@bongos/core 1.21.177 → 1.21.179

package/tests/search_isolation_db.mjs

@@ -0,0 +1,140 @@
+// tests/search_isolation_db.mjs
+//
+// Layer C of the GDS search isolation suite (task 950, V4.R12 / ADR 0060 §6 / ADR 0016),
+// against a REAL Postgres. Layers A (pure + SQL structure) and B (the HTTP route derives
+// scope from the session only) are DB-free and stay in tests/search_isolation.mjs.
+//
+// Seeds rank-gated + owner-scoped chunks and runs the REAL searchChunks and
+// searchPublicDocs in a ROLLED-BACK transaction for the done-when cases
+// (xenos-vs-protected, cross-builder memory, owner-sees-own, the public port's fixed
+// scope). The search index must never be a read-side bypass of the trust boundary.
+//
+// SPLIT OUT by task 1004863. As the third layer of search_isolation.mjs it said it ran in
+// the integration gate, but that file was never in the INTEGRATION set — so in CI it
+// always skipped and no lane executed it. This file is in the set; it needs a MIGRATED
+// database (builders 1 and 2 are the seeded system rows the owned chunk points at).
+//
+// Run:  DATABASE_URL=postgres://... node tests/search_isolation_db.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const search = require('../modules/memory/search.js');
+
+let passed = 0;
+let failed = 0;
+async function t(name, fn) {
+  try { await fn(); passed++; console.log(`  ok  ${name}`); }
+  catch (err) { failed++; console.log(`  FAIL ${name}`); console.log(`     ${err.message}`); }
+}
+
+// ---------------------------------------------------------------------------
+// Layer C — DB-backed real-query scoping (auto-skips without Postgres)
+// ---------------------------------------------------------------------------
+console.log('Layer C — real searchChunks against a live DB (skips if unreachable):');
+
+let pool = null;
+try {
+  // task 1003207: this said `../src/db`, which has not existed since the kernel
+  // carve — so the require ALWAYS threw, pool stayed null, and Layer C skipped
+  // even against a live Postgres. It was a dead layer reporting as a skip.
+  ({ pool } = require('../src/bongos/pool'));
+} catch { pool = null; }
+
+async function dbReachable() {
+  if (!pool) return null;
+  try {
+    const c = await pool.connect();
+    try { await c.query('SELECT 1'); return c; } catch { c.release(); return null; }
+  } catch { return null; }
+}
+
+const client = await dbReachable();
+if (!client) {
+  console.log('  SKIP  no reachable Postgres — this runs in the integration lane (run-unit-tests.js INTEGRATION) / wherever a Postgres is reachable.');
+  console.log('        (The same scoping cases were proven on the prod DB in a rolled-back transaction at ship time.)');
+  // END THE POOL ON THE SKIP PATH TOO (task 1003848). Only the else-branch below
+  // ended it, so when Postgres was unreachable the Pool survived with libuv handles
+  // still closing from its failed connect — and the process.exit() at the bottom of
+  // the old combined file then tore down the loop underneath them. On Windows that surfaces as
+  // `Assertion failed: !(handle->flags & UV_HANDLE_CLOSING), src\win\async.c`, exit
+  // 0xC0000409: a process-teardown crash AFTER '5 passed, 0 failed', which reads as
+  // a failing suite in the unit gate while every assertion actually passed.
+  if (pool) await pool.end().catch(() => {});
+} else {
+  try {
+    await client.query('BEGIN');
+    await client.query(`SET LOCAL pg_trgm.word_similarity_threshold = ${search.TRGM_THRESHOLD}`);
+    // builder 1 exists (example-owner); seed a protected (metic) chunk, a public one,
+    // and a chunk owned by builder 1 — all matching q=ISO_TERM.
+    //
+    // ISO_TERM is a word no real document contains (task 1004889). It used to be
+    // 'enforcement', and in the integration lane the booted server's search-index
+    // poller fills search_chunks with the repo's docs first: 149 real chunks matched,
+    // the three seeded rows fell out of the top 50, and every "sees" case failed.
+    // Worse, the "does NOT see" cases were then passing VACUOUSLY — a hidden row and a
