@bongos/core 1.21.126 → 1.21.128

package/tests/module_error_counts.mjs

@@ -0,0 +1,265 @@
+// tests/module_error_counts.mjs — instances count each store module's runtime
+// errors per day and send the daily count with the builder sign-in on the box
+// (task 1004637): the loader's attribution, the on-disk tally, and the sender.
+// Hermetic — temp dirs, a fake store client, an in-process express app.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import http from 'node:http';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const loader = require(path.join(ROOT, 'src', 'module-loader', 'loader.js'));
+const { seed, record, readTally, start, startDailySend, _reset } = require(path.join(ROOT, 'src', 'module-loader', 'error-tally.js'));
+// the in-memory tally is read the way tooling reads it: through the loader's snapshot
+const tally = { seed, record, readTally, start, startDailySend, _reset, snapshot: () => loader.loaderSnapshot().errorCounts };
+const sender = require(path.join(ROOT, 'scripts', 'gds', 'module-error-report.js'));
+const express = require('express');
+
+function tmpDir(prefix) { return fs.mkdtempSync(path.join(os.tmpdir(), prefix)); }
+
+function fixtureRoot(spec) {
+  const root = tmpDir('bongos-errmods-');
+  for (const [key, def] of Object.entries(spec)) {
+    const d = path.join(root, key);
+    fs.mkdirSync(d, { recursive: true });
+    fs.writeFileSync(path.join(d, 'module.json'), JSON.stringify({
+      key, title: key, description: 'd', version: def.version === undefined ? '1.2.0' : def.version,
+      coreVersion: '^1.0.0', contributes: def.contributes || {},
+    }));
+    for (const [rel, content] of Object.entries(def.files || {})) {
+      const fp = path.join(d, rel);
+      fs.mkdirSync(path.dirname(fp), { recursive: true });
+      fs.writeFileSync(fp, content);
+    }
+  }
+  return root;
+}
+
+const TODAY = new Date().toISOString().slice(0, 10);
+
+// ---------------------------------------------------------------------------
+// The tally
+// ---------------------------------------------------------------------------
+
+test('seed gives every exactly-versioned module a 0 today; record counts only those', () => {
+  tally._reset();
+  const n = tally.seed([
+    { key: 'alpha', manifest: { version: '1.2.0' } },
+    { key: 'loose', manifest: { version: '^1.0.0' } },
+    { key: 'none', manifest: {} },
+  ]);
+  assert.equal(n, 1);
+  assert.deepEqual(tally.snapshot()[TODAY], { 'alpha@1.2.0': 0 }, 'a clean day is a 0, not a missing row');
+  assert.equal(tally.record('alpha'), true);
+  assert.equal(tally.record('alpha'), true);
+  assert.equal(tally.record('loose'), false, 'no exact version, nothing to file it against');
+  assert.equal(tally.record('ghost'), false, 'a stray key never invents a module');
+  assert.deepEqual(tally.snapshot()[TODAY], { 'alpha@1.2.0': 2 });
+  tally._reset();
+});
+
+test('nothing touches disk until start(); start merges the file (higher count wins) and prunes old days', () => {
+  tally._reset();
+  const dir = tmpDir('bongos-tally-');
+  const file = path.join(dir, 'module-error-counts.json');
+  tally.seed([{ key: 'alpha', manifest: { version: '1.2.0' } }]);
+  tally.record('alpha');
+  assert.equal(fs.existsSync(file), false);
+  fs.writeFileSync(file, JSON.stringify({ days: {
+    [TODAY]: { 'alpha@1.2.0': 5 },
+    '2000-01-01': { 'alpha@1.0.0': 9 },
+  } }));
+  tally.start({ file });
+  const onDisk = tally.readTally(file);
+  assert.equal(onDisk[TODAY]['alpha@1.2.0'], 5, 'a restart mid-day keeps the morning count');
+  assert.equal(onDisk['2000-01-01'], undefined, 'days past the window are pruned');
+  tally._reset();
+});
+
+test('the tally on disk holds counts only — key@version and a number, nothing else', () => {
+  tally._reset();
+  const file = path.join(tmpDir('bongos-tally-'), 'c.json');
+  tally.seed([{ key: 'alpha', manifest: { version: '1.2.0' } }]);
+  tally.record('alpha');
+  tally.start({ file });
+  const raw = JSON.parse(fs.readFileSync(file, 'utf8'));
+  assert.deepEqual(Object.keys(raw), ['days']);
+  for (const row of Object.values(raw.days)) {
+    for (const [k, v] of Object.entries(row)) {
+      assert.match(k, /^[a-z0-9-]+@\d+\.\d+\.\d+$/);
+      assert.ok(Number.isInteger(v));
+    }
