@bongos/core 1.21.172 → 1.21.174

package/tests/auth_switch_account.mjs

@@ -0,0 +1,38 @@
+// tests/auth_switch_account.mjs — the home page's "New account" door (task 1004789).
+//
+// WHY. GitHub silently re-uses whoever is logged in to github.com in the browser,
+// so a second Cloud Bongos account was unreachable. ?switch=1 on /auth/web/start
+// must add prompt=select_account (GitHub's account picker); a plain sign-in must not.
+import { strict as assert } from 'node:assert';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+process.env.BONGOS_GITHUB_CLIENT_ID = process.env.BONGOS_GITHUB_CLIENT_ID || 'test-client';
+process.env.BONGOS_GITHUB_CLIENT_SECRET = process.env.BONGOS_GITHUB_CLIENT_SECRET || 'test-secret';
+const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
+
+test('switchAccount adds prompt=select_account; a plain sign-in does not', () => {
+  const plain = new URL(auth.buildAuthorizeUrl('s', 'https://x/cb'));
+  assert.equal(plain.searchParams.get('prompt'), null);
+  const sw = new URL(auth.buildAuthorizeUrl('s', 'https://x/cb', { switchAccount: true }));
+  assert.equal(sw.searchParams.get('prompt'), 'select_account');
+  assert.equal(sw.searchParams.get('scope'), plain.searchParams.get('scope'));
+});
+
+test('the start route reads ?switch=1 and passes it to the GitHub leg', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'src/bongos/routes/auth.js'), 'utf8');
+  assert.match(src, /const wantsSwitch = req\.query\.switch === '1'/);
+  assert.match(src, /switchAccount: wantsSwitch/);
+  // a switch must reach GitHub, never short-circuit through the live-session handoff
+  assert.match(src, /if \(!wantsRepos && !wantsSwitch\) \{/);
+});
+
+test('the landing carries the New account door beside Sign in', () => {
+  const html = fs.readFileSync(path.join(ROOT, 'modules/public-landing/public/index.html'), 'utf8');
+  assert.match(html, /<a class="pill newacct" href="\/api\/bongos\/auth\/web\/start\?return=\/&amp;repos=1&amp;switch=1"[^>]*>New account<\/a>/);
+});

package/tests/copy_desk_page_claim.mjs

@@ -86,8 +86,13 @@ try {
     assert.equal(db.tasks.length, 1);
     assert.deepEqual(
       [t.source, t.source_ref, t.title, t.kind, t.discipline, t.credits_reward, t.version_id, t.goal_id, t.status],
-      ['page-tweak', 'page-tweak/builders:studio/r1', 'Tweak: Studio (builders:studio)', 'feature', 'artist', 30, 'V9', '77', 'active']
+      ['page-tweak', 'page-tweak/builders:studio/r1', 'Tweak: Studio (builders:studio)', 'feature', 'artist', 30, 'V9', '88', 'active']
     );
+    // task 1004819: the round lands in the version's artist review goal, made on
+    // first use with its two standing criteria — never the catch-all.
+    assert.equal(db.artistGoal.title, 'V9 — artist review');
+    assert.deepEqual(db.criteria.map((x) => [x.criterion_id, x.goal_id]),
+      [['artist-every-page-reviewed', '88'], ['artist-pages-simple-to-use', '88']]);
     assert.deepEqual(t.touches, F.STUDIO_FILES, 'touches are the inventory page files');
     const c = db.claims[0];
     assert.deepEqual([c.builder_id, c.worktree_name, c.creator_session_id], [ALICE, null, null], 'a web claim: no worktree, no session');

package/tests/copy_desk_page_submit.mjs

@@ -208,7 +208,7 @@ try {
       `page-tweak-unplaced/${studioTask().id}/L0005`,
     ]);
     for (const t of eng) {
-      assert.deepEqual([t.status, t.discipline, t.kind, t.version_id, t.goal_id, t.created_by], ['backlog', 'engineer', 'feature', 'V9', '77', ALICE]);
+      assert.deepEqual([t.status, t.discipline, t.kind, t.version_id, t.goal_id, t.created_by], ['backlog', 'engineer', 'feature', 'V9', '88', ALICE], 'an unplaced line lands in the artist review goal (task 1004819)');
       assert.match(t.description, /builders:studio/);
     }
     const quiet = eng.find((t) => t.source_ref.endsWith('/L0005'));