+    // crowded-out row look the same. With a unique term the seeded rows are the only
+    // candidates, so a row missing from the results can only mean the scope removed it.
+    const ISO_TERM = 'zqxisoprobe';
+    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
+      ('doc','__iso__/protected.md',0,'p','PROT','trust boundary permission core ${ISO_TERM}','metic',NULL,'i1'),
+      ('doc','__iso__/public.md',0,'pub','PUB','trust boundary public ${ISO_TERM} overview','xenos',NULL,'i2'),
+      ('db','__iso__/memory:1',0,'m','MEM1','builder one private ${ISO_TERM} memo','xenos',1,'i3')`);
+
+    const titles = (rows) => rows.map((r) => r.title).sort().join(',');
+
+    await t('xenos caller sees the public chunk but NOT the metic-protected one (xenos-vs-protected)', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 2, builderRank: 'xenos', limit: 50 }, { client });
+      const ts = titles(rows);
+      assert.ok(ts.includes('PUB'), `expected PUB, got [${ts}]`);
+      assert.ok(!ts.includes('PROT'), `xenos must NOT see the metic chunk, got [${ts}]`);
+    });
+
+    await t('metic caller sees the protected chunk too', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 2, builderRank: 'metic', limit: 50 }, { client });
+      const ts = titles(rows);
+      assert.ok(ts.includes('PROT') && ts.includes('PUB'), `metic should see PROT+PUB, got [${ts}]`);
+    });
+
+    await t('builder 2 does NOT see builder 1\'s owned chunk (cross-builder memory)', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 2, builderRank: 'archon', limit: 50 }, { client });
+      assert.ok(!rows.some((r) => r.title === 'MEM1'), 'an Archon STILL must not see another builder\'s private chunk');
+    });
+
+    await t('builder 1 DOES see their own owned chunk (owner-sees-own)', async () => {
+      const rows = await search.searchChunks({ q: ISO_TERM, builderId: 1, builderRank: 'xenos', limit: 50 }, { client });
+      assert.ok(rows.some((r) => r.title === 'MEM1'), 'a builder must see their own private chunk');
+    });
+
+    // The public port (task 1002534, ADR 0367): the Discord #support answerer
+    // has no session, so its scope is fixed — shared xenos docs on the
+    // allowlist, nothing else, whatever matches the query.
+    await client.query(`INSERT INTO search_chunks (source_kind, source_ref, chunk_index, heading_path, title, body, min_rank, owner_builder_id, content_hash) VALUES
+      ('doc','__pub__/allowed/guide.md',0,'g','PUBOK','support enforcement guide','xenos',NULL,'p1'),
+      ('doc','__pub__/allowed/locked.md',0,'l','PUBMETIC','support enforcement locked','metic',NULL,'p2'),
+      ('doc','__pub__/allowed/mine.md',0,'m','PUBOWNED','support enforcement owned','xenos',1,'p3'),
+      ('db','__pub__/allowed/task:1',0,'d','PUBDB','support enforcement task prose','xenos',NULL,'p4'),
+      ('doc','__pub__/elsewhere.md',0,'e','PUBOFFLIST','support enforcement off the list','xenos',NULL,'p5')`);
+
+    await t('searchPublicDocs returns ONLY a shared xenos doc on the allowlist (no metic, owned, db, or off-list row)', async () => {
+      const rows = await search.searchPublicDocs({ q: 'support enforcement', refs: ['__pub__/allowed/'], limit: 10 }, { client });
+      const ts = titles(rows);
+      assert.equal(ts, 'PUBOK', `expected only PUBOK, got [${ts}]`);
+      assert.ok(rows[0].body.includes('support enforcement guide'), 'the body comes back with the hit');
+    });
+
+    await t('searchPublicDocs with no allowlist returns nothing at all', async () => {
+      assert.deepEqual(await search.searchPublicDocs({ q: 'support enforcement', refs: [] }, { client }), []);
+    });
+  } finally {
+    await client.query('ROLLBACK').catch(() => {});
+    client.release();
+    await pool.end().catch(() => {});
+  }
+}
+
+console.log(`\n${passed} passed, ${failed} failed`);
+// exitCode, not process.exit() (task 1003848): a hard exit can tear the loop down under a
+// pg handle still closing after a failed connect — the skip path.
+process.exitCode = failed === 0 ? 0 : 1;

