@bongos/core 1.21.14 → 1.21.16

package/tests/upgrade.mjs

@@ -1926,6 +1926,153 @@ t('parseArgs: --allow-downgrade is read, and is OFF unless asked for', () => {
   assert.equal(u.parseArgs(['--to', '1.0.0', '--allow-downgrade']).allowDowngrade, true);
 });
 
+// ---- 11. WHICH ACCOUNT DOES WHAT (task 1004512) -----------------------------
+//
+// Found live on cloudbongos.com: every core move on a project provisioned since task
+// 1003369 failed, and reported a dirty tree it had invented. The move ran wholly as the
+// project's own `bongos-<slug>` account, which can only READ the checkout, so `git status`
+// refused with `detected dubious ownership`, the clean-tree pre-flight read that as dirt,
+// the self-heal chain committed a tree nobody had touched, and the retry failed identically.
+// Both halves are pinned here: git's refusal is its own failure, and the database steps run
+// as the account that actually owns the database.
+
+t('a `git status` that could NOT ANSWER is not reported as uncommitted work', async () => {
+  const dir = scratchConsumer();
+  const res = await u.runUpgrade({ to: '1.15.0', instance: dir }, {
+    log: () => {}, err: () => {},
+    run: (cmd, args) => (cmd === 'git' && args[0] === 'status'
+      ? { status: 128, stdout: '', stderr: `fatal: detected dubious ownership in repository at '${dir}'\n` }
+      : { status: 0 }),
+  });
+  assert.equal(res.ok, false, 'it still refuses — nothing is known about the tree');
+  assert.match(res.error, /git could not read the working tree/, 'and says which question went unanswered');
+  assert.match(res.error, /dubious ownership/, 'carrying git\'s OWN words, not "not a git repo?"');
+  assert.doesNotMatch(res.error, /^working tree not clean/m, 'it must never claim there is uncommitted work');
+});
+
+t('…and that refusal is classified as unknown, so no remedy commits a guess', async () => {
+  const o = require('../scripts/gds/upgrade-outcome.js');
+  const dir = scratchConsumer();
+  const res = await u.runUpgrade({ to: '1.15.0', instance: dir }, {
+    log: () => {}, err: () => {},
+    run: (cmd, args) => (cmd === 'git' && args[0] === 'status'
+      ? { status: 128, stdout: '', stderr: 'fatal: detected dubious ownership in repository\n' }
+      : { status: 0 }),
+  });
+  // The whole point: dirty_tree is known_wedge, and wedge-remedy.js answers it by running
+  // `git add -u && git commit`. Doing that to a tree git would not describe commits whatever
+  // happens to be lying there, under a runner identity, in someone else's repository.
+  const reason = o.upgradeReason(res);
+  assert.equal(reason, 'git_unreadable', `got ${reason} — a failed "git status" is not a dirty tree`);
+  assert.equal(o.classifyFailure(reason).class, 'unknown', 'unknown reaches a person; known_wedge would "fix" it');
+  assert.notEqual(o.classifyFailure(reason).class, 'known_wedge');
+});
+
+t('--migrate-as hands the DATABASE steps to another account, and nothing else', async () => {
+  const dir = scratchConsumer();
+  const calls = [];
+  const res = await u.runUpgrade(
+    { to: '1.15.0', registry: true, instance: dir, migrateAs: 'bongos-p', healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: (cmd, args) => {
+        calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+        if (cmd === 'git' && args[0] === 'status') return { status: 0, stdout: '' };
+        if (cmd === 'npm' && args[0] === 'install') {
+          writeFileSync(join(dir, 'node_modules', '@bongos', 'core', 'package.json'),
+            JSON.stringify({ name: '@bongos/core', version: '1.15.0' }) + '\n');
+        }
+        return { status: 0, stdout: '' };
+      },
+      materialize: () => ({ skills: 0, writtenPaths: [] }),
+      regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+      resolveInstanceDb: () => ({ db: 'p', ran: true }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.equal(res.ok, true, `the bump ran: ${res.error || ''}`);
+  const migrate = calls.find((c) => /\bnpm run migrate\b/.test(c));
+  assert.ok(migrate, `migrate ran: ${JSON.stringify(calls)}`);
+  assert.match(migrate, /^sudo -n -u bongos-p env /, 'migrate connects as the account that owns the database');
