', 'gds', 'autobongos-verify.js'));
+const conductor = require(path.join(ROOT, '.claude', 'hooks', 'conductor.js'));
+
+const words = (t) => asks.words(t).length;
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'agent-asks-'));
+const writeCard = (name, body) => { const f = path.join(TMP, name); fs.writeFileSync(f, JSON.stringify(body)); return f; };
+
+// The override ask as an agent first wrote it: the matter's title and its prose.
+const OVERRIDE = fx('government__docket').matters.find((x) => x.id === 'override_requests:1000017');
+const OVERRIDE_PROSE = [OVERRIDE.title, OVERRIDE.detail].filter(Boolean).join('\n\n');
+// ...and as the card it should have been (the corpus's card for the same matter).
+const OVERRIDE_CARD = (() => {
+  const a = CARDS.find((x) => x.id === 'override_requests:1000017');
+  return { question: a.question, options: a.options, recommend: a.recommend, waits_on: a.waits_on, if_nobody_answers: a.if_nobody_answers };
+})();
+
+// ── 1. real past asks come out as short cards ───────────────────────────────
+
+test('the 238-word override ask comes out as a short card', () => {
+  assert.equal(words(OVERRIDE_PROSE), 238, "the override ask as an agent wrote it");
+  assert.ok(words(OVERRIDE.detail) >= 200, 'it is the long one');
+  const prose = asks.checkAsk({ question: OVERRIDE_PROSE });
+  assert.equal(prose.ok, false, 'the prose is not an ask');
+  const card = asks.checkAsk(OVERRIDE_CARD);
+  assert.equal(card.ok, true, JSON.stringify(card.errors));
+  const text = asks.cardText(card.ask);
+  assert.equal(text.split('\n')[0], 'Pay this task despite the grader crashing on it?');
+  assert.ok(words(text) <= 70, `the card is ${words(text)} words`);
+  assert.ok(words(text) * 3 < words(OVERRIDE_PROSE), 'a third of the prose or less');
+  assert.match(text, /^ {2}1\. Approve \(recommended\): The task counts as passed and its builder is paid\.$/m);
+  assert.match(text, /^ {2}2\. Decline: /m);
+  assert.match(text, /^Why: The 0\.0 is a crashed grader/m);
+  assert.match(text, /^Waits on the owner\. If nobody answers: The task stays at completed/m);
+  assert.doesNotMatch(text, /undefined|null|\[object/);
+});
+
+test('every real past ask written as prose comes out as a short card', () => {
+  let long = 0;
+  for (const a of CARDS) {
+    const raw = a.raw || {};
+    const prose = [raw.title, raw.detail].filter(Boolean).join('\n\n');
+    const r = asks.checkAsk(a);
+    assert.equal(r.ok, true, `${a.id}: ${JSON.stringify(r.errors)}`);
+    const text = asks.cardText(r.ask);
+    const lines = text.split('\n');
+    assert.ok(words(lines[0]) <= asks.ASK_RULES.question_words, `${a.id}: the question`);
+    assert.ok(lines.length <= 2 + asks.ASK_RULES.options_max + 1, `${a.id}: ${lines.length} lines`);
+    assert.ok(words(text) <= 90, `${a.id}: ${words(text)} words`);
+    if (words(prose) >= 50) {
+      long += 1;
+      assert.equal(asks.checkAsk({ question: prose }).ok, false, `${a.id}: its prose is refused`);
+    }
+  }
+  assert.ok(long >= 15, `${long} long prose asks`);
+});
+
+test('each seat reads as a person would say it', () => {
+  assert.equal(asks.seatWords('owner'), 'the owner');
+  assert.equal(asks.seatWords('lead:release'), 'the Release lead');
+  assert.equal(asks.seatWords('board:charter'), 'the Charter board');
+  assert.equal(asks.seatWords('committee:review.art_direction'), 'the Review art direction committee');
+  assert.equal(asks.cardText(null), '');
+});
+
+// ── 2. through the real routers: prose is refused, the rewrite files ───────
+
+const api = require(path.join(ROOT, 'src', 'module-api.js'));
+const seams = require(path.join(ROOT, 'src', 'module-seams.js'));
+const authMod = require(path.join(ROOT, 'src', 'bongos', 'auth.js'));
+const resolver = require(path.join(GOV, 'resolver.js'));
+const { attachFail } = require(path.join(ROOT, 'src', 'bongos', 'middleware', 'error-envelope.js'));
+const blockersDb = require(path.join(ROOT, 'modules', 'ideas', 'blockers.js'));
+const blockersRoutes = require(path.join(ROOT, 'modules', 'ideas', 'routes', 'blockers.js'));
+const express = require('express');
+
+const real = {
+  apiRequireBuilder: api.requireBuilder, authRequireBuilder: authMod.requireBuilder, requirePermission: authMod.requirePermission,
+  resolve: resolver.resolveBuilderPermissions, saveAsk: asksDb.saveAsk, asksFor: asksDb.asksFor,
+  create: blockersDb.createBlocker, list: blockersDb.listOpenBlockers, count: blockersDb.countOpenBlockers, get: blockersDb.getBlocker,
+};
+// The session's source rides a header here: `cli` is an agent's tools, `web` the hall.