package/tests/session_earnings_mirror_db.mjs

@@ -125,6 +125,8 @@ async function fixture(client) {
     title: `${tag} task`,
     status: 'shipped',
     version_id: version.id,
+    // Named, not placeholder-filled: tasks_discipline_check admits only the live crafts.
+    discipline: 'engineer',
   });
   const sessionId = `${tag}-session`;
   await insertRow(client, 'session_records', {

package/tests/work_board_live_refresh.mjs

@@ -0,0 +1,236 @@
+// tests/work_board_live_refresh.mjs — the Work board refreshes on the hall's live
+// signal, not a 20-second timer, and asks for a bounded claimable list (task 1004877).
+//
+// Before: an idle, visible Work tab re-fetched the WHOLE claimable feed every 20 s
+// (30 requests per 10 minutes) whether or not anything had changed. Now it listens
+// on the same live channel the hall home uses (GET /api/bongos/live, an
+// EventSource that says "something changed" and nothing else), re-fetches a
+// second after a change (at most one read per 20 s while changes keep coming), and
+// keeps a slow 2-minute timer as a backstop in case the live connection is down. Every claimable read carries ?limit= so the list it
+// returns has a ceiling.
+//
+// work.js is BOOTED in a vm here (the harness shape tests/hall_mine_lens.mjs uses)
+// against a fake clock and a fake EventSource, so the counts below are the real
+// page's timers, not a reading of its source.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { settle } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+
+const MIN = 60 * 1000;
+
+// A virtual clock: setTimeout/setInterval queue here and only fire on advance(),
+// so ten minutes of page life run in milliseconds.
+function makeClock() {
+  let now = 1_000_000;
+  let seq = 0;
+  const timers = new Map();
+  const add = (fn, ms, every) => { seq += 1; timers.set(seq, { at: now + Math.max(0, Number(ms) || 0), fn, every }); return seq; };
+  return {
+    now: () => now,
+    setTimeout: (fn, ms) => add(fn, ms, 0),
+    setInterval: (fn, ms) => add(fn, ms, Math.max(1, Number(ms) || 1)),
+    clear: (id) => { timers.delete(id); },
+    async advance(ms) {
+      const end = now + ms;
+      for (;;) {
+        let next = null;
+        for (const [id, t] of timers) if (t.at <= end && (!next || t.at < next[1].at)) next = [id, t];
+        if (!next) break;
+        const [id, t] = next;
+        now = t.at;
+        if (t.every) t.at += t.every; else timers.delete(id);
+        t.fn();
+        await settle(); await settle();
+      }
+      now = end;
+      await settle();
+    },
+  };
+}
+
+function bootWorkBoard() {
+  const clock = makeClock();
+  const els = new Map();
+  const makeEl = (id = '') => ({
+    id, dataset: {}, style: {}, textContent: '', hidden: false, disabled: false,
+    checked: false, value: '', title: '', _html: '',
+    classList: { add() {}, remove() {}, toggle() { return false; }, contains() { return false; } },
+    setAttribute() {}, getAttribute() { return null; },
+    listeners: {},
+    addEventListener(type, fn) { (this.listeners[type] ||= []).push(fn); },
+    querySelector() { return null; }, querySelectorAll() { return []; },
+    appendChild() {}, remove() {}, closest() { return null; },
+    set innerHTML(v) { this._html = String(v); }, get innerHTML() { return this._html; },
+  });
+  const el = (key) => { if (!els.has(key)) els.set(key, makeEl(key)); return els.get(key); };
+  const documentObj = {
+    getElementById: (id) => el(id),
+    querySelector: (sel) => el(String(sel).replace(/^#/, '')),
