@bongos/core 1.24.76 → 1.24.78

package/tests/hall_runner_button.mjs

@@ -0,0 +1,467 @@
+// tests/hall_runner_button.mjs — a device's Run button on Settings > Your
+// Autobongos runner (task 1005094).
+//
+// Owner direction, 2026-11-09: running Autobongos on a device is ONE button, and
+// any cooldown is built into the button itself. Two files carry that, and both
+// are RUN here, never read:
+//
+//   · runner-button.js decides what the button's face says. It is pure, so it is
+//     required and asked directly, one case per face.
+//   · settings-autobongos.js draws the panel. It is loaded in a vm against
+//     stand-in elements and the hall-preview fixtures, and its own click handler
+//     is pressed: the requests it sends, in the order it sends them, are the
+//     assertions.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+const read = (f) => fs.readFileSync(path.join(HALL, f), 'utf8');
+const fixture = (name) => JSON.parse(fs.readFileSync(path.join(ROOT, 'scripts', 'hall-preview', 'fixtures', `${name}.json`), 'utf8'));
+const RB = require(path.join(HALL, 'runner-button.js'));
+
+const NOW = Date.parse('2026-11-09T12:00:00.000Z');
+const iso = (offsetMs) => new Date(NOW + offsetMs).toISOString();
+const MIN = 60 * 1000;
+// A fence that lets the runner work: the project is on and a goal is picked.
+const OPEN = { enabled: true, scope: { goals: [1000118] }, project: { enabled: true, goals: [{ goal_id: 1000118 }] } };
+const device = (over = {}, healthOver = {}) => ({
+  host: 'ada-laptop', run_requested: true, run_changed_at: iso(-60 * MIN), last_seen_at: iso(-30 * 1000),
+  health: { state: 'alive', host: 'ada-laptop', workingTaskId: null, holdUntil: null, age: '30s', ...healthOver },
+  ...over,
+});
+const face = (runner, fence = OPEN) => RB.buttonState({ runner, fence, nowMs: NOW });
+
+// ── what the button says ─────────────────────────────────────────────────────
+
+test('a stopped device shows Run, and a press starts it', () => {
+  const b = face(device({ run_requested: false }, { state: 'stopped' }));
+  assert.deepEqual([b.status, b.label, b.act, b.busy], ['', 'Run', 'run', false]);
+  assert.equal(b.sub, 'Stopped on this device.');
+});
+
+test('a press of Run reads Starting until the device has checked in after it, and cannot be pressed again', () => {
+  const pressed = device({ run_changed_at: iso(-20 * 1000), last_seen_at: iso(-40 * 1000) }, { state: 'stopped' });
+  const b = face(pressed);
+  assert.deepEqual([b.status, b.act, b.busy], ['Starting…', null, true], 'the cooldown is the button: it has no action while it starts');
+  assert.match(b.sub, /under a minute/);
+  // The device picked it up: it checked in after the press.
+  assert.equal(face(device({ run_changed_at: iso(-20 * 1000), last_seen_at: iso(-5 * 1000) })).status, 'Running');
+});
+
+test('Starting does not last forever: a device that never picks the press up reads as off', () => {
+  const stale = device({ run_changed_at: iso(-RB.STARTING_MS - 1000), last_seen_at: iso(-3 * 3600 * 1000) }, { state: 'dead', age: '3h' });
+  const b = face(stale);
+  assert.equal(b.status, 'Device is off or asleep');
+  assert.equal(b.act, 'stop', 'and the press that is left turns the request off again');
+  assert.match(b.sub, /No check-in for 3h\. Turn it on and sign in/);
+});
+
+test('the stay-on note goes with a device that is switched on, and with one finishing its last task', () => {
+  assert.equal(face(device()).stayOn, true);
+  assert.equal(face(device({}, { state: 'dead', age: '4h' })).stayOn, true, 'most of all when it has gone quiet');
+  assert.equal(face(device({ run_requested: false }, { state: 'stopped' })).stayOn, false, 'a stopped device has nothing to stay awake for');
+  assert.equal(face(device({ run_requested: false }, { workingTaskId: '7' })).stayOn, true, 'still building: it must stay up to finish');
+});
+
+test('a running device shows what it is doing, and a press stops it', () => {
+  const working = face(device({}, { workingTaskId: '1004711' }));
+  assert.deepEqual([working.status, working.label, working.act, working.tone], ['Running', 'Stop', 'stop', 'ok']);
+  assert.equal(working.sub, 'Working on task 1004711.');
+  assert.equal(face(device()).sub, 'On — waiting for work.');
+});
+
+test('THE COOLDOWN IS ON THE BUTTON: a resting device shows when it resumes and how long is left', () => {
+  const b = face(device({}, { holdUntil: iso(144 * MIN) }));
+  assert.match(b.status, /^Resting until /);
+  assert.equal(b.status, `Resting until ${RB.clock(NOW + 144 * MIN, NOW)}`);
+  assert.equal(b.countdown, '2 h 24 min');
+  assert.equal(b.act, 'stop', 'it can still be stopped while it rests');
+  assert.match(b.sub, /starts again by itself/);
+  // A rest that is already over is not shown.
