@bongos/core 1.25.13 → 1.25.14

package/tests/front_door_guide_existing.mjs

@@ -0,0 +1,238 @@
+// tests/front_door_guide_existing.mjs — the guide's branch for a visitor who already has
+// something (task 1005279): the guide asks early whether they are starting fresh, asks an
+// existing-project visitor what they have and what they want next, and plans from their
+// DESCRIPTION. The owner's hard rule: nothing they have made is read on the platform's AI
+// bill — no upload, no fetch, no link reading — so the tests pin the absence too: the
+// requests carry text only and no tools, no outbound request is made besides the (mocked)
+// model call, and the guide's routes have no upload path.
+//
+// The real routers over an in-memory db and a mocked Claude client: no key, no network,
+// no spend.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const db = require('../modules/front-door-guide/db.js');
+const claude = require('../modules/front-door-guide/claude.js');
+const SP = require('../modules/front-door-guide/starting-point.js');
+require('../modules/provisioning/seams.js').registerProvisioningSeams();
+
+const ENV = 'BONGOS_FRONT_DOOR_GUIDE_';
+
+// ---- in-memory db --------------------------------------------------------------------
+
+const convs = new Map();
+let calls = [];
+let seq = 0;
+const copy = (c) => c && JSON.parse(JSON.stringify(c));
+Object.assign(db, {
+  createConversation: async (tokenHash, visitorHash) => {
+    const c = { id: String(++seq), token_hash: tokenHash, visitor_hash: visitorHash, messages: [], visitor_messages: 0, spend_micro: 0, status: 'open', end_reason: null, created_at: new Date(Date.now() - 10_000).toISOString(), plan: null, builder_id: null, starting_point: null };
+    convs.set(c.id, c);
+    return copy(c);
+  },
+  setStartingPoint: async (id, sp) => { const c = convs.get(String(id)); c.starting_point = sp; return copy(c); },
+  getConversation: async (id, tokenHash) => { const c = convs.get(String(id)); return c && c.token_hash === tokenHash ? copy(c) : null; },
+  siteSpendMicro: async () => calls.reduce((s, r) => s + r.cost_micro, 0),
+  visitorUsage: async (v) => {
+    const mine = calls.filter((r) => r.visitor_hash === v);
+    return { messages: mine.filter((r) => r.kind === 'reply').length, spendMicro: mine.reduce((s, r) => s + r.cost_micro, 0) };
+  },
+  recordTurn: async (id, { messages, status, endReason }, call) => {
+    calls.push({ visitor_hash: call.visitorHash, cost_micro: call.costMicro, kind: 'reply' });
+    const c = convs.get(String(id));
+    Object.assign(c, { messages, status, end_reason: endReason, visitor_messages: c.visitor_messages + 1 });
+    return copy(c);
+  },
+  endConversation: async (id, reason) => Object.assign(convs.get(String(id)), { status: 'ended', end_reason: reason }),
+  savePlan: async (id, plan, call) => {
+    calls.push({ visitor_hash: call.visitorHash, cost_micro: call.costMicro, kind: 'plan' });
+    const c = convs.get(String(id));
+    Object.assign(c, { plan: c.plan || plan, status: 'ended', end_reason: 'planned' });
+    return copy(c);
+  },
+  recordPlanSpend: async () => {},
+});
+
+// ---- the mocked model, and a trap for any other outbound request ----------------------------
+
+let requests = [];
+let planText = null;
+claude.createClient = () => ({ messages: { create: async (req) => {
+  requests.push(req);
+  if (req.output_config && req.output_config.format) {
+    return { model: 'claude-opus-5-5', stop_reason: 'end_turn', usage: { input_tokens: 1500, output_tokens: 500 }, content: [{ type: 'text', text: planText }] };
+  }
+  return { model: 'claude-opus-5-5', stop_reason: 'end_turn', usage: { input_tokens: 700, output_tokens: 150 }, content: [{ type: 'text', text: 'What would you like to build next?' }] };
+} } });
+
+let outbound = [];
+const realFetch = globalThis.fetch;
+globalThis.fetch = async (url) => { outbound.push(String(url)); throw new Error('no outbound requests in this test'); };
+
+// ---- the real routers over http -----------------------------------------------------------
+
+const express = require('express');
+const app = express();
+app.set('trust proxy', true);
+app.use(express.json({ limit: '64kb' }));
+const chatRouter = require('../modules/front-door-guide/routes/front-door-guide.js')();
+const planRouter = require('../modules/front-door-guide/routes/front-door-guide-plan.js')();
