@1agh/maude 0.48.0 → 0.49.0

package/apps/studio/test/collab-origin-gate.test.ts

@@ -0,0 +1,323 @@
+// Unit: the DDR-122 follow-up origin gate — untrusted canvas-realm doc ops may
+// never write the canvas SOURCE lanes (html / css / meta / syncMeta), while the
+// lanes the canvas legitimately co-authors (comments / annotations /
+// presentation) keep working for same-machine boards.
+//
+// Cloud Phase 1 Task 3. See apps/studio/collab/origins.ts for the threat model
+// and for why the gate needs a mirror doc rather than update-byte inspection.
+
+import { describe, expect, test } from 'bun:test';
+
+import * as encoding from 'lib0/encoding';
+import { writeUpdate } from 'y-protocols/sync';
+import * as Y from 'yjs';
+
+import {
+  isBodyLane,
+  isCanvasAuthorableLane,
+  isTrustedOrigin,
+  laneVocabulary,
+  markTrustedOrigin,
+  rootTypesTouched,
+  SHELL_EDIT_ORIGIN,
+  touchesBodyLane,
+} from '../collab/origins.ts';
+import { MESSAGE_SYNC } from '../collab/protocol.ts';
+import { createRoom, type RoomCallbacks, type RoomConn } from '../collab/room.ts';
+
+const MESSAGE_SYNC_UPDATE = 2; // y-protocols/sync messageYjsUpdate
+
+function makeConn(id: string, realm?: 'main' | 'canvas'): RoomConn & { recv: Uint8Array[] } {
+  const recv: Uint8Array[] = [];
+  return {
+    id,
+    ...(realm ? { realm } : {}),
+    send(payload: Uint8Array) {
+      recv.push(payload);
+    },
+    recv,
+  };
+}
+
+function makeCallbacks(): RoomCallbacks {
+  return {
+    seed() {
+      /* nothing on disk */
+    },
+    persistJson() {
+      /* no-op */
+    },
+    persistBinary() {
+      /* no-op */
+    },
+  };
+}
+
+/** Frame a raw Y update as a y-websocket MESSAGE_SYNC / update frame. */
+function syncUpdateFrame(update: Uint8Array): Uint8Array {
+  const encoder = encoding.createEncoder();
+  encoding.writeVarUint(encoder, MESSAGE_SYNC);
+  writeUpdate(encoder, update);
+  return encoding.toUint8Array(encoder);
+}
+
+/**
+ * Build the frame a malicious (or merely careless) canvas peer would send: it
+ * mirrors the room's current state, mutates locally, and ships the delta —
+ * exactly what `use-collab.tsx` does, minus lock 1.
+ */
+function peerDelta(room: { doc: Y.Doc }, mutate: (doc: Y.Doc) => void): Uint8Array {
+  const peer = new Y.Doc();
+  Y.applyUpdate(peer, Y.encodeStateAsUpdate(room.doc));
+  const before = Y.encodeStateVector(peer);
+  mutate(peer);
+  return Y.encodeStateAsUpdate(peer, before);
+}
+
+describe('origins — lane vocabulary + trusted sentinels', () => {
+  test('body lanes and canvas-authorable lanes are disjoint and complete', () => {
+    const { body, canvasAuthorable } = laneVocabulary();
+    expect(body).toEqual(['css', 'html', 'meta', 'syncMeta']);
+    expect(canvasAuthorable).toEqual(['annotations', 'comments', 'presentation']);
+    for (const lane of body) {
+      expect(isBodyLane(lane)).toBe(true);
+      expect(isCanvasAuthorableLane(lane)).toBe(false);
+    }
+    for (const lane of canvasAuthorable) {
+      expect(isBodyLane(lane)).toBe(false);
+      expect(isCanvasAuthorableLane(lane)).toBe(true);
+    }
+  });
+
+  test('a forged origin object is NOT trusted; only the real sentinel is', () => {
+    expect(isTrustedOrigin(SHELL_EDIT_ORIGIN)).toBe(true);
+    // The exact shape of the sentinel, rebuilt by an attacker who read the source.
