@bongos/core 1.25.12 → 1.25.14

package/tests/genesis_home.mjs

@@ -73,6 +73,23 @@ test('the board read groups genesis tasks by the stage their ref names', async (
   assert.deepEqual(out.scope.map((t) => t.id), ['1', '2']);
 });
 
+test('the board read carries each genesis task\'s description, for its Copy prompt (task 1005109)', async () => {
+  let seen = '';
+  const pool = { query: async (sql) => {
+    seen = sql;
+    return { rows: [
+      { id: 7, title: 'Write the scope', status: 'ready', description: 'Answer the five scope questions.', source_ref: 'genesis:scope' },
+      { id: 8, title: 'Old row', status: 'ready', description: null, source_ref: 'genesis:charter' },
+    ] };
+  } };
+  const out = await seed.genesisStageTasks({ pool });
+  assert.match(seen, /\bdescription\b/, 'the SELECT reads the description');
+  assert.equal(out.scope[0].description, 'Answer the five scope questions.');
+  assert.equal(out.charter[0].description, '', 'a null description is an empty string, never "null"');
+  const g = gh.shapeGenesis({ mode: { stage: 'scope', stage_number: 1, stage_count: 5, day: 1 }, plan: gh.parsePlan({}).plan, tasks: out });
+  assert.equal(g.stages[0].tasks[0].description, 'Answer the five scope questions.', 'the genesis view passes it through');
+});
+
 // ── the plan ─────────────────────────────────────────────────────────────────
 
 test('an empty plan is the recommended defaults: the solo fast-track is one click', () => {
@@ -361,25 +378,60 @@ test('every genesis write is the project owner\'s; the read is any signed-in bui
 
 const CARD = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'genesis-home.js'), 'utf8');
 
+const TASK_LIB = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'task-lib.js'), 'utf8');
+
 function bootCard({ founding, data = { genesis: null } }) {
   const calls = [];
+  const copied = [];
+  const toasts = [];
   let widget = null;
   let observer = null;
   const attrs = founding ? { 'data-founding': 'on' } : {};
   const sandbox = {
     window: {
-      OTB: { escapeHtml: (s) => String(s), statusPill: (s) => `<span>${s}</span>`, contributeHallWidget: (w) => { widget = w; } },
+      OTB: { escapeHtml: (s) => String(s), statusPill: (s) => `<span>${s}</span>`, contributeHallWidget: (w) => { widget = w; }, toast: (m) => toasts.push(m) },
       BongosClient: { createClient: () => ({ request: async (m, p) => { calls.push(`${m} ${p}`); return { ok: true, status: 200, data }; } }) },
     },
+    navigator: { clipboard: { writeText: async (t) => { copied.push(t); } } },
+    location: { hostname: 'builders.example.test', origin: 'https://builders.example.test' },
     document: { documentElement: { getAttribute: (k) => attrs[k] || null } },
     MutationObserver: class { constructor(fn) { observer = fn; } observe() {} disconnect() {} },
+    setTimeout: () => 0,
     Promise,
   };
   vm.createContext(sandbox);
+  // The hall's real prompt builder, loaded as index.html loads it (before the card).
+  vm.runInContext(TASK_LIB, sandbox, { filename: 'task-lib.js' });
   vm.runInContext(CARD, sandbox, { filename: 'genesis-home.js' });
   const host = { hidden: true, innerHTML: '', addEventListener() {}, querySelector: () => null, querySelectorAll: () => [] };
   widget.mount(host);
-  return { widget, host, calls, attrs, fire: () => observer && observer() };
+  return { widget, host, calls, copied, toasts, attrs, fire: () => observer && observer() };
+}
+
+// Re-mount a booted card so its click handler is captured; returns a click(btn) driver.
+async function mountClickable(b) {
+  let onClick = null;
+  b.host.addEventListener = (type, fn) => { if (type === 'click') onClick = fn; };
+  b.host.contains = () => true;
+  b.widget.mount(b.host);
+  await new Promise((r) => setImmediate(r));
+  await new Promise((r) => setImmediate(r));
+  return async (btn) => {
+    onClick({ target: { closest: () => btn } });
+    for (let i = 0; i < 4; i++) await new Promise((r) => setImmediate(r));
+  };
+}
+
+// A fake button carrying one data attribute, as the click handler reads it.
+function fakeButton(attr, value) {
+  const set = {};
+  return {
+    set,
+    hasAttribute: (k) => k === attr,
+    getAttribute: (k) => (k === attr ? value : null),
+    setAttribute: (k, v) => { set[k] = v; },
+    querySelector: () => null,
+  };
 }
 
