@bongos/core 1.24.14 → 1.24.15

package/tests/github_chip.mjs

@@ -0,0 +1,217 @@
+// tests/github_chip.mjs — the Link GitHub chip in the top bar (task 1004996, goal
+// 1000095 WA6; owner ask 2026-10-29).
+//
+// Someone with no GitHub linked sees one very small chip with the engineer's icon
+// in the top bar; a press starts the GitHub link (ADR 0396). Anyone with GitHub
+// linked sees nothing, and nothing ever pops up. Three copies draw it — the hall's
+// github-chip.js, the hub's assets/hub-bar.js and projects.html's own bar — so
+// this file RUNS each one under a small DOM stub and holds their words, link and
+// glyph equal, then checks the shell loads the hall's copy and both sheets keep
+// the 24px floor.
+//
+// Run:  node --test tests/github_chip.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const read = (p) => fs.readFileSync(p, 'utf8').replace(/\r\n/g, '\n');
+const CHIP_SRC = read(path.join(HALL, 'github-chip.js'));
+const BAR = read(path.join(LANDING, 'assets', 'hub-bar.js'));
+const HUB = read(path.join(LANDING, 'projects.html'));
+const SHELL = read(path.join(HALL, 'shell.js'));
+const chip = require(path.join(HALL, 'github-chip.js'));
+// the engineer's glyph IS the Building craft's (craft-mode.js ICONS.building)
+const BUILDING = /building: '<path d="([^"]+)"\/>'/.exec(read(path.join(HALL, 'craft-mode.js')))[1];
+
+// ── a DOM just big enough for the three copies ──────────────────────────────
+class El {
+  constructor(tag, id) { this.tagName = tag.toUpperCase(); this.id = id || ''; this.children = []; this.parentNode = null; this.attrs = {}; this.textContent = ''; this.hidden = false; this.className = ''; }
+  get firstChild() { return this.children[0] || null; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  appendChild(c) { c.parentNode = this; this.children.push(c); return c; }
+  insertBefore(c, ref) { c.parentNode = this; const i = ref ? this.children.indexOf(ref) : -1; if (i < 0) this.children.push(c); else this.children.splice(i, 0, c); return c; }
+  remove() { if (this.parentNode) this.parentNode.children.splice(this.parentNode.children.indexOf(this), 1); this.parentNode = null; }
+  addEventListener() {}
+  querySelector() { return null; }
+  querySelectorAll() { return []; }
+  contains() { return false; }
+  focus() {}
+  closest() { return null; }
+}
+function makeDoc(barSelector) {
+  const bar = new El('div');
+  const byId = new Map();
+  const find = (node, id) => { if (node.id === id) return node; for (const c of node.children) { const f = find(c, id); if (f) return f; } return null; };
+  const doc = {
+    bar,
+    cookie: '',
+    activeElement: null,
+    createElement: (t) => new El(t),
+    createElementNS: (ns, t) => new El(t),
+    getElementById(id) { return find(bar, id) || (id === 'ghChip' || id === 'gh-chip' ? null : (byId.get(id) || byId.set(id, new El('div', id)).get(id))); },
+    querySelector: (sel) => (sel === barSelector ? bar : null),
+    querySelectorAll: () => [],
+    addEventListener() {},
+  };
+  return doc;
+}
+const settle = async () => { for (let i = 0; i < 8; i++) await new Promise((r) => setImmediate(r)); };
+const chipOf = (doc, id) => doc.bar.children.find((c) => c.id === id) || null;
+const svgPath = (a) => a.children.find((c) => c.tagName === 'SVG').children[0].attrs.d;
+const labelOf = (a) => a.children.find((c) => c.tagName === 'SPAN').textContent;
+const GOOGLE_ONLY = { methods: [{ provider: 'google', email: 'o@example.com' }], providers: ['github', 'google'] };
+const BOTH = { methods: [{ provider: 'github' }, { provider: 'google' }], providers: ['github', 'google'] };
+
+// ── the hall's copy ──────────────────────────────────────────────────────────
+test('the hall: who needs GitHub — only a stand-in login, and the ways in decide where they can be read', () => {
+  assert.equal(chip.needsGithub([{ provider: 'google' }], { github_login: '~octo' }), true);
+  assert.equal(chip.needsGithub([{ provider: 'github' }, { provider: 'google' }], { github_login: '~octo' }), false, 'a linked GitHub wins over the stand-in login');
+  assert.equal(chip.needsGithub(null, { github_login: '~octo' }), true, 'a project hall with no ways-in route: the stand-in says Google-only');