+  assert.equal(face(device({}, { holdUntil: iso(-MIN) })).status, 'Running');
+  // The countdown's own words.
+  assert.equal(RB.countdown(30 * 1000), '1 min');
+  assert.equal(RB.countdown(59 * MIN), '59 min');
+  assert.equal(RB.countdown(120 * MIN), '2 h');
+  assert.equal(RB.countdown(0), '');
+});
+
+test('the resume time is a clock time today, a weekday within the week, a date beyond', () => {
+  const at = (ms) => RB.clock(NOW + ms, NOW);
+  const time = new Date(NOW + 30 * MIN).toLocaleTimeString([], { hour: 'numeric', minute: '2-digit' });
+  // Thirty minutes ahead is the same day unless this machine's midnight falls between.
+  if (new Date(NOW).toDateString() === new Date(NOW + 30 * MIN).toDateString()) assert.equal(at(30 * MIN), time);
+  assert.match(at(3 * 24 * 3600 * 1000), /\D+ .*\d/, 'a weekday and a time');
+  assert.match(at(40 * 24 * 3600 * 1000), /\d{4}/, 'a date with its year');
+  // A rest longer than any usage window is not counted down in hours.
+  assert.equal(face(device({}, { holdUntil: iso(40 * 24 * 3600 * 1000) })).countdown, '');
+});
+
+test('Stop on a device that is mid-task reads Stopping, with a way to change your mind', () => {
+  const b = face(device({ run_requested: false }, { workingTaskId: '1004711' }));
+  assert.deepEqual([b.status, b.act, b.busy], ['Stopping…', null, true]);
+  assert.equal(b.sub, 'Finishing task 1004711 first, then it stops.');
+  assert.deepEqual(b.alt, { act: 'run', label: 'Keep it running' });
+});
+
+test('a device that has gone quiet says so on the button, switched on or not', () => {
+  const on = face(device({}, { state: 'dead', age: '4h' }));
+  assert.deepEqual([on.status, on.tone], ['Device is off or asleep', 'warn']);
+  const off = face(device({ run_requested: false }, { state: 'dead', age: '4h' }));
+  assert.deepEqual([off.label, off.act], ['Run', 'run']);
+  assert.match(off.sub, /off or asleep.*starts when it is back on/);
+  // Quiet longer than a loop but with a task in hand is a worker building, not a device that is off.
+  assert.equal(face(device({}, { state: 'late', workingTaskId: '1004711' })).status, 'Running');
+  assert.equal(face(device({}, { state: 'late' })).status, 'Device is off or asleep');
+});
+
+test('a device that is on but held says why, in the order someone asks', () => {
+  const sub = (fence, healthOver) => face(device({}, healthOver), fence).sub;
+  assert.equal(face(device(), { enabled: false, stop_code: 'kill_switch', scope: {}, project: { enabled: false, paused_reason: 'night off' } }).status, 'Ready');
+  assert.equal(sub({ enabled: false, stop_code: 'kill_switch', scope: {}, project: { enabled: false, paused_reason: 'night off' } }), 'It is on, but the project’s runner switch is off (night off).');
+  assert.equal(sub({ enabled: false, stop_code: 'builder_paused', scope: { owner_paused_reason: 'too many PRs' }, project: { enabled: true } }), 'It is on, but the owner paused your runner (too many PRs).');
+  assert.equal(sub({ enabled: false, stop_code: 'not_permitted', scope: {}, project: { enabled: true } }), 'It is on, but your rank cannot run a runner on this project.');
+  assert.equal(sub({ enabled: true, scope: { goals: [] }, project: { enabled: true, goals: [{ goal_id: 1 }] } }), 'It is on, but no goals are chosen for it yet — pick at least one below.');
+  assert.equal(sub({ enabled: true, scope: { goals: [] }, project: { enabled: true, goals: [] } }), 'It is on, but the project has not allowed any goals for runners yet.');
+  assert.match(sub(OPEN, { state: 'idle_config', why: 'its usage gauge has no fresh reading', remedy: 'Open one Claude session there.' }), /idle because its usage gauge has no fresh reading\. Open one Claude session there\./);
+  // A task in hand outranks a setting: the device says what it is doing this minute.
+  assert.equal(face(device({}, { workingTaskId: '7' }), { enabled: false, stop_code: 'kill_switch', scope: {}, project: { enabled: false } }).status, 'Running');
+  // No fence read yet is not a hold.
