@1agh/maude 0.58.1 → 0.58.3

package/apps/studio/test/sync-canvas-path.test.ts

@@ -0,0 +1,200 @@
+// The traversal corpus, and the rule that makes the whole thing safe.
+//
+// `syncMeta.path` is hub-supplied input that chooses a DIRECTORY. Every case
+// below is a way a path could try to be something other than "a canvas in this
+// project", plus the one rule that closes the class rather than the instance:
+// the path must slug back to the document carrying it.
+
+import { describe, expect, it } from 'bun:test';
+
+import { canvasSlugFromRel } from '../canvas-slug.ts';
+import {
+  fallbackCanvasPath,
+  MAX_CANVAS_PATH_LEN,
+  resolveCanvasBodyRel,
+  validateCanvasPath,
+} from '../sync/canvas-path.ts';
+
+const GROUPS = [{ path: 'system' }, { path: 'ui' }];
+
+/** Validate a path AGAINST THE SLUG IT WOULD REALLY CARRY, so a rejection is
+ *  attributable to the rule under test and not to rule 7 firing first. */
+function check(path: unknown, slug: string) {
+  return validateCanvasPath({ path, slug, designRel: '.design', canvasGroups: GROUPS });
+}
+
+describe('validateCanvasPath — what it accepts', () => {
+  it('accepts a genuinely nested canvas', () => {
+    const v = check('ui/2026/social/summer-camp.tsx', 'ui-2026-social-summer-camp');
+    expect(v).toEqual({ ok: true, rel: 'ui/2026/social/summer-camp.tsx' });
+  });
+
+  it('accepts a canvas directly in a group', () => {
+    expect(check('ui/Card.tsx', 'ui-card').ok).toBe(true);
+  });
+
+  it('accepts the design-system group', () => {
+    expect(check('system/preview/logo.tsx', 'system-preview-logo').ok).toBe(true);
+  });
+
+  it('accepts a filename with a space — they exist and they sync today', () => {
+    // The slug transform maps whitespace to `_`, so `Kanban App.tsx` is a real
+    // canvas with a real document. Refusing it here would silently relocate a
+    // file that works today.
+    expect(check('ui/Kanban App.tsx', 'ui-kanban_app').ok).toBe(true);
+  });
+
+  it('is case-insensitive about the slug, like the slug transform', () => {
+    expect(check('ui/Card.tsx', 'UI-CARD').ok).toBe(true);
+  });
+});
+
+describe('validateCanvasPath — the traversal corpus', () => {
+  const corpus: Array<[string, unknown, string]> = [
+    ['parent traversal', '../../etc/passwd.tsx', 'anything'],
+    ['traversal inside a group', 'ui/../../../tmp/x.tsx', 'anything'],
+    ['a bare dot component', 'ui/./Card.tsx', 'ui-card'],
+    ['absolute posix', '/etc/cron.d/x.tsx', 'anything'],
+    ['windows drive', 'C:\\Windows\\x.tsx', 'anything'],
+    ['UNC share', '\\\\host\\share\\x.tsx', 'anything'],
+    ['a backslash smuggling a separator', 'ui\\..\\..\\x.tsx', 'anything'],
+    ['an empty component', 'ui//Card.tsx', 'ui-card'],
+    ['a trailing slash', 'ui/Card.tsx/', 'ui-card'],
+    ['a NUL byte', 'ui/Card.tsx\u0000.png', 'ui-card'],
+    ['a newline', 'ui/Ca\nrd.tsx', 'ui-card'],
+    ['percent-encoded traversal', 'ui/%2e%2e/%2e%2e/x.tsx', 'anything'],
+    ['a unicode dot lookalike as a component', 'ui/\u2024\u2024/x.tsx', 'anything'],
+    ['a bidi override in a component', 'ui/Ca\u202erd.tsx', 'ui-card'],
+    ['not a .tsx', 'ui/Card.html', 'ui-card'],
+    ['no extension at all', 'ui/Card', 'ui-card'],
+    ['an extra extension', 'ui/Card.tsx.png', 'ui-card'],
+    ['a dotfile', 'ui/.env.tsx', 'anything'],
+    ['at the design root, in no group', 'ui-card.tsx', 'ui-card'],
+    ['outside every declared group', 'assets/Card.tsx', 'assets-card'],
+    ['not a string', 42, 'anything'],
+    ['an object', { toString: () => 'ui/Card.tsx' }, 'ui-card'],
+    ['the empty string', '', 'anything'],
+  ];
+
+  for (const [label, path, slug] of corpus) {
+    it(`refuses ${label}`, () => {
+      const v = validateCanvasPath({ path, slug, designRel: '.design', canvasGroups: GROUPS });
+      expect(v.ok).toBe(false);
+    });
+  }
+
+  it('refuses a path longer than the cap', () => {
+    const long = `ui/${'a'.repeat(MAX_CANVAS_PATH_LEN)}.tsx`;
+    expect(validateCanvasPath({ path: long, slug: 'x', canvasGroups: GROUPS }).ok).toBe(false);
+  });
+});
+
+describe('rule 7 — a path that points elsewhere no longer addresses this document', () => {
+  it('refuses a well-formed path belonging to a DIFFERENT canvas', () => {
+    // The one that matters. Every rule above refuses a MALFORMED path; this
+    // refuses a perfectly legal one that simply is not this document's. Without
+    // it, any peer could overwrite any other canvas in the project by pushing a
