@bongos/core 1.24.68 → 1.24.70

package/tests/instance_config.mjs

@@ -2,6 +2,7 @@
 // Pure: every input is injected, so no env mutation / disk dependence.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
+import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import ic from '../src/instance-config.js';
@@ -108,7 +109,37 @@ test('resolveEnv: ONLY the old spelling set — resolves, and warns naming old,
   assert.equal(lines.length, 1);
   assert.match(lines[0], /CLOUDBONGOS_C3A_RENDER_PROBE/, 'names the old spelling');
   assert.match(lines[0], /BONGOS_C3A_RENDER_PROBE/, 'names the new spelling');
-  assert.match(lines[0], /stops being read in core 1\.21/, 'names the release it stops working in');
+  // Task 1005042 - legacy env warning: the line used to promise "stops being read
+  // in core 1.21" long after 1.21 passed with the spelling still read. Whatever it
+  // says about removal must be TRUE against the version actually running: it may
+  // name a future release, never the current one or a past one.
+  assert.deepEqual(stalePromisedReleases(lines[0], runningCore()), [],
+    `the warning names a removal release that is not in the future: ${lines[0]}`);
+  assert.match(lines[0], /still read/i, 'says plainly that the old spelling still works today');
+  assert.match(lines[0], /future core release/i, 'says it will go, without inventing a date nobody has committed to');
+});
+
+// Every "core X.Y" a line names that is NOT after the running release — i.e. a
+// removal promise that is already broken, since the running core still reads the
+// spelling. Empty = the line is honest about dates.
+function runningCore() {
+  const coreSrc = fs.readFileSync(new URL('../src/module-api.js', import.meta.url), 'utf8');
+  return coreSrc.match(/^const CORE_VERSION = '(\d+)\.(\d+)\.\d+'/m).slice(1).map(Number);
+}
+function stalePromisedReleases(line, [runMaj, runMin]) {
+  return [...line.matchAll(/core (\d+)\.(\d+)/g)]
+    .map((m) => [Number(m[1]), Number(m[2])])
+    .filter(([maj, min]) => !(maj > runMaj || (maj === runMaj && min > runMin)))
+    .map(([maj, min]) => `${maj}.${min}`);
+}
+
+test('stalePromisedReleases: catches the passed-release warning task 1005042 fixed, accepts a future one', () => {
+  const old = '[bongos] deprecated env CLOUDBONGOS_X — rename it to BONGOS_X. The legacy spelling stops being read in core 1.21.';
+  assert.deepEqual(stalePromisedReleases(old, [1, 24]), ['1.21'], 'the original line names a release already passed');
+  assert.deepEqual(stalePromisedReleases('stops being read in core 1.24.', [1, 24]), ['1.24'], 'the running release is not a future one');
+  assert.deepEqual(stalePromisedReleases('stops being read in core 1.25.', [1, 24]), [], 'a genuinely future release is honest');
+  assert.deepEqual(stalePromisedReleases('stops being read in core 2.0.', [1, 24]), [], 'a future major is honest');
+  assert.ok(runningCore()[0] >= 1, 'CORE_VERSION is readable from src/module-api.js');
 });
 