+  assert.equal(face(device(), null).status, 'Running');
+});
+
+test('a runner restarting on new code says so', () => {
+  const b = face(device({}, { state: 'restarting' }));
+  assert.deepEqual([b.status, b.busy], ['Updating…', true]);
+});
+
+// ── the setup command ────────────────────────────────────────────────────────
+
+const CODE = `abr_${'a1'.repeat(32)}`;
+
+test('the setup command is one line per platform, carrying the code, the project and the repository', () => {
+  const c = RB.setupCommands({ apiBase: 'https://hub.example/', code: CODE, repoUrl: 'https://github.com/owner/name' });
+  assert.equal(c.windows, `& ([scriptblock]::Create((irm 'https://hub.example/api/bongos/autonomy/runner-setup.ps1'))) -Code '${CODE}' -ApiBase 'https://hub.example' -Repo 'https://github.com/owner/name'`);
+  assert.equal(c.mac, `curl -fsSL 'https://hub.example/api/bongos/autonomy/runner-setup.sh' | bash -s -- --code '${CODE}' --api-base 'https://hub.example' --repo 'https://github.com/owner/name'`);
+  assert.equal(c.windows.includes('\n') || c.mac.includes('\n'), false, 'one line each');
+});
+
+test('the setup command downloads and runs code, so it is only ever built for an https project', () => {
+  const good = { code: CODE, repoUrl: 'https://github.com/owner/name' };
+  for (const base of ['http://hub.example', 'http://hub.example:8080', 'http://10.0.0.5:3000', 'http://evil.localhost.example', 'ftp://hub.example']) {
+    assert.equal(RB.setupCommands({ ...good, apiBase: base }), null, `${base} must not get a command: anyone on the network could swap the script`);
+  }
+  // A project on this very machine never leaves the device.
+  for (const base of ['http://localhost:3000', 'http://127.0.0.1:4600', 'http://builders.localhost:4642']) {
+    assert.ok(RB.setupCommands({ ...good, apiBase: base }), base);
+  }
+  assert.ok(RB.setupCommands({ ...good, apiBase: 'https://hub.example:8443' }));
+});
+
+test('no command is built with a hole in it, or from text that could end the quoting', () => {
+  const good = { apiBase: 'https://hub.example', code: CODE, repoUrl: 'https://github.com/owner/name' };
+  for (const bad of [
+    { repoUrl: null }, { repoUrl: 'git@github.com:owner/name.git' }, { repoUrl: "https://github.com/owner/name'; rm -rf ~; '" },
+    { code: '' }, { code: "abr_x'; whoami; '" }, { code: 'not-a-code' },
+    { apiBase: '' }, { apiBase: "https://hub.example'; calc; '" }, { apiBase: 'javascript:alert(1)' },
+  ]) {
+    assert.equal(RB.setupCommands({ ...good, ...bad }), null, JSON.stringify(bad));
+  }
+});
+
+test('the platform shown first follows the browser', () => {
+  assert.equal(RB.guessPlatform('Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)'), 'mac');
+  assert.equal(RB.guessPlatform('Mozilla/5.0 (Windows NT 10.0; Win64; x64)'), 'windows');
+  assert.equal(RB.guessPlatform(''), 'windows');
+});
+
+// ── the panel, run for real ──────────────────────────────────────────────────
+
+const FENCE = fixture('autonomy__fence');
+const RUNNERS = fixture('autonomy__runners');
+
+// settings-autobongos.js in a vm. `respond(method, url, body)` answers each
+// request ({ status, data }); anything it returns nothing for is a 404.
+async function loadPanel({ respond, confirm = async () => true, userAgent = 'Mozilla/5.0 (Windows NT 10.0)', hidden = false } = {}) {
+  const els = {};
+  const el = (id) => {
+    let html = '';
+    const node = {
+      id, hidden: true, textContent: '', disabled: false, writes: 0, handlers: {},
+      get innerHTML() { return html; },
+      set innerHTML(v) { html = String(v); node.writes += 1; },
+      addEventListener(type, fn) { node.handlers[type] = fn; },
+      contains: () => true,
+    };
+    return node;
+  };
+  for (const id of ['autobongos-scroll', 'autobongos-body', 'ab-notices', 'ab-devices', 'ab-add', 'ab-goals', 'autobongos-status', 'autobongos-save']) els[`#${id}`] = el(id);
+  const requests = [];
+  const toasts = [];
+  const timers = [];
+  const dialogs = [];
+  const copied = [];
+  const kit = await import(`file://${path.join(HALL, 'hall-kit.js').replace(/\\/g, '/')}`).then((m) => m.default);
+  const window = {
+    OTB: { ...realOTB(), $: (sel) => els[sel] || null, toast: (m) => toasts.push(m) },
+    OTBKit: kit,
+    OTBDialog: { confirm: async (opts) => { dialogs.push(opts); return confirm(opts); } },
+    BongosClient: {
+      createClient: () => ({
+        request: async (method, url, opts = {}) => {
+          // Through JSON: the page runs in its own realm, and an object born
+          // there is never deepEqual to one written here.
