@1agh/maude 0.53.2 → 0.55.0

package/apps/studio/test/cloud-endpoints.test.ts

@@ -9,7 +9,12 @@ import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-import { parseDeepLink, shareViewUrl } from '../client/panels/CloudBar.jsx';
+import {
+  isDisplayableUrl,
+  localIdentityHint,
+  parseDeepLink,
+  shareViewUrl,
+} from '../client/panels/CloudBar.jsx';
 
 let stub: ReturnType<typeof Bun.serve> | null = null;
 let scratch = '';
@@ -78,20 +83,242 @@ describe('parseDeepLink — untrusted input, strict shape', () => {
       'maude://open/x?code=nothex', // bad code
       'https://evil.example/?code=mhc_' + 'a'.repeat(64), // not maude://
       'maude://join/x/y', // join is not the open shape
+      // Over the platform's 40-char project-id cap — a drive-by link never
+      // passes through the server-side bound, so arbitrary attacker text would
+      // otherwise render in the dialog heading, prose and aria-label.
+      `maude://open/${'a'.repeat(41)}?code=mhc_${'a'.repeat(64)}`,
     ]) {
       expect(parseDeepLink(bad)).toBeNull();
     }
+    // …and exactly 40 is still a real project id.
+    expect(
+      parseDeepLink(`maude://open/${'a'.repeat(40)}?code=mhc_${'a'.repeat(64)}`)
+    ).not.toBeNull();
   });
 });
 