+  assert.equal(chip.needsGithub(null, { github_login: 'octo' }), false);
+  assert.equal(chip.needsGithub([{ provider: 'google' }], { github_login: 'octo' }), false, 'a real login means GitHub was linked (linking writes it over the stand-in)');
+  assert.equal(chip.needsGithub(null, null), false, 'nothing known, nothing drawn');
+  assert.equal(chip.chipHref(null), null, 'no hub, no linking, no chip');
+  assert.equal(chip.chipHref('https://example.com'), 'https://example.com/api/bongos/auth/link/github/start');
+  for (const bad of ['http://example.com', 'https://example.com/x', 'https://evil.example?x=', 'javascript:alert(1)//', '']) assert.equal(chip.chipHref(bad), null, `refused: ${bad}`);
+});
+
+async function mountHall(answer, builder, hub = 'https://example.com') {
+  const doc = makeDoc('#app-topbar .topbar-side');
+  const calls = [];
+  const api = { request: (m, p) => { calls.push(`${m} ${p}`); return typeof answer === 'function' ? answer() : Promise.resolve(answer); } };
+  const ctx = { document: doc, window: {}, Array, Promise };
+  ctx.window = ctx;
+  vm.runInNewContext(CHIP_SRC, ctx);
+  const shown = await ctx.OTBGithubChip.mount({ api, builder, hub });
+  return { doc, calls, shown, a: chipOf(doc, 'gh-chip') };
+}
+
+test('the hall, executed: Google only draws one small link with the engineer glyph, to the hub’s link start', async () => {
+  const { a, calls, shown } = await mountHall({ ok: true, data: GOOGLE_ONLY }, { github_login: '~octo' });
+  assert.equal(shown, true);
+  assert.deepEqual(calls, ['GET /api/bongos/me/sign-in-methods'], 'one read');
+  assert.equal(a.tagName, 'A', 'a plain link: no pop-up, no dialog');
+  assert.equal(a.href, 'https://example.com/api/bongos/auth/link/github/start');
+  assert.equal(a.className, 'gh-chip');
+  assert.equal(labelOf(a), 'Link GitHub');
+  assert.equal(svgPath(a), BUILDING, 'the engineer craft’s own glyph');
+  assert.match(a.attrs['aria-label'], /coding/);
+});
+
+test('the hall, executed: GitHub linked, a failed read for a real login, or no hub draws nothing', async () => {
+  assert.equal((await mountHall({ ok: true, data: BOTH }, { github_login: '~octo' })).a, null);
+  assert.equal((await mountHall({ ok: false, status: 404 }, { github_login: 'octo' })).a, null);
+  assert.equal((await mountHall(() => Promise.reject(new Error('offline')), { github_login: 'octo' })).a, null);
+  const noHub = await mountHall({ ok: true, data: GOOGLE_ONLY }, {}, null);
+  assert.equal(noHub.a, null);
+  assert.deepEqual(noHub.calls, [], 'no hub: not even the read');
+  const fallback = await mountHall({ ok: false, status: 404 }, { github_login: '~octo' });
+  assert.ok(fallback.a, 'a project hall: the stand-in login draws it');
+  const real = await mountHall({ ok: true, data: GOOGLE_ONLY }, { github_login: 'octo' });
+  assert.equal(real.a, null);
+  assert.deepEqual(real.calls, [], 'a real login costs no read at all');
+});
+
+test('the shell loads the hall’s copy once, for a signed-in builder, only where there is a hub', () => {
+  assert.match(SHELL, /if \(state\.builder && access\.authed === true\) \{ loadPositions\(state\.builder, state\.positions\); loadGithubChip\(state\.builder\); \}/);
+  const fn = /function loadGithubChip\(builder\) \{[\s\S]*?\n {2}\}/.exec(SHELL)[0];
+  assert.match(fn, /hubOrigin\(\)/);
+  assert.match(fn, /if \(githubChipAsked \|\| !hub\) return;/);
+  assert.match(fn, /loadHallScript\('github-chip\.js'/);
+  assert.ok(SHELL.split('\n').length <= 1500, 'shell.js stays inside the 1500-line ratchet');
+});
+
+// ── the hub's two copies ─────────────────────────────────────────────────────
+function bootBar(answers) {
+  const doc = makeDoc('.barRight');
+  const calls = [];
+  const fetch = (url) => {
+    const p = url.replace(/^\/api\/bongos/, '');
+    calls.push(p);
+    const { status, data } = answers(p);
+    return Promise.resolve({ status, ok: status >= 200 && status < 300, json: () => Promise.resolve(data) });
+  };
+  const window = {};
+  vm.runInNewContext(BAR, { document: doc, fetch, window, location: { hostname: 'cloudbongos.com', pathname: '/account' }, Array, Promise });
+  return { doc, calls, window };
+}
