@1agh/maude 0.29.0 → 0.31.0

package/apps/studio/test/github-api.test.ts

@@ -0,0 +1,465 @@
+// Phase 28 (epic E3) — GitHub service + token-bridge tests.
+//
+// Layers (mirrors git-api.test.ts):
+//   (1) request CONSTRUCTION + error MAPPING via a stubbed global `fetch` — proves
+//       the auth header / API-version / method / body shape and the non-technical
+//       error copy, no network;
+//   (2) `setRemote` against a REAL local iso-git repo — no network;
+//   (3) the loopback token bridge fetch (token.ts) with a stubbed fetch + env;
+//   (4) a guarded REAL-account pass (skipped unless MAUDE_GH_TEST_TOKEN is set) —
+//       the "auth shape matters" check the plan calls for, runnable by the user
+//       with a scratch token.
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import fs, { mkdirSync, mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import git from 'isomorphic-git';
+import type { Context } from '../context.ts';
+import { createGitHubEndpoints, __testing as epTesting } from '../github/endpoints.ts';
+import {
+  createRepo,
+  GitHubApiError,
+  getIdentity,
+  inviteCollaborator,
+  listUserRepos,
+  setRemote,
+} from '../github/service.ts';
+import { getGithubToken, tokenBridgeAvailable } from '../github/token.ts';
+import { hasDesign } from '../scaffold-design.ts';
+
+// ── fetch stub harness ───────────────────────────────────────────────────────
+const realFetch = globalThis.fetch;
+type Capture = { url: string; init: RequestInit | undefined };
+function stubFetch(handler: (url: string, init?: RequestInit) => Response): Capture[] {
+  const calls: Capture[] = [];
+  globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = typeof input === 'string' ? input : input.toString();
+    calls.push({ url, init });
+    return handler(url, init);
+  }) as typeof fetch;
+  return calls;
+}
+afterEach(() => {
+  globalThis.fetch = realFetch;
+});
+
+function json(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'content-type': 'application/json' },
+  });
+}
+
+// ── (1) request construction + error mapping ───────────────────────────────────
+describe('GitHub REST request construction', () => {
+  test('getIdentity sends Bearer auth + API version, shapes the profile', async () => {
+    const calls = stubFetch(() =>
+      json({ login: 'octocat', name: 'Octo Cat', avatar_url: 'https://x/y.png' })
+    );
+    const id = await getIdentity('tok_abc');
+    expect(id).toEqual({ login: 'octocat', name: 'Octo Cat', avatar_url: 'https://x/y.png' });
+    expect(calls[0].url).toBe('https://api.github.com/user');
+    const headers = calls[0].init?.headers as Record<string, string>;
+    expect(headers.Authorization).toBe('Bearer tok_abc');
+    expect(headers['X-GitHub-Api-Version']).toBe('2022-11-28');
+    expect(headers.Accept).toBe('application/vnd.github+json');
+  });
+
+  test('getIdentity tolerates a null name', async () => {
+    stubFetch(() => json({ login: 'ghost', name: null, avatar_url: 'a' }));
+    expect((await getIdentity('t')).name).toBeNull();
+  });
+
+  test('createRepo POSTs name/private/description/auto_init and shapes the result', async () => {
+    const calls = stubFetch(() =>
+      json({
+        full_name: 'octocat/acme',
+        clone_url: 'https://github.com/octocat/acme.git',
+        html_url: 'https://github.com/octocat/acme',
+        default_branch: 'main',
+        owner: { login: 'octocat' },
+      })
+    );
+    const repo = await createRepo('t', { name: 'acme', private: true, description: 'd' });
+    expect(repo.owner).toBe('octocat');
+    expect(repo.clone_url).toBe('https://github.com/octocat/acme.git');
+    expect(calls[0].url).toBe('https://api.github.com/user/repos');
+    expect(calls[0].init?.method).toBe('POST');
+    const body = JSON.parse(calls[0].init?.body as string);
+    expect(body).toEqual({ name: 'acme', private: true, description: 'd', auto_init: false });
+  });
+
+  test('createRepo maps 422 to a "name already taken" message', async () => {