+          const body = opts.body === undefined ? undefined : JSON.parse(JSON.stringify(opts.body));
+          requests.push([method, url.replace('/api/bongos', ''), ...(body === undefined ? [] : [body])]);
+          const r = await respond(method, url.replace('/api/bongos', ''), body);
+          if (!r) return { ok: false, status: 404, data: null };
+          const status = r.status || 200;
+          // A copy, every time: the page keeps what it is handed and writes a press
+          // into it, and a fixture shared by reference would carry one test's press
+          // into the next.
+          return { ok: status >= 200 && status < 300, status, data: r.data === undefined ? null : JSON.parse(JSON.stringify(r.data)) };
+        },
+      }),
+    },
+    location: { assign() {}, origin: 'https://hub.example' },
+    navigator: { userAgent, clipboard: { writeText: async (t) => { copied.push(t); } } },
+    setTimeout: (fn, ms) => { timers.push({ fn, ms }); return timers.length; },
+    clearTimeout: () => {},
+  };
+  const sandbox = { window, document: { hidden, activeElement: null, addEventListener() {} }, console: { error() {}, warn() {} }, Date, Promise, Set, Map, Number, String, Array, Object, JSON, Error, encodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(read('runner-button.js'), sandbox, { filename: 'runner-button.js' });
+  vm.runInContext(read('settings-autobongos.js'), sandbox, { filename: 'settings-autobongos.js' });
+  const settle = async () => { for (let i = 0; i < 30; i++) await new Promise((r) => setImmediate(r)); };
+  await settle();
+  const body = els['#autobongos-body'];
+  // Press a button the way the page's one listener sees it.
+  const click = async (attrs) => {
+    const btn = { disabled: false, id: attrs.id || '', dataset: { ...attrs } };
+    await body.handlers.click({ target: { closest: () => btn } });
+    await settle();
+  };
+  const html = (id) => els[`#${id}`].innerHTML;
+  return { els, html, click, requests, toasts, timers, dialogs, copied, settle };
+}
+
+// The harness's own answers, with the runners list a test can change.
+function fixtureResponder({ fence = FENCE, runners = () => RUNNERS.runners, extra = () => null } = {}) {
+  return async (method, url, body) => {
+    const mine = await extra(method, url, body);
+    if (mine) return mine;
+    if (method === 'GET' && url === '/autonomy/fence') return { data: fence };
+    if (method === 'GET' && url === '/autonomy/runners') return { data: { runners: runners() } };
+    if (method === 'GET' && url === '/goals') return { data: { goals: [{ id: 1000118, title: 'Bug squash' }] } };
+    if (method === 'GET' && url === '/public/repo-info') return { data: fixture('public__repo-info') };
+    if (method === 'POST' && url === '/auth/runner-code/issue') return { status: 201, data: { ...fixture('auth__runner-code__issue.post'), api_base: 'https://hub.example' } };
+    return null;
+  };
+}
+
+const count = (haystack, needle) => haystack.split(needle).length - 1;
+
+test('the panel draws one card per device, each with its one button, and the stay-on note once', async () => {
+  const p = await loadPanel({ respond: fixtureResponder() });
+  assert.equal(p.els['#autobongos-scroll'].hidden, false);
+  const devices = p.html('ab-devices');
+  assert.equal(count(devices, 'class="rb-card"'), 4);
+  for (const host of ['ada-laptop', 'studio-mac', 'gmk-always-on', 'winbox']) assert.ok(devices.includes(`data-host="${host}"`), host);
+  assert.equal(count(devices, 'rb-button"'), 4, 'one Run button per device');
+  // studio-mac is stopped: its button is the accent Run, and a press starts it.
+  assert.match(devices, /<button type="button" class="btn rb-button" data-focus="press:studio-mac"\s+data-press="run" data-host="studio-mac">/);
+  // ada-laptop is building: the face says so and the press stops it.
+  assert.match(devices, /data-press="stop" data-host="ada-laptop">[\s\S]*?Running[\s\S]*?Stop/);
+  assert.ok(devices.includes('Working on task 1004711.'));
+  assert.ok(devices.includes('Device is off or asleep'));
+  // The stay-on note is on the card of every device that is switched on (three
+  // of the four here), and not on the one its builder stopped.
