@bongos/core 1.24.14 → 1.24.16

package/tests/ai_studio_gemini_models.mjs

@@ -0,0 +1,81 @@
+// tests/ai_studio_gemini_models.mjs — a retired Gemini model never breaks the
+// studio: when Google answers 404 for the model we name, the key's own model
+// list is read, the newest model of the same kind is used, and that pick is
+// remembered. Google's own reason reaches the message when it still fails.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const G = require('../modules/ai-studio/gemini.js');
+
+const KEY = 'AIza-test-key-0000000000000000000000';
+const gen = ['generateContent'];
+const LIST = [
+  { name: 'models/gemini-2.5-flash', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-pro-preview', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3-pro', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-flash-image-preview', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-flash-image', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-flash-lite-image', supportedGenerationMethods: gen },
+  { name: 'models/gemini-3.1-pro-tts', supportedGenerationMethods: gen },
+  { name: 'models/imagen-4.0-generate-001', supportedGenerationMethods: ['predict'] },
+  { name: 'models/text-embedding-004', supportedGenerationMethods: ['embedContent'] },
+];
+
+test('pickModel takes the newest stable model of the right kind', () => {
+  assert.equal(G.pickModel('images', LIST), 'gemini-3.1-flash-image');
+  assert.equal(G.pickModel('reply', LIST), 'gemini-3-pro');
+  assert.equal(G.pickModel('reply', LIST.filter((m) => m.name !== 'models/gemini-3-pro')), 'gemini-2.5-flash', 'a stable model beats a preview, which Google can pull any day');
+  assert.equal(G.pickModel('reply', LIST.filter((m) => !/gemini-3-pro|2\.5-flash$/.test(m.name))), 'gemini-3.1-pro-preview');
+  assert.equal(G.pickModel('images', []), null);
+});
+
+test('a 404 on the named model falls over to the key\'s newest one, and remembers it', async () => {
+  const calls = [];
+  const PNG = Buffer.from('png').toString('base64');
+  const fetchImpl = async (url, init) => {
+    calls.push({ url, method: init.method, key: init.headers['x-goog-api-key'] });
+    if (init.method === 'GET') return { ok: true, status: 200, json: async () => ({ models: LIST }) };
+    if (url.includes('gemini-2.5-flash-image')) return { ok: false, status: 404, json: async () => ({ error: { message: 'models/gemini-2.5-flash-image is not found' } }) };
+    return { ok: true, status: 200, json: async () => ({ candidates: [{ content: { parts: [{ inlineData: { mimeType: 'image/png', data: PNG } }] } }] }) };
+  };
+  const out = await G.images({ fetchImpl, key: KEY, system: 's', brief: 'b', files: [] });
+  assert.equal(out.images.length, 1);
+  assert.ok(calls[2].url.includes('/gemini-3.1-flash-image:generateContent'));
+  assert.ok(calls.every((c) => c.key === KEY && !c.url.includes(KEY)), 'the key rides only the header');
+  calls.length = 0;
+  await G.images({ fetchImpl, key: KEY, system: 's', brief: 'b', files: [] });
+  assert.equal(calls.length, 1, 'the pick is remembered');
+  assert.ok(calls[0].url.includes('/gemini-3.1-flash-image:'));
+  assert.ok([...G._resolved.keys()].every((k) => !k.includes(KEY)), 'the memory holds a hash, never the key');
+  calls.length = 0;
+  await G.images({ fetchImpl, key: 'AIza-another-key-00000000000000000', system: 's', brief: 'b', files: [] });
+  assert.ok(calls[0].url.includes('/gemini-2.5-flash-image:'), 'another key does not inherit the first key\'s pick');
+  G._resolved.clear();
+});
+
+test('a model list that never answers is given up on, and the refusal still comes back', async () => {
+  const fetchImpl = (url, init) => (init.method === 'GET'
+    ? new Promise((_, reject) => init.signal.addEventListener('abort', () => reject(Object.assign(new Error('aborted'), { name: 'AbortError' }))))
+    : Promise.resolve({ ok: false, status: 404, json: async () => ({ error: { message: 'not found' } }) }));
+  const real = globalThis.setTimeout;
+  globalThis.setTimeout = (fn, ms) => real(fn, ms > 1000 ? 5 : ms); // the 15 s limit, compressed
+  try {
+    await assert.rejects(G.images({ fetchImpl, key: KEY, system: 's', brief: 'b', files: [] }), /HTTP 404: not found\)/);
+  } finally {
+    globalThis.setTimeout = real;
+  }
+});
+
+test('a refusal folds Google\'s own reason into one sentence, with no key and no control characters', async () => {
+  const fetchImpl = async (url, init) => (init.method === 'GET'
+    ? { ok: false, status: 400, json: async () => ({}) }
+    : { ok: false, status: 400, json: async () => ({ error: { message: 'API key not valid. Please pass a valid API key.' } }) });
+  await assert.rejects(G.reply({ fetchImpl, key: KEY, system: 's', prompt: 'p', files: [] }),
+    { message: 'Google refused the request (HTTP 400: API key not valid. Please pass a valid API key). Check the key in Settings.' });
+  assert.equal(G.googleReason({ error: { message: 'bad AIzaSyD-abcdefghijklmnop\u0007\nkey' } }), ': bad [key] key');
+  assert.equal(G.googleReason({ error: { message: 'x'.repeat(500) } }).length, 162);
+  assert.equal(G.googleReason(null), '');
+});

