@1agh/maude 0.58.0 → 0.58.2

package/apps/studio/test/comments-fs-rebroadcast.test.ts

@@ -0,0 +1,155 @@
+// Issue #74 — `_comments/<slug>.json` written DIRECTLY on disk must reach
+// already-open shells over WS.
+//
+// This pins EXISTING behaviour rather than covering a fix. `/design:edit`
+// resolves comments with a plain jq-rewrite of the comments file (edit.md §3's
+// documented recipe), which bypasses api.commentsPatch and so never fires the
+// `onCommentsChanged` re-broadcast in server.ts. The broadcast happens anyway,
+// from collab/index.ts's `fs:any` re-seed ("the sidebar still needs the
+// 'comments' bus emit, so keep that unconditionally") — a non-obvious owner
+// that a reader of server.ts alone would conclude was missing.
+//
+// It is worth locking down because the chat panel's "Implement N comments"
+// quick action (issue #74) is built on it: the agent resolves comments by
+// direct write, and if that stopped reaching open shells the button would keep
+// counting comments that are already done, with nothing else failing.
+
+import { describe, expect, test } from 'bun:test';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+const FILE = '.design/ui/Foo.tsx';
+const SLUG = 'ui-foo';
+
+async function openWs(port: number): Promise<WebSocket> {
+  const ws = new WebSocket(`ws://localhost:${port}/_ws`);
+  await new Promise<void>((resolve, reject) => {
+    const t = setTimeout(() => reject(new Error('ws open timeout')), 2000);
+    ws.addEventListener('open', () => {
+      clearTimeout(t);
+      resolve();
+    });
+    ws.addEventListener('error', (e) => {
+      clearTimeout(t);
+      reject(e);
+    });
+  });
+  return ws;
+}
+
+/** Resolve on the first `comments` frame for `file`, or null after `ms`. */
+function nextCommentsFrame(
+  ws: WebSocket,
+  file: string,
+  ms = 5000
+): Promise<{ file: string; comments: Array<{ id: string; status: string }> } | null> {
+  return new Promise((resolve) => {
+    const done = (v: never | null) => {
+      clearTimeout(timer);
+      ws.removeEventListener('message', onMsg);
+      resolve(v);
+    };
+    const timer = setTimeout(() => done(null), ms);
+    const onMsg = (ev: MessageEvent) => {
+      try {
+        const m = JSON.parse(String(ev.data));
+        if (m && m.type === 'comments' && m.file === file) done(m);
+      } catch {
+        /* non-JSON frame — ignore */
+      }
+    };
+    ws.addEventListener('message', onMsg);
+  });
+}
+
+function seedCanvas(designRoot: string) {
+  mkdirSync(join(designRoot, 'ui'), { recursive: true });
+  writeFileSync(join(designRoot, 'ui', 'Foo.tsx'), 'export default function P(){return <main/>}\n');
+  mkdirSync(join(designRoot, '_comments'), { recursive: true });
+}
+
+function commentsJson(status: 'open' | 'resolved') {
+  return JSON.stringify(
+    [
+      {
+        id: 'c_one',
+        file: FILE,
+        selector: 'main',
+        dom_path: ['main'],
+        tag: 'main',
+        classes: '',
+        bounds: null,
+        html_excerpt: '',
+        text: 'tighten the padding',
+        status,
+        created: '2026-01-01T00:00:00.000Z',
+        resolved_at: status === 'resolved' ? '2026-01-02T00:00:00.000Z' : null,
+        author: 'Test User',
+        thread: [],
+        mentions: [],
+      },
+    ],
+    null,
+    2
+  );
+}
+
+describe('issue #74 — comments file-watch re-broadcast', () => {
+  test('a direct resolve-write broadcasts the updated list to open shells', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      seedCanvas(designRoot);
+      const commentsFile = join(designRoot, '_comments', `${SLUG}.json`);
+      writeFileSync(commentsFile, commentsJson('open'));
+
+      const ws = await openWs(port);
+      // Clear the fs-watch per-path debounce window (50 ms) so the resolve
+      // write below is seen as its own event rather than folded into the seed.
+      await Bun.sleep(150);
+
+      const frame = nextCommentsFrame(ws, FILE);
+      // Exactly what edit.md §3's resolve recipe does: rewrite the file in
+      // place, never touching the API.
