@bugmole/cli 0.5.0 → 0.6.0

package/src/registry-worker/projects/projects.test.ts

@@ -0,0 +1,283 @@
+// One app is one project (identity dedupe, Free-plan identity_in_use) and
+// projects paused after the plan's inactiveProjectDays.
+import assert from "node:assert/strict";
+import test from "node:test";
+import type { Env } from "../core.js";
+import { DAILY_CRON } from "../jobs/index.js";
+import { call, createTestEnv, runScheduled, seedPlan, seedProject } from "../testing/harness.js";
+import { lastActivityOf, parseRegistryTime, pauseInactiveProjects } from "./inactivity.js";
+
+const DAY = 86_400_000;
+const web = { kind: "repo", remote: "https://github.com/acme/shop.git", appPath: "apps/web" };
+const webFromTeammate = { kind: "repo", remote: "git@github.com:Acme/Shop.git", appPath: "./apps/web" };
+const mobile = { kind: "repo", remote: "https://github.com/acme/shop.git", appPath: "apps/mobile" };
+
+type Db = ReturnType<typeof createTestEnv>["db"];
+
+function register(env: Env, as: string, workspaceId: string, id: string, extra: Record<string, unknown> = {}) {
+  return call(env, "POST", "/api/projects/register", {
+    as, body: { id, name: id, workspaceId, environment: "staging", storageProvider: "r2", ...extra },
+  });
+}
+
+async function workspace(env: Env, owner: string, id: string) {
+  const created = await call(env, "POST", "/api/workspaces", { as: owner, body: { id, name: id } });
+  assert.equal(created.status, 201, JSON.stringify(created.json));
+}
+
+function addMember(db: Db, workspaceId: string, aegisId: string, role = "member") {
+  db.db.prepare("INSERT INTO aegis_users (id) VALUES (?) ON CONFLICT(id) DO NOTHING").run(aegisId);
+  db.db.prepare("INSERT INTO workspace_memberships (workspace_id, aegis_id, role, status) VALUES (?, ?, ?, 'active')").run(workspaceId, aegisId, role);
+}
+
+const projectCount = (db: Db, workspaceId: string) =>
+  Number((db.db.prepare("SELECT COUNT(*) AS c FROM projects WHERE workspace_id = ? AND deleted_at IS NULL").get(workspaceId) as { c: number }).c);
+
+test("in one workspace the same app resolves to the existing project; each monorepo app is its own", async () => {
+  const { env, db } = createTestEnv();
+  await workspace(env, "user_ada", "acme");
+  const first = await register(env, "user_ada", "acme", "shop-web", { identity: web });
+  assert.equal(first.status, 201, JSON.stringify(first.json));
+  assert.deepEqual(first.json.identity, { kind: "repo", key: "repo:github.com/acme/shop#apps/web", label: "github.com/acme/shop (apps/web)" });
+
+  // A teammate's clone of the same repository, with a different remote form and project id.
+  addMember(db, "acme", "user_bob");
+  const again = await register(env, "user_bob", "acme", "bobs-shop", { identity: webFromTeammate });
+  assert.equal(again.status, 200, JSON.stringify(again.json));
+  assert.equal(again.json.existing, true);
+  assert.equal(again.json.project.id, "shop-web");
+
+  // The monorepo's other app is a second project.
+  const other = await register(env, "user_bob", "acme", "shop-mobile", { identity: mobile });
+  assert.equal(other.status, 201);
+  assert.equal(projectCount(db, "acme"), 2);
+
+  // Never stored: the remote's credentials.
+  const withToken = await register(env, "user_ada", "acme", "admin", { identity: { remote: "https://ada:ghp_secret@github.com/acme/admin.git" } });
+  assert.equal(withToken.status, 201);
+  const stored = db.db.prepare("SELECT identity_key AS k, identity_hash AS h FROM projects WHERE id = 'admin'").get() as { k: string; h: string };
+  assert.equal(stored.k, "repo:github.com/acme/admin#.");
+  assert.match(stored.h, /^[0-9a-f]{64}$/);
+  assert.doesNotMatch(JSON.stringify(db.db.prepare("SELECT * FROM projects").all()), /ghp_secret/);
+
+  assert.equal((await register(env, "user_ada", "acme", "bad", { identity: { remote: "/srv/repo" } })).json.code, "invalid_identity");
+  const listed = await call(env, "GET", "/api/projects", { as: "user_ada" });
+  assert.equal(listed.json.projects.find((p: { id: string }) => p.id === "shop-web").identity.label, "github.com/acme/shop (apps/web)");
+});
+
+test("on Free an app in someone else's Free workspace is refused with identity_in_use; paid workspaces aren't", async () => {
+  const { env, db } = createTestEnv({ FEATURE_ENTITLEMENTS: "on", DASHBOARD_URL: "https://dash.test" });
+  await workspace(env, "user_ada", "ada");
+  assert.equal((await register(env, "user_ada", "ada", "shop", { identity: web })).status, 201);
+
+  await workspace(env, "user_bob", "bob");
+  const refused = await register(env, "user_bob", "bob", "shop-copy", { identity: webFromTeammate });
+  assert.equal(refused.status, 409, JSON.stringify(refused.json));
+  assert.equal(refused.json.code, "identity_in_use");
+  assert.match(refused.json.error, /github\.com\/acme\/shop \(apps\/web\) is already a project in another Free workspace\. Ask that project's owner to invite you/);
+  assert.equal(refused.json.billingUrl, "https://dash.test/billing?workspace=bob&plan=team");
+  assert.doesNotMatch(JSON.stringify(refused.json), /"ada"/, "doesn't reveal whose workspace it is");
+  assert.equal(projectCount(db, "bob"), 0);
+
+  // A different app of the same repo is fine.
