@1agh/maude 0.53.2 → 0.54.0

package/apps/studio/test/repo-lock.test.ts

@@ -0,0 +1,350 @@
+// Cloud Phase 27 D2 — one writer at a time on the workspace checkout.
+//
+// The lock is the thing standing between "two processes over one working tree"
+// and the preserved dissent's 3 a.m. event, so the properties asserted here are
+// the ones that make it a lock rather than a suggestion: mutual exclusion,
+// release on throw, and a stale holder that unwedges itself without a human.
+
+import { describe, expect, test } from 'bun:test';
+import {
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  utimesSync,
+  writeFileSync,
+} from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { HEARTBEAT_MS, REPO_LOCK_FILE, STALE_LOCK_MS, withRepoLock } from '../git/repo-lock.ts';
+
+function makeRepo({ git = true } = {}): string {
+  const root = mkdtempSync(join(tmpdir(), 'maude-repo-lock-'));
+  if (git) mkdirSync(join(root, '.git'), { recursive: true });
+  return root;
+}
+
+const lockFile = (root: string) => join(root, '.git', REPO_LOCK_FILE);
+const sleep = (ms: number) => new Promise<void>((r) => setTimeout(r, ms));
+
+describe('repo lock', () => {
+  test('two holders never overlap — the loser waits rather than failing', async () => {
+    const root = makeRepo();
+    try {
+      const order: string[] = [];
+      let concurrent = 0;
+      let maxConcurrent = 0;
+
+      const contend = (name: string) =>
+        withRepoLock(root, name, async () => {
+          concurrent += 1;
+          maxConcurrent = Math.max(maxConcurrent, concurrent);
+          order.push(`${name}:in`);
+          await sleep(30);
+          order.push(`${name}:out`);
+          concurrent -= 1;
+        });
+
+      await Promise.all([contend('hub:autocommit'), contend('studio:checkout')]);
+
+      // The point of the lock, stated twice: never two inside, and never an
+      // interleaved in/in/out/out — the second entry follows the first exit.
+      expect(maxConcurrent).toBe(1);
+      expect(order[1]).toBe(order[0].replace(':in', ':out'));
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('the lock is released when the operation throws', async () => {
+    const root = makeRepo();
+    try {
+      await expect(
+        withRepoLock(root, 'studio:commit', async () => {
+          throw new Error('git exploded');
+        })
+      ).rejects.toThrow('git exploded');
+
+      // Not merely "the file is gone" — the next caller gets in, which is the
+      // property that matters. A lock leaked by a failed commit would stop
+      // every autosave after it.
+      let ran = false;
+      await withRepoLock(root, 'hub:autocommit', async () => {
+        ran = true;
+      });
+      expect(ran).toBe(true);
+      expect(() => readFileSync(lockFile(root))).toThrow();
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('a repo with no .git runs unlocked instead of creating one', async () => {
+    const root = makeRepo({ git: false });
+    try {
+      let ran = false;
+      await withRepoLock(root, 'hub:seed', async () => {
+        ran = true;
+      });
+      expect(ran).toBe(true);
+      // It must not have become a repo initializer on the way past.
+      expect(() => readFileSync(join(root, '.git', REPO_LOCK_FILE))).toThrow();
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('a stale lock is stolen — a cell that crashed mid-commit unwedges itself', async () => {
+    const root = makeRepo();
+    try {
+      // A holder that still EXISTS as a process (this one) so the steal can only
+      // be attributed to the age, not to the liveness check.
+      writeFileSync(
+        lockFile(root),
+        JSON.stringify({ pid: process.pid, holder: 'hub:autocommit', at: 0, token: 'old' })
+      );
+
+      let ran = false;
+      const warned: string[] = [];
+      await withRepoLock(
+        root,
+        'studio:commit',
+        async () => {
+          ran = true;
+        },
+        {
+          waitMs: 1000,
+          // Age it past the window without waiting for it.
+          now: () => Date.now() + STALE_LOCK_MS + 5_000,
+          log: { warn: (m: string) => warned.push(m), log() {} },
+        }
+      );
+      expect(ran).toBe(true);
+      expect(warned.join(' ')).toContain('hub:autocommit');
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('a lock whose process is gone is stolen without waiting out the window', async () => {
+    const root = makeRepo();
+    try {
+      // pid 1 is tini in a cell and always alive, so a pid that cannot exist is
+      // the honest fixture: 2^22 is above every default pid_max.
+      writeFileSync(
+        lockFile(root),
+        JSON.stringify({ pid: 4194304, holder: 'studio:checkout', at: Date.now(), token: 'dead' })
+      );
+
+      let ran = false;
+      await withRepoLock(
+        root,
+        'hub:autocommit',
+        async () => {
+          ran = true;
+        },
+        { waitMs: 500, log: { warn() {}, log() {} } }
+      );
+      expect(ran).toBe(true);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('giving up names the holder rather than hanging', async () => {
+    const root = makeRepo();
+    try {
+      writeFileSync(
+        lockFile(root),
+        JSON.stringify({ pid: process.pid, holder: 'studio:fold', at: Date.now(), token: 'live' })
+      );
+      await expect(
+        withRepoLock(root, 'hub:autocommit', async () => undefined, { waitMs: 120 })
+      ).rejects.toThrow(/studio:fold/);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('releasing never unlinks a lock that was stolen from us', async () => {
+    // The one way a lock can be worse than no lock: a slow holder finishes,
+    // unlinks, and pulls the lock out from under whoever legitimately took it
+    // after the steal.
+    const root = makeRepo();
+    try {
+      const finished = withRepoLock(root, 'hub:autocommit', async () => {
+        // Simulate the steal: somebody reaped us and took it.
+        writeFileSync(
+          lockFile(root),
+          JSON.stringify({
+            pid: process.pid,
+            holder: 'studio:checkout',
+            at: Date.now(),
+            token: 'theirs',
+          })
+        );
+      });
+      await finished;
+      const after = JSON.parse(readFileSync(lockFile(root), 'utf8'));