 describe('shareViewUrl — the viewer’s browser home', () => {
-  test('derives view-<host> from the project url', () => {
+  test('is the project’s OWN address — the view- gallery is gone (Phase 25 C5)', () => {
+    // `view-*` is hard-refused by tenantFromHostname, so the old derivation
+    // produced a guaranteed 404 — invisible only because window.open was a no-op
+    // in the shell. Making the opener work would have made it a dead menu item.
     expect(shareViewUrl('https://alligators.cloud.maude.sh', 'alligators')).toBe(
-      'https://view-alligators.cloud.maude.sh'
+      'https://alligators.cloud.maude.sh'
     );
+    expect(shareViewUrl('https://alligators.cloud.maude.sh', 'alligators')).not.toContain('view-');
   });
   test('falls back to the platform zone on garbage', () => {
-    expect(shareViewUrl('nonsense', 'p1')).toBe('https://view-p1.cloud.maude.sh');
+    expect(shareViewUrl('nonsense', 'p1')).toBe('https://p1.cloud.maude.sh');
+  });
+});
+
+describe('isDisplayableUrl — what may be rendered as a clickable address', () => {
+  const CLOUD = 'https://cloud.maude.sh';
+
+  test('the configured origin and the cloud zone’s front doors pass', () => {
+    expect(isDisplayableUrl('https://cloud.maude.sh/activate?code=ABCD', CLOUD)).toBe(true);
+    expect(isDisplayableUrl('https://alligators.cloud.maude.sh/', CLOUD)).toBe(true);
+    // A self-host origin is legitimate for its OWN addresses.
+    expect(isDisplayableUrl('http://127.0.0.1:8788/activate', 'http://127.0.0.1:8788')).toBe(true);
+  });
+
+  test('an off-zone address is never rendered — a scheme check was not enough', () => {
+    // The bug this closes: `https://evil.example/activate?code=…` from a hostile
+    // or MITM'd control plane passed a protocol-only check and still rendered as
+    // a live href with a Copy button, and middle-click never reaches the click
+    // handler, let alone the Rust zone lock.
+    for (const bad of [
+      'https://evil.example/activate?code=x',
+      'https://cloud.maude.sh.attacker.example/',
+      'javascript:alert(1)',
+      'file:///etc/passwd',
+      'not a url',
+    ]) {
+      expect(isDisplayableUrl(bad, CLOUD)).toBe(false);
+    }
+    // Deep paths on a TENANT host are refused here too — same rule as the opener.
+    expect(isDisplayableUrl('https://canvas-evil.cloud.maude.sh/stored.svg', CLOUD)).toBe(false);
+  });
+});
+
+describe('status — names the LOCAL half so a deep link can be read', () => {
+  test('reports the open folder and its workspace, and never a credential', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const { mkdirSync } = await import('node:fs');
+    const repoRoot = join(scratch, 'alligators-web');
+    const designRoot = join(repoRoot, '.design');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(
+      join(designRoot, 'config.json'),
+      JSON.stringify({ linkedHub: { url: 'https://alligators.cloud.maude.sh', linkedAt: 1 } })
+    );
+
+    const r = createCloudEndpoints({ paths: { repoRoot, designRoot } }).status();
+    expect(r.status).toBe(200);
+    const json = r.json as Record<string, unknown>;
+    expect(json.project).toBe('alligators-web');
+    // No hub credential was stored in this scratch dir, so the link is reported
+    // but explicitly UNCORROBORATED — the dialog may not vouch for it.
+    expect(json.linkedHub).toEqual({
+      url: 'https://alligators.cloud.maude.sh',
+      credentialed: false,
+    });
+    // Signed out here — and the payload must stay free of token material
+    // whatever the state (this response reaches the browser surface too).
+    expect(json.connected).toBe(false);
+    expect(JSON.stringify(json)).not.toContain('token');
+  });
+
+  test('an unlinked (or malformed-config) folder reports linkedHub: null, not an error', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const { mkdirSync } = await import('node:fs');
+    const repoRoot = join(scratch, 'fresh-thing');
+    const designRoot = join(repoRoot, '.design');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(join(designRoot, 'config.json'), '{ not json');
+
+    const json = createCloudEndpoints({ paths: { repoRoot, designRoot } }).status().json as Record<
+      string,
+      unknown
+    >;
+    expect(json.linkedHub).toBeNull();
+    expect(json.project).toBe('fresh-thing');
+  });
+});
+
+describe('localIdentityHint — only an exact, corroborated agreement is silent', () => {
+  const CLOUD = 'https://cloud.maude.sh';
+
+  test('the reported case warns: one project open, the link naming another', () => {
+    // StudyFi open, "Open in Maude" pressed on alligators — one click from
+    // syncing StudyFi's designs into somebody else's workspace.
+    expect(
+      localIdentityHint({ localProject: 'AI-StudyMate', cloudUrl: CLOUD, claimed: 'alligators' })
+    ).toBe('mismatch');
+  });
+
