@bongos/core 1.21.78 → 1.21.80

package/tests/module_assess_installs.mjs

@@ -0,0 +1,272 @@
+// tests/module_assess_installs.mjs — the Install and Reliability parts of a module's
+// assessment, from what real installs report (task 1003793, ADR 0343 D1; core_273).
+//
+// No database, no network: the scorers are pure, the intake and the re-score run
+// against a regex-dispatching fake pool that throws on any SQL it does not expect
+// (ADR 0216 fail-loud), and the CLI runs against a fake store built from a REAL
+// packed tarball. The owner's privacy posture — counts only, on by default, with an
+// opt-out — is held from three sides: the intake's validators, the migration's
+// columns and CHECKs, and the opt-out dropping a report before anything is written.
+//
+// Run:  node tests/module_assess_installs.mjs
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { MIN_HOLDERS, assessInstall, assessReliability, recordInstallSignals } = require('../scripts/gds/module-assess-installs.js');
+const reports = require('../src/bongos/module-usage-reports.js');
+const { ERROR_CODE_RE } = require('../src/bongos/module-usage-reports.js');
+const { cmdInstall } = require('../scripts/gds/module.js');
+const { packModule, verifyModuleArtifact } = require('../scripts/gds/module-artifact.js');
+
+const read = (rel) => fs.readFileSync(path.join(ROOT, rel), 'utf8').replace(/\r\n/g, '\n');
+
+// ---- the scorers (pure) ----
+
+test('Install: no reports is no_data, never a zero', () => {
+  const s = assessInstall([]);
+  assert.equal(s.outcome, 'no_data');
+  assert.equal(s.score, null);
+  assert.equal(s.sample_size, 0);
+});
+
+test(`Install: fewer than ${MIN_HOLDERS} holders is pending, so one friend cannot set the number`, () => {
+  const s = assessInstall([{ ok: true }, { ok: true }]);
+  assert.equal(s.outcome, 'pending');
+  assert.equal(s.score, null);
+  assert.equal(s.sample_size, 2);
+  assert.match(s.reason, /2 of the 3 installs needed/);
+});
+
+test('Install: the share of holders whose latest install worked, with the failure codes counted', () => {
+  const s = assessInstall([
+    { ok: true }, { ok: true }, { ok: true },
+    { ok: false, error_code: 'verify_failed' }, { ok: false, error_code: 'place_failed' }, { ok: false, error_code: 'place_failed' },
+  ]);
+  assert.equal(s.outcome, 'scored');
+  assert.equal(s.score, 50);
+  assert.equal(s.sample_size, 6);
+  assert.equal(s.reason, '3 of 6 installs worked');
+  assert.deepEqual(s.detail.failed_codes, { verify_failed: 1, place_failed: 2 });
+});
+
+test('Reliability: the share of holder-days with zero errors; sample_size counts holders, not days', () => {
+  const days = [
+    { holder_kind: 'builder', holder_ref: '1', error_count: 0 },
+    { holder_kind: 'builder', holder_ref: '1', error_count: 4 },
+    { holder_kind: 'builder', holder_ref: '2', error_count: 0 },
+    { holder_kind: 'builder', holder_ref: '3', error_count: 0 },
+  ];
+  const s = assessReliability(days);
+  assert.equal(s.outcome, 'scored');
+  assert.equal(s.score, 75);
+  assert.equal(s.sample_size, 3);
+  assert.equal(s.detail.errors, 4);
+  assert.equal(assessReliability([]).outcome, 'no_data');
+  assert.equal(assessReliability(days.slice(0, 3)).outcome, 'pending', 'two holders is not enough');
+});
+
+// ---- the intake: counts only ----
+
+test('an install report is a yes/no plus a short code — never a message', () => {
+  assert.equal(reports.installReportError({ ok: true, errorCode: null }), null);
+  assert.equal(reports.installReportError({ ok: false, errorCode: 'verify_failed' }), null);
+  assert.equal(reports.installReportError({ ok: 'yes' }).code, 'bad_report');
+  assert.equal(reports.installReportError({ ok: true, errorCode: 'x' }).code, 'bad_report', 'a working install carries no code');
+  assert.equal(reports.installReportError({ ok: false, errorCode: null }).code, 'bad_error_code');
+  for (const smuggled of ['Error: ENOENT /home/me/x', 'Verify Failed', 'a'.repeat(41), 'path/to', 'x y']) {