+  const identity = calls.find((c) => /psql -tAc/.test(c));
+  assert.match(identity, /^sudo -n -u bongos-p env /, 'and so does the pre-check that decides whether it could');
+  // The other half of the split: the file work stays with whoever is running, because the
+  // project's own account cannot write this checkout.
+  for (const bare of ['git status', 'npm install']) {
+    assert.ok(calls.some((c) => c.startsWith(bare)), `${bare} runs as the move itself, unescalated`);
+    assert.ok(!calls.some((c) => c.includes(`bongos-p env ${bare}`)), `${bare} must NOT be handed to the project's account`);
+  }
+});
+
+t('with no --migrate-as, every step is spawned exactly as it was before', async () => {
+  // The shape half the fleet is on (a control plane, a project older than the per-instance
+  // account model). A flag that quietly started escalating there would be a new failure.
+  const dir = scratchConsumer();
+  const calls = [];
+  await u.runUpgrade(
+    { to: '1.15.0', registry: true, instance: dir, healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: (cmd, args) => {
+        calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+        if (cmd === 'npm' && args[0] === 'install') {
+          writeFileSync(join(dir, 'node_modules', '@bongos', 'core', 'package.json'),
+            JSON.stringify({ name: '@bongos/core', version: '1.15.0' }) + '\n');
+        }
+        return { status: 0, stdout: '' };
+      },
+      materialize: () => ({ skills: 0, writtenPaths: [] }),
+      regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+      resolveInstanceDb: () => ({ db: 'p', ran: true }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.ok(!calls.some((c) => c.startsWith('sudo')), `nothing escalated: ${JSON.stringify(calls.filter((c) => c.startsWith('sudo')))}`);
+  assert.ok(calls.some((c) => /^npm run migrate$/.test(c)), 'migrate is still the bare command');
+});
+
+t('sudo refusing the hand-over is caught BEFORE the pin moves, not at migrate', async () => {
+  // The one failure this split can add. Soft-skipping it (as "psql failed for another
+  // reason") would move the pin, install the new core, and then fail at migrate for a
+  // reason that was knowable up front — a full rollback, restarting a live service twice,
+  // to learn something one `select 1` already said.
+  const dir = scratchConsumer();
+  const calls = [];
+  const res = await u.runUpgrade(
+    { to: '1.15.0', registry: true, instance: dir, migrateAs: 'bongos-p', healthCheck: false },
+    {
+      log: () => {}, err: () => {},
+      run: (cmd, args) => {
+        calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+        if (cmd === 'sudo') return { status: 1, stdout: '', stderr: 'sudo: a password is required\n' };
+        return { status: 0, stdout: '' };
+      },
+      resolveInstanceDb: () => ({ db: 'p', ran: true }),
+      materialize: () => ({ skills: 0, writtenPaths: [] }),
+      databaseUrl: '', pgDatabase: '',
+    }
+  );
+  assert.equal(res.ok, false);
+  assert.match(res.error, /cannot run as "bongos-p"/);
+  assert.match(res.error, /a password is required/, 'carrying what sudo actually said');
+  assert.ok(!calls.some((c) => c.startsWith('npm install')), 'and nothing was installed — the pin never moved');
+  assert.equal(u.readPinnedCoreVersion(dir), '1.14.1', 'the pin is untouched');
+});
+
+t('an account name that is not one is refused before anything moves', () => {
+  // It reaches `sudo` as an argv entry, so it is refused rather than quoted into shape.
+  return u.runUpgrade({ to: '1.15.0', instance: scratchConsumer(), migrateAs: 'root; rm -rf /' }, { log: () => {}, err: () => {} })
+    .then((res) => {
+      assert.equal(res.ok, false);
+      assert.match(res.error, /not a unix account name/);
+    });
+});
+
+t('parseArgs: --migrate-as is read, and is absent unless passed', () => {
+  assert.equal(u.parseArgs(['--to', '1.0.0']).migrateAs, null);
+  assert.equal(u.parseArgs(['--to', '1.0.0', '--migrate-as', 'bongos-p']).migrateAs, 'bongos-p');
+});
+
 await Promise.all(pending);
 console.log(`\nupgrade: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);