package/tests/ai_studio_requests.mjs

@@ -27,8 +27,10 @@ const OUT_PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 1,
 const files = new Map();
 const requests = new Map();
 let seq = 100;
+let ageTier = 'adult';
 const meta = (f) => ({ id: f.id, request_id: f.request_id, role: f.role, name: f.name, content_type: f.content_type, size_bytes: f.bytes.length, created_at: f.created_at });
 Object.assign(db, {
+  latestAgeTier: async () => ageTier,
   appendLedger: async () => ({}),
   addUpload: async (builderId, f) => {
     const row = { id: String(++seq), builder_id: builderId, request_id: null, role: 'upload', name: f.name, content_type: f.content_type, bytes: f.bytes, created_at: 'now' };
@@ -177,6 +179,8 @@ test('THE WHOLE PATH: upload a sketch, send it, get a reply, an image and the ex
   assert.ok(providerCalls.every((c) => c.auth === `Bearer ${OUR_KEY}`));
   assert.match(providerCalls[0].body.messages[0].content, /art director's assistant/);
   assert.equal(providerCalls[0].body.messages[1].content[1].type, 'image_url');
+  // Every call carried the provider policy: no provider that keeps or trains on prompts.
+  assert.ok(providerCalls.every((c) => c.body.provider && c.body.provider.data_collection === 'deny' && c.body.provider.zdr === true));
 
   // Our key is in nothing a builder can see, and in no log line.
   for (const res of [up, sent, done]) assert.ok(!res.raw.includes(OUR_KEY));
@@ -317,3 +321,23 @@ test('an uploaded PDF downloads rather than opening in the page', async () => {
   const img = await call('POST', '/ai-studio/uploads', { name: 'i.png', content_type: 'image/png', data: PNG.toString('base64') });
   assert.match((await call('GET', `/ai-studio/files/${img.body.file.id}`)).headers['content-disposition'], /^inline;/);
 });
+
+test('AI Studio is adults only: no recorded age, or under 18, is refused before anything runs', async () => {
+  for (const tier of [null, '16_17']) {
+    ageTier = tier;
+    const r = await call('POST', '/ai-studio/requests', { prompt: 'A tower', file_ids: [] });
+    assert.equal(r.status, 403);
+    assert.equal(r.body.error.code || r.body.error, 'adults_only');
+  }
+  ageTier = 'adult';
+  const s = await call('GET', '/ai-studio/status');
+  assert.equal(s.body.adult, true);
+  assert.match(s.body.terms, /18 and over/);
+});
+
+test('every OpenRouter call refuses providers that keep or train on prompts', () => {
+  const { providerPolicy } = require('../modules/ai-studio/openrouter.js');
+  assert.deepEqual(providerPolicy({}), { data_collection: 'deny', zdr: true });
+  assert.deepEqual(providerPolicy({ OPENROUTER_ZDR: 'off', OPENROUTER_ALLOWED_PROVIDERS: 'google-vertex, anthropic', OPENROUTER_DISTILLABLE_ONLY: 'on' }),
+    { data_collection: 'deny', only: ['google-vertex', 'anthropic'], enforce_distillable_text: true });
+});

package/tests/blocker_detail_hydration.mjs

@@ -31,7 +31,7 @@ let queries = [];
 
 api.pool.query = async (sql, params = []) => {
   queries.push({ sql: String(sql), params });
-  if (/FROM blockers b\s+WHERE b\.status = 'open'/.test(sql)) {
+  if (/FROM blockers b\s+LEFT JOIN LATERAL[\s\S]*?\) bl ON true\s+WHERE b\.status = 'open'/.test(sql)) {
     return {
       rows: [
         { id: '1000085', title: 'the open one', body_md: '', status: 'open',
@@ -40,7 +40,7 @@ api.pool.query = async (sql, params = []) => {
       ],
     };
   }
-  if (/FROM blockers b WHERE b\.id = \$1/.test(sql)) {
+  if (/FROM blockers b LEFT JOIN LATERAL[\s\S]*?\) bl ON true WHERE b\.id = \$1/.test(sql)) {
     const id = String(params[0]);
     if (id === '1000085') {
       return {
@@ -87,7 +87,9 @@ async function test(name, fn) {
 }
 
 function blockingTaskIdsFragment(sql) {
-  const match = sql.match(/COALESCE\(\s*\(SELECT array_agg\(tb\.task_id[\s\S]*?blocking_task_ids/);
+  // task 1004958: the ids now come from one LATERAL read (with the named tasks beside
+  // them); the identity that matters is still the projection AND the join it reads.
+  const match = sql.match(/COALESCE\(bl\.ids[\s\S]*?\) bl ON true/);
   assert.ok(match, `query does not carry a blocking_task_ids projection:\n${sql}`);
   return match[0].replace(/\s+/g, ' ').trim();
 }