+  }
+  tally._reset();
+});
+
+// ---------------------------------------------------------------------------
+// The loader attributes a 500 to the module that answered it
+// ---------------------------------------------------------------------------
+
+async function withServer(app, fn) {
+  const server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  const base = `http://127.0.0.1:${server.address().port}`;
+  try { return await fn(base); } finally { await new Promise((r) => server.close(r)); }
+}
+
+test('a module route that throws or answers 500 counts against it; a 4xx, a 503 and a fall-through do not', async () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: {
+      contributes: { routes: ['main'] },
+      files: { 'routes/main.js': `
+        const express = require(${JSON.stringify(require.resolve('express'))});
+        module.exports = () => {
+          const r = express.Router();
+          r.get('/alpha/boom', () => { throw new Error('boom'); });
+          r.get('/alpha/fail', (req, res) => res.status(500).json({ error: 'x' }));
+          r.get('/alpha/bad', (req, res) => res.status(400).json({ error: 'x' }));
+          r.get('/alpha/off', (req, res) => res.status(503).json({ error: 'not set up' }));
+          r.get('/alpha/pass', (req, res, next) => next(new Error('handed on')));
+          return r;
+        };` },
+    },
+    beta: { contributes: {} },
+  });
+  const app = express();
+  const router = express.Router();
+  loader.mountModuleRoutes(router, { isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  router.get('/kernel/boom', () => { throw new Error('kernel'); });
+  app.use(router);
+  app.use((err, req, res, next) => res.status(500).json({ error: 'internal' })); // eslint-disable-line no-unused-vars
+
+  await withServer(app, async (base) => {
+    for (const p of ['/alpha/boom', '/alpha/fail', '/alpha/bad', '/alpha/off', '/alpha/pass', '/kernel/boom']) {
+      await (await fetch(base + p)).text();
+    }
+  });
+  await new Promise((r) => setImmediate(r));
+  const day = tally.snapshot()[TODAY];
+  assert.equal(day['alpha@1.2.0'], 3, 'boom + fail + next(err) — not the 400, not the 503, not the kernel route');
+  assert.equal(day['beta@1.2.0'], 0, 'an enabled module with no routes still files its clean day');
+  loader._reset();
+});
+
+test('the wrapped router still exposes the module’s own routes to tooling', () => {
+  loader._reset();
+  const root = fixtureRoot({
+    alpha: {
+      contributes: { routes: ['main'] },
+      files: { 'routes/main.js': `
+        const express = require(${JSON.stringify(require.resolve('express'))});
+        module.exports = () => { const r = express.Router(); r.get('/alpha/x', (q, s) => s.end()); return r; };` },
+    },
+  });
+  const used = [];
+  loader.mountModuleRoutes({ use: (r) => used.push(r) }, { isEnabled: () => true }, { roots: [root], core: '1.0.0' });
+  assert.equal(used.length, 1);
+  const paths = (used[0].stack || []).filter((l) => l.route).map((l) => l.route.path);
+  assert.deepEqual(paths, ['/alpha/x']);
+  loader._reset();
+});
+
+test('a poller that throws on start counts, and a running poller can report through reportError', async () => {
+  loader._reset();
+  const root = fixtureRoot({
+    broken: { contributes: { pollers: ['p'] }, files: { 'pollers/p.js': 'module.exports = { start() { throw new Error("x"); } };' } },
+    rejecting: { contributes: { pollers: ['p'] }, files: { 'pollers/p.js': 'module.exports = { start() { return Promise.reject(new Error("x")); } };' } },
+    reporting: { contributes: { pollers: ['p'] }, files: { 'pollers/p.js': 'module.exports = { start(deps) { deps.reportError(); deps.reportError(); } };' } },
+  });
+  const opts = { roots: [root], core: '1.0.0' };
+  loader.mountModuleRoutes({ use: () => {} }, { isEnabled: () => true }, opts);
+  const origErr = console.error;
+  console.error = () => {};
+  try {
+    loader.startModulePollers({}, { isEnabled: () => true }, opts);
+    await new Promise((r) => setImmediate(r));
+  } finally { console.error = origErr; }
+  const day = tally.snapshot()[TODAY];
+  assert.equal(day['broken@1.2.0'], 1);
+  assert.equal(day['rejecting@1.2.0'], 1);
+  assert.equal(day['reporting@1.2.0'], 2);
+  loader._reset();