package/tests/fixtures/page-ledger.mjs

@@ -36,6 +36,7 @@ export function installPageLedger(api, { builders }) {
   // first commits or rolls back.
   const locks = new Map();
   async function lock(key, owner) {
+    if (locks.has(key) && locks.get(key).owner === owner) return; // re-entrant, as Postgres is for one session
     while (locks.has(key)) await locks.get(key).done;
     let release;
     const done = new Promise((r) => { release = r; });
@@ -109,6 +110,18 @@ export function installPageLedger(api, { builders }) {
     if (/FROM goals g JOIN versions v ON v\.id = g\.version_id WHERE g\.version_id = \$1 AND g\.title = \$2/.test(q)) {
       return { rows: [{ id: '77', version_status: 'building' }] };
     }
+    // task 1004819: studio work lands in the version's artist review goal, found
+    // (or made, with its two criteria) on the same transaction client.
+    if (/^SELECT status FROM versions WHERE id = \$1/.test(q)) return { rows: [{ status: 'building' }] };
+    if (/^SELECT id, version_id, title FROM goals WHERE version_id = \$1 AND title = \$2/.test(q)) {
+      assert.ok(owner, 'the artist review goal must be found on the transaction client');
+      return { rows: db.artistGoal ? [{ ...db.artistGoal }] : [] };
+    }
+    if (/^INSERT INTO goals \(version_id, title, description, scope_modules, status, created_by, sort_order\)/.test(q)) {
+      db.artistGoal = { id: '88', version_id: p[0], title: p[1] };
+      return { rows: [{ ...db.artistGoal }] };
+    }
+    if (/^INSERT INTO done_when_criteria/.test(q)) { (db.criteria = db.criteria || []).push({ version_id: p[0], criterion_id: p[1], goal_id: p[3] }); return { rows: [] }; }
     if (/^SELECT scope_modules FROM goals WHERE id = \$1/.test(q)) return { rows: [{ scope_modules: [] }] };
     if (/^INSERT INTO tasks \(version_id, title, description, status, touches,/.test(q)) {
       assert.ok(owner, 'the round must be created inside the claim transaction');

package/tests/hall_city_rewording.mjs

@@ -49,3 +49,14 @@ test('the "?" asks before it sends: the send lives behind a confirm button', ()
   assert.match(fn, /Send this to Claude to rewrite\?/);
   assert.match(fn, /Nothing is decided or changed/);
 });
+
+test('a card never cuts what it says: the whole text is one tap away, and only when there is more', () => {
+  const G = boot();
+  const m = { id: 'override_requests:1', title: 'Override: a long title', detail: 'The whole story, word for word.' };
+  assert.equal(G.fullText(m, { question: 'Release it?' }), 'Override: a long title\n\nThe whole story, word for word.');
+  assert.equal(G.fullText(m, { question: 'Override: a long title' }), 'The whole story, word for word.', 'the question is not repeated');
+  assert.equal(G.fullText({ id: 'x:1', title: 'Same' }, { question: 'Same' }), '', 'nothing more to show, no opener');
+  assert.equal(G.fullText(null, { question: 'Q?' }), '');
+  const src = fs.readFileSync(path.join(PUB, 'city-decide.js'), 'utf8');
+  assert.match(src, /str\(o\.input && o\.input\.label\) \|\| str\(o\.label\)/, 'an answer uses its full words, not the desk chip cut to fit');
+});

package/tests/module_store_listing.mjs

@@ -15,9 +15,18 @@ import { createRequire } from 'node:module';
 const require = createRequire(import.meta.url);
 
