@bongos/core 1.23.22 → 1.24.1

package/tests/claims_batch_routes.mjs

@@ -0,0 +1,421 @@
+// tests/claims_batch_routes.mjs — the batch claim and batch release routes,
+// driven end to end through express and the error envelope (task 1004983;
+// gaps 2 and 15 of credit-burn/test-gap-hunt.md).
+//
+// Why this file exists. releaseClaimsBatch (modules/lifecycle/db-claims.js) was
+// named in no test, yet it is the one place a builder hands N claims back at
+// once: it sets each task to 'ready' and clears needs_rebase, and its `force`
+// flag skips the session check. The only thing that stops a builder releasing
+// SOMEONE ELSE's claim is its per-item ownership compare. POST /claims/batch
+// was never driven as a route either, so nothing pinned which gates sit in
+// front of it.
+//
+// How. The doorway (src/module-api.js) is stubbed in require.cache BEFORE the
+// route loads — db-claims.js destructures pool/withTx at require time, the
+// tests/access_requests_invite.mjs pattern. requireBuilder admits whichever
+// caller a test sets; withTx runs the REAL releaseClaimsBatch against a client
+// that records every query and answers the claims read from a fixture. For
+// POST /claims/batch the db facade's claimTasksBatch is swapped per test for a
+// recording handler (the route reads it at call time), so each documented error
+// can be thrown on demand.
+//
+// Every permission test asserts BOTH halves: the refusal, and that no write
+// query ran.
+//
+// Run:  node --test tests/claims_batch_routes.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after, beforeEach } from 'node:test';
+import http from 'node:http';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const express = require('express');
+
+const apiPath = require.resolve('../src/module-api.js');
+const realApi = require(apiPath);
+
+// ── the recording pool ───────────────────────────────────────────────────────
+
+let calls = [];          // every query any path ran: { sql, params, via }
+let claimFixture = [];   // rows the claims read answers with
+let activeClaims = [];   // rows getActiveClaimsForBuilder answers with
+let connects = 0;        // pool.connect() count — claimTasksBatch's tx door
+
+function answer(sql, params, via) {
+  calls.push({ sql, params, via });
+  // The release's locked read (FOR UPDATE) — distinct from the newcomer gate's
+  // active-claims read, which joins the same tables.
+  if (/FROM claims c JOIN tasks t ON t\.id = c\.task_id/.test(sql) && /FOR UPDATE/.test(sql)) {
+    const wanted = new Set(params[0].map(String));
+    return { rows: claimFixture.filter((r) => wanted.has(String(r.id))) };
+  }
+  if (/FROM claims c/.test(sql) && /released_at IS NULL/.test(sql)) {
+    return { rows: activeClaims };
+  }
+  return { rows: [], rowCount: 1 };
+}
+const client = {
+  async query(sql, params) { return answer(sql, params, 'tx'); },
+  release() {},
+};
+const pool = {
+  async query(sql, params) { return answer(sql, params, 'pool'); },
+  async connect() { connects += 1; return client; },
+};
+// Same shape as src/bongos/db-kernel.js withTx, on the recording client.
+async function withTx(fn) {
+  await client.query('BEGIN');
+  try {
+    const out = await fn(client);
+    await client.query('COMMIT');
+    return out;
+  } catch (err) {
+    await client.query('ROLLBACK');
+    throw err;
+  }
+}
+
+let caller = { id: '42', rank: 'thetes' };
+let callerSession = 'sess-A';
+function requireBuilder(req, _res, next) {
+  req.builder = { ...caller };
+  req.gdsSession = callerSession ? { session_id: callerSession } : undefined;
+  next();
+}
+
+require.cache[apiPath].exports = { ...realApi, pool, withTx, requireBuilder };
+
+const db = require('../modules/lifecycle/db.js');
+const realClaimTasksBatch = db.claimTasksBatch;
+const buildClaimsRouter = require('../modules/lifecycle/routes/claims.js');
+const { attachFail } = require('../src/bongos/middleware/error-envelope.js');
+
+const router = buildClaimsRouter();
+const app = express();
+app.use(express.json());
+app.use(attachFail);
+app.use('/api/bongos', router);
+
+let server, port;
+before(async () => {
+  server = http.createServer(app);
+  await new Promise((r) => server.listen(0, '127.0.0.1', r));
+  port = server.address().port;
+});
+after(async () => { await new Promise((r) => server.close(r)); });
+
+beforeEach(() => {
+  calls = []; claimFixture = []; activeClaims = []; connects = 0;
+  caller = { id: '42', rank: 'thetes' };
+  callerSession = 'sess-A';
+  db.claimTasksBatch = realClaimTasksBatch;
+});
+
+function post(pathname, body) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request({
+      host: '127.0.0.1', port, path: pathname, method: 'POST',
+      headers: { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let data = '';
+      res.on('data', (c) => { data += c; });
+      res.on('end', () => resolve({ status: res.statusCode, json: data ? JSON.parse(data) : null }));
+    });
+    req.on('error', reject);
+    req.write(payload);
+    req.end();
+  });
+}
+
+const RELEASE = '/api/bongos/claims/batch/release';
+const CLAIM = '/api/bongos/claims/batch';
+
+// Any statement that changes state. BEGIN/COMMIT and SELECTs are not writes.
