@bongos/core 1.21.119 → 1.21.121

package/tests/github_sign_in_seen.mjs

@@ -0,0 +1,148 @@
+// tests/github_sign_in_seen.mjs — the project's own "sign-in works" ticks its setup
+// checklist (task 1004410, from a Discord #bugs report: "says that github wiring is not done.
+// When in reality i did make it and was able to sign in via github to my account").
+//
+// Sign-in used to tick only from the one-click GitHub attempt reaching 'done', so a project
+// whose sign-in was wired some other way — a hand-made OAuth app, or a GitHub tab that never
+// came back — sat at "Waiting on GitHub" for good. Now the liveness sweep reads the project's
+// /healthz answer, records 'github-sign-in-seen' once per attempt, and githubChecklist reads it.
+// The page half (what the founder sees) is tests/setup_status_facts.mjs §6.
+//
+// Pinned here, DB-free over recording fakes and real loopback servers:
+//   * githubChecklist: the fact ticks sign-in; with no app of ours it is wired_elsewhere and
+//     connected; with one, the install keeps its own fact;
+//   * pickUpFor offers nothing to pick up once sign-in works elsewhere;
+//   * githubSetupRead reads the fact even when no attempt exists;
+//   * recordSignInSeen writes at most one row per attempt;
+//   * probeHealthz reports auth_configured only from a small JSON answer saying true;
+//   * sweepOnce records the fact only for an up project that says so.
+//
+// Run:  node --test tests/github_sign_in_seen.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const gs = require(path.join(ROOT, 'modules', 'provisioning', 'github-setup.js'));
+const liveness = require(path.join(ROOT, 'modules', 'provisioning', 'pollers', 'liveness-sweep.js'));
+
+const SEEN = { signInSeenAt: '2026-10-14T10:00:00.000Z' };
+
+// ── the checklist ──────────────────────────────────────────────────────────────────────
+test('the project saying sign-in works ticks sign-in, whatever the attempt row says', () => {
+  for (const status of [null, 'pending', 'expired', 'error', 'code_received']) {
+    const c = gs.githubChecklist(status, null, SEEN);
+    assert.equal(c.sign_in, 'done', `${status}: sign-in is the project's own answer`);
+    assert.equal(c.wired_elsewhere, true, `${status}: no app of ours, so it was wired another way`);
+    assert.equal(c.approve, 'done');
+    assert.equal(c.install, 'done');
+    assert.equal(c.connected, true, `${status}: the project is not held back`);
+  }
+});
+
+test('without that answer, nothing changes: a pending attempt still waits on GitHub', () => {
+  const c = gs.githubChecklist('pending', null, {});
+  assert.deepEqual(c, { approve: 'now', install: 'todo', sign_in: 'todo', device_flow: 'todo', connected: false, wired_elsewhere: false });
+});
+
+test('with our app recorded, the answer ticks sign-in and the install keeps its own fact', () => {
+  const c = gs.githubChecklist('converting', 'kestrel-cloudbongos-com', SEEN);
+  assert.equal(c.sign_in, 'done');
+  assert.equal(c.install, 'now', 'the install is still GitHub\'s to confirm');
+  assert.equal(c.wired_elsewhere, false);
+  assert.equal(c.connected, false);
+  assert.equal(gs.githubChecklist('done', 'k', { ...SEEN, installedAt: SEEN.signInSeenAt }).connected, true);
+});
+
+test('nothing to pick up once sign-in works another way', () => {
+  const now = Date.now();
+  for (const [status, row] of [['pending', { state: 'S', attempts: 0 }], ['expired', { attempts: 0 }], ['error', { attempts: 2, created_at: new Date(now).toISOString(), github_code: 'c' }]]) {
+    const checklist = gs.githubChecklist(status, null, SEEN);
+    assert.equal(gs.pickUpFor(row, status, checklist, false, now), null, `${status}: no Reopen, Start fresh or Convert`);
+  }
+  // and the old answers stand when it does not
+  assert.equal(gs.pickUpFor({ state: 'S' }, 'pending', gs.githubChecklist('pending', null, {}), false, now), 'reopen');
+});
+
+// ── the read ───────────────────────────────────────────────────────────────────────────