 // ---- the fake registry the route reads ----
-const state = { modules: {}, versions: [], scores: [], signals: [] };
+const state = { modules: {}, versions: [], scores: [], signals: [], prices: [] };
 const pool = {
   async query(sql, params = []) {
+    if (/FROM store_module_prices/.test(sql)) {
+      const newest = new Map();
+      for (const p of state.prices) {
+        if (!params[0].includes(p.module_key)) continue;
+        const have = newest.get(p.module_key);
+        if (!have || p.set_at > have.set_at) newest.set(p.module_key, p);
+      }
+      return { rows: [...newest.values()] };
+    }
     if (/FROM store_modules m JOIN store_module_versions v/.test(sql)) {
       return {
         rows: state.versions
@@ -53,7 +62,7 @@ const poolPath = require.resolve('../src/bongos/pool.js');
 require.cache[poolPath] = { id: poolPath, filename: poolPath, loaded: true, exports: { pool: { connect: async () => ({ ...pool, release() {} }), query: pool.query } } };
 
 const buildModulesRouter = require('../src/bongos/routes/modules.js');
-const { QUALITY_FLOOR, SORT_PARTS, placeVersion, sortByPart } = require('../src/bongos/module-listing.js');
+const { QUALITY_FLOOR, SORT_PARTS, RANKING, placeVersion, sortByPart, priceOf, withinMaxPrice, rankListed } = require('../src/bongos/module-listing.js');
 
 function handlerFor(router, method, p) {
   const layer = router.stack.find((l) => l.route && l.route.path === p && l.route.methods[method]);
@@ -153,7 +162,7 @@ test('GET /store/modules: lists by the newest version\'s current score, drops wh
   assert.equal(res.statusCode, 200);
   assert.equal(res.headers['Cache-Control'], 'no-store');
   assert.equal(res.body.floor, 50);
-  assert.deepEqual(res.body.listed.map((m) => [m.key, m.version, m.overall]), [['fixed', '2.0.0', 60], ['good', '1.10.0', 80]]);
+  assert.deepEqual(res.body.listed.map((m) => [m.key, m.version, m.overall]), [['good', '1.10.0', 80], ['fixed', '2.0.0', 60]], 'highest score first');
   assert.deepEqual(res.body.new.map((m) => [m.key, m.is_new, m.overall]), [['fresh', true, null]]);
   const all = [...res.body.listed, ...res.body.new].map((m) => m.key);
   for (const k of ['low', 'unsafe', 'unscored', 'gone']) assert.ok(!all.includes(k), `${k} must not be listed`);
@@ -163,7 +172,7 @@ test('GET /store/modules: an empty store answers empty lists and the floor', asy
   state.modules = {}; state.versions = []; state.scores = [];
   const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
   const res = await invoke(handle, {});
-  assert.deepEqual(res.body, { floor: 50, sort: null, sort_parts: SORT_PARTS, listed: [], new: [] });
+  assert.deepEqual(res.body, { floor: 50, ranking: RANKING, sort: null, sort_parts: SORT_PARTS, max_price: null, listed: [], new: [] });
 });
 
 // ---------------------------------------------------------------------------
@@ -229,7 +238,7 @@ test('GET /store/modules?sort=: orders the listed modules by the part, leaves Ne
   assert.deepEqual(byTests.body.listed.map((m) => m.key), ['tested', 'steady']);
   const plain = await invoke(handle, { query: {} });
   assert.equal(plain.body.sort, null);
-  assert.deepEqual(plain.body.listed.map((m) => m.key), ['steady', 'tested'], 'no sort is key order, as before');
+  assert.deepEqual(plain.body.listed.map((m) => m.key), ['steady', 'tested'], 'no sort is the ranking: equal scores, both free, so key order');
   state.signals = [];
 });
 