+  assert.equal((await register(env, "user_bob", "bob", "mobile", { identity: mobile })).status, 201);
+
+  // Paid workspaces aren't restricted.
+  db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES ('bob', 'team')").run();
+  assert.equal((await register(env, "user_bob", "bob", "shop-copy", { identity: webFromTeammate })).status, 201);
+});
+
+test("identity_in_use follows the entitlements rollout, and a paused project doesn't hold its app", async () => {
+  const shadow = createTestEnv({ FEATURE_ENTITLEMENTS: "shadow" });
+  await workspace(shadow.env, "user_ada", "ada");
+  await register(shadow.env, "user_ada", "ada", "shop", { identity: web });
+  await workspace(shadow.env, "user_bob", "bob");
+  assert.equal((await register(shadow.env, "user_bob", "bob", "shop-copy", { identity: web })).status, 201, "shadow only logs");
+
+  const { env, db } = createTestEnv({ FEATURE_ENTITLEMENTS: "on" });
+  await workspace(env, "user_ada", "ada");
+  await register(env, "user_ada", "ada", "shop", { identity: web });
+  db.db.prepare("UPDATE projects SET inactive_at = CURRENT_TIMESTAMP WHERE id = 'shop'").run();
+  await workspace(env, "user_bob", "bob");
+  assert.equal((await register(env, "user_bob", "bob", "shop-copy", { identity: web })).status, 201);
+});
+
+test("sign-up with a site that's already someone else's Free project is refused", async () => {
+  const { env, db } = createTestEnv({ FEATURE_ENTITLEMENTS: "on" });
+  await workspace(env, "user_ada", "ada");
+  const cloud = await register(env, "user_ada", "ada", "store", { appUrl: "https://shop.example.com/" });
+  assert.equal(cloud.json.identity.key, "domain:shop.example.com");
+
+  const headers = { "x-aegis-email": "bob@elsewhere.example", "x-aegis-email-verified": "true" };
+  const body = { workspaceName: "Bob", projectName: "Store", siteUrl: "https://www.shop.example.com/cart" };
+  const refused = await call(env, "POST", "/api/onboarding", { as: "user_bob", body, headers });
+  assert.equal(refused.status, 409, JSON.stringify(refused.json));
+  assert.equal(refused.json.code, "identity_in_use");
+  const other = await call(env, "POST", "/api/onboarding", { as: "user_bob", body: { ...body, siteUrl: "https://bob.example.com" }, headers });
+  assert.equal(other.status, 201, JSON.stringify(other.json));
+
+  // Adding the site later, as an environment, is the same claim.
+  const env2 = await call(env, "POST", `/api/projects/${other.json.project.id}/environments`, {
+    as: "user_bob", body: { id: "prod2", name: "Shop", baseUrl: "https://shop.example.com" },
+  });
+  assert.equal(env2.status, 201, "the project already has an identity (bob.example.com)");
+  db.db.prepare("UPDATE projects SET identity_kind = NULL, identity_key = NULL, identity_hash = NULL WHERE id = ?").run(other.json.project.id);
+  const env3 = await call(env, "POST", `/api/projects/${other.json.project.id}/environments`, {
+    as: "user_bob", body: { id: "prod3", name: "Shop again", baseUrl: "https://shop.example.com/login" },
+  });
+  assert.equal(env3.status, 409);
+  assert.equal(env3.json.code, "identity_in_use");
+});
+
+async function pair(env: Env, who: string, projectId: string, identity: unknown) {
+  const start = await call(env, "POST", "/api/device-authorizations", {
+    body: { projectId, projectName: projectId, environment: "local", storageProvider: "local", identity },
+  });
+  assert.equal(start.status, 201, JSON.stringify(start.json));
+  const claimed = await call(env, "POST", "/api/device-authorizations/claim", {
+    as: who,
+    headers: { "x-aegis-email": `${who}@example.com`, "x-aegis-email-verified": "true" },
+    body: { attemptId: start.json.attemptId, code: start.json.code, deviceId: projectId },
+  });
+  const poll = await call(env, "POST", "/api/device-authorizations/poll", { body: { attemptId: start.json.attemptId, pollSecret: start.json.pollSecret } });
+  return { claimed, poll };
+}
+
+test("CLI pairing joins a teammate's project for the same app, and refuses one from someone else's Free workspace", async () => {
+  const { env, db } = createTestEnv({ FEATURE_ENTITLEMENTS: "on" });
+  await workspace(env, "user_ada", "acme");
+  await register(env, "user_ada", "acme", "shop", { identity: web });
+  addMember(db, "acme", "user_bob");
+
+  const bob = await pair(env, "user_bob", "bobs-clone", webFromTeammate);
+  assert.equal(bob.claimed.status, 200, JSON.stringify(bob.claimed.json));
+  assert.equal(bob.claimed.json.joined, true);
+  assert.equal(bob.poll.json.status, "completed");
+  assert.equal(bob.poll.json.projectId, "shop", "the CLI learns which project it joined");
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS c FROM projects WHERE id = 'bobs-clone'").get()?.c, 0);
+  const key = db.db.prepare("SELECT project_ids_json AS ids FROM api_keys WHERE aegis_id = 'user_bob'").get() as { ids: string };
+  assert.deepEqual(JSON.parse(key.ids), ["shop"]);
+  assert.equal((db.db.prepare("SELECT role FROM workspace_memberships WHERE workspace_id = 'acme' AND aegis_id = 'user_bob'").get() as { role: string }).role, "member", "joining doesn't make them an owner");
+
+  const carol = await pair(env, "user_carol", "carols-clone", web);
+  assert.equal(carol.claimed.status, 409, JSON.stringify(carol.claimed.json));
+  assert.equal(carol.claimed.json.code, "identity_in_use");
+  assert.equal(carol.poll.json.status, "refused");
+  assert.equal(carol.poll.json.code, "identity_in_use");
+  assert.equal(db.db.prepare("SELECT COUNT(*) AS c FROM projects WHERE id = 'carols-clone'").get()?.c, 0);
+
+  // A new app pairs as a new project carrying its identity.