+const ME = { builder: { id: '1', github_login: '~octo' } };
+
+test('the hub bar, executed: signed in with Google only, the chip heads the bar’s right side', async () => {
+  const { doc, calls } = bootBar((p) => (p === '/me' ? { status: 200, data: ME } : { status: 200, data: GOOGLE_ONLY }));
+  await settle();
+  assert.deepEqual(calls, ['/me', '/me/sign-in-methods']);
+  const a = chipOf(doc, 'ghChip');
+  assert.ok(a);
+  assert.equal(doc.bar.children[0], a, 'first in the row');
+  assert.equal(a.href, '/api/bongos/auth/link/github/start');
+  assert.equal(labelOf(a), chip.LABEL);
+  assert.equal(svgPath(a), BUILDING);
+});
+
+test('the hub bar, executed: linked, signed out, a child (404) or a failed read draws nothing', async () => {
+  for (const answers of [
+    (p) => (p === '/me' ? { status: 200, data: ME } : { status: 200, data: BOTH }),
+    (p) => (p === '/me' ? { status: 200, data: ME } : { status: 404, data: null }),
+    (p) => (p === '/me' ? { status: 200, data: ME } : { status: 500, data: null }),
+  ]) {
+    const { doc } = bootBar(answers);
+    await settle();
+    assert.equal(chipOf(doc, 'ghChip'), null);
+  }
+  const out = bootBar(() => ({ status: 401, data: null }));
+  await settle();
+  assert.deepEqual(out.calls, ['/me'], 'signed out: no ways-in read at all');
+  assert.equal(chipOf(out.doc, 'ghChip'), null);
+  const real = bootBar((p) => (p === '/me' ? { status: 200, data: { builder: { id: '2', github_login: 'octocat' } } } : { status: 200, data: GOOGLE_ONLY }));
+  await settle();
+  assert.deepEqual(real.calls, ['/me'], 'a real login (GitHub linked): no ways-in read on any page');
+  assert.equal(chipOf(real.doc, 'ghChip'), null);
+});
+
+test('projects.html keeps its own copy, executed: the same chip from the same read', async () => {
+  const fn = /\n {2}var GH_TITLE = [^\n]+\n {2}function githubChip\(\) \{[\s\S]*?\n {2}\}\n/.exec(HUB);
+  assert.ok(fn, 'projects.html carries githubChip()');
+  assert.match(HUB, /paintShellIdentity\(\);\n\s+githubChip\(\);/, 'drawn after the identity read');
+  for (const [answer, who, drawn] of [[GOOGLE_ONLY, ME.builder, true], [BOTH, ME.builder, false], [GOOGLE_ONLY, { github_login: 'octocat' }, false]]) {
+    const doc = makeDoc('.barRight');
+    let reads = 0;
+    const fetch = () => { reads++; return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve(answer) }); };
+    const ctx = { document: doc, fetch, API: '/api/bongos', me: who, $: (id) => doc.getElementById(id), Array, Promise };
+    vm.runInNewContext(fn[0] + '\ngithubChip();', ctx);
+    await settle();
+    const a = chipOf(doc, 'ghChip');
+    assert.equal(!!a, drawn);
+    assert.equal(reads, who.github_login.startsWith('~') ? 1 : 0, 'only a stand-in login is asked about');
+    if (a) { assert.equal(a.href, '/api/bongos/auth/link/github/start'); assert.equal(labelOf(a), chip.LABEL); assert.equal(svgPath(a), BUILDING); }
+  }
+});
+
+test('the three copies say the same words and build no markup from strings', () => {
+  const title = /var TITLE = '([^']+)'/.exec(CHIP_SRC)[1];
+  assert.match(BAR, new RegExp(`var GH_TITLE = '${title}'`));
+  assert.match(HUB, new RegExp(`var GH_TITLE = '${title}'`));
+  for (const src of [CHIP_SRC, BAR]) assert.doesNotMatch(src, /innerHTML|insertAdjacentHTML|outerHTML/);
+  assert.doesNotMatch(/function githubChip\(\) \{[\s\S]*?\n {2}\}\n/.exec(HUB)[0], /innerHTML/);
+});
+
+// ── the sheets: very small, but never under the 24px floor ───────────────────
+test('both sheets keep the chip quiet and at least 24px, its words folding away on a phone', () => {
+  const cosmos = read(path.join(LANDING, 'assets', 'cosmos.css'));
+  const hall = read(path.join(HALL, 'style.css'));
+  assert.match(cosmos, /\.ghChip\{[^}]*min-height:24px;min-width:24px;/);
+  assert.match(cosmos, /@media \(max-width:900px\)\{[\s\S]*?\.ghChip__label\{display:none;\}/);
+  assert.match(hall, /\.gh-chip \{[^}]*min-height: 24px;[^}]*min-width: 24px;/);
+  assert.match(hall, /@media \(max-width: 640px\) \{\n {2}\.gh-chip \{[^}]*\}\n {2}\.gh-chip__label \{ display: none; \}/);
+  for (const css of [cosmos, hall]) assert.doesNotMatch(/\.gh-?[Cc]hip[^{]*\{[^}]*\}/.exec(css)[0], /#[0-9a-f]{3,8}\b|rgba?\(/i, 'tokens only');
+});