+const fakeBuilder = (req, res, next) => {
+  req.builder = { id: 42, rank: 'metic', github_login: 'someone' };
+  req.gdsSession = { builder_id: 42, source: req.headers['x-session-source'] || 'web' };
+  next();
+};
+api.requireBuilder = fakeBuilder;
+authMod.requireBuilder = fakeBuilder;
+authMod.requirePermission = () => (req, res, next) => next();
+resolver.resolveBuilderPermissions = async () => ['board.vote.cast'];
+const store = new Map();
+const filed = [];
+asksDb.saveAsk = async ({ matterId, ask }) => { const row = { ...ask, written_at: '2026-10-09T12:00:00.000Z' }; store.set(matterId, row); return row; };
+asksDb.asksFor = async (ids) => new Map(ids.filter((id) => store.has(id)).map((id) => [id, store.get(id)]));
+let nextId = 500;
+blockersDb.createBlocker = async ({ title, bodyMd, source }) => { const b = { id: String(nextId++), title, body_md: bodyMd, source, status: 'open' }; filed.push(b); return b; };
+blockersDb.listOpenBlockers = async () => filed.slice();
+blockersDb.countOpenBlockers = async () => filed.length;
+blockersDb.getBlocker = async (id) => filed.find((b) => b.id === String(id)) || null;
+
+seams._reset();
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use(require(path.join(GOV, 'routes', 'government.js'))());
+app.use(blockersRoutes());
+const server = http.createServer(app);
+await new Promise((r) => server.listen(0, '127.0.0.1', r));
+const BASE = `http://127.0.0.1:${server.address().port}`;
+after(() => {
+  server.close();
+  api.requireBuilder = real.apiRequireBuilder; authMod.requireBuilder = real.authRequireBuilder; authMod.requirePermission = real.requirePermission;
+  resolver.resolveBuilderPermissions = real.resolve; asksDb.saveAsk = real.saveAsk; asksDb.asksFor = real.asksFor;
+  blockersDb.createBlocker = real.create; blockersDb.listOpenBlockers = real.list; blockersDb.countOpenBlockers = real.count; blockersDb.getBlocker = real.get;
+  seams._reset();
+  fs.rmSync(TMP, { recursive: true, force: true });
+});
+async function call(method, p, body, source) {
+  const headers = { 'content-type': 'application/json' };
+  if (source) headers['x-session-source'] = source;
+  const res = await fetch(`${BASE}${p}`, { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
+  let json = null; try { json = await res.json(); } catch { /* none */ }
+  return { ok: res.ok, status: res.status, data: json };
+}
+// The helper's client: the CLI's request shape, against these routers.