+  const fresh = await pair(env, "user_dan", "dans-app", { remote: "github.com/dan/app", appPath: "." });
+  assert.equal(fresh.claimed.status, 200);
+  assert.equal((db.db.prepare("SELECT identity_key AS k FROM projects WHERE id = 'dans-app'").get() as { k: string }).k, "repo:github.com/dan/app#.");
+});
+
+test("the CLI reports a project's identity once; another app can't take it over", async () => {
+  const { env } = createTestEnv({ DASHBOARD_URL: "https://dash.test" });
+  const { projectId, owner } = await seedProject(env);
+  const set = (identity: unknown) => call(env, "POST", `/api/projects/${projectId}/identity`, { as: owner, body: { identity } });
+  const first = await set(web);
+  assert.equal(first.status, 200, JSON.stringify(first.json));
+  assert.equal(first.json.identity.key, "repo:github.com/acme/shop#apps/web");
+  assert.equal((await set(webFromTeammate)).status, 200, "the same app again is fine");
+  const mismatch = await set(mobile);
+  assert.equal(mismatch.status, 409);
+  assert.equal(mismatch.json.code, "identity_mismatch");
+  assert.match(mismatch.json.error, /Each app is its own project/);
+  assert.equal((await set(null)).status, 422);
+});
+
+async function idle(db: Db, projectId: string, days: number, now = Date.now()) {
+  const at = new Date(now - days * DAY).toISOString();
+  db.db.prepare("UPDATE projects SET created_at = ? WHERE id = ?").run(at, projectId);
+  db.db.prepare("UPDATE audit_log SET created_at = ? WHERE project_id = ?").run(at, projectId);
+  db.db.prepare("UPDATE plan_drafts SET updated_at = ? WHERE project_id = ?").run(at, projectId);
+  db.db.prepare("UPDATE runs SET requested_at = ?, completed_at = NULL WHERE project_id = ?").run(at, projectId);
+}
+
+test("activity is the latest of every timestamp a project has, in either D1 format", () => {
+  assert.equal(parseRegistryTime("2026-09-01 10:00:00"), Date.parse("2026-09-01T10:00:00Z"));
+  assert.equal(lastActivityOf({
+    createdAt: "2026-01-01 00:00:00", workerSeenAt: null, activatedAt: null, runAt: "2026-03-01T00:00:00.000Z",
+    taskAt: null, planAt: "2026-02-01 00:00:00", journeyAt: null, auditAt: null,
+  }), Date.parse("2026-03-01T00:00:00Z"));
+});
+
+test("Free projects idle past inactiveProjectDays are paused: no runs, tasks or claims, not counted, until activated", async () => {
+  const { env, db } = createTestEnv({ FEATURE_ENTITLEMENTS: "on", DASHBOARD_URL: "https://dash.test" });
+  const { projectId, owner, workspaceId } = await seedProject(env);
+  await seedPlan(env, projectId, owner);
+  const queued = await call(env, "POST", `/api/projects/${projectId}/runs`, { as: owner, body: { planId: "checkout", idempotencyKey: "before-pause" } });
+  assert.equal(queued.status, 201, JSON.stringify(queued.json));
+
+  const now = new Date();
+  await idle(db, projectId, 29, now.getTime());
+  assert.deepEqual(await pauseInactiveProjects(env, now), { paused: 0, wouldPause: 0 }, "29 days isn't long enough");
+  await idle(db, projectId, 31, now.getTime());
+  await runScheduled(env, DAILY_CRON, now.getTime());
+  const row = db.db.prepare("SELECT inactive_at AS at FROM projects WHERE id = ?").get(projectId) as { at: string | null };
+  assert.ok(row.at, "the daily job paused it");
+
+  const listed = await call(env, "GET", "/api/projects", { as: owner });
+  assert.ok(listed.json.projects[0].inactiveAt);
+  const audit = await call(env, "GET", `/api/workspaces/${workspaceId}/audit-log`, { as: owner });
+  assert.ok(audit.json.entries.some((entry: { action: string }) => entry.action === "project.paused"));
+
+  const run = await call(env, "POST", `/api/projects/${projectId}/runs`, { as: owner, body: { planId: "checkout", idempotencyKey: "after-pause" } });
+  assert.equal(run.status, 409);
+  assert.equal(run.json.code, "project_inactive");
+  assert.equal(run.json.activateUrl, `https://dash.test/?project=${projectId}`);
+  assert.match(run.json.error, /paused after 30 days without activity/);
+  const task = await call(env, "POST", `/api/projects/${projectId}/tasks`, { as: owner, body: { title: "t", description: "d", idempotencyKey: "t1" } });
+  assert.equal(task.json.code, "project_inactive");
+  const claim = await call(env, "POST", `/api/runs/${queued.json.run.id}/claim`, { as: owner, body: { workerId: "w1" } });
+  assert.equal(claim.status, 409);
+  assert.equal(claim.json.code, "project_inactive");
+
+  // Paused, it doesn't count: the Free workspace has room for another project...