package/tests/hall_ai_studio.mjs

@@ -131,6 +131,8 @@ function makeEl(id) {
     removeAttribute(k) { delete el.attrs[k]; },
     addEventListener(type, fn) { (el.handlers[type] = el.handlers[type] || []).push(fn); },
     focus() {},
+    clicks: 0,
+    click() { el.clicks += 1; },
     async fire(type, extra = {}) {
       const ev = { preventDefault() {}, currentTarget: el, target: el, ...extra };
       for (const fn of el.handlers[type] || []) await fn(ev);
@@ -157,8 +159,27 @@ function makeEl(id) {
 
 const settle = async () => { for (let i = 0; i < 30; i++) await new Promise((r) => setImmediate(r)); };
 
-function bootPage(search, { routes = {} } = {}) {
-  const els = { 'ais-page': makeEl('ais-page'), 'hall-main': makeEl('hall-main'), 'ais-file': makeEl('ais-file') };
+// A browser File, as much of it as the page reads.
+class FakeFile {
+  constructor(parts, name, opts = {}) { this.name = name; this.type = opts.type || ''; this.size = parts.reduce((n, p) => n + (p.size || 3), 0); }
+}
+
+// The device the page runs on: a phone (coarse pointer) or a computer, and
+// whether its webcam answers. Each track records whether it was stopped.
+function makeDevice({ touch = false, webcam = 'yes' } = {}) {
+  const tracks = [{ stopped: false, stop() { this.stopped = true; } }];
+  return {
+    tracks,
+    matchMedia: (q) => ({ matches: touch && q.includes('coarse') }),
+    navigator: { mediaDevices: webcam === 'none' ? undefined : {
+      getUserMedia: async () => { if (webcam === 'refused') throw new Error('NotAllowedError'); return { getTracks: () => tracks }; },
+    } },
+  };
+}
+
+function bootPage(search, { routes = {}, device = makeDevice() } = {}) {
+  const els = { 'ais-page': makeEl('ais-page'), 'hall-main': makeEl('hall-main'), 'ais-file': makeEl('ais-file'), 'ais-camera-file': makeEl('ais-camera-file') };
+  const winHandlers = {};
   const calls = [];
   const store = new Map();
   const loc = { search, href: `/builders/ai-studio${search}` };
@@ -201,7 +222,15 @@ function bootPage(search, { routes = {} } = {}) {
     clearInterval: () => {},
     Date,
     Promise,
-    document: { getElementById: (id) => els[id] || null, body: makeEl('body') },
+    document: {
+      getElementById: (id) => els[id] || null,
+      body: makeEl('body'),
+      // The snapshot canvas: draws nothing, hands back a 3-byte JPEG.
+      createElement: () => ({ getContext: () => ({ drawImage() {} }), toBlob: (cb, type) => cb({ size: 3, type }) }),
+    },
+    File: FakeFile,
+    matchMedia: device.matchMedia,
+    navigator: device.navigator,
     location: loc,
     history: {
       pushState(_s, _t, url) { loc.href = url; loc.search = url.includes('?') ? url.slice(url.indexOf('?')) : ''; },
@@ -210,7 +239,7 @@ function bootPage(search, { routes = {} } = {}) {
     sessionStorage: { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, String(v)) },
     fetch: async (url) => { calls.push({ method: 'FETCH', url }); return { ok: true, blob: async () => ({ size: 3, type: 'image/png' }) }; },
     FileReader: class { readAsDataURL() { this.result = 'data:image/png;base64,QUJD'; setImmediate(() => this.onload()); } },
-    addEventListener() {},
+    addEventListener(type, fn) { (winHandlers[type] = winHandlers[type] || []).push(fn); },
   };
   ctx.window = ctx;
   ctx.window.BongosClient = { createClient: () => client };
@@ -220,7 +249,18 @@ function bootPage(search, { routes = {} } = {}) {
     const src = f === 'studio-lib.js' ? 'window.OTBStudioLib = { skyAt: () => "night" };' : fs.readFileSync(path.join(PUB, f), 'utf8');
     vm.runInContext(src, ctx, { filename: f });
   }
-  return { els, page: els['ais-page'], main: els['hall-main'], calls, loc, store };
+  const fireWindow = async (type, ev) => { for (const fn of winHandlers[type] || []) await fn(ev); };
+  return { els, page: els['ais-page'], main: els['hall-main'], calls, loc, store, device, fireWindow };
+}
+
+// A paste event carrying these clipboard files; records whether the page took it.
+function pasteEvent(files) {
+  const ev = {
+    taken: false,
+    preventDefault() { ev.taken = true; },
+    clipboardData: { items: files.map((f) => ({ kind: 'file', getAsFile: () => f })) },
+  };
+  return ev;
 }
 
 test('page: step 1 opens on an earlier request\'s files, carried by address, with Next', async () => {
@@ -234,6 +274,90 @@ test('page: step 1 opens on an earlier request\'s files, carried by address, wit
   assert.equal(p.main.getAttribute('data-view'), 'pick');
 });
 