+app.use('/api/bongos', chatRouter);
+app.use('/api/bongos', planRouter);
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const PORT = server.address().port;
+test.after(() => { server.close(); globalThis.fetch = realFetch; });
+
+let ipSeq = 0;
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request({ host: '127.0.0.1', port: PORT, method, path: `/api/bongos${path}`,
+      headers: { 'content-type': 'application/json', 'user-agent': 'Mozilla/5.0 (test browser)', 'x-forwarded-for': `10.7.0.${++ipSeq}` } }, (res) => {
+      let buf = '';
+      res.on('data', (c) => { buf += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: buf ? JSON.parse(buf) : null }));
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+function reset() {
+  for (const k of Object.keys(process.env)) if (k.startsWith(ENV)) delete process.env[k];
+  Object.assign(process.env, { [`${ENV}ANTHROPIC_API_KEY`]: 'sk-ant-TEST-ONLY-0123456789abcdef', [`${ENV}MIN_FIRST_MESSAGE_MS`]: '1', [`${ENV}STARTS_PER_HOUR`]: '1000', [`${ENV}MESSAGES_PER_MINUTE`]: '1000' });
+  convs.clear(); calls = []; requests = []; outbound = []; planText = null;
+}
+
+// Every request the platform sent its AI: text only, no tools, nothing attached.
+function assertTextOnly(reqs) {
+  for (const r of reqs) {
+    assert.equal(r.tools, undefined, 'no tools: the model cannot fetch or read anything');
+    assert.equal(r.mcp_servers, undefined);
+    assert.equal(r.container, undefined);
+    assert.equal(typeof r.system, 'string');
+    for (const m of r.messages) assert.equal(typeof m.content, 'string', 'no file, image or document blocks');
+  }
+  assert.deepEqual(outbound, [], 'no other outbound request was made');
+}
+
+// ---- asking early -------------------------------------------------------------------------
+
+test('without a starting point, the greeting asks it, with two answers to offer', async () => {
+  reset();
+  const st = await call('POST', '/front-door-guide/conversations', {});
+  assert.equal(st.status, 201);
+  assert.equal(st.body.greeting, SP.GREETINGS.unknown);
+  assert.match(st.body.greeting, /already have something/);
+  assert.deepEqual(st.body.starting_point_options, [{ value: 'fresh', label: 'Starting fresh' }, { value: 'existing', label: 'I already have something' }]);
+  assert.equal(st.body.conversation.starting_point, null);
+
+  const conv = st.body.conversation;
+  await call('POST', `/front-door-guide/conversations/${conv.id}/messages`, { token: conv.token, text: 'I want to make a recipe app.' });
+  assert.match(requests[0].system, /do not yet know whether this visitor is starting fresh/);
+  assert.match(requests[0].system, /cannot see, open or read any file, repository/);
+});
+
+test('a starting point can be given at the start, or with a message; anything else is refused', async () => {
+  reset();
+  const fresh = await call('POST', '/front-door-guide/conversations', { starting_point: 'fresh' });
+  assert.equal(fresh.body.greeting, SP.GREETINGS.fresh);
+  assert.equal(fresh.body.conversation.starting_point, 'fresh');
+
+  const bad = await call('POST', '/front-door-guide/conversations', { starting_point: 'github' });
+  assert.equal(bad.status, 400);
+
+  const st = await call('POST', '/front-door-guide/conversations', {});
+  const conv = st.body.conversation;
+  const r = await call('POST', `/front-door-guide/conversations/${conv.id}/messages`, { token: conv.token, text: 'I already have a half-built shop.', starting_point: 'existing' });
+  assert.equal(r.body.mode, 'chat');
+  assert.equal(r.body.conversation.starting_point, 'existing');
+  assert.match(requests[0].system, /This visitor already has something/, 'the reply already follows the answer');
+  assert.equal((await call('POST', `/front-door-guide/conversations/${conv.id}/messages`, { token: conv.token, text: 'x', starting_point: 'both' })).status, 400);
+});
+
+// ---- the existing-project branch -----------------------------------------------------------
+
+test('an existing project: the guide asks what they have and what is next, and plans from their words alone', async () => {
+  reset();
+  const st = await call('POST', '/front-door-guide/conversations', { starting_point: 'existing' });
+  assert.equal(st.body.greeting, SP.GREETINGS.existing);
+  assert.match(st.body.greeting, /cannot open files or links/);
+  const conv = st.body.conversation;