@@ -307,3 +316,94 @@ test('the criterion: two modules with the same overall score read differently',
   assert.equal(by.steady.parts.reliability.score, 90);
   state.signals = [];
 });
+
+// ---------------------------------------------------------------------------
+// the ranking: quality first, price breaks ties, optional max price (task 1003808)
+// ---------------------------------------------------------------------------
+
+test('priceOf: no price row is free; 0 in either currency is free; null is not offered', () => {
+  assert.deepEqual(priceOf(null), { cents: null, credits: null, free: true });
+  assert.deepEqual(priceOf({ price_cents: 0, price_credits: null }), { cents: 0, credits: null, free: true });
+  assert.deepEqual(priceOf({ price_cents: 500, price_credits: 0 }), { cents: 500, credits: 0, free: true });
+  assert.deepEqual(priceOf({ price_cents: 500, price_credits: null }), { cents: 500, credits: null, free: false });
+});
+
+test('rankListed: a higher score always wins, whatever it costs — price never buys a place', () => {
+  const ranked = rankListed([
+    { key: 'cheap', overall: 70, price: priceOf(null) },
+    { key: 'dear', overall: 90, price: priceOf({ price_cents: 99900 }) },
+  ]);
+  assert.deepEqual(ranked.map((e) => e.key), ['dear', 'cheap']);
+});
+
+test('rankListed: between equal scores, free first, then lowest cash, then lowest credits, then key', () => {
+  const input = [
+    { key: 'z-credits', overall: 80, price: priceOf({ price_credits: 5 }) },
+    { key: 'cents-900', overall: 80, price: priceOf({ price_cents: 900 }) },
+    { key: 'cents-100', overall: 80, price: priceOf({ price_cents: 100 }) },
+    { key: 'b-free', overall: 80, price: priceOf(null) },
+    { key: 'a-free', overall: 80, price: priceOf({ price_cents: 0 }) },
+  ];
+  assert.deepEqual(rankListed(input).map((e) => e.key), ['a-free', 'b-free', 'cents-100', 'cents-900', 'z-credits']);
+  assert.equal(input[0].key, 'z-credits', 'the input is untouched');
+});
+
+test('withinMaxPrice: free always passes; a priced module must be offered at or under a cap the buyer set', () => {
+  const p = priceOf({ price_cents: 500, price_credits: 7 });
+  assert.equal(withinMaxPrice(p, null), true, 'no cap, no filter');
+  assert.equal(withinMaxPrice(p, { cents: 500, credits: null }), true, 'at the cap is in');
+  assert.equal(withinMaxPrice(p, { cents: 499, credits: null }), false);
+  assert.equal(withinMaxPrice(p, { cents: 1, credits: 7 }), true, 'either currency under its cap is enough');
+  assert.equal(withinMaxPrice(priceOf({ price_cents: 500 }), { cents: null, credits: 100 }), false, 'not offered in credits, so a credit cap cannot let it in');
+  assert.equal(withinMaxPrice(priceOf(null), { cents: 0, credits: null }), true);
+});
+
+test('GET /store/modules: ranks by score then price, and ?max_cents= leaves out what costs more', async () => {
+  state.modules = {
+    top: { status: 'listed', title: 'Top' }, 'tie-paid': { status: 'listed', title: 'Tie paid' },
+    'tie-free': { status: 'listed', title: 'Tie free' }, fresh: { status: 'listed', title: 'Fresh' },
+  };
+  state.versions = [
+    { id: 31, module_key: 'top', version: '1.0.0', published_at: 't' },
+    { id: 32, module_key: 'tie-paid', version: '1.0.0', published_at: 't' },
+    { id: 33, module_key: 'tie-free', version: '1.0.0', published_at: 't' },
+    { id: 34, module_key: 'fresh', version: '1.0.0', published_at: 't' },
+  ];
+  state.scores = [
+    { id: 31, version_id: 31, computed_at: 1, ...score({ overall: 92 }) },
+    { id: 32, version_id: 32, computed_at: 1, ...score({ overall: 75 }) },
+    { id: 33, version_id: 33, computed_at: 1, ...score({ overall: 75 }) },
+    { id: 34, version_id: 34, computed_at: 1, ...score({ is_new: true }) },
+  ];
+  state.signals = [];
+  state.prices = [
+    { module_key: 'top', price_cents: 2000, price_credits: null, set_at: 1 },
+    { module_key: 'tie-paid', price_cents: 900, price_credits: null, set_at: 1 },
+    { module_key: 'tie-paid', price_cents: 500, price_credits: null, set_at: 2 },
+    { module_key: 'fresh', price_cents: 3000, price_credits: null, set_at: 1 },
+  ];
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  const all = await invoke(handle, { query: {} });
+  assert.equal(all.body.ranking, RANKING);
+  assert.deepEqual(all.body.listed.map((m) => m.key), ['top', 'tie-free', 'tie-paid']);
+  assert.deepEqual(all.body.listed.map((m) => m.price.cents), [2000, null, 500], 'the CURRENT price is shown');
+  assert.equal(all.body.max_price, null);
+
+  const capped = await invoke(handle, { query: { max_cents: '1000' } });
+  assert.deepEqual(capped.body.max_price, { cents: 1000, credits: null });
+  assert.deepEqual(capped.body.listed.map((m) => m.key), ['tie-free', 'tie-paid']);
+  assert.deepEqual(capped.body.new, [], 'the cap applies to New modules too');
+
+  const free = await invoke(handle, { query: { max_cents: '0' } });
+  assert.deepEqual(free.body.listed.map((m) => m.key), ['tie-free'], 'a cap of 0 is free only');
+  state.prices = [];
+});
+
+test('GET /store/modules: a maximum price that is not a whole number of 0 or more is refused', async () => {
+  const { handle } = handlerFor(buildModulesRouter(), 'get', '/store/modules');
+  for (const query of [{ max_cents: '-1' }, { max_cents: '5.5' }, { max_credits: 'ten' }, { max_cents: ['1', '2'] }]) {
+    const res = await invoke(handle, { query });
+    assert.equal(res.statusCode, 400, JSON.stringify(query));
+    assert.match(res.body.message, /maximum price/);
+  }
+});

