@bongos/core 1.25.10 → 1.25.12

package/modules/provisioning/starter-bundles.js

@@ -82,7 +82,9 @@ const ALWAYS_ON_CORE = Object.freeze([
 // bills AI generation through Cloud Bongos's own payment processor account, so it stays on
 // the hub until a project can bring its own billing. `market-watch` sat here while it was
 // empty; task 1004938 shipped the owner's on/off switch and moved it to OPTIONAL_MODULES.
-const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy', 'raise', 'ai-studio']);
+// `front-door-guide` (task 1005272) is the hub's start-a-project chat on Cloud Bongos's own
+// Anthropic key, so a new project gains nothing by switching it on.
+const HUB_ONLY_MODULES = Object.freeze(['platform-identity', 'provisioning', 'npm-release', 'render-deploy', 'raise', 'ai-studio', 'front-door-guide']);
 
 // The OPT-IN catalog as the creation picker renders it (BV1.R20, task 1002339):
 // every module an owner may actually choose, in the order the picker lists them,

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.10",
+  "version": "1.25.12",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.25.10",
+      "version": "1.25.12",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.25.10",
+  "version": "1.25.12",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -11766,5 +11766,21 @@
       "id": "1005267",
       "text": "The hall's panels, menus, dialogs, toasts, top bar and city labels now share one smoked-glass look that softens whatever is behind them; phones keep solid panels."
     }
+  ],
+  "1.25.11": [
+    {
+      "id": "1005268",
+      "text": "An Archon can now switch the card requirement on or off for a builder straight from the People roster."
+    }
+  ],
+  "1.25.12": [
+    {
+      "id": "1005272",
+      "text": "Visitors who press start a project can now talk with an AI guide about what they want to build, with strict limits on messages and spending, and a plain form whenever the guide is unavailable."
+    },
+    {
+      "id": "1005288",
+      "text": "Decided how every project gets a sandbox: a free copy of the app that always shows the newest finished work, while the real site only changes when a person presses promote. Fake data and test keys by default. Costs the owner n"
+    }
   ]
 }

package/scripts/bongos/publish-manifest.js

@@ -78,6 +78,7 @@ const PUBLISH_ALLOWLIST = [
   'modules/render-deploy/',  // the deploy page of a project whose app deploys through Render (task 1004270). default:false. MUST be here for the npm-release reason: modules/hall-ui/ ships as one subtree, so a released core without it carries deploy.js's loader for #rd-panel with no routes behind it.
   'modules/market-watch/',   // the weekly AI market watch (task 1004935, goal 1000137). default:false and empty for now, but MUST be here: shipped is not enabled, and a released core without it answers "unknown module" to an instance that turns it on; tests/market_watch_module.mjs (publishable) also reads its manifest.
   'modules/ai-studio/',      // AI generation for artists (task 1004916, ADR 0392): keys, prepaid balance, generate. default:false.
+  'modules/front-door-guide/', // the start-a-project guide (task 1005272): a capped AI chat for a signed-out visitor on the platform's key. default:false, hub first; shipped is not enabled.
   'modules/raise/',           // the /raise investor page (task 1004847, ADR 0384) — ships in core, enabled ONLY on the hub, like platform-identity. Owner decision 2026-10-25: the whole page, its copy and starting numbers included, lives in the repo so builders can contribute to it, accepting that it publishes with the core. Secrets never do: the investor password is RAISE_PASSWORD_HASH in the instance env. default:false.
   'modules/platform-identity/', // hub identity provider (ADR 0141) — ships in core, enabled ONLY on the hub (cloudbongos.com). MUST be here or the hub's enabledModules() throws "unknown module" and provision.js's federation load MODULE_NOT_FOUNDs (task 1002235, same rationale as provisioning above). default:false — shipped ≠ enabled; a vanilla/self-hosted instance never turns it on.
   // --- neutral (customer-0) config starters + their schemas (the filled-in *.json twins are denied) ---

package/src/bongos/db-kernel.js

@@ -84,10 +84,14 @@ async function getFoundingBuilder() {
 // Archon-only); id/login/name/avatar/rank is no more sensitive than what
 // GET /leaderboard already exposes publicly, just without the credits cutoff.
 // Accounts tagged is_tester (migration core_278) stay out unless the caller is a
-// management read that has to see them to untag them (includeTesters).
-async function listActiveBuilders({ includeTesters = false } = {}) {
+// management read that has to see them to untag them (includeTesters). Card state
+// (require_card, has_card) is an Archon-desk fact, never part of the any-builder
+// directory: it says which accounts lack a card. Ask for it with includeCardState.
+async function listActiveBuilders({ includeTesters = false, includeCardState = false } = {}) {
   const { rows } = await pool.query(
     `SELECT id, github_login, display_name, avatar_url, rank
+            ${includeCardState ? `, require_card,
+            EXISTS (SELECT 1 FROM passkey_credentials c WHERE c.builder_id = builders.id) AS has_card` : ''}
        FROM builders
       WHERE status = 'active'
         AND (is_tester = false OR $1::boolean)