+    assert.equal(reports.installReportError({ ok: false, errorCode: smuggled }).code, 'bad_error_code', smuggled);
+  }
+});
+
+test('a daily error count is a whole number for a recent, non-future day', () => {
+  const today = '2026-10-08';
+  assert.equal(reports.errorCountError({ day: '2026-10-08', count: 0 }, { today }), null);
+  assert.equal(reports.errorCountError({ day: '2026-09-08', count: 3 }, { today }), null, '30 days back is the edge');
+  assert.equal(reports.errorCountError({ day: '2026-09-07', count: 3 }, { today }).code, 'bad_day');
+  assert.equal(reports.errorCountError({ day: '2026-10-09', count: 3 }, { today }).code, 'bad_day');
+  assert.equal(reports.errorCountError({ day: 'yesterday', count: 3 }, { today }).code, 'bad_day');
+  assert.equal(reports.errorCountError({ day: '2026-10-08', count: 1.5 }, { today }).code, 'bad_count');
+  assert.equal(reports.errorCountError({ day: '2026-10-08', count: -1 }, { today }).code, 'bad_count');
+});
+
+// A fake pool that answers only the SQL it is told to, and records every call.
+function fakeDb(handlers) {
+  const calls = [];
+  return {
+    calls,
+    async query(sql, params) {
+      calls.push({ sql, params });
+      for (const [re, fn] of handlers) if (re.test(sql)) return fn(params);
+      throw new Error(`unexpected SQL: ${sql.slice(0, 80)}`);
+    },
+  };
+}
+
+test('opted out: the report is dropped before anything is written', async () => {
+  const db = fakeDb([[/FROM module_usage_report_optouts/, () => ({ rows: [{ '?column?': 1 }] })]]);
+  const holder = { holderKind: 'builder', holderRef: '7' };
+  assert.deepEqual(await reports.recordInstallReport({ versionId: 1, ...holder, ok: true }, { db }), { recorded: false, reason: 'opted_out' });
+  assert.deepEqual(await reports.recordErrorCount({ versionId: 1, ...holder, day: '2026-10-08', count: 2 }, { db }), { recorded: false, reason: 'opted_out' });
+  assert.ok(!db.calls.some((c) => /INSERT/.test(c.sql)), 'no INSERT ran');
+});
+
+test('on by default: no opt-out row means the report is recorded; a same-day count replaces, never adds', async () => {
+  const db = fakeDb([
+    [/FROM module_usage_report_optouts/, () => ({ rows: [] })],
+    [/INSERT INTO module_install_reports/, () => ({ rows: [] })],
+    [/INSERT INTO module_runtime_error_counts/, () => ({ rows: [] })],
+  ]);
+  const holder = { holderKind: 'builder', holderRef: '7' };
+  assert.deepEqual(await reports.recordInstallReport({ versionId: 1, ...holder, ok: false, errorCode: 'verify_failed' }, { db }), { recorded: true });
+  const install = db.calls.find((c) => /module_install_reports/.test(c.sql)).sql;
+  assert.match(install, /ON CONFLICT \(version_id, holder_kind, holder_ref\)\s*DO UPDATE SET ok = EXCLUDED\.ok/,
+    "a retry replaces the holder's row, never adds one");
+  await reports.recordErrorCount({ versionId: 1, ...holder, day: '2026-10-08', count: 2 }, { db });
+  const upsert = db.calls.find((c) => /module_runtime_error_counts/.test(c.sql)).sql;
+  assert.match(upsert, /DO UPDATE SET error_count = EXCLUDED\.error_count/);
+});
+
+test('the switch: off writes an opt-out row, on deletes it', async () => {
+  const db = fakeDb([
+    [/INSERT INTO module_usage_report_optouts/, () => ({ rows: [] })],
+    [/DELETE FROM module_usage_report_optouts/, () => ({ rows: [] })],
+  ]);
+  assert.deepEqual(await reports.setReporting({ holderKind: 'builder', holderRef: '7', enabled: false }, { db }), { enabled: false });
+  assert.deepEqual(await reports.setReporting({ holderKind: 'builder', holderRef: '7', enabled: true }, { db }), { enabled: true });
+  assert.deepEqual(db.calls.map((c) => c.sql.trim().split(/\s+/)[0]), ['INSERT', 'DELETE']);
+});
+
+// ---- the re-score ----
+
+function scoringDb({ latest, days, current = [] }) {
+  return fakeDb([
+    [/FROM module_install_reports r/, () => ({ rows: latest })],
+    [/FROM module_runtime_error_counts r/, () => ({ rows: days })],
+    [/part IN \('install', 'reliability'\)/, () => ({ rows: current })],
+    [/INSERT INTO module_assessment_signals/, () => ({ rows: [] })],
