@bugmole/cli 0.4.0 → 0.6.0

package/src/runtime/init-wizard.ts

@@ -4,6 +4,7 @@ import { spawn } from "node:child_process";
 import readline from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import YAML from "yaml";
+import { describeDetection, detectProjectIdentity, type ProjectIdentityDetection } from "./project-identity.js";
 
 export type StorageProvider = "local" | "gcs" | "s3" | "r2" | "bugmole";
 
@@ -30,6 +31,10 @@ export type InitOptions = {
   endpoint?: string;
   cloudProjectId?: string;
   accountId?: string;
+  /** The app's folder inside the repository, for a repository with several apps. */
+  appPath?: string;
+  /** The app's URL (a public one identifies the project by domain when there is no git remote). */
+  appUrl?: string;
 };
 
 export type InitConfig = {
@@ -50,8 +55,40 @@ export type InitConfig = {
   endpoint?: string;
   cloudProjectId?: string;
   accountId?: string;
+  /** Which app of the repository this project is ("." for the root). */
+  appPath?: string;
 };
 
+/**
+ * The registry refused a project or workspace because of the plan (402
+ * plan_limit or free_workspace_exists). Carries the registry's own message
+ * and the Billing link, so the CLI prints those instead of a stack trace.
+ */
+export class PlanLimitError extends Error {
+  constructor(message: string, readonly billingUrl: string, readonly code: string) {
+    super(message);
+    this.name = "PlanLimitError";
+  }
+}
+
+/** A PlanLimitError for a registry refusal about the plan; null for anything else. */
+export function planLimitFromRegistry(
+  status: number,
+  body: { error?: string; code?: string; upgradeUrl?: string; billingUrl?: string } | null,
+  dashboardUrl: string,
+): PlanLimitError | null {
+  if (!body || (body.code !== "plan_limit" && body.code !== "free_workspace_exists" && body.code !== "identity_in_use" && status !== 402)) return null;
+  const base = dashboardUrl.replace(/\/$/, "");
+  const relative = typeof body.upgradeUrl === "string" && body.upgradeUrl.startsWith("/billing") ? body.upgradeUrl : "/billing";
+  const billingUrl = typeof body.billingUrl === "string" && /^https?:\/\//.test(body.billingUrl) ? body.billingUrl : `${base}${relative}`;
+  return new PlanLimitError(body.error || "Your Bugmole plan doesn't allow this.", billingUrl, body.code ?? "plan_limit");
+}
+
+/** What `bugmole init` prints for a plan refusal. */
+export function describePlanLimit(error: PlanLimitError): string {
+  return `${error.message}\nSee plans and upgrade: ${error.billingUrl}`;
+}
+
 const providers = new Set<StorageProvider>(["local", "gcs", "s3", "r2", "bugmole"]);
 
 export function validateStorageProvider(value: string): StorageProvider {
@@ -90,6 +127,7 @@ function existingDefaults(cwd: string, configPath: string): Partial<InitConfig>
     endpoint: storage[provider]?.endpoint,
     cloudProjectId: storage[provider]?.project_id,
     accountId: storage[provider]?.account_id,
+    appPath: project.app_path ?? project.appPath,
   };
 }
 
@@ -134,7 +172,7 @@ project:
   workspace_id: ${config.workspaceId}
   workspace_name: ${JSON.stringify(config.workspaceName)}
   environment: ${config.environment}
-  spec_dir: ${config.specDir}
+${config.appPath ? `  app_path: ${JSON.stringify(config.appPath)}\n` : ""}  spec_dir: ${config.specDir}
   evidence_manifest: ${config.evidenceManifest}
   evidence_screenshots: ${config.evidenceScreenshots}
 
