@1agh/maude 0.53.1 → 0.54.0

package/apps/studio/test/git-system-engine.test.ts

@@ -0,0 +1,135 @@
+// The engine a CELL actually runs — Cloud Phase 27 D2.
+//
+// WHY THIS FILE EXISTS. `MAUDE_USE_SYSTEM_GIT=1` used to be an escape hatch
+// nobody set, so `commitSystem` and the system-git halves of checkout / branch /
+// discard / fold had no coverage at all while their isomorphic-git twins had
+// plenty. D2 makes every cloud tenant's saves go through exactly those halves
+// (studio-child.mjs pins it, because two git engines over one index is not a
+// race a careful caller can avoid — it is two programs writing one file).
+//
+// Shipping that flip while its code path was the untested one would be trading a
+// known bug for an unmeasured one. These are the same assertions the iso engine
+// already gets, run against the engine the cloud uses.
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  gitCheckout,
+  gitCommit,
+  gitCreateBranch,
+  gitDiscard,
+  gitListBranches,
+  gitStatus,
+} from '../git/service.ts';
+
+let dir: string;
+let saved: string | undefined;
+
+function run(args: string[], cwd: string) {
+  const r = Bun.spawnSync(['git', ...args], { cwd });
+  return { code: r.exitCode, stdout: r.stdout.toString(), stderr: r.stderr.toString() };
+}
+
+beforeEach(() => {
+  saved = process.env.MAUDE_USE_SYSTEM_GIT;
+  // The whole point: the flag is read LIVE, so it can be scoped to this file
+  // instead of leaking into every other suite through a module-load const.
+  process.env.MAUDE_USE_SYSTEM_GIT = '1';
+
+  dir = mkdtempSync(join(tmpdir(), 'maude-system-git-'));
+  run(['init', '-b', 'main'], dir);
+  run(['config', 'user.name', 'Test'], dir);
+  run(['config', 'user.email', 'test@example.com'], dir);
+  mkdirSync(join(dir, '.design', 'ui'), { recursive: true });
+  writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 1;\n');
+  run(['add', '-A'], dir);
+  run(['commit', '-m', 'seed'], dir);
+});
+
+afterEach(() => {
+  if (saved === undefined) {
+    delete process.env.MAUDE_USE_SYSTEM_GIT;
+  } else process.env.MAUDE_USE_SYSTEM_GIT = saved;
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('the system-git engine a cell runs on', () => {
+  test('a save commits exactly the selected file and nothing else', async () => {
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 2;\n');
+    writeFileSync(join(dir, '.design', 'ui', 'Other.tsx'), 'export const other = 1;\n');
+
+    const res = await gitCommit(dir, 'update home', ['.design/ui/Home.tsx'], {
+      designPrefix: '.design',
+    });
+    expect(res.ok).toBe(true);
+
+    // The other file is still uncommitted — "Save selected" must mean selected.
+    const after = await gitStatus(dir, { designPrefix: '.design' });
+    expect(after.files.map((f) => f.path)).toEqual(['.design/ui/Other.tsx']);
+  });
+
+  test('save-all commits every change in scope', async () => {
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 3;\n');
+    writeFileSync(join(dir, '.design', 'ui', 'New.tsx'), 'export const n = 1;\n');
+
+    const res = await gitCommit(dir, 'save all', undefined, { designPrefix: '.design' });
+    expect(res.ok).toBe(true);
+    expect((await gitStatus(dir, { designPrefix: '.design' })).clean).toBe(true);
+  });
+
+  test('nothing to save is a refusal, not an empty commit', async () => {
+    const before = run(['rev-list', '--count', 'HEAD'], dir).stdout.trim();
+    const res = await gitCommit(dir, 'nothing', undefined, { designPrefix: '.design' });
+    expect(res.ok).toBe(false);
+    expect(run(['rev-list', '--count', 'HEAD'], dir).stdout.trim()).toBe(before);
+  });
+
+  test('discard restores a tracked file and deletes an untracked one', async () => {
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'wrecked\n');
+    writeFileSync(join(dir, '.design', 'ui', 'Scratch.tsx'), 'temporary\n');
+
+    const res = await gitDiscard(dir, ['.design/ui/Home.tsx', '.design/ui/Scratch.tsx'], {
+      designPrefix: '.design',
+    });
+    expect(res.ok).toBe(true);
+    expect(readFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'utf8')).toBe(
+      'export const v = 1;\n'
+    );
+    expect(existsSync(join(dir, '.design', 'ui', 'Scratch.tsx'))).toBe(false);
+  });
+
+  test('a draft is created, switched to, and switched back', async () => {
+    const made = await gitCreateBranch(dir, 'nav-redesign');
+    expect(made.ok).toBe(true);
+    expect(run(['rev-parse', '--abbrev-ref', 'HEAD'], dir).stdout.trim()).toBe('nav-redesign');
+
+    const back = await gitCheckout(dir, 'main');
+    expect(back.ok).toBe(true);
+    expect(run(['rev-parse', '--abbrev-ref', 'HEAD'], dir).stdout.trim()).toBe('main');
+
+    expect((await gitListBranches(dir)).map((b) => b.name).sort()).toEqual([
+      'main',
+      'nav-redesign',
+    ]);
+  });
+
+  test('switching with unsaved changes says so instead of losing them', async () => {
+    await gitCreateBranch(dir, 'draft');
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 99;\n');
+    await gitCommit(dir, 'draft edit', undefined, { designPrefix: '.design' });
+    await gitCheckout(dir, 'main');
+
+    // Now dirty on main in a way the switch would clobber.
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 1000;\n');
+    const res = await gitCheckout(dir, 'draft');
+    expect(res.ok).toBe(false);
+    expect(res.error).toContain('Save your changes');
+    // The unsaved bytes are still there — the refusal is the point.
+    expect(readFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'utf8')).toBe(
+      'export const v = 1000;\n'
+    );
+  });
+});