+test('githubSetupRead reads the fact for a project with no attempt at all', async () => {
+  const seen = [];
+  const pool = {
+    query: async (sql, params) => {
+      seen.push(params);
+      assert.match(sql, /FROM provisioning_events/);
+      return { rows: params[1].includes('github-sign-in-seen') ? [{ event: 'github-sign-in-seen', at: SEEN.signInSeenAt, detail: null }] : [] };
+    },
+  };
+  const r = await gs.githubSetupRead(pool, { id: 42, target_ref: 'you/kestrel' }, null, null);
+  assert.equal(seen[0][0], 42, 'read by the project\'s own id');
+  assert.equal(r.checklist.connected, true);
+  assert.equal(r.checklist.wired_elsewhere, true);
+  assert.equal(r.pick_up, null);
+  // a failed read is "nothing verified yet", never a 500
+  const broken = await gs.githubSetupRead({ query: async () => { throw new Error('db down'); } }, { id: 42 }, null, null);
+  assert.equal(broken.checklist.sign_in, 'todo');
+});
+
+test('recordSignInSeen writes at most one row per attempt, from the liveness sweep', async () => {
+  let sql = '', params = null;
+  await gs.recordSignInSeen({ query: async (s, p) => { sql = s; params = p; return { rows: [] }; } }, 42);
+  assert.deepEqual(params, [42, 'github-sign-in-seen']);
+  assert.match(sql, /INSERT INTO provisioning_events/);
+  assert.match(sql, /WHERE NOT EXISTS/, 'a five-minute sweep never grows the ledger');
+  assert.match(sql, /max\(m\.created_at\) FROM provisioning_oauth_manifests m WHERE m\.instance_id = \$1/, 'once per attempt, so a fresh attempt is seen afresh');
+  assert.match(sql, /'liveness'/);
+});
+
+// ── the probe and the sweep ────────────────────────────────────────────────────────────
+function serve(body, type = 'application/json') {
+  const server = http.createServer((req, res) => { res.writeHead(200, { 'content-type': type }); res.end(body); });
+  return new Promise((r) => server.listen(0, '127.0.0.1', () => r(server)));
+}
+function close(server) { if (server.closeAllConnections) server.closeAllConnections(); server.close(); }
+
+test('probeHealthz says auth_configured only from a small JSON answer saying true', async () => {
+  const cases = [
+    ['{"ok":true,"auth_configured":true}', true],
+    ['{"ok":true,"auth_configured":false}', false],
+    ['{"ok":true}', false],
+    ['{"ok":true,"auth_configured":"true"}', false],
+    ['ok', false],
+    [JSON.stringify({ ok: true, auth_configured: true, pad: 'x'.repeat(8000) }), false],
+  ];
+  for (const [body, want] of cases) {
+    const s = await serve(body);
+    try {
+      const r = await liveness.probeHealthz(`http://127.0.0.1:${s.address().port}/healthz`, { timeoutMs: 3000 });
+      assert.equal(r.up, true, 'any 2xx is still up');
+      assert.equal(r.authConfigured, want, body.slice(0, 50));
+    } finally { close(s); }
+  }
+});
+
+test('the sweep records the fact for an up project that says so, and for no other', async () => {
+  const yes = await serve('{"ok":true,"auth_configured":true}');
+  const no = await serve('{"ok":true,"auth_configured":false}');
+  const inserts = [];
+  const db = {
+    query: async (sql, params) => {
+      if (/FROM provisioning_instances/.test(sql) && /WHERE status = 'active'/.test(sql)) {
+        return { rows: [{ id: 1, slug: 'kestrel', domain: null, port: yes.address().port }, { id: 2, slug: 'tern', domain: null, port: no.address().port }] };
+      }
+      if (/^UPDATE provisioning_instances/.test(sql)) return { rows: [{ id: params[0], prev_up: true }] };
+      if (/INSERT INTO provisioning_events/.test(sql)) { inserts.push(params); return { rows: [] }; }
+      throw new Error(`unexpected SQL: ${sql}`);
+    },
+  };
+  try {
+    liveness.resetNoticeState();
+    const out = await liveness.sweepOnce({ pool: db, log: () => {}, timeoutMs: 3000, notify: () => {}, collectRunnerDrift: async () => [] });
+    assert.equal(out.up, 2);
+    assert.deepEqual(inserts, [[1, 'github-sign-in-seen']]);
+  } finally { close(yes); close(no); }
+});