+    expect(isTrustedOrigin({ maudeOrigin: 'shell-edit' })).toBe(false);
+    expect(isTrustedOrigin('shell-edit')).toBe(false);
+    expect(isTrustedOrigin(null)).toBe(false);
+    expect(isTrustedOrigin(undefined)).toBe(false);
+  });
+
+  test('markTrustedOrigin registers a frozen object and returns it', () => {
+    const sentinel = markTrustedOrigin(Object.freeze({ maudeOrigin: 'test' }));
+    expect(isTrustedOrigin(sentinel)).toBe(true);
+  });
+
+  test('rootTypesTouched resolves nested types up to their root', () => {
+    const doc = new Y.Doc();
+    const seen: Set<string>[] = [];
+    doc.on('afterTransaction', (tr: Y.Transaction) => {
+      if (tr.origin === 'probe') seen.push(rootTypesTouched(tr));
+    });
+    doc.transact(() => {
+      const nested = new Y.Map<string>();
+      doc.getArray<Y.Map<string>>('comments').push([nested]);
+      nested.set('text', 'hi');
+    }, 'probe');
+    expect(seen.length).toBe(1);
+    expect([...(seen[0] ?? [])]).toEqual(['comments']);
+  });
+
+  test('touchesBodyLane discriminates body writes from comment writes', () => {
+    const doc = new Y.Doc();
+    const verdicts: boolean[] = [];
+    doc.on('afterTransaction', (tr: Y.Transaction) => {
+      if (tr.origin === 'probe') verdicts.push(touchesBodyLane(tr));
+    });
+    doc.transact(() => doc.getArray('comments').push([{ id: 'c1' }]), 'probe');
+    doc.transact(() => doc.getText('html').insert(0, '<b>x</b>'), 'probe');
+    // An insert into EXISTING text — the case whose target lane is absent from
+    // the update bytes (origins.ts § "why a mirror doc").
+    doc.transact(() => doc.getText('html').insert(3, 'evil'), 'probe');
+    expect(verdicts).toEqual([false, true, true]);
+  });
+});
+
+describe('room origin gate — canvas realm', () => {
+  test('REJECTS a canvas-realm write to the body lane; doc untouched, not broadcast', async () => {
+    const room = createRoom('ui-screen', makeCallbacks());
+    const shell = makeConn('shell', 'main');
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(shell);
+    await room.connect(canvas);
+    shell.recv.length = 0;
+
+    // Seed a body through the trusted path so the attack is an insert into
+    // EXISTING text — the case update-byte inspection cannot classify.
+    room.doc.transact(() => room.doc.getText('html').insert(0, '<main>ok</main>'), 'sync-agent');
+    shell.recv.length = 0;
+    canvas.recv.length = 0;
+
+    const evil = peerDelta(room, (d) => d.getText('html').insert(6, 'PWNED'));
+    room.receive(canvas, syncUpdateFrame(evil));
+
+    expect(room.doc.getText('html').toString()).toBe('<main>ok</main>');
+    expect(room.gateRefusals()).toBe(1);
+    // Nothing reached the other peer.
+    expect(shell.recv.length).toBe(0);
+    // The refused peer got a corrective full-state frame instead.