package/tests/blocker_tasks_named_db.mjs

@@ -0,0 +1,74 @@
+// tests/blocker_tasks_named_db.mjs — task 1004958. Real DB.
+// A blocker names the tasks it holds ("task N - <name>"), through ONE lateral read in
+// modules/ideas/blockers.js that returns both blocking_task_ids (the hall's field) and
+// blocking_tasks [{ id, short_name }]. tests/blocker_detail_hydration.mjs pins the SQL
+// text against a fake pool; this runs the real listOpenBlockers / getBlocker against a
+// fully migrated Postgres: ordering, a task with no name yet, a blocker holding nothing,
+// and that the two reads agree.
+// Self-skips without a reachable Postgres.
+// Run:  DATABASE_URL=... node tests/blocker_tasks_named_db.mjs
+import { createRequire } from 'node:module';
+import { strict as assert } from 'node:assert';
+const require = createRequire(import.meta.url);
+const { Pool } = require('pg');
+
+const pool = new Pool({ connectionString: process.env.DATABASE_URL || undefined, max: 1 });
+try {
+  await pool.query('SELECT 1');
+} catch (e) {
+  console.log(`blocker_tasks_named_db.mjs SKIPPED — no reachable Postgres (${e.code || e.message}).`);
+  await pool.end().catch(() => {});
+  process.exit(0);
+}
+
+const blockers = require('../modules/ideas/blockers.js');
+const VER = 'ZZZ-NAMES';
+const T1 = 990049581;
+const T2 = 990049582;
+const REF = 'task-1004958-names';
+const q = (sql, params) => pool.query(sql, params).then((r) => r.rows);
+
+let pass = 0;
+const ok = (c, m) => { assert.ok(c, m); pass++; console.log(`  ok - ${m}`); };
+
+async function cleanup() {
+  await q(`DELETE FROM task_blockers WHERE task_id = ANY($1::bigint[]) OR blocker_id IN (SELECT id FROM blockers WHERE source = 'test' AND source_ref LIKE $2)`, [[T1, T2], `${REF}%`]).catch(() => {});
+  await q(`DELETE FROM blockers WHERE source = 'test' AND source_ref LIKE $1`, [`${REF}%`]).catch(() => {});
+  await q('DELETE FROM tasks WHERE id = ANY($1::bigint[])', [[T1, T2]]).catch(() => {});
+  await q('DELETE FROM versions WHERE id = $1', [VER]).catch(() => {});
+}
+
+try {
+  await cleanup();
+  await q(`INSERT INTO versions (id,name,status,track) VALUES ($1,'names','shipped','internal') ON CONFLICT (id) DO NOTHING`, [VER]);
+  // T2 first and with no name: the read must order by id and keep a null name.
+  await q(`INSERT INTO tasks (id,version_id,title,status,credits_reward,kind,discipline,short_name)
+           VALUES ($1,$3,'Payout approvals','backlog',10,'feature','engineer','payout approvals'),
+                  ($2,$3,'#12','backlog',10,'feature','engineer',NULL)`, [T1, T2, VER]);
+  const holding = await blockers.createBlocker({ title: 'names fixture: holds two', bodyMd: '', source: 'test', sourceRef: `${REF}-a` });
+  const empty = await blockers.createBlocker({ title: 'names fixture: holds none', bodyMd: '', source: 'test', sourceRef: `${REF}-b` });
+  await blockers.linkBlockerToTask({ blockerId: holding.id, taskId: T2 }); // linked out of id order on purpose
+  await blockers.linkBlockerToTask({ blockerId: holding.id, taskId: T1 });
+
+  const one = await blockers.getBlocker(holding.id);
+  ok(JSON.stringify(one.blocking_task_ids.map(Number)) === JSON.stringify([T1, T2]), 'blocking_task_ids is unchanged in shape and ordered by id');
+  ok(Array.isArray(one.blocking_tasks) && one.blocking_tasks.length === 2, 'blocking_tasks carries one entry per held task');
+  ok(Number(one.blocking_tasks[0].id) === T1 && one.blocking_tasks[0].short_name === 'payout approvals', 'each entry names its task');
+  ok(Number(one.blocking_tasks[1].id) === T2 && one.blocking_tasks[1].short_name === null, 'a task with no name yet keeps null, never a guess');
+
+  const none = await blockers.getBlocker(empty.id);
+  ok(Array.isArray(none.blocking_task_ids) && none.blocking_task_ids.length === 0, 'a blocker holding nothing reads an empty id list');
+  ok(Array.isArray(none.blocking_tasks) && none.blocking_tasks.length === 0, 'and an empty task list, not null');
+
+  const list = await blockers.listOpenBlockers();
+  const fromList = list.find((b) => String(b.id) === String(holding.id));
+  ok(fromList && JSON.stringify(fromList.blocking_tasks) === JSON.stringify(one.blocking_tasks), 'the list and the detail read agree');
+  const paged = await blockers.listOpenBlockers({ limit: 1000, offset: 0 });
+  ok(paged.some((b) => String(b.id) === String(empty.id)), 'the paged list still returns a blocker that holds nothing (the lateral join drops no row)');
+} finally {
+  await cleanup();
+  await pool.end().catch(() => {});
+  // blockers.js reads through the shared doorway pool; close it so the process exits.
+  await require('../src/module-api').pool.end().catch(() => {});
+}
+console.log(`\nblocker_tasks_named_db: ${pass} passed`);