+    [/SELECT DISTINCT ON \(part\) id, part, outcome, score, sample_size/, () => ({ rows: [] })],
+    [/FROM module_assessment_scores/, () => ({ rows: [] })],
+    [/INSERT INTO module_assessment_scores/, (p) => ({ rows: [{ id: 1, version_id: p[0], formula: p[4] }] })],
+  ]);
+}
+
+test('re-score: the module author is never counted, and each holder is one row (their latest attempt)', async () => {
+  const db = scoringDb({ latest: [], days: [] });
+  await recordInstallSignals(5, { db });
+  for (const table of ['module_install_reports', 'module_runtime_error_counts']) {
+    const sql = db.calls.find((c) => c.sql.includes(`FROM ${table} r`)).sql;
+    assert.match(sql, /NOT \(r\.holder_kind = 'builder' AND r\.holder_ref = m\.author_id::text\)/, `${table} excludes the author`);
+  }
+  const install = db.calls.find((c) => c.sql.includes('FROM module_install_reports r')).sql;
+  assert.doesNotMatch(install, /DISTINCT ON|ORDER BY/, 'one row per holder already, so no history scan');
+});
+
+test('re-score: writes a signal row only for a part whose result moved, then re-composes', async () => {
+  const latest = [{ ok: true }, { ok: true }, { ok: false, error_code: 'place_failed' }];
+  const db = scoringDb({
+    latest, days: [],
+    current: [{ part: 'reliability', outcome: 'no_data', score: null, sample_size: 0 }],
+  });
+  const res = await recordInstallSignals(5, { db });
+  assert.deepEqual(res.written, ['install'], 'reliability is unchanged, so no new row');
+  const insert = db.calls.find((c) => /INSERT INTO module_assessment_signals/.test(c.sql));
+  assert.deepEqual(insert.params.slice(0, 5), [5, 'install', 'scored', 67, 3]);
+  assert.ok(db.calls.some((c) => /INSERT INTO module_assessment_scores/.test(c.sql)), 'the overall score re-composed');
+
+  const again = scoringDb({ latest, days: [], current: [
+    { part: 'install', outcome: 'scored', score: 67, sample_size: 3 },
+    { part: 'reliability', outcome: 'no_data', score: null, sample_size: 0 },
+  ] });
+  const res2 = await recordInstallSignals(5, { db: again });
+  assert.deepEqual(res2.written, []);
+  assert.ok(!again.calls.some((c) => /INSERT/.test(c.sql)), 'nothing moved, nothing written');
+});
+
+// ---- the migration: there is nowhere to put anything but counts ----
+
+test('core_273: three additive tables whose columns hold counts and codes only', () => {
+  const sql = read('migrations/core_273_module_install_reports.sql');
+  const DDL = sql.replace(/--.*$/gm, '');
+  for (const t of ['module_install_reports', 'module_runtime_error_counts', 'module_usage_report_optouts']) {
+    assert.match(DDL, new RegExp(`CREATE TABLE IF NOT EXISTS ${t} \\(`), t);
+  }
+  assert.match(DDL, /error_code\s+text CHECK \(error_code ~ '\^\[a-z\]\[a-z0-9_\]\{0,39\}\$'\)/, 'the code is held to the same rule as the intake');
+  assert.equal(String(ERROR_CODE_RE), '/^[a-z][a-z0-9_]{0,39}$/', 'intake and CHECK agree');
+  assert.match(DDL, /CHECK \(\(ok AND error_code IS NULL\) OR \(NOT ok AND error_code IS NOT NULL\)\)/);
+  assert.match(DDL, /PRIMARY KEY \(version_id, holder_kind, holder_ref, day\)/, 'one count per holder per day');
+  assert.match(DDL, /PRIMARY KEY \(version_id, holder_kind, holder_ref\)\n\);/, 'one install row per holder per version: grows with holders, never with retries');
+  const textCols = [...DDL.matchAll(/^\s+(\w+)\s+text\b/gm)].map((m) => m[1]).sort();
+  assert.deepEqual([...new Set(textCols)], ['error_code', 'holder_kind', 'holder_ref'], 'no free-text column for a message or a path');
+  assert.doesNotMatch(DDL, /\b(DROP|ALTER)\b|^\s*(UPDATE|DELETE)\b/m, 'additive only');
+  assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('core_273_module_install_reports'\)/);
+});
+
+// ---- the routes and the settings switch, pinned in their source ----
+
+test('the report routes are own-scoped, need a live holder, and re-score after an accepted report', () => {
+  const src = read('src/bongos/routes/modules.js');