+    expect(canvas.recv.length).toBe(1);
+    await room.destroy();
+  });
+
+  test('REJECTS canvas-realm writes to css, meta and syncMeta too', async () => {
+    for (const [lane, mutate] of [
+      ['css', (d: Y.Doc) => d.getText('css').insert(0, '.evil{}')],
+      ['meta', (d: Y.Doc) => d.getText('meta').insert(0, '{"evil":1}')],
+      ['syncMeta', (d: Y.Doc) => d.getMap('syncMeta').set('bodyEditAt', 1)],
+    ] as const) {
+      const room = createRoom(`lane-${lane}`, makeCallbacks());
+      const canvas = makeConn('canvas', 'canvas');
+      await room.connect(canvas);
+      room.receive(canvas, syncUpdateFrame(peerDelta(room, mutate)));
+      expect(room.gateRefusals()).toBe(1);
+      expect(Y.encodeStateAsUpdate(room.doc).length).toBe(
+        Y.encodeStateAsUpdate(new Y.Doc()).length
+      );
+      await room.destroy();
+    }
+  });
+
+  test('ALLOWS canvas-realm comments + annotations (same-machine boards keep working)', async () => {
+    const room = createRoom('board', makeCallbacks());
+    const shell = makeConn('shell', 'main');
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(shell);
+    await room.connect(canvas);
+    shell.recv.length = 0;
+
+    room.receive(
+      canvas,
+      syncUpdateFrame(
+        peerDelta(room, (d) => {
+          d.getArray('comments').push([{ id: 'c1', text: 'from the canvas' }]);
+          d.getMap('annotations').set('svg', '<svg><rect/></svg>');
+        })
+      )
+    );
+
+    expect(room.doc.getArray('comments').toArray()).toEqual([
+      { id: 'c1', text: 'from the canvas' },
+    ]);
+    expect(room.doc.getMap('annotations').get('svg')).toBe('<svg><rect/></svg>');
+    expect(room.gateRefusals()).toBe(0);
+    // And it DID reach the other peer.
+    expect(shell.recv.length).toBeGreaterThan(0);
+    await room.destroy();
+  });
+
+  test('a mixed frame is refused WHOLESALE — no partial application of the good half', async () => {
+    const room = createRoom('mixed', makeCallbacks());
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(canvas);
+
+    room.receive(
+      canvas,
+      syncUpdateFrame(
+        peerDelta(room, (d) => {
+          d.getArray('comments').push([{ id: 'decoy' }]);
+          d.getText('html').insert(0, 'PWNED');
+        })
+      )
+    );
+
+    expect(room.gateRefusals()).toBe(1);
+    expect(room.doc.getArray('comments').length).toBe(0);
+    expect(room.doc.getText('html').toString()).toBe('');
+    await room.destroy();
+  });
+
+  test('the gate SURVIVES a refusal — the next honest canvas frame still applies', async () => {
+    const room = createRoom('recover', makeCallbacks());
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(canvas);
+
+    room.receive(canvas, syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'x'))));
+    expect(room.gateRefusals()).toBe(1);
+
+    room.receive(
+      canvas,
+      syncUpdateFrame(peerDelta(room, (d) => d.getArray('comments').push([{ id: 'after' }])))
+    );
+    expect(room.gateRefusals()).toBe(1);
+    expect(room.doc.getArray('comments').toArray()).toEqual([{ id: 'after' }]);
+    await room.destroy();
+  });
+
+  test('the MAIN realm is ungated — the shell may still write the body', async () => {
+    const room = createRoom('shell-write', makeCallbacks());
+    const shell = makeConn('shell', 'main');
+    await room.connect(shell);
+
+    room.receive(shell, syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'ok'))));
+
+    expect(room.doc.getText('html').toString()).toBe('ok');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a conn with no realm defaults to trusted (pre-existing callers unchanged)', async () => {
+    const room = createRoom('legacy', makeCallbacks());
+    const legacy = makeConn('legacy');
+    await room.connect(legacy);
+
+    room.receive(
+      legacy,
+      syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'ok')))
+    );
+
+    expect(room.doc.getText('html').toString()).toBe('ok');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('awareness frames from the canvas realm pass through the gate untouched', async () => {
+    const room = createRoom('presence', makeCallbacks());
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(canvas);
+
+    // A well-formed awareness frame from a peer's own Awareness instance.