+const isWrite = (c) => /^\s*(UPDATE|INSERT|DELETE)\b/i.test(c.sql);
+const writes = () => calls.filter(isWrite);
+const claimReleases = () => writes().filter((c) => /UPDATE claims SET released_at/.test(c.sql));
+const taskToReady = () => writes().filter((c) => /UPDATE tasks\s+SET status = 'ready'/.test(c.sql));
+
+// A claim row as the locked read returns it. node-pg hands bigint columns back
+// as strings, so the realistic default spells every id that way.
+const row = (over) => ({
+  id: '101', task_id: '501', builder_id: '42', released_at: null,
+  claimed_at: '2026-10-29T10:00:00Z', worktree_name: 'tree-a',
+  creator_session_id: 'sess-A', title: 'Own task', ...over,
+});
+
+// ── POST /claims/batch/release — the mixed batch ─────────────────────────────
+
+test('batch release [own, another builder\'s, own already-released, missing]: only the own open claim is released', async () => {
+  claimFixture = [
+    row({ id: '101', task_id: '501', title: 'Own task' }),
+    row({ id: '102', task_id: '502', builder_id: '7', creator_session_id: 'sess-Z', title: 'Their task' }),
+    row({ id: '103', task_id: '503', released_at: '2026-10-28T00:00:00Z', title: 'Old task' }),
+  ];
+  const r = await post(RELEASE, { claim_ids: [101, 102, 103, 999] });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.released, [{ claim_id: 101, task_id: '501', task_title: 'Own task' }]);
+  assert.deepEqual(r.json.failures, [
+    { claim_id: 102, reason: 'NOT_YOUR_CLAIM' },
+    { claim_id: 103, reason: 'ALREADY_RESOLVED' },
+    { claim_id: 999, reason: 'CLAIM_NOT_FOUND' },
+  ]);
+  // Exactly one claim closed and one task sent back to the queue — the own one.
+  assert.equal(claimReleases().length, 1);
+  assert.deepEqual(claimReleases()[0].params, [101]);
+  assert.equal(taskToReady().length, 1);
+  assert.deepEqual(taskToReady()[0].params, ['501']);
+  // Nothing at all was written about the other builder's claim or task.