 test('resolveEnv: ONLY the new spelling set — resolves, and is SILENT', () => {

package/tests/paste_token_windows.mjs

@@ -0,0 +1,165 @@
+// tests/paste_token_windows.mjs — a first-time CLI sign-in on Windows took four failed
+// attempts (task 1005033). Three of the four failure points are in code:
+//
+//   2. The hall's one-liner starts with `npx`. In Windows PowerShell `npx` resolves to
+//      npx.ps1, which the DEFAULT execution policy refuses to run ("running scripts is
+//      disabled on this system"). `npx.cmd` is the same program without the script
+//      host, and works in PowerShell and cmd alike. The hall now hands a Windows
+//      browser the npx.cmd form.
+//   3. The one-liner only resolves `bongos` inside the project folder (npx finds the
+//      project's own bin); from anywhere else npm says "could not determine executable
+//      to run". Nothing said so — the hall now says it in the instruction itself.
+//   4. The token sat on the command line (shell history). paste-token now also reads it
+//      from a hidden prompt, or from stdin when piped, when no token argument is given.
+//
+//   1. The App's Device Flow switch was off. GitHub has no API to tick it, so the fix is
+//      telling the OWNER: the first refusal files one idempotent blocker
+//      (src/bongos/device-flow-blocker.js). Task 1005118 later replaces the paste route
+//      with a browser approval.
+//
+// Run:  node --test tests/paste_token_windows.mjs
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { PassThrough } from 'node:stream';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { readTokenFromInput } = require(path.join(ROOT, 'scripts', 'bongos', 'paste-token.js'));
+
+const sink = () => { const s = new PassThrough(); s.text = ''; s.on('data', (c) => { s.text += c; }); return s; };
+
+// ── 4. the token can arrive without touching the command line ────────────────
+
+test('a piped token is read from stdin and trimmed', async () => {
+  const input = new PassThrough();
+  const p = readTokenFromInput({ input, output: sink() });
+  input.end('  abcdef0123456789abcdef0123456789  \r\n');
+  assert.equal(await p, 'abcdef0123456789abcdef0123456789');
+});
+
+test('an interactive prompt reads one line and never echoes the token', async () => {
+  const input = new PassThrough();
+  input.isTTY = true;
+  const modes = [];
+  input.setRawMode = (on) => { modes.push(on); input.isRaw = on; };
+  const output = sink();
+  const p = readTokenFromInput({ input, output });
+  input.write('abcdef01234567');
+  input.write('X\u007f'); // a typo, then backspace
+  input.write('89abcdef\r');
+  const token = await p;
+  assert.equal(token, 'abcdef0123456789abcdef');
+  assert.ok(!output.text.includes('abcdef'), `the token must not be echoed, got: ${JSON.stringify(output.text)}`);
+  assert.match(output.text, /token/i, 'it asks for the token');
+  assert.deepEqual(modes, [true, false], 'raw mode is switched on for the read and back off after');
+});
+
+test('Ctrl+C at the prompt cancels instead of saving a half-typed token', async () => {
+  const input = new PassThrough();
+  input.isTTY = true;
+  input.setRawMode = () => {};
+  const p = readTokenFromInput({ input, output: sink() });
+  input.write('abc\u0003');
+  await assert.rejects(p, /cancel/i);
+});
+
+test('paste-token falls back to the prompt when no token argument is given', () => {
+  const src = fs.readFileSync(path.join(ROOT, 'scripts', 'bongos', 'paste-token.js'), 'utf8');
+  const main = src.slice(src.indexOf('async function main()'));
+  assert.match(main, /readTokenFromInput\(/, 'main reads the token from input when argv has none');
+});
+
+// ── 2 + 3. the hall's one-liner works in a default Windows PowerShell ─────────
+
+const routeSrc = fs.readFileSync(path.join(ROOT, 'src', 'bongos', 'routes', 'auth.js'), 'utf8');
+const issueBlock = (() => {
+  const start = routeSrc.indexOf("'/auth/cli-token/issue'");
+  const next = routeSrc.indexOf('\n  router.', start);
+  return routeSrc.slice(start, next === -1 ? routeSrc.length : next);
+})();
+
+test('the issue route also composes a Windows one-liner that avoids npx.ps1', () => {
+  const m = issueBlock.match(/paste_command_windows:\s*issuer\s*\?\s*`([^`]+)`\s*:\s*`([^`]+)`/);
+  assert.ok(m, 'paste_command_windows should be a readable template literal pair');
+  for (const cmd of [m[1], m[2]]) {
+    assert.match(cmd, /^npx\.cmd bongos paste-token \$\{token\}/, `npx.cmd, not npx — got: ${cmd}`);
+  }
+  assert.match(m[1], /--api-base \$\{issuer\}/, 'the Windows form carries the issuer too');
+});
+
+const settingsJs = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'settings.js'), 'utf8');
+const issueFn = (settingsJs.match(/async function issueCliToken\([\s\S]*?\n  \}\n/) || [''])[0];
+
+test('the hall shows the Windows one-liner to a Windows browser', () => {
+  assert.ok(issueFn, 'issueCliToken is a whole function');
+  assert.match(issueFn, /paste_command_windows/, 'it reads the Windows form');
+  assert.match(settingsJs, /function isWindowsBrowser\(/, 'it decides by the browser platform');
+});
+
+test('the hall says the command only runs from inside the project folder', () => {
+  assert.match(issueFn, /cd/, 'the instruction names cd');
+  assert.match(issueFn, /only (runs|works) (from )?(there|inside)/i, 'and says why');
+});
+
+// ── grade round 2 (task 1005033) ─────────────────────────────────────────────
+
+test('a pipe that never closes still settles on the first line', async () => {
+  const input = new PassThrough();
+  const p = readTokenFromInput({ input, output: sink() });
+  input.write('abcdef0123456789abcdef\nsomething else that never ends');
+  assert.equal(await p, 'abcdef0123456789abcdef');
+});
+
+test('Ctrl+D on an empty prompt cancels instead of saving nothing', async () => {
+  const input = new PassThrough();
+  input.isTTY = true;
+  input.setRawMode = () => {};
+  const p = readTokenFromInput({ input, output: sink() });
+  input.write('\u0004');
+  await assert.rejects(p, /cancel/i);
+});
+
+test('the hall offers the token-free command with the token on its own button', () => {
+  assert.match(issueFn, /bongos paste-token\$\{body\.api_base/, 'a command with no token in it');
+  assert.match(issueFn, /Copy token/, 'the token is copied separately');
+  assert.match(issueFn, /Keep the token out of your shell history/, 'and it says why');
+});
+
+// ── 1. the owner hears about Device Flow being off ────────────────────────────
+
+const { raiseDeviceFlowOffBlocker, SOURCE, SOURCE_REF } = require(path.join(ROOT, 'src', 'bongos', 'device-flow-blocker.js'));
+
+test('a device_flow_disabled refusal files ONE owner blocker through ideas.fileBlocker', async () => {
+  const filed = [];
+  const resolveOptional = (port) => (port === 'ideas.fileBlocker' ? async (b) => { filed.push(b); return { id: 1 }; } : null);
+  const out = await raiseDeviceFlowOffBlocker({ reason: 'device_flow_disabled', origin: 'https://x.example', resolveOptional });
+  assert.deepEqual(out, { id: 1 });
+  assert.equal(filed.length, 1);
+  assert.equal(filed[0].source, SOURCE);
+  assert.equal(filed[0].sourceRef, SOURCE_REF, 'a fixed source_ref makes the writer idempotent');
+  assert.match(filed[0].title, /Enable Device Flow/);
+  assert.match(filed[0].bodyMd, /https:\/\/x\.example\/builders\/settings/);
+});
+
+test('any other start failure files nothing', async () => {
+  let called = false;
+  const resolveOptional = () => async () => { called = true; };
+  assert.equal(await raiseDeviceFlowOffBlocker({ reason: 'bad_client_id', resolveOptional }), null);
+  assert.equal(called, false);
+});
+
+test('no ideas module, or a failing write, never breaks the sign-in reply', async () => {
+  assert.equal(await raiseDeviceFlowOffBlocker({ reason: 'device_flow_disabled', resolveOptional: () => null }), null);
+  const boom = () => async () => { throw new Error('db down'); };
+  assert.equal(await raiseDeviceFlowOffBlocker({ reason: 'device_flow_disabled', resolveOptional: boom }), null);
+});
+
+test('the device/start route raises it on the refusal', () => {
+  const start = routeSrc.slice(routeSrc.indexOf("'/auth/device/start'"), routeSrc.indexOf("'/auth/device/start'") + 2500);
+  assert.match(start, /raiseDeviceFlowOffBlocker\(\{ reason/);
+});