+      expect(after.holder).toBe('studio:checkout');
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+  test("a lost steal race does not unlink the winner's fresh lock", async () => {
+    // THE MUTUAL-EXCLUSION FAILURE THIS LOCK EXISTS TO PREVENT, REINTRODUCED BY
+    // ITS OWN RECOVERY PATH. Two waiters both see holder A as stale; the first
+    // unlinks and acquires; the second — still acting on its read of A —
+    // unlinks the FIRST's fresh lock and acquires too. Both then run their
+    // critical section over one git index.
+    //
+    // The fixture is aged through its MTIME rather than through a fake clock,
+    // and that distinction is the test: a fake `now` makes every lock look
+    // ancient, including the winner's brand-new one, which is not a state the
+    // real world can produce and would assert something nobody needs.
+    const root = makeRepo();
+    try {
+      writeFileSync(
+        lockFile(root),
+        JSON.stringify({ pid: process.pid, holder: 'hub:autocommit', at: 0, token: 'stale' })
+      );
+      const long_ago = new Date(Date.now() - STALE_LOCK_MS * 4);
+      utimesSync(lockFile(root), long_ago, long_ago);
+
+      let concurrent = 0;
+      let maxConcurrent = 0;
+      const contend = (name: string) =>
+        withRepoLock(
+          root,
+          name,
+          async () => {
+            concurrent += 1;
+            maxConcurrent = Math.max(maxConcurrent, concurrent);
+            await sleep(60);
+            concurrent -= 1;
+          },
+          { waitMs: 5000, log: { warn() {}, log() {} } }
+        );
+
+      await Promise.all([contend('one'), contend('two'), contend('three')]);
+      expect(maxConcurrent).toBe(1);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 20_000);
+
+  test('a long-but-live holder is not stolen from — the heartbeat says it is alive', async () => {
+    // `pull`, `fold` and `resolve` came under this lock in D2, and they do
+    // NETWORK I/O. Without a heartbeat the staleness test cannot tell "held for
+    // 30 s" from "the holder died 30 s ago", so the next waiter steals the lock
+    // out from under a running merge.
+    const root = makeRepo();
+    try {
+      const order: string[] = [];
+      const slow = withRepoLock(root, 'studio:pull', async () => {
+        order.push('slow:in');
+        await sleep(HEARTBEAT_MS + 400);
+        order.push('slow:out');
+      });
+      await sleep(50);
+      // A waiter whose clock is PAST the staleness window. The heartbeat has
+      // refreshed the mtime, so the lock is not stale by age and the holder is
+      // alive — it must wait, not steal.
+      const waiter = withRepoLock(
+        root,
+        'hub:autocommit',
+        async () => {
+          order.push('waiter:in');
+        },
+        { waitMs: 20_000, log: { warn() {}, log() {} } }
+      );
+      await Promise.all([slow, waiter]);
+      expect(order).toEqual(['slow:in', 'slow:out', 'waiter:in']);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 30_000);
+
+  test('a hostile holder label cannot forge a log line', async () => {
+    const root = makeRepo();
+    try {
+      writeFileSync(
+        lockFile(root),
+        JSON.stringify({
+          pid: process.pid,
+          holder: 'evil\n[repo-lock] PASS: nothing to see here',
+          at: 0,
+          token: 'x',
+        })
+      );
+      const long_ago = new Date(Date.now() - STALE_LOCK_MS * 4);
+      utimesSync(lockFile(root), long_ago, long_ago);
+      const warned: string[] = [];
+      await withRepoLock(root, 'hub:autocommit', async () => undefined, {
+        waitMs: 2000,
+        log: { warn: (m: string) => warned.push(m), log() {} },
+      });
+      expect(warned.join(' ')).not.toContain('\n');
+      expect(warned.join(' ')).not.toContain('nothing to see here');
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+  test('exactly ONE waiter can steal a dead lock — the steal is a compare-and-swap', async () => {
+    // The `unlink` this replaced could not say no: two waiters both judged the
+    // holder stale, the first unlinked and acquired, and the second unlinked
+    // the FIRST's fresh lock. `rename` fails with ENOENT when the source is
+    // already gone, so only one waiter moves the file aside and the rest go
+    // back around the loop.
+    //
+    // WHAT THIS TEST DOES AND DOES NOT PROVE, because the difference matters.
+    // It asserts the OBSERVABLE contract — one steal, no leftover sidecar,
+    // never two holders. It does NOT reproduce the interleaving that made the
+    // unlink unsafe: that race is between the hub PROCESS and the studio
+    // PROCESS, and inside one bun test the whole read → steal → acquire
+    // sequence runs synchronously, so a single-process harness reaches the same
+    // verdict with either implementation (measured, not assumed). The
+    // correctness argument for `rename` is its atomicity — exactly one caller
+    // can move a given file — and this test guards the contract around it.
+    const root = makeRepo();
+    try {
+      writeFileSync(
+        lockFile(root),
+        JSON.stringify({ pid: 4194304, holder: 'hub:autocommit', at: 0, token: 'dead' })
+      );
+      const long_ago = new Date(Date.now() - STALE_LOCK_MS * 4);
+      utimesSync(lockFile(root), long_ago, long_ago);
+
+      const steals: string[] = [];
+      let concurrent = 0;
+      let maxConcurrent = 0;
+      const contend = (name: string) =>
+        withRepoLock(
+          root,
+          name,
+          async () => {
+            concurrent += 1;
+            maxConcurrent = Math.max(maxConcurrent, concurrent);
+            await sleep(40);
+            concurrent -= 1;
+          },
+          {
+            waitMs: 5000,
+            log: { warn: (m: string) => steals.push(m), log() {} },
+          }
+        );
+
+      await Promise.all([contend('a'), contend('b'), contend('c'), contend('d')]);
+
+      expect(maxConcurrent).toBe(1);
+      // One steal, not four: the other three found the file already gone.
+      expect(steals.filter((m) => m.includes('stole a')).length).toBe(1);
+      // And no sidecar left behind.
+      expect(readdirSync(join(root, '.git')).filter((f) => f.includes('.stale-'))).toEqual([]);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 20_000);
+});