+  for (const w of writes()) {
+    assert.ok(!w.params.map(String).some((p) => p === '102' || p === '502'),
+      `a write touched the other builder's claim or task: ${w.sql.trim().slice(0, 60)}`);
+  }
+});
+
+test('batch release of ONLY another builder\'s claim: refused, and no write query ran', async () => {
+  claimFixture = [row({ id: '102', task_id: '502', builder_id: '7', creator_session_id: 'sess-Z' })];
+  const r = await post(RELEASE, { claim_ids: [102] });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.released, []);
+  assert.deepEqual(r.json.failures, [{ claim_id: 102, reason: 'NOT_YOUR_CLAIM' }]);
+  assert.deepEqual(writes(), []);
+});
+
+test('force does not reach past ownership: another builder\'s claim with force:true is still refused, nothing written', async () => {
+  claimFixture = [row({ id: '102', task_id: '502', builder_id: '7', creator_session_id: 'sess-Z' })];
+  const r = await post(RELEASE, { claim_ids: [102], force: true });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.released, []);
+  assert.deepEqual(r.json.failures, [{ claim_id: 102, reason: 'NOT_YOUR_CLAIM' }]);
+  assert.deepEqual(writes(), []);
+});
+
+// ── the id-type matrix (node-pg bigint strings vs numbers) ────────────────────
+
+test('another builder\'s claim is refused whatever the id types — string or number on either side', async () => {
+  for (const [rowId, callerId] of [['7', '42'], ['7', 42], [7, '42'], [7, 42]]) {
+    calls = [];
+    caller = { id: callerId, rank: 'thetes' };
+    claimFixture = [row({ id: '102', task_id: '502', builder_id: rowId, creator_session_id: 'sess-Z' })];
+    const r = await post(RELEASE, { claim_ids: [102] });
+    assert.deepEqual(r.json.failures, [{ claim_id: 102, reason: 'NOT_YOUR_CLAIM' }],
+      `row builder_id ${JSON.stringify(rowId)} vs caller ${JSON.stringify(callerId)}`);
+    assert.deepEqual(writes(), []);
+  }
+});
+
+test('own claim with matching id types (both strings, as production sends them) is released', async () => {
+  caller = { id: '42', rank: 'thetes' };
+  claimFixture = [row({ builder_id: '42' }), row({ id: '102', task_id: '502', builder_id: '7', creator_session_id: 'sess-Z' })];
+  const r = await post(RELEASE, { claim_ids: [101, 102] });
+  assert.deepEqual(r.json.released.map((x) => x.claim_id), [101]);
+  assert.deepEqual(r.json.failures, [{ claim_id: 102, reason: 'NOT_YOUR_CLAIM' }]);
+  assert.equal(claimReleases().length, 1);
+});
+
+// KNOWN BUG (task 1005004, filed by task 1004983): releaseClaimsBatch compares
+// claim.builder_id !== builderId strictly, so a STRING row id (node-pg bigint)
+// against a NUMBER caller id refuses the caller's OWN claim as NOT_YOUR_CLAIM.
+// Production is unaffected today only because req.builder.id is also a string.
+// It fails closed (never releases a stranger's claim), so this pins CURRENT
+// behaviour; when the compare is fixed, flip this to expect a release.
+test('KNOWN BUG: own claim as string builder_id vs a NUMBER caller id is refused NOT_YOUR_CLAIM (fails closed)', async () => {
+  caller = { id: 42, rank: 'thetes' };
+  claimFixture = [row({ builder_id: '42' })];
+  const r = await post(RELEASE, { claim_ids: [101] });
+  assert.deepEqual(r.json.released, []);
+  assert.deepEqual(r.json.failures, [{ claim_id: 101, reason: 'NOT_YOUR_CLAIM' }]);
+  assert.deepEqual(writes(), []);
+});
+
+// ── the session check, and force ─────────────────────────────────────────────
+
+test('own claim bound to a different session, without force: CLAIM_SESSION_MISMATCH, nothing written', async () => {
+  callerSession = 'sess-A';
+  claimFixture = [row({ creator_session_id: 'sess-B', worktree_name: 'tree-b' })];
+  const r = await post(RELEASE, { claim_ids: [101] });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.released, []);
+  assert.deepEqual(r.json.failures, [{ claim_id: 101, reason: 'CLAIM_SESSION_MISMATCH', claimWorktree: 'tree-b' }]);
+  assert.deepEqual(writes(), []);
+});
+
+test('own claim bound to a different session, WITH force: released', async () => {
+  callerSession = 'sess-A';
+  claimFixture = [row({ creator_session_id: 'sess-B', worktree_name: 'tree-b' })];
+  const r = await post(RELEASE, { claim_ids: [101], force: true });
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.json.released.map((x) => x.claim_id), [101]);
+  assert.deepEqual(r.json.failures, []);
+  assert.equal(claimReleases().length, 1);
+  assert.equal(taskToReady().length, 1);
+});
+
+test('force must be the boolean true: a truthy string is refused by validation before any query', async () => {
+  claimFixture = [row({ creator_session_id: 'sess-B' })];
+  const r = await post(RELEASE, { claim_ids: [101], force: 'yes' });
+  assert.equal(r.status, 400);
+  assert.deepEqual(calls, []);
+});
+
+test('a released task goes back to ready with needs_rebase cleared, and the session log is sealed as abandoned', async () => {
+  claimFixture = [row()];
+  await post(RELEASE, { claim_ids: [101] });
+  const ready = taskToReady()[0];
+  assert.match(ready.sql, /needs_rebase = false/);
+  assert.match(ready.sql, /needs_rebase_reason = NULL/);
+  assert.match(claimReleases()[0].sql, /outcome = 'abandoned'/);
+  const seal = writes().find((c) => /INSERT INTO session_logs/.test(c.sql));
+  assert.ok(seal, 'session log sealed');
+  assert.equal(seal.params[0], '42', 'sealed under the caller, never a caller-supplied id');
+  assert.equal(seal.params[4], 'abandoned');
+  // All of it inside one transaction.