package/src/bongos/module-scope-map.js

@@ -186,6 +186,11 @@ const MODULE_GLOBS = {
   'ai-studio': [
     'modules/ai-studio/',
   ],
+  // The start-a-project guide (task 1005272, goal 1000106): a capped AI chat for a
+  // signed-out visitor. Its test sits at the repo root, listed by exact path.
+  'front-door-guide': [
+    'modules/front-door-guide/', 'tests/front_door_guide.mjs',
+  ],
   // The /raise investor page (task 1004847, ADR 0384): hub-only.
   raise: [
     'modules/raise/',

package/src/bongos/routes/builders.js

@@ -209,6 +209,30 @@ function contributeBuilderDesk() {
   });
 }
 
+// The People Cards desk (task 1005268; ADR 0382 D4): one row per builder with a
+// registered hardware card, and the one act the viewer holding builder.rank.set (the
+// card-requirement route's own atom) may take — require a card, or stop requiring it.
+// It is its own desk because a roster row holds at most two buttons. Never the
+// viewer's own row: the route refuses switching your own requirement off. Pure;
+// exported for tests.
+function cardDeskRows(builders, { viewerId }) {
+  return (builders || []).filter((b) => b && String(b.id) !== String(viewerId) && (b.has_card === true || b.require_card === true)).map((b) => {
+    const on = b.require_card === true;
+    return {
+      id: b.id, name: b.display_name || b.github_login || `builder ${b.id}`, fact: on ? 'card required' : 'card optional',
+      facts: b.github_login ? [`@${b.github_login}`] : [], ref: { type: 'builder_card', id: b.id },
+      acts: [{ key: 'card', options: [on ? { key: 'off', label: 'stop requiring a card' } : { key: 'on', label: 'require a card' }] }],
+    };
+  });
+}
+function contributeCardDesk() {
+  seams.contribute('governor.docket', {
+    desk: 'people.cards',
+    gate: { permission: 'builder.rank.set' },
+    read: async (ctx) => cardDeskRows(await db.listActiveBuilders({ includeTesters: true, includeCardState: true }), { viewerId: ctx.builderId }),
+  });
+}
+
 // The Treasury desk's budget rows (task 1004561): one row per active builder,
 // their monthly spending limit as the fact, and the limits a viewer holding
 // builder.budget.set (PATCH /builders/:id/budget's own atom) may set in one tap.
@@ -264,6 +288,7 @@ function contributeTreasury() {
 
 module.exports = function buildBuildersRouter() {
   contributeBuilderDesk();
+  contributeCardDesk();
   contributeTreasury();
   const router = express.Router();
 
@@ -898,5 +923,6 @@ module.exports = function buildBuildersRouter() {
 };
 
 module.exports.builderDeskRows = builderDeskRows;
+module.exports.cardDeskRows = cardDeskRows;
 module.exports.fireDiscordBroadcast = fireDiscordBroadcast;
 module.exports.budgetDeskRows = budgetDeskRows;

package/src/module-api.js

@@ -81,7 +81,7 @@ const { sleep } = require('./sleep');
 // MAJOR (see allowBoxScope below): passes the request through untouched.
 function deprecatedNoopMiddleware(_req, _res, next) { next(); }
 
-const CORE_VERSION = '1.25.10'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
+const CORE_VERSION = '1.25.12'; // CI auto-patch carrier (ADR 0161); changelog: docs/module-api-changelog.md
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('discord'); log.info('mounted');

package/tests/builder_card_requirement.mjs

@@ -72,4 +72,32 @@ await test('route: rank atom + step-up gate, self-disable refused, 409 mapped, e
   assert.equal(classify('cannot_disable_own_card_requirement'), 'forbidden');
 });
 
