@bongos/core 1.21.115 → 1.21.117

package/tests/pin_replay.mjs

@@ -0,0 +1,147 @@
+// tests/pin_replay.mjs — a core move whose pin push is refused as "behind" replays the pin
+// commit onto GitHub's newer history instead of leaving GitHub on the old core (task 1004733).
+//
+// The normal case for a project worked from a laptop: the owner has pushed commits the box
+// does not have, so the box's pin commit cannot fast-forward GitHub. Before this task the move
+// finished `done` with a `repo_not_updated:behind` note and GitHub kept naming the old core, so
+// the next deploy from GitHub could quietly roll the core back. What these pin, against REAL
+// git repositories (a bare "GitHub", the box's checkout, the owner's laptop clone):
+//   * origin ahead → only the pin commit is replayed on top of it and pushed; the owner's
+//     commits stay, nothing is forced, and the live box's checkout is not touched
+//   * the owner changed the lockfile too → reported in plain words, GitHub left as it was
+//   * origin already up to date → the ordinary push, no replay at all
+//
+// Run:  node tests/pin_replay.mjs
+
+import { strict as assert } from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { pushUpgradePin } from '../scripts/gds/provision-core-upgrade.js';
+
+let passed = 0, failed = 0;
+const t = async (name, fn) => {
+  try { await fn(); passed += 1; console.log(`  PASS  ${name}`); }
+  catch (e) { failed += 1; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+// Forward slashes: the commands run through bash, which would eat a Windows backslash.
+const fwd = (p) => p.replace(/\\/g, '/');
+const ID = '-c user.name=tester -c user.email=tester@example.invalid';
+
+// The control plane's executor, for real: a shell command, the allowFail result shape
+// provision-config.js softFailResult returns (output kept, softFailed set).
+function realExec(ran) {
+  return (cmd, opts = {}) => {
+    ran.push(cmd);
+    const r = spawnSync('bash', ['-c', cmd], { encoding: 'utf8', env: { ...process.env, ...(opts.env || {}) } });
+    if (r.status === 0) return { ok: true, stdout: r.stdout || '', stderr: r.stderr || '' };
+    if (!opts.allowFail) throw new Error(`command failed: ${cmd}\n${r.stderr}`);
+    return { ok: true, stdout: r.stdout || '', stderr: r.stderr || '', softFailed: true };
+  };
+}
+const sh = (cmd) => {
+  const r = spawnSync('bash', ['-c', cmd], { encoding: 'utf8' });
+  if (r.status !== 0) throw new Error(`setup failed: ${cmd}\n${r.stderr}`);
+  return String(r.stdout || '').trim();
+};
+
+const pkg = (core, extra = {}) => `${JSON.stringify({ name: 'site', dependencies: { '@bongos/core': core, ...extra } }, null, 2)}\n`;
+const lock = (core, extra = '') => `${JSON.stringify({ name: 'site', lockfileVersion: 3, packages: { 'node_modules/@bongos/core': { version: core } }, note: extra }, null, 2)}\n`;
+
+// A bare "GitHub", the box's checkout (holding an unpushed pin commit, as upgrade.js
+// --commit-pin --pin-no-push leaves it), and the owner's laptop clone.
+function world({ ownerChanges = null } = {}) {
+  const root = fwd(mkdtempSync(join(tmpdir(), 'pin-replay-')));
+  const origin = `${root}/origin.git`, box = `${root}/box`, laptop = `${root}/laptop`, scratch = `${root}/scratch`;
+  sh(`git init -q --bare ${origin} && git -C ${origin} symbolic-ref HEAD refs/heads/main`);
+  sh(`git init -q ${laptop} && git -C ${laptop} checkout -q -b main`);
+  writeFileSync(`${laptop}/package.json`, pkg('1.0.0'));
+  writeFileSync(`${laptop}/package-lock.json`, lock('1.0.0'));
+  writeFileSync(`${laptop}/index.html`, '<p>v1</p>\n');
+  sh(`git -C ${laptop} add -A && git -C ${laptop} ${ID} commit -q -m init && git -C ${laptop} remote add origin ${origin} && git -C ${laptop} push -q origin main`);
+  sh(`git clone -q ${origin} ${box}`);
+  // The move's pin commit, on the box.
+  writeFileSync(`${box}/package.json`, pkg('1.1.0'));
+  writeFileSync(`${box}/package-lock.json`, lock('1.1.0'));
+  sh(`git -C ${box} add package.json package-lock.json && git -C ${box} ${ID} commit -q -m "pin @bongos/core 1.1.0 (was 1.0.0)"`);
+  if (ownerChanges) {
+    ownerChanges(laptop);
+    sh(`git -C ${laptop} add -A && git -C ${laptop} ${ID} commit -q -m "owner work" && git -C ${laptop} push -q origin main`);
+  }
+  return { root, origin, box, laptop, scratch, done: () => { try { rmSync(root, { recursive: true, force: true }); } catch { /* best effort */ } } };
+}
+
