@1agh/maude 0.53.2 → 0.54.0

package/apps/studio/test/collab-readonly-gate.test.ts

@@ -0,0 +1,194 @@
+// Unit: the read-only role gate on collab sync writes — the cloud collab lane
+// (RCA issue-cloud-live-collaboration-dead).
+//
+// A cell's proxy opens the canvas iframe's collab socket at the member's real
+// role; a viewer's socket arrives with readOnly=true. The room mirrors the role
+// matrix at the WS door the same way the inspector channel does for
+// comments-patch/delete: a read-only conn receives everything and publishes
+// awareness (presence for viewers is the point of the channel), but its sync
+// writes are gated to the COMMENT lane — the one write a viewer holds
+// (`viewer.comment === true`). Composes with, never replaces, the DDR-122
+// canvas-realm body-lane gate (test/collab-origin-gate.test.ts).
+
+import { describe, expect, test } from 'bun:test';
+
+import * as encoding from 'lib0/encoding';
+import { writeUpdate } from 'y-protocols/sync';
+import * as Y from 'yjs';
+
+import { MESSAGE_SYNC } from '../collab/protocol.ts';
+import { createRoom, type RoomCallbacks, type RoomConn } from '../collab/room.ts';
+
+function makeConn(
+  id: string,
+  opts: { realm?: 'main' | 'canvas'; readOnly?: boolean } = {}
+): RoomConn & { recv: Uint8Array[] } {
+  const recv: Uint8Array[] = [];
+  return {
+    id,
+    ...(opts.realm ? { realm: opts.realm } : {}),
+    ...(opts.readOnly !== undefined ? { readOnly: opts.readOnly } : {}),
+    send(payload: Uint8Array) {
+      recv.push(payload);
+    },
+    recv,
+  };
+}
+
+function makeCallbacks(): RoomCallbacks {
+  return {
+    seed() {},
+    persistJson() {},
+    persistBinary() {},
+  };
+}
+
+function syncUpdateFrame(update: Uint8Array): Uint8Array {
+  const encoder = encoding.createEncoder();
+  encoding.writeVarUint(encoder, MESSAGE_SYNC);
+  writeUpdate(encoder, update);
+  return encoding.toUint8Array(encoder);
+}
+
+function peerDelta(room: { doc: Y.Doc }, mutate: (doc: Y.Doc) => void): Uint8Array {
+  const peer = new Y.Doc();
+  Y.applyUpdate(peer, Y.encodeStateAsUpdate(room.doc));
+  const before = Y.encodeStateVector(peer);
+  mutate(peer);
+  return Y.encodeStateAsUpdate(peer, before);
+}
+
+describe('room read-only gate — cloud viewer sockets', () => {
+  test('a read-only canvas conn may write COMMENTS (the viewer capability)', async () => {
+    const room = createRoom('viewer-comments', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(viewer);
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(
+        peerDelta(room, (d) => d.getArray('comments').push([{ id: 'c1', text: 'a viewer note' }]))
+      )
+    );
+
+    expect(room.doc.getArray('comments').toArray()).toEqual([{ id: 'c1', text: 'a viewer note' }]);
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a read-only conn may NOT write annotations — refused, doc untouched, not broadcast', async () => {
+    const room = createRoom('viewer-annotations', makeCallbacks());
+    const editor = makeConn('editor', { realm: 'canvas', readOnly: false });
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(editor);
+    await room.connect(viewer);
+    editor.recv.length = 0;
+    viewer.recv.length = 0;
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(peerDelta(room, (d) => d.getMap('annotations').set('svg', '<svg/>')))
+    );
+
+    expect(room.doc.getMap('annotations').get('svg')).toBeUndefined();
+    expect(room.gateRefusals()).toBe(1);
+    expect(editor.recv.length).toBe(0);
+    // The refused peer got a corrective full-state frame instead.