+    stubFetch(() => json({ message: 'name already exists on this account' }, 422));
+    const err = await createRepo('t', { name: 'acme', private: true }).catch((e) => e);
+    expect(err).toBeInstanceOf(GitHubApiError);
+    expect((err as GitHubApiError).status).toBe(422);
+    expect((err as GitHubApiError).message).toMatch(/already have a project with that name/i);
+  });
+
+  test('inviteCollaborator PUTs permission=push, 201 = invited', async () => {
+    const calls = stubFetch(() => json({ id: 1 }, 201));
+    const r = await inviteCollaborator('t', 'octocat', 'acme', 'anna');
+    expect(r.invited).toBe(true);
+    expect(calls[0].url).toBe('https://api.github.com/repos/octocat/acme/collaborators/anna');
+    expect(calls[0].init?.method).toBe('PUT');
+    expect(JSON.parse(calls[0].init?.body as string)).toEqual({ permission: 'push' });
+  });
+
+  test('inviteCollaborator 204 = already had access (not a new invite)', async () => {
+    stubFetch(() => new Response(null, { status: 204 }));
+    expect((await inviteCollaborator('t', 'o', 'r', 'anna')).invited).toBe(false);
+  });
+
+  test('inviteCollaborator maps 404 to "no GitHub user named X"', async () => {
+    stubFetch(() => json({ message: 'Not Found' }, 404));
+    const err = await inviteCollaborator('t', 'o', 'r', 'nobodyxyz').catch((e) => e);
+    expect((err as GitHubApiError).message).toMatch(/no github user named "nobodyxyz"/i);
+  });
+
+  test('listUserRepos requests owner+collaborator, sorted, and maps rows', async () => {
+    const calls = stubFetch(() =>
+      json([
+        {
+          name: 'acme',
+          full_name: 'octocat/acme',
+          owner: { login: 'octocat' },
+          private: true,
+          html_url: 'h',
+          clone_url: 'c',
+          updated_at: '2026-06-18T00:00:00Z',
+        },
+      ])
+    );
+    const repos = await listUserRepos('t');
+    expect(repos[0]).toEqual({
+      name: 'acme',
+      full_name: 'octocat/acme',
+      owner: 'octocat',
+      private: true,
+      html_url: 'h',
+      clone_url: 'c',
+      updated_at: '2026-06-18T00:00:00Z',
+    });
+    expect(calls[0].url).toContain('affiliation=owner,collaborator');
+    expect(calls[0].url).toContain('sort=updated');
+  });
+
+  test('401 maps to "sign-in expired", 403 rate-limit, 404 not-found', async () => {
+    stubFetch(() => json({ message: 'Bad credentials' }, 401));
+    expect(((await getIdentity('t').catch((e) => e)) as GitHubApiError).message).toMatch(
+      /sign-in expired/i
+    );
+
+    stubFetch(() => json({ message: 'API rate limit exceeded' }, 403));
+    expect(((await getIdentity('t').catch((e) => e)) as GitHubApiError).message).toMatch(
+      /rate-limit/i
+    );
+
+    stubFetch(() => json({ message: 'Not Found' }, 404));
+    expect(((await getIdentity('t').catch((e) => e)) as GitHubApiError).message).toMatch(
+      /couldn't find/i
+    );
+  });
+
+  test('network failure maps to a connection message (status 0)', async () => {
+    globalThis.fetch = (async () => {
+      throw new Error('network down');
+    }) as typeof fetch;
+    const err = (await getIdentity('t').catch((e) => e)) as GitHubApiError;
+    expect(err.status).toBe(0);
+    expect(err.message).toMatch(/could not reach github/i);
+  });
+});
+
+// ── (2) setRemote against a real iso-git repo ──────────────────────────────────
+describe('setRemote (iso-git, no network)', () => {
+  let dir: string;
+  afterEach(() => {
+    if (dir) rmSync(dir, { recursive: true, force: true });
+  });
+
+  test('adds origin, and replaces it idempotently on re-run', async () => {
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-remote-'));
+    await git.init({ fs, dir, defaultBranch: 'main' });
+
+    await setRemote(dir, 'https://github.com/octocat/acme.git');
+    let remotes = await git.listRemotes({ fs, dir });
+    expect(remotes).toEqual([{ remote: 'origin', url: 'https://github.com/octocat/acme.git' }]);
+
+    // Re-run with a different URL → still exactly one origin (replaced, not duplicated).