+const inst = { id: 9, slug: 'acme-site', hosting_shape: 'cloud-host', status: 'active', owner_builder_id: 5, target_ref: 'acme/site' };
+function run(w) {
+  const ran = [], logs = [];
+  const deps = {
+    controlExec: realExec(ran), log: (l) => logs.push(String(l)),
+    getGithubToken: async () => null,                    // no owner token: the box's own remote pushes
+    fsImpl: { existsSync: () => false },                 // and no write key on this hub
+    pinKeyDir: `${w.root}/keys`, tmpDir: w.scratch,
+  };
+  sh(`mkdir -p ${w.scratch}`);
+  return pushUpgradePin(inst, deps, { instanceDir: w.box }).then((out) => ({ out, ran, logs }));
+}
+const at = (dir, ref) => sh(`git -C ${dir} rev-parse ${ref}`);
+const show = (dir, ref, file) => sh(`git -C ${dir} show ${ref}:${file}`);
+
+console.log('origin AHEAD of the box: the pin commit is replayed on top and pushed');
+
+await t('the owner\'s commits stay, the pin lands on top of them, and nothing is forced', async () => {
+  const w = world({ ownerChanges: (d) => writeFileSync(`${d}/index.html`, '<p>v2 from the laptop</p>\n') });
+  try {
+    const ownerTip = at(w.origin, 'main');
+    const boxHead = at(w.box, 'HEAD');
+    const { out, ran } = await run(w);
+    assert.equal(out.pushed, true, `pushed — got ${JSON.stringify(out)}`);
+    assert.equal(out.replayed, true, 'by replaying the pin, not by the first push');
+    assert.equal(out.via, 'origin', 'over the same credential that was refused as behind');
+    const tip = at(w.origin, 'main');
+    assert.equal(at(w.origin, 'main^'), ownerTip, 'the replayed pin sits directly on the owner\'s newest commit');
+    assert.match(show(w.origin, 'main', 'package.json'), /"@bongos\/core": "1\.1\.0"/, 'GitHub now names the new core');
+    assert.match(show(w.origin, 'main', 'package-lock.json'), /"version": "1\.1\.0"/);
+    assert.match(show(w.origin, 'main', 'index.html'), /v2 from the laptop/, 'the owner\'s work is still there');
+    assert.equal(sh(`git -C ${w.origin} log -1 --format=%s main`), 'pin @bongos/core 1.1.0 (was 1.0.0)', 'the pin commit\'s own message');
+    assert.notEqual(tip, boxHead, 'a new commit, not the box\'s');
+    assert.equal(at(w.box, 'HEAD'), boxHead, 'the live box\'s checkout was NOT moved');
+    assert.match(readFileSync(`${w.box}/index.html`, 'utf8'), /v1/, 'nor its files changed under the running site');
+    assert.equal(sh(`git -C ${w.box} worktree list`).split('\n').length, 1, 'the scratch copy was cleaned up');
+    assert.ok(!ran.some((c) => /--force|\s\+\S|reset --hard|rebase/.test(c)), `never forced: ${ran.join('\n')}`);
+  } finally { w.done(); }
+});
+
+await t('a conflicting LOCKFILE is reported in plain words, and GitHub is left exactly as it was', async () => {
+  const w = world({ ownerChanges: (d) => writeFileSync(`${d}/package-lock.json`, lock('1.0.1', 'the owner reinstalled')) });
+  try {
+    const ownerTip = at(w.origin, 'main');
+    const boxHead = at(w.box, 'HEAD');
+    const { out, ran } = await run(w);
+    assert.equal(out.pushed, false);
+    assert.equal(out.code, 'conflict');
+    assert.match(out.note, /^repo_not_updated:conflict: /, 'the note the web tier reads');
+    assert.match(out.note, /package-lock\.json/, 'it names the file');
+    assert.equal(at(w.origin, 'main'), ownerTip, 'nothing was pushed over the owner\'s commit');
+    assert.equal(at(w.box, 'HEAD'), boxHead, 'the box is untouched');
+    assert.equal(sh(`git -C ${w.box} status --porcelain`), '', 'and its tree is clean');
+    assert.equal(sh(`git -C ${w.box} worktree list`).split('\n').length, 1, 'the scratch copy was cleaned up');
+    assert.ok(!ran.some((c) => /--force|\s\+\S|reset --hard/.test(c)), 'never forced');
+  } finally { w.done(); }
+});
+
+await t('origin UP TO DATE: the ordinary push, no fetch and no replay', async () => {
+  const w = world();
+  try {
+    const boxHead = at(w.box, 'HEAD');
+    const { out, ran } = await run(w);
+    assert.equal(out.pushed, true);
+    assert.ok(!out.replayed, 'nothing to replay');
+    assert.equal(at(w.origin, 'main'), boxHead, 'GitHub fast-forwarded to the box\'s own pin commit');
+    assert.ok(!ran.some((c) => / fetch | worktree | cherry-pick /.test(c)), `no replay machinery ran: ${ran.join('\n')}`);
+  } finally { w.done(); }
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);

package/tests/pin_write_key.mjs

@@ -262,6 +262,32 @@ await t('GitHub AHEAD of the box (rejected non-fast-forward) on the write key: r
   assert.ok(!call(r, /x-access-token@/) && !call(r, / push origin /));
 });
 