+    // body under its own document name and someone else's path.
+    const v = check('ui/secrets/credentials.tsx', 'ui-card');
+    expect(v.ok).toBe(false);
+    if (!v.ok) expect(v.reason).toContain('slugs to');
+  });
+
+  it('refuses a path that only differs in a folder boundary', () => {
+    // `ui/a-b.tsx` and `ui/a/b.tsx` slug identically (`ui-a-b`) — so this pair
+    // is ACCEPTED by rule 7 on purpose: the collision is the slug's, it predates
+    // this feature, and `admitCanvases` already refuses to sync both files.
+    expect(check('ui/a/b.tsx', 'ui-a-b').ok).toBe(true);
+    expect(check('ui/a-b.tsx', 'ui-a-b').ok).toBe(true);
+    // What is NOT accepted is a path whose slug simply differs.
+    expect(check('ui/a/c.tsx', 'ui-a-b').ok).toBe(false);
+  });
+});
+
+describe('fallbackCanvasPath — visible, and still the same document', () => {
+  it('places an un-pathed canvas inside the group its slug came from', () => {
+    expect(fallbackCanvasPath('ui-legacy', GROUPS)).toBe('ui/legacy.tsx');
+  });
+
+  it('the result slugs BACK to the document — a fallback must not fork it', () => {
+    // The property, not the string. `ui/ui-legacy.tsx` would be visible and
+    // would slug to `ui-ui-legacy`: a second document syncing the same bytes,
+    // with the original orphaned on the hub.
+    for (const slug of ['ui-legacy', 'ui-2026-social-summer-camp', 'system-preview-logo']) {
+      expect(canvasSlugFromRel(fallbackCanvasPath(slug, GROUPS), '.design')).toBe(slug);
+    }
+  });
+
+  it('picks the group the slug actually came from, not the first one', () => {
+    const groups = [{ path: 'ui' }, { path: 'screens' }];
+    expect(fallbackCanvasPath('screens-x', groups)).toBe('screens/x.tsx');
+  });
+
+  it('prefers the LONGEST matching group over declaration order', () => {
+    const groups = [{ path: 'ui' }, { path: 'ui/social' }];
+    expect(fallbackCanvasPath('ui-social-x', groups)).toBe('ui/social/x.tsx');
+  });
+
+  it('keeps the design root when no declared group matches the slug', () => {
+    // Today's behaviour, deliberately: it is invisible, but it is the SAME
+    // document. A canvas that was outside every group at its author cannot be
+    // placed inside one without renaming it — which is what a path is for.
+    expect(fallbackCanvasPath('welcome', GROUPS)).toBe('welcome.tsx');
+    expect(fallbackCanvasPath('x', [])).toBe('x.tsx');
+  });
+
+  it('drops a group path that escapes the design root', () => {
+    expect(fallbackCanvasPath('etc-x', [{ path: '../../etc' }])).toBe('etc-x.tsx');
+  });
+
+  it('never produces a separator, a dotfile or a `..` from the slug', () => {
+    // The slug is charset-constrained upstream (`slugFromDocName`), so this is
+    // the second line rather than the first — but it is the line that stands
+    // between a bad slug and a directory of the sender's choosing.
+    for (const hostile of ['../../evil', '/etc/passwd', '..', '.', 'a\\b', '']) {
+      const rel = fallbackCanvasPath(hostile, GROUPS);
+      expect(rel).not.toContain('/');
+      expect(rel).not.toContain('\\');
+      expect(rel).not.toContain('..');
+      expect(rel.startsWith('.')).toBe(false);
+      expect(rel.endsWith('.tsx')).toBe(true);
+    }
+  });
+});
+
+describe('resolveCanvasBodyRel — one answer for "what does a refused path do"', () => {
+  it('uses the path when it validates', () => {
+    expect(
+      resolveCanvasBodyRel({
+        path: 'ui/2026/social/summer-camp.tsx',
+        slug: 'ui-2026-social-summer-camp',
+        designRel: '.design',
+        canvasGroups: GROUPS,
+      })
+    ).toEqual({ rel: 'ui/2026/social/summer-camp.tsx', fromPath: true });
+  });
+
+  it('falls back — never throws the canvas away — and says why', () => {
+    const reasons: string[] = [];
+    const out = resolveCanvasBodyRel({
+      path: '../../etc/passwd.tsx',
+      slug: 'ui-card',
+      canvasGroups: GROUPS,
+      onRefused: (r) => reasons.push(r),
+    });
+    expect(out).toEqual({ rel: 'ui/card.tsx', fromPath: false });
+    expect(reasons.length).toBe(1);
+  });
+
+  it('an ABSENT path is not a refusal — an older peer omits it', () => {
+    const reasons: string[] = [];
+    const out = resolveCanvasBodyRel({
+      path: undefined,
+      slug: 'ui-card',
+      canvasGroups: GROUPS,
+      onRefused: (r) => reasons.push(r),
+    });
+    expect(out).toEqual({ rel: 'ui/card.tsx', fromPath: false });
+    expect(reasons).toEqual([]);
+  });
+});