package/tests/claim_gate_ci_unblock.mjs

@@ -66,7 +66,7 @@ function fakeClientFor(task) {
       seen.push(s);
       if (s === 'BEGIN' || s === 'ROLLBACK' || s === 'COMMIT') return { rows: [] };
       if (s.startsWith('SELECT status, rank FROM builders')) return { rows: [{ status: 'active', rank: 'archon' }] };
-      if (s.startsWith('SELECT id, title, needs_rebase_reason, needs_rebase_at FROM tasks WHERE needs_rebase = true')) {
+      if (s.startsWith('SELECT id, title, short_name, needs_rebase_reason, needs_rebase_at FROM tasks WHERE needs_rebase = true')) {
         return { rows: [{ id: '900', title: 'stalled', needs_rebase_reason: 'strand:pr_not_landed', needs_rebase_at: new Date() }] };
       }
       if (s === 'SELECT kind, priority FROM tasks WHERE id = $1') {

package/tests/github_chip.mjs

@@ -0,0 +1,217 @@
+// tests/github_chip.mjs — the Link GitHub chip in the top bar (task 1004996, goal
+// 1000095 WA6; owner ask 2026-10-29).
+//
+// Someone with no GitHub linked sees one very small chip with the engineer's icon
+// in the top bar; a press starts the GitHub link (ADR 0396). Anyone with GitHub
+// linked sees nothing, and nothing ever pops up. Three copies draw it — the hall's
+// github-chip.js, the hub's assets/hub-bar.js and projects.html's own bar — so
+// this file RUNS each one under a small DOM stub and holds their words, link and
+// glyph equal, then checks the shell loads the hall's copy and both sheets keep
+// the 24px floor.
+//
+// Run:  node --test tests/github_chip.mjs
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const LANDING = path.join(ROOT, 'modules', 'public-landing', 'public');
+const read = (p) => fs.readFileSync(p, 'utf8').replace(/\r\n/g, '\n');
+const CHIP_SRC = read(path.join(HALL, 'github-chip.js'));
+const BAR = read(path.join(LANDING, 'assets', 'hub-bar.js'));
+const HUB = read(path.join(LANDING, 'projects.html'));
+const SHELL = read(path.join(HALL, 'shell.js'));
+const chip = require(path.join(HALL, 'github-chip.js'));
+// the engineer's glyph IS the Building craft's (craft-mode.js ICONS.building)
+const BUILDING = /building: '<path d="([^"]+)"\/>'/.exec(read(path.join(HALL, 'craft-mode.js')))[1];
+
+// ── a DOM just big enough for the three copies ──────────────────────────────
+class El {
+  constructor(tag, id) { this.tagName = tag.toUpperCase(); this.id = id || ''; this.children = []; this.parentNode = null; this.attrs = {}; this.textContent = ''; this.hidden = false; this.className = ''; }
+  get firstChild() { return this.children[0] || null; }
+  setAttribute(k, v) { this.attrs[k] = String(v); }
+  getAttribute(k) { return k in this.attrs ? this.attrs[k] : null; }
+  appendChild(c) { c.parentNode = this; this.children.push(c); return c; }
+  insertBefore(c, ref) { c.parentNode = this; const i = ref ? this.children.indexOf(ref) : -1; if (i < 0) this.children.push(c); else this.children.splice(i, 0, c); return c; }
+  remove() { if (this.parentNode) this.parentNode.children.splice(this.parentNode.children.indexOf(this), 1); this.parentNode = null; }
+  addEventListener() {}
+  querySelector() { return null; }
+  querySelectorAll() { return []; }
+  contains() { return false; }
+  focus() {}
+  closest() { return null; }
+}
+function makeDoc(barSelector) {
+  const bar = new El('div');
+  const byId = new Map();
+  const find = (node, id) => { if (node.id === id) return node; for (const c of node.children) { const f = find(c, id); if (f) return f; } return null; };
+  const doc = {
+    bar,
+    cookie: '',
+    activeElement: null,
+    createElement: (t) => new El(t),
+    createElementNS: (ns, t) => new El(t),
+    getElementById(id) { return find(bar, id) || (id === 'ghChip' || id === 'gh-chip' ? null : (byId.get(id) || byId.set(id, new El('div', id)).get(id))); },
+    querySelector: (sel) => (sel === barSelector ? bar : null),
+    querySelectorAll: () => [],
+    addEventListener() {},
+  };
+  return doc;
+}
+const settle = async () => { for (let i = 0; i < 8; i++) await new Promise((r) => setImmediate(r)); };
+const chipOf = (doc, id) => doc.bar.children.find((c) => c.id === id) || null;
+const svgPath = (a) => a.children.find((c) => c.tagName === 'SVG').children[0].attrs.d;
+const labelOf = (a) => a.children.find((c) => c.tagName === 'SPAN').textContent;
+const GOOGLE_ONLY = { methods: [{ provider: 'google', email: 'o@example.com' }], providers: ['github', 'google'] };
+const BOTH = { methods: [{ provider: 'github' }, { provider: 'google' }], providers: ['github', 'google'] };