+    const peerDoc = new Y.Doc();
+    const { Awareness, encodeAwarenessUpdate } = await import('y-protocols/awareness');
+    const peerAwareness = new Awareness(peerDoc);
+    peerAwareness.setLocalState({ name: 'canvas peer' });
+    const encoder = encoding.createEncoder();
+    encoding.writeVarUint(encoder, 1 /* MESSAGE_AWARENESS */);
+    encoding.writeVarUint8Array(
+      encoder,
+      encodeAwarenessUpdate(peerAwareness, [peerAwareness.clientID])
+    );
+    room.receive(canvas, encoding.toUint8Array(encoder));
+
+    expect(room.awareness.getStates().get(peerAwareness.clientID)).toEqual({ name: 'canvas peer' });
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a malformed sync frame from the canvas realm mutates nothing and leaves the room usable', async () => {
+    const room = createRoom('garbage', makeCallbacks());
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(canvas);
+
+    const encoder = encoding.createEncoder();
+    encoding.writeVarUint(encoder, MESSAGE_SYNC);
+    encoding.writeVarUint(encoder, MESSAGE_SYNC_UPDATE);
+    encoding.writeVarUint8Array(encoder, new Uint8Array([0xff, 0xff, 0xff, 0xff]));
+    // yjs swallows an undecodable update internally rather than throwing, so
+    // this is not a *gate* refusal — it never becomes a transaction at all, on
+    // the mirror or on the room doc. Assert the property that matters: nothing
+    // applied, no crash, and the gate still works afterwards.
+    room.receive(canvas, encoding.toUint8Array(encoder));
+
+    expect(Y.encodeStateAsUpdate(room.doc).length).toBe(Y.encodeStateAsUpdate(new Y.Doc()).length);
+
+    room.receive(canvas, syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'x'))));
+    expect(room.gateRefusals()).toBe(1);
+    room.receive(
+      canvas,
+      syncUpdateFrame(peerDelta(room, (d) => d.getArray('comments').push([{ id: 'ok' }])))
+    );
+    expect(room.doc.getArray('comments').toArray()).toEqual([{ id: 'ok' }]);
+    await room.destroy();
+  });
+});

package/apps/studio/test/sync-autocommit.test.ts

@@ -0,0 +1,334 @@
+// Cloud Phase 3 Task 1 — autosave as append-only git commits.
+//
+// Driven against a REAL git repository in a temp dir, not a mocked runner. The
+// properties that matter (authorship survives, history is never rewritten, a
+// no-op write produces no commit) are properties of git's actual behaviour, and
+// a mock would only prove that the arguments match what I expected them to be.
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+
+import { spawn } from 'node:child_process';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+import {
+  commitMessage,
+  createAutoCommit,
+  formatAuthor,
+  type GitRunner,
+  pushMirror,
+  sanitizeAttribution,
+  UNKNOWN_AUTHOR,
+} from '../sync/autocommit.ts';
+
+const git: GitRunner = (args, { cwd }) =>
+  new Promise((resolve) => {
+    const child = spawn('git', args, {
+      cwd,
+      env: { ...process.env, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null' },
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (d) => {
+      stdout += d;
+    });
+    child.stderr.on('data', (d) => {
+      stderr += d;
+    });
+    child.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
+  });
+
+let repo: string;
+
+async function initRepo(): Promise<string> {
+  const dir = mkdtempSync(path.join(tmpdir(), 'maude-autocommit-'));
+  await git(['init', '--initial-branch=main'], { cwd: dir });
+  await git(['config', 'user.name', 'Seed'], { cwd: dir });
+  await git(['config', 'user.email', 'seed@example.com'], { cwd: dir });
+  mkdirSync(path.join(dir, '.design', 'ui'), { recursive: true });
+  writeFileSync(path.join(dir, '.design', 'ui', 'Screen.tsx'), 'export default () => null;\n');
+  await git(['add', '-A'], { cwd: dir });
+  await git(['commit', '-m', 'seed'], { cwd: dir });
+  return dir;
+}
+
+const ALICE = { name: 'Alice Novák', email: 'alice@example.com' };
+const BOB = { name: 'Bob', email: 'bob@example.com' };
+const REL = '.design/ui/Screen.tsx';
+
+const write = (rel: string, body: string) => writeFileSync(path.join(repo, rel), body);
+const log = async (fmt: string) =>
+  (await git(['log', `--pretty=format:${fmt}`], { cwd: repo })).stdout.split('\n').filter(Boolean);
+
+beforeEach(async () => {
+  repo = await initRepo();
+});
+
+afterEach(() => {
+  if (repo) rmSync(repo, { recursive: true, force: true });
+});
+
+describe('attribution', () => {
+  test('a missing author is UNKNOWN, never the bot', () => {
+    // Attributing an anonymous human's work to the server makes `git blame` lie
+    // in a way that is hard to notice later. "Unknown" is honest and visibly
+    // wrong.