+await t('GitHub AHEAD on the write key: the pin is replayed and pushed over THAT key, never forced (task 1004733)', async () => {
+  const SHA = 'a'.repeat(40), UP = 'b'.repeat(40), NEXT = 'c'.repeat(40);
+  const r = pushRig();
+  let keyPushes = 0;
+  const inner = r.deps.exec;
+  r.deps.exec = (cmd, opts) => {
+    if (/core\.sshCommand=.* push /.test(cmd) && keyPushes++ === 0) { r.ran.push({ cmd, env: opts && opts.env }); return refused(' ! [rejected]        HEAD -> main (fetch first)'); }
+    if (/log -1 --format=/.test(cmd)) { r.ran.push({ cmd }); return { ok: true, stdout: `${SHA}\n${'d'.repeat(40)}\nbox\nbox@x.invalid\npin @bongos/core 1.2.0 (was 1.1.0)\n` }; }
+    if (/rev-parse FETCH_HEAD/.test(cmd)) { r.ran.push({ cmd }); return { ok: true, stdout: `${UP}\n` }; }
+    if (/diff --quiet /.test(cmd)) { r.ran.push({ cmd }); return refused(''); }
+    if (/rev-parse HEAD/.test(cmd)) { r.ran.push({ cmd }); return { ok: true, stdout: `${NEXT}\n` }; }
+    return inner(cmd, opts);
+  };
+  const out = await push(r);
+  assert.equal(out.pushed, true);
+  assert.equal(out.via, 'write-key');
+  assert.equal(out.replayed, true);
+  const fetch = call(r, / fetch /);
+  assert.ok(fetch && fetch.cmd.includes('core.sshCommand=') && fetch.cmd.includes('git@github.com:acme/site.git main'), `fetched over the key: ${fetch && fetch.cmd}`);
+  const again = r.ran.filter((c) => /core\.sshCommand=.* push /.test(c.cmd)).pop();
+  assert.ok(again.cmd.includes(`push git@github.com:acme/site.git ${NEXT}:refs/heads/main`), `the replayed commit, over the key: ${again.cmd}`);
+  assert.ok(call(r, new RegExp(`cherry-pick ${SHA}`)), 'only the pin commit is replayed');
+  assert.ok(!r.ran.some((c) => /--force|\s\+\S|reset --hard|rebase/.test(c.cmd)), 'never forced');
+  assert.ok(!call(r, /x-access-token@/) && !call(r, / push origin /), 'no other credential');
+});
+
 await t('NO KEY yet but a FRESH TOKEN: the key is minted first (reconnecting is enough), then used', async () => {
   const r = pushRig({ hasKey: false });
   const out = await push(r);

package/tests/upgrade_migrate.mjs

@@ -23,6 +23,9 @@ import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, realpathSync, syml
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { EventEmitter } from 'node:events';
+// ESM named imports: knip credits a CJS export only when a test imports it this way.
+import { migrateError, migrateFailureDetail, teeSpawn } from '../scripts/gds/upgrade-migrate.js';
 