+    querySelectorAll: () => [],
+    createElement: () => makeEl(),
+    addEventListener(type, fn) { (this.listeners[type] ||= []).push(fn); },
+    listeners: {},
+    body: { dataset: {} }, documentElement: { dataset: {} },
+    hidden: false,
+  };
+
+  const requests = [];
+  const client = {
+    request: async (method, url) => {
+      requests.push(url);
+      const ok = (data) => ({ status: 200, ok: true, data });
+      if (url.endsWith('/me')) return ok({ builder: { id: 7, github_login: 'percy', rank: 'metic' } });
+      if (url.endsWith('/goals')) return ok({ goals: [] });
+      if (url.includes('/tasks/claimable')) {
+        return ok({ claimable: [{ id: 501, title: 'a ready task', status: 'ready', version_id: 'V1' }], claimable_total: 1234, active_claims: [] });
+      }
+      return ok({});
+    },
+  };
+
+  // The fake live stream: one instance per `new EventSource(url)`.
+  const streams = [];
+  class FakeEventSource {
+    constructor(url) { this.url = url; this.readyState = 1; this.listeners = {}; streams.push(this); }
+    addEventListener(type, fn) { (this.listeners[type] ||= []).push(fn); }
+    emit(type) { (this.listeners[type] || []).forEach((fn) => fn({ data: '{}' })); }
+    close() { this.readyState = 2; }
+  }
+  FakeEventSource.CLOSED = 2;
+
+  const tabCounts = {};
+  const kit = {
+    makePager: (prefix) => ({ prefix, page: 1, perPage: 100 }),
+    paginate: (rows) => rows,
+    wirePager() {},
+    pagerBarHtml: () => '',
+    makeTabs: ({ tabs }) => ({ active: () => tabs[0].id, setCount(id, n) { tabCounts[id] = n; }, activate() {} }),
+    makeFilterBar: ({ search, primary = [], overflow = [] }) => {
+      [search, ...primary, ...overflow].filter(Boolean).forEach((c) => { el(c.id).value = c.value ?? c.default ?? ''; });
+      return { values: () => ({}), get: () => '', set() {} };
+    },
+    ageChipHtml: () => '',
+  };
+  const windowObj = {
+    __BRANDING__: { currency: { label: 'credits' } },
+    BongosClient: { createClient: () => client },
+    OTBKit: kit,
+    OTBTaskDetail: { href: (id) => `/task/${id}`, open() {} },
+    OTBTaskLib: {
+      priorityRank: () => 0, touchesConflict: () => false, conflictPeers: () => [], conflictChipHtml: () => '', rankTagHtml: () => '',
+      creditsPerMinute: () => 0, buildPromptForTask: () => '', friendlyBatchReason: () => '',
+      taskActivityMs: () => 0, STALE_CHOICES: [{ value: '', label: '— any —' }], isStale: () => false,
+      focusVersionDefault: () => null,
+    },
+    OTB: {
+      escapeHtml: (s) => String(s ?? ''), $: (sel) => documentObj.querySelector(sel),
+      fmtNum: (n) => String(n ?? 0), fmtDate: (d) => String(d ?? ''),
+      errCode: () => null, errDetails: () => ({}), toast() {}, categoryChip: () => '', fillKindFilter() {},
+      kindIsUnset: () => true, KIND_UNSET: 'unclassified', roleAxisLabel: () => 'Role',
+      roleOptions: () => [{ value: '', label: '— any —' }], roleIsUnset: () => true, roleLabel: () => '', ROLE_UNSET: 'unclassified',
+    },
+    location: { hostname: 'builders.example.com', pathname: '/work', search: '', hash: '', href: 'https://builders.example.com/work' },
+    localStorage: { getItem: () => null, setItem() {}, removeItem() {} },
+    confirm: () => true,
+    addEventListener() {},
+  };
+  class FakeDate extends Date {}
+  FakeDate.now = () => clock.now();
+  const sandbox = {
+    window: windowObj, document: documentObj, location: windowObj.location,
+    localStorage: windowObj.localStorage, console,