@@ -167,7 +205,8 @@ function renderEnv(config: InitConfig): string {
     `BUGMOLE_ENVIRONMENT=${config.environment}`,
     `BUGMOLE_STORAGE_PROVIDER=${config.storageProvider}`,
     `BUGMOLE_LOCAL_ARTIFACTS_DIR=${config.artifactsDir}`,
-    `BUGMOLE_AEGIS_EMAIL=${JSON.stringify(process.env.BUGMOLE_AEGIS_EMAIL?.trim() ?? "")}`,
+    // The email you sign in with, remembered to prefill the next sign-in.
+    ...(process.env.BUGMOLE_AEGIS_EMAIL?.trim() ? [`BUGMOLE_AEGIS_EMAIL=${JSON.stringify(process.env.BUGMOLE_AEGIS_EMAIL.trim())}`] : []),
     "",
   ];
   if (config.storageProvider === "gcs") {
@@ -199,11 +238,50 @@ function renderEnv(config: InitConfig): string {
   return `${lines.join("\n")}\n`;
 }
 
+/** The registry matched this app to a project that already exists (a teammate's): use its id from now on. */
+function adoptProjectId(configFile: string, envFile: string, config: InitConfig, projectId: string): void {
+  if (projectId === config.projectId) return;
+  if (fs.existsSync(configFile)) {
+    const text = fs.readFileSync(configFile, "utf8");
+    fs.writeFileSync(configFile, text.replace(/^(project:\r?\n  id: ).*$/m, `$1${projectId}`), "utf8");
+  }
+  if (fs.existsSync(envFile)) writeEnvValue(envFile, "BUGMOLE_PROJECT_ID", projectId);
+  config.projectId = projectId;
+}
+
+/** Which app this is; never fails init (detection is best-effort). */
+function detectIdentity(cwd: string, options: InitOptions, defaults: Partial<InitConfig>): ProjectIdentityDetection | null {
+  try {
+    return detectProjectIdentity({
+      cwd,
+      appPath: options.appPath ?? defaults.appPath,
+      appUrl: options.appUrl ?? (process.env.BUGMOLE_BASE_URL?.trim() || process.env.PLAYWRIGHT_BASE_URL?.trim() || undefined),
+    });
+  } catch {
+    return null;
+  }
+}
+
 async function ask(rl: readline.Interface, label: string, fallback: string): Promise<string> {
   const answer = await rl.question(`${label} [${fallback}]: `);
   return valueOr(answer, fallback);
 }
 