+    expect(viewer.recv.length).toBe(1);
+    await room.destroy();
+  });
+
+  test('a read-only conn may not write body lanes either — even on the main realm', async () => {
+    const room = createRoom('viewer-body', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'main', readOnly: true });
+    await room.connect(viewer);
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'PWNED')))
+    );
+
+    expect(room.doc.getText('html').toString()).toBe('');
+    expect(room.gateRefusals()).toBe(1);
+    await room.destroy();
+  });
+
+  test('a WRITABLE canvas conn (an owner through the cloud lane) still annotates', async () => {
+    // The reason the role claim exists at all: annotations are exactly what the
+    // cloud complaint was about, and they need an editor-or-better socket.
+    const room = createRoom('owner-annotates', makeCallbacks());
+    const owner = makeConn('owner', { realm: 'canvas', readOnly: false });
+    await room.connect(owner);
+
+    room.receive(
+      owner,
+      syncUpdateFrame(
+        peerDelta(room, (d) => d.getMap('annotations').set('svg', '<svg><rect/></svg>'))
+      )
+    );
+
+    expect(room.doc.getMap('annotations').get('svg')).toBe('<svg><rect/></svg>');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('awareness frames from a read-only conn pass — presence for viewers is the point', async () => {
+    const room = createRoom('viewer-presence', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(viewer);
+
+    const peerDoc = new Y.Doc();
+    const { Awareness, encodeAwarenessUpdate } = await import('y-protocols/awareness');
+    const peerAwareness = new Awareness(peerDoc);
+    peerAwareness.setLocalState({ name: 'viewing member' });
+    const encoder = encoding.createEncoder();
+    encoding.writeVarUint(encoder, 1 /* MESSAGE_AWARENESS */);
+    encoding.writeVarUint8Array(
+      encoder,
+      encodeAwarenessUpdate(peerAwareness, [peerAwareness.clientID])
+    );
+    room.receive(viewer, encoding.toUint8Array(encoder));
+
+    expect(room.awareness.getStates().get(peerAwareness.clientID)).toEqual({
+      name: 'viewing member',
+    });
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a mixed frame (comment + annotation) from a read-only conn is refused wholesale', async () => {
+    const room = createRoom('viewer-mixed', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(viewer);
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(
+        peerDelta(room, (d) => {
+          d.getArray('comments').push([{ id: 'decoy' }]);
+          d.getMap('annotations').set('svg', '<svg/>');
+        })
+      )
+    );
+
+    expect(room.gateRefusals()).toBe(1);
+    expect(room.doc.getArray('comments').length).toBe(0);
+    expect(room.doc.getMap('annotations').get('svg')).toBeUndefined();
+    await room.destroy();
+  });
+
+  test('absent readOnly defaults to writable — pre-existing loopback callers unchanged', async () => {
+    const room = createRoom('legacy-writable', makeCallbacks());
+    const legacy = makeConn('legacy', { realm: 'canvas' });
+    await room.connect(legacy);
+
+    room.receive(
+      legacy,
+      syncUpdateFrame(peerDelta(room, (d) => d.getMap('annotations').set('svg', '<svg/>')))
+    );
+
+    expect(room.doc.getMap('annotations').get('svg')).toBe('<svg/>');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+});

package/apps/studio/test/git-system-engine.test.ts

@@ -0,0 +1,135 @@
+// The engine a CELL actually runs — Cloud Phase 27 D2.
+//
+// WHY THIS FILE EXISTS. `MAUDE_USE_SYSTEM_GIT=1` used to be an escape hatch
+// nobody set, so `commitSystem` and the system-git halves of checkout / branch /
+// discard / fold had no coverage at all while their isomorphic-git twins had
+// plenty. D2 makes every cloud tenant's saves go through exactly those halves
+// (studio-child.mjs pins it, because two git engines over one index is not a
+// race a careful caller can avoid — it is two programs writing one file).
+//
+// Shipping that flip while its code path was the untested one would be trading a
+// known bug for an unmeasured one. These are the same assertions the iso engine
+// already gets, run against the engine the cloud uses.