+    await setRemote(dir, 'https://github.com/octocat/acme-2.git');
+    remotes = await git.listRemotes({ fs, dir });
+    expect(remotes).toEqual([{ remote: 'origin', url: 'https://github.com/octocat/acme-2.git' }]);
+  });
+});
+
+// ── (3) loopback token bridge (token.ts) ───────────────────────────────────────
+describe('token bridge fetch', () => {
+  const savedEndpoint = process.env.MAUDE_TOKEN_ENDPOINT;
+  const savedKey = process.env.MAUDE_TOKEN_KEY;
+  afterEach(() => {
+    if (savedEndpoint === undefined) delete process.env.MAUDE_TOKEN_ENDPOINT;
+    else process.env.MAUDE_TOKEN_ENDPOINT = savedEndpoint;
+    if (savedKey === undefined) delete process.env.MAUDE_TOKEN_KEY;
+    else process.env.MAUDE_TOKEN_KEY = savedKey;
+  });
+
+  test('returns null + reports unavailable when env is absent (non-Tauri mode)', async () => {
+    delete process.env.MAUDE_TOKEN_ENDPOINT;
+    delete process.env.MAUDE_TOKEN_KEY;
+    expect(tokenBridgeAvailable()).toBe(false);
+    expect(await getGithubToken()).toBeNull();
+  });
+
+  test('sends the key header and returns the token on 200', async () => {
+    process.env.MAUDE_TOKEN_ENDPOINT = 'http://127.0.0.1:9/_tauri/github-token';
+    process.env.MAUDE_TOKEN_KEY = 'k123';
+    const calls = stubFetch(() => new Response('gho_secret\n', { status: 200 }));
+    expect(tokenBridgeAvailable()).toBe(true);
+    expect(await getGithubToken()).toBe('gho_secret');
+    expect((calls[0].init?.headers as Record<string, string>)['X-Maude-Token-Key']).toBe('k123');
+  });
+
+  test('returns null on 404 (not signed in) and 403 (bad key)', async () => {
+    process.env.MAUDE_TOKEN_ENDPOINT = 'http://127.0.0.1:9/_tauri/github-token';
+    process.env.MAUDE_TOKEN_KEY = 'k';
+    stubFetch(() => new Response('', { status: 404 }));
+    expect(await getGithubToken()).toBeNull();
+    stubFetch(() => new Response('', { status: 403 }));
+    expect(await getGithubToken()).toBeNull();
+  });
+});
+
+// ── (3b) endpoint validators + handlers ───────────────────────────────────────
+describe('endpoint validators', () => {
+  test('slugifyRepoName normalizes human names', () => {
+    expect(epTesting.slugifyRepoName('Acme Rebrand')).toBe('acme-rebrand');
+    expect(epTesting.slugifyRepoName('  Weird!! Name ##  ')).toBe('weird-name');
+    expect(epTesting.slugifyRepoName('keep.dots_and-dashes')).toBe('keep.dots_and-dashes');
+    expect(epTesting.slugifyRepoName('')).toBeNull();
+    expect(epTesting.slugifyRepoName('---')).toBeNull();
+    expect(epTesting.slugifyRepoName(42)).toBeNull();
+  });
+
+  test('parseGitHubRemote handles https + ssh, rejects non-github', () => {
+    expect(epTesting.parseGitHubRemote('https://github.com/octocat/acme.git')).toEqual({
+      owner: 'octocat',
+      repo: 'acme',
+    });
+    expect(epTesting.parseGitHubRemote('https://github.com/octocat/acme')).toEqual({
+      owner: 'octocat',
+      repo: 'acme',
+    });
+    expect(epTesting.parseGitHubRemote('git@github.com:octocat/acme.git')).toEqual({
+      owner: 'octocat',
+      repo: 'acme',
+    });
+    expect(epTesting.parseGitHubRemote('https://gitlab.com/octocat/acme.git')).toBeNull();
+    expect(epTesting.parseGitHubRemote('not a url')).toBeNull();
+  });
+
+  test('parseGitHubRemote anchors the host — rejects SSRF/credential-leak URLs (audit D-1/F-2)', () => {
+    // The original unanchored regex matched `github.com` as a PATH segment, so a
+    // crafted link cloned from (and leaked the PAT to) an attacker host. All null now.