+  assert.equal(calls[0].sql, 'BEGIN');
+  assert.equal(calls[calls.length - 1].sql, 'COMMIT');
+});
+
+// ── the release body ──────────────────────────────────────────────────────────
+
+test('release body: an empty array → 400 claim_ids_required, no query', async () => {
+  const r = await post(RELEASE, { claim_ids: [] });
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'claim_ids_required');
+  assert.deepEqual(calls, []);
+});
+
+test('release body: 21 ids → 400, no query', async () => {
+  const r = await post(RELEASE, { claim_ids: Array.from({ length: 21 }, (_, i) => i + 1) });
+  assert.equal(r.status, 400);
+  assert.deepEqual(calls, []);
+});
+
+test('release body: 20 ids is allowed through to the release', async () => {
+  const r = await post(RELEASE, { claim_ids: Array.from({ length: 20 }, (_, i) => i + 1) });
+  assert.equal(r.status, 200);
+  assert.equal(r.json.failures.length, 20);
+});
+
+test('release body: non-numeric ids → 400 claim_ids_must_be_numbers, no query', async () => {
+  const r = await post(RELEASE, { claim_ids: [101, 'abc'] });
+  assert.equal(r.status, 400);
+  assert.equal(r.json.error.code, 'claim_ids_must_be_numbers');
+  assert.deepEqual(calls, []);
+});
+
+test('release body: claim_ids missing → 400, no query', async () => {
+  const r = await post(RELEASE, {});
+  assert.equal(r.status, 400);
+  assert.deepEqual(calls, []);
+});
+
+// ── POST /claims/batch — the middleware chain ────────────────────────────────
+
+function chainFor(path) {
+  const layer = router.stack.find((l) => l.route && l.route.path === path && l.route.methods.post);
+  assert.ok(layer, `POST ${path} is mounted`);
+  return layer.route.stack.map((s) => s.handle.name || '<handler>');
+}
+
+test('POST /claims/batch middleware chain is pinned: requireBuilder → gateNewcomerClaim → handler', () => {
+  assert.deepEqual(chainFor('/claims/batch'), ['requireBuilder', 'gateNewcomerClaim', '<handler>']);
+});
+
+test('POST /claims carries the one-claim-per-session gate that POST /claims/batch does not (the documented difference)', () => {
+  const single = chainFor('/claims');
+  assert.ok(single.includes('gateOneActiveClaimPerSession'));
+  assert.ok(single.includes('gateNewcomerClaim'));
+  assert.ok(!chainFor('/claims/batch').includes('gateOneActiveClaimPerSession'),
+    'if batch claim gains the session gate, update this pin (task 1005005 asks whether it should)');
+});
+
+test('POST /claims/batch/release middleware chain is pinned: requireBuilder → handler', () => {
+  assert.deepEqual(chainFor('/claims/batch/release'), ['requireBuilder', '<handler>']);
+});
+
+// ── POST /claims/batch — the newcomer gate ───────────────────────────────────
+
+test('a xenos with a claim in flight is refused by gateNewcomerClaim: 403, and no claim or write is attempted', async () => {
+  caller = { id: '42', rank: 'xenos' };
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task' }];
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  const r = await post(CLAIM, { task_ids: [501, 502] });
+  assert.equal(r.status, 403);
+  assert.equal(r.json.error.code, 'newcomer_must_ship_first');
+  assert.equal(r.json.error.details.active_task_id, '700');
+  assert.equal(batchCalls, 0, 'claimTasksBatch never ran');
+  assert.equal(connects, 0, 'no transaction was opened');
+  assert.deepEqual(writes(), []);
+  assert.equal(calls.length, 1, 'only the gate\'s own active-claims read');
+});
+
+test('a thetes with a claim in flight is NOT held by the newcomer gate — and makes no gate lookup', async () => {
+  caller = { id: '42', rank: 'thetes' };