package/apps/studio/test/read-only-gate.test.ts

@@ -76,6 +76,14 @@ describe('read-only gate — viewer role refuses project writes locally', () =>
       ['/_api/fs-mkdir', 'POST'],
       ['/_api/annotations', 'PUT'],
       ['/_api/acp/chat', 'POST'],
+      // Cloud Phase 27 D2 — both USED to be on READ_ONLY_ALLOWED_WRITES, on the
+      // reasoning that "viewing another branch is not changing one". Both
+      // rewrite the working TREE, and the tree is shared: a viewer switching
+      // branches replaces the files under whoever is mid-edit. The cell's proxy
+      // refuses them too, but this is the gate the hub-linked desktop and the
+      // self-host path consult, where no manifest runs at all.
+      ['/_api/git/checkout', 'POST'],
+      ['/_api/git/pull', 'POST'],
     ] as const) {
       const r = await fetch(base + path, { method, body: '{}' });
       expect(`${path} ${r.status}`).toBe(`${path} 403`);
@@ -128,3 +136,53 @@ describe('read-only gate — viewer role refuses project writes locally', () =>
     expect(r.status).not.toBe(403);
   }, 30000);
 });
+
+// ---------------------------------------------------------------------------
+// Cloud Phase 27 — the one write a viewer holds.
+//
+// The role matrix has said `viewer.comment === true` since Phase 25 C4 and the
+// People page promises it in those words. This list did not have it, so a
+// viewer's comment was allowed by the authority (the cell's proxy) and then
+// refused by the defence-in-depth layer behind it. Found by commenting as a
+// viewer against a real cell, not by reading either file.
+
+describe('a viewer may comment — the matrix says so, and so must this gate', () => {
+  test('comment + reply pass; annotate still does not', async () => {
+    const { base } = await boot('viewer');
+
+    const comment = await fetch(`${base}/_comments`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ file: 'ui/Sample.tsx', text: 'looks off to me' }),
+    });
+    expect(comment.status).not.toBe(403);
+
+    const reply = await fetch(`${base}/_api/comments/abc123/reply`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ text: 'agreed' }),
+    });
+    expect(reply.status).not.toBe(403);
+
+    // An annotation is drawn ON the design and versioned with it — the matrix
+    // files it with `edit`, and that distinction has to survive this change.
+    const annotate = await fetch(`${base}/_api/annotations`, {
+      method: 'PUT',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ file: 'ui/Sample.tsx', svg: '<svg/>' }),
+    });
+    expect(annotate.status).toBe(403);
+  });
+
+  test('the reply pattern does not open the whole comment namespace', async () => {
+    const { base } = await boot('viewer');
+    for (const path of [
+      '/_api/comments/abc/delete',
+      '/_api/comments/abc/reply/../../edit-text',
+      '/_api/comments//reply',
+    ]) {
+      const res = await fetch(`${base}${path}`, { method: 'POST' });
+      expect(res.status).not.toBe(200);
+    }
+  });
+});