+    expect(sanitizeAttribution(null)).toEqual(UNKNOWN_AUTHOR);
+    expect(sanitizeAttribution(undefined)).toEqual(UNKNOWN_AUTHOR);
+    expect(sanitizeAttribution({ name: '', email: '' })).toEqual(UNKNOWN_AUTHOR);
+  });
+
+  test('presence-supplied identity cannot forge commit trailers', () => {
+    // Presence arrives over a semi-trusted hub (DDR-054): a name is
+    // attacker-influenceable text, and `--author` takes `Name <email>`.
+    const evil = sanitizeAttribution({
+      name: 'Real Person <real@example.com>\nSigned-off-by: Someone Else',
+      email: 'a@b.com\r\nCo-Authored-By: Nobody',
+    });
+    expect(evil.name).not.toContain('\n');
+    expect(evil.name).not.toContain('<');
+    expect(evil.name).not.toContain('>');
+    expect(evil.email).not.toContain('\r');
+    expect(formatAuthor(evil)).toMatch(/^[^<>\n]+ <[^<>\n]+>$/);
+  });
+
+  test('names are bounded so one peer cannot bloat every commit', () => {
+    const long = sanitizeAttribution({ name: 'x'.repeat(500), email: 'y'.repeat(500) });
+    expect(long.name.length).toBeLessThanOrEqual(96);
+    expect(long.email.length).toBeLessThanOrEqual(96);
+  });
+
+  test('unicode names survive intact — this is a real person, not a slug', () => {
+    expect(sanitizeAttribution(ALICE).name).toBe('Alice Novák');
+  });
+});
+
+describe('commit message', () => {
+  test('names the canvas rather than saying "autosave"', () => {
+    // 400 identical subjects is the same as no history.
+    const one = commitMessage(['.design/ui/Screen.tsx'], ALICE);
+    expect(one.split('\n')[0]).toBe('design: update Screen');
+    expect(one).toContain('Alice Novák <alice@example.com>');
+    expect(one).toContain('append-only');
+  });
+
+  test('a multi-file commit summarizes and lists', () => {
+    const many = commitMessage(
+      ['.design/ui/Screen.tsx', '.design/ui/Settings.tsx', '.design/ui/Screen.meta.json'],
+      ALICE
+    );
+    // Screen.tsx + Screen.meta.json are ONE canvas — a subject that said
+    // "3 canvases" would overstate what changed on every single commit.
+    expect(many.split('\n')[0]).toBe('design: update 2 canvases');
+    expect(many).toContain('- Screen');
+    expect(many).toContain('- Settings');
+    expect(many).not.toContain('- Screen.meta');
+  });
+});
+
+describe('committing, against a real repo', () => {
+  test('an edit becomes a commit authored by the HUMAN, committed by the bot', async () => {
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    write(REL, 'export default () => <main>alice was here</main>;\n');
+    auto.note(REL, ALICE);
+
+    const outcome = await auto.flush();
+    expect(outcome?.ok).toBe(true);
+
+    // This is the point of using git's author/committer split at all: blame
+    // answers "who designed this", not "the server did".
+    expect(await log('%an|%ae')).toEqual([
+      'Alice Novák|alice@example.com',
+      'Seed|seed@example.com',
+    ]);
+    expect((await log('%cn'))[0]).toBe('Maude Workspace');
+    expect((await log('%s'))[0]).toBe('design: update Screen');
+  });
+
+  test('edits COALESCE — a typing session is one commit, not four hundred', async () => {
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    for (let i = 0; i < 20; i++) {
+      write(REL, `export default () => <main>v${i}</main>;\n`);
+      auto.note(REL, ALICE);
+    }
+    await auto.flush();
+    expect((await log('%s')).length).toBe(2); // seed + one autosave
+  });
+
+  test('a no-op write produces NO commit', async () => {
+    // An echo, or a write of identical bytes. Committing it would be noise.