+const uploadsOf = (p) => p.calls.filter((c) => c.method === 'POST' && c.url.endsWith('/ai-studio/uploads'));
+
+test('page: a pasted picture joins the files on step 1, named so it can be told apart', async () => {
+  const p = bootPage('?step=pick');
+  await settle();
+  assert.match(p.page.innerHTML, /paste a picture/);
+  const ev = pasteEvent([new FakeFile([{ size: 3 }], 'image.png', { type: 'image/png' })]);
+  await p.fireWindow('paste', ev);
+  await settle();
+  assert.equal(ev.taken, true);
+  const sent = uploadsOf(p);
+  assert.equal(sent.length, 1);
+  assert.match(sent[0].body.name, /^pasted-\d+-1\.png$/, 'the browser\'s generic image.png is renamed');
+  assert.equal(sent[0].body.content_type, 'image/png');
+  assert.match(p.page.innerHTML, /1 file ready/);
+  // A pasted file that already has a real name keeps it.
+  await p.fireWindow('paste', pasteEvent([new FakeFile([{ size: 3 }], 'tower.jpg', { type: 'image/jpeg' })]));
+  await settle();
+  assert.equal(uploadsOf(p)[1].body.name, 'tower.jpg');
+});
+
+test('page: pasting anywhere but step 1, or pasting words, is left to the browser', async () => {
+  const p = bootPage('?step=describe&from=1001');
+  await settle();
+  const pic = pasteEvent([new FakeFile([{ size: 3 }], 'image.png', { type: 'image/png' })]);
+  await p.fireWindow('paste', pic);
+  assert.equal(pic.taken, false, 'words pasted into the request box still paste');
+  const q = bootPage('?step=pick');
+  await settle();
+  const words = { taken: false, preventDefault() { words.taken = true; }, clipboardData: { items: [{ kind: 'string', getAsFile: () => null }] } };
+  await q.fireWindow('paste', words);
+  assert.equal(words.taken, false);
+  assert.equal(uploadsOf(p).length + uploadsOf(q).length, 0);
+});
+
+test('page: on a phone, "take a photo" opens the phone\'s own camera', async () => {
+  const p = bootPage('?step=pick', { device: makeDevice({ touch: true }) });
+  await settle();
+  await p.page.querySelector('#ais-camera').fire('click');
+  assert.equal(p.els['ais-camera-file'].clicks, 1);
+  assert.equal(p.page.querySelector('#ais-cam').hidden, false, 'no webcam panel on a phone');
+});
+
+test('page: on a computer, the webcam shows on the page, a photo is taken and sent, and the camera turns off', async () => {
+  const p = bootPage('?step=pick');
+  await settle();
+  await p.page.querySelector('#ais-camera').fire('click');
+  await settle();
+  assert.equal(p.els['ais-camera-file'].clicks, 0);
+  const view = p.page.querySelector('#ais-cam-view');
+  assert.ok(view.srcObject, 'the webcam feeds the page');
+  view.videoWidth = 640;
+  view.videoHeight = 480;
+  await p.page.querySelector('#ais-snap').fire('click');
+  await settle();
+  assert.equal(p.device.tracks[0].stopped, true, 'taking the photo turns the camera off');
+  const sent = uploadsOf(p);
+  assert.equal(sent.length, 1);
+  assert.match(sent[0].body.name, /^photo-\d+\.jpg$/);
+  assert.equal(sent[0].body.content_type, 'image/jpeg');
+});
+
+test('page: leaving step 1 with the webcam open turns the camera off', async () => {
+  const p = bootPage('?step=pick&from=1001');
+  await settle();
+  await p.page.querySelector('#ais-camera').fire('click');
+  await settle();
+  assert.equal(p.device.tracks[0].stopped, false);
+  await p.page.querySelector('#ais-next').fire('click');
+  await settle();
+  assert.equal(p.loc.search, '?step=describe');
+  assert.equal(p.device.tracks[0].stopped, true, 'Next must not leave the camera light on');
+});
+
+test('page: a refused or missing webcam falls back to the camera picker', async () => {
+  for (const webcam of ['refused', 'none']) {
+    const p = bootPage('?step=pick', { device: makeDevice({ webcam }) });
+    await settle();
+    await p.page.querySelector('#ais-camera').fire('click');
+    await settle();
+    assert.equal(p.els['ais-camera-file'].clicks, 1, webcam);
+  }
+});
+
 test('page: step 3 sends the request on the card pressed, with copies of the carried files', async () => {
   const p = bootPage('?step=make&from=1001');
   await settle();

package/tests/host_topology_skips.mjs

@@ -49,6 +49,7 @@ const ALLOWED = {
   run_node_reroute: '.claude/hooks/run-node.sh (package-excluded)',
   run_routine_two_root: '.claude/hooks/_core-resolve.js (package-excluded)',
   'session-cards': '.claude/hooks/session-cards.js (package-excluded)',
+  self_healing_start: '.claude/hooks/session-start.js (package-excluded)',
   session_start_freshness: '.claude/hooks/session-start.js (package-excluded)',
   shell_hooks: '.claude/hooks/shell-hooks.js (package-excluded)',
   stop_refcheck: '.claude/hooks/stop-refcheck.js (package-excluded; the task-1002234 precedent)',

package/tests/hub_account_page.mjs

@@ -85,9 +85,10 @@ test('the door returns here, and the page calls only its own-scoped routes', ()
   assert.match(PAGE, /href="\/api\/bongos\/auth\/web\/start\?return=\/account&repos=1"/, 'sign-in lands back on /account, asking for repo access once (task 1004549)');
   const calls = [...SCRIPT.matchAll(/request\('(GET|PATCH|POST|DELETE)', '([^']+)'/g)].map((m) => `${m[1]} ${m[2]}`);
   assert.deepEqual([...new Set(calls)].sort(), ['GET /me/cross-project', 'PATCH /me/cross-project', 'PATCH /me/handle', 'PATCH /me/profile', 'GET /my-projects', 'POST /my-projects/', 'GET /me/guilds', 'GET /me/sign-in-methods', 'DELETE /me/sign-in-methods/'].sort());
-  // the bar's two calls live in the shared asset: the identity read and sign out
+  // the bar's calls live in the shared asset: the identity read, sign out, and the
+  // ways in the Link GitHub chip asks (task 1004996)
   const barCalls = [...BAR.matchAll(/fetch\(API \+ '([^']+)', \{ method: '(GET|POST)'/g)].map((m) => `${m[2]} ${m[1]}`);
-  assert.deepEqual(barCalls.sort(), ['GET /me', 'POST /auth/logout']);
+  assert.deepEqual(barCalls.sort(), ['GET /me', 'GET /me/sign-in-methods', 'POST /auth/logout']);
   assert.match(BAR, /var API = '\/api\/bongos';/);
 });
 