+  activeClaims = [{ claim_id: '88', task_id: '700', title: 'First task' }];
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  const r = await post(CLAIM, { task_ids: [501] });
+  assert.equal(r.status, 201);
+  assert.equal(batchCalls, 1);
+  assert.deepEqual(calls, []);
+});
+
+// ── POST /claims/batch — each documented error maps to its status and body ────
+
+test('success: 201 with the claims, ids coerced to numbers, caller and session from the server', async () => {
+  let seen;
+  db.claimTasksBatch = async (args) => { seen = args; return { claims: [{ id: 1, task_id: 501 }] }; };
+  const r = await post(CLAIM, { task_ids: ['501', 502], worktree_name: 'wt' });
+  assert.equal(r.status, 201);
+  assert.deepEqual(r.json.claims, [{ id: 1, task_id: 501 }]);
+  assert.deepEqual(seen, { taskIds: [501, 502], builderId: '42', worktreePrefix: 'wt', creatorSessionId: 'sess-A' });
+});
+
+test('bind_session:false claims session-unbound', async () => {
+  let seen;
+  db.claimTasksBatch = async (args) => { seen = args; return { claims: [] }; };
+  await post(CLAIM, { task_ids: [501], bind_session: false });
+  assert.equal(seen.creatorSessionId, null);
+});
+
+const ERROR_MAP = [
+  ['BATCH_FAILED', 409, 'batch_failed'],
+  ['BATCH_EMPTY', 400, 'task_ids_required'],
+  ['BATCH_DUPLICATE_IDS', 400, 'duplicate_task_ids'],
+  ['BUILDER_INACTIVE', 403, 'BUILDER_INACTIVE'],
+];
+for (const [thrown, status, code] of ERROR_MAP) {
+  test(`claimTasksBatch throws ${thrown} → ${status} ${code}`, async () => {
+    const failures = [{ task_id: 501, reason: 'ALREADY_CLAIMED' }];
+    db.claimTasksBatch = async () => { throw { code: thrown, failures }; };
+    const r = await post(CLAIM, { task_ids: [501] });
+    assert.equal(r.status, status);
+    assert.equal(r.json.error.code, code);
+    if (thrown === 'BATCH_FAILED') assert.deepEqual(r.json.error.details, { failures });
+  });
+}
+
+test('an unexpected error → 500 batch_claim_failed with no internals in the message', async () => {
+  db.claimTasksBatch = async () => { throw new Error('connection refused at 10.0.0.1'); };
+  const r = await post(CLAIM, { task_ids: [501] });
+  assert.equal(r.status, 500);
+  assert.equal(r.json.error.code, 'batch_claim_failed');
+  assert.equal(r.json.error.message, 'internal error');
+});
+
+test('claim body: empty → 400 task_ids_required, 21 ids → 400, non-numeric → 400 task_ids_must_be_numbers; never reaches claimTasksBatch', async () => {
+  let batchCalls = 0;
+  db.claimTasksBatch = async () => { batchCalls += 1; return { claims: [] }; };
+  const empty = await post(CLAIM, { task_ids: [] });
+  assert.equal(empty.status, 400);
+  assert.equal(empty.json.error.code, 'task_ids_required');
+  const big = await post(CLAIM, { task_ids: Array.from({ length: 21 }, (_, i) => i + 1) });
+  assert.equal(big.status, 400);
+  const bad = await post(CLAIM, { task_ids: [1, 'x'] });
+  assert.equal(bad.status, 400);
+  assert.equal(bad.json.error.code, 'task_ids_must_be_numbers');
+  assert.equal(batchCalls, 0);
+  assert.deepEqual(calls, []);
+});

package/tests/config_read_cache.mjs

@@ -0,0 +1,171 @@
+// tests/config_read_cache.mjs
+//
+// task 1004924 — request-path config reads are cached. authConfigured(),
+// discordConfigured() and the secret box's master-key load ran on every request
+// and, with no env creds, each did sync readFileSync attempts (most of them
+// ENOENT misses) that blocked the event loop. They now go through
+// instance-config readConfigFileCached: one read per TTL window, keyed by the
+// resolved read paths, so a different home dir is never answered from another
+// dir's cache.