+await test('Cards desk: one row per builder with a card, one act, never the viewer or a cardless builder', () => {
+  const { cardDeskRows, builderDeskRows } = require('../src/bongos/routes/builders');
+  const rows = cardDeskRows([
+    { id: 1, has_card: true },
+    { id: 2 },
+    { id: 3, has_card: true },
+    { id: 4, has_card: true, require_card: true },
+  ], { viewerId: '1' });
+  assert.deepEqual(rows.map((r) => r.id), [3, 4]);
+  assert.deepEqual(rows[0].acts, [{ key: 'card', options: [{ key: 'on', label: 'require a card' }] }]);
+  assert.deepEqual(rows[1].acts[0].options.map((o) => o.key), ['off']);
+  assert.equal(rows[1].fact, 'card required');
+  assert.equal(rows[0].ref.type, 'builder_card');
+  // the roster keeps its two buttons: tier + deactivate, no card act
+  const roster = builderDeskRows([{ id: 3, rank: 'xenos', has_card: true }], { viewerId: '1', mayRank: true, mayStop: true, ranks: ['xenos', 'thetes'] });
+  assert.deepEqual(roster[0].acts.map((a) => a.key), ['tier', 'deactivate']);
+});
+
+await test('hall: the card act posts to the card-requirement route, under its own ref type', async () => {
+  const fs = await import('node:fs');
+  const src = fs.readFileSync(new URL('../modules/hall-ui/public/street-card.js', import.meta.url), 'utf8');
+  const at = src.indexOf('ACT_ROUTES.builder_card = {');
+  assert.ok(at > 0, 'the card act has its own ref type');
+  const block = src.slice(at, src.indexOf('};', at));
+  assert.ok(block.includes("'/builders/' + id + '/card-requirement'"));
+  assert.ok(block.includes("require_card: str(inp.option) === 'on'"));
+});
+
 summary();