+
+// ── the hall's copy ──────────────────────────────────────────────────────────
+test('the hall: who needs GitHub — only a stand-in login, and the ways in decide where they can be read', () => {
+  assert.equal(chip.needsGithub([{ provider: 'google' }], { github_login: '~octo' }), true);
+  assert.equal(chip.needsGithub([{ provider: 'github' }, { provider: 'google' }], { github_login: '~octo' }), false, 'a linked GitHub wins over the stand-in login');
+  assert.equal(chip.needsGithub(null, { github_login: '~octo' }), true, 'a project hall with no ways-in route: the stand-in says Google-only');
+  assert.equal(chip.needsGithub(null, { github_login: 'octo' }), false);
+  assert.equal(chip.needsGithub([{ provider: 'google' }], { github_login: 'octo' }), false, 'a real login means GitHub was linked (linking writes it over the stand-in)');
+  assert.equal(chip.needsGithub(null, null), false, 'nothing known, nothing drawn');
+  assert.equal(chip.chipHref(null), null, 'no hub, no linking, no chip');
+  assert.equal(chip.chipHref('https://example.com'), 'https://example.com/api/bongos/auth/link/github/start');
+  for (const bad of ['http://example.com', 'https://example.com/x', 'https://evil.example?x=', 'javascript:alert(1)//', '']) assert.equal(chip.chipHref(bad), null, `refused: ${bad}`);
+});
+
+async function mountHall(answer, builder, hub = 'https://example.com') {
+  const doc = makeDoc('#app-topbar .topbar-side');
+  const calls = [];
+  const api = { request: (m, p) => { calls.push(`${m} ${p}`); return typeof answer === 'function' ? answer() : Promise.resolve(answer); } };
+  const ctx = { document: doc, window: {}, Array, Promise };
+  ctx.window = ctx;
+  vm.runInNewContext(CHIP_SRC, ctx);
+  const shown = await ctx.OTBGithubChip.mount({ api, builder, hub });
+  return { doc, calls, shown, a: chipOf(doc, 'gh-chip') };
+}
+
+test('the hall, executed: Google only draws one small link with the engineer glyph, to the hub’s link start', async () => {
+  const { a, calls, shown } = await mountHall({ ok: true, data: GOOGLE_ONLY }, { github_login: '~octo' });
+  assert.equal(shown, true);
+  assert.deepEqual(calls, ['GET /api/bongos/me/sign-in-methods'], 'one read');
+  assert.equal(a.tagName, 'A', 'a plain link: no pop-up, no dialog');
+  assert.equal(a.href, 'https://example.com/api/bongos/auth/link/github/start');
+  assert.equal(a.className, 'gh-chip');
+  assert.equal(labelOf(a), 'Link GitHub');
+  assert.equal(svgPath(a), BUILDING, 'the engineer craft’s own glyph');
+  assert.match(a.attrs['aria-label'], /coding/);
+});
+
+test('the hall, executed: GitHub linked, a failed read for a real login, or no hub draws nothing', async () => {
+  assert.equal((await mountHall({ ok: true, data: BOTH }, { github_login: '~octo' })).a, null);
+  assert.equal((await mountHall({ ok: false, status: 404 }, { github_login: 'octo' })).a, null);
+  assert.equal((await mountHall(() => Promise.reject(new Error('offline')), { github_login: 'octo' })).a, null);
+  const noHub = await mountHall({ ok: true, data: GOOGLE_ONLY }, {}, null);
+  assert.equal(noHub.a, null);
+  assert.deepEqual(noHub.calls, [], 'no hub: not even the read');
+  const fallback = await mountHall({ ok: false, status: 404 }, { github_login: '~octo' });
+  assert.ok(fallback.a, 'a project hall: the stand-in login draws it');
+  const real = await mountHall({ ok: true, data: GOOGLE_ONLY }, { github_login: 'octo' });
+  assert.equal(real.a, null);
+  assert.deepEqual(real.calls, [], 'a real login costs no read at all');
+});
+
+test('the shell loads the hall’s copy once, for a signed-in builder, only where there is a hub', () => {
+  assert.match(SHELL, /if \(state\.builder && access\.authed === true\) \{ loadPositions\(state\.builder, state\.positions\); loadGithubChip\(state\.builder\); \}/);
+  const fn = /function loadGithubChip\(builder\) \{[\s\S]*?\n {2}\}/.exec(SHELL)[0];
+  assert.match(fn, /hubOrigin\(\)/);
+  assert.match(fn, /if \(githubChipAsked \|\| !hub\) return;/);
+  assert.match(fn, /loadHallScript\('github-chip\.js'/);
+  assert.ok(SHELL.split('\n').length <= 1500, 'shell.js stays inside the 1500-line ratchet');
+});
+
+// ── the hub's two copies ─────────────────────────────────────────────────────
+function bootBar(answers) {
+  const doc = makeDoc('.barRight');
+  const calls = [];
+  const fetch = (url) => {
+    const p = url.replace(/^\/api\/bongos/, '');
+    calls.push(p);
+    const { status, data } = answers(p);
