@bongos/core 1.25.21 → 1.25.23

package/src/sandbox/index.js

@@ -0,0 +1,144 @@
+'use strict';
+// src/sandbox/index.js — what a project's app loads to behave as a sandbox (task 1005291;
+// ADR 0406 §5). Published as `@bongos/core/sandbox`.
+//
+// WHY. A project's sandbox is a free copy of its app that takes every finished change first
+// (ADR 0406). It must be visibly a sandbox, and — when the owner lends a real key so it can
+// show real data — it must only read. One line at the top of a Node app does both:
+//
+//     const sandbox = require('@bongos/core/sandbox').install();
+//     app.use(sandbox.middleware);          // Express-style apps; optional
+//
+// `install()` does nothing at all unless BONGOS_SANDBOX=1 (which only the sandbox service
+// carries), so the same code runs unchanged on the live site. In a sandbox it:
+//   - puts the outbound gate (gate.js) in front of fetch, http and https;
+//   - gives `middleware`, which adds a "Sandbox" band to every HTML page and serves
+//     /__bongos/sandbox: what was refused, which real keys are lent, and what the gate
+//     cannot catch;
+//   - writes every refusal to the log as `[bongos-sandbox] refused …`, which Render shows.
+//
+// Fake data is the app's own to seed: `isSandbox()` lets it seed only here.
+
+const { makeLog, wrapFetch, wrapHttp } = require('./gate');
+
+const PAGE = '/__bongos/sandbox';
+let state = null;
+
+function isSandbox(env = process.env) { return String(env.BONGOS_SANDBOX || '') === '1'; }
+
+// Which REAL keys are lent, by provider and kind, never by value: a live key shape in an
+// env var. A restricted / read-only key is named as such, because it is the safe floor.
+const KEY_SHAPES = [
+  { re: /^sk_live_/, says: 'Stripe — a full live secret key. Prefer a restricted key with read access only.', safe: false },
+  { re: /^rk_live_/, says: 'Stripe — a restricted live key. Good: check it has read access only.', safe: true },
+  { re: /^SG\./, says: 'SendGrid — a live API key. Prefer a key with read access only.', safe: false },
+  { re: /^key-[0-9a-f]{32}$/, says: 'Mailgun — a live API key.', safe: false },
+  { re: /^re_[A-Za-z0-9]{8,}/, says: 'Resend — a live API key.', safe: false },
+  { re: /^xox[bpa]-/, says: 'Slack — a live token.', safe: false },
+  { re: /^gh[pousr]_[A-Za-z0-9]{20,}/, says: 'GitHub — a live token. Prefer a fine-grained token with read access only.', safe: false },
+];
+function lentKeys(env = process.env) {
+  const out = [];
+  for (const [name, value] of Object.entries(env)) {
+    const v = String(value || '');
+    const k = KEY_SHAPES.find((s) => s.re.test(v));
+    if (k) out.push({ variable: name, says: k.says, readOnly: k.safe });
+  }
+  return out;
+}
+
+const { escapeHtml: esc } = require('../html-escape'); // the one server-side escaper (task 1004876)
+
+/** The band every page carries: plain, fixed, on top, with a link to what it means. It names
+ *  no count: what was refused is the owner's to see (pageHtml), not every visitor's. */
+function bandHtml() {
+  return `<div id="bongos-sandbox-band" role="note" style="position:sticky;top:0;z-index:2147483647;background:#ffd84d;color:#111;font:600 14px/1.4 system-ui,sans-serif;padding:8px 14px;text-align:center;border-bottom:2px solid #111">`
+    + `Sandbox — a test copy of this site. Nothing here reaches real customers.`
+    + ` <a href="${PAGE}" style="color:#111;text-decoration:underline">What this sandbox does</a></div>`;
+}
+
+// Whether a visitor carries this sandbox's page key (BONGOS_SANDBOX_PAGE_KEY, set by the
+// platform when it made the sandbox; the owner's project page links with it). Without it
+// the page says what a sandbox is and what it cannot catch, and nothing else: which real
+// keys are lent and which calls were refused are the owner's to see, not a passer-by's.
