@bongos/core 1.21.28 → 1.21.30

package/tests/provisioning_callback_page.mjs

@@ -38,7 +38,7 @@ test('esc renders an absent value as the empty string, never "null"/"undefined"'
   assert.equal(esc(false), 'false');
 });
 
-test('the progress variant escapes the title + domain it interpolates', () => {
+test('the hand-back variant escapes the title + domain it interpolates', () => {
   const html = callbackPage({
     ok: true,
     title: 'Setting up <your> instance',
@@ -49,9 +49,9 @@ test('the progress variant escapes the title + domain it interpolates', () => {
   assert.match(html, /evil&quot;\.example\.com/, 'the domain rides through esc');
   assert.doesNotMatch(html, /Setting up <your> instance/, 'no raw title anywhere on the page');
   assert.doesNotMatch(html, /https:\/\/evil"\.example\.com/, 'no unescaped domain in an href');
-  // it IS the progress variant: the stepper + the config block the client script reads
-  assert.match(html, /id="steps"/);
-  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com"\}/);
+  // it IS the hand-back variant (task 1004548): the way back + the config block the client script reads
+  assert.match(html, /id="back" href="\/projects\?view=new"/);
+  assert.match(html, /__CB_SETUP__=\{"state":"GOODSTATE","domain":"evil\\"\.example\.com","back":"\/projects\?view=new"\}/);
 });
 
 test('the message variant escapes the title but passes server-authored body HTML through', () => {
@@ -63,7 +63,7 @@ test('the message variant escapes the title but passes server-authored body HTML
   assert.match(html, /<h1>This setup link has &lt;expired&gt;<\/h1>/);
   assert.match(html, /<div class="sub"><p>Ask the owner for a fresh link\.<\/p><\/div>/,
     'body is trusted server-authored HTML — the route composes it, a request never does');
-  assert.doesNotMatch(html, /id="steps"/, 'no stepper without ok + state + domain');
+  assert.doesNotMatch(html, /id="back"/, 'no hand-back without ok + state + domain');
   assert.match(html, /badge-warn">⚠️</, 'a failure wears the warning badge');
 });
 

package/tests/provisioning_github_app_routes.mjs

@@ -93,44 +93,43 @@ console.log('\nGET /provisioning/github-app/callback (the public GitHub redirect
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=GHCODE123&state=GOODSTATE`);
   const html = await res.text();
-  t('good state → 200 text/html progress page wired to auto-open', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /Setting up your instance/.test(html) && /Placing credentials/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
+  t('good state → 200 text/html hand-back page', res.status === 200 && /text\/html/.test(res.headers.get('content-type') || '') && /GitHub app created/.test(html) && /__CB_SETUP__/.test(html) && html.includes('GOODSTATE'), `status=${res.status}`);
   t('the page names the instance host', /mercury\.example\.com/.test(html));
-  // task 1003236: a same-tab return (pop-up blocked → form target=_self) must never be
-  // navigated away from the checklist. The page carries a hidden way back, and the
-  // countdown sits behind the pop-up guard.
-  t('carries a hidden "finish your remaining setup steps" link back to the wizard', /<p class="muted hidden" id="back"><a href="\/projects\?view=new">Finish your remaining setup steps/.test(html));
-  t('the auto-open countdown is reachable only past the pop-up guard', /var popup=!!window\.opener\|\|window\.name==='ghAppSetup';/.test(html) && /if\(!popup\)\{[^}]*return;\}\s*var n=4;\(function tick\(\)\{if\(n<=0\)\{location\.href=target;/.test(html) && (html.match(/location\.href=target/g) || []).length === 1);
+  // task 1004548: the founder no longer waits here — the page hands them back to the
+  // checklist, which shows the wait. A manual way back is always on the page.
+  t('carries a plain "back to my checklist" link (works without script)', /<a class="btn" id="back" href="\/projects\?view=new">Back to my checklist/.test(html));
+  t('no progress stepper or countdown left on the page', !/id="steps"/.test(html) && !/Placing credentials/.test(html) && !/location\.href=target/.test(html));
 