package/tests/hall_catalog_world.mjs

@@ -58,7 +58,7 @@ test('modules: the row is the oversight row — title with the mono key, clamped
   assert.match(js, /<span class="ov-row__title">\$\{escapeHtml\(m\.title \|\| m\.key\)\}<span class="ov-mono">\$\{escapeHtml\(m\.key\)\}<\/span>/, 'the key rides inside the title in mono');
   assert.match(js, /class="ov-row__sub mod-row__desc"/, 'the description is the sub line');
   assert.match(js, /<details class="mod-more"/, 'a details disclosure opens the rest');
-  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}<\/div>/, 'provenance, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill are the facts line');
+  assert.match(js, /<div class="ov-row__facts">\$\{provenancePill\(m\)\}\$\{attributionFacts\(m\)\}\$\{upkeepFact\(m\)\}\$\{howtoFact\(m\)\}\$\{delistedFact\(m\)\}\$\{restartFact\(m\)\}<\/div>/, 'provenance, credit, upkeep, (for a store version, task 1004366) the how-to link and (task 1003797) the delisted pill and (task 1004463) the waits-for-a-restart pill are the facts line');
   assert.match(js, /<div class="ov-row__right mod-row__right">\$\{rightHtml\(m\)\}<\/div>/, 'the right column is one function');
   const css = read('modules.css');
   assert.match(css, /\.mod-row__desc \{[^}]*-webkit-line-clamp: 2/, 'the description clamps to two lines');

package/tests/module_loader.mjs

@@ -462,3 +462,34 @@ test('the demo proof module mounts + serves through the loader (BV1.R52 / task 1
   assert.deepEqual(routes.sort(), ['GET /demo/health', 'POST /demo/ping']);
   loader._reset();
 });
+
+// ---------------------------------------------------------------------------
+// task 1004463 — a toggle says whether it waits for a restart. Routes mount and pollers
+// start once, at boot, so restartPendingFor compares the toggle with what THIS process
+// mounted; the Modules toggle used to claim "Live on this box now" regardless.
+// ---------------------------------------------------------------------------
+
+test('task 1004463: restartPendingFor names what waits for a restart, and nothing before boot', () => {
+  loader._reset();
+  const factory = "module.exports = () => function moduleRoute(req, res, next) { next(); };";
+  const poller = 'module.exports = { start() {}, stop() {} };';
+  const root = fixtureRoot({
+    pages: { manifest: validManifest('pages', { contributes: { routes: ['main'] } }), files: { 'routes/main.js': factory } },
+    jobs: { manifest: validManifest('jobs', { contributes: { routes: ['main'], pollers: ['tick'] } }), files: { 'routes/main.js': factory, 'pollers/tick.js': poller } },
+    remote: { manifest: validManifest('remote', { contributes: { pollers: ['elsewhere'] } }) },
+    quiet: { manifest: validManifest('quiet') },
+  });
+  const opts = { roots: [root], core: '1.0.0' };
+  assert.deepEqual(loader.restartPendingFor('pages', true, opts), [], 'a process that never booted is never told a restart is pending');
+  const bootOn = (k) => k === 'jobs';
+  loader.mountModuleRoutes({ use: () => {} }, { isEnabled: bootOn }, opts);
+  loader.startModulePollers({}, { isEnabled: bootOn }, opts);
+  assert.deepEqual(loader.restartPendingFor('pages', true, opts), ['routes'], 'switched on after boot: its pages wait');
+  assert.deepEqual(loader.restartPendingFor('pages', false, opts), [], 'back off: matches what is mounted');
+  assert.deepEqual(loader.restartPendingFor('jobs', false, opts), ['routes', 'pollers'], 'switched off after boot: pages and jobs keep running');
+  assert.deepEqual(loader.restartPendingFor('jobs', true, opts), []);
+  assert.deepEqual(loader.restartPendingFor('remote', true, opts), [], 'a poller with no file here never runs in this process');
+  assert.deepEqual(loader.restartPendingFor('quiet', true, opts), [], 'nothing mounted at boot, nothing to wait for');
+  assert.deepEqual(loader.restartPendingFor('nope', true, opts), []);
+  loader._reset();
+});