+  const cards = devices.split('<li class="rb-card"').slice(1);
+  const noted = cards.filter((c) => c.includes('Keep this device on and plugged in while it runs.')).map((c) => /data-host="([a-z-]+)"/.exec(c)[1]);
+  assert.deepEqual(noted.sort(), ['ada-laptop', 'gmk-always-on', 'winbox']);
+  assert.ok(p.html('ab-add').includes('Add a device'));
+  assert.ok(p.html('ab-notices').includes('runner switch is off'), 'the fixture project has its switch off, and the panel says so first');
+});
+
+test('a press of Run sends that device’s switch, shows Starting, and reads the devices again', async () => {
+  let pressed = false;
+  const afterPress = () => RUNNERS.runners.map((r) => (r.host === 'studio-mac' && pressed
+    ? { ...r, run_requested: true, run_changed_at: new Date().toISOString(), health: { ...r.health, state: 'stopped' } } : r));
+  const p = await loadPanel({ respond: fixtureResponder({
+    runners: afterPress,
+    extra: (method, url, body) => {
+      if (method === 'POST' && url === '/autonomy/runners/studio-mac/run') { pressed = body.run === true; return { data: { host: 'studio-mac', run_requested: true, run_changed_at: new Date().toISOString() } }; }
+      return null;
+    },
+  }) });
+  p.requests.length = 0;
+  await p.click({ press: 'run', host: 'studio-mac' });
+  assert.deepEqual(p.requests[0], ['POST', '/autonomy/runners/studio-mac/run', { run: true }]);
+  assert.ok(p.requests.some(([m, u]) => m === 'GET' && u === '/autonomy/runners'), 'the devices are read again');
+  assert.deepEqual(p.toasts, ['Starting it on that device.']);
+  const card = p.html('ab-devices').split('<li class="rb-card"').find((c) => c.includes('data-host="studio-mac"'));
+  assert.ok(card.includes('Starting…'), 'the button is the cooldown');
+  assert.match(card, /rb-button--busy"[^>]*data-host="studio-mac" disabled>/, 'and cannot be pressed while it starts');
+  // While a card is starting the panel reads again quickly.
+  assert.equal(p.timers.at(-1).ms, 3000);
+});
+
+test('a press of Stop sends run:false, and a refusal is shown as the server’s own sentence', async () => {
+  const sent = [];
+  const p = await loadPanel({ respond: fixtureResponder({ extra: (method, url, body) => {
+    if (method === 'POST' && url === '/autonomy/runners/ada-laptop/run') { sent.push(body); return { data: { host: 'ada-laptop', run_requested: false, run_changed_at: new Date().toISOString() } }; }
+    if (method === 'POST' && url === '/autonomy/runners/winbox/run') return { status: 404, data: { error: { code: 'device_not_found', message: 'You have no device by that name.' } } };
+    return null;
+  } }) });
+  await p.click({ press: 'stop', host: 'ada-laptop' });
+  assert.deepEqual(sent, [{ run: false }]);
+  assert.equal(p.toasts.at(-1), 'Stopping it on that device.');
+  await p.click({ press: 'stop', host: 'winbox' });
+  assert.equal(p.toasts.at(-1), 'You have no device by that name.');
+});
+
+test('a failure with no sentence from the server is said in the page’s one wording, as a whole sentence', async () => {
+  const p = await loadPanel({ respond: fixtureResponder({ extra: (method, url) => {
+    if (method === 'POST' && url.endsWith('/run')) return { status: 502, data: null };
+    if (method === 'POST' && url === '/me/sessions/revoke') return { status: 502, data: null };
+    if (method === 'POST' && url === '/auth/runner-code/issue') return { status: 502, data: null };
+    return null;
+  } }) });
+  await p.click({ press: 'run', host: 'studio-mac' });
+  assert.equal(p.toasts.at(-1), 'Could not start it on that device. Try again.');
+  await p.click({ press: 'stop', host: 'ada-laptop' });
+  assert.equal(p.toasts.at(-1), 'Could not stop it on that device. Try again.');
+  await p.click({ remove: 'studio-mac' });
+  assert.equal(p.toasts.at(-1), 'Could not sign that device out. Try again.');
+  await p.click({ id: 'ab-add-open' });
+  assert.ok(p.html('ab-add').includes('Could not make a setup code. Try again.'));
+  for (const t of p.toasts) assert.match(t, /^[A-Z]/, `"${t}" starts with a capital`);
+});
+
+test('Remove signs the device’s own login out FIRST, then clears its card', async () => {
+  const p = await loadPanel({ respond: fixtureResponder({ extra: (method, url) => {
+    if (method === 'POST' && url === '/me/sessions/revoke') return { data: { ok: true, revoked: 1 } };
+    if (method === 'DELETE' && url === '/autonomy/runners/studio-mac') return { data: { removed: true } };
+    return null;
+  } }) });
+  p.requests.length = 0;
+  await p.click({ remove: 'studio-mac' });
+  assert.equal(p.dialogs.length, 1);
+  assert.equal(p.dialogs[0].danger, true);
+  assert.match(p.dialogs[0].body, /signed out at once/);
+  const writes = p.requests.filter(([m]) => m !== 'GET');
+  assert.deepEqual(writes, [
+    ['POST', '/me/sessions/revoke', { session_id: '8802' }],
+    ['DELETE', '/autonomy/runners/studio-mac'],
+  ], 'a card that is gone while its login still works would be a runner nobody can see');
+  assert.equal(p.toasts.at(-1), 'studio-mac removed.');
+});
+
+test('Remove on a device with no login of its own says what it cannot do, and revokes nothing', async () => {