   // Run the served script itself (not a copy) against a minimal DOM, once as the
-  // wizard's pop-up and once as a same-tab return, and watch what it does to location.
+  // wizard's pop-up and once as a same-tab return, and watch what it does.
   const script = (html.match(/<script>\s*(\(function\(\)\{[\s\S]*?)<\/script>\s*<\/body>/) || [])[1];
-  t('the progress page ships the client script', typeof script === 'string' && script.length > 200);
-  async function runCallback({ opener, name }) {
+  t('the hand-back page ships the client script', typeof script === 'string' && script.length > 100);
+  async function runCallback({ opener }) {
     const vm = await import('node:vm');
-    const el = () => { const cls = new Set(); return { textContent: '', classList: { add: (...c) => c.forEach((x) => cls.add(x)), remove: (...c) => c.forEach((x) => cls.delete(x)), contains: (c) => cls.has(c) }, querySelector: () => el() }; };
-    const els = { steps: el(), status: el(), cta: el(), go: el(), foot: el(), back: el() };
-    els.steps.querySelector = () => el();
-    els.back.classList.add('hidden'); els.cta.classList.add('hidden');
+    const back = { href: '/projects?view=new' };
     const timers = [];
+    const calls = { close: 0, focusOpener: 0, replaced: null };
     const sandbox = {
-      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com' },
-      opener, name,
-      document: { getElementById: (id) => els[id] || null },
-      location: { pathname: '/api/bongos/provisioning/github-app/callback', href: 'about:callback' },
-      fetch: async () => ({ ok: true, json: async () => ({ ok: true, ready: true, status: 'done' }) }),
+      __CB_SETUP__: { state: 'GOODSTATE', domain: 'mercury.example.com', back: '/projects?view=new' },
+      opener: opener ? { closed: false, focus: () => { calls.focusOpener++; } } : null,
+      close: () => { calls.close++; },
+      document: { getElementById: (id) => (id === 'back' ? back : null) },
+      location: { replace: (u) => { calls.replaced = u; } },
       setTimeout: (fn) => { timers.push(fn); return timers.length; },
       encodeURIComponent,
     };
     sandbox.window = sandbox;
     vm.runInNewContext(script, sandbox);
-    for (let i = 0; i < 5; i++) await new Promise((r) => setImmediate(r)); // let the poll's promise chain settle
-    for (let guard = 0; guard < 10 && timers.length; guard++) { const fn = timers.shift(); fn(); }
-    return { href: sandbox.location.href, go: els.go.textContent, backHidden: els.back.classList.contains('hidden'), foot: els.foot.textContent };
+    const replacedBeforeTimer = calls.replaced;
+    while (timers.length) timers.shift()();
+    return { ...calls, replacedBeforeTimer, backHref: back.href };
   }
-  const popup = await runCallback({ opener: {}, name: 'ghAppSetup' });
-  t('as the wizard’s pop-up it still counts down and opens the instance', popup.href === 'https://mercury.example.com', JSON.stringify(popup));
-  const sameTab = await runCallback({ opener: null, name: '' });
-  t('as a same-tab return it stays put: door shown, way back revealed, no navigation', sameTab.href === 'about:callback' && sameTab.go === 'Open mercury.example.com →' && sameTab.backHidden === false && /checklist is waiting/.test(sameTab.foot), JSON.stringify(sameTab));
+  const want = '/projects?view=new#ghstate=GOODSTATE';
+  const popup = await runCallback({ opener: true });
+  t('as the wizard’s pop-up it focuses the checklist tab and closes itself', popup.focusOpener === 1 && popup.close === 1 && popup.replacedBeforeTimer === null, JSON.stringify(popup));
+  t('…and if the browser refuses the close, the pop-up becomes the checklist', popup.replaced === want, JSON.stringify(popup));
+  const sameTab = await runCallback({ opener: false });
+  t('as a same-tab return it goes straight back to the checklist, carrying the attempt in the fragment', sameTab.close === 0 && sameTab.replaced === want && sameTab.backHref === want, JSON.stringify(sameTab));
 }
 {
   const res = await fetch(`${base}/provisioning/github-app/callback?code=X&state=NOPE`);