package/tests/landing_legal_pages.mjs

@@ -239,10 +239,11 @@ test('cosmos.css still carries the bar and the bands the doors lean on', () => {
   for (const rule of ['.bar{', '.barMark{', '.trig{', '.signinDoor{', '.menuBand{']) assert.ok(css.includes(rule), `cosmos.css still carries ${rule}`);
 });
 
-test('assets/hub-bar.js builds no markup from strings and makes only the bar’s two calls', () => {
+test('assets/hub-bar.js builds no markup from strings and makes only the bar’s three calls', () => {
   assert.doesNotMatch(BAR, /innerHTML|insertAdjacentHTML|outerHTML/);
   const calls = [...BAR.matchAll(/fetch\(API \+ '([^']+)', \{ method: '(GET|POST)'/g)].map((m) => `${m[2]} ${m[1]}`);
-  assert.deepEqual(calls.sort(), ['GET /me', 'POST /auth/logout']);
+  // the identity read, sign out, and the ways in the Link GitHub chip asks (task 1004996)
+  assert.deepEqual(calls.sort(), ['GET /me', 'GET /me/sign-in-methods', 'POST /auth/logout']);
   assert.doesNotMatch(BAR, /gtag|plausible|googletagmanager/, 'the privacy page promises no trackers');
 });
 

package/tests/market_watch_data_db.mjs

@@ -29,6 +29,7 @@ const db = require('../modules/market-watch/db.js');
 const MIGRATION = readFileSync(new URL('../modules/market-watch/migrations/market_watch_001_tables.sql', import.meta.url), 'utf8');
 const MIGRATION_002 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_002_run.sql', import.meta.url), 'utf8');
 const MIGRATION_003 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_003_ask_pool.sql', import.meta.url), 'utf8');
+const MIGRATION_004 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_004_entry_corrections.sql', import.meta.url), 'utf8');
 const run = require('../modules/market-watch/run.js');
 const store = require('../modules/market-watch/store.js');
 const settings = require('../modules/market-watch/settings.js');
@@ -86,6 +87,11 @@ try {
     // market_watch_003 (task 1004940): the weekly ask's pool-lookup index.
     await q(MIGRATION_003);
     await q(MIGRATION_003);
+    // market_watch_004 (task 1005016): the applied-correction lookup index.
+    await q(MIGRATION_004);
+    await q(MIGRATION_004);
+    const { rows: [ix] } = await q(`SELECT count(*)::int AS n FROM pg_indexes WHERE indexname = 'market_watch_proposals_entry_corrections'`);
+    assert.equal(ix.n, 1, 'the correction lookup index exists');
     const { rows } = await q(`SELECT count(*)::int AS n FROM information_schema.tables WHERE table_name LIKE 'market\\_watch\\_%'`);
     assert.ok(rows[0].n >= 10, `tables: ${rows[0].n}`);
   });