+  test('a name an ATTACKER chose to look like yours does not buy silence', () => {
+    // The whole point (attacker pass B1). The cloud project id is registerable by
+    // anyone, so treating "contains your folder name" as agreement handed the
+    // attacker the off-switch for the warning. And the server's 409 cannot help:
+    // the claim and the actual project agree — it IS their project.
+    for (const claimed of [
+      'alligators-design-sync',
+      'alligators-backup',
+      'shared-alligators',
+      'web-design-studio-app',
+    ]) {
+      expect(localIdentityHint({ localProject: 'alligators', cloudUrl: CLOUD, claimed })).not.toBe(
+        'match'
+      );
+      expect(
+        ['similar', 'mismatch'].includes(
+          localIdentityHint({ localProject: 'alligators', cloudUrl: CLOUD, claimed })
+        )
+      ).toBe(true);
+    }
+  });
+
+  test('an exact name is the only silent name-based verdict', () => {
+    expect(
+      localIdentityHint({ localProject: 'alligators', cloudUrl: CLOUD, claimed: 'alligators' })
+    ).toBe('match');
+    // Normalization still applies — casing and separators are not a difference.
+    expect(
+      localIdentityHint({ localProject: 'Alligators', cloudUrl: CLOUD, claimed: 'alligators' })
+    ).toBe('match');
+    // A near-match is its own state: alike, and still NOT the same workspace.
+    expect(
+      localIdentityHint({ localProject: 'alligators-web', cloudUrl: CLOUD, claimed: 'alligators' })
+    ).toBe('similar');
+  });
+
+  test('a CREDENTIALED link to that project reads as linked', () => {
+    expect(
+      localIdentityHint({
+        localProject: 'anything',
+        linkedHubUrl: 'https://alligators.cloud.maude.sh',
+        linkedHubCredentialed: true,
+        cloudUrl: CLOUD,
+        claimed: 'alligators',
+      })
+    ).toBe('linked');
+  });
+
+  test('an UNCREDENTIALED linkedHub cannot vouch for anyone', () => {
+    // config.json is committed and travels with the repo, so a hostile template
+    // could otherwise make the dialog say "already linked to <attacker>" — the
+    // strongest reassurance it can give (attacker pass B2). Without a stored
+    // credential it is ignored and the folder name decides.
+    expect(
+      localIdentityHint({
+        localProject: 'my-thing',
+        linkedHubUrl: 'https://attacker.cloud.maude.sh',
+        linkedHubCredentialed: false,
+        cloudUrl: CLOUD,
+        claimed: 'attacker',
+      })
+    ).toBe('mismatch');
+  });
+
+  test('a folder credentialed to a DIFFERENT workspace warns', () => {
+    expect(
+      localIdentityHint({
+        localProject: 'alligators',
+        linkedHubUrl: 'https://someone-else.cloud.maude.sh',
+        linkedHubCredentialed: true,
+        cloudUrl: CLOUD,
+        claimed: 'alligators',
+      })
+    ).toBe('mismatch');
+  });
+
+  test('a short generic folder name does not buy agreement by containment', () => {
+    for (const localProject of ['web', 'app', 'src']) {
+      expect(
+        localIdentityHint({ localProject, cloudUrl: CLOUD, claimed: 'webshop-frontend' })
+      ).toBe('mismatch');
+    }
+  });
+
+  test('an accented or over-long folder name still matches its own workspace', () => {
+    // The fold must mirror the platform's deriveProjectId (NFKD + strip + 40-cap)
+    // or the warning fires on every LEGITIMATE connect for a whole class of
+    // names — which is how a consent warning dies (attacker re-review).
+    expect(
+      localIdentityHint({ localProject: 'Zkušební tým', cloudUrl: CLOUD, claimed: 'zkusebni-tym' })
+    ).toBe('match');
+    expect(
+      localIdentityHint({ localProject: 'Přátelé', cloudUrl: CLOUD, claimed: 'pratele' })
+    ).toBe('match');
+    // >40 chars: the platform truncates the id, so the fold must truncate too.
+    const long = 'a-very-long-project-name-that-the-platform-truncates-at-forty';
+    expect(
+      localIdentityHint({ localProject: long, cloudUrl: CLOUD, claimed: long.slice(0, 40) })
+    ).toBe('match');
+  });
+
+  test('no signal is "unknown", which warns — it must never read as agreement', () => {
+    // Every stub and self-hoster is http://127.0.0.1:<port>, carrying no project
+    // name. Before, that produced a reassuring neutral with a primary Connect;
+    // on the launch path an unresolved status did the same (attacker pass B3).
+    expect(
+      localIdentityHint({
+        localProject: '',
+        linkedHubUrl: 'http://127.0.0.1:4599',
+        cloudUrl: 'http://127.0.0.1:4599',
+        claimed: 'stub-project',
+      })
+    ).toBe('unknown');
+    // Status not yet resolved → unknown, whatever else is on hand.
+    expect(
+      localIdentityHint({
+        localProject: 'alligators',
+        cloudUrl: CLOUD,
+        claimed: 'alligators',
+        resolved: false,
+      })
+    ).toBe('unknown');
   });
 });
 