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    auto.note(REL, ALICE);
+    const outcome = await auto.flush();
+    expect(outcome?.ok).toBe(false);
+    expect(outcome && !outcome.ok && outcome.reason).toBe('nothing-to-commit');
+    expect((await log('%s')).length).toBe(1);
+  });
+
+  test('only the NOTED files are staged — an unrelated dirty file is left alone', async () => {
+    // `git add -A` in a workspace would sweep in whatever else is in the tree.
+    // The cell must never commit something it wasn't told about.
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    write(REL, 'export default () => <main>noted</main>;\n');
+    writeFileSync(path.join(repo, 'UNRELATED.md'), 'not part of the design\n');
+    auto.note(REL, ALICE);
+    await auto.flush();
+
+    const show = await git(['show', '--name-only', '--pretty=format:', 'HEAD'], { cwd: repo });
+    expect(show.stdout.trim()).toBe(REL);
+    const status = await git(['status', '--porcelain'], { cwd: repo });
+    expect(status.stdout).toContain('UNRELATED.md');
+  });
+
+  test('history is APPEND-ONLY — an earlier state is still reachable', async () => {
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    write(REL, 'export default () => <main>first</main>;\n');
+    auto.note(REL, ALICE);
+    await auto.flush();
+    const firstSha = (await log('%H'))[0];
+
+    write(REL, 'export default () => <main>second</main>;\n');
+    auto.note(REL, BOB);
+    await auto.flush();
+
+    // The old content is still there — the guarantee that makes a cell's
+    // autosave safe to trust with someone's only copy.
+    const old = await git(['show', `${firstSha}:${REL}`], { cwd: repo });
+    expect(old.stdout).toContain('first');
+    expect((await log('%s')).length).toBe(3);
+    expect(await log('%an')).toEqual(['Bob', 'Alice Novák', 'Seed']);
+  });
+
+  test('two peers editing before quiescence produce one commit, attributed to the last', async () => {
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    write(REL, 'export default () => <main>alice</main>;\n');
+    auto.note(REL, ALICE);
+    write(path.join('.design', 'ui', 'Second.tsx'), '');
+    writeFileSync(path.join(repo, '.design/ui/Second.tsx'), 'export default () => null;\n');
+    auto.note('.design/ui/Second.tsx', BOB);
+    await auto.flush();
+
+    expect((await log('%an'))[0]).toBe('Bob');
+    expect((await log('%s'))[0]).toBe('design: update 2 canvases');
+  });
+
+  test('a git failure RE-QUEUES the change instead of dropping it', async () => {
+    // The bytes are already on disk, so a git error must not remove the change
+    // from history permanently — making the commit a precondition of the save
+    // would turn a transient error into data loss.
+    let failNext = true;
+    const flaky: GitRunner = async (args, opts) => {
+      if (args.includes('commit') && failNext) {
+        failNext = false;
+        return { code: 1, stdout: '', stderr: 'simulated git failure' };
+      }
+      return git(args, opts);
+    };
+    const auto = createAutoCommit({ repoRoot: repo, run: flaky, debounceMs: 5, log: silent() });
+    write(REL, 'export default () => <main>retry me</main>;\n');
+    auto.note(REL, ALICE);
+
+    const first = await auto.flush();
+    expect(first?.ok).toBe(false);
+    expect(auto.pending()).toEqual([REL]);
+
+    const second = await auto.flush();
+    expect(second?.ok).toBe(true);
+    expect((await log('%s')).length).toBe(2);
+  });
+
+  test('flush with nothing pending is a no-op, not an empty commit', async () => {
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    expect(await auto.flush()).toBe(null);
+    expect((await log('%s')).length).toBe(1);
+  });
+
+  test('stop() prevents further scheduling', async () => {
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    auto.stop();
+    write(REL, 'export default () => <main>after stop</main>;\n');
+    auto.note(REL, ALICE);
+    expect(auto.pending()).toEqual([]);
+  });
+});
+
+describe('mirror push — never rewrites someone else’s work', () => {
+  test('a non-fast-forward push is REPORTED as rejected, never forced', async () => {
+    // The cell has no way to know whether merging a stranger's commits is
+    // right, so it stops and surfaces it. DDR-119's hazard, arriving from the
+    // other direction.