+  const p = await loadPanel({ respond: fixtureResponder({ extra: (method, url) => (method === 'DELETE' && url === '/autonomy/runners/winbox' ? { data: { removed: true } } : null) }) });
+  p.requests.length = 0;
+  await p.click({ remove: 'winbox' });
+  assert.match(p.dialogs[0].body, /only clears its card/);
+  assert.deepEqual(p.requests.filter(([m]) => m !== 'GET'), [['DELETE', '/autonomy/runners/winbox']]);
+});
+
+test('a cancelled Remove, or a login that would not sign out, leaves the card where it is', async () => {
+  const cancelled = await loadPanel({ respond: fixtureResponder(), confirm: async () => false });
+  cancelled.requests.length = 0;
+  await cancelled.click({ remove: 'studio-mac' });
+  assert.deepEqual(cancelled.requests, []);
+
+  const stuck = await loadPanel({ respond: fixtureResponder({ extra: (method, url) => (method === 'POST' && url === '/me/sessions/revoke' ? { status: 500, data: { error: { code: 'x', message: 'internal error' } } } : null) }) });
+  stuck.requests.length = 0;
+  await stuck.click({ remove: 'studio-mac' });
+  assert.equal(stuck.requests.some(([m]) => m === 'DELETE'), false, 'the card is not cleared over a login that is still live');
+  assert.equal(stuck.toasts.at(-1), 'internal error');
+});
+
+test('Add a device shows one command for the browser’s platform, the other on a press, and copies it', async () => {
+  const p = await loadPanel({ respond: fixtureResponder(), userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)' });
+  await p.click({ id: 'ab-add-open' });
+  const code = fixture('auth__runner-code__issue.post').code;
+  const repo = fixture('public__repo-info').blob_base.split('/blob/')[0];
+  let add = p.html('ab-add');
+  assert.ok(add.includes(`curl -fsSL &#39;https://hub.example/api/bongos/autonomy/runner-setup.sh&#39; | bash -s -- --code &#39;${code}&#39; --api-base &#39;https://hub.example&#39; --repo &#39;${repo}&#39;`) || add.includes(`--code '${code}'`), 'the Mac line, for a Mac browser');
+  assert.ok(add.includes('open Terminal'));
+  assert.ok(add.includes('works once, for 15 minutes'));
+  await p.click({ platform: 'windows' });
+  add = p.html('ab-add');
+  assert.ok(add.includes('runner-setup.ps1'));
+  assert.ok(add.includes('PowerShell (not as administrator)'));
+  await p.click({ id: 'ab-add-copy' });
+  assert.equal(p.copied.length, 1);
+  assert.equal(p.copied[0], RB.setupCommands({ apiBase: 'https://hub.example', code, repoUrl: repo }).windows, 'what is copied is the line shown, unescaped');
+  assert.equal(p.toasts.at(-1), 'Setup command copied.');
+  assert.equal(p.timers.at(-1).ms, 3000, 'and the panel watches closely for the new device');
+});
+
+test('when the new device checks in, the command goes away and its card is there', async () => {
+  let arrived = false;
+  const newcomer = { host: 'new-pc', run_requested: false, run_changed_at: null, last_seen_at: new Date().toISOString(), session_id: '9001', health: { state: 'stopped', host: 'new-pc', workingTaskId: null, holdUntil: null, age: '2s' } };
+  const p = await loadPanel({ respond: fixtureResponder({ runners: () => (arrived ? [newcomer, ...RUNNERS.runners] : RUNNERS.runners) }) });
+  await p.click({ id: 'ab-add-open' });
+  assert.ok(p.html('ab-add').includes('Waiting for the device to check in'));
+  arrived = true;
+  await p.timers.at(-1).fn();   // the next read of the devices
+  await p.settle();
+  assert.ok(p.html('ab-devices').includes('data-host="new-pc"'));
+  assert.equal(p.html('ab-add').includes('setup command'), false, 'the command is gone');
+  assert.equal(p.toasts.at(-1), 'Device connected. Press Run on its card.');
+  assert.match(p.html('ab-devices'), /data-press="run" data-host="new-pc"/, 'a new device starts stopped, so its button is Run');
+});
+
+test('a project with no repository address gets a sentence instead of a command with a hole in it', async () => {
+  const p = await loadPanel({ respond: fixtureResponder({ extra: (method, url) => (url === '/public/repo-info' ? { status: 503, data: null } : null) }) });
+  await p.click({ id: 'ab-add-open' });
+  const add = p.html('ab-add');
+  assert.ok(add.includes('no repository address'));
+  assert.equal(add.includes('runner-setup'), false);
+});
+
+test('a builder whose rank cannot run a runner sees one line: no devices, no Add a device, no picks', async () => {
+  const p = await loadPanel({ respond: fixtureResponder({ fence: { ...FENCE, scope: { ...FENCE.scope, may_run: false } } }) });
+  assert.ok(p.html('ab-devices').includes('Your rank cannot run an Autobongos runner'));
+  assert.equal(p.html('ab-add'), '');
+  assert.equal(p.html('ab-goals'), '');
+  assert.equal(p.els['#autobongos-body'].handlers.click, undefined, 'and nothing on the panel is wired');
+});
+
+test('the goal picks are drawn once: the timer redraws the devices and never the form', async () => {
+  const withGoals = { ...FENCE, enabled: true, stop_code: null, scope: { may_run: true, goals: [1000118] }, project: { enabled: true, goals: [{ goal_id: 1000118, note: 'bug squash' }] } };
+  // Without the device that is restarting: that one is busy, and a busy card is
+  // read again quickly, which is the next test's subject, not this one's.