+function carriesKey(given, env = process.env) {
+  const want = String(env.BONGOS_SANDBOX_PAGE_KEY || '');
+  const got = String(given || '');
+  if (want.length < 32 || got.length !== want.length) return false;
+  return require('node:crypto').timingSafeEqual(Buffer.from(got), Buffer.from(want));
+}
+
+/** The sandbox's own page. `owner` adds the refusals and the lent keys. */
+function pageHtml(log, env = process.env, { owner = false } = {}) {
+  const keys = lentKeys(env);
+  const rows = log.items.map((r) => `<li><b>${esc(r.provider)}</b>: would ${esc({ send: 'send a message', charge: 'take or move a payment', write: 'change a record' }[r.kind] || r.kind)} — ${esc(r.method)} ${esc(r.target)} <small>${esc(r.at)}</small></li>`).join('');
+  return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sandbox</title></head>`
+    + `<body style="font:16px/1.5 system-ui,sans-serif;max-width:720px;margin:0 auto;padding:16px">`
+    + `<h1>This is a sandbox</h1>`
+    + `<p>A test copy of your app. Every finished change reaches it first; your live site changes only when you promote.</p>`
+    + (owner
+      ? `<h2>Refused calls</h2>`
+        + (rows ? `<ul>${rows}</ul>` : `<p>Nothing has been refused since this copy last started.</p>`)
+        + `<h2>Real keys lent to it</h2>`
+        + (keys.length ? `<ul>${keys.map((k) => `<li><code>${esc(k.variable)}</code>: ${esc(k.says)}</li>`).join('')}</ul>` : `<p>None that the sandbox recognises. With test keys or none, nothing it does is real.</p>`)
+      : `<p>The project's owner sees what this copy refused from their project page.</p>`)
+    + `<h2>What this cannot catch</h2>`
+    + `<p>Reads to a known provider go out; sends, charges and writes to it are refused. It only sees calls this app makes through Node's own web requests, and only to the providers it knows. Code that goes around them, or a provider it does not know, is not stopped. A read-only key is the real protection; this is the second wall.</p>`
+    + `<p>The free plan also blocks outgoing email ports, so this copy cannot send email directly.</p>`
+    + `</body></html>`;
+}
+
+/** An Express/Connect-style middleware: the page, and the band on every HTML answer. */
+function makeMiddleware(log, env = process.env) {
+  return function bongosSandbox(req, res, next) {
+    if (req.method === 'GET' && String(req.url || '').split('?')[0] === PAGE) {
+      const given = new URL(String(req.url), 'http://sandbox.invalid').searchParams.get('key');
+      res.statusCode = 200;
+      res.setHeader('content-type', 'text/html; charset=utf-8');
+      res.setHeader('cache-control', 'no-store');
+      res.setHeader('referrer-policy', 'no-referrer');
+      return res.end(pageHtml(log, env, { owner: carriesKey(given, env) }));
+    }
+    const end = res.end;
+    const chunks = [];
+    const write = res.write;
+    const isHtml = () => /text\/html/i.test(String(res.getHeader && res.getHeader('content-type') || ''));
+    res.write = function (chunk, ...rest) {
+      if (!isHtml()) return write.call(this, chunk, ...rest);
+      if (chunk) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+      return true;
+    };
+    res.end = function (chunk, ...rest) {
+      if (!isHtml()) return end.call(this, chunk, ...rest);
+      if (chunk && typeof chunk !== 'function') chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+      let html = Buffer.concat(chunks).toString('utf8');
+      const band = bandHtml();
+      html = /<body[^>]*>/i.test(html) ? html.replace(/<body[^>]*>/i, (m) => m + band) : band + html;
+      if (res.removeHeader) res.removeHeader('content-length');
+      return end.call(this, html);
+    };
+    next();
+  };
+}
+
+const passThrough = (req, res, next) => next();
+
+/**
+ * Turn the app into a sandbox when BONGOS_SANDBOX=1; otherwise change nothing. Safe to call
+ * more than once. Returns { active, middleware, refusals, bandHtml, isSandbox }.
+ */
+function install({ env = process.env, fetchHost = globalThis, http = require('node:http'), https = require('node:https'), write } = {}) {
+  if (!isSandbox(env)) return { active: false, middleware: passThrough, refusals: [], bandHtml: () => '', isSandbox: false };
+  if (!state) {
+    const log = makeLog(write ? { write } : {});
+    if (typeof fetchHost.fetch === 'function') fetchHost.fetch = wrapFetch(fetchHost.fetch, log);
+    wrapHttp(http, log);
+    wrapHttp(https, log);
+    state = { log, middleware: makeMiddleware(log, env) };
+  }
+  return { active: true, middleware: state.middleware, refusals: state.log.items, bandHtml, isSandbox: true };
+}
+
+// The public surface: install() and isSandbox() for the app; pageHtml and PAGE for the tests
+// and the provisioning module's pinned copy of the path.