package/tests/market_watch_pages.mjs

@@ -134,7 +134,10 @@ test('each of the four changes, with a one-line reason, becomes a proposal the s
     'the direction comes from the item, never from the client');
   assert.deepEqual(norm({ kind: 'move_kind', reason: 'r' }, { id: 9, kind: 'partner' }).value.payload, { from: 'partner', to: 'competitor' });
   assert.deepEqual(norm({ kind: 'add_source', url: 'https://example.org/changelog', reason: 'r' }).value.payload, { source_url: 'https://example.org/changelog' });
-  assert.deepEqual(norm({ kind: 'correct_entry', log_entry_id: '15', reason: 'r' }).value, { kind: 'correct_entry', item_id: 4, log_entry_id: 15, reason: 'r', payload: {} });
+  // task 1005016: the proposal carries the correction itself, or a wrong flag
+  assert.deepEqual(norm({ kind: 'correct_entry', log_entry_id: '15', takeaway: ' Raised a seed,\n not a Series B. ', reason: 'r' }).value,
+    { kind: 'correct_entry', item_id: 4, log_entry_id: 15, reason: 'r', payload: { takeaway: 'Raised a seed, not a Series B.', summary: 'Correct an entry to read "Raised a seed, not a Series B."' } });
+  assert.deepEqual(norm({ kind: 'correct_entry', log_entry_id: 15, wrong: true, reason: 'r' }).value.payload, { wrong: true, summary: 'Mark an entry as wrong' });
   assert.deepEqual(norm({ kind: 'remove_item', reason: 'shut down' }).value.payload, {}, 'stop tracking');
   assert.deepEqual(pages.normalizeProposal({ kind: 'add_item', scout: 'topic', name: ' agent pay models ', reason: 'r' }).value.payload,
     { kind: 'topic', name: 'agent pay models', url: null });
@@ -151,7 +154,11 @@ test('a proposal is refused without a reason, with a bad value, or about somethi
   assert.equal(err({ kind: 'rescore', dimension: 'human_gates', value: '', reason: 'r' }), 'invalid_value');
   assert.equal(err({ kind: 'move_kind', reason: 'r' }, { id: 3, kind: 'topic' }), 'cannot_move_topic');
   assert.equal(err({ kind: 'add_source', url: 'javascript:alert(1)', reason: 'r' }), 'invalid_url');
-  assert.equal(err({ kind: 'correct_entry', log_entry_id: '0', reason: 'r' }), 'invalid_entry');
+  assert.equal(err({ kind: 'correct_entry', log_entry_id: '0', takeaway: 'x', reason: 'r' }), 'invalid_entry');
+  assert.equal(err({ kind: 'correct_entry', log_entry_id: '15', reason: 'r' }), 'correction_required', 'the reason alone is no correction');
+  assert.equal(err({ kind: 'correct_entry', log_entry_id: '15', takeaway: '  ', reason: 'r' }), 'correction_required');
+  assert.equal(err({ kind: 'correct_entry', log_entry_id: '15', takeaway: 'x', wrong: true, reason: 'r' }), 'invalid_correction', 'not both');
+  assert.equal(err({ kind: 'correct_entry', log_entry_id: '15', takeaway: 'x'.repeat(501), reason: 'r' }), 'correction_too_long');
   assert.equal(err({ kind: 'rule_change', reason: 'r' }), 'invalid_kind', 'a rules change is the rules page\'s, not this one\'s');
   assert.equal(pages.normalizeProposal({ kind: 'rescore', reason: 'r' }).error, 'item_not_found');
   assert.equal(pages.normalizeProposal({ kind: 'add_item', scout: 'friend', name: 'x', reason: 'r' }).error, 'invalid_scout');
@@ -166,10 +173,79 @@ test('the propose dialog offers exactly the four changes, and posts what the ser
   assert.deepEqual(MW.bodyFor('change', form({ kind: 'rescore', dimension: 'human_gates', value: '8', reason: ' r ' }), { id: 4 }),
     { kind: 'rescore', item_id: 4, reason: 'r', dimension: 'human_gates', value: '8' });
   assert.deepEqual(MW.bodyFor('stop', form({ reason: 'gone' }), { id: 4 }), { kind: 'remove_item', item_id: 4, reason: 'gone' });
+  // correct_entry (task 1005016): the corrected words, or the wrong flag instead
+  assert.match(html, /name="takeaway"/);
+  assert.match(html, /name="wrong" type="checkbox"/);
+  const fix = form({ kind: 'correct_entry', log_entry_id: '15', takeaway: ' seed ', reason: 'r' });
+  fix.elements.wrong = { value: 'true', checked: false };
+  assert.deepEqual(MW.bodyFor('change', fix, { id: 4 }), { kind: 'correct_entry', item_id: 4, reason: 'r', log_entry_id: '15', takeaway: 'seed' });
+  fix.elements.wrong.checked = true;
+  assert.deepEqual(MW.bodyFor('change', fix, { id: 4 }), { kind: 'correct_entry', item_id: 4, reason: 'r', log_entry_id: '15', wrong: true });
+  for (const b of [MW.bodyFor('change', fix, { id: 4 }), { ...MW.bodyFor('change', fix, { id: 4 }), wrong: undefined, takeaway: 'seed' }]) {
+    assert.equal(pages.normalizeProposal(b, { item: COP }).ok, true, 'the dialog posts what the server reads');
+  }
+});
+
+test('a corrected entry reads corrected on the item page; one marked wrong is no report on the home', () => {
+  const it = byName('GitHub Copilot', 'competitor');
+  const cf = rows.caseFileFrom(R, RUNS, it.id);
+  cf[0] = { ...cf[0], corrected_at: new Date('2026-10-30T10:00:00Z'), correction_reason: '<b>their post</b>', marked_wrong: false };
+  cf[1] = { ...cf[1], corrected_at: new Date('2026-10-30T11:00:00Z'), correction_reason: 'still running', marked_wrong: true };
+  const v = pages.shapeItem({ item: it, entries: cf, history: { series: {}, runs: [] }, rules: RULES });
+  assert.deepEqual(v.entries[0].corrected, { on: '2026-10-30', reason: '<b>their post</b>', wrong: false });
+  assert.deepEqual(v.entries[1].corrected, { on: '2026-10-30', reason: 'still running', wrong: true });
+  assert.equal(v.entries[2].corrected, null, 'an entry nobody corrected carries no note');
+  // the read behind it: the latest APPLIED correct_entry of this project, per entry
+  const caseSql = readFileSync(new URL('../modules/market-watch/db.js', import.meta.url), 'utf8');
+  assert.match(caseSql, /p\.project = i\.project AND p\.log_entry_id = e\.id AND p\.kind = 'correct_entry' AND p\.status = 'applied'/);
+  const pagesSrc = readFileSync(new URL('../modules/market-watch/pages.js', import.meta.url), 'utf8');
+  assert.match(pagesSrc, /AND NOT COALESCE\(\(SELECT p\.payload->>'wrong' = 'true' FROM market_watch_proposals p/, 'the home skips an entry marked wrong');
+  // both lookups are served by market_watch_004's partial index, in the order they read
+  const m4 = readFileSync(new URL('../modules/market-watch/migrations/market_watch_004_entry_corrections.sql', import.meta.url), 'utf8');
+  assert.match(m4, /CREATE INDEX IF NOT EXISTS market_watch_proposals_entry_corrections\s+ON market_watch_proposals \(log_entry_id, decided_at DESC, id DESC\)\s+WHERE kind = 'correct_entry' AND status = 'applied';/);
+  assert.match(m4, /^[\s\S]*BEGIN;[\s\S]*COMMIT;\s*$/, 'transactional');
+  assert.ok(/^[\x00-\x7F]*$/.test(m4), 'ASCII only');
+  for (const src of [caseSql, pagesSrc]) assert.match(src, /ORDER BY p\.decided_at DESC, p\.id DESC/);
 });
 