package/apps/studio/test/cloud-shell-surfaces.test.ts

@@ -61,7 +61,15 @@ describe('the cloud shell offers nothing it cannot honour', () => {
   });
 
   test('the cloud sign-in is not offered inside the cloud', () => {
-    expect(APP).toContain('{cloud ? null : <CloudBar />}');
+    // `=== null`, not falsiness. `cloud` is undefined until `/_config` answers,
+    // and treating unknown as "not cloud" mounted this bar for one frame in
+    // every cloud tab — long enough to fire the one request the cell refuses.
+    expect(APP).toContain('{cloud === null ? <CloudBar /> : null}');
+    expect(APP).not.toContain('{cloud ? null : <CloudBar />}');
+  });
+
+  test('the local export queue does not hydrate before the shell is known', () => {
+    expect(APP).toContain('useExportCenter({ enabled: cfg.cloud === null })');
   });
 
   test('every component that gates on the shell is actually GIVEN the flag', () => {
@@ -71,7 +79,9 @@ describe('the cloud shell offers nothing it cannot honour', () => {
       const at = APP.indexOf(call);
       expect(at).toBeGreaterThan(0);
       const props = APP.slice(at, at + 900);
-      expect(props).toContain('cloud={cfg?.cloud ?? null}');
+      // Passed RAW — a `?? null` here would erase the "not known yet" state
+      // before any component could see it.
+      expect(props).toContain('cloud={cfg.cloud}');
     }
   });
 
@@ -88,3 +98,22 @@ describe('the cloud shell offers nothing it cannot honour', () => {
     }
   });
 });
+
+describe('"not known yet" survives every layer between /_config and the DOM', () => {
+  // The three-line bug: the call sites were fixed to pass `cfg.cloud` raw, and
+  // the components still declared `cloud = null` as a default parameter. A
+  // default fires on `undefined` — so "we have not asked yet" turned back into
+  // "this is not the cloud" one layer further in, the sign-in bar mounted for a
+  // frame, and the boot 404 came back looking exactly like the one just fixed.
+  const APP_SRC = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
+  const SETTINGS_SRC = readFileSync(join(STUDIO, 'client', 'panels', 'SettingsPanel.jsx'), 'utf8');
+
+  test('no component defaults the shell flag', () => {
+    for (const [label, src] of [
+      ['app.jsx', APP_SRC],
+      ['SettingsPanel.jsx', SETTINGS_SRC],
+    ] as const) {
+      expect(src, label).not.toMatch(/^\s*cloud = (null|false|\{\}),$/m);
+    }
+  });
+});