package/tests/front_door_guide.mjs

@@ -0,0 +1,410 @@
+// tests/front_door_guide.mjs — the start-a-project guide's server (task 1005272): a
+// signed-out visitor starts a chat, talks, and every wall holds — the message cap, the
+// length limit, the per-visitor spend cap, the daily and monthly budget cut-off to the
+// form, the missing-key fallback, a refused reply, and a scripted abuse run.
+//
+// Drives the REAL router over an in-memory db and a mocked Claude client, so it needs no
+// Postgres, no network and no key, and spends no money. Settings come from the
+// environment, re-read per request, so each test sets the knobs it is about.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const db = require('../modules/front-door-guide/db.js');
+const claude = require('../modules/front-door-guide/claude.js');
+const G = require('../modules/front-door-guide/guide.js');
+
+const KEY = 'sk-ant-api03-TEST-ONLY-NOT-A-REAL-KEY-0123456789';
+const ENV = 'BONGOS_FRONT_DOOR_GUIDE_';
+
+// ---- an in-memory db with the same rules as the SQL ----------------------------------
+
+const convs = new Map();
+let callRows = [];
+let seq = 0;
+let baselineDay = 0;   // spend already on the books today, outside these tests
+let baselineMonth = 0;
+const copy = (c) => c && { ...c, messages: JSON.parse(JSON.stringify(c.messages)) };
+Object.assign(db, {
+  createConversation: async (tokenHash, visitorHash) => {
+    const c = { id: String(++seq), token_hash: tokenHash, visitor_hash: visitorHash, messages: [], visitor_messages: 0, spend_micro: 0, status: 'open', end_reason: null, created_at: new Date(Date.now() - 10_000).toISOString() };
+    convs.set(c.id, c);
+    return copy(c);
+  },
+  getConversation: async (id, tokenHash) => { const c = convs.get(String(id)); return c && c.token_hash === tokenHash ? copy(c) : null; },
+  siteSpendMicro: async (period) => callRows.reduce((s, r) => s + r.cost_micro, period === 'day' ? baselineDay : baselineMonth),
+  visitorUsage: async (visitorHash) => {
+    const mine = callRows.filter((r) => r.visitor_hash === visitorHash);
+    return { messages: mine.length, spendMicro: mine.reduce((s, r) => s + r.cost_micro, 0) };
+  },
+  recordTurn: async (convId, { messages, status, endReason }, call) => {
+    callRows.push({ conversation_id: String(convId), visitor_hash: call.visitorHash, cost_micro: call.costMicro, model: call.model, input_tokens: call.inputTokens, output_tokens: call.outputTokens, stop_reason: call.stopReason });
+    const c = convs.get(String(convId));
+    Object.assign(c, { messages, status, end_reason: endReason, visitor_messages: c.visitor_messages + 1, spend_micro: c.spend_micro + call.costMicro });
+    return copy(c);
+  },
+  endConversation: async (convId, reason) => Object.assign(convs.get(String(convId)), { status: 'ended', end_reason: reason }),
+});
+
+// ---- the mocked Claude client: records every request, answers from a script ----------
+
+let requests = [];
+let respond = null;
+let delayMs = 0;
+let clientKeys = [];
+const normalReply = () => ({
+  model: 'claude-opus-5-5', stop_reason: 'end_turn',
+  content: [{ type: 'thinking', thinking: '' }, { type: 'text', text: 'Sounds useful. Who will use it first?' }],
+  usage: { input_tokens: 800, output_tokens: 200 },
+});
+claude.createClient = (apiKey) => {
+  clientKeys.push(apiKey);
+  return { messages: { create: async (req) => {
+    requests.push(req);
+    if (delayMs) await new Promise((r) => setTimeout(r, delayMs));
+    return respond ? respond(req) : normalReply();
+  } } };
+};
+
+// ---- the real router over http ----------------------------------------------------------
+
+const express = require('express');
+const app = express();
+app.set('trust proxy', true); // so each test can be a different visitor via X-Forwarded-For
+app.use(express.json({ limit: '64kb' }));
+app.use('/api/bongos', require('../modules/front-door-guide/routes/front-door-guide.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const PORT = server.address().port;
+
+const UA = 'Mozilla/5.0 (test browser)';
+function call(method, path, { body, ip = '10.0.0.1', ua = UA, headers = {} } = {}) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const h = { 'content-type': 'application/json', 'x-forwarded-for': ip, ...headers };
+    if (ua) h['user-agent'] = ua;
+    const req = http.request({ host: '127.0.0.1', port: PORT, method, path: `/api/bongos${path}`, headers: h }, (res) => {
+      let buf = '';
+      res.on('data', (c) => { buf += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: buf ? JSON.parse(buf) : null, raw: buf }));
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+let ipSeq = 0;
+const freshIp = () => `10.1.${Math.floor(++ipSeq / 250)}.${ipSeq % 250}`;
+
+function setEnv(over = {}) {
+  for (const k of Object.keys(process.env)) if (k.startsWith(ENV)) delete process.env[k];
+  const all = {
