@1agh/maude 0.22.2 → 0.24.0

package/cli/commands/hub.test.mjs

@@ -3,12 +3,14 @@
 
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { test } from 'node:test';
 import { fileURLToPath } from 'node:url';
 
+import { readTokens } from '../../plugins/design/hub/src/tokens.mjs';
+
 const BIN = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'maude.mjs');
 
 function runCli(args, { cwd } = {}) {
@@ -30,8 +32,10 @@ function withDataDir(fn) {
 test('hub help prints subcommand summary on stdout', () => {
   const res = runCli(['hub', 'help']);
   assert.equal(res.status, 0, res.stderr);
-  assert.match(res.stdout, /maude hub <serve\|token\|status>/);
+  assert.match(res.stdout, /maude hub <serve\|token\|status\|deploy>/);
   assert.match(res.stdout, /token generate --label NAME/);
+  assert.match(res.stdout, /token rotate --label NAME/);
+  assert.match(res.stdout, /deploy <fly\|docker>/);
 });
 
 test('hub token generate without --label exits 2', () => {
@@ -40,7 +44,7 @@ test('hub token generate without --label exits 2', () => {
   assert.match(res.stderr, /--label <name> is required/);
 });
 
-test('hub token generate writes tokens.json + prints the connect command', () => {
+test('hub token generate persists to the store + prints the connect command', () => {
   withDataDir((dataDir) => {
     const res = runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
     assert.equal(res.status, 0, res.stderr);
@@ -48,11 +52,11 @@ test('hub token generate writes tokens.json + prints the connect command', () =>
     assert.match(res.stdout, /value:\s+mau_[0-9a-f]{32}/);
     assert.match(res.stdout, /maude design link/);
 
-    const raw = readFileSync(join(dataDir, 'tokens.json'), 'utf8');
-    const parsed = JSON.parse(raw);
-    assert.equal(parsed.tokens.length, 1);
-    assert.equal(parsed.tokens[0].label, 'alice');
-    assert.match(parsed.tokens[0].value, /^mau_[0-9a-f]{32}$/);
+    const { tokens } = readTokens(dataDir);
+    assert.equal(tokens.length, 1);
+    assert.equal(tokens[0].label, 'alice');
+    // The raw value is never persisted — only labels/metadata are listable.
+    assert.equal(tokens[0].value, undefined);
   });
 });
 
@@ -61,8 +65,7 @@ test('hub token generate --label is idempotent (overwrites in place)', () => {
     runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
     runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
 
-    const parsed = JSON.parse(readFileSync(join(dataDir, 'tokens.json'), 'utf8'));
-    assert.equal(parsed.tokens.length, 1);
+    assert.equal(readTokens(dataDir).tokens.length, 1);
   });
 });
 
@@ -74,6 +77,128 @@ test('hub token generate --dev uses mau_dev_ prefix', () => {
   });
 });
 