+const client = { request: (method, p, opts = {}) => call(method, p, opts.body, 'cli') };
+
+test('an agent that files prose is refused, rewrites with the helper, and files the card', async () => {
+  const before = filed.length;
+  const blocker = { title: OVERRIDE.title, body_md: OVERRIDE.detail, source: 'task', source_ref: '1004704' };
+
+  // 1. prose alone, from an AI session: refused, told what to send and how to check it
+  const bare = await call('POST', '/blockers', blocker, 'cli');
+  assert.equal(bare.status, 400);
+  assert.equal(bare.data.error.code, 'ask_required');
+  assert.equal(bare.data.error.message, asks.ASK_REQUIRED_MESSAGE);
+  assert.match(bare.data.error.message, /at most 12 words/);
+  assert.match(bare.data.error.message, /node scripts\/gds\/ask\.js check/);
+
+  // 2. the prose sent as the ask: refused, every fix named
+  const prose = { question: OVERRIDE_PROSE, options: [], waits_on: '', if_nobody_answers: '' };
+  const slop = await call('POST', '/blockers', { ...blocker, ask: prose }, 'cli');
+  assert.equal(slop.data.error.code, 'ask_refused');
+  assert.match(slop.data.error.message, /The question is \d+ words; 12 at most\./);
+  assert.equal(filed.length, before, 'nothing was filed');
+
+  // 3. the helper says the same, through the server's dry run, and names each fix
+  const proseFile = writeCard('prose.json', { ...blocker, ask: prose });
+  const refused = await askCli.check(proseFile, { client });
+  assert.equal(refused.code, 1);
+  const out = refused.lines.join('\n');
+  assert.equal(refused.lines[0], `✗ ${slop.data.error.message}`, 'the server\'s own words');
+  assert.doesNotMatch(out, /checked here/, 'the server answered');
+  assert.match(out, /^ {2}- question: The question is \d+ words; 12 at most\.$/m);
+  assert.match(out, /^ {2}- options: Offer 2 or 3 tap answers, not 0\.$/m);
+  assert.match(out, /^ {2}- waits_on: Say who this waits on\.$/m);
+
+  // 4. the rewrite passes the helper, which prints the card as a person reads it
+  const rewrite = { ...blocker, ask: { ...OVERRIDE_CARD, detail: OVERRIDE.detail } };
+  const passed = await askCli.check(writeCard('card.json', rewrite), { client });
+  assert.equal(passed.code, 0, passed.lines.join('\n'));
+  assert.match(passed.lines[0], /^✓ This ask has the shape\. As a person reads it:$/);
+  assert.equal(passed.lines.slice(2).join('\n'), asks.cardText(OVERRIDE_CARD));
+
+  // 5. and files, stored against the blocker
+  const ok = await call('POST', '/blockers', rewrite, 'cli');
+  assert.equal(ok.status, 201, JSON.stringify(ok.data));
+  assert.equal(store.get(`blockers:${ok.data.blocker.id}`).question, OVERRIDE_CARD.question);
+  assert.equal(store.get(`blockers:${ok.data.blocker.id}`).detail, OVERRIDE.detail.trim(), 'the prose rides along');
+});
+
+test('every source an agent files with is held to it; the hall and the templated scripts are not', async () => {
+  for (const source of [undefined, '', 'manual', 'task', 'something-new']) {
+    const r = await call('POST', '/blockers', { title: 'Stuck', ...(source === undefined ? {} : { source }) }, 'cli');
+    assert.equal(r.status, 400, `source ${JSON.stringify(source)}`);
+    assert.equal(r.data.error.code, 'ask_required');
+  }
+  // a person on the hall's form (a web session)
+  assert.equal((await call('POST', '/blockers', { title: 'Typed by a person' }, 'web')).status, 201);
+  // the unattended scripts, from a CLI session: they file with or without a card
+  for (const source of blockersRoutes.TEMPLATED_SOURCES) {
+    const r = await call('POST', '/blockers', { title: `From ${source}`, source, source_ref: `x-${source}` }, 'cli');
+    assert.equal(r.status, 201, source);
+  }
+});
+
+test('the helper checks locally, and says so, when the server cannot answer', async () => {
+  const offline = { request: async () => { throw new Error('ECONNREFUSED'); } };
+  const r = await askCli.check(writeCard('slop2.json', { question: 'Can you look at the deploy and tell me what you think about it all?' }), { client: offline });
+  assert.equal(r.code, 1);
+  assert.match(r.lines.join('\n'), /checked here; the server could not be asked/);
+  const ok = await askCli.check(writeCard('ok2.json', OVERRIDE_CARD), { local: true });
+  assert.equal(ok.code, 0);
+  assert.match(ok.lines[0], /checked here/);
+  const bad = await askCli.check(path.join(TMP, 'missing.json'), { local: true });
+  assert.equal(bad.code, 2);
+  assert.match(bad.lines[0], /ask\.js template/);
+  // the blank card it hands out has the shape, so an agent starts from a valid one