package/apps/studio/test/collab-readonly-gate.test.ts

@@ -0,0 +1,194 @@
+// Unit: the read-only role gate on collab sync writes — the cloud collab lane
+// (RCA issue-cloud-live-collaboration-dead).
+//
+// A cell's proxy opens the canvas iframe's collab socket at the member's real
+// role; a viewer's socket arrives with readOnly=true. The room mirrors the role
+// matrix at the WS door the same way the inspector channel does for
+// comments-patch/delete: a read-only conn receives everything and publishes
+// awareness (presence for viewers is the point of the channel), but its sync
+// writes are gated to the COMMENT lane — the one write a viewer holds
+// (`viewer.comment === true`). Composes with, never replaces, the DDR-122
+// canvas-realm body-lane gate (test/collab-origin-gate.test.ts).
+
+import { describe, expect, test } from 'bun:test';
+
+import * as encoding from 'lib0/encoding';
+import { writeUpdate } from 'y-protocols/sync';
+import * as Y from 'yjs';
+
+import { MESSAGE_SYNC } from '../collab/protocol.ts';
+import { createRoom, type RoomCallbacks, type RoomConn } from '../collab/room.ts';
+
+function makeConn(
+  id: string,
+  opts: { realm?: 'main' | 'canvas'; readOnly?: boolean } = {}
+): RoomConn & { recv: Uint8Array[] } {
+  const recv: Uint8Array[] = [];
+  return {
+    id,
+    ...(opts.realm ? { realm: opts.realm } : {}),
+    ...(opts.readOnly !== undefined ? { readOnly: opts.readOnly } : {}),
+    send(payload: Uint8Array) {
+      recv.push(payload);
+    },
+    recv,
+  };
+}
+
+function makeCallbacks(): RoomCallbacks {
+  return {
+    seed() {},
+    persistJson() {},
+    persistBinary() {},
+  };
+}
+
+function syncUpdateFrame(update: Uint8Array): Uint8Array {
+  const encoder = encoding.createEncoder();
+  encoding.writeVarUint(encoder, MESSAGE_SYNC);
+  writeUpdate(encoder, update);
+  return encoding.toUint8Array(encoder);
+}
+
+function peerDelta(room: { doc: Y.Doc }, mutate: (doc: Y.Doc) => void): Uint8Array {
+  const peer = new Y.Doc();
+  Y.applyUpdate(peer, Y.encodeStateAsUpdate(room.doc));
+  const before = Y.encodeStateVector(peer);
+  mutate(peer);
+  return Y.encodeStateAsUpdate(peer, before);
+}
+
+describe('room read-only gate — cloud viewer sockets', () => {
+  test('a read-only canvas conn may write COMMENTS (the viewer capability)', async () => {
+    const room = createRoom('viewer-comments', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(viewer);
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(
+        peerDelta(room, (d) => d.getArray('comments').push([{ id: 'c1', text: 'a viewer note' }]))
+      )
+    );
+
+    expect(room.doc.getArray('comments').toArray()).toEqual([{ id: 'c1', text: 'a viewer note' }]);
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a read-only conn may NOT write annotations — refused, doc untouched, not broadcast', async () => {
+    const room = createRoom('viewer-annotations', makeCallbacks());
+    const editor = makeConn('editor', { realm: 'canvas', readOnly: false });
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(editor);
+    await room.connect(viewer);
+    editor.recv.length = 0;
+    viewer.recv.length = 0;
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(peerDelta(room, (d) => d.getMap('annotations').set('svg', '<svg/>')))
+    );
+
+    expect(room.doc.getMap('annotations').get('svg')).toBeUndefined();
+    expect(room.gateRefusals()).toBe(1);
+    expect(editor.recv.length).toBe(0);