+module.exports = { install, isSandbox, pageHtml, PAGE };

package/tests/folder_upload_project.mjs

@@ -0,0 +1,396 @@
+// tests/folder_upload_project.mjs — create a project by uploading a folder (task 1005282).
+//
+// A person with a folder of papers, artwork or scaffolding and no repository creates a
+// project from it in the browser; Bongos makes the private repository and commits the
+// files. What this pins, over the REAL route (POST /github/repos/upload) mounted over HTTP,
+// GitHub faked at the fetch boundary and the files pushed by REAL git into a local bare repo:
+//   1. a folder of non-code files becomes a private repo with every file committed, byte-equal;
+//   2. an over-limit upload (one file too big, the folder too big, too many files) is refused
+//      with a plain reason BEFORE GitHub is asked for anything;
+//   3. refused file types (programs, archives, key files) are named with their reason;
+//   4. unsafe paths (traversal, absolute, git internals, workflows, platform files,
+//      duplicates) are refused, and nothing is created;
+//   5. a push that fails after the repo was made can be retried into THAT repo only.
+//
+// Run:  node --test tests/folder_upload_project.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import vm from 'node:vm';
+import { execFileSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+process.env.BUILDER_SECRET_KEY = process.env.BUILDER_SECRET_KEY || 'ab'.repeat(32);
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+// ── fake GitHub, at the fetch boundary ──────────────────────────────────────────────
+const realFetch = globalThis.fetch;
+const ghCalls = [];
+globalThis.fetch = async (url, init = {}) => {
+  if (!String(url).startsWith('https://api.github.com/')) return realFetch(url, init);
+  const u = new URL(String(url));
+  const key = `${(init.method || 'GET').toUpperCase()} ${u.pathname}`;
+  const body = init.body ? JSON.parse(init.body) : null;
+  ghCalls.push({ key, body });
+  if (key === 'POST /user/repos') {
+    return new Response(JSON.stringify({ full_name: `founder/${body.name}`, html_url: `https://github.com/founder/${body.name}` }), { status: 201 });
+  }
+  return new Response('{"message":"Not Found"}', { status: 404 });
+};
+
+const db = require(path.join(ROOT, 'src/bongos/db.js'));
+db.getGithubToken = async () => ({ token: 'tok', scope: 'read:user,repo' });
+db.deleteGithubToken = async () => {};
+const auth = require(path.join(ROOT, 'src/bongos/auth.js'));
+auth.requireBuilder = (req, _res, next) => { req.builder = { id: 7, github_login: 'founder' }; next(); };
+
+const folderUpload = require(path.join(ROOT, 'src/bongos/folder-upload.js'));
+const { UPLOAD_LIMITS, checkFolderUpload, pushFolderToRepo } = folderUpload;
+
+// ── each pushed repo is a local bare repo; the real push runs real git into it ─────
+const TMP = fs.mkdtempSync(path.join(os.tmpdir(), 'folder-upload-test-'));
+const bare = {};   // "owner/name" → bare repo dir
+const pushes = [];
+let failNextPush = false;
+let holdPushes = null;   // a promise every push waits on, to hold uploads in flight
+function bareFor(owner, repo) {
+  const key = `${owner}/${repo}`;
+  if (!bare[key]) {
+    bare[key] = path.join(TMP, `${owner}-${repo}.git`);
+    execFileSync('git', ['init', '-q', '--bare', bare[key]]);
+  }
+  return bare[key];
+}
+const testPush = async (args) => {
+  pushes.push({ owner: args.owner, repo: args.repo, files: args.files.length, author: args.author });
+  if (holdPushes) await holdPushes;
+  if (failNextPush) { failNextPush = false; throw Object.assign(new Error('git failed'), { code: 'GIT_FAILED', stderr: 'remote: boom' }); }
+  return pushFolderToRepo({ ...args, remoteUrl: bareFor(args.owner, args.repo) });
+};
+const git = (dir, ...a) => execFileSync('git', ['--git-dir', dir, ...a], { encoding: 'utf8' });
+
+const express = require('express');
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+const buildGithubRouter = require(path.join(ROOT, 'src/bongos/routes/github.js'));