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  gitCheckout,
+  gitCommit,
+  gitCreateBranch,
+  gitDiscard,
+  gitListBranches,
+  gitStatus,
+} from '../git/service.ts';
+
+let dir: string;
+let saved: string | undefined;
+
+function run(args: string[], cwd: string) {
+  const r = Bun.spawnSync(['git', ...args], { cwd });
+  return { code: r.exitCode, stdout: r.stdout.toString(), stderr: r.stderr.toString() };
+}
+
+beforeEach(() => {
+  saved = process.env.MAUDE_USE_SYSTEM_GIT;
+  // The whole point: the flag is read LIVE, so it can be scoped to this file
+  // instead of leaking into every other suite through a module-load const.
+  process.env.MAUDE_USE_SYSTEM_GIT = '1';
+
+  dir = mkdtempSync(join(tmpdir(), 'maude-system-git-'));
+  run(['init', '-b', 'main'], dir);
+  run(['config', 'user.name', 'Test'], dir);
+  run(['config', 'user.email', 'test@example.com'], dir);
+  mkdirSync(join(dir, '.design', 'ui'), { recursive: true });
+  writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 1;\n');
+  run(['add', '-A'], dir);
+  run(['commit', '-m', 'seed'], dir);
+});
+
+afterEach(() => {
+  if (saved === undefined) {
+    delete process.env.MAUDE_USE_SYSTEM_GIT;
+  } else process.env.MAUDE_USE_SYSTEM_GIT = saved;
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('the system-git engine a cell runs on', () => {
+  test('a save commits exactly the selected file and nothing else', async () => {
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 2;\n');
+    writeFileSync(join(dir, '.design', 'ui', 'Other.tsx'), 'export const other = 1;\n');
+
+    const res = await gitCommit(dir, 'update home', ['.design/ui/Home.tsx'], {
+      designPrefix: '.design',
+    });
+    expect(res.ok).toBe(true);
+
+    // The other file is still uncommitted — "Save selected" must mean selected.
+    const after = await gitStatus(dir, { designPrefix: '.design' });
+    expect(after.files.map((f) => f.path)).toEqual(['.design/ui/Other.tsx']);
+  });
+
+  test('save-all commits every change in scope', async () => {
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 3;\n');
+    writeFileSync(join(dir, '.design', 'ui', 'New.tsx'), 'export const n = 1;\n');
+
+    const res = await gitCommit(dir, 'save all', undefined, { designPrefix: '.design' });
+    expect(res.ok).toBe(true);
+    expect((await gitStatus(dir, { designPrefix: '.design' })).clean).toBe(true);
+  });
+
+  test('nothing to save is a refusal, not an empty commit', async () => {
+    const before = run(['rev-list', '--count', 'HEAD'], dir).stdout.trim();
+    const res = await gitCommit(dir, 'nothing', undefined, { designPrefix: '.design' });
+    expect(res.ok).toBe(false);
+    expect(run(['rev-list', '--count', 'HEAD'], dir).stdout.trim()).toBe(before);
+  });
+
+  test('discard restores a tracked file and deletes an untracked one', async () => {
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'wrecked\n');
+    writeFileSync(join(dir, '.design', 'ui', 'Scratch.tsx'), 'temporary\n');
+
+    const res = await gitDiscard(dir, ['.design/ui/Home.tsx', '.design/ui/Scratch.tsx'], {
+      designPrefix: '.design',
+    });
+    expect(res.ok).toBe(true);
+    expect(readFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'utf8')).toBe(
+      'export const v = 1;\n'
+    );
+    expect(existsSync(join(dir, '.design', 'ui', 'Scratch.tsx'))).toBe(false);
+  });
+
+  test('a draft is created, switched to, and switched back', async () => {
+    const made = await gitCreateBranch(dir, 'nav-redesign');
+    expect(made.ok).toBe(true);
+    expect(run(['rev-parse', '--abbrev-ref', 'HEAD'], dir).stdout.trim()).toBe('nav-redesign');
+
+    const back = await gitCheckout(dir, 'main');
+    expect(back.ok).toBe(true);
+    expect(run(['rev-parse', '--abbrev-ref', 'HEAD'], dir).stdout.trim()).toBe('main');
+
+    expect((await gitListBranches(dir)).map((b) => b.name).sort()).toEqual([
+      'main',
+      'nav-redesign',
+    ]);
+  });
+
+  test('switching with unsaved changes says so instead of losing them', async () => {
+    await gitCreateBranch(dir, 'draft');
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 99;\n');
+    await gitCommit(dir, 'draft edit', undefined, { designPrefix: '.design' });
+    await gitCheckout(dir, 'main');
+
+    // Now dirty on main in a way the switch would clobber.