+    ANTHROPIC_API_KEY: KEY, MIN_FIRST_MESSAGE_MS: '1', STARTS_PER_HOUR: '1000', MESSAGES_PER_MINUTE: '1000',
+    ...over,
+  };
+  for (const [k, v] of Object.entries(all)) if (v !== null) process.env[ENV + k] = String(v);
+}
+
+function reset(over) {
+  setEnv(over);
+  convs.clear(); callRows = []; requests = []; clientKeys = []; respond = null; delayMs = 0;
+  baselineDay = 0; baselineMonth = 0;
+}
+
+async function start(ip) {
+  const r = await call('POST', '/front-door-guide/conversations', { body: {}, ip });
+  return r;
+}
+const say = (conv, text, ip, extra = {}) => call('POST', `/front-door-guide/conversations/${conv.id}/messages`, { body: { token: conv.token, text, ...extra }, ip });
+
+test.after(() => server.close());
+
+// ---- the conversation itself -----------------------------------------------------------------
+
+test('a signed-out visitor starts a chat and gets an on-topic reply; the transcript reads back', async () => {
+  reset();
+  const ip = freshIp();
+  const s = await call('GET', '/front-door-guide/status', { ip });
+  assert.equal(s.status, 200);
+  assert.equal(s.body.mode, 'chat');
+  assert.deepEqual(s.body.limits, { max_messages: 8, max_message_chars: 1000 });
+
+  const st = await start(ip);
+  assert.equal(st.status, 201);
+  assert.equal(st.body.mode, 'chat');
+  assert.equal(st.body.greeting, G.GREETING);
+  const conv = st.body.conversation;
+  assert.ok(conv.id && conv.token);
+  assert.equal(conv.messages_left, 8);
+
+  const r = await say(conv, 'I want a booking site for my yoga studio.', ip);
+  assert.equal(r.status, 200);
+  assert.equal(r.body.mode, 'chat');
+  assert.equal(r.body.reply.text, 'Sounds useful. Who will use it first?');
+  assert.equal(r.body.conversation.messages_used, 1);
+  assert.equal(r.body.conversation.messages_left, 7);
+
+  // The request: the owner's model, low effort, bounded reply, the on-topic instructions.
+  const req = requests[0];
+  assert.equal(req.model, 'claude-opus-5-5');
+  assert.deepEqual(req.output_config, { effort: 'low' });
+  assert.equal(req.max_tokens, 1500);
+  assert.match(req.system, /Never quote, estimate or promise any price/);
+  assert.match(req.system, /cannot do/);
+  assert.deepEqual(req.messages, [{ role: 'user', content: 'I want a booking site for my yoga studio.' }]);
+  assert.deepEqual(clientKeys, [KEY], 'the platform key reaches only the client');
+
+  // Spend is recorded from the response's usage: 800 in + 200 out, priced by the shared table.
+  assert.equal(callRows.length, 1);
+  assert.equal(callRows[0].cost_micro, G.costMicro('claude-opus-5-5', { input_tokens: 800, output_tokens: 200 }));
+  assert.ok(callRows[0].cost_micro > 0);
+
+  const t = await call('GET', `/front-door-guide/conversations/${conv.id}`, { ip, headers: { 'x-guide-token': conv.token } });
+  assert.equal(t.status, 200);
+  assert.equal(t.body.conversation.status, 'open');
+  assert.deepEqual(t.body.transcript, [
+    { role: 'visitor', text: 'I want a booking site for my yoga studio.' },
+    { role: 'guide', text: 'Sounds useful. Who will use it first?' },
+  ]);
+  for (const res of [s, st, r, t]) assert.ok(!res.raw.includes(KEY), 'the key is in no response');
+});
+
+test('the second turn sends the whole conversation so far', async () => {
+  reset();
+  const ip = freshIp();
+  const conv = (await start(ip)).body.conversation;
+  await say(conv, 'A shop for my pottery.', ip);
+  await say(conv, 'Mostly local customers.', ip);
+  assert.deepEqual(requests[1].messages.map((m) => m.role), ['user', 'assistant', 'user']);
+  assert.equal(requests[1].messages[2].content, 'Mostly local customers.');
+});
+
+// ---- the walls ------------------------------------------------------------------------------
+
+test('message cap: the last allowed message ends the chat, and nothing more is sent', async () => {
+  reset({ MAX_MESSAGES: 3 });
+  const ip = freshIp();
+  const conv = (await start(ip)).body.conversation;
+  assert.equal((await say(conv, 'one', ip)).body.mode, 'chat');
+  assert.equal((await say(conv, 'two', ip)).body.mode, 'chat');
+  const third = await say(conv, 'three', ip);
+  assert.equal(third.body.mode, 'ended');
+  assert.equal(third.body.reason, 'message_cap');
+  assert.ok(third.body.reply.text, 'the last message still gets its reply');
+  assert.equal(third.body.conversation.messages_left, 0);
+
+  const fourth = await say(conv, 'four', ip);
+  assert.equal(fourth.status, 200);
+  assert.equal(fourth.body.mode, 'ended');
+  assert.equal(requests.length, 3, 'no call past the cap');
+
+  // A new chat does not reset the visitor's cap.
+  const again = await start(ip);
+  assert.equal(again.body.mode, 'form');
+  assert.equal(again.body.reason, 'visitor_limit');
+});
+
+test('length limit: one character over is refused before any call; exactly the limit is fine', async () => {
+  reset({ MAX_MESSAGE_CHARS: 40 });
+  const ip = freshIp();
+  const conv = (await start(ip)).body.conversation;