+let server, origin;
+before(async () => {
+  const app = express();
+  app.use(attachFail);
+  app.use('/api/bongos', buildGithubRouter({ pushFolderToRepo: testPush }));
+  server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  origin = `http://127.0.0.1:${server.address().port}`;
+});
+after(() => { server.close(); globalThis.fetch = realFetch; fs.rmSync(TMP, { recursive: true, force: true }); });
+
+const b64 = (s) => Buffer.from(s).toString('base64');
+const file = (p, content) => ({ path: p, data: b64(content) });
+async function upload(body) {
+  const res = await realFetch(`${origin}/api/bongos/github/repos/upload`, {
+    method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),
+  });
+  return { status: res.status, body: await res.json().catch(() => ({})) };
+}
+function reset() { ghCalls.length = 0; pushes.length = 0; }
+
+// a few bytes that are not text: a PNG header and a NUL
+const PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0x00, 0xff, 0x10]);
+
+// ── 1. a folder of non-code files becomes a project with its files committed ───────
+test('a folder of papers and artwork becomes a private repo with every file committed', async () => {
+  reset();
+  const files = [
+    file('Proposal.md', '# The plan\n\nA community garden.\n'),
+    file('papers/Budget 2026.csv', 'item,cost\nseeds,40\r\n'),
+    { path: 'artwork/logo.png', data: PNG.toString('base64') },
+    file('notes/meeting notes.txt', 'Tuesday: soil tests.'),
+    file('.DS_Store', 'junk'),
+    file('node_modules/x/index.js', 'module.exports=1'),
+  ];
+  const r = await upload({ name: 'garden', files });
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(r.body.repo.full_name, 'founder/garden');
+  assert.equal(r.body.uploaded.files, 4);
+  assert.deepEqual(r.body.uploaded.skipped.sort(), ['.DS_Store', 'node_modules/x/index.js']);
+
+  const create = ghCalls.find((c) => c.key === 'POST /user/repos');
+  assert.ok(create, 'the repo was made on the person’s own account');
+  assert.equal(create.body.private, true, 'a repo made from a folder is private');
+  assert.equal(create.body.auto_init, false, 'empty, so the folder is its first commit');
+
+  const dir = bare['founder/garden'];
+  const tree = git(dir, 'ls-tree', '-r', '--name-only', 'main').trim().split('\n').sort();
+  assert.deepEqual(tree, ['Proposal.md', 'artwork/logo.png', 'notes/meeting notes.txt', 'papers/Budget 2026.csv']);
+  assert.ok(Buffer.from(execFileSync('git', ['--git-dir', dir, 'show', 'main:artwork/logo.png'])).equals(PNG), 'binary artwork arrives byte-equal');
+  assert.equal(git(dir, 'show', 'main:papers/Budget 2026.csv'), 'item,cost\nseeds,40\r\n', 'line endings untouched');
+  assert.equal(git(dir, 'rev-list', '--count', 'main').trim(), '1', 'one commit on main');
+  assert.match(git(dir, 'log', '-1', '--format=%an <%ae>', 'main'), /^founder <founder@users\.noreply\.github\.com>/);
+});
+
+// ── 2. over the limits: refused before anything is created ─────────────────────────
+test('a file over 25 MB is refused with its reason, and GitHub is never asked', async () => {
+  reset();
+  const big = 'A'.repeat(Math.ceil(((UPLOAD_LIMITS.fileBytes + 1) * 4) / 3 / 4) * 4);
+  const r = await upload({ name: 'films', files: [file('ok.txt', 'hi'), { path: 'film.mov', data: big }] });
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error.code, 'upload_refused');
+  assert.match(r.body.error.message, /nothing was created/i);
+  assert.deepEqual(r.body.error.details.problems.map((p) => [p.path, p.code]), [['film.mov', 'file_too_big']]);
+  assert.match(r.body.error.details.problems[0].reason, /25 MB/);
+  assert.equal(ghCalls.length, 0, 'no repo was made');
+  assert.equal(pushes.length, 0);
+});
+
+test('a folder over 50 MB is refused with a plain reason before anything is created', async () => {
+  reset();
+  const each = 'A'.repeat(Math.floor((17 * 1024 * 1024 * 4) / 3 / 4) * 4);   // ~17 MB each, 51 MB in all