+  const say = (text) => call('POST', `/front-door-guide/conversations/${conv.id}/messages`, { token: conv.token, text });
+
+  await say('I have a Node app for booking yoga classes, about half done, on github.com/someone/yoga-app.');
+  await say('Next I want online payments and a teacher dashboard.');
+  const system = requests[0].system;
+  assert.match(system, /ask what they have \(code, documents, artwork or something else, and how far along it is\) and what they want to build next/);
+  assert.match(system, /Never ask them to paste code, upload files or share links/);
+  assert.match(system, /If they paste a link, say you cannot open links/);
+
+  // The plan: the visitor's answer decides the starting point, even if the model said otherwise.
+  planText = JSON.stringify({
+    summary: 'Finish a yoga booking app and add payments and a teacher dashboard.',
+    starting_point: 'fresh',
+    what_you_have: ['A Node booking app, about half done', 'Code on GitHub'],
+    project_type: 'business', how_it_works: ['You decide; AI builders do small tasks.'],
+    modules: [], steps: [{ title: 'Sign up', detail: '' }, { title: 'Bring in your existing work', detail: 'Your own AI looks through it.' }],
+    needs: [{ item: 'A payments account', detail: '' }], open_questions: [],
+  });
+  const plan = await call('POST', `/front-door-guide/conversations/${conv.id}/plan`, { token: conv.token });
+  assert.equal(plan.body.mode, 'plan');
+  assert.equal(plan.body.plan.starting_point, 'existing');
+  assert.deepEqual(plan.body.plan.what_you_have, ['A Node booking app, about half done', 'Code on GitHub']);
+
+  const planReq = requests.find((r) => r.output_config.format);
+  const props = planReq.output_config.format.schema.properties;
+  assert.deepEqual(props.starting_point.enum, ['fresh', 'existing']);
+  assert.equal(props.what_you_have.type, 'array');
+  assert.match(planReq.system, /"existing" \(the visitor said so\)/);
+  assert.match(planReq.system, /Only what they described: you have seen none of it/);
+
+  // Nothing they have made reached the platform's AI: text only, no tools, no fetch of the link.
+  assertTextOnly(requests);
+  const sent = requests.flatMap((r) => r.messages.map((m) => m.content)).join('\n');
+  assert.ok(sent.includes('github.com/someone/yoga-app'), 'the link is only their words');
+  assert.equal(outbound.length, 0, 'and it was never opened');
+});
+
+test('a fresh project plans with nothing listed as already made', async () => {
+  reset();
+  const st = await call('POST', '/front-door-guide/conversations', { starting_point: 'fresh' });
+  const conv = st.body.conversation;
+  await call('POST', `/front-door-guide/conversations/${conv.id}/messages`, { token: conv.token, text: 'A garden planner.' });
+  planText = JSON.stringify({ summary: 'A garden planner.', starting_point: 'existing', what_you_have: [], project_type: 'not-sure', how_it_works: [], modules: [], steps: [], needs: [], open_questions: [] });
+  const plan = await call('POST', `/front-door-guide/conversations/${conv.id}/plan`, { token: conv.token });
+  assert.equal(plan.body.plan.starting_point, 'fresh');
+  assert.deepEqual(plan.body.plan.what_you_have, []);
+  assert.match(requests[0].system, /starting fresh, from an idea/);
+  assertTextOnly(requests);
+});
+
+// ---- no path for reading their work ------------------------------------------------------
+
+test('the guide has no upload, fetch or link-reading path: these are all its routes', () => {
+  const routes = (r) => r.stack.filter((l) => l.route).map((l) => `${Object.keys(l.route.methods)[0].toUpperCase()} ${l.route.path}`);
+  assert.deepEqual([...routes(chatRouter), ...routes(planRouter)].sort(), [
+    'GET /front-door-guide/conversations/:id',
+    'GET /front-door-guide/mine',
+    'GET /front-door-guide/status',
+    'POST /front-door-guide/conversations',
+    'POST /front-door-guide/conversations/:id/attach',
+    'POST /front-door-guide/conversations/:id/messages',
+    'POST /front-door-guide/conversations/:id/plan',
+  ]);
+});
+
+test('every instruction version carries the no-reading rule', () => {
+  for (const sp of [null, 'fresh', 'existing']) {
+    assert.match(SP.instructionsFor(sp), /You cannot see, open or read any file, repository, code, document, image or link/);
+  }
+  assert.equal(SP.greetingFor('nonsense'), SP.GREETINGS.unknown);
+});