package/tests/upgrade_outcome.mjs

@@ -33,6 +33,9 @@ const TABLE = [
   ['downgrade refusal', { ok: false, downgrade: true, error: 'refusing to DOWNGRADE: --to 1.19.1 is older' }, 'refused', 'downgrade', 'needs_decision'],
   ['already on the target', { ok: false, error: 'already on 1.20.1 (pass --force to re-run the steps anyway)' }, 'refused', 'already_on', 'unknown'],
   ['dirty working tree', { ok: false, error: 'working tree not clean — commit/stash first, or pass --force.\n M package.json' }, 'refused', 'dirty_tree', 'known_wedge'],
+  // task 1004512: git REFUSING to read the checkout is not a report that the checkout is
+  // dirty, and must not be classified as one — see the dedicated section at the end.
+  ['git would not read the tree', { ok: false, error: 'git could not read the working tree in /srv/cloudbongos/p — the clean-tree pre-flight never ran, so this is NOT a report of uncommitted work.\nfatal: detected dubious ownership in repository at \'/srv/cloudbongos/p\'' }, 'refused', 'git_unreadable', 'unknown'],
   ['module pre-check', { ok: false, error: 'module pre-check failed: game incompatible with core 1.20.1' }, 'refused', 'module_incompatible', 'needs_decision'],
   ['database unresolvable', { ok: false, error: 'cannot determine which database to migrate.\n    Set PGDATABASE' }, 'refused', 'db_unresolvable', 'unknown'],
   ['database identity', { ok: false, error: 'database "cb" is not reachable as the current user: role "root" does not exist' }, 'refused', 'db_identity', 'unknown'],

package/tests/wedge_remedy.mjs

@@ -37,10 +37,10 @@ const intent = (over = {}) => ({ id: 99, action: 'core-upgrade', target_version:
 const wedge = (reason) => ({ ok: false, error: `core upgrade to 1.20.31 was refused (${reason})`, failure: { class: 'known_wedge', reason } });
 const selfRoot = () => '/srv/charter';
 
-function harness({ execFails = false } = {}) {
+function harness({ execFails = false, privileged = false } = {}) {
   const ran = []; const events = []; const queries = [];
   const deps = {
-    apply: true, privileged: false, log: () => {}, selfInstanceRoot: selfRoot,
+    apply: true, privileged, log: () => {}, selfInstanceRoot: selfRoot,
     exec: (cmd, opts) => { ran.push({ cmd, ...opts }); return execFails ? { ok: false, softFailed: true, stderr: 'fatal: nope' } : { ok: true, stdout: '' }; },
     db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows: [] }; } },
     provisioning: { recordEvent: async (_db, e) => { events.push(e); } },
@@ -143,6 +143,40 @@ for (const reason of W.REMEDY_REASONS) {
   });
 }
 
+await t('schema_pending on a PRIVILEGED runner migrates as the account that owns the DATABASE (task 1004512)', async () => {
+  // THE ONE PATH THAT CALLS runAsFor, and until this test nothing did: every other case
+  // above runs unprivileged, where planRemedy takes its no-sudo branch and the account is
+  // never resolved at all. So the account-selection change this task is about — runAsFor
+  // reading `migrateAs` instead of `runAs` — shipped with no coverage.
+  //
+  // The two answers are DIFFERENT accounts, and only one of them can connect: the project's
+  // database is owned by its own Postgres login role with CONNECT revoked from PUBLIC, so a
+  // migration run as the app user (which owns the checkout) fails outright. Asserting the
+  // assembled command, because that is where the wrong account would actually show up.
+  const h = harness({ privileged: true });
+  const r = await W.remedyAfterFailure({ intent: intent(), inst: inst(), result: wedge('schema_pending'), deps: h.deps });
+  assert.deepEqual(r, { repended: true });
+  // Two commands now: the `id -u` probe resolveRunAs spends to learn whether the project
+  // HAS an account of its own, then the migration itself.
+  assert.ok(h.ran.some((c) => /^id -u bongos-charter$/.test(c.cmd)), `the account is probed, not assumed: ${JSON.stringify(h.ran.map((c) => c.cmd))}`);
+  const migrate = (h.ran.find((c) => /migrate/.test(c.cmd)) || {}).cmd || '';
+  assert.match(migrate, /^sudo -u bongos-charter env PGDATABASE=charter /,
+    `must migrate as the project's own account — got: ${migrate}`);
+  assert.doesNotMatch(migrate, /sudo -u lars\b/,
+    'the app user owns the checkout, not the database — it has no role to connect with');
+});
+
+await t('…and the OTHER two fixes never escalate, privileged or not', async () => {
+  // The split is per-step, not per-run: dirty_tree touches the checkout and disk_full
+  // touches the backup dir, both of which belong to the runner. A sudo appearing here
+  // would mean the account change had leaked beyond the database.
+  for (const reason of ['dirty_tree', 'disk_full']) {
+    const h = harness({ privileged: true });
+    await W.remedyAfterFailure({ intent: intent(), inst: inst(), result: wedge(reason), deps: h.deps });
+    assert.doesNotMatch(h.ran[0].cmd, /sudo/, `${reason} runs as the runner, which owns what it touches`);
+  }
+});
+
 await t('the same reason again after a fix: no second fix — retired as unknown for a person', async () => {
   const h = harness();
   const r = await W.remedyAfterFailure({ intent: intent({ remedied_reason: 'dirty_tree' }), inst: inst(), result: wedge('dirty_tree'), deps: h.deps });