+/**
+ * Adds the env file to the repository's .gitignore (when the workspace is a
+ * git repository and doesn't ignore it yet). Returns whether it added it.
+ */
+export function ensureGitignored(cwd: string, file: string): boolean {
+  if (!fs.existsSync(path.join(cwd, ".git"))) return false;
+  const gitignore = path.join(cwd, ".gitignore");
+  const entry = `/${file.replace(/^\.\//, "")}`;
+  const current = fs.existsSync(gitignore) ? fs.readFileSync(gitignore, "utf8") : "";
+  const lines = current.split(/\r?\n/).map((line) => line.trim());
+  if (lines.includes(entry) || lines.includes(entry.slice(1)) || lines.includes(".bugmole.env*") || lines.includes("*.env")) return false;
+  fs.writeFileSync(gitignore, `${current}${current && !current.endsWith("\n") ? "\n" : ""}${entry}\n`, "utf8");
+  return true;
+}
+
 export async function runInitWizard(
   options: InitOptions = {},
 ): Promise<{ configPath: string; envPath: string; config: InitConfig }> {
@@ -232,6 +310,12 @@ export async function runInitWizard(
         await choose(options.storageProvider, "Storage provider (local|gcs|s3|r2|bugmole)", valueOr(defaults.storageProvider, "local")),
       ),
     };
+    const detection = detectIdentity(cwd, options, defaults);
+    if (detection) {
+      for (const line of describeDetection(detection)) console.log(line);
+      if (detection.app && detection.app.path !== ".") config.appPath = detection.app.path;
+    }
+    const identity = detection?.identity ?? undefined;
     if (config.storageProvider !== "local" && config.storageProvider !== "bugmole") {
       config.bucket = await choose(options.bucket, "Bucket", valueOr(defaults.bucket, ""));
       if (config.storageProvider === "gcs")
@@ -256,6 +340,7 @@ export async function runInitWizard(
       if (options.force || !fs.existsSync(envFile)) {
         fs.writeFileSync(envFile, renderEnv(config), "utf8");
         console.log(`Generated ${configPath} and ${envPath}.`);
+        if (ensureGitignored(cwd, envPath)) console.log(`Added ${envPath} to .gitignore: it will hold your API key.`);
       } else {
         console.log(`Generated ${configPath}; kept existing ${envPath}.`);
       }
@@ -264,6 +349,8 @@ export async function runInitWizard(
     }
     const registryUrl =
       process.env.BUGMOLE_REGISTRY_URL?.trim() || "https://api.bugmole.com";
+    const dashboardUrl =
+      process.env.BUGMOLE_DASHBOARD_URL?.trim() || "https://app.bugmole.com";
     const apiKey = process.env.BUGMOLE_API_KEY?.trim();
     if (registryUrl && apiKey && shouldWrite) {
       const headers: Record<string, string> = {
@@ -282,12 +369,22 @@ export async function runInitWizard(
           workspaceName: config.workspaceName,
           environment: config.environment,
           storageProvider: config.storageProvider,
+          identity,
         }),
       });
       if (!response.ok) {
-        throw new Error(`Bugmole registry rejected project registration (${response.status})`);
+        const refusal = await response.json().catch(() => null) as { error?: string; code?: string; upgradeUrl?: string; billingUrl?: string } | null;
+        const planLimit = planLimitFromRegistry(response.status, refusal, dashboardUrl);