+test("hub token generate --scope '*' mints a hub-wide (wildcard) token", () => {
+  withDataDir((dataDir) => {
+    // Array-arg spawn (no shell) → '*' is passed literally, not glob-expanded.
+    const res = runCli([
+      'hub',
+      'token',
+      'generate',
+      '--label',
+      'peer',
+      '--scope',
+      '*',
+      '--data',
+      dataDir,
+    ]);
+    assert.equal(res.status, 0, res.stderr);
+    assert.match(res.stdout, /scope:\s+\*/);
+    const { tokens } = readTokens(dataDir);
+    assert.equal(tokens.length, 1);
+    // Wildcard is stored as NULL and surfaced as '*' — authorizes any documentName.
+    assert.equal(tokens[0].scope, '*');
+  });
+});
+
+test('hub token generate --scope <value> binds the token to that documentName prefix', () => {
+  withDataDir((dataDir) => {
+    const res = runCli([
+      'hub',
+      'token',
+      'generate',
+      '--label',
+      'peer',
+      '--scope',
+      'team-x',
+      '--data',
+      dataDir,
+    ]);
+    assert.equal(res.status, 0, res.stderr);
+    assert.match(res.stdout, /scope:\s+team-x/);
+    assert.equal(readTokens(dataDir).tokens[0].scope, 'team-x');
+  });
+});
+
+test('hub token generate without --scope defaults the scope to the label (DDR-053)', () => {
+  withDataDir((dataDir) => {
+    runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
+    assert.equal(readTokens(dataDir).tokens[0].scope, 'alice');
+  });
+});
+
+test('hub token rotate mints a fresh value for an existing label', () => {
+  withDataDir((dataDir) => {
+    const gen = runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
+    const firstValue = /value:\s+(mau_[0-9a-f]{32})/.exec(gen.stdout)?.[1];
+    assert.ok(firstValue, 'generate printed a value');
+
+    const rot = runCli(['hub', 'token', 'rotate', '--label', 'alice', '--data', dataDir]);
+    assert.equal(rot.status, 0, rot.stderr);
+    const rotatedValue = /value:\s+(mau_[0-9a-f]{32})/.exec(rot.stdout)?.[1];
+    assert.ok(rotatedValue, 'rotate printed a value');
+    assert.notEqual(rotatedValue, firstValue, 'rotate changed the value');
+    assert.match(rot.stdout, /rotated in/);
+    // Still exactly one token under that label.
+    assert.equal(readTokens(dataDir).tokens.length, 1);
+  });
+});
+
+test('hub token rotate on a missing label exits 1', () => {
+  withDataDir((dataDir) => {
+    const res = runCli(['hub', 'token', 'rotate', '--label', 'ghost', '--data', dataDir]);
+    assert.equal(res.status, 1);
+    assert.match(res.stderr, /no token with label "ghost"/);
+  });
+});
+
+test('hub deploy fly emits fly.toml + Dockerfile with substituted placeholders', () => {
+  withDataDir((outDir) => {
+    const res = runCli([
+      'hub',
+      'deploy',
+      'fly',
+      '--name',
+      'maude-hub-test',
+      '--region',
+      'fra',
+      '--out',
+      outDir,
+    ]);
+    assert.equal(res.status, 0, res.stderr);
+    const flyToml = readFileSync(join(outDir, 'fly.toml'), 'utf8');
+    assert.match(flyToml, /app = "maude-hub-test"/);
+    assert.match(flyToml, /primary_region = "fra"/);
+    assert.doesNotMatch(flyToml, /\{\{/, 'no unsubstituted placeholders');
+    assert.ok(existsSync(join(outDir, 'Dockerfile')), 'Dockerfile copied alongside');
+  });
+});
+
+test('hub deploy docker emits compose + Caddyfile with the image tag', () => {
+  withDataDir((outDir) => {
+    const res = runCli(['hub', 'deploy', 'docker', '--tag', 'v9.9.9', '--out', outDir]);
+    assert.equal(res.status, 0, res.stderr);
+    const compose = readFileSync(join(outDir, 'docker-compose.yml'), 'utf8');
+    assert.match(compose, /ghcr\.io\/1agh\/maude-hub:v9\.9\.9/);
+    assert.doesNotMatch(compose, /\{\{/, 'no unsubstituted placeholders');
+    assert.ok(existsSync(join(outDir, 'Caddyfile')), 'Caddyfile emitted');
+  });
+});
+
+test('hub deploy refuses to overwrite without --force', () => {
+  withDataDir((outDir) => {
+    runCli(['hub', 'deploy', 'docker', '--out', outDir]);
+    const res = runCli(['hub', 'deploy', 'docker', '--out', outDir]);
+    assert.equal(res.status, 1);
+    assert.match(res.stderr, /already exists.*--force/s);
+  });
+});
+
+test('hub deploy with an unknown target exits 2', () => {
+  const res = runCli(['hub', 'deploy', 'kubernetes']);
+  assert.equal(res.status, 2);
+  assert.match(res.stderr, /target must be one of/);
+});
+
 test('hub status against an unreachable URL exits 1 with diagnostic', () => {
   const res = runCli(['hub', 'status', 'http://127.0.0.1:1']);
   assert.equal(res.status, 1);

package/cli/commands/init.mjs

@@ -74,6 +74,9 @@ export async function run({ args, pkgRoot }) {
   const result = await copyTree(skeleton, aiDir, {
     force: !!flags.force,
     dryRun: !!flags['dry-run'],
+    // npm strips `.gitignore` from published tarballs, so the cache-ignore
+    // template ships as `gitignore` and is renamed to `.gitignore` on copy.
+    rename: (name) => (name === 'gitignore' ? '.gitignore' : name),
     transformMatch: (p) => TEMPLATED.some((t) => p.endsWith(t)),
     transform: ({ srcPath, contents }) => {
       let out = contents.replaceAll(PLACEHOLDER, projectName);