+  const features = await call(env, "GET", `/api/workspaces/${workspaceId}/features`, { as: owner });
+  assert.deepEqual(features.json.limits.inactiveProjectDays, { limit: 30, unlimited: false });
+  assert.equal(features.json.limits.projects.used, 0);
+  assert.equal((await register(env, owner, workspaceId, "second")).status, 201);
+  // ...and activating it again needs room.
+  const full = await call(env, "POST", `/api/projects/${projectId}/activate`, { as: owner });
+  assert.equal(full.status, 402);
+  assert.equal(full.json.code, "plan_limit");
+  assert.equal((await call(env, "POST", `/api/projects/${projectId}/activate`, { as: "user_stranger" })).status, 403);
+
+  db.db.prepare("INSERT INTO workspace_plans (workspace_id, plan) VALUES (?, 'team')").run(workspaceId);
+  const activated = await call(env, "POST", `/api/projects/${projectId}/activate`, { as: owner });
+  assert.equal(activated.status, 200, JSON.stringify(activated.json));
+  assert.equal(activated.json.activated, true);
+  assert.equal((await call(env, "POST", `/api/projects/${projectId}/activate`, { as: owner })).json.alreadyActive, true);
+  const after = await call(env, "GET", `/api/workspaces/${workspaceId}/audit-log`, { as: owner });
+  assert.ok(after.json.entries.some((entry: { action: string }) => entry.action === "project.activated"));
+  assert.equal((await call(env, "POST", `/api/projects/${projectId}/runs`, { as: owner, body: { planId: "checkout", idempotencyKey: "after-activate" } })).status, 201);
+
+  // Paid plans never pause, however long a project sits idle.
+  await idle(db, projectId, 400, now.getTime());
+  db.db.prepare("UPDATE projects SET activated_at = NULL").run();
+  assert.equal((await pauseInactiveProjects(env, now)).paused, 0);
+  const teamFeatures = await call(env, "GET", `/api/workspaces/${workspaceId}/features`, { as: owner });
+  assert.deepEqual(teamFeatures.json.limits.inactiveProjectDays, { limit: null, unlimited: true });
+});
+
+test("recent activity keeps a project active, and shadow mode only logs", async () => {
+  const { env, db } = createTestEnv({ FEATURE_ENTITLEMENTS: "on" });
+  const { projectId } = await seedProject(env);
+  const now = new Date();
+  await idle(db, projectId, 60, now.getTime());
+  db.db.prepare("UPDATE projects SET local_worker_seen_at = ? WHERE id = ?").run(new Date(now.getTime() - 2 * DAY).toISOString(), projectId);
+  assert.equal((await pauseInactiveProjects(env, now)).paused, 0, "a machine checked in two days ago");
+
+  const shadow = createTestEnv({ FEATURE_ENTITLEMENTS: "shadow" });
+  const seeded = await seedProject(shadow.env);
+  await idle(shadow.db, seeded.projectId, 60, now.getTime());
+  assert.deepEqual(await pauseInactiveProjects(shadow.env, now), { paused: 0, wouldPause: 1 });
+  assert.equal((shadow.db.db.prepare("SELECT inactive_at AS at FROM projects").get() as { at: string | null }).at, null);
+
+  const off = createTestEnv();
+  const offSeed = await seedProject(off.env);
+  await idle(off.db, offSeed.projectId, 60, now.getTime());
+  assert.deepEqual(await pauseInactiveProjects(off.env, now), { paused: 0, wouldPause: 0 });
+});

package/src/registry-worker/proposals/proposals.test.ts

@@ -0,0 +1,80 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { call, createTestEnv, seedProject } from "../testing/harness.js";
+
+async function inviteAndJoin(env: Parameters<typeof call>[0], inviter: string, workspaceId: string, who: string, role: string) {
+  const invited = await call(env, "POST", `/api/workspaces/${workspaceId}/invitations`, { as: inviter, body: { email: `${who}@example.com`, role } });
+  const token = invited.json.invitation.acceptUrl.split("/invite/")[1];
+  await call(env, "POST", `/api/invitations/${token}/accept`, { as: who });
+}
+
+const loginCase = (title: string) => ({
+  title, nodeId: "screen:/login", intent: "Prove a person can sign in.",
+  steps: ["Open /login", "Sign in"], expected: ["The dashboard opens"], confidence: "high", basis: ["spec"],
+});
+
+async function setup(storageProvider = "bugmole") {
+  const setupEnv = createTestEnv();
+  const project = await seedProject(setupEnv.env, { storageProvider });
+  const key = `projects/${project.projectId}/test-cases/login.json`;
+  await setupEnv.artifacts.put(key, JSON.stringify({ schemaVersion: 1, caseSetId: "login", journeyId: "j", journeyRevision: 1, cases: [{ caseId: "TC-login", ...loginCase("Sign in works") }] }));
+  const propose = (body: Record<string, unknown>, as = project.owner) =>
+    call(setupEnv.env, "POST", `/api/projects/${project.projectId}/proposals`, { as, body: { caseSetId: "login", caseId: "TC-login", source: "mcp", summary: "Name the password path", ...body } });
+  const readSet = async () => JSON.parse(await (await setupEnv.artifacts.get(key))!.text());