+    // The refused peer got a corrective full-state frame instead.
+    expect(viewer.recv.length).toBe(1);
+    await room.destroy();
+  });
+
+  test('a read-only conn may not write body lanes either — even on the main realm', async () => {
+    const room = createRoom('viewer-body', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'main', readOnly: true });
+    await room.connect(viewer);
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'PWNED')))
+    );
+
+    expect(room.doc.getText('html').toString()).toBe('');
+    expect(room.gateRefusals()).toBe(1);
+    await room.destroy();
+  });
+
+  test('a WRITABLE canvas conn (an owner through the cloud lane) still annotates', async () => {
+    // The reason the role claim exists at all: annotations are exactly what the
+    // cloud complaint was about, and they need an editor-or-better socket.
+    const room = createRoom('owner-annotates', makeCallbacks());
+    const owner = makeConn('owner', { realm: 'canvas', readOnly: false });
+    await room.connect(owner);
+
+    room.receive(
+      owner,
+      syncUpdateFrame(
+        peerDelta(room, (d) => d.getMap('annotations').set('svg', '<svg><rect/></svg>'))
+      )
+    );
+
+    expect(room.doc.getMap('annotations').get('svg')).toBe('<svg><rect/></svg>');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('awareness frames from a read-only conn pass — presence for viewers is the point', async () => {
+    const room = createRoom('viewer-presence', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(viewer);
+
+    const peerDoc = new Y.Doc();
+    const { Awareness, encodeAwarenessUpdate } = await import('y-protocols/awareness');
+    const peerAwareness = new Awareness(peerDoc);
+    peerAwareness.setLocalState({ name: 'viewing member' });
+    const encoder = encoding.createEncoder();
+    encoding.writeVarUint(encoder, 1 /* MESSAGE_AWARENESS */);
+    encoding.writeVarUint8Array(
+      encoder,
+      encodeAwarenessUpdate(peerAwareness, [peerAwareness.clientID])
+    );
+    room.receive(viewer, encoding.toUint8Array(encoder));
+
+    expect(room.awareness.getStates().get(peerAwareness.clientID)).toEqual({
+      name: 'viewing member',
+    });
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a mixed frame (comment + annotation) from a read-only conn is refused wholesale', async () => {
+    const room = createRoom('viewer-mixed', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(viewer);
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(
+        peerDelta(room, (d) => {
+          d.getArray('comments').push([{ id: 'decoy' }]);
+          d.getMap('annotations').set('svg', '<svg/>');
+        })
+      )
+    );
+
+    expect(room.gateRefusals()).toBe(1);
+    expect(room.doc.getArray('comments').length).toBe(0);
+    expect(room.doc.getMap('annotations').get('svg')).toBeUndefined();
+    await room.destroy();
+  });
+
+  test('absent readOnly defaults to writable — pre-existing loopback callers unchanged', async () => {
+    const room = createRoom('legacy-writable', makeCallbacks());
+    const legacy = makeConn('legacy', { realm: 'canvas' });
+    await room.connect(legacy);
+
+    room.receive(
+      legacy,
+      syncUpdateFrame(peerDelta(room, (d) => d.getMap('annotations').set('svg', '<svg/>')))
+    );
+
+    expect(room.doc.getMap('annotations').get('svg')).toBe('<svg/>');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+});