package/apps/studio/test/sync-connection-state.test.ts

@@ -61,6 +61,19 @@ describe('connection monitor', () => {
     expect(monitor.snapshot().state).toBe('online');
   });
 
+  test('the snapshot carries a stable startedAt — the clock a stall is measured against', () => {
+    const { clock, monitor } = makeMonitor();
+    const born = monitor.snapshot().startedAt;
+    expect(typeof born).toBe('number');
+    // It must NOT move with later emits — `updatedAt` does that job, and a
+    // rejection storm refreshing `updatedAt` forever is exactly why a second,
+    // fixed stamp exists.
+    clock.advance(60_000);
+    monitor.noteProviderStatus('p1', 'connecting');
+    expect(monitor.snapshot().startedAt).toBe(born);
+    expect(monitor.snapshot().updatedAt).toBeGreaterThan(born as number);
+  });
+
   test('a link nobody answers still escalates to offline', () => {
     // The seed change must not create a state that waits forever: a provider
     // that only ever reports 'connecting' has to reach the offline banner on

package/apps/studio/test/sync-hubs-config.test.ts

@@ -44,6 +44,11 @@ describe('normalizeUrl', () => {
   test('preserves non-root path case', () => {
     expect(normalizeUrl('https://Hub.example.com/Path')).toBe('https://hub.example.com/Path');
   });
+
+  test('rejects embedded credentials (claim-a hardening — user:pass@ survives toString)', () => {
+    expect(() => normalizeUrl('https://evil@proj.cloud.maude.sh')).toThrow(/embedded credentials/);
+    expect(() => normalizeUrl('https://u:p@proj.cloud.maude.sh')).toThrow(/embedded credentials/);
+  });
 });
 