+//
+// Hermetic: every case runs under a fresh temp HOME (USERPROFILE too — on
+// Windows os.homedir() reads that, never HOME), proven before the body runs, and
+// counts fs.readFileSync calls for the file under test.
+//
+// Run:  node tests/config_read_cache.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { mkdtempSync, mkdirSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import os from 'node:os';
+import path from 'node:path';
+import { makeRunner } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const fs = require('node:fs');
+const ic = require('../src/instance-config.js');
+const authConfig = require('../src/bongos/auth-config.js');
+const authDiscord = require('../src/bongos/auth-discord.js');
+const box = require('../src/bongos/secret-box.js');
+
+const { test, summary } = makeRunner();
+
+// Every env name that could satisfy the creds lookups from env (any prefix).
+const ENV_SUFFIXES = /(GITHUB_CLIENT_ID|GITHUB_CLIENT_SECRET|DISCORD_CLIENT_ID|DISCORD_CLIENT_SECRET|BUILDER_SECRET_KEY)$/;
+
+function withSandbox(fn) {
+  const home = mkdtempSync(path.join(tmpdir(), 'otb-cfgcache-'));
+  const { root } = path.parse(home);
+  const sandbox = {
+    HOME: home,
+    USERPROFILE: home,
+    HOMEDRIVE: root.replace(/[\\/]+$/, ''),
+    HOMEPATH: home.slice(root.length - 1) || '\\',
+  };
+  const saved = {};
+  for (const k of Object.keys(process.env)) if (ENV_SUFFIXES.test(k)) { saved[k] = process.env[k]; delete process.env[k]; }
+  for (const k of Object.keys(sandbox)) { saved[k] = process.env[k]; process.env[k] = sandbox[k]; }
+  ic.clearConfigReadCache();
+  try {
+    if (os.homedir() !== home) throw new Error(`sandbox escape: os.homedir() is ${os.homedir()}, not ${home}`);
+    return fn(home);
+  } finally {
+    for (const [k, v] of Object.entries(saved)) { if (v === undefined) delete process.env[k]; else process.env[k] = v; }
+    ic.clearConfigReadCache();
+  }
+}
+
+// Count fs.readFileSync calls whose path ends with `name`, for the body of fn.
+function countReads(name, fn) {
+  const real = fs.readFileSync;
+  let n = 0;
+  fs.readFileSync = function (p, ...rest) {
+    if (String(p).endsWith(name)) n++;
+    return real.call(this, p, ...rest);
+  };
+  try { fn(); } finally { fs.readFileSync = real; }
+  return n;
+}
+
+function writeCfg(home, name, body) {
+  const dir = path.join(home, '.config', ic.configDirName());
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(path.join(dir, name), body);
+}
+
+await test('authConfigured(): 50 calls with no env creds read gds-github.json once, not 50 times', () => {
+  withSandbox(() => {
+    const paths = ic.configReadPaths('gds-github.json').length;
+    const n = countReads('gds-github.json', () => {
+      for (let i = 0; i < 50; i++) assert.equal(authConfig.authConfigured(), false);
+    });
+    assert.ok(n <= paths, `read ${n} times; at most one pass over ${paths} dir(s) expected`);
+  });
+});
+
+await test('discordConfigured(): 50 calls read discord-bot.json once', () => {
+  withSandbox((home) => {
+    writeCfg(home, 'discord-bot.json', JSON.stringify({ client_id: 'c', client_secret: 's' }));
+    const n = countReads('discord-bot.json', () => {
+      for (let i = 0; i < 50; i++) assert.equal(authDiscord.discordConfigured(), true);
+    });
+    assert.equal(n, 1);
+  });
+});
+
+await test('secret box: 50 isConfigured() calls from a key FILE read it once', () => {
+  withSandbox((home) => {
+    writeCfg(home, 'builder-secret.key', 'ab'.repeat(32) + '\n');
+    const n = countReads('builder-secret.key', () => {
+      for (let i = 0; i < 50; i++) assert.equal(box.isConfigured(), true);
+    });
+    assert.equal(n, 1);
+    // and the cached key still round-trips
+    assert.equal(box.decrypt(box.encrypt('hello')), 'hello');
+  });
+});
+
+await test('env stays live: setting or changing BUILDER_SECRET_KEY takes effect on the next call', () => {