+  assert.equal(asks.checkAsk(askCli.TEMPLATE).ok, true);
+});
+
+// ── 3. the scripts that file templated blockers ─────────────────────────────
+
+test('each templated blocker carries a card with the shape, for every input it can see', () => {
+  const cards = [
+    shipEscalation.escalationAsk(1003822),
+    shipEscalation.escalationAsk('99999999999999'),
+    artifactAudit.blockerAsk([{ id: 1 }]),
+    artifactAudit.blockerAsk(Array.from({ length: 250 }, (_, i) => ({ id: i }))),
+  ];
+  for (const shape of ['undetermined', 'pending_land', 'shipped_no_artifact', 'abandoned', 'still_held', 'blocked', 'not_started']) {
+    const row = autobongosVerify.blockerFor({ shape, status: 'active', reason: 'r' }, { taskId: '99999999999999' });
+    assert.deepEqual(row.ask, autobongosVerify.blockerAsk({ shape }, { taskId: '99999999999999' }));
+    cards.push(row.ask);
+  }
+  for (const c of cards) {
+    const r = asks.checkAsk(c);
+    assert.equal(r.ok, true, `${c.question}: ${JSON.stringify(r.errors)}`);
+  }
+});
+
+test('the route\'s templated sources are exactly the ones the scripts send', async () => {
+  const sent = [];
+  const capture = async (_m, _p, body) => { sent.push(body); return { ok: true, status: 201, data: { blocker: { id: 1 } } }; };
+  await shipEscalation.fileNoArtifactEscalation({ taskId: 7, title: 't' }, { call: capture });
+  await artifactAudit.fileBlocker([{ id: '1', status: 'shipped', shipped_at: '2026-09-01', title: 'x', touches: ['a.js'] }], { call: capture });
+  const gen = { blockers: { postBlockers: async ({ body }) => { sent.push(body); return { ok: true, status: 201, data: { blocker: { id: 2 } } }; } } };
+  await autobongosVerify.fileBlocker(gen, autobongosVerify.blockerFor({ shape: 'still_held', status: 'active', reason: 'r' }, { taskId: 7 }), { taskId: 7, link: false });
+  assert.deepEqual(sent.map((b) => b.source).sort(), [...blockersRoutes.TEMPLATED_SOURCES].sort());
+  for (const b of sent) assert.equal(asks.checkAsk(b.ask).ok, true, `${b.source} sends its card`);
+});
+
+test('a card the server refuses never costs the blocker; a broken card is never sent', async () => {
+  const sent = [];
+  const refusing = async (body) => {
+    sent.push(body);
+    return body.ask ? { ok: false, status: 400, data: { error: { code: 'ask_refused' } } } : { ok: true, status: 201, data: { blocker: { id: 9 } } };
+  };
+  const r = await askCli.postWithAsk(refusing, { title: 't', source: 'autobongos' }, OVERRIDE_CARD);
+  assert.equal(r.status, 201);
+  assert.deepEqual(sent.map((b) => !!b.ask), [true, false], 'sent with the card, then again without it');
+
+  sent.length = 0;
+  await askCli.postWithAsk(refusing, { title: 't' }, { question: 'not a card' });
+  assert.deepEqual(sent.map((b) => !!b.ask), [false], 'a card that breaks a rule is not sent');
+
+  // a failure that is not about the card is reported, not retried
+  sent.length = 0;
+  const down = async (body) => { sent.push(body); return { ok: false, status: 503, data: {} }; };
+  assert.equal((await askCli.postWithAsk(down, { title: 't' }, OVERRIDE_CARD)).status, 503);
+  assert.equal(sent.length, 1);
+});
+
+// ── 4. the Conductor reminder ───────────────────────────────────────────────
+
+test('the Conductor reminds a session about to ask a person, and only then', () => {
+  const ids = (prompt) => conductor.evaluateTriggers({ prompt, activeClaims: [] }).map((a) => a.id);
+  for (const p of ['file a blocker for this', 'I am stuck on the owner', 'ask the owner which one', 'please confirm the list',
+    'get a review of this', 'Bongos feedback: claim is slow', '/builder-ship', 'ship it', "I'm done", 'wrap it up', '/ask-for-help 12']) {
+    assert.ok(ids(p).includes('ask-shape'), p);
+  }
+  for (const p of ['explain the architecture', 'add a tile to the map', 'how does the grader work?']) {
+    assert.ok(!ids(p).includes('ask-shape'), p);
+  }
+  const a = conductor.evaluateTriggers({ prompt: 'file a blocker' }).find((x) => x.id === 'ask-shape');
+  assert.equal(a.text, conductor.ASK_SHAPE_TEXT);
+});
+
+test('the reminder states the ask\'s own numbers', () => {
+  const R = asks.ASK_RULES;
+  assert.match(conductor.ASK_SHAPE_TEXT, new RegExp(`at most ${R.question_words} words`));
+  assert.match(conductor.ASK_SHAPE_TEXT, new RegExp(`${R.options_min} or ${R.options_max} tap answers`));
+  assert.match(asks.ASK_REQUIRED_MESSAGE, new RegExp(`at most ${R.question_words} words, ${R.options_min} or ${R.options_max} tap answers`));
+  assert.match(conductor.ASK_SHAPE_TEXT, /node scripts\/gds\/ask\.js check/);
+});