+  const r = await upload({ name: 'archive', files: [{ path: 'a.bin', data: each }, { path: 'b.bin', data: each }, { path: 'c.bin', data: each }] });
+  assert.equal(r.status, 400);
+  assert.equal(r.body.error.code, 'upload_too_big');
+  assert.match(r.body.error.message, /the most a folder can be is 50 MB\. Nothing was created\./);
+  assert.equal(ghCalls.length, 0);
+});
+
+test('more than 1,000 files is refused before anything is created', () => {
+  const files = Array.from({ length: UPLOAD_LIMITS.files + 1 }, (_, i) => file(`n/${i}.txt`, 'x'));
+  const c = checkFolderUpload(files);
+  assert.equal(c.ok, false);
+  assert.equal(c.code, 'upload_too_many');
+  assert.match(c.message, /1001 files; the most a folder can have is 1000/);
+});
+
+// ── 3. refused file types ───────────────────────────────────────────────────────────
+test('programs, zipped files and key files are refused, each with its reason', async () => {
+  reset();
+  const r = await upload({ name: 'mixed', files: [
+    file('readme.txt', 'fine'),
+    file('setup.EXE', 'MZ'),
+    file('photos.zip', 'PK'),
+    file('.env', 'SECRET=1'),
+    file('keys/id_rsa', '-----BEGIN'),
+    file('certs/site.pem', '-----BEGIN'),
+    file('.env.example', 'SECRET='),    // documentation, allowed
+  ] });
+  assert.equal(r.status, 400);
+  const got = Object.fromEntries(r.body.error.details.problems.map((p) => [p.path, p.code]));
+  assert.deepEqual(got, { 'setup.EXE': 'program', 'photos.zip': 'archive', '.env': 'secret', 'keys/id_rsa': 'secret', 'certs/site.pem': 'secret' });
+  assert.match(r.body.error.message, /^5 files can’t go in, so nothing was created/);
+  const zip = r.body.error.details.problems.find((p) => p.code === 'archive');
+  assert.match(zip.reason, /Unzip it/);
+  assert.equal(ghCalls.length, 0);
+});
+
+// ── 4. unsafe paths ─────────────────────────────────────────────────────────────────
+test('unsafe paths are refused and nothing is created', async () => {
+  reset();
+  const bad = {
+    '../escape.txt': 'unsafe_path',
+    '/etc/passwd': 'unsafe_path',
+    'C:/Windows/x.txt': 'unsafe_path',
+    'a\\b.txt': 'unsafe_path',
+    'a/./b.txt': 'unsafe_path',
+    'a//b.txt': 'unsafe_path',
+    'trailing. ': 'unsafe_path',
+    'bell\u0007.txt': 'unsafe_path',
+    'docs/CON.txt': 'unsafe_path',
+    'nul': 'unsafe_path',
+    'drafts/com1/a.md': 'unsafe_path',
+    '.git/config': 'git_internal',
+    'sub/.GIT/hooks/post-checkout': 'git_internal',
+    '.gitmodules': 'git_internal',
+    '.github/workflows/run.yml': 'workflow',
+    '.claude/settings.json': 'platform_file',
+    'config/branding.json': 'platform_file',
+  };
+  const files = [file('ok.md', 'ok'), file('Notes.md', 'one'), file('notes.md', 'two'), ...Object.keys(bad).map((p) => file(p, 'x'))];
+  const r = await upload({ name: 'unsafe', files });
+  assert.equal(r.status, 400);
+  const got = Object.fromEntries(r.body.error.details.problems.map((p) => [p.path, p.code]));
+  assert.deepEqual(got, { ...bad, 'notes.md': 'duplicate' });
+  assert.equal(ghCalls.length, 0);
+  assert.equal(pushes.length, 0);
+  // the platform's own files are left to it, and the reason says why
+  assert.match(r.body.error.details.problems.find((p) => p.code === 'platform_file').reason, /sets your project up/);
+});
+
+test('pushFolderToRepo never writes outside its work dir, even for a path that slipped the check', async () => {
+  await assert.rejects(
+    pushFolderToRepo({ owner: 'o', repo: 'r', files: [{ path: '../../escape.txt', data: b64('x') }], remoteUrl: path.join(TMP, 'none.git'), exec: async () => '' }),
+    (e) => e.code === 'UNSAFE_PATH',
+  );
+});
+
+test('a body that is not base64, or an empty folder, is refused plainly', async () => {
+  reset();
+  let r = await upload({ name: 'x1', files: [{ path: 'a.txt', data: 'not base64!' }] });
+  assert.equal(r.body.error.details.problems[0].code, 'bad_content');
+  r = await upload({ name: 'x2', files: [] });
+  assert.equal(r.body.error.code, 'upload_empty');