 test('the card registers in the Home banner, ahead of the welcome, hidden by default', () => {
@@ -459,6 +511,32 @@ test('the card lists every stage vote waiting on the viewer, and votes yes on al
   ], 'one yes per stage, earliest first');
 });
 
+test('each open stage task has Copy prompt, and it copies the task\'s own words (task 1005109)', async () => {
+  const genesis = gh.shapeGenesis({
+    mode: { stage: 'scope', stage_number: 1, stage_count: 5, day: 1 },
+    plan: gh.parsePlan({}).plan,
+    tasks: { scope: [
+      { id: '201', title: 'Gather what already exists', status: 'shipped', description: 'Link the documents.' },
+      { id: '202', title: 'Write the scope', status: 'ready', description: 'Answer the five scope questions in your own words.' },
+    ] },
+  });
+  const b = bootCard({ founding: true, data: { genesis, viewer_id: '1' } });
+  const click = await mountClickable(b);
+  const html = b.host.innerHTML;
+  assert.match(html, /data-genesis-copy="202"/, 'the open task offers Copy prompt');
+  assert.doesNotMatch(html, /data-genesis-copy="201"/, 'a shipped task offers nothing');
+  assert.doesNotMatch(html, /task__claim|>Claim</, 'Copy prompt only: no Claim button (owner, 2026-11-07)');
+  const btn = fakeButton('data-genesis-copy', '202');
+  await click(btn);
+  assert.equal(b.copied.length, 1, 'one click, one copy');
+  const text = b.copied[0];
+  assert.doesNotMatch(text, /\(no description\)/, 'the copied prompt is never the empty fallback');
+  assert.match(text, /Answer the five scope questions in your own words\./, 'it carries the task\'s description');
+  assert.match(text, /Bongos task 202 \(Write the scope\)/, 'built by the hall\'s one prompt builder');
+  assert.equal(btn.set['data-copied'], '1');
+  assert.match(b.toasts.join(' '), /copied/i);
+});
+
 test('the hall carries the five life plates byte-identical to the world\'s', () => {
   const world = path.join(ROOT, 'modules', 'public-landing', 'public', 'assets', 'world');
   const hall = path.join(ROOT, 'modules', 'hall-ui', 'public', 'genesis');

package/tests/package_core.mjs

@@ -363,15 +363,15 @@ t('TAR_ROOT is the npm-required "package/" (not the ARTIFACT_NAME dir)', () => {
   assert.equal(TAR_ROOT, 'package/');
 });
 
-t('buildPackageJson: prunes to express+pg+pino, keeps the source ranges + the undici override', () => {
+t('buildPackageJson: prunes to the core deps, keeps the source ranges + the undici override', () => {
   const pkg = buildPackageJson({
     version: '1.14.0',
-    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
+    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', '@simplewebauthn/browser': '^13.3.0', '@simplewebauthn/server': '^13.3.3', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
     sourceOverrides: { undici: '^6.27.0' },
   });
   assert.equal(pkg.name, '@bongos/core');
   assert.equal(pkg.version, '1.14.0');
-  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0' });
+  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', '@simplewebauthn/browser': '^13.3.0', '@simplewebauthn/server': '^13.3.3' });
   assert.equal(pkg.dependencies.phaser, undefined);
   assert.equal(pkg.dependencies['discord.js'], undefined);
   assert.deepEqual(pkg.overrides, { undici: '^6.27.0' });
@@ -450,7 +450,7 @@ t('the publish lane sets no long-lived npm credential (OIDC only)', () => {
 });
 