+});
+
+// ---------------------------------------------------------------------------
+// The sender
+// ---------------------------------------------------------------------------
+
+function fakeStore({ enabled = true, known = ['alpha'], post = () => ({ ok: true, status: 200 }) } = {}) {
+  const calls = [];
+  const call = async (method, p, opts = {}) => {
+    calls.push({ method, p, json: opts.json });
+    if (p === '/store/usage-reporting') return { ok: true, status: 200, data: { enabled } };
+    if (p.startsWith('/store/modules/latest')) {
+      return { ok: true, status: 200, data: { latest: Object.fromEntries(known.map((k) => [k, { version: '1.2.0' }])) } };
+    }
+    return post(p, opts.json);
+  };
+  return { call, calls };
+}
+
+test('pendingDays: finished, unsent days inside the store window, oldest first', () => {
+  const days = { '2026-10-14': {}, '2026-10-15': {}, '2026-10-12': {}, '2026-09-01': {} };
+  assert.deepEqual(sender.pendingDays(days, { '2026-10-12': true }, '2026-10-15'), ['2026-10-14']);
+});
+
+test('sendPending sends every count for a store module, zeros included, and skips modules the store does not know', async () => {
+  const { call, calls } = fakeStore();
+  const days = { '2026-10-14': { 'alpha@1.2.0': 0, 'core-thing@3.0.0': 4 } };
+  const out = await sender.sendPending({ days, today: '2026-10-15', call });
+  const posts = calls.filter((c) => c.method === 'POST');
+  assert.equal(posts.length, 1);
+  assert.equal(posts[0].p, '/store/modules/alpha/versions/1.2.0/error-count');
+  assert.deepEqual(posts[0].json, { day: '2026-10-14', count: 0 }, 'a clean day goes as a 0');
+  assert.deepEqual(out.sentDays, ['2026-10-14']);
+  assert.equal(out.skipped, 1);
+});
+
+test('an opted-out builder sends nothing, and the days are marked done', async () => {
+  const { call, calls } = fakeStore({ enabled: false });
+  const out = await sender.sendPending({ days: { '2026-10-14': { 'alpha@1.2.0': 2 } }, today: '2026-10-15', call });
+  assert.equal(calls.filter((c) => c.method === 'POST').length, 0);
+  assert.equal(out.optedOut, true);
+  assert.deepEqual(out.sentDays, ['2026-10-14']);
+});
+
+test('a refusal for good (4xx) is done; a server error leaves the day for the next run', async () => {
+  const refused = fakeStore({ post: () => ({ ok: false, status: 403 }) });
+  const a = await sender.sendPending({ days: { '2026-10-14': { 'alpha@1.2.0': 1 } }, today: '2026-10-15', call: refused.call });
+  assert.deepEqual(a.sentDays, ['2026-10-14']);
+  const down = fakeStore({ post: () => ({ ok: false, status: 502 }) });
+  const b = await sender.sendPending({ days: { '2026-10-14': { 'alpha@1.2.0': 1 } }, today: '2026-10-15', call: down.call });
+  assert.deepEqual(b.sentDays, []);
+  assert.equal(b.retryLater, true);
+});
+
+test('main records the days it sent, and a second run sends nothing again', async () => {
+  const dir = tmpDir('bongos-sender-');
+  const tallyFile = path.join(dir, 'counts.json');
+  const sentFile = path.join(dir, 'sent.json');
+  fs.writeFileSync(tallyFile, JSON.stringify({ days: { '2026-10-14': { 'alpha@1.2.0': 3 }, '2026-10-15': { 'alpha@1.2.0': 1 } } }));
+  const first = fakeStore();
+  const log = () => {};
+  assert.equal(await sender.main([], { log, request: first.call, tallyFile, sentFile, today: '2026-10-15' }), 0);
+  assert.equal(first.calls.filter((c) => c.method === 'POST').length, 1, 'today is not finished, so only yesterday goes');
+  assert.deepEqual(JSON.parse(fs.readFileSync(sentFile, 'utf8')).sent, { '2026-10-14': true });
+  const second = fakeStore();
+  assert.equal(await sender.main([], { log, request: second.call, tallyFile, sentFile, today: '2026-10-15' }), 0);
+  assert.equal(second.calls.length, 0);
+});
+
+test('the server runs the sender as a child process, never in its own process', () => {
+  tally._reset();
+  const ran = [];
+  const timers = tally.startDailySend({ spawnImpl: (s) => ran.push(s) });
+  assert.equal(timers.length, 2, 'a first run soon after boot, then every few hours');
+  tally._reset();
+  const src = fs.readFileSync(path.join(ROOT, 'src', 'module-loader', 'error-tally.js'), 'utf8');
+  assert.doesNotMatch(src, /require\([^)]*cli-lib/, 'the session plumbing never loads in the server');
+});