+    for (const evil of [
+      'https://evil.com/github.com/o/r.git',
+      'https://evil.com/github.com/o/r',
+      'https://github.com.evil.com/o/r.git',
+      'https://evil.com#github.com/o/r.git',
+      'https://evil.com/?x=github.com/o/r',
+      'http://github.com/o/r.git', // http downgrade rejected
+      'ssh://git@evil.com/github.com/o/r.git',
+    ]) {
+      expect(epTesting.parseGitHubRemote(evil)).toBeNull();
+    }
+    // Canonical URL is rebuilt only from the validated owner/repo.
+    expect(epTesting.canonicalGitHubCloneUrl('octocat', 'acme')).toBe(
+      'https://github.com/octocat/acme.git'
+    );
+  });
+
+  test('USERNAME_RE rejects leading/trailing/double hyphens + overlong', () => {
+    expect(epTesting.USERNAME_RE.test('octocat')).toBe(true);
+    expect(epTesting.USERNAME_RE.test('a-b-c')).toBe(true);
+    expect(epTesting.USERNAME_RE.test('-bad')).toBe(false);
+    expect(epTesting.USERNAME_RE.test('bad-')).toBe(false);
+    expect(epTesting.USERNAME_RE.test('a--b')).toBe(false);
+    expect(epTesting.USERNAME_RE.test('a'.repeat(40))).toBe(false);
+  });
+});
+
+describe('endpoint handlers', () => {
+  let dir: string;
+  const savedEndpoint = process.env.MAUDE_TOKEN_ENDPOINT;
+  const savedKey = process.env.MAUDE_TOKEN_KEY;
+  const BRIDGE = 'http://127.0.0.1:9/_tauri/github-token';
+  function ctxFor(d: string): Context {
+    return { paths: { repoRoot: d } } as unknown as Context;
+  }
+  afterEach(() => {
+    if (dir) rmSync(dir, { recursive: true, force: true });
+    if (savedEndpoint === undefined) delete process.env.MAUDE_TOKEN_ENDPOINT;
+    else process.env.MAUDE_TOKEN_ENDPOINT = savedEndpoint;
+    if (savedKey === undefined) delete process.env.MAUDE_TOKEN_KEY;
+    else process.env.MAUDE_TOKEN_KEY = savedKey;
+  });
+
+  test('401 when not signed in (no token bridge)', async () => {
+    delete process.env.MAUDE_TOKEN_ENDPOINT;
+    delete process.env.MAUDE_TOKEN_KEY;
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-ep-'));
+    const ep = createGitHubEndpoints(ctxFor(dir));
+    expect((await ep.identity()).status).toBe(401);
+    expect((await ep.repos()).status).toBe(401);
+  });
+
+  test('createRepo: 400 on empty name (before any token use)', async () => {
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-ep-'));
+    const ep = createGitHubEndpoints(ctxFor(dir));
+    const r = await ep.createRepo({ name: '   ' });
+    expect(r.status).toBe(400);
+  });
+
+  test('createRepo: slugifies, creates, sets origin (token via bridge + mocked GH)', async () => {
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-ep-'));
+    await git.init({ fs, dir, defaultBranch: 'main' });
+    process.env.MAUDE_TOKEN_ENDPOINT = BRIDGE;
+    process.env.MAUDE_TOKEN_KEY = 'k';
+    stubFetch((url) => {
+      if (url.includes('/_tauri/github-token')) return new Response('gho_x', { status: 200 });
+      // POST /user/repos
+      return json({
+        full_name: 'octocat/acme-rebrand',