+    return Promise.resolve({ status, ok: status >= 200 && status < 300, json: () => Promise.resolve(data) });
+  };
+  const window = {};
+  vm.runInNewContext(BAR, { document: doc, fetch, window, location: { hostname: 'cloudbongos.com', pathname: '/account' }, Array, Promise });
+  return { doc, calls, window };
+}
+const ME = { builder: { id: '1', github_login: '~octo' } };
+
+test('the hub bar, executed: signed in with Google only, the chip heads the bar’s right side', async () => {
+  const { doc, calls } = bootBar((p) => (p === '/me' ? { status: 200, data: ME } : { status: 200, data: GOOGLE_ONLY }));
+  await settle();
+  assert.deepEqual(calls, ['/me', '/me/sign-in-methods']);
+  const a = chipOf(doc, 'ghChip');
+  assert.ok(a);
+  assert.equal(doc.bar.children[0], a, 'first in the row');
+  assert.equal(a.href, '/api/bongos/auth/link/github/start');
+  assert.equal(labelOf(a), chip.LABEL);
+  assert.equal(svgPath(a), BUILDING);
+});
+
+test('the hub bar, executed: linked, signed out, a child (404) or a failed read draws nothing', async () => {
+  for (const answers of [
+    (p) => (p === '/me' ? { status: 200, data: ME } : { status: 200, data: BOTH }),
+    (p) => (p === '/me' ? { status: 200, data: ME } : { status: 404, data: null }),
+    (p) => (p === '/me' ? { status: 200, data: ME } : { status: 500, data: null }),
+  ]) {
+    const { doc } = bootBar(answers);
+    await settle();
+    assert.equal(chipOf(doc, 'ghChip'), null);
+  }
+  const out = bootBar(() => ({ status: 401, data: null }));
+  await settle();
+  assert.deepEqual(out.calls, ['/me'], 'signed out: no ways-in read at all');
+  assert.equal(chipOf(out.doc, 'ghChip'), null);
+  const real = bootBar((p) => (p === '/me' ? { status: 200, data: { builder: { id: '2', github_login: 'octocat' } } } : { status: 200, data: GOOGLE_ONLY }));
+  await settle();
+  assert.deepEqual(real.calls, ['/me'], 'a real login (GitHub linked): no ways-in read on any page');
+  assert.equal(chipOf(real.doc, 'ghChip'), null);
+});
+
+test('projects.html keeps its own copy, executed: the same chip from the same read', async () => {
+  const fn = /\n {2}var GH_TITLE = [^\n]+\n {2}function githubChip\(\) \{[\s\S]*?\n {2}\}\n/.exec(HUB);
+  assert.ok(fn, 'projects.html carries githubChip()');
+  assert.match(HUB, /paintShellIdentity\(\);\n\s+githubChip\(\);/, 'drawn after the identity read');
+  for (const [answer, who, drawn] of [[GOOGLE_ONLY, ME.builder, true], [BOTH, ME.builder, false], [GOOGLE_ONLY, { github_login: 'octocat' }, false]]) {
+    const doc = makeDoc('.barRight');
+    let reads = 0;
+    const fetch = () => { reads++; return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve(answer) }); };
+    const ctx = { document: doc, fetch, API: '/api/bongos', me: who, $: (id) => doc.getElementById(id), Array, Promise };
+    vm.runInNewContext(fn[0] + '\ngithubChip();', ctx);
+    await settle();
+    const a = chipOf(doc, 'ghChip');
+    assert.equal(!!a, drawn);
+    assert.equal(reads, who.github_login.startsWith('~') ? 1 : 0, 'only a stand-in login is asked about');
+    if (a) { assert.equal(a.href, '/api/bongos/auth/link/github/start'); assert.equal(labelOf(a), chip.LABEL); assert.equal(svgPath(a), BUILDING); }
+  }
+});
+
+test('the three copies say the same words and build no markup from strings', () => {
+  const title = /var TITLE = '([^']+)'/.exec(CHIP_SRC)[1];
+  assert.match(BAR, new RegExp(`var GH_TITLE = '${title}'`));
+  assert.match(HUB, new RegExp(`var GH_TITLE = '${title}'`));
+  for (const src of [CHIP_SRC, BAR]) assert.doesNotMatch(src, /innerHTML|insertAdjacentHTML|outerHTML/);
+  assert.doesNotMatch(/function githubChip\(\) \{[\s\S]*?\n {2}\}\n/.exec(HUB)[0], /innerHTML/);
+});
+
+// ── the sheets: very small, but never under the 24px floor ───────────────────
+test('both sheets keep the chip quiet and at least 24px, its words folding away on a phone', () => {
+  const cosmos = read(path.join(LANDING, 'assets', 'cosmos.css'));
+  const hall = read(path.join(HALL, 'style.css'));
+  assert.match(cosmos, /\.ghChip\{[^}]*min-height:24px;min-width:24px;/);
+  assert.match(cosmos, /@media \(max-width:900px\)\{[\s\S]*?\.ghChip__label\{display:none;\}/);
+  assert.match(hall, /\.gh-chip \{[^}]*min-height: 24px;[^}]*min-width: 24px;/);
+  assert.match(hall, /@media \(max-width: 640px\) \{\n {2}\.gh-chip \{[^}]*\}\n {2}\.gh-chip__label \{ display: none; \}/);
+  for (const css of [cosmos, hall]) assert.doesNotMatch(/\.gh-?[Cc]hip[^{]*\{[^}]*\}/.exec(css)[0], /#[0-9a-f]{3,8}\b|rgba?\(/i, 'tokens only');
+});