 t('buildPackageJson: omits `overrides` when the source has none', () => {
-  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0', '@simplewebauthn/browser': '^13.0.0', '@simplewebauthn/server': '^13.0.0' } });
   assert.equal(pkg.overrides, undefined);
 });
 
@@ -458,8 +458,10 @@ t('buildPackageJson: throws when a required core dep is missing from the source'
   assert.throws(() => buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0' } }), /missing required core dependency "pg"/);
 });
 
-t('CORE_DEP_NAMES is exactly [express, pg, pino]', () => {
-  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg', 'pino']);
+// The security-card libraries are core runtime deps: routes/my-passkeys.js serves the browser bundle
+// and requires the server lib. Left out, every packaged instance answers bundle_missing (task 1005269).
+t('CORE_DEP_NAMES is exactly [express, pg, pino, @simplewebauthn/browser, @simplewebauthn/server]', () => {
+  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg', 'pino', '@simplewebauthn/browser', '@simplewebauthn/server']);
 });
 
 // A tiny synthetic lockfile fixture with a THREE-level chain (root -> a -> b) and
@@ -542,7 +544,9 @@ t('prunePackageLock: on the real repo lockfile, drops the vast majority of packa
   });
   const keptCount = Object.keys(pruned.packages).length - 1; // exclude the root '' entry
   const sourceCount = Object.keys(realLock.packages).length - 1;
-  assert.ok(keptCount < sourceCount / 2, `expected a real prune (kept ${keptCount} of ${sourceCount})`);
+  // Under two thirds: the card libraries (task 1005269) added their certificate-parsing closure, taking the
+  // kept share from ~44% to ~55%. That the game deps stay out is asserted by the closure test above.
+  assert.ok(keptCount < sourceCount * 2 / 3, `expected a real prune (kept ${keptCount} of ${sourceCount})`);
   assert.ok(keptCount > 0);
 });
 

package/tests/pruned_lockfile_integrity.mjs

@@ -34,7 +34,7 @@ const isRegistryResolved = (v) => typeof v.resolved === 'string' && /^https?:\/\
 
 const pruned = prunePackageLock(realLock, {
   name: '@bongos/core', version: '0.0.0-test',
-  rootRanges: { express: '^4.21.2', pg: '^8.20.0' },
+  rootRanges: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', '@simplewebauthn/browser': '^13.3.0', '@simplewebauthn/server': '^13.3.3' },
 });
 
 t('pruned lockfile: non-trivial and closes over the core deps (express + pg present)', () => {
@@ -42,6 +42,8 @@ t('pruned lockfile: non-trivial and closes over the core deps (express + pg pres
   assert.ok(keys.length > 2, `pruned lockfile is suspiciously empty (${keys.length} entries)`);
   assert.ok(pruned.packages['node_modules/express'], 'express missing from the pruned closure');
   assert.ok(pruned.packages['node_modules/pg'], 'pg missing from the pruned closure');
+  assert.ok(pruned.packages['node_modules/@simplewebauthn/browser'], 'card browser library missing from the pruned closure');
+  assert.ok(pruned.packages['node_modules/@simplewebauthn/server'], 'card server library missing from the pruned closure');
 });
 
 t('pruned lockfile: EVERY registry-resolved package keeps a well-formed integrity hash (R88 guard)', () => {
@@ -72,7 +74,7 @@ t('pruned lockfile: integrity hashes match the SOURCE lockfile verbatim (not rew
 });
 