+  const steady = RUNNERS.runners.filter((r) => r.health.state !== 'restarting');
+  const p = await loadPanel({ respond: fixtureResponder({ fence: withGoals, runners: () => steady }) });
+  assert.ok(p.html('ab-goals').includes('Bug squash'), 'the goal is named, not numbered');
+  const formWrites = p.els['#ab-goals'].writes;
+  const deviceWrites = p.els['#ab-devices'].writes;
+  await p.timers.at(-1).fn();
+  await p.settle();
+  assert.ok(p.els['#ab-devices'].writes > deviceWrites, 'the devices were redrawn');
+  assert.equal(p.els['#ab-goals'].writes, formWrites, 'a form redrawn under someone ticking boxes would untick them');
+  assert.equal(p.timers.at(-1).ms, 15000, 'nothing is starting, so the read is the slow one');
+});
+
+test('a hidden tab reads nothing, and a failed read keeps the cards that were there', async () => {
+  const hiddenTab = await loadPanel({ respond: fixtureResponder(), hidden: true });
+  assert.equal(hiddenTab.timers.length, 0, 'no timer while the tab is hidden');
+
+  let fail = false;
+  const p = await loadPanel({ respond: fixtureResponder({ extra: (method, url) => (fail && url === '/autonomy/runners' ? { status: 503, data: null } : null) }) });
+  fail = true;
+  await p.timers.at(-1).fn();
+  await p.settle();
+  assert.equal(count(p.html('ab-devices'), 'class="rb-card"'), 4, 'one bad read does not empty the page');
+});

package/tests/hall_runner_panel_connect.mjs

@@ -0,0 +1,73 @@
+// tests/hall_runner_panel_connect.mjs — the owner's runner panel sends "Connect
+// a PC" to the Settings flow (task 1005097).
+//
+// The panel on Watch > Autobongos (gate.js) is a checklist while anything the
+// runner needs is missing. Its first line, "Connect a PC", used to say that a
+// runner had to be installed and nothing about how. It now opens Settings > Your
+// Autobongos runner, where Add a device hands out the one setup command.
+//
+// gate.js is RUN here in a vm against stand-in elements: the assertions are on
+// what it draws for an owner with no device, and for one whose device checks in.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import vm from 'node:vm';
+import { fileURLToPath } from 'node:url';
+import { realOTB } from './helpers.mjs';
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const HALL = path.join(ROOT, 'modules', 'hall-ui', 'public');
+
+// The panel as an Archon sees it. `runners` is what GET /autonomy/runners answers.
+async function drawPanel({ runners = [], fence = { enabled: false, goals: [], project: { enabled: false, goals: [] }, scope: { goals: [] } } } = {}) {
+  const els = new Map();
+  const el = (id) => {
+    if (!els.has(id)) {
+      els.set(id, {
+        id, hidden: true, textContent: '', innerHTML: '', open: false,
+        addEventListener() {}, querySelector: () => null, querySelectorAll: () => [], focus() {},
+      });
+    }
+    return els.get(id);
+  };
+  const answers = {
+    '/api/bongos/me': { builder: { rank: 'archon' } },
+    '/api/bongos/autonomy/runners': { runners },
+    '/api/bongos/autonomy/fence': fence,
+    '/api/bongos/autonomy/runners/all': { builders: [] },
+  };
+  const kit = await import(`file://${path.join(HALL, 'hall-kit.js').replace(/\\/g, '/')}`).then((m) => m.default);
+  const window = {
+    OTB: { ...realOTB(), rankLabel: (r) => r, toast() {} },
+    OTBKit: kit,
+    OTBDialog: { prompt: async () => null },
+    BongosClient: { createClient: () => ({ request: async (_m, url) => (url in answers ? { ok: true, status: 200, data: answers[url] } : { ok: false, status: 404, data: null }) }) },
+    location: { assign() {} },
+  };
+  const sandbox = { window, document: { getElementById: el }, console: { error() {} }, Promise, Object, Array, Number, String, JSON, Error, encodeURIComponent };
+  vm.createContext(sandbox);
+  vm.runInContext(fs.readFileSync(path.join(HALL, 'gate.js'), 'utf8'), sandbox, { filename: 'gate.js' });
+  window.OTBWatchTabs.autobongos();   // the tab opens
+  for (let i = 0; i < 30; i++) await new Promise((r) => setImmediate(r));
+  return el('fence-body').innerHTML;
+}
+
+test('with no device, Connect a PC says how and opens the Settings flow', async () => {
+  const html = await drawPanel();
+  const line = html.split('<li class="rn-check__item').find((c) => c.includes('Connect a PC'));
+  assert.ok(line, 'the checklist has the line');