package/tests/wizard_auto_open.mjs

@@ -0,0 +1,94 @@
+// tests/wizard_auto_open.mjs — the checklist's "Open my project automatically when it's
+// ready" tick (task 1004548).
+//
+// WHY. The GitHub-App callback page used to hold the founder on its own stepper and open
+// the instance itself. Since task 1004548 it hands them straight back to the checklist,
+// so the auto-open moved there. The rule it must keep: open ONCE, only when sign-in is
+// wired AND the project answers, only after a wait this page actually watched (so a
+// revisit to a long-finished checklist never jumps away), never when the founder
+// unticked it — and prefer a new tab, falling back to this one when the browser blocks
+// an unprompted tab.
+//
+// Executed, not read: the real AUTO_OPEN_KEY…maybeAutoOpen region is sliced out of the
+// page's inline script and run in a node:vm under stubs (the vm-slice idiom of
+// tests/wizard_intent_resume.mjs). The slice boundaries are asserted, so a rename fails
+// loudly instead of testing nothing.
+//
+// Run:  node --test tests/wizard_auto_open.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const HUB = fs.readFileSync(path.join(LANDING, 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+
+const START = SCRIPT.indexOf("    var AUTO_OPEN_KEY = 'cb-open-when-ready';");
+const END = SCRIPT.indexOf('    /* oauth-app — the ADR 0133 one-click GitHub-App manifest flow', START);
+const SLICE = SCRIPT.slice(START, END);
+
+test('the auto-open region is still findable (a rename must fail loudly)', () => {
+  assert.ok(START > 0 && END > START, 'both slice boundaries found');
+  assert.match(SLICE, /function maybeAutoOpen\(\)/);
+  assert.match(SLICE, /function autoOpenTick\(\)/);
+});
+
+const READY = { manifest: 'done', instStatus: 'active', addrReady: true };
+
+function run({ live = READY, armed = true, pref = null, popupBlocked = false, ticks = 1 } = {}) {
+  const store = new Map();
+  if (pref !== null) store.set('cb-open-when-ready', pref);
+  const calls = { opened: [], assigned: [] };
+  const sandbox = {
+    live: { ...live },
+    resolvedDomain: () => 'mercury.example.com',
+    localStorage: { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, v) },
+    window: {
+      open: (u, t) => { calls.opened.push([u, t]); return popupBlocked ? null : { opener: 'checklist' }; },
+      location: { assign: (u) => { calls.assigned.push(u); } },
+    },
+  };
+  sandbox.globalThis = sandbox;
+  vm.createContext(sandbox);
+  vm.runInContext(`${SLICE}\nautoOpenArmed = ${armed ? 'true' : 'false'};\nfor (var i = 0; i < ${ticks}; i++) maybeAutoOpen();\nvar tickHtml = autoOpenTick();`, sandbox);
+  return { calls, sandbox };
+}
+
+test('ready + armed + ticked (the default) → opens the project ONCE, in a new tab', () => {
+  const { calls } = run({ ticks: 3 });
+  assert.deepEqual(calls.opened, [['https://mercury.example.com', '_blank']], 'one new tab, however many renders follow');
+  assert.deepEqual(calls.assigned, [], 'this checklist stays put');
+});
+
+test('a browser that blocks the unprompted tab sends THIS tab instead — the founder asked', () => {
+  const { calls } = run({ popupBlocked: true });
+  assert.deepEqual(calls.assigned, ['https://mercury.example.com']);
+});
+
+test('nothing opens until sign-in is wired AND the project answers', () => {
+  for (const live of [
+    { ...READY, manifest: 'code_received' },
+    { ...READY, instStatus: 'provisioning' },
+    { ...READY, addrReady: false },
+  ]) {
+    const { calls } = run({ live });
+    assert.deepEqual([calls.opened, calls.assigned], [[], []], JSON.stringify(live));
+  }
+});
+
+test('unticked → never opens, and the tick renders unticked', () => {
+  const { calls, sandbox } = run({ pref: '0' });
+  assert.deepEqual([calls.opened, calls.assigned], [[], []]);
+  assert.doesNotMatch(sandbox.tickHtml, / checked/);
+  assert.match(run().sandbox.tickHtml, / checked>/, 'the default is ticked');
+});
+
+test('a checklist that never watched the wait (a revisit) does not jump away', () => {
+  const { calls } = run({ armed: false });
+  assert.deepEqual([calls.opened, calls.assigned], [[], []]);
+});