package/tests/shell_hooks.mjs

@@ -165,6 +165,13 @@ t('a missing hook is visible (exit 1, one line) and never blocks; the others sti
   assert.match(r.stderr, /no-such-hook\.js/);
   const b = together(['no-such-hook.js', 'git-guard.js'], shell('Bash', 'git stash push -m x'));
   assert.equal(b.status, 2, 'a real block still blocks beside a missing hook');
+  assert.match(b.stderr, /no-such-hook\.js/, 'the missing-hook line survives the block (task 1004949)');
+  assert.match(b.stderr, /git-guard: blocked/, 'and the block reason is still there');
+});
+
+t('merge: a code-1 diagnostic is joined into the block stderr, in roster order (task 1004949)', () => {
+  const m = dispatcher.merge([{ code: 1, stderr: 'missing\n' }, { code: 2, stderr: 'blocked\n' }, { code: 0, stdout: '' }]);
+  assert.deepEqual(m, { code: 2, stdout: '', stderr: 'missing\nblocked\n' });
 });
 
 t('only plain sibling names load — no paths, not itself', () => {

package/tests/status_mirror_sync.mjs

@@ -8,7 +8,7 @@
 // exited 2. The `require.main === module` guard is what makes the transform testable.
 import assert from 'node:assert/strict';
 import { test } from 'node:test';
-import { readFileSync } from 'node:fs';
+import { readFileSync, readdirSync } from 'node:fs';
 import mirror from '../scripts/status-mirror-sync.js';
 