+        if (planLimit) throw planLimit;
+        throw new Error(`Bugmole registry rejected project registration (${response.status})${refusal?.error ? `: ${refusal.error}` : ""}`);
+      }
+      const registered = await response.json().catch(() => null) as { project?: { id?: string }; existing?: boolean } | null;
+      if (registered?.existing && registered.project?.id) {
+        adoptProjectId(configFile, envFile, config, registered.project.id);
+        console.log(`This app is already project ${config.projectId} in the workspace; joined it instead of creating another.`);
+      } else {
+        console.log(`Registered ${config.projectId} with the Bugmole registry.`);
       }
-      console.log(`Registered ${config.projectId} with the Bugmole registry.`);
     } else if (registryUrl && !apiKey && shouldWrite && !nonInteractive) {
       const createResponse = await fetch(`${registryUrl.replace(/\/$/, "")}/api/device-authorizations`, {
         method: "POST",
@@ -297,6 +394,7 @@ export async function runInitWizard(
           projectName: config.projectName,
           environment: config.environment,
           storageProvider: config.storageProvider,
+          identity,
         }),
       });
       const attempt = await createResponse.json().catch(() => null) as {
@@ -309,8 +407,6 @@ export async function runInitWizard(
       if (!createResponse.ok || !attempt?.attemptId || !attempt.code || !attempt.pollSecret) {
         throw new Error(attempt?.error ?? "Unable to start Bugmole device registration");
       }
-      const dashboardUrl =
-        process.env.BUGMOLE_DASHBOARD_URL?.trim() || "https://app.bugmole.com";
       const registrationUrl =
         `${dashboardUrl.replace(/\/$/, "")}/register?attemptId=${encodeURIComponent(attempt.attemptId)}&projectId=${encodeURIComponent(config.projectId)}${process.env.BUGMOLE_AEGIS_EMAIL?.trim() ? `&email=${encodeURIComponent(process.env.BUGMOLE_AEGIS_EMAIL.trim())}` : ""}`;
       console.log(`Open ${registrationUrl} and enter code: ${attempt.code}`);
@@ -327,14 +423,24 @@ export async function runInitWizard(
           status?: string;
           token?: string;
           email?: string;
+          projectId?: string;
           alreadyInitialized?: boolean;
           error?: string;
+          code?: string;
+          upgradeUrl?: string;
+          billingUrl?: string;
         } | null;
         if (result?.status === "pending") continue;
         if (!pollResponse.ok) {
+          const planLimit = planLimitFromRegistry(pollResponse.status, result, dashboardUrl);
+          if (planLimit) throw planLimit;
           const detail = result?.error ?? result?.status ?? `HTTP ${pollResponse.status}`;
           throw new Error(`Bugmole device registration failed: ${detail}`);
         }
+        if (result?.projectId && result.projectId !== config.projectId) {
+          adoptProjectId(configFile, envFile, config, result.projectId);
+          console.log(`This app is already project ${config.projectId}; this machine joined it.`);
+        }
         if (result?.alreadyInitialized) {
           throw new Error("This Aegis account already has an API key; revoke it or use that key in .bugmole.env.");
         }

