@bongos/core 1.21.22 → 1.21.24

package/tests/hall_record_world.mjs

@@ -306,7 +306,8 @@ const CLAIM_ACTION_SRC = read('claim-action.js');
 // all of them, because what these tests are actually about is the REQUEST the
 // page issues — `requests` carries paths only and is left alone so the older
 // assertions on it keep meaning what they meant.
-function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsList = null, patch = null, write = null, status = 200, search = '', referrer = '', withReader = true, grade, sessionLogs, claims } = {}) {
+function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsList = null, patch = null, write = null, status = 200, search = '', referrer = '', withReader = true, grade, sessionLogs, claims, shell = false } = {}) {
+  const fills = [];   // task 1004477: each time the page asked the shell to fill its exits
   const requests = [];
   const writes = [];
   const toasts = [];
@@ -400,6 +401,9 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
     confirm: () => true,
     navigator: { clipboard: { writeText: async () => {} } },
   };
+  // task 1004477: the shell is what fills a [data-shell-exit] link. `shell: true`
+  // stands it in so a test can see the page ask; absent, the page must still work.
+  if (shell) windowObj.OTBShell = { fillExits(root) { fills.push(root); } };
   class CustomEvent { constructor(type, init) { this.type = type; this.detail = init && init.detail; } }
   const sandbox = { window: windowObj, document: documentObj, location: windowObj.location, console, setTimeout, clearTimeout, Date, URL, URLSearchParams, CustomEvent };
   sandbox.globalThis = sandbox;
@@ -410,6 +414,7 @@ function renderTask(task, { lastClaim = null, viewer = null, goal = null, goalsL
   assert.ok(onReady, 'task.js registers its DOMContentLoaded boot');
   return {
     boot: onReady,
+    fills,
     html: () => documentObj.getElementById('task-body').innerHTML,
     sub: () => documentObj.getElementById('task-sub').textContent,
     el: (id) => documentObj.getElementById(id),
@@ -536,77 +541,50 @@ test('the idea grade badge IS the archetype pill, not a private copy of it', ()
     'idea.css carried a near-verbatim copy of .rec-pill down to the token triples — a hundred lines waiting to drift');
 });
 
-// ---- 10. the way out — the record exits to where it was opened from ----------
+// ---- 10. the way out — the record exits through the shell's Back ------------
 //
-// task 1003468. task.js hardcoded "Open the work board" in three places and
-// task.html's crumb a fourth, so a builder who walked goal → task had only the
-// browser's own Back, and the two failure renders sent them somewhere they had
-// never been. The list that opens a record now writes `?from=` on the link
-// (task-detail.js's href()) and the record offers THAT as its exit — in the
-// crumb before the fetch lands, and in the actions row of every render
-// including the two failures. A same-origin referrer is the fallback for a link
-// written without it; the board is the fallback for a reader with no history.
-// Every value is honoured only as a path on this host.
-
-const FROM_GOAL = '?from=' + encodeURIComponent('/goals#/goal/1000081');
-
-test('opened from a goal, the record exits to that goal — crumb and actions row alike', async () => {
-  const r = renderTask(BASE_TASK, { search: FROM_GOAL });
-  await r.boot(); await settle();
-  assert.match(r.html(), /<a class="td-btn" href="\/goals#\/goal\/1000081">Back to goal 1000081<\/a>/);
-  assert.doesNotMatch(r.html(), /Open the work board/, 'the hardcoded exit is gone from the happy path');
-  assert.equal(r.el('task-back').href, '/goals#/goal/1000081', 'the crumb points at the goal');
-  assert.equal(r.el('task-back-label').textContent, 'Back to goal 1000081');
-});
-
-test('opened from the board, the exit is the board — on the tab it was opened from', async () => {
-  const r = renderTask(BASE_TASK, { search: '?from=' + encodeURIComponent('/work#backlog') });
-  await r.boot(); await settle();
-  assert.match(r.html(), /href="\/work#backlog">Back to the work board</);
-});
-
-test('without ?from=, a same-origin referrer is the way back', async () => {
-  const r = renderTask(BASE_TASK, { referrer: 'https://builders.cloudbongos.com/sessions?page=2' });
-  await r.boot(); await settle();
-  assert.match(r.html(), /href="\/sessions\?page=2">Back to sessions</);
-});
-
-test('a cross-origin referrer, a broken one, or none, falls back to the work board', async () => {
-  for (const referrer of ['', 'https://example.org/elsewhere', 'not a url']) {
-    const r = renderTask(BASE_TASK, { referrer });
+// task 1003468 taught the record to exit to where it was opened from; task
+// 1004477 moved that decision into shell.js, which now makes it for every hall
+// page (tests/hall_fullscreen.mjs drives the real shell through ?from=, the
+// referrer, the hostile values and the fallback). What stays the record's is
+// PLACING the exit: an actions-row link in every render, the two failures
+// included, marked [data-shell-exit] so the shell fills it with the same
+// address and words as its top-bar Back — and asking the shell to, once the
+// render that placed it has landed.
+
+const EXIT_SLOT = /<a class="td-btn" data-shell-exit href="\/work">Back to tasks<\/a>/;
+
+test('every render places one shell exit — the record and both honest failures', async () => {
+  const cases = [['record', 200], ['not found', 404], ['feed unavailable', 500]];
+  for (const [name, status] of cases) {
+    const r = renderTask(BASE_TASK, { status, shell: true });
     await r.boot(); await settle();
-    assert.match(r.html(), /href="\/work">Back to the work board</, `referrer ${JSON.stringify(referrer)}`);
-    assert.equal(r.el('task-back').href, '/work');
+    assert.equal((r.html().match(/data-shell-exit/g) || []).length, 1, `${name}: one exit`);
+    assert.match(r.html(), EXIT_SLOT, `${name}: the static href is what a reader without the shell still gets`);
+    assert.doesNotMatch(r.html(), /Open the work board/, `${name}: the old hardcoded exit stays gone`);
+    assert.ok(r.fills.length >= 1, `${name}: the page asked the shell to fill the exit it placed`);
   }
 });
 