package/tests/wizard_intent_resume.mjs

@@ -70,10 +70,10 @@ test('both slices are still findable (a rename must fail loudly, not silently pa
 // A faithful miniature: the stubs record what enterCreated ASKS FOR, which is the whole
 // contract — which panel is shown, whether the answers were reset, and what the offer
 // above step 1 was told to name.
-function runEnter({ focus, resumeIntent = false, draft = null, record }) {
+function runEnter({ focus, resumeIntent = false, draft = null, record, handbackState = null }) {
   const store = new Map();
   if (draft) store.set('draft', JSON.stringify(draft));
-  const calls = { show: [], resets: 0, offer: [], done: 0, progress: [], polls: 0, focused: 0 };
+  const calls = { show: [], resets: 0, offer: [], done: 0, progress: [], polls: 0, focused: 0, remembered: [] };
   // state.step is the DONE step for the whole life of a finished standup — the value
   // a draft-blind reading would have trusted
   const state = { step: draft ? draft.step : 6, name: 'Mercury', slug: 'mercury', domain: '', mode: 'greenfield', noAddress: false, modules: null };
@@ -83,6 +83,8 @@ function runEnter({ focus, resumeIntent = false, draft = null, record }) {
     live: { manifest: null, appSlug: null },
     manifestState: null,
     manifestPending: false,
+    handbackState,   // the #ghstate=… a GitHub hand-back carries (task 1004548); null on a plain arrival
+    rememberManifest(st, status) { calls.remembered.push([st, status]); },
     sessionStorage: { getItem: (k) => (store.has(k) ? store.get(k) : null) },
     resetForNewProject() { calls.resets += 1; state.step = 1; state.name = ''; state.slug = ''; },
     paintResumeOffer(c) { calls.offer.push(c ? (c.name || c.slug) : null); },
@@ -111,6 +113,19 @@ test('a reload / Back / identity settle (focus false) still resumes the done pan
   assert.deepEqual(calls.offer, [null], 'the offer is down — the done panel is on stage, not step 1');
 });
 
+test('a hand-back from the GitHub callback page resumes watching THAT attempt (task 1004548)', () => {
+  const { calls, sandbox } = runEnter({ focus: false, record: { ...REC }, handbackState: 'ab'.repeat(32) });
+  assert.deepEqual(calls.show, [[6, false]], 'the founder lands on their checklist');
+  assert.equal(sandbox.manifestState, 'ab'.repeat(32), 'the sign-in step polls the attempt GitHub just approved');
+  assert.equal(sandbox.manifestPending, true, 'and the poll is queued for resumePolls()');
+  assert.equal(sandbox.live.manifest, 'code_received', 'it shows the wait, not "Set up GitHub sign-in" again');
+  assert.deepEqual(calls.remembered, [['ab'.repeat(32), 'code_received']], 'the attempt is kept across a reload');
+  assert.equal(sandbox.handbackState, null, 'read once — a later arrival is not a hand-back');
+  const done = runEnter({ focus: false, record: { ...REC, manifest: 'done' }, handbackState: 'cd'.repeat(32) });
+  assert.equal(done.sandbox.live.manifest, 'done', 'a finished setup is never walked back to waiting');
+  assert.equal(done.sandbox.manifestPending, false, 'and nothing is polled for it');
+});
+
 test('a deliberate "New project" click after a finished standup opens a FRESH step 1', () => {
   const { calls, state } = runEnter({ focus: true, record: REC });
   assert.equal(calls.done, 0, 'the previous project\'s done panel is not painted');