package/tests/module_toggle_restart.mjs

@@ -0,0 +1,73 @@
+// tests/module_toggle_restart.mjs — task 1004463.
+//
+// Measured on cloudbongos.com: switching a module on stored the override and the toggle
+// said "Live on this box now", but the module's pages stayed 404 until the next restart,
+// because routes mount (and pollers start) once, at boot. The toggle now asks the loader
+// what still waits (restartPendingFor) and says so; GET /modules carries the same field
+// so the hall can show "waits for a restart" on the row.
+//
+// Hermetic: setOverride is stubbed BEFORE the route file binds it, and the loader's
+// answer is stubbed on the loader object the route calls through. The loader's own rule
+// is tests/module_loader.mjs (task 1004463 case).
+//
+// Run:  node --test tests/module_toggle_restart.mjs
+
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const overrides = require('../src/bongos/module-overrides.js');
+overrides.setOverride = async (key, enabled) => ({ [key]: enabled, sources: { [key]: 'override' } });
+const loader = require('../src/module-loader/loader.js');
+// the route binds restartPendingFor at require time, so stub it BEFORE the route loads and
+// let each case choose the answer through `pending`
+let pending = () => [];
+loader.restartPendingFor = (...a) => pending(...a);
+const buildModulesRouter = require('../src/bongos/routes/modules.js');
+
+function handlerFor(router, method, path) {
+  const layer = router.stack.find((l) => l.route && l.route.path === path && l.route.methods[method]);
+  assert.ok(layer, `no ${method.toUpperCase()} ${path} on the router`);
+  return layer.route.stack[layer.route.stack.length - 1].handle;
+}
+async function invoke(handler, req) {
+  const res = {
+    statusCode: 200, body: undefined,
+    json(b) { this.body = b; return this; },
+    status(c) { this.statusCode = c; return this; },
+    fail(code, opts) { this.body = { error: code, ...opts }; return this; },
+  };
+  let err = null;
+  await handler(req, res, (e) => { err = e; });
+  if (err) throw err;
+  return res;
+}
+const router = buildModulesRouter();
+const key = buildModulesRouter.listModules()[0].key;
+const toggle = (enabled) => invoke(handlerFor(router, 'post', '/modules/:key/enable'), { params: { key }, query: {}, body: { enabled }, builder: { id: 1 } });
+
+test('a toggle that waits for a restart says so, instead of "live now"', async () => {
+  pending = () => ['routes', 'pollers'];
+  const on = await toggle(true);
+  assert.deepEqual(on.body.restart_pending, ['routes', 'pollers']);
+  assert.doesNotMatch(on.body.note, /Live on this box now/);
+  assert.equal(on.body.note, 'Saved, and it survives the next deploy. It turns on at the next restart of this server. Until then its pages do not open and its background jobs do not run.');
+  pending = () => ['routes'];
+  const off = await toggle(false);
+  assert.equal(off.body.note, 'Saved, and it survives the next deploy. It turns off at the next restart of this server. Until then its pages still open.');
+});
+
+test('a toggle with nothing waiting is still live now', async () => {
+  pending = () => [];
+  const r = await toggle(true);
+  assert.deepEqual(r.body.restart_pending, []);
+  assert.equal(r.body.note, 'Live on this box now, and durable — it survives the next deploy.');
+});
+
+test('GET /modules carries restart_pending on every row', async () => {
+  pending = (k) => (k === key ? ['routes'] : []);
+  const r = await invoke(handlerFor(router, 'get', '/modules'), { params: {}, query: {}, body: {} });
+  for (const m of r.body.modules) assert.ok(Array.isArray(m.restart_pending), `${m.key} carries restart_pending`);
+  assert.deepEqual(r.body.modules.find((m) => m.key === key).restart_pending, ['routes']);
+});