+  return { ...setupEnv, ...project, propose, readSet };
+}
+
+test("a proposal waits for a manager, and accepting it on Bugmole storage writes revision 2 and obsoletes revision 1", async () => {
+  const { env, owner, workspaceId, propose, readSet } = await setup();
+  await inviteAndJoin(env, owner, workspaceId, "user_member", "member");
+  const proposed = await propose({ action: "change", baseRevision: 1, case: loginCase("Sign in with a password works") }, "user_member");
+  assert.equal(proposed.status, 201, JSON.stringify(proposed.json));
+  assert.equal(proposed.json.proposal.status, "pending", "auto mode reviews spec changes like code");
+  assert.equal(proposed.json.proposal.proposedBy, "user_member");
+  const id = proposed.json.proposal.id;
+
+  assert.equal((await call(env, "POST", `/api/proposals/${id}/accept`, { as: "user_member" })).status, 403, "members propose, managers decide");
+  const accepted = await call(env, "POST", `/api/proposals/${id}/accept`, { as: owner });
+  assert.equal(accepted.status, 200, JSON.stringify(accepted.json));
+  assert.deepEqual([accepted.json.proposal.status, accepted.json.proposal.appliedRevision], ["accepted", 2]);
+  const set = await readSet();
+  assert.deepEqual(set.cases.map((testCase: { revision?: number; status?: string }) => [testCase.revision ?? 1, testCase.status ?? "active"]), [[1, "obsolete"], [2, "active"]]);
+  assert.equal(set.cases[1].proposalId, id);
+  assert.equal((await call(env, "POST", `/api/proposals/${id}/accept`, { as: owner })).status, 409, "deciding twice");
+});
+
+test("a proposal against a revision that moved on is marked outdated, and a rejected one changes nothing", async () => {
+  const { env, owner, propose, readSet } = await setup();
+  const first = (await propose({ action: "change", baseRevision: 1, case: loginCase("B") })).json.proposal.id;
+  const second = (await propose({ action: "change", baseRevision: 1, case: loginCase("C") })).json.proposal.id;
+  await call(env, "POST", `/api/proposals/${first}/accept`, { as: owner });
+  const stale = await call(env, "POST", `/api/proposals/${second}/accept`, { as: owner });
+  assert.equal(stale.json.proposal.status, "outdated");
+  assert.match(stale.json.proposal.decisionNote, /revision 2, not 1/);
+
+  const third = (await propose({ action: "retire", baseRevision: 2 })).json.proposal.id;
+  const rejected = await call(env, "POST", `/api/proposals/${third}/reject`, { as: owner, body: { note: "Still needed" } });
+  assert.deepEqual([rejected.json.proposal.status, rejected.json.proposal.decisionNote], ["rejected", "Still needed"]);
+  assert.equal((await readSet()).cases.at(-1).status, "active");
+});
+
+test("extreme mode accepts on arrival; a project's own storage leaves applying to its worker", async () => {
+  const { env, owner, projectId, propose } = await setup("local");
+  await call(env, "PATCH", `/api/projects/${projectId}/settings`, { as: owner, body: { taskApprovalMode: "extreme" } });
+  const proposal = (await propose({ action: "add", caseId: "TC-new", case: loginCase("New") })).json.proposal;
+  assert.deepEqual([proposal.status, proposal.decidedBy, proposal.appliedAt], ["accepted", "auto:extreme", null]);
+
+  const waiting = await call(env, "GET", `/api/projects/${projectId}/proposals?unapplied=1`, { as: owner });
+  assert.deepEqual(waiting.json.proposals.map((item: { id: string }) => item.id), [proposal.id]);
+  const done = await call(env, "POST", `/api/proposals/${proposal.id}/applied`, { as: owner, body: { outcome: "applied", revision: 1 } });
+  assert.equal(done.json.proposal.appliedRevision, 1);
+  assert.equal((await call(env, "GET", `/api/projects/${projectId}/proposals?unapplied=1`, { as: owner })).json.proposals.length, 0);
+});
+
+test("a proposal must say why, name its base revision, and carry a valid case", async () => {
+  const { propose } = await setup();
+  assert.equal((await propose({ action: "change", baseRevision: 1, case: loginCase("x"), summary: "" })).status, 422);
+  assert.equal((await propose({ action: "change", case: loginCase("x") })).status, 422);
+  assert.equal((await propose({ action: "change", baseRevision: 1, case: { ...loginCase("x"), steps: [] } })).status, 422);
+  assert.equal((await propose({ action: "rename", baseRevision: 1 })).status, 422);
+});

package/src/registry-worker/proposals/routes.ts

@@ -0,0 +1,183 @@
+// Proposals: a developer, an agent or a person in the dashboard suggests a
+// change to a test case, and it becomes a new revision once accepted. The
+// project's approval mode decides whether a manager must accept it (manual,
+// auto) or it's accepted on arrival (extreme). On Bugmole storage the
+// registry applies an accepted proposal itself; on a project's own storage,
+// `bugmole serve` or the proposing CLI applies it and reports back.