+        clone_url: 'https://github.com/octocat/acme-rebrand.git',
+        html_url: 'https://github.com/octocat/acme-rebrand',
+        default_branch: 'main',
+        owner: { login: 'octocat' },
+      });
+    });
+    const ep = createGitHubEndpoints(ctxFor(dir));
+    const res = await ep.createRepo({ name: 'Acme Rebrand', private: true });
+    expect(res.status).toBe(200);
+    expect((res.json as { repo: { full_name: string } }).repo.full_name).toBe(
+      'octocat/acme-rebrand'
+    );
+    // origin was set on the local repo
+    const remotes = await git.listRemotes({ fs, dir });
+    expect(remotes).toEqual([
+      { remote: 'origin', url: 'https://github.com/octocat/acme-rebrand.git' },
+    ]);
+  });
+
+  test('invite: 400 on bad username, 409 when project has no GitHub origin', async () => {
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-ep-'));
+    await git.init({ fs, dir, defaultBranch: 'main' });
+    process.env.MAUDE_TOKEN_ENDPOINT = BRIDGE;
+    process.env.MAUDE_TOKEN_KEY = 'k';
+    const ep = createGitHubEndpoints(ctxFor(dir));
+    expect((await ep.invite({ username: '-bad-' })).status).toBe(400);
+    // valid username but no origin remote → 409
+    expect((await ep.invite({ username: 'anna' })).status).toBe(409);
+  });
+
+  test('clone: 400 on non-github url, traversal name, or missing parentDir', async () => {
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-ep-'));
+    const ep = createGitHubEndpoints(ctxFor(dir));
+    expect(
+      (await ep.clone({ cloneUrl: 'https://gitlab.com/x/y.git', parentDir: dir, name: 'y' })).status
+    ).toBe(400);
+    expect(
+      (await ep.clone({ cloneUrl: 'https://github.com/o/r.git', parentDir: dir, name: '../evil' }))
+        .status
+    ).toBe(400);
+    expect(
+      (
+        await ep.clone({
+          cloneUrl: 'https://github.com/o/r.git',
+          parentDir: '/no/such/dir/xyz123',
+          name: 'r',
+        })
+      ).status
+    ).toBe(400);
+  });
+
+  test('clone: 409 when the target folder already exists', async () => {
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-ep-'));
+    mkdirSync(join(dir, 'taken'));
+    const ep = createGitHubEndpoints(ctxFor(dir));
+    expect(
+      (await ep.clone({ cloneUrl: 'https://github.com/o/r.git', parentDir: dir, name: 'taken' }))
+        .status
+    ).toBe(409);
+  });
+
+  test('createProject: 400 on empty name or missing parentDir', async () => {
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-ep-'));
+    const ep = createGitHubEndpoints(ctxFor(dir));
+    expect((await ep.createProject({ name: '  ', parentDir: dir })).status).toBe(400);
+    expect((await ep.createProject({ name: 'Acme', parentDir: '/no/such/xyz' })).status).toBe(400);
+  });
+
+  test('initDesign: scaffolds a bootable .design into a fresh folder; idempotent', async () => {
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-ep-'));
+    const ep = createGitHubEndpoints(ctxFor(dir));
+    const r = await ep.initDesign({ dir });