-test('a hostile or useless ?from= is refused, never followed', async () => {
-  const bad = [
-    '//evil.example', '/\\evil.example', 'javascript:alert(1)', 'https://evil.example/x',
-    '/api/gds/auth/web/callback', '/lib/bongos-client.js',
-    '/task/1003305',          // this same record — a loop, not a way back
-    'work', '/ work', '',
-  ];
-  for (const from of bad) {
-    const r = renderTask(BASE_TASK, { search: '?from=' + encodeURIComponent(from) });
-    await r.boot(); await settle();
-    assert.match(r.html(), /href="\/work">Back to the work board</, `from=${JSON.stringify(from)}`);
-    assert.equal(r.el('task-back').href, '/work', `the crumb refuses from=${JSON.stringify(from)} too`);
-  }
+test('the page no longer decides the way back: ?from= is the shell\'s to read', async () => {
+  const r = renderTask(BASE_TASK, { search: '?from=' + encodeURIComponent('/goals#/goal/1000081'), shell: true });
+  await r.boot(); await settle();
+  assert.doesNotMatch(r.html(), /href="\/goals#\/goal\/1000081"/, 'task.js writes no origin of its own into the exit');
+  assert.doesNotMatch(TASK_SRC, /\bsafeHallPath\b|\breferrerPath\b|\bexitTarget\b|\bapplyExit\b/,
+    'the second copy of the origin logic is gone, so the two cannot drift');
 });
 
-test('the two honest failures exit the same way the record does', async () => {
-  for (const status of [404, 500]) {
-    const r = renderTask(BASE_TASK, { status, search: FROM_GOAL });
-    await r.boot(); await settle();
-    assert.match(r.html(), /href="\/goals#\/goal\/1000081">Back to goal 1000081</, `status ${status}`);
-    assert.doesNotMatch(r.html(), /Open the work board/, `status ${status} still hardcodes the board`);
-  }
+test('without a shell the record still renders, and its exit still goes somewhere', async () => {
+  const r = renderTask(BASE_TASK);
+  await r.boot(); await settle();
+  assert.match(r.html(), EXIT_SLOT);
+  assert.equal(r.fills.length, 0);
 });
 
-test('the crumb is an element task.js can point, with its label apart from the icon', () => {
-  assert.match(taskHtml, /<a class="rec-back" id="task-back" href="\/work">/, 'the static href is the fallback the page ships with');
-  assert.match(taskHtml, /<span id="task-back-label">Back to tasks<\/span>/, 'the label is its own node, so the icon survives a relabel');
+test('the crumb is the record\'s address only; the fallback rides the body', () => {
+  assert.doesNotMatch(taskHtml, /rec-back|task-back/, 'the page-drawn back link is gone');
+  assert.match(taskHtml, /<body [^>]*data-back-fallback="\/work"/, 'a deep-linked task still has a way back');
+  assert.match(taskHtml, /<p class="rec-sub" id="task-sub">/);
 });
 
 // ---- 11. the description is markdown, and renders as it (task 1003465) --------