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 1000;\n');
+    const res = await gitCheckout(dir, 'draft');
+    expect(res.ok).toBe(false);
+    expect(res.error).toContain('Save your changes');
+    // The unsaved bytes are still there — the refusal is the point.
+    expect(readFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'utf8')).toBe(
+      'export const v = 1000;\n'
+    );
+  });
+});

package/apps/studio/test/read-only-gate.test.ts

@@ -76,6 +76,14 @@ describe('read-only gate — viewer role refuses project writes locally', () =>
       ['/_api/fs-mkdir', 'POST'],
       ['/_api/annotations', 'PUT'],
       ['/_api/acp/chat', 'POST'],
+      // Cloud Phase 27 D2 — both USED to be on READ_ONLY_ALLOWED_WRITES, on the
+      // reasoning that "viewing another branch is not changing one". Both
+      // rewrite the working TREE, and the tree is shared: a viewer switching
+      // branches replaces the files under whoever is mid-edit. The cell's proxy
+      // refuses them too, but this is the gate the hub-linked desktop and the
+      // self-host path consult, where no manifest runs at all.
+      ['/_api/git/checkout', 'POST'],
+      ['/_api/git/pull', 'POST'],
     ] as const) {
       const r = await fetch(base + path, { method, body: '{}' });
       expect(`${path} ${r.status}`).toBe(`${path} 403`);

package/apps/studio/test/repo-concurrency.test.ts

@@ -0,0 +1,146 @@
+// Cloud Phase 27 D2 — the concurrency test the plan asks for by name:
+// "a concurrency test that runs an autocommit against a live canvas write."
+//
+// REAL GIT, REAL FILES, REAL CONTENTION. Everything else in this suite injects
+// its git runner, which is right for asserting what the code MEANS to do and
+// useless for asserting what two processes over one index actually DO. The
+// failure this exists to catch does not reproduce against a fake: it is
+// `.git/index.lock` colliding, or a commit landing between another commit's
+// `add` and its `commit`.
+//
+// What is asserted, in the order it matters:
+//   1. NOTHING IS LOST. Every byte written during the storm is either committed
+//      or still in the working tree at the end. That is the tenant's data.
+//   2. THE REPO IS NOT CORRUPT. `git fsck` and a clean `git status` afterwards.
+//   3. NO LOCK IS LEFT BEHIND. Neither git's nor ours — a leaked lock is a
+//      history that silently stops.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { REPO_LOCK_FILE, withRepoLock } from '../git/repo-lock.ts';
+import { createAutoCommit } from '../sync/autocommit.ts';
+
+/** The same shape the cell uses on both sides: shell out to system git. */
+async function run(args: string[], { cwd }: { cwd: string }) {
+  const proc = Bun.spawn(['git', ...args], { cwd, stdout: 'pipe', stderr: 'pipe' });
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ]);
+  return { code: await proc.exited, stdout, stderr };
+}
+
+async function makeRepo(): Promise<string> {
+  const root = mkdtempSync(join(tmpdir(), 'maude-repo-concurrency-'));
+  await run(['init', '-b', 'main'], { cwd: root });
+  await run(['config', 'user.name', 'Test'], { cwd: root });
+  await run(['config', 'user.email', 'test@example.com'], { cwd: root });
+  mkdirSync(join(root, '.design', 'ui'), { recursive: true });
+  writeFileSync(join(root, '.design', 'ui', 'seed.tsx'), 'export const seed = 0;\n');
+  await run(['add', '-A'], { cwd: root });
+  await run(['commit', '-m', 'seed'], { cwd: root });
+  return root;
+}
+
+/** Atomic, exactly like every real writer in this codebase. */
+function writeCanvas(root: string, rel: string, body: string): void {
+  const abs = join(root, rel);
+  const tmp = `${abs}.tmp`;
+  writeFileSync(tmp, body);
+  Bun.spawnSync(['mv', tmp, abs]);
+}
+
+describe('two writers, one checkout', () => {
+  test('an autocommit against a live canvas write loses nothing and corrupts nothing', async () => {
+    const root = await makeRepo();
+    try {
+      const auto = createAutoCommit({
+        repoRoot: root,
+        run,
+        debounceMs: 5,
+        log: { warn() {}, error() {}, log() {} },
+      });
+
+      // The storm: twelve rounds of "a designer typed, the doc flushed to disk,
+      // the hub noticed" — with a SECOND writer (the studio's own git verbs,
+      // here standing in as a lock-taking committer) cutting in throughout.