package/tests/speciality_injection.mjs

@@ -105,3 +105,23 @@ test('the adoption read selects the contract itself', () => {
   // while still looking well-formed.
   assert.match(src('modules/specialities/db.js'), /SELECT s\.id, s\.slug, s\.name, s\.discipline, s\.summary, s\.contract_md/);
 });
+
+// task 1004817: two sessions, two worktrees, two claims in two crafts. Each
+// session gets ONLY the contract for the claim bound to its own worktree; the
+// account-wide pool is only the fallback when no claim is bound here.
+test('two claims in two worktrees: each session gets only its own contract', () => {
+  const claims = [
+    { ...claim('artist'), task_id: '1', worktree_name: 'task-1' },
+    { ...claim('engineer'), task_id: '2', worktree_name: 'task-2' },
+  ];
+  const specs = [
+    sp({ discipline: 'artist', contract: 'Speciality: Pixel art (under artist).' }),
+    sp({ discipline: 'engineer', contract: 'Speciality: Compilers (under engineer).' }),
+  ];
+  const got = (worktree) => ids(conductor.evaluateTriggers({ activeClaims: claims, specialities: specs, worktree }))
+    .filter((i) => String(i).startsWith('speciality:'));
+  assert.deepEqual(got('task-1'), ['speciality:artist']);
+  assert.deepEqual(got('task-2'), ['speciality:engineer']);
+  // No claim bound to this tree (main checkout): today's behaviour, every craft in play.
+  assert.deepEqual(got('main-checkout').sort(), ['speciality:artist', 'speciality:engineer']);
+});

package/tests/task_goal_required.mjs

@@ -113,12 +113,11 @@ test('POST /tasks does NOT pass the escape hatch — this door always has a goal
 
 const OPT_INS = [
   ['modules/onboarding/newcomer-restock.js', 'the beginner queue, stamped from templates'],
-  ['modules/copy-desk/routes/copy-desk.js', 'copy-change proposals'],
   ['modules/lifecycle/kickoff-seed.js', "the founder's first board, on an instance with no goals at all"],
   ['modules/lifecycle/cascade.js', 'a follow-up off a parent task that is itself goal-less'],
 ];
 
-test('exactly four vectors opt in, and each says why', () => {
+test('exactly three vectors opt in, and each says why', () => {
   for (const [file, why] of OPT_INS) {
     const body = src(file);
     assert.match(body, /allowCatchAll/, `${file} should opt in (${why})`);
@@ -127,6 +126,17 @@ test('exactly four vectors opt in, and each says why', () => {
   }
 });
 
+// task 1004819: studio work names its home instead of the catch-all. Each of the
+// three studio create vectors passes artistReview, which lands it in the
+// version's artist review goal; none of them opts into the catch-all any more.
+test('the three studio vectors land in the artist review goal, not the catch-all', () => {
+  for (const file of ['modules/copy-desk/routes/copy-desk.js', 'modules/lifecycle/page-tweak-claim.js', 'modules/lifecycle/page-tweak-write.js']) {
+    const body = src(file);
+    assert.match(body, /artistReview: true/, `${file} should name the artist review goal`);
+    assert.equal(/allowCatchAll/.test(body), false, `${file} must not opt into the catch-all`);
+  }
+});
+
 test('cascade opts in ONLY when inheritance actually failed', () => {
   // The others opt in unconditionally because they have no goal to name at all.
   // A cascade normally inherits its parent's goal and must keep doing so — the