+  assert.match(line, /rn-check__item--todo/);
+  assert.match(line, /Add a device in Settings: one copied command on any Windows PC or Mac/);
+  assert.match(line, /<a class="btn btn--sm" href="\/builders\/settings#autobongos">Add a device<\/a>/, 'a link to the flow, not a sentence about one');
+});
+
+test('once a device is checking in, the line is ticked and the link is gone', async () => {
+  const html = await drawPanel({ runners: [{ host: 'ada-laptop', health: { state: 'alive', host: 'ada-laptop', age: '30s', account: 'ada@example.com' } }] });
+  const line = html.split('<li class="rn-check__item').find((c) => c.includes('PC connected'));
+  assert.ok(line);
+  assert.match(line, /rn-check__item--ok/);
+  assert.equal(html.includes('Connect a PC'), false);
+  assert.equal(html.includes('>Add a device</a>'), false, 'nothing to add when one is connected');
+});

package/tests/stranded_rows.mjs

@@ -44,6 +44,56 @@ test('the claim is read from ANYWHERE in the message, not just the subject', ()
   assert.deepEqual([...authoredIds(mergeBody)], ['1002200']);
 });
 
+// ---- the second convention: the task leads the subject (task 1005187) ------
+//
+// Main went red on 2026-11-10 because builders, and ship.js's own regeneration
+// commits, had moved to writing the task at the START of the subject, and the only
+// form this file knew was the `(task N)` suffix: 18 distinct tasks in 400 commits.
+
+test('a subject that LEADS with the task counts, with or without a conventional prefix', () => {
+  for (const subject of [
+    'task 1005094: Running Autobongos on a device is now one button.',
+    'task 1005094 - the device card sheet uses the type and radius tokens',
+    'fix: task 1005094 grade round 1 - https-only setup command',   // words between the id and the dash: not this form
+    'fix: task 1005094 - https-only setup command',
+    'chore: task 1005094 - merge main, regenerate the copy registry',
+    'wip(autobongos): task 1005094 - a Run switch per device',
+    'feat(hall)!: task 1005094: the button is the cooldown',
+    'Task 1005094 \u2014 an em dash, as some editors write it',
+  ]) {
+    const ids = [...authoredIds(subject)];
+    if (subject.includes('grade round 1 -')) assert.deepEqual(ids, [], `"${subject}" has words between the task and the dash`);
+    else assert.deepEqual(ids, ['1005094'], subject);
+  }
+});
+
+test('a task that is only MENTIONED is still not counted: not mid-subject, and not in the body', () => {
+  assert.deepEqual([...authoredIds('see task 1005094 for why this is here')], []);
+  assert.deepEqual([...authoredIds('Merge origin/main into task 1004893 (keep CORE_VERSION 1.23.0 above the 1.22.2 carrier)')], []);
+  assert.deepEqual([...authoredIds('docs: a session log\n\ntask 1005094 - settings add pc, mentioned at the start of a body line\ntask 1005095: and another')], [],
+    'the leading form is read off the subject, never off body lines');
+  // The suffix form is still read from anywhere, exactly as before.
+  assert.deepEqual([...authoredIds('docs: a session log\n\nfix: the real work (task 1000001)')], ['1000001']);
+});
+
+test('a merge commit is read by the pull request title GitHub echoes into its body', () => {
+  const merge = ['Merge pull request #2033 from an-owner/claude/autobongos-run-button', '', 'task 1005094: Running Autobongos on a device is now one button.', '', 'task 1005095 - a later line that only mentions another task'].join('\n');
+  assert.deepEqual([...authoredIds(merge)], ['1005094'], 'the echoed title, and only that line');
+  // Any other subject does not get its body read this way.
+  assert.deepEqual([...authoredIds('release: core 1.24.78\n\ntask 1005094: carried by this release')], []);
+});
+
+test('both conventions in one log are counted once each, first sha kept', () => {
+  const raw = [
+    `${SEP}cccccccc3333\nchore: task 1000002 - regenerate after merging main`,
+    `${SEP}aaaaaaaa1111\nfix: later touch (task 1000001)`,
+    `${SEP}bbbbbbbb2222\ntask 1000002: the original work`,
+  ].join('\n');
+  const m = scanLog(raw);
+  assert.deepEqual([...m.keys()].sort(), ['1000001', '1000002']);
+  assert.equal(m.get('1000002'), 'cccccccc3333');
+});
+
 test('scanLog keeps the FIRST sha that claimed an id', () => {
   const raw = [
     `${SEP}aaaaaaaa1111\nfix: later touch (task 1000001)`,