 t('CORE_DEP_NAMES: the pin domain is exactly the runtime core deps (express + pg + pino)', () => {
-  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg') && CORE_DEP_NAMES.includes('pino'));
+  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg') && CORE_DEP_NAMES.includes('pino') && CORE_DEP_NAMES.includes('@simplewebauthn/browser') && CORE_DEP_NAMES.includes('@simplewebauthn/server'));
 });
 
 console.log(`\npruned_lockfile_integrity: ${passed} passed, ${failed} failed`);

package/tests/status_page_no_dead_uptime.mjs

@@ -69,7 +69,7 @@ test('the server no longer registers GET /public/uptime', () => {
 
 test('the core package exports only files that exist, and the codemod maps only exported subpaths', () => {
   const { buildPackageJson } = require('../scripts/bongos/package-core.js');
-  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0', '@simplewebauthn/browser': '^13.0.0', '@simplewebauthn/server': '^13.0.0' } });
   for (const [sub, target] of Object.entries(pkg.exports)) {
     assert.ok(existsSync(join(ROOT, target)), `export ${sub} points at missing ${target}`);
   }

package/tests/task_lib.mjs

@@ -136,5 +136,51 @@ t('conflictChipHtml: empty for none, count + capped list for many', () => {
   assert.doesNotMatch(many, /#6/);
 });
 
+// task 1005109 — the one Copy prompt click, shared by the Tasks board, a goal's to-do
+// list and the Genesis stage list. Runs against fake browser globals.
+async function at(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+function fakeBtn() {
+  const icon = { textContent: '📋' };
+  const attrs = {};
+  return { icon, attrs, querySelector: (sel) => (sel === '.task__copy-icon' ? icon : null), setAttribute: (k, v) => { attrs[k] = v; } };
+}
+const savedGlobals = { navigator: globalThis.navigator, location: globalThis.location, setTimeout: globalThis.setTimeout };
+function stubGlobals(writeText) {
+  Object.defineProperty(globalThis, 'navigator', { value: { clipboard: { writeText } }, configurable: true, writable: true });
+  globalThis.location = { hostname: 'builders.example.test', origin: 'https://builders.example.test' };
+  globalThis.setTimeout = () => 0;
+}
+
+await at('copyTaskPrompt copies the task\'s own words, flips the button, says one sentence', async () => {
+  const copied = [];
+  const toasts = [];
+  stubGlobals(async (x) => { copied.push(x); });
+  const btn = fakeBtn();
+  const ok = await T.copyTaskPrompt({ id: 42, title: 'Write the scope', description: 'Answer the questions.' }, btn, (m) => toasts.push(m));
+  assert.equal(ok, true);
+  assert.equal(copied.length, 1);
+  assert.match(copied[0], /Answer the questions\./);
+  assert.doesNotMatch(copied[0], /\(no description\)/);
+  assert.equal(btn.icon.textContent, '✓');
+  assert.equal(btn.attrs['data-copied'], '1');
+  assert.deepEqual(toasts, ['Prompt for task 42 copied to your clipboard.']);
+});
+
+await at('copyTaskPrompt: a refused clipboard with no fallback says so and leaves the button alone', async () => {
+  const toasts = [];
+  stubGlobals(async () => { throw new Error('denied'); });
+  const btn = fakeBtn();
+  const ok = await T.copyTaskPrompt({ id: 7, title: 'x', description: 'y' }, btn, (m) => toasts.push(m));
+  assert.equal(ok, false, 'no document under Node, so the textarea fallback fails too');
+  assert.equal(btn.icon.textContent, '📋');
+  assert.deepEqual(toasts, ['Could not copy to the clipboard. Try again.']);
+});
+Object.defineProperty(globalThis, 'navigator', { value: savedGlobals.navigator, configurable: true, writable: true });
+globalThis.location = savedGlobals.location;
+globalThis.setTimeout = savedGlobals.setTimeout;
+
 console.log(`\ntask-lib tests: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);