package/src/runtime/journey-editor.ts

@@ -82,6 +82,15 @@ function idPart(value: string): string {
   return value.trim().replace(/[^a-zA-Z0-9._:-]+/g, "-").replace(/^-+|-+$/g, "");
 }
 
+/**
+ * Step and transition IDs keep the route in them (screen:/settings,
+ * screen:/->screen:/settings:dom-3), as exploration writes them; rewriting
+ * the slashes made the agent's next call name a step that didn't exist.
+ */
+function graphIdPart(value: string): string {
+  return value.trim().replace(/[^a-zA-Z0-9._:/>\[\]-]+/g, "-").replace(/^-+|-+$/g, "");
+}
+
 function requireJourney(graph: JourneyGraph, journeyId: string): UserJourney {
   const journey = graph.journeys.find((item) => item.id === journeyId);
   if (!journey) throw new Error(`Journey not found: ${journeyId}`);
@@ -98,6 +107,45 @@ function nextRevision(journey: UserJourney): UserJourney {
   };
 }
 
+/**
+ * A run that passed proves the flow it ran. Discovery saves what it finds as
+ * draft journeys, and only stable ones are drawn in the dashboard's journey
+ * graph, but nothing promoted them: a cloud run has no agent to call
+ * stabilizeJourney. This does it for the drafts discovery wrote, reading the
+ * stored graph (a cloud container has no local copy). Journeys an agent or a
+ * person made are left for them to stabilize. Returns the journey promoted.
+ */
+export async function stabilizeAfterPassingRun(
+  cfg: JourneyConfig,
+  run: { id: string; planId?: string | null; journeyId?: string | null },
+): Promise<string | null> {
+  const store = storeFor(cfg);
+  const key = `${projectPrefix(projectId(cfg))}/journeys/graph.json`;
+  if (!(await store.has(key))) return null;
+  const parsed = JSON.parse(await store.getText(key)) as JourneyGraph;
+  const graph = repairJourneyGraph({
+    ...emptyJourneyGraph(projectId(cfg)),
+    ...parsed,
+    journeys: Array.isArray(parsed.journeys) ? parsed.journeys : [],
+    nodes: Array.isArray(parsed.nodes) ? parsed.nodes : [],
+    edges: Array.isArray(parsed.edges) ? parsed.edges : [],
+  }, projectId(cfg));
+  const current = graph.journeys.find((journey) =>
+    (run.journeyId && journey.id === run.journeyId) || (run.planId && journey.metadata?.planId === run.planId));
+  if (!current || current.stability === "stable" || current.metadata?.generatedBy !== "site-discovery") return null;
+  const journey: UserJourney = {
+    ...current,
+    status: "published",
+    stability: "stable",
+    linkedToGraph: true,
+    verificationRunId: run.id,
+    verifiedAt: new Date().toISOString(),
+  };
+  graph.journeys = graph.journeys.map((item) => item.id === current.id ? journey : item);
+  await writeJourneyGraph(cfg, graph);
+  return journey.id;
+}
+
 export async function stabilizeJourney(
   cfg: JourneyConfig,
   input: { journeyId: string; verificationRunId: string; verifiedAt?: string },
@@ -152,7 +200,7 @@ export async function addJourneyStep(
 ) {
   const graph = readJourneyGraph(cfg);
   const journey = requireJourney(graph, input.journeyId);
-  const nodeId = idPart(input.node.id || `step-${Date.now()}`);
+  const nodeId = graphIdPart(input.node.id || `step-${Date.now()}`);
   if (!nodeId || graph.nodes.some((node) => node.id === nodeId)) throw new Error(`Node already exists: ${nodeId}`);
   const node = { ...input.node, id: nodeId } as JourneyNode;
   graph.nodes.push(node);
@@ -202,7 +250,7 @@ export async function addJourneyTransition(
   if (!graph.nodes.some((node) => node.id === input.from) || !graph.nodes.some((node) => node.id === input.to)) {
     throw new Error("Transition endpoints must reference existing nodes");
   }
-  const edgeId = idPart(input.edge?.id || `${input.from}->${input.to}:${Date.now()}`);
+  const edgeId = graphIdPart(input.edge?.id || `${input.from}->${input.to}:${Date.now()}`);
   if (graph.edges.some((edge) => edge.id === edgeId)) throw new Error(`Edge already exists: ${edgeId}`);
   const edge: JourneyEdge = { ...input.edge, id: edgeId, from: input.from, to: input.to };
   graph.edges.push(edge);
@@ -262,6 +310,34 @@ export async function removeJourneyItem(
 export function nextJourneyTask(cfg: JourneyConfig, journeyId: string): JourneyNextTask {
   const graph = readJourneyGraph(cfg);
   const journey = requireJourney(graph, journeyId);
+  // An empty journey, or steps nothing connects, is not finished: there is
+  // nothing to plan from yet.
+  if (!journey.nodeIds.length) {
+    return {
+      status: "actionable",
+      journeyId,
+      reason: "The journey has no steps yet.",
+      action: "Add the screen the journey starts on",
+      nextSteps: [
+        "Open the app where this journey starts and record that screen with bugmole_journey_add_step",
+        "Call bugmole_journey_next again after recording it",
+      ],
+    };
+  }
+  if (journey.nodeIds.length > 1 && !journey.edgeIds.length) {
+    return {
+      status: "actionable",
+      journeyId,
+      reason: "The journey's steps aren't connected: no transition says how a person gets from one to the next.",
+      nodeId: journey.nodeIds[0],
+      route: graph.nodes.find((node) => node.id === journey.nodeIds[0])?.route,
+      action: `Connect ${journey.nodeIds[0]} to the next step`,
+      nextSteps: [
+        "Perform the action that leads from each step to the next and record it with bugmole_journey_add_transition",
+        "Call bugmole_journey_next again after recording it",
+      ],
+    };
+  }
   const included = new Set(journey.nodeIds);
   const includedEdges = new Set(journey.edgeIds);
   const coveredTransitions = new Set(