+      writeFileSync(commentsFile, commentsJson('resolved'));
+
+      const got = await frame;
+      ws.close();
+
+      expect(got).not.toBeNull();
+      expect(got!.comments).toHaveLength(1);
+      expect(got!.comments[0]!.id).toBe('c_one');
+      expect(got!.comments[0]!.status).toBe('resolved');
+    } finally {
+      await killProc(proc);
+    }
+  }, 20000);
+
+  test('a comments file for an unknown slug is ignored, not fatal', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      seedCanvas(designRoot);
+      const ws = await openWs(port);
+      await Bun.sleep(150);
+
+      // No canvas resolves to this slug — the handler must bail quietly and
+      // leave the server healthy.
+      writeFileSync(
+        join(designRoot, '_comments', 'ui-does-not-exist.json'),
+        JSON.stringify([], null, 2)
+      );
+      await Bun.sleep(400);
+      ws.close();
+
+      const health = await fetch(`http://localhost:${port}/_health`);
+      expect(health.ok).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  }, 20000);
+});

package/apps/studio/test/fixtures/mock-acp-agent-wedged.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env bun
+// A mock ACP agent that WEDGES on the FIRST turn only (issue-82): its
+// `session/prompt` handler never resolves for call #1 — simulating a
+// `claude` subprocess that has hung — and it never implements
+// `session/cancel` at all, so a bridge that only sends the cooperative ACP
+// `session/cancel` request and trusts it will hang forever, exactly like the
+// reported "I clicked STOP and nothing happened" bug.
+//
+// Every call AFTER the first resolves normally and quickly — this lets a
+// test start a second, overlapping `prompt()` on the same bridge/chat (the
+// ethical-hacker's "no reentrancy guard" finding) and confirm that turn's
+// ordinary completion doesn't blind `cancel()` to the still-wedged first one.
+
+import { Readable, Writable } from 'node:stream';
+
+import * as acp from '@agentclientprotocol/sdk';
+
+const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+
+let promptCalls = 0;
+
+acp
+  .agent({ name: 'mock-acp-agent-wedged' })
+  .onRequest('initialize', () => ({
+    protocolVersion: acp.PROTOCOL_VERSION,
+    agentCapabilities: { loadSession: false },
+  }))
+  .onRequest('session/new', () => ({ sessionId: 'mock-wedged-session' }))
+  .onRequest('session/prompt', () => {
+    promptCalls += 1;
+    if (promptCalls === 1) return new Promise(() => {}); // never resolves, never rejects
+    return Promise.resolve({ stopReason: 'end_turn' });
+  })
+  // Deliberately NO `session/cancel` handler — an agent that never
+  // implemented turn-cancellation at all, the other real-world shape of
+  // "Stop does nothing".
+  .connect(stream);

package/apps/studio/test/sync-canvas-path.test.ts

@@ -0,0 +1,200 @@
+// The traversal corpus, and the rule that makes the whole thing safe.
+//
+// `syncMeta.path` is hub-supplied input that chooses a DIRECTORY. Every case
+// below is a way a path could try to be something other than "a canvas in this
+// project", plus the one rule that closes the class rather than the instance:
+// the path must slug back to the document carrying it.
+
+import { describe, expect, it } from 'bun:test';
+
+import { canvasSlugFromRel } from '../canvas-slug.ts';
+import {
+  fallbackCanvasPath,
+  MAX_CANVAS_PATH_LEN,
+  resolveCanvasBodyRel,
+  validateCanvasPath,
+} from '../sync/canvas-path.ts';
+
+const GROUPS = [{ path: 'system' }, { path: 'ui' }];
+
+/** Validate a path AGAINST THE SLUG IT WOULD REALLY CARRY, so a rejection is
+ *  attributable to the rule under test and not to rule 7 firing first. */
+function check(path: unknown, slug: string) {
+  return validateCanvasPath({ path, slug, designRel: '.design', canvasGroups: GROUPS });
+}
+
+describe('validateCanvasPath — what it accepts', () => {
+  it('accepts a genuinely nested canvas', () => {
+    const v = check('ui/2026/social/summer-camp.tsx', 'ui-2026-social-summer-camp');
+    expect(v).toEqual({ ok: true, rel: 'ui/2026/social/summer-camp.tsx' });
+  });
+
+  it('accepts a canvas directly in a group', () => {
+    expect(check('ui/Card.tsx', 'ui-card').ok).toBe(true);
+  });
+
+  it('accepts the design-system group', () => {
+    expect(check('system/preview/logo.tsx', 'system-preview-logo').ok).toBe(true);
+  });
+
+  it('accepts a filename with a space — they exist and they sync today', () => {
+    // The slug transform maps whitespace to `_`, so `Kanban App.tsx` is a real
+    // canvas with a real document. Refusing it here would silently relocate a
+    // file that works today.