package/tests/genesis_home.mjs

@@ -73,6 +73,23 @@ test('the board read groups genesis tasks by the stage their ref names', async (
   assert.deepEqual(out.scope.map((t) => t.id), ['1', '2']);
 });
 
+test('the board read carries each genesis task\'s description, for its Copy prompt (task 1005109)', async () => {
+  let seen = '';
+  const pool = { query: async (sql) => {
+    seen = sql;
+    return { rows: [
+      { id: 7, title: 'Write the scope', status: 'ready', description: 'Answer the five scope questions.', source_ref: 'genesis:scope' },
+      { id: 8, title: 'Old row', status: 'ready', description: null, source_ref: 'genesis:charter' },
+    ] };
+  } };
+  const out = await seed.genesisStageTasks({ pool });
+  assert.match(seen, /\bdescription\b/, 'the SELECT reads the description');
+  assert.equal(out.scope[0].description, 'Answer the five scope questions.');
+  assert.equal(out.charter[0].description, '', 'a null description is an empty string, never "null"');
+  const g = gh.shapeGenesis({ mode: { stage: 'scope', stage_number: 1, stage_count: 5, day: 1 }, plan: gh.parsePlan({}).plan, tasks: out });
+  assert.equal(g.stages[0].tasks[0].description, 'Answer the five scope questions.', 'the genesis view passes it through');
+});
+
 // ── the plan ─────────────────────────────────────────────────────────────────
 
 test('an empty plan is the recommended defaults: the solo fast-track is one click', () => {
@@ -361,25 +378,60 @@ test('every genesis write is the project owner\'s; the read is any signed-in bui
 
 const CARD = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'genesis-home.js'), 'utf8');
 
+const TASK_LIB = fs.readFileSync(path.join(ROOT, 'modules', 'hall-ui', 'public', 'task-lib.js'), 'utf8');
+
 function bootCard({ founding, data = { genesis: null } }) {
   const calls = [];
+  const copied = [];
+  const toasts = [];
   let widget = null;
   let observer = null;
   const attrs = founding ? { 'data-founding': 'on' } : {};
   const sandbox = {
     window: {
-      OTB: { escapeHtml: (s) => String(s), statusPill: (s) => `<span>${s}</span>`, contributeHallWidget: (w) => { widget = w; } },
+      OTB: { escapeHtml: (s) => String(s), statusPill: (s) => `<span>${s}</span>`, contributeHallWidget: (w) => { widget = w; }, toast: (m) => toasts.push(m) },
       BongosClient: { createClient: () => ({ request: async (m, p) => { calls.push(`${m} ${p}`); return { ok: true, status: 200, data }; } }) },
     },
+    navigator: { clipboard: { writeText: async (t) => { copied.push(t); } } },
+    location: { hostname: 'builders.example.test', origin: 'https://builders.example.test' },
     document: { documentElement: { getAttribute: (k) => attrs[k] || null } },
     MutationObserver: class { constructor(fn) { observer = fn; } observe() {} disconnect() {} },
+    setTimeout: () => 0,
     Promise,
   };
   vm.createContext(sandbox);
+  // The hall's real prompt builder, loaded as index.html loads it (before the card).
+  vm.runInContext(TASK_LIB, sandbox, { filename: 'task-lib.js' });
   vm.runInContext(CARD, sandbox, { filename: 'genesis-home.js' });
   const host = { hidden: true, innerHTML: '', addEventListener() {}, querySelector: () => null, querySelectorAll: () => [] };
   widget.mount(host);
-  return { widget, host, calls, attrs, fire: () => observer && observer() };
+  return { widget, host, calls, copied, toasts, attrs, fire: () => observer && observer() };
+}
+
+// Re-mount a booted card so its click handler is captured; returns a click(btn) driver.
+async function mountClickable(b) {
+  let onClick = null;
+  b.host.addEventListener = (type, fn) => { if (type === 'click') onClick = fn; };
+  b.host.contains = () => true;
+  b.widget.mount(b.host);
+  await new Promise((r) => setImmediate(r));
+  await new Promise((r) => setImmediate(r));
+  return async (btn) => {
+    onClick({ target: { closest: () => btn } });
+    for (let i = 0; i < 4; i++) await new Promise((r) => setImmediate(r));
+  };
+}
+
+// A fake button carrying one data attribute, as the click handler reads it.
+function fakeButton(attr, value) {
+  const set = {};
+  return {
+    set,
+    hasAttribute: (k) => k === attr,
+    getAttribute: (k) => (k === attr ? value : null),
+    setAttribute: (k, v) => { set[k] = v; },
+    querySelector: () => null,
+  };
 }
 