+    setTimeout: clock.setTimeout, clearTimeout: clock.clear, setInterval: clock.setInterval, clearInterval: clock.clear,
+    Date: FakeDate, URL, URLSearchParams, navigator: {}, history: { replaceState() {} },
+    EventSource: FakeEventSource,
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  for (const f of ['mine-lens.js', 'work-summary.js', 'claim-action.js', 'bulk-toolbar.js']) vm.runInContext(read(f), sandbox, { filename: f });
+  windowObj.OTBMineLens = sandbox.OTBMineLens;
+  windowObj.OTBWorkSummary = sandbox.OTBWorkSummary;
+  vm.runInContext(read('work.js'), sandbox, { filename: 'work.js' });
+  (documentObj.listeners.DOMContentLoaded || []).forEach((fn) => fn());
+
+  return {
+    clock, requests, streams, tabCounts,
+    claimableReads: () => requests.filter((u) => u.includes('/tasks/claimable')),
+    setHidden(h) { documentObj.hidden = h; (documentObj.listeners.visibilitychange || []).forEach((fn) => fn()); },
+  };
+}
+
+const boot = async () => {
+  const b = bootWorkBoard();
+  for (let i = 0; i < 8; i += 1) await settle();
+  await b.clock.advance(0);
+  return b;
+};
+
+test('every claimable read asks for a bounded list', async () => {
+  const b = await boot();
+  await b.clock.advance(10 * MIN);
+  const reads = b.claimableReads();
+  assert.ok(reads.length >= 1);
+  for (const u of reads) assert.match(u, /[?&]limit=\d+/, `unbounded claimable read: ${u}`);
+});
+
+test('the Ready tab count is the server total, not the length of the bounded list', async () => {
+  const b = await boot();
+  assert.equal(b.tabCounts.ready, 1234);
+});
+
+test('an idle visible tab makes at most 5 claimable reads in 10 minutes (was 30)', async () => {
+  const b = await boot();
+  const atLoad = b.claimableReads().length;
+  await b.clock.advance(10 * MIN);
+  const idle = b.claimableReads().length - atLoad;
+  assert.ok(idle <= 5, `expected ≤ 5 background reads per 10 min, got ${idle}`);
+  assert.ok(idle >= 4, `the slow fallback timer must still run (got ${idle})`);
+});
+
+test('the page subscribes to the live channel', async () => {
+  const b = await boot();
+  assert.equal(b.streams.length, 1);
+  assert.equal(b.streams[0].url, '/api/bongos/live');
+});
+
+test('a live nudge refreshes the claimable list within seconds', async () => {
+  const b = await boot();
+  const before = b.claimableReads().length;
+  b.streams[0].emit('nudge');
+  await b.clock.advance(3000);
+  assert.equal(b.claimableReads().length, before + 1);
+});
+
+test('a burst of nudges is coalesced: a busy minute costs at most 3 reads', async () => {
+  const b = await boot();
+  const before = b.claimableReads().length;
+  for (let s = 0; s < 60; s += 1) { b.streams[0].emit('nudge'); await b.clock.advance(1000); }
+  const n = b.claimableReads().length - before;
+  assert.ok(n >= 1 && n <= 3, `expected 1–3 reads for 60 nudges in a minute, got ${n}`);
+});
+
+test('a project changing every second never costs more than the old 20 s timer (30 per 10 min)', async () => {
+  const b = await boot();
+  const before = b.claimableReads().length;
+  for (let s = 0; s < 600; s += 1) { b.streams[0].emit('nudge'); await b.clock.advance(1000); }
+  const n = b.claimableReads().length - before;
+  assert.ok(n <= 30, `expected ≤ 30 reads in a busy 10 minutes, got ${n}`);
+});
+
+test('a hidden tab fetches nothing, on the timer or on a nudge', async () => {
+  const b = await boot();
+  b.setHidden(true);
+  const before = b.claimableReads().length;
+  b.streams[0].emit('nudge');
+  await b.clock.advance(10 * MIN);
+  assert.equal(b.claimableReads().length, before);
+});