package/apps/studio/test/server-lifecycle.test.ts

@@ -3,6 +3,7 @@
 import { describe, expect, test } from 'bun:test';
 import { join } from 'node:path';
 
+import { rootIdentity } from '../http.ts';
 import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
 
 describe('server lifecycle', () => {
@@ -13,9 +14,18 @@ describe('server lifecycle', () => {
     try {
       const h = await fetch(`http://localhost:${port}/_health`);
       expect(h.status).toBe(200);
-      const body = (await h.json()) as { ok: boolean; app: string };
+      const body = (await h.json()) as { ok: boolean; app: string; rootId: string };
       expect(body.ok).toBe(true);
       expect(body.app).toBe('design');
+      // Cloud Phase 27 D5 — the supervisor asks this route WHICH TREE it is
+      // serving, and kills a child that answers about another one. That check
+      // is only worth anything if both ends compute the identity the same way,
+      // which is what this asserts: the hash the server reports for the root it
+      // resolved is the hash the supervisor would compute for the root it
+      // handed over. And it is a hash, not the path — this route is on the
+      // untrusted canvas origin's allowlist.
+      expect(body.rootId).toBe(rootIdentity(root));
+      expect(body.rootId).not.toContain('/');
 
       const info = await Bun.file(join(designRoot, '_server.json')).json();
       expect(info.port).toBe(port);