 test('the card registers in the Home banner, ahead of the welcome, hidden by default', () => {
@@ -459,6 +511,32 @@ test('the card lists every stage vote waiting on the viewer, and votes yes on al
   ], 'one yes per stage, earliest first');
 });
 
+test('each open stage task has Copy prompt, and it copies the task\'s own words (task 1005109)', async () => {
+  const genesis = gh.shapeGenesis({
+    mode: { stage: 'scope', stage_number: 1, stage_count: 5, day: 1 },
+    plan: gh.parsePlan({}).plan,
+    tasks: { scope: [
+      { id: '201', title: 'Gather what already exists', status: 'shipped', description: 'Link the documents.' },
+      { id: '202', title: 'Write the scope', status: 'ready', description: 'Answer the five scope questions in your own words.' },
+    ] },
+  });
+  const b = bootCard({ founding: true, data: { genesis, viewer_id: '1' } });
+  const click = await mountClickable(b);
+  const html = b.host.innerHTML;
+  assert.match(html, /data-genesis-copy="202"/, 'the open task offers Copy prompt');
+  assert.doesNotMatch(html, /data-genesis-copy="201"/, 'a shipped task offers nothing');
+  assert.doesNotMatch(html, /task__claim|>Claim</, 'Copy prompt only: no Claim button (owner, 2026-11-07)');
+  const btn = fakeButton('data-genesis-copy', '202');
+  await click(btn);
+  assert.equal(b.copied.length, 1, 'one click, one copy');
+  const text = b.copied[0];
+  assert.doesNotMatch(text, /\(no description\)/, 'the copied prompt is never the empty fallback');
+  assert.match(text, /Answer the five scope questions in your own words\./, 'it carries the task\'s description');
+  assert.match(text, /Bongos task 202 \(Write the scope\)/, 'built by the hall\'s one prompt builder');
+  assert.equal(btn.set['data-copied'], '1');
+  assert.match(b.toasts.join(' '), /copied/i);
+});
+
 test('the hall carries the five life plates byte-identical to the world\'s', () => {
   const world = path.join(ROOT, 'modules', 'public-landing', 'public', 'assets', 'world');
   const hall = path.join(ROOT, 'modules', 'hall-ui', 'public', 'genesis');

package/tests/package_core.mjs

@@ -363,15 +363,15 @@ t('TAR_ROOT is the npm-required "package/" (not the ARTIFACT_NAME dir)', () => {
   assert.equal(TAR_ROOT, 'package/');
 });
 