+  const over = await say(conv, 'x'.repeat(41), ip);
+  assert.equal(over.status, 400);
+  assert.equal(over.body.error, 'too_long');
+  assert.equal(over.body.max_message_chars, 40);
+  assert.equal(requests.length, 0);
+  assert.equal((await say(conv, 'x'.repeat(40), ip)).body.mode, 'chat');
+  assert.equal((await say(conv, '   ', ip)).body.error, 'empty');
+  assert.equal(requests.length, 1);
+});
+
+test('per-visitor spend cap: the visitor stops before passing it, and never passes it', async () => {
+  reset({ VISITOR_CAP_CENTS: 6 }); // 60,000 micro-dollars
+  const ip = freshIp();
+  const conv = (await start(ip)).body.conversation;
+  let last;
+  for (let i = 0; i < 8; i++) {
+    last = await say(conv, `message ${i}`, ip);
+    if (last.body.mode !== 'chat') break;
+  }
+  assert.equal(last.body.mode, 'ended');
+  assert.equal(last.body.reason, 'visitor_budget');
+  const spent = callRows.reduce((s, r) => s + r.cost_micro, 0);
+  assert.ok(spent <= 60_000, `spent ${spent} within the cap`);
+  assert.ok(callRows.length >= 1 && callRows.length < 8);
+  const after = await say(conv, 'one more', ip);
+  assert.equal(after.body.mode, 'ended');
+  assert.equal(requests.length, callRows.length, 'no call after the cap');
+});
+
+test('daily budget cut-off: the guide answers the form, never an error, and makes no call', async () => {
+  reset({ DAILY_BUDGET_CENTS: 200 });
+  const ip = freshIp();
+  const conv = (await start(ip)).body.conversation;
+  baselineDay = 2_000_000 - 1_000; // a tenth of a cent left today: less than one reply could cost
+  const r = await say(conv, 'Hello there', ip);
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.body, G.formAnswer('daily_budget'));
+  assert.equal(requests.length, 0);
+  const s = await call('GET', '/front-door-guide/status', { ip });
+  assert.equal(s.body.mode, 'chat', 'status still offers the chat while a cent is left');
+  baselineDay = 2_000_000;
+  assert.equal((await call('GET', '/front-door-guide/status', { ip })).body.reason, 'daily_budget');
+  const st = await start(freshIp());
+  assert.equal(st.status, 200);
+  assert.equal(st.body.mode, 'form');
+  assert.equal(st.body.reason, 'daily_budget');
+});
+
+test('monthly budget cut-off: the form too', async () => {
+  reset({ MONTHLY_BUDGET_CENTS: 2500 });
+  baselineMonth = 25_000_000;
+  const st = await start(freshIp());
+  assert.deepEqual(st.body, G.formAnswer('monthly_budget'));
+});
+
+test('no key configured: every route answers the form, never an error, and no client is made', async () => {
+  reset({ ANTHROPIC_API_KEY: null });
+  const ip = freshIp();
+  const s = await call('GET', '/front-door-guide/status', { ip });
+  assert.equal(s.status, 200);
+  assert.equal(s.body.mode, 'form');
+  assert.equal(s.body.reason, 'no_key');
+  const st = await start(ip);
+  assert.equal(st.status, 200);
+  assert.deepEqual(st.body, G.formAnswer('no_key'));
+
+  // A chat started while the key was set, then the key removed: the form, not a 500.
+  setEnv();
+  const conv = (await start(ip)).body.conversation;
+  setEnv({ ANTHROPIC_API_KEY: null });
+  const r = await say(conv, 'hello', ip);
+  assert.equal(r.status, 200);
+  assert.equal(r.body.reason, 'no_key');
+  assert.equal(clientKeys.length, 0);
+});
+
+test('a refusal stop reason gets a graceful reply, and the refused words are not sent again', async () => {
+  reset();
+  const ip = freshIp();
+  const conv = (await start(ip)).body.conversation;
+  respond = () => ({ model: 'claude-opus-5-5', stop_reason: 'refusal', stop_details: { type: 'refusal', category: null }, content: [], usage: { input_tokens: 500, output_tokens: 3 } });
+  const r = await say(conv, 'something off topic', ip);
+  assert.equal(r.status, 200);
+  assert.equal(r.body.mode, 'chat');
+  assert.equal(r.body.declined, true);
+  assert.equal(r.body.reply.text, G.REFUSAL_REPLY);
+  assert.equal(callRows[0].stop_reason, 'refusal');
+  assert.ok(callRows[0].cost_micro > 0, 'a refused call is still recorded');
+
+  respond = null;
+  await say(conv, 'OK, a recipe website.', ip);
+  const sent = JSON.stringify(requests[1].messages);
+  assert.ok(!sent.includes('something off topic'));
+});
+
+test('a failed API call answers the form and records no spend', async () => {
+  reset();
+  const ip = freshIp();
+  const conv = (await start(ip)).body.conversation;
+  respond = () => { const e = new Error('overloaded'); e.status = 529; throw e; };
+  const r = await say(conv, 'hello', ip);
+  assert.equal(r.status, 200);
+  assert.deepEqual(r.body, G.formAnswer('unavailable'));
+  assert.equal(callRows.length, 0);
+});
+
+// ---- a scripted abuse run -------------------------------------------------------------------
+
+test('scripted abuse run: bots, stolen ids, floods and a budget stampede all hold', async () => {
+  reset({ DAILY_BUDGET_CENTS: 10, STARTS_PER_HOUR: 3, MESSAGES_PER_MINUTE: 4 });
+