package/apps/studio/test/repo-concurrency.test.ts

@@ -0,0 +1,146 @@
+// Cloud Phase 27 D2 — the concurrency test the plan asks for by name:
+// "a concurrency test that runs an autocommit against a live canvas write."
+//
+// REAL GIT, REAL FILES, REAL CONTENTION. Everything else in this suite injects
+// its git runner, which is right for asserting what the code MEANS to do and
+// useless for asserting what two processes over one index actually DO. The
+// failure this exists to catch does not reproduce against a fake: it is
+// `.git/index.lock` colliding, or a commit landing between another commit's
+// `add` and its `commit`.
+//
+// What is asserted, in the order it matters:
+//   1. NOTHING IS LOST. Every byte written during the storm is either committed
+//      or still in the working tree at the end. That is the tenant's data.
+//   2. THE REPO IS NOT CORRUPT. `git fsck` and a clean `git status` afterwards.
+//   3. NO LOCK IS LEFT BEHIND. Neither git's nor ours — a leaked lock is a
+//      history that silently stops.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { REPO_LOCK_FILE, withRepoLock } from '../git/repo-lock.ts';
+import { createAutoCommit } from '../sync/autocommit.ts';
+
+/** The same shape the cell uses on both sides: shell out to system git. */
+async function run(args: string[], { cwd }: { cwd: string }) {
+  const proc = Bun.spawn(['git', ...args], { cwd, stdout: 'pipe', stderr: 'pipe' });
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ]);
+  return { code: await proc.exited, stdout, stderr };
+}
+
+async function makeRepo(): Promise<string> {
+  const root = mkdtempSync(join(tmpdir(), 'maude-repo-concurrency-'));
+  await run(['init', '-b', 'main'], { cwd: root });
+  await run(['config', 'user.name', 'Test'], { cwd: root });
+  await run(['config', 'user.email', 'test@example.com'], { cwd: root });
+  mkdirSync(join(root, '.design', 'ui'), { recursive: true });
+  writeFileSync(join(root, '.design', 'ui', 'seed.tsx'), 'export const seed = 0;\n');
+  await run(['add', '-A'], { cwd: root });
+  await run(['commit', '-m', 'seed'], { cwd: root });
+  return root;
+}
+
+/** Atomic, exactly like every real writer in this codebase. */
+function writeCanvas(root: string, rel: string, body: string): void {
+  const abs = join(root, rel);
+  const tmp = `${abs}.tmp`;
+  writeFileSync(tmp, body);
+  Bun.spawnSync(['mv', tmp, abs]);
+}
+
+describe('two writers, one checkout', () => {
+  test('an autocommit against a live canvas write loses nothing and corrupts nothing', async () => {
+    const root = await makeRepo();
+    try {
+      const auto = createAutoCommit({
+        repoRoot: root,
+        run,
+        debounceMs: 5,
+        log: { warn() {}, error() {}, log() {} },
+      });
+
+      // The storm: twelve rounds of "a designer typed, the doc flushed to disk,
+      // the hub noticed" — with a SECOND writer (the studio's own git verbs,
+      // here standing in as a lock-taking committer) cutting in throughout.
+      const rounds = 12;
+      const expected = new Map<string, string>();
+      const flights: Promise<unknown>[] = [];
+
+      for (let i = 0; i < rounds; i++) {
+        const rel = `.design/ui/canvas-${i % 4}.tsx`;
+        const body = `export const v = ${i};\n`;
+        writeCanvas(root, rel, body);
+        expected.set(rel, body);
+        auto.note(rel, { name: 'Alice', email: 'alice@example.com' });
+
+        if (i % 3 === 0) {
+          // The other process, doing what it does: taking the lock for a whole
+          // sequence and running git inside it.
+          flights.push(
+            withRepoLock(root, 'studio:commit', async () => {
+              await run(['add', '--', '.design'], { cwd: root });
+              await run(['commit', '-m', `studio ${i}`, '--allow-empty'], { cwd: root });
+            })
+          );
+        }
+        if (i % 2 === 0) flights.push(auto.flush());
+        await new Promise((r) => setTimeout(r, 3));
+      }
+
+      await Promise.all(flights);
+      await auto.flush();
+      auto.stop();
+
+      // 1. NOTHING IS LOST — every last write is on disk with the bytes we wrote.
+      for (const [rel, body] of expected) {
+        expect(readFileSync(join(root, rel), 'utf8')).toBe(body);
+      }
+
+      // 2. THE REPO IS NOT CORRUPT.
+      const fsck = await run(['fsck', '--no-progress'], { cwd: root });
+      expect(fsck.code).toBe(0);
+      const log = await run(['log', '--oneline'], { cwd: root });
+      expect(log.code).toBe(0);
+      expect(log.stdout.trim().split('\n').length).toBeGreaterThan(1);
+
+      // 3. NO LOCK LEFT BEHIND — neither git's nor ours.
+      expect(existsSync(join(root, '.git', 'index.lock'))).toBe(false);
+      expect(existsSync(join(root, '.git', REPO_LOCK_FILE))).toBe(false);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 30_000);
+
+  test('a commit sequence is never interleaved by another writer', async () => {
+    // The half-staged commit, precisely. Without a lock held ACROSS the
+    // sequence, the second writer's commit lands between the first's `add` and
+    // its `commit` and takes the staged file with it. `index.lock` cannot stop
+    // this — it is released the moment `add` returns.
+    const root = await makeRepo();
+    try {
+      const order: string[] = [];
+      const sequence = (name: string) =>
+        withRepoLock(root, `studio:${name}`, async () => {
+          order.push(`${name}:add`);
+          await run(['add', '-A'], { cwd: root });
+          await new Promise((r) => setTimeout(r, 25));
+          order.push(`${name}:commit`);
+          await run(['commit', '-m', name, '--allow-empty'], { cwd: root });
+        });
+
+      writeCanvas(root, '.design/ui/a.tsx', 'export const a = 1;\n');
+      await Promise.all([sequence('one'), sequence('two')]);
+
+      // add/commit/add/commit — never add/add/commit/commit.
+      expect(order[1]).toBe(order[0].replace(':add', ':commit'));
+      expect(order[3]).toBe(order[2].replace(':add', ':commit'));
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 20_000);
+});