+import type { Env } from "../core.js";
+import { can, memberOfProject, randomToken, requestJson, response } from "../core.js";
+import { proposalDecidedHooks } from "../hooks.js";
+import { auditProject } from "../org/audit.js";
+import { matchPath, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
+import { DEFAULT_APPROVAL_MODE, approvalModeOf, autoApprover, needsApproval } from "../../registry/task-scheduling.js";
+import { applyTestCaseChange, caseProblem, type CaseSetDocument, type RevisionedCase, type TestCaseChange } from "../../registry/test-case-revisions.js";
+
+const ACTIONS = ["add", "change", "retire"] as const;
+const SOURCES = ["mcp", "cli", "dashboard"] as const;
+const CASE_SET_ID = /^[a-zA-Z0-9._-]+$/;
+
+const proposalSelect = `
+  SELECT id, project_id AS projectId, kind, case_set_id AS caseSetId, case_id AS caseId, action,
+         base_revision AS baseRevision, proposed_json AS proposedJson, summary, source,
+         proposed_by AS proposedBy, status, decided_by AS decidedBy, decided_at AS decidedAt,
+         decision_note AS decisionNote, applied_at AS appliedAt, applied_revision AS appliedRevision,
+         created_at AS createdAt
+  FROM spec_proposals`;
+
+type ProposalRow = {
+  id: string; projectId: string; kind: string; caseSetId: string; caseId: string; action: TestCaseChange["action"];
+  baseRevision: number | null; proposedJson: string | null; summary: string; source: string; proposedBy: string;
+  status: string; decidedBy: string | null; decidedAt: string | null; decisionNote: string | null;
+  appliedAt: string | null; appliedRevision: number | null; createdAt: string;
+};
+
+function view(row: ProposalRow) {
+  const { proposedJson, ...rest } = row;
+  let proposed: unknown = null;
+  try {
+    proposed = proposedJson ? JSON.parse(proposedJson) : null;
+  } catch {
+    proposed = null;
+  }
+  return { ...rest, proposed };
+}
+
+/** Tells integrations (Jira) a proposal was decided or applied. A failing hook never fails the request. */
+async function announce(env: Env, row: ProposalRow): Promise<void> {
+  for (const hook of proposalDecidedHooks) {
+    await hook(env, { projectId: row.projectId, proposalId: row.id, status: row.status, applied: Boolean(row.appliedAt) })
+      .catch((error) => console.error("[proposals] decision hook failed", error));
+  }
+}
+
+function changeOf(row: ProposalRow): TestCaseChange {
+  const proposed = (row.proposedJson ? JSON.parse(row.proposedJson) : {}) as RevisionedCase;
+  if (row.action === "add") return { action: "add", case: { ...proposed, caseId: row.caseId } };
+  if (row.action === "retire") return { action: "retire", caseId: row.caseId, baseRevision: row.baseRevision ?? 0 };
+  return { action: "change", caseId: row.caseId, baseRevision: row.baseRevision ?? 0, case: { ...proposed, caseId: row.caseId } };
+}
+
+async function load(env: Env, id: string): Promise<ProposalRow | null> {
+  return env.DB.prepare(`${proposalSelect} WHERE id = ?`).bind(id).first<ProposalRow>();
+}
+
+async function managed(env: Env, projectId: string): Promise<boolean> {
+  const row = await env.DB.prepare("SELECT storage_mode AS storageMode FROM projects WHERE id = ?").bind(projectId).first<{ storageMode: string }>();
+  return row?.storageMode === "managed" && Boolean(env.ARTIFACTS);
+}
+
+/**
+ * Applies an accepted proposal to Bugmole storage. Returns the updated row;
+ * a proposal the case moved past becomes "outdated" instead of overwriting.
+ */
+async function applyManaged(env: Env, row: ProposalRow): Promise<ProposalRow> {
+  const key = `projects/${row.projectId}/test-cases/${row.caseSetId}.json`;
+  const object = await env.ARTIFACTS!.get(key);
+  const outcome = object
+    ? applyTestCaseChange(JSON.parse(await object.text()) as CaseSetDocument, changeOf(row), { proposalId: row.id })
+    : { ok: false as const, reason: "missing" as const, message: `There's no case set ${row.caseSetId}` };
+  if (!outcome.ok) {
+    await env.DB.prepare("UPDATE spec_proposals SET status = 'outdated', decision_note = ? WHERE id = ?").bind(outcome.message, row.id).run();
+  } else {
+    await env.ARTIFACTS!.put(key, `${JSON.stringify(outcome.caseSet, null, 2)}\n`, { httpMetadata: { contentType: "application/json" } });
+    await env.DB.prepare("UPDATE spec_proposals SET applied_at = CURRENT_TIMESTAMP, applied_revision = ? WHERE id = ?").bind(outcome.revision, row.id).run();
+  }
+  return (await load(env, row.id))!;
+}
+
+async function propose({ env, principal, request }: AuthedRouteContext, projectId: string): Promise<Response> {
+  if (!can(principal, "tasks:write") && !can(principal, "projects:write") && !can(principal, "*")) return response({ error: "Proposing changes is not allowed" }, 403);
+  if (!(await memberOfProject(env, principal, projectId, "project.write"))) return response({ error: "Project scope is not allowed" }, 403);
+  const body = await requestJson(request);
+  const action = ACTIONS.find((item) => item === body?.action);
+  const caseSetId = typeof body?.caseSetId === "string" ? body.caseSetId.trim() : "";
+  const proposed = (body?.case && typeof body.case === "object" ? body.case : null) as RevisionedCase | null;
+  const caseId = typeof body?.caseId === "string" ? body.caseId.trim() : proposed?.caseId ?? "";
+  const summary = typeof body?.summary === "string" ? body.summary.trim() : "";
+  const source = SOURCES.find((item) => item === body?.source) ?? "dashboard";
+  const baseRevision = Number.isInteger(body?.baseRevision) ? body!.baseRevision as number : null;
+  if (!action) return response({ error: "action must be add, change or retire" }, 422);
+  if (!CASE_SET_ID.test(caseSetId) || !CASE_SET_ID.test(caseId)) return response({ error: "caseSetId and caseId may contain only letters, numbers, ., _ and -" }, 422);
+  if (!summary) return response({ error: "Say why in summary" }, 422);
+  if (action !== "add" && !baseRevision) return response({ error: "baseRevision is the revision you're changing" }, 422);
+  if (action !== "retire") {
+    const problem = caseProblem(proposed ? { ...proposed, caseId } : undefined);
+    if (problem) return response({ error: problem }, 422);
+  }
+  const mode = approvalModeOf((await env.DB.prepare("SELECT task_approval_mode AS mode FROM projects WHERE id = ?").bind(projectId).first<{ mode: string }>())?.mode) ?? DEFAULT_APPROVAL_MODE;
+  // A spec change is reviewed like a code change: it waits in manual and auto.