+    const remote = mkdtempSync(path.join(tmpdir(), 'maude-remote-'));
+    await git(['init', '--bare', '--initial-branch=main'], { cwd: remote });
+    await git(['remote', 'add', 'origin', remote], { cwd: repo });
+    await git(['push', 'origin', 'main'], { cwd: repo });
+
+    // Someone else pushes first, from a separate clone.
+    const other = mkdtempSync(path.join(tmpdir(), 'maude-other-'));
+    await git(['clone', remote, other], { cwd: path.dirname(other) });
+    await git(['config', 'user.name', 'Other'], { cwd: other });
+    await git(['config', 'user.email', 'other@example.com'], { cwd: other });
+    writeFileSync(path.join(other, 'theirs.txt'), 'their work\n');
+    await git(['add', '-A'], { cwd: other });
+    await git(['commit', '-m', 'their work'], { cwd: other });
+    await git(['push', 'origin', 'main'], { cwd: other });
+
+    // Now the cell has a diverging commit.
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    write(REL, 'export default () => <main>ours</main>;\n');
+    auto.note(REL, ALICE);
+    await auto.flush();
+
+    const res = await pushMirror({ repoRoot: repo, run: git, branch: 'main', log: silent() });
+    expect(res.ok).toBe(false);
+    expect(res.rejected).toBe(true);
+
+    // Their commit is still the remote's tip — nothing of theirs was destroyed.
+    const remoteLog = await git(['log', '--pretty=format:%s', 'main'], { cwd: remote });
+    expect(remoteLog.stdout.split('\n')[0]).toBe('their work');
+
+    rmSync(remote, { recursive: true, force: true });
+    rmSync(other, { recursive: true, force: true });
+  });
+
+  test('a fast-forward push succeeds', async () => {
+    const remote = mkdtempSync(path.join(tmpdir(), 'maude-remote-ok-'));
+    await git(['init', '--bare', '--initial-branch=main'], { cwd: remote });
+    await git(['remote', 'add', 'origin', remote], { cwd: repo });
+    await git(['push', 'origin', 'main'], { cwd: repo });
+
+    const auto = createAutoCommit({ repoRoot: repo, run: git, debounceMs: 5, log: silent() });
+    write(REL, 'export default () => <main>ours</main>;\n');
+    auto.note(REL, ALICE);
+    await auto.flush();
+
+    const res = await pushMirror({ repoRoot: repo, run: git, branch: 'main', log: silent() });
+    expect(res.ok).toBe(true);
+    expect(res.rejected).toBe(false);
+
+    rmSync(remote, { recursive: true, force: true });
+  });
+
+  test('pushMirror never passes a force flag', async () => {
+    // Pinned as an argv assertion: the guarantee is the ABSENCE of a flag, and
+    // absence is exactly what a future edit could add without any test noticing.
+    const seen: string[][] = [];
+    await pushMirror({
+      repoRoot: repo,
+      branch: 'main',
+      run: async (args) => {
+        seen.push(args);
+        return { code: 0, stdout: '', stderr: '' };
+      },
+      log: silent(),
+    });
+    const flat = seen.flat();
+    expect(flat.some((a) => /^--force/.test(a))).toBe(false);
+    expect(flat.some((a) => a.startsWith('+'))).toBe(false);
+    expect(flat).toContain('refs/heads/main:refs/heads/main');
+  });
+});
+
+function silent() {
+  return { warn: () => {}, error: () => {}, log: () => {} };
+}