package/tests/projects_hub_pre_uat.mjs

@@ -86,7 +86,10 @@ test('the restart door appears ONLY where it has a reason to exist, and mirrors
   // task 1004182 folded into 'cloud-host'. A `!== 'dedicated'` test against a value no row
   // can hold is always true, so keeping it would have been a condition that reads like a
   // guard and guards nothing.
-  assert.doesNotMatch(body, /hosting_shape/, 'no shape term survives — the one it excluded no longer exists');
+  // task 1004463: the ONE shape term is an inclusion — the platform's own row always has the
+  // door, because a module toggled in its hall waits for a restart
+  assert.match(body, /inst.last_verified_up === false || inst.hosting_shape === 'control-plane'/, 'the self row is the one healthy card with a door');
+  assert.doesNotMatch(body, /dedicated/, 'the shape it once excluded no longer exists');
   assert.match(body, /!inst\.open_intent/, 'the strip tells the story while work is in flight');
 });
 

package/tests/provision_restart.mjs

@@ -167,9 +167,9 @@ await ta('dry-run runs no real work and observes nothing', async () => {
   assert.equal(writes.length, 0);
 });
 
-await ta('a co-tenant restarts on the co-hosting box; a cloud-host on the control plane', async () => {
+await ta("a co-tenant restarts on the co-hosting box; a cloud-host and the platform's own row on the control plane", async () => {
   const seen = {};
-  for (const shape of ['co-tenant', 'cloud-host']) {
+  for (const shape of ['co-tenant', 'cloud-host', 'control-plane']) {
     const box = [], control = [];
     const { deps } = recorder();
     deps.exec = (cmd) => { box.push(cmd); return /healthz/.test(cmd) ? { ok: true, stdout: '{}' } : { ok: true, stdout: '' }; };
@@ -179,6 +179,7 @@ await ta('a co-tenant restarts on the co-hosting box; a cloud-host on the contro
   }
   assert.ok(seen['co-tenant'].box > 0 && seen['co-tenant'].control === 0, 'a co-tenant runs on the box');
   assert.ok(seen['cloud-host'].control > 0 && seen['cloud-host'].box === 0, 'a cloud-host runs control-plane-local (task 2074) — restart it THERE');
+  assert.ok(seen['control-plane'].control > 0 && seen['control-plane'].box === 0, 'the self row IS this box (task 1004463)');
 });
 
 await ta('privileged mode escalates the restart', async () => {

package/tests/provisioning_restart.mjs

@@ -89,14 +89,17 @@ t('RESTART_FROM is exactly {active} — every other state is already served by t
   }
 });
 
-t('RESTART_SHAPES is the runner-reachable pair, and the set is a subset of HOSTING_SHAPES', () => {
-  assert.deepEqual([...provisioning.RESTART_SHAPES].sort(), ['cloud-host', 'co-tenant']);
+t('RESTART_SHAPES is what the runner can reach, and the set is a subset of HOSTING_SHAPES', () => {
+  // task 1004463 added the control plane's own row: its hall's module toggles wait for a restart
+  assert.deepEqual([...provisioning.RESTART_SHAPES].sort(), ['cloud-host', 'co-tenant', 'control-plane']);
+  const G = require('../modules/provisioning/control-plane-guard.js');
+  assert.equal(G.intentAllowedForShape('restart', 'control-plane'), true, 'the self-row guard lets the restart through, so the route never promises one it refuses');
   for (const s of provisioning.RESTART_SHAPES) assert.ok(provisioning.HOSTING_SHAPES.includes(s), `${s} is a real shape`);
   // Was `!has('dedicated')`. Task 1004182 removed that value from HOSTING_SHAPES, which made
   // the assertion vacuously true — it would now pass against any set at all. Name the shapes
   // that still EXIST and are still unreachable, and assert they are real first, so this
   // cannot rot the same way twice.
-  for (const unreachable of ['byo-host', 'control-plane']) {
+  for (const unreachable of ['byo-host']) {
     assert.ok(provisioning.HOSTING_SHAPES.includes(unreachable), `${unreachable} must be a real shape or this assertion is vacuous`);
     assert.ok(!provisioning.RESTART_SHAPES.has(unreachable), unreachable);
   }