package/apps/studio/test/session-runtime-state.test.ts

@@ -0,0 +1,226 @@
+// Cloud Phase 27 D3, end to end: two members of one cell keep their own place.
+//
+// The unit test next door proves the path helpers; this proves the wiring — a
+// real server in workspace mode, two vouched sessions, and the two files the
+// plan names by hand: `_active.json` (selection, open tabs) and
+// `_canvas-state/<slug>.view.json` (the camera).
+//
+// The last test is the one that must never go red for the desktop: with no
+// session header the server writes exactly the paths it always wrote.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { isMaudeRuntimeState } from '../git/service.ts';
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+/** The proxy's vouched headers for one member (studio-proxy.mjs injects these). */
+function asMember(session: string, role = 'owner') {
+  return {
+    'x-maude-session': session,
+    'x-maude-role': role,
+    'x-maude-readonly': '0',
+  };
+}
+
+const CANVAS = '.design/ui/fixture.html';
+
+describe('two members, one cell', () => {
+  test('the camera is per member, and the desktop path is untouched', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, {
+      MAUDE_WORKSPACE_MODE: '1',
+      // A dev checkout resolves Playwright, a legitimate devDependency that
+      // would otherwise fail the module half of the containment assert before
+      // workspace mode could be tested at all.
+      MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+    });
+    try {
+      const base = `http://localhost:${port}`;
+      const patch = (session: string | null, zoom: number) =>
+        fetch(`${base}/_api/canvas-meta`, {
+          method: 'PATCH',
+          headers: {
+            'content-type': 'application/json',
+            ...(session ? asMember(session) : {}),
+          },
+          body: JSON.stringify({
+            file: CANVAS,
+            patch: { viewport: { x: zoom * 10, y: 0, zoom } },
+          }),
+        });
+
+      const alice = await patch('aaaaaaaaaaaaaaaa', 2);
+      const bob = await patch('bbbbbbbbbbbbbbbb', 3);
+      expect(alice.status).toBe(200);
+      expect(bob.status).toBe(200);
+
+      // Each member's camera is its own FILE — the whole point.
+      const aliceView = join(
+        designRoot,
+        '_canvas-state',
+        'aaaaaaaaaaaaaaaa',
+        'ui-fixture.view.json'
+      );
+      const bobView = join(designRoot, '_canvas-state', 'bbbbbbbbbbbbbbbb', 'ui-fixture.view.json');
+      expect(existsSync(aliceView)).toBe(true);
+      expect(existsSync(bobView)).toBe(true);
+      expect((await Bun.file(aliceView).json()).viewport.zoom).toBe(2);
+      expect((await Bun.file(bobView).json()).viewport.zoom).toBe(3);
+
+      // And each reads back their OWN camera, not the last writer's.
+      const read = async (session: string) => {
+        const r = await fetch(`${base}/_api/canvas-meta?file=${encodeURIComponent(CANVAS)}`, {
+          headers: asMember(session),
+        });
+        return (await r.json()) as { viewport?: { zoom?: number } };
+      };
+      expect((await read('aaaaaaaaaaaaaaaa')).viewport?.zoom).toBe(2);
+      expect((await read('bbbbbbbbbbbbbbbb')).viewport?.zoom).toBe(3);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+
+  test('with no session header the camera lands where it always did', async () => {
+    // The desktop regression gate. A `_canvas-state/<slug>.view.json` at the
+    // top level, no subdirectory, byte-for-byte the pre-D3 layout.
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const res = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ file: CANVAS, patch: { viewport: { x: 1, y: 2, zoom: 1.5 } } }),
+      });
+      expect(res.status).toBe(200);
+      expect(existsSync(join(designRoot, '_canvas-state', 'ui-fixture.view.json'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+
+  test('a forged session key cannot escape the canvas-state directory', async () => {
+    // The key becomes a path segment, so it is a traversal surface. The proxy
+    // strips inbound `x-maude-*` before injecting its own, which is the real
+    // defence; this is the second one.
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, {
+      MAUDE_WORKSPACE_MODE: '1',
+      // A dev checkout resolves Playwright, a legitimate devDependency that
+      // would otherwise fail the module half of the containment assert before
+      // workspace mode could be tested at all.
+      MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+    });
+    try {
+      const res = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: {
+          'content-type': 'application/json',