+  for (const p of ['/store/modules/:key/versions/:version/install-report', '/store/modules/:key/versions/:version/error-count', '/store/usage-reporting']) {
+    assert.match(src, new RegExp(`router\\.(post|get)\\('${p.replace(/[/:]/g, (c) => `\\${c}`)}', auth\\.requireBuilder`), p);
+  }
+  assert.match(src, /holderKind: 'builder', holderRef: String\(req\.builder\.id\)/);
+  assert.match(src, /if \(!held\.entitled\) \{\s*res\.fail\('not_entitled'/);
+  assert.match(src, /res\.json\(\{ ok: true, recorded: out\.recorded[^\n]*\n\s*if \(out\.recorded\) rescore\(t\.versionId\);/, 're-scores after answering');
+  assert.match(src, /function rescore\(versionId\) \{\s*setImmediate\(/, 'the re-score is off the request path');
+});
+
+test('Settings carries the opt-out, on by default, saved through the store route', () => {
+  const html = read('modules/hall-ui/public/settings.html');
+  const js = read('modules/hall-ui/public/settings-usage-reports.js');
+  assert.match(html, /<section class="scroll" id="usage-reports-scroll"[^>]*data-group="preferences" hidden>/);
+  assert.match(html, /<script src="\/builders\/settings-usage-reports\.js\?v=[^"]+"><\/script>/);
+  assert.match(js, /api\.request\('GET', `\$\{API\}\/store\/usage-reporting`\)/);
+  assert.match(js, /api\.request\('POST', `\$\{API\}\/store\/usage-reporting`, \{ body: \{ enabled: value === 'on' \} \}\)/);
+  assert.match(js, /render\(res\.data\.enabled !== false\)/, 'anything but an explicit false reads as on');
+});
+
+// ---- the CLI: a failed install is reported with a code, never a message ----
+
+test('install: a tarball that fails verification is reported as verify_failed', async () => {
+  const src = fs.mkdtempSync(path.join(os.tmpdir(), 'mod-assess-installs-'));
+  const manifest = { key: 'weather', title: 'Weather', description: 'Shows the weather.', version: '1.2.0', coreVersion: '^1.0.0', contributes: {} };
+  fs.mkdirSync(path.join(src, 'weather'), { recursive: true });
+  fs.writeFileSync(path.join(src, 'weather', 'module.json'), JSON.stringify(manifest));
+  const { tgz } = packModule('weather', { modulesDir: src, now: () => new Date('2026-10-01T00:00:00Z'), modeOf: () => '644' });
+  const v = await verifyModuleArtifact(tgz, { key: 'weather' });
+  const calls = [];
+  const request = async (method, urlPath, opts = {}) => {
+    calls.push({ method, urlPath, json: opts.json });
+    if (urlPath.endsWith('/acquire')) {
+      return { ok: true, status: 200, data: { version: v.version, core_version: v.coreVersion, tarball_sha256: v.tarballSha256, tree_sha256: v.treeSha256 } };
+    }
+    if (urlPath.endsWith('/tarball')) return { ok: true, status: 200, buf: Buffer.from('not a tarball') };
+    if (urlPath.endsWith('/install-report')) return { ok: true, status: 200, data: { ok: true, recorded: true } };
+    throw new Error(`unexpected ${method} ${urlPath}`);
+  };
+  const out = [];
+  const code = await cmdInstall(['weather'], { log: (m) => out.push(m), errlog: (m) => out.push(m), modulesDir: fs.mkdtempSync(path.join(os.tmpdir(), 'mod-dest-')), roots: [], request, core: '1.19.0' });
+  assert.equal(code, 1);
+  const report = calls.find((c) => c.urlPath.endsWith('/install-report'));
+  assert.equal(report.urlPath, '/store/modules/weather/versions/1.2.0/install-report');
+  assert.deepEqual(report.json, { ok: false, error_code: 'verify_failed' }, 'a code, never the message');
+});
+
+test('install: a store that refuses or cannot be reached is not the module\'s fault, so nothing is reported', async () => {
+  const calls = [];
+  const request = async (method, urlPath) => {
+    calls.push(urlPath);
+    if (urlPath.endsWith('/acquire')) return { ok: false, status: 402, data: { error: { code: 'payment_required' } } };
+    throw new Error(`unexpected ${urlPath}`);
+  };
+  const code = await cmdInstall(['weather'], { log() {}, errlog() {}, modulesDir: fs.mkdtempSync(path.join(os.tmpdir(), 'mod-dest-')), roots: [], request });
+  assert.equal(code, 1);
+  assert.deepEqual(calls, ['/store/modules/weather/acquire']);
+});