+      const rounds = 12;
+      const expected = new Map<string, string>();
+      const flights: Promise<unknown>[] = [];
+
+      for (let i = 0; i < rounds; i++) {
+        const rel = `.design/ui/canvas-${i % 4}.tsx`;
+        const body = `export const v = ${i};\n`;
+        writeCanvas(root, rel, body);
+        expected.set(rel, body);
+        auto.note(rel, { name: 'Alice', email: 'alice@example.com' });
+
+        if (i % 3 === 0) {
+          // The other process, doing what it does: taking the lock for a whole
+          // sequence and running git inside it.
+          flights.push(
+            withRepoLock(root, 'studio:commit', async () => {
+              await run(['add', '--', '.design'], { cwd: root });
+              await run(['commit', '-m', `studio ${i}`, '--allow-empty'], { cwd: root });
+            })
+          );
+        }
+        if (i % 2 === 0) flights.push(auto.flush());
+        await new Promise((r) => setTimeout(r, 3));
+      }
+
+      await Promise.all(flights);
+      await auto.flush();
+      auto.stop();
+
+      // 1. NOTHING IS LOST — every last write is on disk with the bytes we wrote.
+      for (const [rel, body] of expected) {
+        expect(readFileSync(join(root, rel), 'utf8')).toBe(body);
+      }
+
+      // 2. THE REPO IS NOT CORRUPT.
+      const fsck = await run(['fsck', '--no-progress'], { cwd: root });
+      expect(fsck.code).toBe(0);
+      const log = await run(['log', '--oneline'], { cwd: root });
+      expect(log.code).toBe(0);
+      expect(log.stdout.trim().split('\n').length).toBeGreaterThan(1);
+
+      // 3. NO LOCK LEFT BEHIND — neither git's nor ours.
+      expect(existsSync(join(root, '.git', 'index.lock'))).toBe(false);
+      expect(existsSync(join(root, '.git', REPO_LOCK_FILE))).toBe(false);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 30_000);
+
+  test('a commit sequence is never interleaved by another writer', async () => {
+    // The half-staged commit, precisely. Without a lock held ACROSS the
+    // sequence, the second writer's commit lands between the first's `add` and
+    // its `commit` and takes the staged file with it. `index.lock` cannot stop
+    // this — it is released the moment `add` returns.
+    const root = await makeRepo();
+    try {
+      const order: string[] = [];
+      const sequence = (name: string) =>
+        withRepoLock(root, `studio:${name}`, async () => {
+          order.push(`${name}:add`);
+          await run(['add', '-A'], { cwd: root });
+          await new Promise((r) => setTimeout(r, 25));
+          order.push(`${name}:commit`);
+          await run(['commit', '-m', name, '--allow-empty'], { cwd: root });
+        });
+
+      writeCanvas(root, '.design/ui/a.tsx', 'export const a = 1;\n');
+      await Promise.all([sequence('one'), sequence('two')]);
+
+      // add/commit/add/commit — never add/add/commit/commit.
+      expect(order[1]).toBe(order[0].replace(':add', ':commit'));
+      expect(order[3]).toBe(order[2].replace(':add', ':commit'));
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  }, 20_000);
+});