package/tests/own_scope_guard.mjs

@@ -164,6 +164,12 @@ const OWN_SCOPED_SURFACES = [
       },
     ],
   },
+  {
+    file: 'modules/onboarding/routes/onboarding.js',
+    why: "the how-to read state (task 1004634). GET /me/howto and POST /me/howto/read|reset read and write the CALLER's own marks, keyed on req.builder.id; the body names step ids, never a builder. The rest of the router is /founding/*, whose one path param names a founding STAGE, not a builder.",
+    minOwnScoped: 1,
+    crossOwner: [],
+  },
 ];
 
 // Floors that keep this guard from going quietly vacuous (a regex that stops

package/tests/provision.mjs

@@ -637,6 +637,8 @@ t('systemd manager: emits byte-identical commands + unit paths to the inline str
     'sudo rm -f /etc/systemd/system/demo.service [allowFail]',
     'sudo systemctl disable --now demo-db-backup.timer [allowFail]',
     'sudo rm -f /etc/systemd/system/demo-db-backup.service /etc/systemd/system/demo-db-backup.timer [allowFail]',
+    'sudo rm -f /etc/systemd/system.control/demo.service.d/50-*.conf [allowFail]',   // the caps drop-in (task 1004414)
+    'sudo rmdir /etc/systemd/system.control/demo.service.d [allowFail]',
     'sudo systemctl daemon-reload [allowFail]',
     'sudo systemctl reset-failed demo.service demo-db-backup.service [allowFail]',
   ], 'including reset-failed — a removed unit\'s FAILED state outlives its file (task 1003940)');