+  r = await upload({ name: 'x3', files: [file('.DS_Store', 'x'), file('Thumbs.db', 'y')] });
+  assert.equal(r.body.error.code, 'upload_empty');
+  assert.equal(ghCalls.length, 0);
+});
+
+// ── 5. a failed push is retried into the same repo only ────────────────────────────
+test('a push that fails after the repo is made retries into that repo, and no other', async () => {
+  reset();
+  failNextPush = true;
+  const files = [file('poem.txt', 'roses')];
+  let r = await upload({ name: 'poems', files });
+  assert.equal(r.status, 502);
+  assert.equal(r.body.error.code, 'upload_failed');
+  assert.equal(r.body.error.details.repo.full_name, 'founder/poems');
+  assert.doesNotMatch(JSON.stringify(r.body), /boom|tok/, 'git’s text and the token stay on the server');
+
+  r = await upload({ into: 'founder/elsewhere', files });
+  assert.equal(r.status, 409);
+  assert.equal(r.body.error.code, 'upload_retry_refused');
+
+  reset();
+  r = await upload({ into: 'founder/poems', files });
+  assert.equal(r.status, 201, JSON.stringify(r.body));
+  assert.equal(ghCalls.length, 0, 'the retry makes no second repo');
+  assert.equal(git(bare['founder/poems'], 'show', 'main:poem.txt'), 'roses');
+
+  r = await upload({ into: 'founder/poems', files });
+  assert.equal(r.status, 409, 'once filled, the retry door closes');
+});
+
+test('a third upload while two are held in memory is turned away plainly, and makes nothing', async () => {
+  reset();
+  let release;
+  holdPushes = new Promise((r) => { release = r; });
+  const files = [file('a.txt', 'a')];
+  const first = upload({ name: 'busy-one', files });
+  const second = upload({ name: 'busy-two', files });
+  while (pushes.length < 2) await new Promise((r) => setTimeout(r, 10));
+  const third = await upload({ name: 'busy-three', files });
+  assert.equal(third.status, 503);
+  assert.equal(third.body.error.code, 'upload_busy');
+  assert.match(third.body.error.message, /Nothing was created\. Try again in a minute\./);
+  assert.ok(!ghCalls.some((c) => c.body && c.body.name === 'busy-three'), 'no repo for the turned-away upload');
+  holdPushes = null; release();
+  assert.equal((await first).status, 201);
+  assert.equal((await second).status, 201);
+  assert.equal((await upload({ name: 'busy-four', files })).status, 201, 'the door reopens once they finish');
+});
+
+// ── 6. the page: the wizard's own code, sliced out of projects.html and run in a vm ──
+// The folder picker and the repo create (ensureFreshRepo) run for real under a small DOM,
+// reading fake Files through a FileReader stand-in and posting to the REAL route above.
+const HUB = fs.readFileSync(path.join(ROOT, 'modules', 'public-landing', 'public', 'projects.html'), 'utf8').replace(/\r\n/g, '\n');
+const SCRIPT = HUB.slice(HUB.lastIndexOf('<script>'), HUB.lastIndexOf('</script>'));
+function region(startMark, endMark) {
+  const s = SCRIPT.indexOf(startMark);
+  const e = s < 0 ? -1 : SCRIPT.indexOf(endMark, s);
+  return s > 0 && e > s ? SCRIPT.slice(s, e) : null;
+}
+const FOLDER = region('    /* ── start it from a folder (task 1005282) ──', '    /* ── whose GitHub account: mine or an organisation');
+const ENSURE = region('    function ensureFreshRepo() {', "    $('doCreate').addEventListener('click'");
+
+test('the page regions are still findable, and the folder code builds no markup from strings', () => {
+  assert.ok(FOLDER, 'folder region'); assert.ok(ENSURE, 'ensureFreshRepo region');
+  assert.doesNotMatch(FOLDER, /innerHTML/);
+  assert.match(SCRIPT, /onboard_mode: state\.mode === 'adopt' \|\| state\.folderUploaded \? 'adopt' : 'greenfield'/,
+    'a repo made from a folder already has commits, so the scaffold layers onto it');
+  // the markup: both pickers inside the new-repo choice
+  const fresh = (HUB.match(/<div id="ghFresh"[\s\S]*?<div class="row2" id="manualHome">/) || [''])[0];
+  assert.match(fresh, /<input type="file" id="folderDir" webkitdirectory multiple hidden/);