package/cli/commands/preflight.mjs

@@ -0,0 +1,11 @@
+import { runPreflight } from '../lib/preflight.mjs';
+
+// `maude preflight --plugin <design|flow> [--json|--shell-export|--warn-only|--quiet] [--cache PATH]`
+// Thin command over cli/lib/preflight.mjs. Plugin bin scripts + hooks call this
+// instead of shelling to a relative `$PKG_ROOT/cli/lib/preflight.mjs` — in a
+// marketplace install the plugin is copied alone (no sibling cli/), so the
+// only reachable entry is the on-PATH `maude` binary. See DDR-061.
+
+export async function run({ args, pkgRoot }) {
+  return runPreflight({ args, pkgRoot });
+}

package/cli/commands/preflight.test.mjs

@@ -0,0 +1,46 @@
+// `maude preflight` resolves the plugin manifest from the maude PACKAGE root,
+// never the caller's cwd. This is the DDR-061 regression: in a marketplace
+// install the plugin is copied alone (no sibling cli/), and bin scripts reach
+// the check through the on-PATH `maude` binary — invoked from an arbitrary
+// target-repo cwd. Spawning from a temp cwd that has no `plugins/` proves the
+// resolution doesn't depend on cwd.
+
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const BIN = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'maude.mjs');
+
+function runFromTmp(args) {
+  const cwd = mkdtempSync(join(tmpdir(), 'maude-preflight-'));
+  try {
+    return spawnSync(process.execPath, [BIN, 'preflight', ...args], { cwd, encoding: 'utf8' });
+  } finally {
+    rmSync(cwd, { recursive: true, force: true });
+  }
+}
+
+test('preflight resolves the manifest from pkgRoot, not cwd (marketplace-layout regression)', () => {
+  // cwd has no plugins/ — if resolution used cwd this would error "manifest not found".
+  const res = runFromTmp(['--plugin', 'design', '--shell-export']);
+  assert.equal(res.status === 0 || res.status === 1, true, res.stderr); // 0/1 = ran; 2 = bad args
+  assert.match(res.stdout, /DEPS_PLUGIN="design"/);
+});
+
+test('preflight --json emits a structured envelope for the named plugin', () => {
+  const res = runFromTmp(['--plugin', 'flow', '--json']);
+  const env = JSON.parse(res.stdout);
+  assert.equal(env.plugin, 'flow');
+  assert.ok(Array.isArray(env.results));
+  assert.ok(env.summary && typeof env.summary.total === 'number');
+});
+
+test('preflight without --plugin exits 2', () => {
+  const res = runFromTmp([]);
+  assert.equal(res.status, 2);
+  assert.match(res.stderr, /--plugin/);
+});

package/cli/commands/scenario-report.mjs

@@ -0,0 +1,45 @@
+import { writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+// `maude scenario-report <run-dir> [--out <path>]` — deterministic cross-platform
+// scenario report generator (Phase C / DDR-061). Thin wrapper that resolves the
+// bundled generator from maude's OWN package root (NOT $CLAUDE_PLUGIN_ROOT — the
+// flow plugin can't reach the design plugin's dev-server dir; only the on-PATH
+// `maude` binary resolves it reliably across install shapes — see DDR-062), runs
+// it, and writes report.md. Output stdout = the written path (capture idiom).
+
+export async function run({ args, pkgRoot }) {
+  const runDir = args.find((a) => !a.startsWith('--'));
+  if (!runDir || runDir === 'help') {
+    process.stdout.write(
+      'maude scenario-report <run-dir> [--out <path>]\n\n' +
+        '  Walk a scenario run directory and emit the mechanical sections of report.md\n' +
+        '  (TL;DR, counter-delta, per-step pivot, path listing). Leaves the prose sections\n' +
+        '  ("What surprised us", "Recommended follow-ups") as placeholders for the LLM.\n' +
+        '  Default output: <run-dir>/report.md.\n'
+    );
+    return;
+  }
+
+  const generatorPath = resolve(
+    pkgRoot,
+    'plugins',
+    'design',
+    'dev-server',
+    'bin',
+    'scenario-report.mjs'
+  );
+  const { generateReport } = await import(pathToFileURL(generatorPath).href);
+
+  const absRunDir = resolve(process.cwd(), runDir);
+  const outIdx = args.indexOf('--out');
+  const outPath =
+    outIdx >= 0 && args[outIdx + 1]
+      ? resolve(process.cwd(), args[outIdx + 1])
+      : join(absRunDir, 'report.md');
+
+  const md = generateReport(absRunDir);
+  writeFileSync(outPath, md, 'utf8');
+  process.stdout.write(`${outPath}\n`);
+}