+    expect(r.status).toBe(200);
+    expect(hasDesign(dir)).toBe(true);
+    // already a project → ok + alreadyDesign
+    const r2 = await ep.initDesign({ dir });
+    expect(r2.status).toBe(200);
+    expect((r2.json as { alreadyDesign?: boolean }).alreadyDesign).toBe(true);
+  });
+
+  test('initDesign: 400 on a non-existent dir', async () => {
+    const ep = createGitHubEndpoints(ctxFor(mkdtempSync(join(tmpdir(), 'maude-gh-ep-'))));
+    expect((await ep.initDesign({ dir: '/no/such/xyz123' })).status).toBe(400);
+  });
+
+  test('invite: 200 with origin set (mocked GH 201 = invited)', async () => {
+    dir = mkdtempSync(join(tmpdir(), 'maude-gh-ep-'));
+    await git.init({ fs, dir, defaultBranch: 'main' });
+    await git.addRemote({ fs, dir, remote: 'origin', url: 'https://github.com/octocat/acme.git' });
+    process.env.MAUDE_TOKEN_ENDPOINT = BRIDGE;
+    process.env.MAUDE_TOKEN_KEY = 'k';
+    stubFetch((url) => {
+      if (url.includes('/_tauri/github-token')) return new Response('gho_x', { status: 200 });
+      return json({ id: 1 }, 201); // collaborator invitation created
+    });
+    const res = await createGitHubEndpoints(ctxFor(dir)).invite({ username: 'anna' });
+    expect(res.status).toBe(200);
+    expect((res.json as { invited: boolean }).invited).toBe(true);
+  });
+});
+
+// ── (4) guarded real-account pass — set MAUDE_GH_TEST_TOKEN to run ──────────────
+// A scratch GitHub PAT/token with `repo read:user`. Creates + deletes a throwaway
+// repo, so the auth shape is exercised end-to-end. Skipped in CI / normal runs.
+const REAL = process.env.MAUDE_GH_TEST_TOKEN;
+describe('real GitHub account (guarded by MAUDE_GH_TEST_TOKEN)', () => {
+  test.skipIf(!REAL)('getIdentity + listUserRepos + create/delete a scratch repo', async () => {
+    const token = REAL as string;
+    const id = await getIdentity(token);
+    expect(typeof id.login).toBe('string');
+    const repos = await listUserRepos(token);
+    expect(Array.isArray(repos)).toBe(true);
+
+    const name = `maude-scratch-${Date.now()}`;
+    const created = await createRepo(token, {
+      name,
+      private: true,
+      description: 'maude test — safe to delete',
+    });
+    expect(created.full_name).toBe(`${id.login}/${name}`);
+    // cleanup — delete the scratch repo (needs delete_repo scope; ignore failure)
+    await fetch(`https://api.github.com/repos/${id.login}/${name}`, {
+      method: 'DELETE',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'User-Agent': 'maude-desktop',
+        Accept: 'application/vnd.github+json',
+      },
+    }).catch(() => {});
+  });
+});

package/apps/studio/test/hub-link.test.ts

@@ -0,0 +1,69 @@
+// Phase 29 (E4) Door C — hub-link credential write. Validates the lean in-app
+// counterpart to `maude design link`: input validation + the global hubs.json write
+// (token + per-machine trust, mode 0600). The http-layer gating (main-origin +
+// loopback) is covered by canvas-origin-gate.test.ts.