package/apps/studio/test/git-system-engine.test.ts

@@ -0,0 +1,135 @@
+// The engine a CELL actually runs — Cloud Phase 27 D2.
+//
+// WHY THIS FILE EXISTS. `MAUDE_USE_SYSTEM_GIT=1` used to be an escape hatch
+// nobody set, so `commitSystem` and the system-git halves of checkout / branch /
+// discard / fold had no coverage at all while their isomorphic-git twins had
+// plenty. D2 makes every cloud tenant's saves go through exactly those halves
+// (studio-child.mjs pins it, because two git engines over one index is not a
+// race a careful caller can avoid — it is two programs writing one file).
+//
+// Shipping that flip while its code path was the untested one would be trading a
+// known bug for an unmeasured one. These are the same assertions the iso engine
+// already gets, run against the engine the cloud uses.
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  gitCheckout,
+  gitCommit,
+  gitCreateBranch,
+  gitDiscard,
+  gitListBranches,
+  gitStatus,
+} from '../git/service.ts';
+
+let dir: string;
+let saved: string | undefined;
+
+function run(args: string[], cwd: string) {
+  const r = Bun.spawnSync(['git', ...args], { cwd });
+  return { code: r.exitCode, stdout: r.stdout.toString(), stderr: r.stderr.toString() };
+}
+
+beforeEach(() => {
+  saved = process.env.MAUDE_USE_SYSTEM_GIT;
+  // The whole point: the flag is read LIVE, so it can be scoped to this file
+  // instead of leaking into every other suite through a module-load const.
+  process.env.MAUDE_USE_SYSTEM_GIT = '1';
+
+  dir = mkdtempSync(join(tmpdir(), 'maude-system-git-'));
+  run(['init', '-b', 'main'], dir);
+  run(['config', 'user.name', 'Test'], dir);
+  run(['config', 'user.email', 'test@example.com'], dir);
+  mkdirSync(join(dir, '.design', 'ui'), { recursive: true });
+  writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 1;\n');
+  run(['add', '-A'], dir);
+  run(['commit', '-m', 'seed'], dir);
+});
+
+afterEach(() => {
+  if (saved === undefined) {
+    delete process.env.MAUDE_USE_SYSTEM_GIT;
+  } else process.env.MAUDE_USE_SYSTEM_GIT = saved;
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('the system-git engine a cell runs on', () => {
+  test('a save commits exactly the selected file and nothing else', async () => {
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 2;\n');
+    writeFileSync(join(dir, '.design', 'ui', 'Other.tsx'), 'export const other = 1;\n');
+
+    const res = await gitCommit(dir, 'update home', ['.design/ui/Home.tsx'], {
+      designPrefix: '.design',
+    });
+    expect(res.ok).toBe(true);
+
+    // The other file is still uncommitted — "Save selected" must mean selected.
+    const after = await gitStatus(dir, { designPrefix: '.design' });
+    expect(after.files.map((f) => f.path)).toEqual(['.design/ui/Other.tsx']);
+  });
+
+  test('save-all commits every change in scope', async () => {
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 3;\n');
+    writeFileSync(join(dir, '.design', 'ui', 'New.tsx'), 'export const n = 1;\n');
+
+    const res = await gitCommit(dir, 'save all', undefined, { designPrefix: '.design' });
+    expect(res.ok).toBe(true);
+    expect((await gitStatus(dir, { designPrefix: '.design' })).clean).toBe(true);
+  });
+
+  test('nothing to save is a refusal, not an empty commit', async () => {
+    const before = run(['rev-list', '--count', 'HEAD'], dir).stdout.trim();
+    const res = await gitCommit(dir, 'nothing', undefined, { designPrefix: '.design' });
+    expect(res.ok).toBe(false);
+    expect(run(['rev-list', '--count', 'HEAD'], dir).stdout.trim()).toBe(before);
+  });
+
+  test('discard restores a tracked file and deletes an untracked one', async () => {
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'wrecked\n');
+    writeFileSync(join(dir, '.design', 'ui', 'Scratch.tsx'), 'temporary\n');
+
+    const res = await gitDiscard(dir, ['.design/ui/Home.tsx', '.design/ui/Scratch.tsx'], {
+      designPrefix: '.design',
+    });
+    expect(res.ok).toBe(true);
+    expect(readFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'utf8')).toBe(
+      'export const v = 1;\n'
+    );
+    expect(existsSync(join(dir, '.design', 'ui', 'Scratch.tsx'))).toBe(false);
+  });
+
+  test('a draft is created, switched to, and switched back', async () => {
+    const made = await gitCreateBranch(dir, 'nav-redesign');
+    expect(made.ok).toBe(true);
+    expect(run(['rev-parse', '--abbrev-ref', 'HEAD'], dir).stdout.trim()).toBe('nav-redesign');
+
+    const back = await gitCheckout(dir, 'main');
+    expect(back.ok).toBe(true);
+    expect(run(['rev-parse', '--abbrev-ref', 'HEAD'], dir).stdout.trim()).toBe('main');
+
+    expect((await gitListBranches(dir)).map((b) => b.name).sort()).toEqual([
+      'main',
+      'nav-redesign',
+    ]);
+  });
+
+  test('switching with unsaved changes says so instead of losing them', async () => {
+    await gitCreateBranch(dir, 'draft');
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 99;\n');
+    await gitCommit(dir, 'draft edit', undefined, { designPrefix: '.design' });
+    await gitCheckout(dir, 'main');
+
+    // Now dirty on main in a way the switch would clobber.
+    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 1000;\n');
+    const res = await gitCheckout(dir, 'draft');
+    expect(res.ok).toBe(false);
+    expect(res.error).toContain('Save your changes');
+    // The unsaved bytes are still there — the refusal is the point.
+    expect(readFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'utf8')).toBe(
+      'export const v = 1000;\n'
+    );
+  });
+});

package/apps/studio/test/read-only-gate.test.ts

@@ -76,6 +76,14 @@ describe('read-only gate — viewer role refuses project writes locally', () =>
       ['/_api/fs-mkdir', 'POST'],
       ['/_api/annotations', 'PUT'],
       ['/_api/acp/chat', 'POST'],
+      // Cloud Phase 27 D2 — both USED to be on READ_ONLY_ALLOWED_WRITES, on the
+      // reasoning that "viewing another branch is not changing one". Both
+      // rewrite the working TREE, and the tree is shared: a viewer switching
+      // branches replaces the files under whoever is mid-edit. The cell's proxy
+      // refuses them too, but this is the gate the hub-linked desktop and the
+      // self-host path consult, where no manifest runs at all.
+      ['/_api/git/checkout', 'POST'],
+      ['/_api/git/pull', 'POST'],
     ] as const) {
       const r = await fetch(base + path, { method, body: '{}' });
       expect(`${path} ${r.status}`).toBe(`${path} 403`);