+    expect(check('ui/Kanban App.tsx', 'ui-kanban_app').ok).toBe(true);
+  });
+
+  it('is case-insensitive about the slug, like the slug transform', () => {
+    expect(check('ui/Card.tsx', 'UI-CARD').ok).toBe(true);
+  });
+});
+
+describe('validateCanvasPath — the traversal corpus', () => {
+  const corpus: Array<[string, unknown, string]> = [
+    ['parent traversal', '../../etc/passwd.tsx', 'anything'],
+    ['traversal inside a group', 'ui/../../../tmp/x.tsx', 'anything'],
+    ['a bare dot component', 'ui/./Card.tsx', 'ui-card'],
+    ['absolute posix', '/etc/cron.d/x.tsx', 'anything'],
+    ['windows drive', 'C:\\Windows\\x.tsx', 'anything'],
+    ['UNC share', '\\\\host\\share\\x.tsx', 'anything'],
+    ['a backslash smuggling a separator', 'ui\\..\\..\\x.tsx', 'anything'],
+    ['an empty component', 'ui//Card.tsx', 'ui-card'],
+    ['a trailing slash', 'ui/Card.tsx/', 'ui-card'],
+    ['a NUL byte', 'ui/Card.tsx\u0000.png', 'ui-card'],
+    ['a newline', 'ui/Ca\nrd.tsx', 'ui-card'],
+    ['percent-encoded traversal', 'ui/%2e%2e/%2e%2e/x.tsx', 'anything'],
+    ['a unicode dot lookalike as a component', 'ui/\u2024\u2024/x.tsx', 'anything'],
+    ['a bidi override in a component', 'ui/Ca\u202erd.tsx', 'ui-card'],
+    ['not a .tsx', 'ui/Card.html', 'ui-card'],
+    ['no extension at all', 'ui/Card', 'ui-card'],
+    ['an extra extension', 'ui/Card.tsx.png', 'ui-card'],
+    ['a dotfile', 'ui/.env.tsx', 'anything'],
+    ['at the design root, in no group', 'ui-card.tsx', 'ui-card'],
+    ['outside every declared group', 'assets/Card.tsx', 'assets-card'],
+    ['not a string', 42, 'anything'],
+    ['an object', { toString: () => 'ui/Card.tsx' }, 'ui-card'],
+    ['the empty string', '', 'anything'],
+  ];
+
+  for (const [label, path, slug] of corpus) {
+    it(`refuses ${label}`, () => {
+      const v = validateCanvasPath({ path, slug, designRel: '.design', canvasGroups: GROUPS });
+      expect(v.ok).toBe(false);
+    });
+  }
+
+  it('refuses a path longer than the cap', () => {
+    const long = `ui/${'a'.repeat(MAX_CANVAS_PATH_LEN)}.tsx`;
+    expect(validateCanvasPath({ path: long, slug: 'x', canvasGroups: GROUPS }).ok).toBe(false);
+  });
+});
+
+describe('rule 7 — a path that points elsewhere no longer addresses this document', () => {
+  it('refuses a well-formed path belonging to a DIFFERENT canvas', () => {
+    // The one that matters. Every rule above refuses a MALFORMED path; this
+    // refuses a perfectly legal one that simply is not this document's. Without
+    // it, any peer could overwrite any other canvas in the project by pushing a
+    // body under its own document name and someone else's path.
+    const v = check('ui/secrets/credentials.tsx', 'ui-card');
+    expect(v.ok).toBe(false);
+    if (!v.ok) expect(v.reason).toContain('slugs to');
+  });
+
+  it('refuses a path that only differs in a folder boundary', () => {
+    // `ui/a-b.tsx` and `ui/a/b.tsx` slug identically (`ui-a-b`) — so this pair
+    // is ACCEPTED by rule 7 on purpose: the collision is the slug's, it predates
+    // this feature, and `admitCanvases` already refuses to sync both files.