package/tests/hall_ai_studio.mjs

@@ -131,6 +131,8 @@ function makeEl(id) {
     removeAttribute(k) { delete el.attrs[k]; },
     addEventListener(type, fn) { (el.handlers[type] = el.handlers[type] || []).push(fn); },
     focus() {},
+    clicks: 0,
+    click() { el.clicks += 1; },
     async fire(type, extra = {}) {
       const ev = { preventDefault() {}, currentTarget: el, target: el, ...extra };
       for (const fn of el.handlers[type] || []) await fn(ev);
@@ -157,8 +159,27 @@ function makeEl(id) {
 
 const settle = async () => { for (let i = 0; i < 30; i++) await new Promise((r) => setImmediate(r)); };
 
-function bootPage(search, { routes = {} } = {}) {
-  const els = { 'ais-page': makeEl('ais-page'), 'hall-main': makeEl('hall-main'), 'ais-file': makeEl('ais-file') };
+// A browser File, as much of it as the page reads.
+class FakeFile {
+  constructor(parts, name, opts = {}) { this.name = name; this.type = opts.type || ''; this.size = parts.reduce((n, p) => n + (p.size || 3), 0); }
+}
+
+// The device the page runs on: a phone (coarse pointer) or a computer, and
+// whether its webcam answers. Each track records whether it was stopped.
+function makeDevice({ touch = false, webcam = 'yes' } = {}) {
+  const tracks = [{ stopped: false, stop() { this.stopped = true; } }];
+  return {
+    tracks,
+    matchMedia: (q) => ({ matches: touch && q.includes('coarse') }),
+    navigator: { mediaDevices: webcam === 'none' ? undefined : {
+      getUserMedia: async () => { if (webcam === 'refused') throw new Error('NotAllowedError'); return { getTracks: () => tracks }; },
+    } },
+  };
+}
+
+function bootPage(search, { routes = {}, device = makeDevice() } = {}) {
+  const els = { 'ais-page': makeEl('ais-page'), 'hall-main': makeEl('hall-main'), 'ais-file': makeEl('ais-file'), 'ais-camera-file': makeEl('ais-camera-file') };
+  const winHandlers = {};
   const calls = [];
   const store = new Map();
   const loc = { search, href: `/builders/ai-studio${search}` };
@@ -201,7 +222,15 @@ function bootPage(search, { routes = {} } = {}) {
     clearInterval: () => {},
     Date,
     Promise,
-    document: { getElementById: (id) => els[id] || null, body: makeEl('body') },
+    document: {
+      getElementById: (id) => els[id] || null,
+      body: makeEl('body'),
+      // The snapshot canvas: draws nothing, hands back a 3-byte JPEG.
+      createElement: () => ({ getContext: () => ({ drawImage() {} }), toBlob: (cb, type) => cb({ size: 3, type }) }),
+    },
+    File: FakeFile,
+    matchMedia: device.matchMedia,
+    navigator: device.navigator,
     location: loc,
     history: {
       pushState(_s, _t, url) { loc.href = url; loc.search = url.includes('?') ? url.slice(url.indexOf('?')) : ''; },
@@ -210,7 +239,7 @@ function bootPage(search, { routes = {} } = {}) {
     sessionStorage: { getItem: (k) => (store.has(k) ? store.get(k) : null), setItem: (k, v) => store.set(k, String(v)) },
     fetch: async (url) => { calls.push({ method: 'FETCH', url }); return { ok: true, blob: async () => ({ size: 3, type: 'image/png' }) }; },
     FileReader: class { readAsDataURL() { this.result = 'data:image/png;base64,QUJD'; setImmediate(() => this.onload()); } },
-    addEventListener() {},
+    addEventListener(type, fn) { (winHandlers[type] = winHandlers[type] || []).push(fn); },
   };
   ctx.window = ctx;
   ctx.window.BongosClient = { createClient: () => client };
@@ -220,7 +249,18 @@ function bootPage(search, { routes = {} } = {}) {
     const src = f === 'studio-lib.js' ? 'window.OTBStudioLib = { skyAt: () => "night" };' : fs.readFileSync(path.join(PUB, f), 'utf8');
     vm.runInContext(src, ctx, { filename: f });
   }
-  return { els, page: els['ais-page'], main: els['hall-main'], calls, loc, store };
+  const fireWindow = async (type, ev) => { for (const fn of winHandlers[type] || []) await fn(ev); };
+  return { els, page: els['ais-page'], main: els['hall-main'], calls, loc, store, device, fireWindow };
+}
+
+// A paste event carrying these clipboard files; records whether the page took it.
+function pasteEvent(files) {
+  const ev = {
+    taken: false,
+    preventDefault() { ev.taken = true; },
+    clipboardData: { items: files.map((f) => ({ kind: 'file', getAsFile: () => f })) },
+  };
+  return ev;
 }
 
 test('page: step 1 opens on an earlier request\'s files, carried by address, with Next', async () => {
@@ -234,6 +274,90 @@ test('page: step 1 opens on an earlier request\'s files, carried by address, wit
   assert.equal(p.main.getAttribute('data-view'), 'pick');
 });
 