 const { buildMirrorIndex, injectOnce, brandTokens } = mirror;
@@ -120,3 +120,24 @@ test('the publisher source hardcodes no host identity (the ratchet this slice in
   const hit = stripped.match(/example|example-owner|example world/i);
   assert.equal(hit, null, `scripts/status-mirror-sync.js hardcodes the host identity "${hit && hit[0]}" — resolve it from branding() instead`);
 });
+
+test('no doc claims a sync workflow runs the mirror publish while none exists (task 1005131)', () => {
+  // The publish is run by hand: nothing in .github/workflows/ calls this script. A doc
+  // saying "synced by sync-status-mirror.yml" (or calling the sync CI-driven) sends the
+  // reader waiting for an automatic update that never comes, so the live page goes stale.
+  const wfDir = new URL('../.github/workflows/', import.meta.url);
+  const workflows = readdirSync(wfDir).map((f) => readFileSync(new URL(f, wfDir), 'utf8'));
+  const automated = workflows.some((w) => /status-mirror-sync\.js/.test(w));
+  if (automated) return; // a real workflow now runs it — the claim would be true
+  const docs = [
+    'scripts/status-mirror-sync.js',
+    'docs/adr/0029-status-page-outage-resilience.md',
+    'docs/architecture.md',
+    'docs/recipes/ops-gotchas.md',
+  ];
+  for (const rel of docs) {
+    const text = readFileSync(new URL(`../${rel}`, import.meta.url), 'utf8');
+    const hit = text.match(/synced by[^\n]{0,40}sync-status-mirror\.yml|(?<!NOT )CI-driven/i);
+    assert.equal(hit, null, `${rel} claims an automatic mirror sync ("${hit && hit[0]}"), but no workflow runs scripts/status-mirror-sync.js`);
+  }
+});

package/tests/vendored_work_root.mjs

@@ -0,0 +1,72 @@
+// tests/vendored_work_root.mjs
+//
+// task 1005100 - feedback instance vendors: in a project that installs the core from npm
+// (toast, core 1.21.115), docs-entropy.js and ship-check.js took their root from
+// path.resolve(__dirname, '..', '..') — the PACKAGE dir under node_modules/@bongos/core.
+// docs-entropy then ran `git ls-files '*.md'` there, enumerated 0 files and died with a
+// "scan defect"; ship-check ran every generator from the package dir, so gen-api-docs read
+// STALE while `npx bongos exec scripts/bongos/gen-api-docs.js --check` from the project
+// said up to date. resolveWorkRoot() is the root these tools work on: the core checkout when
+// the core is a checkout, the project (pointer, else the git top of cwd, else cwd) when it
+// is installed. ship-check spawns the script from the core and runs it in that root.
+//
+// Run:  node tests/vendored_work_root.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const { resolveWorkRoot, CORE_ROOT } = require('../scripts/bongos/fitness-lib.js');
+const { runStep } = require('../scripts/bongos/ship-check.js');
+
+const real = (p) => fs.realpathSync.native(p);
+const tmp = (name) => fs.mkdtempSync(path.join(os.tmpdir(), `vwr-${name}-`));
+
+test('a core checkout works on the core root, whatever the cwd', () => {
+  assert.equal(resolveWorkRoot({ installed: false, cwd: os.tmpdir() }), CORE_ROOT);
+});
+
+test('an installed core with a pointer works on the pointed-at project', () => {
+  assert.equal(resolveWorkRoot({ installed: true, cwd: os.tmpdir(), explicit: () => '/proj' }), '/proj');
+});
+
+test('an installed core with no pointer works on the git top of cwd, not the package dir', () => {
+  const repo = tmp('repo');
+  execFileSync('git', ['init', '-q'], { cwd: repo });
+  const sub = path.join(repo, 'docs');
+  fs.mkdirSync(sub);
+  const got = resolveWorkRoot({ installed: true, cwd: sub, explicit: () => null });
+  assert.equal(real(got), real(repo));
+});
+
+test('an installed core outside any repo falls back to cwd', () => {
+  const dir = tmp('norepo');
+  const got = resolveWorkRoot({ installed: true, cwd: dir, explicit: () => null, gitTop: () => null });
+  assert.equal(got, dir);
+});
+
+test('ship-check runs a step from the core but inside the work root', () => {
+  const core = tmp('core');
+  const inst = tmp('inst');
+  fs.mkdirSync(path.join(core, 'scripts', 'bongos'), { recursive: true });
+  fs.writeFileSync(path.join(core, 'scripts', 'bongos', 'where.js'), 'console.log("cwd=" + process.cwd());\n');
+  const r = runStep({ key: 'w', label: 'w', argv: ['scripts/bongos/where.js'], fix: 'f' }, { coreRoot: core, cwd: inst });
+  assert.equal(r.status, 'ok', r.tail);
+  assert.match(r.tail, /cwd=/);
+  assert.equal(real(r.tail.trim().replace(/^cwd=/, '')), real(inst));
+});
+
+test('docs-entropy and ship-check no longer hardwire their root to the package dir', () => {
+  for (const f of ['scripts/bongos/docs-entropy.js', 'scripts/bongos/ship-check.js']) {
+    const src = fs.readFileSync(path.join(ROOT, f), 'utf8');
+    assert.doesNotMatch(src, /const REPO_ROOT = path\.resolve\(__dirname, '\.\.', '\.\.'\)/, f);
+    assert.match(src, /resolveWorkRoot\(\)/, f);
+  }
+});