+
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from 'node:fs';
+import { platform, tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { linkHub, saveHubCredential } from '../sync/hub-link.ts';
+
+let dir: string;
+let prevPath: string | undefined;
+
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), 'maude-hublink-'));
+  prevPath = process.env.HUBS_CONFIG_PATH;
+  process.env.HUBS_CONFIG_PATH = join(dir, 'hubs.json');
+});
+afterEach(() => {
+  if (prevPath === undefined) delete process.env.HUBS_CONFIG_PATH;
+  else process.env.HUBS_CONFIG_PATH = prevPath;
+  rmSync(dir, { recursive: true, force: true });
+});
+
+test('rejects a missing url', async () => {
+  const r = await linkHub({ token: 'tok' });
+  expect(r.status).toBe(400);
+  expect((r.json as { ok: boolean }).ok).toBe(false);
+});
+
+test('rejects a missing token', async () => {
+  const r = await linkHub({ url: 'https://hub.example.dev' });
+  expect(r.status).toBe(400);
+  expect((r.json as { ok: boolean }).ok).toBe(false);
+});
+
+test('rejects a non-http(s) scheme (no file:/ftp: hub)', async () => {
+  const r = await linkHub({ url: 'file:///etc/passwd', token: 'tok' });
+  expect(r.status).toBe(400);
+  expect(existsSync(process.env.HUBS_CONFIG_PATH as string)).toBe(false);
+});
+
+test('rejects a malformed url', async () => {
+  const r = await linkHub({ url: 'not a url', token: 'tok' });
+  expect(r.status).toBe(400);
+});
+
+test('saveHubCredential writes the token + records per-machine trust, mode 0600', () => {
+  saveHubCredential('https://hub.example.dev', 'mau_secret');
+  const p = process.env.HUBS_CONFIG_PATH as string;
+  const cfg = JSON.parse(readFileSync(p, 'utf8'));
+  expect(cfg.hubs['https://hub.example.dev'].token).toBe('mau_secret');
+  expect(typeof cfg.hubs['https://hub.example.dev'].linkedAt).toBe('number');
+  expect(cfg.trusted).toContain('https://hub.example.dev');
+  if (platform() !== 'win32') {
+    expect(statSync(p).mode & 0o777).toBe(0o600);
+  }
+});
+
+test('a second credential for the same hub replaces the token (per-machine key)', () => {
+  saveHubCredential('https://hub.example.dev', 'first');
+  saveHubCredential('https://hub.example.dev', 'second');
+  const cfg = JSON.parse(readFileSync(process.env.HUBS_CONFIG_PATH as string, 'utf8'));
+  expect(cfg.hubs['https://hub.example.dev'].token).toBe('second');
+  // Trust is not duplicated.
+  expect(cfg.trusted.filter((u: string) => u === 'https://hub.example.dev')).toHaveLength(1);
+});

package/apps/studio/test/participants-chrome.test.ts

@@ -1,8 +1,20 @@
 // Unit: pure helpers from participants-chrome.tsx.
 
 import { describe, expect, test } from 'bun:test';
+import { initialsFor, isOwnEditingEcho } from '../participants-chrome.tsx';
+import type { ForeignAwareness } from '../use-collab.tsx';
 
-import { initialsFor } from '../participants-chrome.tsx';
+const peer = (over: Partial<ForeignAwareness>): ForeignAwareness => ({
+  clientID: 1,
+  name: 'Anna',
+  color: 'oklch(0.7 0.16 145)',
+  cursor: null,
+  selection: null,
+  annotationSelection: [],
+  viewport: { x: 0, y: 0, zoom: 1 },
+  editing: null,
+  ...over,
+});
 
 describe('initialsFor', () => {
   test('two-word name → uppercase first letters', () => {
@@ -28,3 +40,26 @@ describe('initialsFor', () => {
     expect(initialsFor('  Alice   Smith  ')).toBe('AS');
   });
 });
+
+describe('isOwnEditingEcho (Phase 30 / DDR-120)', () => {
+  test('skips MY own server-side editing echo (my name, editing, no cursor/selection)', () => {
+    expect(isOwnEditingEcho(peer({ name: 'Anna', editing: { since: 1 } }), 'Anna')).toBe(true);
+  });
+
+  test('keeps a remote peer editing (different name)', () => {
+    expect(isOwnEditingEcho(peer({ name: 'Bob', editing: { since: 1 } }), 'Anna')).toBe(false);
+  });
+
+  test('keeps MY peer if it has a live cursor (a real second tab, not the echo)', () => {
+    expect(
+      isOwnEditingEcho(
+        peer({ name: 'Anna', editing: { since: 1 }, cursor: { x: 1, y: 2 } }),
+        'Anna'
+      )
+    ).toBe(false);
+  });
+
+  test('keeps a peer that is not editing', () => {
+    expect(isOwnEditingEcho(peer({ name: 'Anna', editing: null }), 'Anna')).toBe(false);
+  });
+});