 // ---- untrusted text becomes markup only through esc --------------------------------
 
+// task 1005018: the dialog's screen-reader name follows the action that opened it.
+test('the propose dialog is named by its own title: propose a change, stop tracking or send a new scout', () => {
+  const titleOf = (html) => {
+    const all = [...html.matchAll(/<span[^>]*id="mw-propose-title"[^>]*>([^<]*)<\/span>/g)];
+    assert.equal(all.length, 1, 'exactly one title to point at');
+    return all[0][1];
+  };
+  const item = { id: 4, kind: 'competitor', name: 'Copilot' };
+  const expected = { change: 'propose a change', stop: 'stop tracking', scout: 'send a new scout' };
+  for (const [mode, words] of Object.entries(expected)) {
+    // a fake <dialog> that starts with the old fixed label, as a page served before this fix did
+    const attrs = new Map([['aria-label', 'Propose a change']]);
+    const stub = () => ({ value: '', checked: false, hidden: false, addEventListener() {}, focus() {} });
+    const fields = new Proxy({}, { get: (o, k) => (o[k] = o[k] || stub()) });
+    const form = { elements: fields, addEventListener() {}, querySelector: () => stub() };
+    let html = '';
+    const dlg = {
+      set innerHTML(v) { html = v; }, get innerHTML() { return html; },
+      setAttribute: (k, v) => attrs.set(k, String(v)), removeAttribute: (k) => attrs.delete(k), getAttribute: (k) => attrs.get(k) ?? null,
+      querySelector: (s) => (s === 'form' ? form : stub()), querySelectorAll: () => [], showModal() {}, close() {},
+    };
+    const saved = globalThis.document;
+    globalThis.document = { getElementById: (id) => (id === 'mw-propose' ? dlg : null) };
+    try { MW.openPropose(mode, { item, dimensions: [], entries: [] }, () => {}); } finally { globalThis.document = saved; }
+    assert.equal(attrs.has('aria-label'), false, `${mode}: no fixed label left to override the title`);
+    assert.equal(attrs.get('aria-labelledby'), 'mw-propose-title', mode);
+    assert.equal(titleOf(html), words, `${mode}: the name a screen reader hears`);
+  }
+  for (const page of ['market-watch.html', 'market-watch-item.html']) {
+    const src = readFileSync(new URL(`../modules/hall-ui/public/${page}`, import.meta.url), 'utf8');
+    const tag = src.match(/<dialog[^>]*id="mw-propose"[^>]*>/)[0];
+    assert.doesNotMatch(tag, /aria-label=/, `${page}: no fixed name on the dialog`);
+    assert.match(tag, /aria-labelledby="mw-propose-title"/, page);
+  }
+});
+
 test('an item name or takeaway with markup in it is escaped on the landscape and in the dialog', () => {
   const evil = '<img src=x onerror=alert(1)>"\'';
   const h = home();
@@ -307,6 +383,15 @@ test('a member files a proposal: one row, origin member, their id, this project;
   assert.equal((await call('POST', '/market-watch/proposals', { kind: 'remove_item', item_id: 4, reason: 'r', status: 'approved' })).status, 400,
     'an unknown field (a member trying to approve their own proposal) is refused');
   assert.equal(inserts.length, 2, 'refused proposals write nothing');
+  // task 1005016: the route takes the correction (or the wrong flag) and stores it on the row
+  const fix = await call('POST', '/market-watch/proposals', { kind: 'correct_entry', item_id: 4, log_entry_id: 15, takeaway: 'Raised a seed.', reason: 'their post' });
+  assert.equal(fix.status, 201);
+  assert.deepEqual([inserts[2].params[3], JSON.parse(inserts[2].params[4]).takeaway], [15, 'Raised a seed.']);
+  const wrong = await call('POST', '/market-watch/proposals', { kind: 'correct_entry', item_id: 4, log_entry_id: 15, wrong: true, reason: 'still running' });
+  assert.equal(wrong.status, 201);
+  assert.equal(JSON.parse(inserts[3].params[4]).wrong, true);
+  assert.equal((await call('POST', '/market-watch/proposals', { kind: 'correct_entry', item_id: 4, log_entry_id: 15, reason: 'r' })).status, 400, 'no correction, no proposal');
+  assert.equal(inserts.length, 4);
 });
 
 // ---- the quiet off state -----------------------------------------------------------