+          'x-maude-session': '../../../../tmp/pwned',
+          'x-maude-role': 'owner',
+          'x-maude-readonly': '0',
+        },
+        body: JSON.stringify({ file: CANVAS, patch: { viewport: { x: 0, y: 0, zoom: 1 } } }),
+      });
+      expect(res.status).toBe(200);
+      // Refused, not sanitized — so it lands on the shared singleton, exactly
+      // where a request with no session at all would.
+      expect(existsSync(join(designRoot, '_canvas-state', 'ui-fixture.view.json'))).toBe(true);
+      expect(existsSync('/tmp/pwned')).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+
+  test('`_active.json` is per member too', async () => {
+    // Selection + open tabs travel over the inspector WebSocket, so this drives
+    // the socket the way the client does — including the handshake, which is
+    // where the session is stamped (a role, and now an identity, is per session
+    // and a handshake is the one moment it is unambiguous).
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, {
+      MAUDE_WORKSPACE_MODE: '1',
+      // A dev checkout resolves Playwright, a legitimate devDependency that
+      // would otherwise fail the module half of the containment assert before
+      // workspace mode could be tested at all.
+      MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+    });
+    try {
+      const openAs = (session: string, file: string) =>
+        new Promise<void>((resolve, reject) => {
+          const ws = new WebSocket(`ws://localhost:${port}/_ws`, {
+            headers: asMember(session),
+          } as unknown as string[]);
+          const timer = setTimeout(() => reject(new Error('socket timeout')), 8000);
+          ws.onopen = () => {
+            ws.send(JSON.stringify({ type: 'active', file }));
+            ws.send(JSON.stringify({ type: 'tabs', tabs: [file] }));
+            setTimeout(() => {
+              clearTimeout(timer);
+              ws.close();
+              resolve();
+            }, 400);
+          };
+          ws.onerror = (e) => {
+            clearTimeout(timer);
+            reject(e);
+          };
+        });
+
+      await openAs('aaaaaaaaaaaaaaaa', '.design/ui/alice.tsx');
+      await openAs('bbbbbbbbbbbbbbbb', '.design/ui/bob.tsx');
+      await Bun.sleep(300);
+
+      const aliceState = await Bun.file(join(designRoot, '_active.aaaaaaaaaaaaaaaa.json')).json();
+      const bobState = await Bun.file(join(designRoot, '_active.bbbbbbbbbbbbbbbb.json')).json();
+      expect(aliceState.active).toBe('.design/ui/alice.tsx');
+      expect(bobState.active).toBe('.design/ui/bob.tsx');
+      // Neither clobbered the other, which before D3 is exactly what happened.
+      expect(aliceState.open_tabs).toEqual(['.design/ui/alice.tsx']);
+      expect(bobState.open_tabs).toEqual(['.design/ui/bob.tsx']);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+});
+
+describe('per-member runtime state is runtime state to git', () => {
+  test('all three matchers agree that `_active.<session>.json` is not a commit', () => {
+    // The comment in session-scope.ts CLAIMED a sibling kept every matcher
+    // correct. It did not: `.gitignore`, the CLI's ignore block and the
+    // studio's own `isMaudeRuntimeState` all matched `_active.json` by NAME, so
+    // each member's file showed as untracked to EVERYONE, "Save all" staged it,
+    // and a push published one person's open tabs, active canvas and selection
+    // into the tenant's remote.
+    const key = 'a1b2c3d4e5f60718';
+
+    // 1. the studio's own matcher — what the Changes panel filters by
+    expect(isMaudeRuntimeState(`.design/_active.${key}.json`)).toBe(true);
+    expect(isMaudeRuntimeState('.design/_active.json')).toBe(true);
+    expect(isMaudeRuntimeState(`.design/_canvas-state/${key}/ui-home.view.json`)).toBe(true);
+    // …and it must not have widened into ordinary files on the way.
+    expect(isMaudeRuntimeState('.design/ui/Home.tsx')).toBe(false);
+    expect(isMaudeRuntimeState('.design/ui/Home.meta.json')).toBe(false);
+    expect(isMaudeRuntimeState('.design/_activeXjson')).toBe(false);
+
+    // 2. this repo's own .gitignore
+    const ignored = (rel: string) =>
+      Bun.spawnSync(['git', 'check-ignore', '-q', rel], {
+        cwd: join(import.meta.dir, '..', '..', '..'),
+      }).exitCode === 0;
+    expect(ignored(`.design/_active.${key}.json`)).toBe(true);
+
+    // 3. the block the CLI writes into a downstream project
+    const block = readFileSync(
+      join(import.meta.dir, '..', '..', '..', 'cli', 'lib', 'gitignore-block.mjs'),
+      'utf8'
+    );
+    expect(block).toContain('_active.*.json');
+  });
+});