+  const autoAccepted = !needsApproval(mode, "code");
+  const id = `prop_${randomToken(10)}`;
+  await env.DB.prepare(`
+    INSERT INTO spec_proposals (id, project_id, kind, case_set_id, case_id, action, base_revision, proposed_json, summary, source, proposed_by, status, decided_by, decided_at)
+    VALUES (?, ?, 'test_case', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CASE WHEN ? THEN CURRENT_TIMESTAMP ELSE NULL END)
+  `).bind(
+    id, projectId, caseSetId, caseId, action, baseRevision, action === "retire" ? null : JSON.stringify(proposed),
+    summary, source, principal.email || principal.aegisId, autoAccepted ? "accepted" : "pending", autoAccepted ? autoApprover(mode) : null, autoAccepted ? 1 : 0,
+  ).run();
+  let row = (await load(env, id))!;
+  if (autoAccepted && (await managed(env, projectId))) row = await applyManaged(env, row);
+  if (autoAccepted) await announce(env, row);
+  return response({ proposal: view(row) }, 201);
+}
+
+async function list({ env, principal, url }: AuthedRouteContext, projectId: string): Promise<Response> {
+  if (!(await memberOfProject(env, principal, projectId))) return response({ error: "Project scope is not allowed" }, 403);
+  const status = url.searchParams.get("status");
+  const unapplied = url.searchParams.get("unapplied") === "1";
+  const rows = await env.DB.prepare(`
+    ${proposalSelect}
+    WHERE project_id = ? AND (? IS NULL OR status = ?) AND (? = 0 OR (status = 'accepted' AND applied_at IS NULL))
+    ORDER BY created_at DESC LIMIT 200
+  `).bind(projectId, status, status, unapplied ? 1 : 0).all<ProposalRow>();
+  return response({ proposals: rows.results.map(view) });
+}
+
+async function decide({ env, principal, request }: AuthedRouteContext, id: string, decision: "accept" | "reject"): Promise<Response> {
+  const row = await load(env, id);
+  if (!row || !(await memberOfProject(env, principal, row.projectId))) return response({ error: "Proposal not found" }, 404);
+  if (!(await memberOfProject(env, principal, row.projectId, "project.manage"))) return response({ error: "Only project managers can accept or reject proposals" }, 403);
+  if (row.status !== "pending") return response({ error: `This proposal is already ${row.status}` }, 409);
+  const body = await requestJson(request);
+  const note = typeof body?.note === "string" && body.note.trim() ? body.note.trim().slice(0, 500) : null;
+  await env.DB.prepare("UPDATE spec_proposals SET status = ?, decided_by = ?, decided_at = CURRENT_TIMESTAMP, decision_note = ? WHERE id = ? AND status = 'pending'")
+    .bind(decision === "accept" ? "accepted" : "rejected", principal.email || principal.aegisId, note, id).run();
+  await auditProject(env, principal, row.projectId, { action: `proposal.${decision === "accept" ? "accepted" : "rejected"}`, targetType: "proposal", targetId: id }, request);
+  let updated = (await load(env, id))!;
+  if (decision === "accept" && (await managed(env, row.projectId))) updated = await applyManaged(env, updated);
+  await announce(env, updated);
+  return response({ proposal: view(updated) });
+}
+
+/** A worker or CLI that applied an accepted proposal to the project's own storage reports the outcome. */
+async function applied({ env, principal, request }: AuthedRouteContext, id: string): Promise<Response> {
+  const row = await load(env, id);
+  if (!row || !(await memberOfProject(env, principal, row.projectId, "project.write"))) return response({ error: "Proposal not found" }, 404);
+  if (row.status !== "accepted" || row.appliedAt) return response({ error: "Only an accepted, unapplied proposal can be applied" }, 409);
+  const body = await requestJson(request);
+  if (body?.outcome === "outdated") {
+    const message = typeof body.message === "string" ? body.message.slice(0, 500) : "The case changed since this was proposed";
+    await env.DB.prepare("UPDATE spec_proposals SET status = 'outdated', decision_note = ? WHERE id = ?").bind(message, id).run();
+  } else {
+    const revision = Number.isInteger(body?.revision) ? body!.revision as number : null;
+    await env.DB.prepare("UPDATE spec_proposals SET applied_at = CURRENT_TIMESTAMP, applied_revision = ? WHERE id = ?").bind(revision, id).run();
+  }
+  const updated = (await load(env, id))!;
+  await announce(env, updated);
+  return response({ proposal: view(updated) });
+}
+
+registerRoutes(async (context) => {
+  const { request, url } = context;
+  const projectMatch = matchPath(url.pathname, "/api/projects/:projectId/proposals");
+  if (projectMatch && request.method === "POST") return propose(context, projectMatch.projectId);
+  if (projectMatch && request.method === "GET") return list(context, projectMatch.projectId);
+  const acceptMatch = matchPath(url.pathname, "/api/proposals/:proposalId/accept");
+  if (acceptMatch && request.method === "POST") return decide(context, acceptMatch.proposalId, "accept");
+  const rejectMatch = matchPath(url.pathname, "/api/proposals/:proposalId/reject");
+  if (rejectMatch && request.method === "POST") return decide(context, rejectMatch.proposalId, "reject");
+  const appliedMatch = matchPath(url.pathname, "/api/proposals/:proposalId/applied");
+  if (appliedMatch && request.method === "POST") return applied(context, appliedMatch.proposalId);
+  return null;
+});
+

package/src/registry-worker/roles/roles.test.ts