+  withSandbox(() => {
+    assert.equal(box.isConfigured(), false);
+    process.env.BUILDER_SECRET_KEY = 'cd'.repeat(32);
+    assert.equal(box.isConfigured(), true);
+    const blob = box.encrypt('x');
+    process.env.BUILDER_SECRET_KEY = 'ef'.repeat(32);
+    assert.throws(() => box.decrypt(blob), undefined, 'a changed env key is used at once, not a memoised old one');
+    delete process.env.BUILDER_SECRET_KEY;
+    assert.equal(box.isConfigured(), false);
+  });
+});
+
+await test('provisionMasterKey drops a cached miss, so the new key is seen at once', () => {
+  withSandbox(() => {
+    assert.equal(box.isConfigured(), false); // caches "no key file"
+    const r = box.provisionMasterKey();
+    assert.equal(r.created, true);
+    assert.equal(box.isConfigured(), true);
+  });
+});
+
+await test('readConfigFileCached: a miss and a hit both last the TTL, then re-read', () => {
+  withSandbox((home) => {
+    let t = 1_000_000;
+    const now = () => t;
+    const ttlMs = 30_000;
+    assert.equal(ic.readConfigFileCached('probe.json', { now, ttlMs }), null);
+    writeCfg(home, 'probe.json', 'v1');
+    t += ttlMs - 1;
+    assert.equal(ic.readConfigFileCached('probe.json', { now, ttlMs }), null, 'a cached miss holds inside the TTL');
+    t += 1;
+    assert.equal(ic.readConfigFileCached('probe.json', { now, ttlMs }), 'v1', 'after the TTL the file is read again');
+    // the DEFAULT TTL is short: five minutes on, a dropped-in creds file is seen
+    writeCfg(home, 'probe.json', 'v2');
+    t += 5 * 60_000;
+    assert.equal(ic.readConfigFileCached('probe.json', { now }), 'v2', 'the default TTL keeps creds hot-reloadable');
+  });
+});
+
+await test('readConfigFileCached: a different home is a fresh read, never another dir\'s cache', () => {
+  withSandbox((homeA) => {
+    writeCfg(homeA, 'probe2.json', 'from-A');
+    assert.equal(ic.readConfigFileCached('probe2.json'), 'from-A');
+  });
+  withSandbox(() => {
+    assert.equal(ic.readConfigFileCached('probe2.json'), null, 'a new home with no file reads null');
+  });
+  // withSandbox clears the cache, so prove the KEY isolates homes with no clear between
+  const homeB = mkdtempSync(path.join(tmpdir(), 'otb-cfgcache-'));
+  withSandbox((homeA) => {
+    writeCfg(homeA, 'probe3.json', 'A');
+    assert.equal(ic.readConfigFileCached('probe3.json'), 'A');
+    const keep = { HOME: process.env.HOME, USERPROFILE: process.env.USERPROFILE };
+    process.env.HOME = homeB; process.env.USERPROFILE = homeB;
+    try {
+      if (os.homedir() !== homeB) return; // platform reads some other var; covered above
+      assert.equal(ic.readConfigFileCached('probe3.json'), null, 'home B has no probe3.json');
+    } finally { Object.assign(process.env, keep); }
+  });
+});
+
+summary();

package/tests/copy_desk_page_editor.mjs

@@ -161,6 +161,18 @@ try {
     assert.equal(errCode(u.body), 'page_unread');
   });
 
+  await test('the editor read carries the engineering work open on the page files (information only)', async () => {
+    const orig = lifecyclePort.engineeringActiveOnPage;
+    const asked = [];
+    lifecyclePort.engineeringActiveOnPage = async (files) => { asked.push(files); return [{ task_id: '7', holder: 'Grace' }]; };
+    try {
+      const r = await call('GET', `${STUDIO}/draft`, ALICE);
+      assert.equal(r.status, 200);
+      assert.deepEqual(r.body.engineering_active, [{ task_id: '7', holder: 'Grace' }]);
+      assert.ok(asked.length === 1 && Array.isArray(asked[0]) && asked[0].length > 0, 'asked about the page files');
+    } finally { lifecyclePort.engineeringActiveOnPage = orig; }
+  });
+
   await test('composeEditor keeps only draft lines the reading still has', () => {
     const out = pageStatus.composeEditor({
       page: { id: 'builders:studio', title: 'Studio', surface: 'builders' },