+  assert.match(fresh, /<input type="file" id="folderFilesIn" multiple hidden/);
+});
+
+class El {
+  constructor(id, tag = 'div') { this.id = id; this.tagName = tag; this.hidden = false; this.textContent = ''; this.className = ''; this.children = []; this.listeners = {}; this.value = ''; }
+  addEventListener(ev, fn) { (this.listeners[ev] = this.listeners[ev] || []).push(fn); }
+  fire(ev) { (this.listeners[ev] || []).forEach((fn) => fn.call(this, {})); }
+  click() { this.clicked = true; }
+  appendChild(c) { this.children.push(c); return c; }
+  removeChild(c) { this.children = this.children.filter((x) => x !== c); }
+  get firstChild() { return this.children[0] || null; }
+  get text() { return this.children.map((c) => (c.children.length ? c.text : c.textContent)).join(''); }
+}
+// a File stand-in: name, size, the relative path a folder pick gives, and its bytes
+const fakeFile = (rel, content) => { const buf = Buffer.isBuffer(content) ? content : Buffer.from(content); return { name: rel.split('/').pop(), webkitRelativePath: rel, size: buf.length, buf }; };
+function page({ folderPicker = true } = {}) {
+  const els = {};
+  const $ = (id) => {
+    if (!els[id]) { els[id] = new El(id); if (id === 'folderDir' && folderPicker) els[id].webkitdirectory = true; }
+    return els[id];
+  };
+  const posted = [];
+  class FileReader { readAsDataURL(f) { setTimeout(() => { this.result = 'data:application/octet-stream;base64,' + f.buf.toString('base64'); this.onload(); }, 0); } }
+  const sandbox = {
+    API: '/api/bongos', $, JSON, String, Promise, Error, Array, FileReader,
+    document: { createElement: (t) => new El(null, t), createTextNode: (t) => { const n = new El(null, '#text'); n.textContent = t; return n; } },
+    fetch: (p, init) => { posted.push({ p, body: init && init.body ? JSON.parse(init.body) : null }); return realFetch(origin + p, { method: (init && init.method) || 'GET', headers: init && init.headers, body: init && init.body }); },
+    state: { mode: 'greenfield', repo: 'zine', owner: 'founder' },
+    repoAccess: true, hopForRepoAccess: () => false, syncHome() {}, saveDraft() {}, paintCreate() {},
+  };
+  vm.createContext(sandbox);
+  vm.runInContext(FOLDER + ENSURE, sandbox);
+  const pick = (files) => { $('folderDir').files = files; $('folderDir').fire('change'); };
+  return { sb: sandbox, $, posted, pick };
+}
+
+test('page: a picked folder of artwork goes up without its own folder name, and becomes the repo', async () => {
+  reset();
+  const p = page();
+  assert.equal(p.$('folderDirBtn').hidden, false, 'a browser with a folder picker offers it');
+  p.pick([fakeFile('My Zine/cover.png', PNG), fakeFile('My Zine/text/issue-1.md', '# Issue one'), fakeFile('My Zine/.DS_Store', 'x')]);
+  assert.equal(p.sb.state.fromFolder, true);
+  assert.equal(p.$('folderNote').textContent, '2 files, 1 KB, ready to go into the new repository (1 system files left out).');
+  assert.equal(p.sb.folderWhy(), '');
+  await p.sb.ensureFreshRepo();
+  const sent = p.posted.find((x) => x.p === '/api/bongos/github/repos/upload');
+  assert.deepEqual(sent.body.files.map((f) => f.path), ['cover.png', 'text/issue-1.md'], 'paths are inside the folder, never its own name');
+  assert.equal(sent.body.name, 'zine');
+  assert.equal(p.sb.state.repoAutoCreated, true);
+  assert.equal(p.sb.state.folderUploaded, true, 'so the create sends onboard_mode adopt');
+  assert.equal(p.sb.state.repoUrl, 'https://github.com/founder/zine');
+  assert.ok(Buffer.from(execFileSync('git', ['--git-dir', bare['founder/zine'], 'show', 'main:cover.png'])).equals(PNG));
+  assert.equal(p.$('folderNote').textContent, 'Your 2 files are in the repository.');
+});
+
+test('page: a file over 25 MB is named before anything is sent, and Create is held', async () => {
+  reset();
+  const p = page();
+  const huge = { name: 'film.mov', webkitRelativePath: 'Clips/film.mov', size: 26 * 1024 * 1024, buf: Buffer.alloc(0) };
+  p.pick([fakeFile('Clips/a.txt', 'a'), huge]);