 // Write the test hubs.json with mode 0600 so the DDR-054 §2h mode-warning

package/apps/studio/test/sync-migrate-flat-fallback.test.ts

@@ -0,0 +1,98 @@
+// Fix 4 of the 2026-08-10 sync RCA — the one-shot quarantine of pre-fix-5
+// flat fallback twins. The rules under test: a flat body moves ONLY when a
+// grouped twin of the same slug exists; siblings ride along; annotations stay
+// (they serve the surviving twin); a lone flat canvas is somebody's work and
+// never moves; a second run is a no-op; nothing ever throws into boot.
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { migrateFlatFallback } from '../sync/migrate-flat-fallback.ts';
+
+let designRoot: string;
+
+beforeEach(() => {
+  designRoot = mkdtempSync(join(tmpdir(), 'migrate-flat-'));
+});
+
+afterEach(() => {
+  rmSync(designRoot, { recursive: true, force: true });
+});
+
+const run = () => migrateFlatFallback({ designRoot, designRel: '.design', log: () => {} });
+
+describe('migrateFlatFallback — quarantine the redundant flat copy, never work', () => {
+  test('a collision pair: the flat copy (+ siblings) moves to _trash, the grouped twin stays', () => {
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui/welcome.tsx'), 'grouped\n');
+    writeFileSync(join(designRoot, 'ui-welcome.tsx'), 'flat stub\n');
+    writeFileSync(join(designRoot, 'ui-welcome.meta.json'), '{}\n');
+    writeFileSync(join(designRoot, 'ui-welcome.css'), '.x{}\n');
+    // Annotations are keyed by the flat slug and serve the SURVIVING twin.
+    writeFileSync(join(designRoot, 'ui-welcome.annotations.svg'), '<svg/>\n');
+
+    const moves = run();
+
+    expect(moves).toHaveLength(1);
+    expect(moves[0].slug).toBe('ui-welcome');
+    expect(moves[0].from).toBe('ui-welcome.tsx');
+    expect(moves[0].keptTwin).toBe('ui/welcome.tsx');
+
+    expect(existsSync(join(designRoot, 'ui/welcome.tsx'))).toBe(true);
+    expect(existsSync(join(designRoot, 'ui-welcome.tsx'))).toBe(false);
+    expect(existsSync(join(designRoot, 'ui-welcome.meta.json'))).toBe(false);
+    expect(existsSync(join(designRoot, 'ui-welcome.css'))).toBe(false);
+    expect(existsSync(join(designRoot, 'ui-welcome.annotations.svg'))).toBe(true);
+
+    const trashed = readdirSync(join(designRoot, moves[0].trashedTo)).sort();
+    expect(trashed).toEqual(['ui-welcome.css', 'ui-welcome.meta.json', 'ui-welcome.tsx']);
+  });
+
+  test('a lone flat canvas has no twin — it is somebody’s work and stays put', () => {
+    writeFileSync(join(designRoot, 'scratch-pad.tsx'), 'mine\n');
+    expect(run()).toEqual([]);
+    expect(existsSync(join(designRoot, 'scratch-pad.tsx'))).toBe(true);
+  });
+
+  test('a grouped file with no flat twin is untouched', () => {
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui/card.tsx'), 'x\n');
+    expect(run()).toEqual([]);
+    expect(existsSync(join(designRoot, 'ui/card.tsx'))).toBe(true);
+  });
+
+  test('the second run is a no-op — the quarantine dir is runtime state the scan skips', () => {
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui/welcome.tsx'), 'grouped\n');
+    writeFileSync(join(designRoot, 'ui-welcome.tsx'), 'flat stub\n');
+
+    expect(run()).toHaveLength(1);
+    expect(run()).toEqual([]);
+    // The quarantined copy is still there — moved, never deleted.
+    const trash = readdirSync(join(designRoot, '_trash'));
+    expect(trash).toHaveLength(1);
+  });
+
+  test('nested twins at any depth count', () => {
+    mkdirSync(join(designRoot, 'ui/2026/social'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui/2026/social/summer-camp.tsx'), 'deep\n');
+    writeFileSync(join(designRoot, 'ui-2026-social-summer-camp.tsx'), 'flat stub\n');
+
+    const moves = run();
+    expect(moves).toHaveLength(1);
+    expect(moves[0].keptTwin).toBe('ui/2026/social/summer-camp.tsx');
+    expect(existsSync(join(designRoot, 'ui/2026/social/summer-camp.tsx'))).toBe(true);
+  });
+
+  test('a missing design root is a quiet no-op, not a throw', () => {
+    expect(
+      migrateFlatFallback({
+        designRoot: join(designRoot, 'does-not-exist'),
+        designRel: '.design',
+        log: () => {},
+      })
+    ).toEqual([]);
+  });
+});