package/tests/provision_resource_caps.mjs

@@ -0,0 +1,117 @@
+// tests/provision_resource_caps.mjs
+//
+// Every hosted project's service is capped (task 1004414). A cloud-host project runs its
+// owner's code on the box that also serves the hub, and ADR 0354 lets any signed-in
+// builder host one, so one runaway project must not starve the others or the hub.
+//
+// Covers:
+//   • the numbers are the owner's (2026-10-15): MemoryHigh 160M, MemoryMax 256M,
+//     CPUQuota 50%, TasksMax 256 — pinned here so a change is a decision, not a drift
+//   • a NEW unit carries all four, rendered from the same table
+//   • an EXISTING unit takes them live with `systemctl set-property` (no restart, and no
+//     rewrite of a unit whose User= predates the per-instance accounts)
+//   • `provision.js apply-caps` reaches every ACTIVE cloud-host project, on the control
+//     plane, carries on past one that fails, and says which failed
+//   • teardown removes the drop-in set-property wrote
+//
+// Run:  node tests/provision_resource_caps.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+// ESM named imports, so knip credits these exports to their test (a createRequire read is not)
+import { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps } from '../scripts/gds/provision-caps.js';
+
+const require = createRequire(import.meta.url);
+const CAPS = { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps };
+const { serviceUnit } = require('../scripts/gds/provision-units.js');
+const PM = require('../scripts/gds/provision-process.js');
+// the REAL shape makeExec answers an allowFail'd failure with: ok:true, softFailed:true
+const { softFailResult } = require('../scripts/gds/provision-config.js');
+
+const CLOUD = { id: 18, slug: 'mercury', hosting_shape: 'cloud-host', port: 4100, db_name: 'mercury', target_ref: 'owner/mercury' };
+const OWNER_NUMBERS = ['MemoryHigh=160M', 'MemoryMax=256M', 'CPUQuota=50%', 'TasksMax=256'];
+
+test('the caps are the owner’s numbers (2026-10-15)', () => {
+  assert.deepEqual(CAPS.capDirectives(), OWNER_NUMBERS);
+  assert.ok(Object.isFrozen(CAPS.RESOURCE_CAPS), 'the table cannot be edited at runtime');
+});
+
+test('a new hosted project’s unit carries all four caps in [Service]', () => {
+  const unit = serviceUnit(CLOUD, { etcBase: '/etc' });
+  const service = unit.slice(unit.indexOf('[Service]'), unit.indexOf('[Install]'));
+  for (const d of OWNER_NUMBERS) assert.match(service, new RegExp(`^${d.replace(/[.*+?^${}()|[\]\\%]/g, '\\$&')}$`, 'm'), d);
+});
+
+test('an existing unit takes the caps live through set-property', () => {
+  assert.equal(CAPS.setCapsCmd(CLOUD, { sudoP: 'sudo ' }),
+    'sudo systemctl set-property mercury.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256');
+  assert.equal(CAPS.setCapsCmd(CLOUD), 'systemctl set-property mercury.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256');
+});
+
+function fleet(rows, failSlug = null) {
+  const queries = [];
+  const ran = [];
+  const logs = [];
+  const exec = (cmd, opts = {}) => {
+    ran.push({ cmd, allowFail: !!opts.allowFail, on: 'control' });
+    return cmd.includes(` ${failSlug}.service `) ? softFailResult(new Error(`Unit ${failSlug}.service not loaded.`), false) : { ok: true, stdout: '' };
+  };
+  const deps = {
+    db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows }; } },
+    controlExec: exec,
+    exec: () => { throw new Error('the box executor is for co-tenant; a cloud-host runs on the control plane'); },
+    privileged: true,
+    log: (s) => logs.push(s),
+  };
+  return { deps, queries, ran, logs };
+}
+
+test('apply-caps reaches every active cloud-host project on the control plane', async () => {
+  const f = fleet([{ slug: 'mercury' }, { slug: 'venus' }]);
+  const r = await CAPS.cmdApplyCaps(f.deps);
+  assert.match(f.queries[0].sql, /hosting_shape = 'cloud-host'/);
+  assert.match(f.queries[0].sql, /status = 'active'/);
+  assert.deepEqual(f.ran.map((x) => x.cmd), [
+    'sudo systemctl set-property mercury.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256',
+    'sudo systemctl set-property venus.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256',
+  ]);
+  assert.ok(f.ran.every((x) => x.allowFail), 'one project that refuses must not stop the rest');
+  assert.deepEqual(r, { ok: true, capped: ['mercury', 'venus'], failed: [] });
+});
+
+test('apply-caps carries on past a failure and names it', async () => {
+  const f = fleet([{ slug: 'mercury' }, { slug: 'venus' }, { slug: 'pluto' }], 'venus');
+  const r = await CAPS.cmdApplyCaps(f.deps);
+  assert.equal(f.ran.length, 3);
+  assert.deepEqual(r, { ok: false, capped: ['mercury', 'pluto'], failed: ['venus'] });
+  assert.ok(f.logs.some((l) => /venus/.test(l)), 'the failure is said out loud');
+});
+
+test('a slug outside the create route’s charset is refused, never run as root', () => {
+  for (const slug of ['a;rm -rf /', '../etc', 'Mercury', '-x']) assert.throws(() => CAPS.setCapsCmd({ slug }), /unsafe slug/, slug);
+});
+
+test('apply-caps on an empty fleet does nothing and succeeds', async () => {
+  const f = fleet([]);
+  assert.deepEqual(await CAPS.cmdApplyCaps(f.deps), { ok: true, capped: [], failed: [] });
+  assert.equal(f.ran.length, 0);
+});
+
+test('provision.js lists apply-caps as a command', () => {
+  const r = spawnSync(process.execPath, ['scripts/gds/provision.js', 'help'], { encoding: 'utf8' });
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /apply-caps/);
+});
+
+test('teardown removes the drop-in set-property wrote, before the reload', () => {
+  const cmds = [];
+  const exec = (cmd, opts = {}) => { cmds.push(cmd); return { ok: true }; };
+  PM.systemd.removeService(CLOUD, { exec, sudoP: 'sudo ' });
+  const rm = cmds.indexOf('sudo rm -f /etc/systemd/system.control/mercury.service.d/50-*.conf');
+  assert.ok(rm >= 0, cmds.join('\n'));
+  assert.ok(cmds.includes('sudo rmdir /etc/systemd/system.control/mercury.service.d'), 'the emptied dir goes too');
+  assert.ok(!cmds.some((c) => /rm -rf/.test(c)), 'never a recursive delete');
+  assert.ok(rm < cmds.indexOf('sudo systemctl daemon-reload'), 'removed before the reload that forgets the unit');
+});