package/tests/workflow_exec_paths.mjs

@@ -23,11 +23,12 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO = path.resolve(__dirname, '..');
 const CORE_PATH_SH = path.join(REPO, 'infra', 'core-path.sh');
 
-// infra/ + the gate workflows under .github/ are HOST topology (publish-manifest.js
-// PROTECTED_TOPOLOGY_EXCLUDE) — absent from a neutral core checkout (task 1002470).
-// The real-tree checks only mean something where that tree exists; the synthetic
-// counterfactual below always runs.
-const HAS_GATE_WORKFLOWS = fs.existsSync(path.join(REPO, '.github', 'workflows', 'gate-review.yml'));
+// infra/ is HOST topology (publish-manifest.js PROTECTED_TOPOLOGY_EXCLUDE) — absent
+// from a neutral core checkout (task 1002470). The real-tree checks only mean
+// something where that tree exists; the synthetic counterfactual below always runs.
+// Task 1004859: this used to key on .github/workflows/gate-review.yml, a workflow that
+// was only ever planned; it now keys on the resolver every routed invocation needs.
+const HAS_HOST_TOPOLOGY = fs.existsSync(path.join(REPO, 'infra', 'core-node.sh'));
 const HAS_CORE_PATH = fs.existsSync(CORE_PATH_SH);
 
 let passed = 0, failed = 0;
@@ -42,14 +43,11 @@ function hostTest(name, present, fn) {
 }
 
 // ---- A. the workflow lint is green on the real tree ---------------------------------------------
-hostTest('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', HAS_GATE_WORKFLOWS, () => {
+hostTest('lint-workflow-exec: every core invocation is routed + publishable (no bare repo-relative form)', HAS_HOST_TOPOLOGY, () => {
   const r = lintWorkflowExec({ instanceRoot: REPO, coreRoot: REPO });
   assert.deepEqual(r.violations, [], `expected no violations, got: ${JSON.stringify(r.violations, null, 2)}`);
   assert.ok(r.ok, 'lint should pass');
-  // The security-critical merge gates + the functional gates must all be covered.
   const rels = r.checked.map((c) => `${c.file}:${c.rel}`);
-  assert.ok(rels.some((s) => s.startsWith('gate-review.yml:') && s.endsWith('scripts/bongos/gate-review.js')), 'gate-review routed');
-  assert.ok(rels.some((s) => s.startsWith('grade-gate.yml:') && s.endsWith('scripts/bongos/ci-grade.js')), 'grade-gate routed');
   assert.ok(rels.some((s) => s.endsWith('scripts/migrate.sh')), 'selfhost migrate routed via core-path.sh');
 });
 
@@ -58,9 +56,9 @@ test('lint-workflow-exec: a bare core invocation in a workflow is flagged (count
   try {
     fs.mkdirSync(path.join(tmp, '.github', 'workflows'), { recursive: true });
     fs.mkdirSync(path.join(tmp, 'scripts', 'bongos'), { recursive: true });
-    fs.writeFileSync(path.join(tmp, 'scripts', 'bongos', 'gate-review.js'), '// probe\n');
+    fs.writeFileSync(path.join(tmp, 'scripts', 'bongos', 'main-audit.js'), '// probe\n');
     fs.writeFileSync(path.join(tmp, '.github', 'workflows', 'legacy.yml'),
-      'jobs:\n  x:\n    steps:\n      - run: node scripts/bongos/gate-review.js\n');
+      'jobs:\n  x:\n    steps:\n      - run: node scripts/bongos/main-audit.js\n');
     const r = lintWorkflowExec({ instanceRoot: tmp, coreRoot: tmp });
     assert.ok(!r.ok, 'a bare core invocation must fail the lint');
     assert.equal(r.violations.length, 1);