-t('buildPackageJson: prunes to express+pg+pino, keeps the source ranges + the undici override', () => {
+t('buildPackageJson: prunes to the core deps, keeps the source ranges + the undici override', () => {
   const pkg = buildPackageJson({
     version: '1.14.0',
-    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
+    sourceDeps: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', '@simplewebauthn/browser': '^13.3.0', '@simplewebauthn/server': '^13.3.3', phaser: '^3.87.0', 'discord.js': '^14.26.4' },
     sourceOverrides: { undici: '^6.27.0' },
   });
   assert.equal(pkg.name, '@bongos/core');
   assert.equal(pkg.version, '1.14.0');
-  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0' });
+  assert.deepEqual(pkg.dependencies, { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', '@simplewebauthn/browser': '^13.3.0', '@simplewebauthn/server': '^13.3.3' });
   assert.equal(pkg.dependencies.phaser, undefined);
   assert.equal(pkg.dependencies['discord.js'], undefined);
   assert.deepEqual(pkg.overrides, { undici: '^6.27.0' });
@@ -450,7 +450,7 @@ t('the publish lane sets no long-lived npm credential (OIDC only)', () => {
 });
 
 t('buildPackageJson: omits `overrides` when the source has none', () => {
-  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0', '@simplewebauthn/browser': '^13.0.0', '@simplewebauthn/server': '^13.0.0' } });
   assert.equal(pkg.overrides, undefined);
 });
 
@@ -458,8 +458,10 @@ t('buildPackageJson: throws when a required core dep is missing from the source'
   assert.throws(() => buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0' } }), /missing required core dependency "pg"/);
 });
 
-t('CORE_DEP_NAMES is exactly [express, pg, pino]', () => {
-  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg', 'pino']);
+// The security-card libraries are core runtime deps: routes/my-passkeys.js serves the browser bundle
+// and requires the server lib. Left out, every packaged instance answers bundle_missing (task 1005269).
+t('CORE_DEP_NAMES is exactly [express, pg, pino, @simplewebauthn/browser, @simplewebauthn/server]', () => {
+  assert.deepEqual(CORE_DEP_NAMES, ['express', 'pg', 'pino', '@simplewebauthn/browser', '@simplewebauthn/server']);
 });
 
 // A tiny synthetic lockfile fixture with a THREE-level chain (root -> a -> b) and
@@ -542,7 +544,9 @@ t('prunePackageLock: on the real repo lockfile, drops the vast majority of packa
   });
   const keptCount = Object.keys(pruned.packages).length - 1; // exclude the root '' entry
   const sourceCount = Object.keys(realLock.packages).length - 1;
-  assert.ok(keptCount < sourceCount / 2, `expected a real prune (kept ${keptCount} of ${sourceCount})`);
+  // Under two thirds: the card libraries (task 1005269) added their certificate-parsing closure, taking the
+  // kept share from ~44% to ~55%. That the game deps stay out is asserted by the closure test above.
+  assert.ok(keptCount < sourceCount * 2 / 3, `expected a real prune (kept ${keptCount} of ${sourceCount})`);
   assert.ok(keptCount > 0);
 });
 

package/tests/pruned_lockfile_integrity.mjs

@@ -34,7 +34,7 @@ const isRegistryResolved = (v) => typeof v.resolved === 'string' && /^https?:\/\
 
 const pruned = prunePackageLock(realLock, {
   name: '@bongos/core', version: '0.0.0-test',
-  rootRanges: { express: '^4.21.2', pg: '^8.20.0' },
+  rootRanges: { express: '^4.21.2', pg: '^8.20.0', pino: '^9.14.0', '@simplewebauthn/browser': '^13.3.0', '@simplewebauthn/server': '^13.3.3' },
 });
 
 t('pruned lockfile: non-trivial and closes over the core deps (express + pg present)', () => {
@@ -42,6 +42,8 @@ t('pruned lockfile: non-trivial and closes over the core deps (express + pg pres
   assert.ok(keys.length > 2, `pruned lockfile is suspiciously empty (${keys.length} entries)`);
   assert.ok(pruned.packages['node_modules/express'], 'express missing from the pruned closure');
   assert.ok(pruned.packages['node_modules/pg'], 'pg missing from the pruned closure');
+  assert.ok(pruned.packages['node_modules/@simplewebauthn/browser'], 'card browser library missing from the pruned closure');
+  assert.ok(pruned.packages['node_modules/@simplewebauthn/server'], 'card server library missing from the pruned closure');
 });
 
 t('pruned lockfile: EVERY registry-resolved package keeps a well-formed integrity hash (R88 guard)', () => {
@@ -72,7 +74,7 @@ t('pruned lockfile: integrity hashes match the SOURCE lockfile verbatim (not rew
 });
 