+  // 1. The bot check: honeypot filled, no user agent, a first message faster than typing.
+  const botIp = freshIp();
+  assert.equal((await call('POST', '/front-door-guide/conversations', { body: { website: 'http://spam' }, ip: botIp })).body.reason, 'check_failed');
+  assert.equal((await call('POST', '/front-door-guide/conversations', { body: {}, ip: freshIp(), ua: null })).body.reason, 'check_failed');
+  const ip1 = freshIp();
+  const conv = (await start(ip1)).body.conversation;
+  assert.equal((await say(conv, 'hi', ip1, { website: 'x' })).body.reason, 'check_failed');
+  setEnv({ DAILY_BUDGET_CENTS: 10, STARTS_PER_HOUR: 3, MESSAGES_PER_MINUTE: 4, MIN_FIRST_MESSAGE_MS: 60_000 });
+  assert.equal((await say(conv, 'instant', ip1)).body.reason, 'check_failed');
+  setEnv({ DAILY_BUDGET_CENTS: 10, STARTS_PER_HOUR: 3, MESSAGES_PER_MINUTE: 4 });
+  assert.equal(requests.length, 0, 'no bot reached the API');
+
+  // 2. Someone else's chat: a wrong token or a made-up id is a 404; garbage is a 400.
+  assert.equal((await say({ id: conv.id, token: 'A'.repeat(32) }, 'hijack', freshIp())).status, 404);
+  assert.equal((await say({ id: '999999', token: conv.token }, 'hijack', freshIp())).status, 404);
+  assert.equal((await say({ id: 'abc', token: conv.token }, 'x', freshIp())).status, 400);
+  assert.equal((await call('GET', `/front-door-guide/conversations/${conv.id}`, { headers: { 'x-guide-token': 'B'.repeat(32) } })).status, 404);
+
+  // 3. Firing five messages at once: one call runs, the rest are told to wait.
+  delayMs = 60;
+  const burst = await Promise.all([0, 1, 2, 3].map((i) => say(conv, `parallel ${i}`, ip1)));
+  delayMs = 0;
+  const answered = burst.filter((b) => b.status === 200);
+  assert.equal(answered.length, 1, 'exactly one parallel message was answered');
+  assert.ok(burst.filter((b) => b.status === 429).every((b) => ['busy', 'rate_limited'].includes(b.body.error)));
+  assert.equal(requests.length, 1);
+
+  // 4. A message flood from one address hits the per-minute limit with Retry-After.
+  let flooded = null;
+  for (let i = 0; i < 6 && !flooded; i++) {
+    const r = await say(conv, `flood ${i}`, ip1);
+    if (r.status === 429 && r.body.error === 'rate_limited') flooded = r;
+  }
+  assert.ok(flooded, 'the per-minute limiter tripped');
+  assert.ok(flooded.body.retry_after_seconds >= 1);
+
+  // 5. A start flood from one address hits the per-hour limit.
+  const ip2 = freshIp();
+  const starts = [];
+  for (let i = 0; i < 5; i++) starts.push((await start(ip2)).status);
+  assert.deepEqual(starts.slice(0, 3), [201, 201, 201]);
+  assert.equal(starts[3], 429);
+
+  // 6. A stampede of fresh visitors cannot spend past the daily budget: once it is
+  //    near, everyone gets the form, and the books never pass ten cents.
+  let forms = 0;
+  for (let v = 0; v < 25; v++) {
+    const ip = freshIp();
+    const st = await start(ip);
+    if (st.body.mode === 'form') { forms++; continue; }
+    for (let m = 0; m < 3; m++) {
+      const r = await say(st.body.conversation, `visitor ${v} message ${m}`, ip);
+      if (r.body.mode === 'form') { forms++; break; }
+    }
+  }
+  const spent = callRows.reduce((s, r) => s + r.cost_micro, 0);
+  assert.ok(spent <= 100_000, `site spend ${spent} stays within the daily budget`);
+  assert.ok(forms > 0, 'the budget cut-off was reached and answered with the form');
+  const s = await call('GET', '/front-door-guide/status', { ip: freshIp() });
+  assert.equal(s.status, 200);
+});
+
+// ---- pure pieces --------------------------------------------------------------------------
+
+test('settings: env knobs override, bad values fall back to the defaults, money in micro-dollars', () => {
+  const { readSettings, DEFAULTS } = require('../modules/front-door-guide/settings.js');
+  const s = readSettings({ resolve: (k) => ({ FRONT_DOOR_GUIDE_MAX_MESSAGES: '3', FRONT_DOOR_GUIDE_DAILY_BUDGET_CENTS: '-5', FRONT_DOOR_GUIDE_MODEL: 'gpt-4', FRONT_DOOR_GUIDE_EFFORT: 'max' })[k] });
+  assert.equal(s.maxMessages, 3);
+  assert.equal(s.dailyBudgetMicro, DEFAULTS.DAILY_BUDGET_CENTS * 10_000, 'a negative budget is not a budget');
+  assert.equal(s.model, 'claude-opus-5-5', 'only a Claude model id is accepted');
+  assert.equal(s.effort, 'max');
+  assert.equal(s.apiKey, null);
+  const d = readSettings({ resolve: () => undefined });
+  assert.equal(d.visitorCapMicro, 500_000);
+  assert.equal(d.monthlyBudgetMicro, 25_000_000);
+  assert.equal(d.maxMessageChars, 1000);
+});
+
+test('the reservation covers a full-length reply, so it is never below the recorded cost', () => {
+  const system = G.systemPrompt('Cloud Bongos');
+  const messages = [{ role: 'user', content: 'x'.repeat(1000) }];
+  const est = G.estimateMicro({ model: 'claude-opus-5-5', system, messages, maxReplyTokens: 1500 });
+  const real = G.costMicro('claude-opus-5-5', { input_tokens: Math.ceil((system.length + 1000) / 4), output_tokens: 1500 });
+  assert.ok(est >= real);
+});