package/src/runtime/journey-graph.test.ts

@@ -9,6 +9,7 @@ import {
   addJourneyTransition,
   createJourney,
   reuseJourneyStep,
+  stabilizeAfterPassingRun,
   stabilizeJourney,
   nextJourneyTask,
   readJourneyGraph,
@@ -255,3 +256,62 @@ test("requires runtime transition and terminal-goal completion for source paths"
   assert.equal(nextJourneyTask(cfg, "top-up-flow").status, "exhausted");
   await fs.promises.rm(root, { recursive: true, force: true });
 });
+
+test("a passing run promotes the explored draft it proved, from the stored graph alone", async () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "bugmole-promote-"));
+  const storage = { provider: "local", localDirectory: path.join(root, "artifacts") };
+  const writer = { project: { id: "demo" }, runtime: { spec_dir: path.join(root, "spec"), artifacts_dir: path.join(root, "artifacts") }, storage };
+  // A cloud container: same project storage, no local copy of the graph.
+  const container = { project: { id: "demo" }, runtime: { spec_dir: path.join(root, "container"), artifacts_dir: path.join(root, "artifacts") }, storage };
+  try {
+    const graph = emptyJourneyGraph("demo");
+    graph.nodes = [{ id: "screen:/login", title: "Welcome back", kind: "screen", route: "/login" }];
+    const draft = (id: string, generatedBy?: string) => ({
+      id,
+      name: id,
+      actor: "visitor",
+      startNodeId: "screen:/login",
+      nodeIds: ["screen:/login"],
+      edgeIds: [],
+      revision: 1,
+      status: "draft" as const,
+      sourceOfTruth: "canonical_flow" as const,
+      stability: "discovered" as const,
+      linkedToGraph: false,
+      metadata: generatedBy ? { generatedBy, planId: id } : {},
+    });
+    graph.journeys = [draft("discovered-welcome-back", "site-discovery"), draft("hand-made")];
+    await writeJourneyGraph(writer, graph);
+
+    assert.equal(await stabilizeAfterPassingRun(container, { id: "run_1", planId: "discovered-welcome-back", journeyId: "discovered-welcome-back" }), "discovered-welcome-back");
+    const stored = JSON.parse(fs.readFileSync(path.join(root, "artifacts", "projects", "demo", "journeys", "graph.json"), "utf8"));
+    const promoted = stored.journeys.find((journey: { id: string }) => journey.id === "discovered-welcome-back");
+    assert.equal(promoted.stability, "stable");
+    assert.equal(promoted.linkedToGraph, true);
+    assert.equal(promoted.verificationRunId, "run_1");
+
+    assert.equal(await stabilizeAfterPassingRun(container, { id: "run_2", journeyId: "hand-made" }), null, "journeys a person or agent made are theirs to stabilize");
+    assert.equal(await stabilizeAfterPassingRun(container, { id: "run_3", journeyId: "discovered-welcome-back" }), null, "already stable");
+    assert.equal(await stabilizeAfterPassingRun(container, { id: "run_4", journeyId: "missing" }), null);
+  } finally {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("route-style step IDs are kept, and an empty or unconnected journey is not exhausted", async () => {
+  const root = await fs.promises.mkdtemp(path.join(os.tmpdir(), "bugmole-flow-ids-"));
+  const cfg = {
+    project: { id: "demo" },
+    runtime: { spec_dir: path.join(root, "spec"), artifacts_dir: path.join(root, "artifacts") },
+    storage: { provider: "local", localDirectory: path.join(root, "artifacts") },
+  };
+  await createJourney(cfg, { id: "sign-up", name: "Sign up", actor: "guest" });
+  assert.equal(nextJourneyTask(cfg, "sign-up").status, "actionable");
+  const home = await addJourneyStep(cfg, { journeyId: "sign-up", node: { id: "screen:/", title: "Home", kind: "screen", route: "/" } });
+  const signup = await addJourneyStep(cfg, { journeyId: "sign-up", node: { id: "screen:/signup", title: "Sign up", kind: "screen", route: "/signup" } });
+  assert.deepEqual(signup.journey.nodeIds, ["screen:/", "screen:/signup"]);
+  assert.ok(home);
+  assert.match(nextJourneyTask(cfg, "sign-up").reason, /aren't connected/);
+  await addJourneyTransition(cfg, { journeyId: "sign-up", from: "screen:/", to: "screen:/signup" });
+  assert.match(readJourneyGraph(cfg).edges[0].id, /^screen:\/->screen:\/signup:/);
+});