package/tests/provisioning_settings_apply.mjs

@@ -92,8 +92,8 @@ t('the two gates agree: every settings-apply shape is one the self-row guard let
   // "a restart is coming" and then answer the owner with control_plane_protected.
   const G = require('../modules/provisioning/control-plane-guard.js');
   for (const s of provisioning.SETTINGS_APPLY_SHAPES) assert.equal(G.intentAllowedForShape('settings-apply', s), true, s);
-  // and the restart door was NOT opened on the self row as a side effect
-  assert.ok(!provisioning.RESTART_SHAPES.has('control-plane'), 'task 1004334 widened the settings push only');
+  // the restart door on the self row came later, deliberately (task 1004463)
+  assert.ok(provisioning.RESTART_SHAPES.has('control-plane'), 'task 1004463 opened the restart door on the self row');
 });
 
 await ta('enqueueSettingsApply: a fresh intent → created:true; the INSERT carries the settings-apply action', async () => {

package/tests/setup_status_facts.mjs

@@ -398,3 +398,36 @@ test('part 03 names its own classes: the map table already owns .facts / .fact',
   assert.match(PANEL, /<div class="setFacts" id="homeFacts"/);
   assert.match(FACTS, /textNode\('div', 'setFact ' \+ r\.state\)/);
 });
+
+// ── 6. sign-in set up another way (task 1004410) ───────────────────────────────────────
+// A founder whose project already answers "sign-in works" was told "Waiting on GitHub" for
+// good: the step ticked only from the one-click attempt. The liveness sweep now records the
+// project's own answer ('github-sign-in-seen'), and that fact is what the step names.
+const seen = { event: 'github-sign-in-seen', at: ago(2), detail: null };
+const elsewhereCases = {
+  'a GitHub tab that never came back': attempt({ status: 'pending', attempts: 0, created_at: ago(1), expires_at: soon(29) }),
+  'a GitHub link that lapsed': attempt({ status: 'pending', attempts: 0, created_at: ago(90), expires_at: ago(30) }),
+  'no attempt at all (a hand-made OAuth app)': null,
+};
+for (const [label, manifest] of Object.entries(elsewhereCases)) {
+  test(`sign-in that works is never "waiting on GitHub": ${label}`, async () => {
+    db = JSON.parse(JSON.stringify({ inst: inst(), intent: null, manifest, events: [seen] }));
+    const v = (await page()).read();
+    assert.deepEqual(v.byKey, { address: 'done', server: 'done', answers: 'done', approve: 'done', install: 'done', sign_in: 'done', device_flow: 'todo' });
+    assert.equal(v.count, 'ready ✓');
+    assert.equal(v.said, 'Kestrel is ready. Command-line sign-in is optional; it ticks itself whenever you turn it on.');
+    const approve = v.facts.find((f) => f.key === 'approve');
+    assert.equal(approve.sub, 'Not needed. Sign-in was set up another way.', 'says why a step it skipped is done');
+    assert.deepEqual(approve.acts, [], 'no Connect, Reopen or Pick up for a step that is not needed');
+    assert.equal(v.aliveHidden, false, 'the project is alive');
+  });
+}
+
+test('with our app recorded, the project\'s answer ticks sign-in and leaves the install its own fact', async () => {
+  db = JSON.parse(JSON.stringify({ inst: inst(), intent: null, manifest: attempt({ status: 'converting', app_id: 5, app_slug: 'kestrel-cloudbongos-com', updated_at: ago(1) }), events: [seen] }));
+  const v = (await page()).read();
+  assert.equal(v.byKey.approve, 'done');
+  assert.equal(v.byKey.sign_in, 'done');
+  assert.equal(v.byKey.install, 'you', 'the install is still GitHub\'s to confirm');
+  assert.notEqual(v.facts.find((f) => f.key === 'approve').sub, 'Not needed. Sign-in was set up another way.');
+});