+  assert.match(p.$('folderNote').textContent, /^One thing to fix before Create:/);
+  assert.equal(p.$('folderProblems').hidden, false);
+  assert.equal(p.$('folderProblems').children[0].text, 'film.mov: Each file can be at most 25 MB.');
+  await assert.rejects(p.sb.ensureFreshRepo(), (e) => e.gotoHome && /Fix them below/.test(e.homeMsg));
+  assert.equal(p.posted.length, 0, 'nothing was sent');
+  assert.equal(ghCalls.length, 0, 'nothing was created');
+});
+
+test('page: the server’s refusal shows each refused file with its reason, and nothing is created', async () => {
+  reset();
+  const p = page();
+  p.sb.state.repo = 'refused';
+  p.pick([fakeFile('Stuff/notes.txt', 'n'), fakeFile('Stuff/install.exe', 'MZ'), fakeFile('Stuff/.git/config', '[core]')]);
+  await assert.rejects(p.sb.ensureFreshRepo(), (e) => e.gotoHome && /2 files can’t go in, so nothing was created/.test(e.homeMsg));
+  const lines = p.$('folderProblems').children.map((li) => li.text);
+  assert.deepEqual(lines, [
+    'install.exe: Programs, installers and disk images can’t go in. They can’t be read as project material and can carry harm.',
+    '.git/config: Git’s own internal files can’t be uploaded. Choose the folder without its .git folder.',
+  ]);
+  assert.equal(p.sb.state.repoAutoCreated, undefined);
+  assert.equal(ghCalls.length, 0);
+});
+
+test('page: on a phone (no folder picker) only "Choose files" is offered, and a reload asks for the folder again', () => {
+  const p = page({ folderPicker: false });
+  assert.equal(p.$('folderDirBtn').hidden, true);
+  p.$('folderFilesBtn').fire('click');
+  assert.equal(p.$('folderFilesIn').clicked, true);
+  // a draft that remembers a folder, but no File objects (they cannot ride a draft)
+  p.sb.state.fromFolder = true; p.sb.state.folderCount = 3;
+  assert.match(p.sb.folderWhy(), /Choose your folder again/);
+});

package/tests/genesis_work_routes.mjs

@@ -32,7 +32,15 @@ const store = memStore();
 const app = express();
 app.use(express.json());
 const router = express.Router();
-mount(router, { store });
+// The project's facts (task 1005129) live in project_settings: an in-memory one here.
+const settings = new Map();
+mount(router, {
+  store,
+  getSetting: async (k) => (settings.has(k) ? { key: k, value: settings.get(k) } : null),
+  setSetting: async (k, v) => { settings.set(k, String(v)); },
+  factsMarker: null,
+  payGates: null,
+});
 app.use('/api/bongos', router);
 const server = app.listen(0);
 const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
@@ -76,6 +84,22 @@ try {
     assert.equal((await call('GET', '/founding/work/nope/document')).status, 404);
   });
 
+  await test('task 1005129: any builder reads the facts and options; only the owner changes a fact', async () => {
+    assert.equal((await call('GET', '/founding/facts', { as: null })).status, 401);
+    let r = await call('GET', '/founding/facts', { as: OTHER });
+    assert.equal(r.status, 200);
+    assert.equal(r.data.unanswered.length, 6, 'a project not made through the hub: every fact not answered');
+    assert.equal((await call('PUT', '/founding/facts', { as: OTHER, body: { facts: { builder_geography: 'global' } } })).status, 403);
+    assert.equal((await call('PUT', '/founding/facts', { body: { facts: { builder_geography: 'mars' } } })).status, 400);
+    const w = await call('PUT', '/founding/facts', { body: { facts: { builder_geography: 'global' } } });
+    assert.equal(w.status, 200);
+    assert.equal(w.data.facts.find((f) => f.key === 'builder_geography').value, 'global');
+    r = await call('GET', '/founding/legalize/options', { as: OTHER });
+    assert.equal(r.status, 200);
+    assert.equal(r.data.rules_module, false);
+    assert.match(r.data.markdown, /Where its builders are: global/);
+  });
+
   await test('a builder who is not the owner cannot write', async () => {
     for (const [m, p, body] of [
       ['PUT', '/founding/work/strategize/answers/risks', { text: 'x' }],