package/src/runtime/local-registry-stub.test.ts

@@ -323,3 +323,67 @@ test("personas: adding, renaming, and removing, with at least one always kept",
     assert.equal(removeLast.status, 409, "the last persona in a project can't be removed");
   });
 });
+
+test("completion review mirrors the registry: in review, then accepted or sent back with a note", async () => {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "bugmole-local-registry-"));
+  const stub = await startLocalRegistryStub({ directory, reviewMode: "auto" });
+  const origin = stub.origin;
+  try {
+    const create = async (taskType: string, key: string) => {
+      const created = await postJson(origin, "/api/projects/lumis/tasks", { title: "t", description: "d", taskType, idempotencyKey: key });
+      const id = (created.body as { task: { id: string } }).task.id;
+      await postJson(origin, `/api/tasks/${id}/claim`, { workerId: "w" });
+      return id;
+    };
+    const investigation = await create("investigation", "a");
+    const done = await postJson(origin, `/api/tasks/${investigation}`, { workerId: "w", status: "completed" });
+    assert.equal((done.body as { task: { status: string } }).task.status, "completed", "auto doesn't review an investigation");
+
+    const code = await create("code", "b");
+    const review = await postJson(origin, `/api/tasks/${code}`, { workerId: "w", status: "completed" });
+    const reviewed = review.body as { inReview: boolean; message: string; task: { status: string } };
+    assert.equal(reviewed.task.status, "in_review");
+    assert.equal(reviewed.inReview, true);
+    assert.equal((await postJson(origin, `/api/tasks/${code}`, { workerId: "w", status: "running" })).status, 409);
+    assert.equal((await postJson(origin, `/api/tasks/${code}/resume`, {})).status, 409);
+
+    assert.equal((await postJson(origin, `/api/tasks/${code}/send-back`, {})).status, 422, "sending back needs a note");
+    const sent = await postJson(origin, `/api/tasks/${code}/send-back`, { note: "Also cover the empty cart" });
+    const sentTask = (sent.body as { task: { status: string; reviewNote: string; attempts: number } }).task;
+    assert.equal(sentTask.status, "queued");
+    assert.equal(sentTask.reviewNote, "Also cover the empty cart");
+    assert.equal(sentTask.attempts, 0);
+
+    await postJson(origin, `/api/tasks/${code}/claim`, { workerId: "w" });
+    await postJson(origin, `/api/tasks/${code}`, { workerId: "w", status: "completed" });
+    const accepted = await postJson(origin, `/api/tasks/${code}/accept`, {});
+    assert.equal((accepted.body as { task: { status: string; reviewedBy: string } }).task.status, "completed");
+    assert.equal((await postJson(origin, `/api/tasks/${code}/accept`, {})).status, 409);
+  } finally {
+    await stub.close();
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("roles: suggestions wait for a decision; the dashboard's add form confirms", async () => {
+  await withStub(async (origin) => {
+    const suggested = await postJson(origin, "/api/projects/lumis/roles", { name: "Admin", description: "Admin area.", source: "role_gated_route", evidence: "route /admin" });
+    assert.equal(suggested.status, 201);
+    const role = (suggested.body as { role: { id: string; name: string; status: string } }).role;
+    assert.equal(role.name, "admin");
+    assert.equal(role.status, "suggested");
+    assert.equal((await postJson(origin, "/api/projects/lumis/roles", { name: "x", description: "x" })).status, 422, "a suggestion needs evidence");
+
+    const rejected = await fetch(`${origin}/api/projects/lumis/roles/${role.id}`, {
+      method: "PATCH", headers: { "content-type": "application/json" }, body: JSON.stringify({ action: "reject" }),
+    });
+    assert.equal(((await rejected.json()) as { role: { status: string } }).role.status, "rejected");
+    const again = await postJson(origin, "/api/projects/lumis/roles", { name: "admin", description: "Admin area.", source: "role_gated_menu", evidence: "menu Admin" });
+    assert.equal((again.body as { role: { status: string } }).role.status, "rejected", "a rejected role stays rejected");
+
+    const added = await postJson(origin, "/api/projects/lumis/roles", { name: "guest", description: "Not signed in.", source: "person" });
+    assert.equal((added.body as { role: { status: string } }).role.status, "confirmed");
+    const listed = await (await fetch(`${origin}/api/projects/lumis/roles?status=confirmed`)).json() as { roles: Array<{ name: string }> };
+    assert.deepEqual(listed.roles.map((item) => item.name), ["guest"]);
+  });
+});