@@ -0,0 +1,84 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { call, createTestEnv, seedProject } from "../testing/harness.js";
+
+async function setup() {
+  const { env, db } = createTestEnv();
+  const { owner, workspaceId, projectId } = await seedProject(env);
+  const key = await call(env, "POST", "/api/api-keys", { as: owner, body: { name: "agent", projectIds: [projectId] } });
+  assert.equal(key.status, 201, JSON.stringify(key.json));
+  const token: string = key.json.token;
+  const roles = `/api/projects/${projectId}/roles`;
+  return { env, db, owner, workspaceId, projectId, token, roles };
+}
+
+test("an agent's role is only a suggestion until a person confirms it", async () => {
+  const { env, owner, token, roles, db } = await setup();
+  const suggested = await call(env, "POST", roles, {
+    token,
+    body: { name: "Signed-in Member", description: "Signed-in shopper.", source: "sign_in_wall", evidence: "sign-in screen at /login" },
+  });
+  assert.equal(suggested.status, 201, JSON.stringify(suggested.json));
+  assert.equal(suggested.json.role.name, "signed_in_member", "names become actor ids");
+  assert.equal(suggested.json.role.status, "suggested");
+  assert.equal(suggested.json.role.source, "sign_in_wall");
+
+  const pretendPerson = await call(env, "POST", roles, { token, body: { name: "admin", description: "x", source: "person" } });
+  assert.equal(pretendPerson.status, 422, "an API key can't add a confirmed role, and a suggestion needs evidence");
+  const noEvidence = await call(env, "POST", roles, { token, body: { name: "admin", description: "Admin" } });
+  assert.equal(noEvidence.status, 422);
+
+  const byKey = await call(env, "PATCH", `${roles}/${suggested.json.role.id}`, { token, body: { action: "confirm" } });
+  assert.equal(byKey.status, 403, "an agent can't confirm its own suggestion");
+
+  const confirmed = await call(env, "PATCH", `${roles}/${suggested.json.role.id}`, { as: owner, body: { action: "confirm", name: "member" } });
+  assert.equal(confirmed.status, 200, JSON.stringify(confirmed.json));
+  assert.equal(confirmed.json.role.status, "confirmed");
+  assert.equal(confirmed.json.role.name, "member", "confirming can rename");
+  assert.equal(confirmed.json.role.decidedBy, owner);
+
+  const listed = await call(env, "GET", `${roles}?status=confirmed`, { token });
+  assert.deepEqual(listed.json.roles.map((role: { name: string }) => role.name), ["member"]);
+
+  const audit = db.db.prepare("SELECT action, data_json AS data FROM audit_log WHERE target_type = 'role' ORDER BY rowid").all() as Array<{ action: string; data: string }>;
+  assert.deepEqual(audit.map((row) => row.action), ["role.suggested", "role.confirmed"]);
+  assert.match(audit[1].data, /renamedFrom/);
+});
+
+test("a rejected role stays rejected however often it is suggested again", async () => {
+  const { env, owner, token, roles } = await setup();
+  const body = { name: "admin", description: "Admin area user.", source: "role_gated_route", evidence: "route /admin" };
+  const first = await call(env, "POST", roles, { token, body });
+  const rejected = await call(env, "PATCH", `${roles}/${first.json.role.id}`, { as: owner, body: { action: "reject" } });
+  assert.equal(rejected.json.role.status, "rejected");
+
+  const again = await call(env, "POST", roles, { token, body: { ...body, evidence: "menu Admin" } });
+  assert.equal(again.status, 200);
+  assert.equal(again.json.role.status, "rejected");
+  assert.equal(again.json.alreadyDecided, true);
+
+  // A person can still change their mind.
+  const confirmed = await call(env, "PATCH", `${roles}/${first.json.role.id}`, { as: owner, body: { action: "confirm" } });
+  assert.equal(confirmed.json.role.status, "confirmed");
+});
+
+test("a manager adding a role picks it; members and strangers can't decide", async () => {
+  const { env, owner, workspaceId, roles } = await setup();
+  const added = await call(env, "POST", roles, { as: owner, body: { name: "guest", description: "Not signed in." } });
+  assert.equal(added.status, 201);
+  assert.equal(added.json.role.status, "confirmed");
+  assert.equal(added.json.role.source, "person");
+
+  const invited = await call(env, "POST", `/api/workspaces/${workspaceId}/invitations`, { as: owner, body: { email: "m@example.com", role: "member" } });
+  const inviteToken = invited.json.invitation.acceptUrl.split("/invite/")[1];
+  await call(env, "POST", `/api/invitations/${inviteToken}/accept`, { as: "user_member" });
+  const byMember = await call(env, "POST", roles, { as: "user_member", body: { name: "admin", description: "Admin.", evidence: "I saw an admin link" } });
+  assert.equal(byMember.status, 201);
+  assert.equal(byMember.json.role.status, "suggested", "a member's role is a suggestion");
+  assert.equal((await call(env, "PATCH", `${roles}/${byMember.json.role.id}`, { as: "user_member", body: { action: "confirm" } })).status, 403);
+  assert.equal((await call(env, "GET", roles, { as: "user_stranger" })).status, 403);
+
+  const clash = await call(env, "PATCH", `${roles}/${byMember.json.role.id}`, { as: owner, body: { action: "confirm", name: "guest" } });
+  assert.equal(clash.status, 409);
+  assert.equal((await call(env, "DELETE", `${roles}/${byMember.json.role.id}`, { as: owner })).status, 200);
+});