+const uploadsOf = (p) => p.calls.filter((c) => c.method === 'POST' && c.url.endsWith('/ai-studio/uploads'));
+
+test('page: a pasted picture joins the files on step 1, named so it can be told apart', async () => {
+  const p = bootPage('?step=pick');
+  await settle();
+  assert.match(p.page.innerHTML, /paste a picture/);
+  const ev = pasteEvent([new FakeFile([{ size: 3 }], 'image.png', { type: 'image/png' })]);
+  await p.fireWindow('paste', ev);
+  await settle();
+  assert.equal(ev.taken, true);
+  const sent = uploadsOf(p);
+  assert.equal(sent.length, 1);
+  assert.match(sent[0].body.name, /^pasted-\d+-1\.png$/, 'the browser\'s generic image.png is renamed');
+  assert.equal(sent[0].body.content_type, 'image/png');
+  assert.match(p.page.innerHTML, /1 file ready/);
+  // A pasted file that already has a real name keeps it.
+  await p.fireWindow('paste', pasteEvent([new FakeFile([{ size: 3 }], 'tower.jpg', { type: 'image/jpeg' })]));
+  await settle();
+  assert.equal(uploadsOf(p)[1].body.name, 'tower.jpg');
+});
+
+test('page: pasting anywhere but step 1, or pasting words, is left to the browser', async () => {
+  const p = bootPage('?step=describe&from=1001');
+  await settle();
+  const pic = pasteEvent([new FakeFile([{ size: 3 }], 'image.png', { type: 'image/png' })]);
+  await p.fireWindow('paste', pic);
+  assert.equal(pic.taken, false, 'words pasted into the request box still paste');
+  const q = bootPage('?step=pick');
+  await settle();
+  const words = { taken: false, preventDefault() { words.taken = true; }, clipboardData: { items: [{ kind: 'string', getAsFile: () => null }] } };
+  await q.fireWindow('paste', words);
+  assert.equal(words.taken, false);
+  assert.equal(uploadsOf(p).length + uploadsOf(q).length, 0);
+});
+
+test('page: on a phone, "take a photo" opens the phone\'s own camera', async () => {
+  const p = bootPage('?step=pick', { device: makeDevice({ touch: true }) });
+  await settle();
+  await p.page.querySelector('#ais-camera').fire('click');
+  assert.equal(p.els['ais-camera-file'].clicks, 1);
+  assert.equal(p.page.querySelector('#ais-cam').hidden, false, 'no webcam panel on a phone');
+});
+
+test('page: on a computer, the webcam shows on the page, a photo is taken and sent, and the camera turns off', async () => {
+  const p = bootPage('?step=pick');
+  await settle();
+  await p.page.querySelector('#ais-camera').fire('click');
+  await settle();
+  assert.equal(p.els['ais-camera-file'].clicks, 0);
+  const view = p.page.querySelector('#ais-cam-view');
+  assert.ok(view.srcObject, 'the webcam feeds the page');
+  view.videoWidth = 640;
+  view.videoHeight = 480;
+  await p.page.querySelector('#ais-snap').fire('click');
+  await settle();
+  assert.equal(p.device.tracks[0].stopped, true, 'taking the photo turns the camera off');
+  const sent = uploadsOf(p);
+  assert.equal(sent.length, 1);
+  assert.match(sent[0].body.name, /^photo-\d+\.jpg$/);
+  assert.equal(sent[0].body.content_type, 'image/jpeg');
+});
+
+test('page: leaving step 1 with the webcam open turns the camera off', async () => {
+  const p = bootPage('?step=pick&from=1001');
+  await settle();
+  await p.page.querySelector('#ais-camera').fire('click');
+  await settle();
+  assert.equal(p.device.tracks[0].stopped, false);
+  await p.page.querySelector('#ais-next').fire('click');
+  await settle();
+  assert.equal(p.loc.search, '?step=describe');
+  assert.equal(p.device.tracks[0].stopped, true, 'Next must not leave the camera light on');
+});
+
+test('page: a refused or missing webcam falls back to the camera picker', async () => {
+  for (const webcam of ['refused', 'none']) {
+    const p = bootPage('?step=pick', { device: makeDevice({ webcam }) });
+    await settle();
+    await p.page.querySelector('#ais-camera').fire('click');
+    await settle();
+    assert.equal(p.els['ais-camera-file'].clicks, 1, webcam);
+  }
+});
+
 test('page: step 3 sends the request on the card pressed, with copies of the carried files', async () => {
   const p = bootPage('?step=make&from=1001');
   await settle();

package/tests/host_topology_skips.mjs

@@ -49,6 +49,7 @@ const ALLOWED = {
   run_node_reroute: '.claude/hooks/run-node.sh (package-excluded)',
   run_routine_two_root: '.claude/hooks/_core-resolve.js (package-excluded)',
   'session-cards': '.claude/hooks/session-cards.js (package-excluded)',
+  self_healing_start: '.claude/hooks/session-start.js (package-excluded)',
   session_start_freshness: '.claude/hooks/session-start.js (package-excluded)',
   shell_hooks: '.claude/hooks/shell-hooks.js (package-excluded)',
   stop_refcheck: '.claude/hooks/stop-refcheck.js (package-excluded; the task-1002234 precedent)',