+    expect(check('ui/a/b.tsx', 'ui-a-b').ok).toBe(true);
+    expect(check('ui/a-b.tsx', 'ui-a-b').ok).toBe(true);
+    // What is NOT accepted is a path whose slug simply differs.
+    expect(check('ui/a/c.tsx', 'ui-a-b').ok).toBe(false);
+  });
+});
+
+describe('fallbackCanvasPath — visible, and still the same document', () => {
+  it('places an un-pathed canvas inside the group its slug came from', () => {
+    expect(fallbackCanvasPath('ui-legacy', GROUPS)).toBe('ui/legacy.tsx');
+  });
+
+  it('the result slugs BACK to the document — a fallback must not fork it', () => {
+    // The property, not the string. `ui/ui-legacy.tsx` would be visible and
+    // would slug to `ui-ui-legacy`: a second document syncing the same bytes,
+    // with the original orphaned on the hub.
+    for (const slug of ['ui-legacy', 'ui-2026-social-summer-camp', 'system-preview-logo']) {
+      expect(canvasSlugFromRel(fallbackCanvasPath(slug, GROUPS), '.design')).toBe(slug);
+    }
+  });
+
+  it('picks the group the slug actually came from, not the first one', () => {
+    const groups = [{ path: 'ui' }, { path: 'screens' }];
+    expect(fallbackCanvasPath('screens-x', groups)).toBe('screens/x.tsx');
+  });
+
+  it('prefers the LONGEST matching group over declaration order', () => {
+    const groups = [{ path: 'ui' }, { path: 'ui/social' }];
+    expect(fallbackCanvasPath('ui-social-x', groups)).toBe('ui/social/x.tsx');
+  });
+
+  it('keeps the design root when no declared group matches the slug', () => {
+    // Today's behaviour, deliberately: it is invisible, but it is the SAME
+    // document. A canvas that was outside every group at its author cannot be
+    // placed inside one without renaming it — which is what a path is for.
+    expect(fallbackCanvasPath('welcome', GROUPS)).toBe('welcome.tsx');
+    expect(fallbackCanvasPath('x', [])).toBe('x.tsx');
+  });
+
+  it('drops a group path that escapes the design root', () => {
+    expect(fallbackCanvasPath('etc-x', [{ path: '../../etc' }])).toBe('etc-x.tsx');
+  });
+
+  it('never produces a separator, a dotfile or a `..` from the slug', () => {
+    // The slug is charset-constrained upstream (`slugFromDocName`), so this is
+    // the second line rather than the first — but it is the line that stands
+    // between a bad slug and a directory of the sender's choosing.
+    for (const hostile of ['../../evil', '/etc/passwd', '..', '.', 'a\\b', '']) {
+      const rel = fallbackCanvasPath(hostile, GROUPS);
+      expect(rel).not.toContain('/');
+      expect(rel).not.toContain('\\');
+      expect(rel).not.toContain('..');
+      expect(rel.startsWith('.')).toBe(false);
+      expect(rel.endsWith('.tsx')).toBe(true);
+    }
+  });
+});
+
+describe('resolveCanvasBodyRel — one answer for "what does a refused path do"', () => {
+  it('uses the path when it validates', () => {
+    expect(
+      resolveCanvasBodyRel({
+        path: 'ui/2026/social/summer-camp.tsx',
+        slug: 'ui-2026-social-summer-camp',
+        designRel: '.design',
+        canvasGroups: GROUPS,
+      })
+    ).toEqual({ rel: 'ui/2026/social/summer-camp.tsx', fromPath: true });
+  });
+
+  it('falls back — never throws the canvas away — and says why', () => {
+    const reasons: string[] = [];
+    const out = resolveCanvasBodyRel({
+      path: '../../etc/passwd.tsx',
+      slug: 'ui-card',
+      canvasGroups: GROUPS,
+      onRefused: (r) => reasons.push(r),
+    });
+    expect(out).toEqual({ rel: 'ui/card.tsx', fromPath: false });
+    expect(reasons.length).toBe(1);
+  });
+
+  it('an ABSENT path is not a refusal — an older peer omits it', () => {
+    const reasons: string[] = [];
+    const out = resolveCanvasBodyRel({
+      path: undefined,
+      slug: 'ui-card',
+      canvasGroups: GROUPS,
+      onRefused: (r) => reasons.push(r),
+    });
+    expect(out).toEqual({ rel: 'ui/card.tsx', fromPath: false });
+    expect(reasons).toEqual([]);
+  });
+});