package/tests/hall_street_desk.mjs

@@ -190,7 +190,7 @@ test('a row\'s buttons are the card\'s acts under the board\'s words, and send t
   assert.equal(ana.name, 'Ana Ruiz', 'a person is named by their name');
   assert.deepEqual(ana.actions.map((a) => [a.key, a.label, a.tone]), [['fine', 'let in', 'primary'], ['refuse', 'not now', 'quiet']]);
   assert.deepEqual(j(C.request(ana.card, 'fine')), { method: 'PATCH', url: '/api/bongos/access-requests/11', body: { status: 'invited' } });
-  assert.deepEqual(j(C.request(row('people', 6).card, 'refuse')), { method: 'POST', url: '/api/bongos/goals/42/requests/12/respond', body: { action: 'deny' } });
+  assert.deepEqual(j(C.request(row('people', 7).card, 'refuse')), { method: 'POST', url: '/api/bongos/goals/42/requests/12/respond', body: { action: 'deny' } });
   const rel = D.rowsFor('release', 0, dk, { now: NOW });
   assert.deepEqual(rel[0].actions.map((a) => a.label), ['release', 'hold']);
   assert.equal(C.request(rel[0].card, 'release').url, '/api/bongos/override-requests/13/decide');

package/tests/hall_street_inside.mjs

@@ -587,7 +587,7 @@ test('a building address draws the interior in place of the street, from the doc
   assert.equal(p.byId.get('streetInside').hidden, false);
   assert.equal(p.byId.get('streetSizer').hidden, true, 'the street gives way');
   assert.equal(p.byId.get('insideName').textContent, 'People');
-  assert.equal(p.byId.get('insideFloors').children.length, 7, 'a button per floor in use');
+  assert.equal(p.byId.get('insideFloors').children.length, 8, 'a button per floor in use');
   assert.equal(p.byId.get('insideFloors').children[4].attrs['aria-pressed'], 'true', 'the floor being decided is chosen');
   assert.equal(p.byId.get('insideLift').style.transform, 'translateY(-208px)');
   assert.equal(p.byId.get('insideTable'), undefined, 'no separate list of matters');

package/tests/module_loader.mjs

@@ -278,7 +278,7 @@ test('the live tree discovers the extracted modules cleanly (BV1.R43/R48/R47/R49
   // That is precisely how the agents regression reached an open PR (task 1002485).
   loader._reset();
   const snap = loader.loaderSnapshot();
-  assert.deepEqual(snap.loaded, ['agents', 'ai-studio', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'market-watch', 'memory', 'npm-release', 'onboarding', 'page-notes', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'raise', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
+  assert.deepEqual(snap.loaded, ['agents', 'ai-studio', 'autonomy', 'builder-settings', 'copy-desk', 'design-styles', 'discord', 'economy', 'front-door-guide', 'government', 'grading', 'hall-ui', 'ideas', 'lifecycle', 'market-watch', 'memory', 'npm-release', 'onboarding', 'page-notes', 'pixel-art', 'platform-identity', 'provisioning', 'public-landing', 'raise', 'render-deploy', 'security', 'sessions', 'specialities', 'status-ui', 'ui-design']);
   assert.deepEqual(snap.errors, []);
   assert.deepEqual(snap.skipped, []);
   loader._reset();