 const require = createRequire(import.meta.url);
 const { migratePlan, CORE_MIGRATE_SCRIPT } = require('../scripts/gds/upgrade-migrate.js');
@@ -193,3 +196,81 @@ test('the real fallback command resolves the project as its instance root, despi
   const blind = rootsOf(execFileSync('bash', [CORE_MIGRATE_SCRIPT, '--print-roots'], { cwd: dir, env: base, encoding: 'utf8' }));
   assert.notEqual(blind.INSTANCE_ROOT, dir, 'without INIT_CWD pinned, a stray value decides which project is migrated');
 });
+
+// ── a failed migrate names its migration and psql's ERROR line (task 1004734) ──────────
+// Seen 2026-10-14: toast's move 1.21.20 → 1.21.115 rolled back and the hub kept only
+// "migrate failed (exit 3)". Which file and which error were in the box's journal alone.
+const FAKE_DSN = ['postgres://app', 'Sup3rS3cretPassw0rd@db.internal/prod'].join(':');
+const MIGRATE_OUT = 'skip   core_001_base (already applied)\napply  core_998_ok\napply  core_999_x\n';
+const PSQL_ERR = `psql:node_modules/@bongos/core/migrations/core_999_x.sql:7: ERROR:  check constraint "tasks_kind_check" of relation "tasks" is violated by some row ${FAKE_DSN}\n`;
+
+function failingMigrateRun(calls, opts = {}) {
+  const base = recordingRun(calls, opts);
+  return (cmd, args = [], o = {}) => {
+    if ((cmd === 'bash' && args[0] === CORE_MIGRATE_SCRIPT) || (cmd === 'npm' && args[0] === 'run' && args[1] === 'migrate')) {
+      calls.push({ line: `${cmd} ${args.join(' ')}`.trim(), opts: o });
+      return { status: 3, stdout: MIGRATE_OUT, stderr: PSQL_ERR };
+    }
+    return base(cmd, args, o);
+  };
+}
+
+test('runMigrate: a failing migration comes back with its file name and psql\'s ERROR line', async () => {
+  const mig = await u.runMigrate(adoptedProject(), failingMigrateRun([]));
+  assert.equal(mig.ok, false);
+  assert.equal(mig.code, 3);
+  const error = migrateError(mig);
+  assert.match(error, /^migrate failed \(exit 3\)/, 'the prefix upgrade-outcome.js keys on is unchanged');
+  assert.match(error, /core_999_x/, 'names the migration that was being applied when it stopped');
+  assert.doesNotMatch(error, /core_998_ok/, 'and not an earlier one that applied cleanly');
+  assert.match(error, /ERROR: +check constraint "tasks_kind_check" of relation "tasks" is violated by some row/);
+  assert.doesNotMatch(error, /Sup3rS3cretPassw0rd/, 'a credential in the error never reaches the hub');
+});
+
+test('migrateFailureDetail scrubs secrets and caps the length', () => {
+  const d = migrateFailureDetail(`apply  core_999_x\nERROR:  bad value ${FAKE_DSN} ${'x'.repeat(5000)}\n`);
+  assert.doesNotMatch(d, /Sup3rS3cretPassw0rd/);
+  assert.ok(d.length <= 400, `capped (${d.length})`);
+  assert.match(d, /core_999_x/);
+  assert.equal(migrateFailureDetail('npm error code 1\n'), '', 'nothing recognisable adds nothing');
+  assert.match(migrateFailureDetail('psql:/x/migrations/core_5_y.sql:3: ERROR:  boom\n'), /core_5_y.*ERROR: +boom/, 'psql\'s own file prefix stands in for a missing apply line');
+});
+
+test('a full upgrade whose migrate fails reports the migration, the error, and a CHECK-violation class', async () => {
+  const dir = adoptedProject({ installed: '1.19.312' });
+  const res = await u.runUpgrade(
+    { to: '1.19.1029', registry: true, instance: dir, service: 'mercury', healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: failingMigrateRun([], { dir, installTo: '1.19.1029' }),
+      materialize: () => ({ skills: 0 }), regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+      databaseUrl: '', pgDatabase: '',
+    },
+  );
+  assert.equal(res.ok, false);
+  assert.match(res.error, /^migrate failed \(exit 3\) at core_999_x: ERROR: +check constraint "tasks_kind_check"/);
+  const outcome = require('../scripts/gds/upgrade-outcome.js');
+  assert.equal(outcome.upgradeReason(res), 'migrate_check_violation');
+  assert.equal(outcome.classifyFailure('migrate_check_violation').class, 'unknown', 'existing rows break the new rule: a person decides, never an unattended retry');
+});
+
+test('teeSpawn streams the child\'s output live AND keeps it for the failure report', async () => {
+  const pipe = () => Object.assign(new EventEmitter(), { setEncoding() {} });
+  let child;
+  const spawnImpl = (cmd, args, opts) => {
+    child = Object.assign(new EventEmitter(), { stdout: pipe(), stderr: pipe(), opts });
+    return child;
+  };
+  const out = [], err = [];
+  const p = teeSpawn('bash', ['m.sh'], { cwd: '/x' }, { spawnImpl, out: { write: (c) => out.push(c) }, err: { write: (c) => err.push(c) } });
+  child.stdout.emit('data', 'apply  core_999_x\n');
+  assert.deepEqual(out, ['apply  core_999_x\n'], 'written through as it arrives, not after the child exits');
+  child.stderr.emit('data', 'ERROR:  boom\n');
+  assert.deepEqual(err, ['ERROR:  boom\n']);
+  child.emit('close', 3);
+  const r = await p;
+  assert.equal(r.status, 3);
+  assert.match(r.output, /apply {2}core_999_x[\s\S]*ERROR: {2}boom/);
+  assert.deepEqual(child.opts.stdio, ['inherit', 'pipe', 'pipe']);
+  assert.equal(child.opts.cwd, '/x');
+});