package/tests/wizard_draft_resume.mjs

@@ -204,3 +204,52 @@ test('the team pill is a plain pick on the Team size row — a second click keep
   assert.deepEqual([...HUB.matchAll(/data-team="([a-z-]+)"/g)].map((m) => m[1]), ['small-team', 'community'],
     'the row offers who can join a team; one person is the "One person" pill, not a team shape');
 });
+
+// ── slice 4 · a second draft beside a stored create keeps its place (task 1004549) ──
+// Owner report 2026-10-02: "Allow repo access" seemed to throw the founder out of the
+// flow. GitHub already held the approval, so the round-trip was a blink — and the page
+// came back on the EARLIER project's done panel, because enter() sent every arrival with
+// a stored create (cb-created-instance) to enterCreated(), which treats a non-deliberate
+// arrival as "the same visit, show the watched project". With a draft part-way through
+// the wizard, the same visit IS the draft.
+const ENTER_RE = /function enter\(focus\) \{[\s\S]*?\n {4}\}/;
+const enterSlice = (HUB.match(ENTER_RE) || [null])[0];
+
+test('the enter() slice is still findable', () => {
+  assert.ok(enterSlice, 'enter() was not found in projects.html');
+  assert.match(enterSlice, /enterCreated\(/, 'enter() is where the stored create is routed');
+});
+
+function runEnter({ draftStep, focus = false, resumeIntent = false, created = { id: 101, name: 'Old one' } }) {
+  const log = { shown: [], created: [], offer: undefined };
+  const sandbox = {
+    authKnown: true, me: { github_login: 'probe' }, resumeIntent,
+    state: { step: draftStep },
+    createdRecord: () => created,
+    enterCreated: (rec, f) => log.created.push({ id: rec.id, focus: f }),
+    paintResumeOffer: (rec) => { log.offer = rec; },
+    show: (step) => { sandbox.state.step = step; log.shown.push(step); },
+    saveDraft() {},
+    $: () => ({ focus() {} }),
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(enterSlice + '\nenter(' + JSON.stringify(focus) + ');', sandbox);
+  return log;
+}
+
+test('back from GitHub mid-draft, with an earlier project stored: the draft step, not the old done panel', () => {
+  for (const step of [2, 3, 4, 5]) {
+    const log = runEnter({ draftStep: step });
+    assert.deepEqual(log.created, [], `step ${step}: the earlier project's panel is not entered`);
+    assert.deepEqual(log.shown, [step], `step ${step}: the draft keeps its place`);
+    assert.equal(log.offer && log.offer.id, 101, 'the earlier project stays one click away on the resume line');
+  }
+});
+
+test('the done panel still comes back when no second draft is in flight, or on a deliberate nav', () => {
+  assert.equal(runEnter({ draftStep: 6 }).created.length, 1, 'a reload on the done panel stays on it');
+  assert.equal(runEnter({ draftStep: 0 }).created.length, 1, 'no draft position: the watched project');
+  assert.deepEqual(runEnter({ draftStep: 4, focus: true }).created, [{ id: 101, focus: true }], 'a deliberate New project nav is enterCreated\'s to decide');
+  assert.equal(runEnter({ draftStep: 4, resumeIntent: true }).created.length, 1, 'the resume link still resumes');
+});

package/tests/wizard_intent_resume.mjs

@@ -61,8 +61,10 @@ test('both slices are still findable (a rename must fail loudly, not silently pa
   assert.match(enterSlice, /startProgress\(created\.id\);/, 'so is the resume branch it guards');
   assert.match(enterSlice, /draft\.step >= 1 && draft\.step <= 5 \?/,
     'the STORED draft\'s step decides, not state.step — state.step is 6 for the whole life of a finished standup');
-  assert.match(SCRIPT, /if \(created && created\.id\) \{ enterCreated\(created, !!focus\); return; \}/,
-    'enter() still hands the created record straight to it');
+  // since task 1004549 a second draft in flight keeps its place on a non-deliberate
+  // arrival (tests/wizard_draft_resume.mjs slice 4); a deliberate nav still comes here
+  assert.match(SCRIPT, /if \(created && created\.id && \(focus \|\| !draftInFlight \|\| resumeIntent\)\) \{ enterCreated\(created, !!focus\); return; \}/,
+    'enter() still hands the created record to it on a deliberate nav');
 });
 
 // A faithful miniature: the stubs record what enterCreated ASKS FOR, which is the whole