package/tests/hall_sessions_ledger.mjs

@@ -92,3 +92,43 @@ test('the accessibility column is headed in plain language, not "Accessibility"'
   assert.match(thead, /Plain speech/, 'the column is headed "Plain speech"');
   assert.ok(!/>Accessibility</.test(thead), 'and does not collide with the zoom control\'s word');
 });
+
+// ---- task 1002830: the transcript reader on the Sessions page (ADR 0051) ----
+// Same technique as above: slice the shipped source (canRead/readDoor/turnHtml)
+// and run it, so these exercise the real text.
+function readerFns(viewer) {
+  const from = JS.indexOf('  function canRead(s)');
+  const to = JS.indexOf('  const reader = {');
+  assert.ok(from > 0 && to > from, 'the reader helpers are still where the slice expects them');
+  const src = JS.slice(from, to);
+  const escapeHtml = (v) => String(v).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+  return new Function('escapeHtml', 'shortSid', 'fmtDate', 'V',
+    `let viewer = V;\n${src}\nreturn { canRead, readDoor, turnHtml };`)(escapeHtml, (s) => String(s).slice(0, 8), (d) => String(d), viewer);
+}
+
+test('a Read door appears only for a stored transcript the viewer may read', () => {
+  const owner = readerFns({ id: 7, rank: 'metic' });
+  assert.ok(owner.readDoor({ id: 1, session_id: 'abcdefgh1', builder_id: 7, has_transcript: true }).includes('data-read="1"'), 'own session');
+  assert.equal(owner.readDoor({ id: 2, session_id: 's', builder_id: 8, has_transcript: true }), '', "a Metic gets no door to someone else's transcript");
+  assert.equal(owner.readDoor({ id: 3, session_id: 's', builder_id: 7, has_transcript: false }), '', 'no stored transcript, no door');
+  const archon = readerFns({ id: 1, rank: 'archon' });
+  assert.ok(archon.readDoor({ id: 2, session_id: 's', builder_id: 8, has_transcript: true }).includes('data-read="2"'), 'an Archon may read any');
+  assert.equal(readerFns(null).readDoor({ id: 2, builder_id: 8, has_transcript: true }), '', 'no viewer, no door');
+});
+
+test('transcript text is escaped — stored content is arbitrary builder + tool output', () => {
+  const { turnHtml } = readerFns({ id: 1, rank: 'archon' });
+  const html = turnHtml({
+    role: 'assistant', text: '<img src=x onerror=alert(1)>',
+    tool_calls: [{ name: '<b>Bash</b>', input: '<script>x</script>' }],
+    tool_results: [{ text: '"><svg onload=1>', is_error: true }],
+  });
+  assert.ok(!/<img|<script|<svg|<b>/i.test(html), 'no raw markup survives');
+  assert.match(html, /&lt;img/);
+  assert.match(html, /turn__err/, 'an error result is marked');
+});
+
+test('the transcript panel lives on the SAME page, under the ledger (no second page)', () => {
+  assert.match(HTML, /id="transcript-scroll"/);
+  assert.match(JS, /\/sessions\/\$\{encodeURIComponent\(reader\.id\)\}\/transcript/);
+});

package/tests/hall_tweak_editor.mjs

@@ -635,12 +635,13 @@ try {
     assert.match(HTML, /<body data-page="tweak-editor"[^>]*data-fullscreen-switch/);
     assert.equal((HTML.match(/<h1\b/g) || []).length, 1);
     assert.ok(HTML.indexOf('tweak-editor-lib.js') < HTML.indexOf('tweak-editor.js?'), 'the lib loads first');
-    assert.match(HTML, /shell\.js\?v=2026-10-02-theme/);
+    assert.match(HTML, /shell\.js\?v=2026-10-02-back/);
     assert.equal(/fonts\.googleapis\.com\/css/.test(HTML), false);
     for (const id of ['tw-bar', 'tw-counter', 'tw-open', 'tw-open-more', 'tw-divider', 'tw-openwrap', 'tw-open-menu', 'tw-open-tab', 'tw-open-split', 'tw-frame', 'tw-frame-view', 'tw-split-close', 'tw-download', 'tw-upload', 'tw-file', 'tw-submit', 'tw-paper', 'tw-doc', 'tw-notice', 'tw-done', 'tw-take', 'tw-pick', 'tw-picks', 'tw-refused', 'tw-refused-title', 'tw-refused-list', 'tw-refused-next', 'tw-refused-download', 'tw-refused-close']) {
       assert.ok(new RegExp(`id="${id}"`).test(HTML), `#${id} is in the markup`);
     }
-    assert.match(HTML, />← studio</);
+    // task 1004477: the bar's exit is the shell's, which fills its words.
+    assert.match(HTML, /<a class="tw-back" data-shell-exit href="\/builders\/studio">Back to studio</);
     assert.match(HTML, />submit page</);
     assert.match(HTML, />back to the studio</);
   });

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = 'a8dc2884930ca19a';
+const SHELL_SHA = 'e5094c169d5ee6ef';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);

package/tests/session_transcript.mjs

@@ -264,6 +264,11 @@ await t('read pages in SQL and clamps offset/limit', async () => {
   await db.getSessionTranscript(5, {});
   assert.deepEqual(captured[0].params, [5, 0, 500]);
 });
+await t('the ledger columns carry has_transcript from session_transcripts', async () => {
+  captured.length = 0;
+  await db.listSessionsByBuilder(7, 5);
+  assert.ok(captured[0].sql.replace(/\s+/g, ' ').includes('EXISTS (SELECT 1 FROM session_transcripts st WHERE st.session_id = sr.session_id) AS has_transcript'));
+});
 pool.query = origQuery;
 
 Object.assign(auth, { requireBuilder: orig.requireBuilder, insertAuditLog: orig.insertAuditLog });