 t('CORE_DEP_NAMES: the pin domain is exactly the runtime core deps (express + pg + pino)', () => {
-  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg') && CORE_DEP_NAMES.includes('pino'));
+  assert.ok(Array.isArray(CORE_DEP_NAMES) && CORE_DEP_NAMES.includes('express') && CORE_DEP_NAMES.includes('pg') && CORE_DEP_NAMES.includes('pino') && CORE_DEP_NAMES.includes('@simplewebauthn/browser') && CORE_DEP_NAMES.includes('@simplewebauthn/server'));
 });
 
 console.log(`\npruned_lockfile_integrity: ${passed} passed, ${failed} failed`);

package/tests/status_page_no_dead_uptime.mjs

@@ -69,7 +69,7 @@ test('the server no longer registers GET /public/uptime', () => {
 
 test('the core package exports only files that exist, and the codemod maps only exported subpaths', () => {
   const { buildPackageJson } = require('../scripts/bongos/package-core.js');
-  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0' } });
+  const pkg = buildPackageJson({ version: '1.0.0', sourceDeps: { express: '^4.0.0', pg: '^8.0.0', pino: '^9.0.0', '@simplewebauthn/browser': '^13.0.0', '@simplewebauthn/server': '^13.0.0' } });
   for (const [sub, target] of Object.entries(pkg.exports)) {
     assert.ok(existsSync(join(ROOT, target)), `export ${sub} points at missing ${target}`);
   }

package/tests/task_lib.mjs

@@ -136,5 +136,51 @@ t('conflictChipHtml: empty for none, count + capped list for many', () => {
   assert.doesNotMatch(many, /#6/);
 });
 
+// task 1005109 — the one Copy prompt click, shared by the Tasks board, a goal's to-do
+// list and the Genesis stage list. Runs against fake browser globals.
+async function at(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+function fakeBtn() {
+  const icon = { textContent: '📋' };
+  const attrs = {};
+  return { icon, attrs, querySelector: (sel) => (sel === '.task__copy-icon' ? icon : null), setAttribute: (k, v) => { attrs[k] = v; } };
+}
+const savedGlobals = { navigator: globalThis.navigator, location: globalThis.location, setTimeout: globalThis.setTimeout };
+function stubGlobals(writeText) {
+  Object.defineProperty(globalThis, 'navigator', { value: { clipboard: { writeText } }, configurable: true, writable: true });
+  globalThis.location = { hostname: 'builders.example.test', origin: 'https://builders.example.test' };
+  globalThis.setTimeout = () => 0;
+}
+
+await at('copyTaskPrompt copies the task\'s own words, flips the button, says one sentence', async () => {
+  const copied = [];
+  const toasts = [];
+  stubGlobals(async (x) => { copied.push(x); });
+  const btn = fakeBtn();
+  const ok = await T.copyTaskPrompt({ id: 42, title: 'Write the scope', description: 'Answer the questions.' }, btn, (m) => toasts.push(m));
+  assert.equal(ok, true);
+  assert.equal(copied.length, 1);
+  assert.match(copied[0], /Answer the questions\./);
+  assert.doesNotMatch(copied[0], /\(no description\)/);
+  assert.equal(btn.icon.textContent, '✓');
+  assert.equal(btn.attrs['data-copied'], '1');
+  assert.deepEqual(toasts, ['Prompt for task 42 copied to your clipboard.']);
+});
+
+await at('copyTaskPrompt: a refused clipboard with no fallback says so and leaves the button alone', async () => {
+  const toasts = [];
+  stubGlobals(async () => { throw new Error('denied'); });
+  const btn = fakeBtn();
+  const ok = await T.copyTaskPrompt({ id: 7, title: 'x', description: 'y' }, btn, (m) => toasts.push(m));
+  assert.equal(ok, false, 'no document under Node, so the textarea fallback fails too');
+  assert.equal(btn.icon.textContent, '📋');
+  assert.deepEqual(toasts, ['Could not copy to the clipboard. Try again.']);
+});
+Object.defineProperty(globalThis, 'navigator', { value: savedGlobals.navigator, configurable: true, writable: true });
+globalThis.location = savedGlobals.location;
+globalThis.setTimeout = savedGlobals.setTimeout;
+
 console.log(`\ntask-lib tests: ${passed} passed, ${failed} failed`);
 if (failed) process.exit(1);