package/tests/module_install.mjs

@@ -49,6 +49,7 @@ function fakeStore({ tgz, v }, over = {}) {
     if (urlPath.endsWith('/acquire')) return over.acquire || { ok: true, status: 200, data: { ...describe, ...(over.describe || {}) } };
     if (urlPath.endsWith('/tarball')) return over.download || { ok: true, status: 200, buf: over.buf || tgz };
     if (urlPath.endsWith('/acquired')) return over.acquired || { ok: true, status: 200, data: { ok: true } };
+    if (urlPath.endsWith('/install-report')) return { ok: true, status: 200, data: { ok: true, recorded: true } };
     throw new Error(`unexpected ${method} ${urlPath}`);
   };
   return { calls, request };
@@ -75,8 +76,10 @@ test('installs a free module: verified, placed, recorded, and NOT enabled', asyn
     'POST /store/modules/weather/acquire',
     'GET /store/modules/weather/versions/1.2.0/tarball',
     'POST /store/modules/weather/acquired',
+    'POST /store/modules/weather/versions/1.2.0/install-report',
   ]);
   assert.deepEqual(store.calls[2].json, { version: '1.2.0' }, 'records the exact version placed');
+  assert.deepEqual(store.calls[3].json, { ok: true }, 'reports that the install worked — counts only (task 1003793)');
   assert.match(q.out.join('\n'), /not switched on/);
 });
 

package/tests/module_update.mjs

@@ -68,6 +68,7 @@ function fakeStore({ tgz, v }, { source = 'free', over = {} } = {}) {
     }
     if (urlPath.endsWith('/tarball')) return { ok: true, status: 200, buf: over.buf || tgz };
     if (urlPath.endsWith('/acquired')) return { ok: true, status: 200, data: { ok: true } };
+    if (urlPath.endsWith('/install-report')) return { ok: true, status: 200, data: { ok: true, recorded: true } };
     throw new Error(`unexpected ${method} ${urlPath}`);
   };
   return { calls, request };
@@ -91,8 +92,10 @@ test('updates an installed module to the newest version: files replaced, old-onl
     'POST /store/modules/weather/acquire',
     'GET /store/modules/weather/versions/1.3.0/tarball',
     'POST /store/modules/weather/acquired',
+    'POST /store/modules/weather/versions/1.3.0/install-report',
   ]);
   assert.deepEqual(store.calls[2].json, { version: '1.3.0' });
+  assert.deepEqual(store.calls[3].json, { ok: true }, 'an update reports like an install (task 1003793)');
   assert.match(q.out.join('\n'), /1\.2\.0 → 1\.3\.0\. Its on\/off switch is unchanged/);
 });
 

package/tests/nav_permission_atoms.mjs

@@ -87,7 +87,7 @@ test('the hall-preview fixture carries every atom /me resolves', () => {
 // the file and left the query alone, so a returning browser kept the cached copy —
 // a fix that reaches nobody looks identical to a fix that does not work.
 
-const SHELL_SHA = '02e600a176c32f6a';
+const SHELL_SHA = 'd080c7a69a310077';
 
 test('shell.js has not changed without its cache-bust being bumped', () => {
   const actual = crypto.createHash('sha256').update(SHELL).digest('hex').slice(0, 16);