@1agh/maude 0.58.3 → 0.60.0

package/apps/studio/test/sync-asset-sweep.test.ts

@@ -0,0 +1,243 @@
+// The PARENT half of the out-of-process asset sweep.
+//
+// The child's own contract is `sync-asset-push-worker.test.ts`; here the child
+// is a stand-in script, because what needs pinning is the parent's behaviour
+// when that child misbehaves — and a real sweep cannot be made to segfault on
+// demand. Every case below is a way the sweep can end, and the property under
+// test is the same one each time: the parent always produces a FINAL emit, so
+// the panel can never sit at "92 of 182" forever.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { AssetPushProgress } from '../sync/asset-push.ts';
+import { assetWorkerScript, runAssetSweep } from '../sync/asset-sweep.ts';
+
+const dirs: string[] = [];
+
+/** Write a stand-in child and return its path. */
+function fakeChild(body: string): string {
+  const dir = mkdtempSync(join(tmpdir(), 'sweep-parent-'));
+  dirs.push(dir);
+  const p = join(dir, 'child.ts');
+  writeFileSync(p, body);
+  return p;
+}
+
+function progressLine(over: Partial<AssetPushProgress> = {}): string {
+  const base = {
+    t: 'progress',
+    total: 3,
+    done: 1,
+    pushed: 1,
+    skipped: 0,
+    failedCount: 0,
+    failures: [],
+    active: 'system/ds/assets/logos/a.svg',
+    finished: false,
+  };
+  return JSON.stringify({ ...base, ...over });
+}
+
+function sweep(script: string, onProgress: (p: AssetPushProgress) => void) {
+  const designRoot = mkdtempSync(join(tmpdir(), 'sweep-root-'));
+  dirs.push(designRoot);
+  return runAssetSweep({
+    designRoot,
+    hubUrl: 'https://hub.example',
+    token: () => 'secret-token',
+    onProgress,
+    script,
+    log: { log: () => {}, warn: () => {} },
+  });
+}
+
+describe('a sweep that finishes', () => {
+  test('progress reaches the panel and the result comes back', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(${JSON.stringify(`${progressLine()}\n`)});
+      process.stdout.write(${JSON.stringify(`${progressLine({ done: 3, pushed: 3, active: null, finished: true })}\n`)});
+      process.stdout.write(JSON.stringify({ t: 'result', pushed: ['a', 'b', 'c'], skipped: 0, failed: [] }) + '\\n');
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toEqual({ pushed: ['a', 'b', 'c'], skipped: 0, failed: [] });
+    expect(seen.length).toBe(2);
+    expect(seen[1].finished).toBe(true);
+  });
+
+  test('unparseable output is dropped, not fatal', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write('a stray console.log from an import\\n');
+      process.stdout.write(${JSON.stringify(`${progressLine()}\n`)});
+      process.stdout.write('{ half a li');
+      process.stdout.write('ne }\\n');
+      process.stdout.write(JSON.stringify({ t: 'result', pushed: [], skipped: 1, failed: [] }) + '\\n');
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toEqual({ pushed: [], skipped: 1, failed: [] });
+    expect(seen.length).toBe(1);
+  });
+});
+
+describe('a sweep that dies is a REPORTED failure, never a stall', () => {
+  test('a signalled child names the signal in the final emit', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(${JSON.stringify(`${progressLine({ done: 92, total: 182, pushed: 92 })}\n`)});
+      await Bun.sleep(20);
+      process.kill(process.pid, 'SIGKILL');
+      await new Promise(() => {});
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toBeNull();
+    const final = seen[seen.length - 1];
+    expect(final.finished).toBe(true);
+    // The counts it got to are KEPT — the person is told where it stopped.
+    expect(final.done).toBe(92);
+    expect(final.total).toBe(182);
+    expect(final.failedCount).toBe(1);
+    expect(final.failures[0].reason).toContain('SIGKILL');
+    expect(final.active).toBeNull();
+  });
+
+  test('a child that reports an error carries the message through', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(JSON.stringify({ t: 'error', message: 'the design root vanished' }) + '\\n');
+      process.exit(1);
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toBeNull();
+    expect(seen[seen.length - 1].failures[0].reason).toContain('the design root vanished');
+  });
+
+  test('a missing worker script is reported — never a silent in-process fallback', async () => {
+    const seen: AssetPushProgress[] = [];
+    const result = await sweep(join(tmpdir(), 'no-such-worker-xyz.ts'), (p) => seen.push(p)).done;
+
+    expect(result).toBeNull();
+    expect(seen.length).toBe(1);
+    expect(seen[0].finished).toBe(true);
+    expect(seen[0].failedCount).toBe(1);
+  });
+
+  test('a result line with a non-zero exit is NOT trusted as success', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(JSON.stringify({ t: 'result', pushed: ['a'], skipped: 0, failed: [] }) + '\\n');
+      process.exit(3);
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toBeNull();
+    expect(seen[seen.length - 1].failures[0].reason).toContain('3');
+  });
+});
+
+describe('cancel ends the sweep, and says that is what happened', () => {
+  test('a wedged child is killed and the lane closes as cancelled', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(${JSON.stringify(`${progressLine()}\n`)});
+      await new Promise(() => {});
+    `);
+    const handle = sweep(child, (p) => seen.push(p));
+    // Wait for the first emit so the child is definitely alive — BOUNDED, so a
+    // machine that cannot spawn fails this test instead of hanging the suite.
+    for (let i = 0; seen.length === 0 && i < 500; i++) await Bun.sleep(10);
+    expect(seen.length).toBeGreaterThan(0);
+    handle.cancel();
+    const result = await handle.done;
+
+    expect(result).toBeNull();
+    const final = seen[seen.length - 1];
+    expect(final.finished).toBe(true);
+    expect(final.failures[0].reason).toBe('cancelled');
+  });
+
+  test('cancel is idempotent and safe after the sweep already ended', async () => {
+    const child = fakeChild(
+      `process.stdout.write(JSON.stringify({ t: 'result', pushed: [], skipped: 0, failed: [] }) + '\\n');`
+    );
+    const handle = sweep(child, () => {});
+    await handle.done;
+    expect(() => {
+      handle.cancel();
+      handle.cancel();
+    }).not.toThrow();
+  });
+});
+
+describe('the credential never touches argv', () => {
+  test('the token goes to a 0600 file that is gone when the sweep ends', async () => {
+    let sawArgv = '';
+    let sawToken = '';
+    let sawMode = '';
+    const child = fakeChild(`
+      const { readFileSync, statSync } = await import('node:fs');
+      const tokenFile = process.argv[4];
+      process.stdout.write(JSON.stringify({
+        t: 'result', pushed: [], skipped: 0,
+        failed: [
+          { key: 'argv', reason: process.argv.slice(2).join(' ') },
+          { key: 'token', reason: readFileSync(tokenFile, 'utf8') },
+          { key: 'mode', reason: (statSync(tokenFile).mode & 0o777).toString(8) },
+          { key: 'file', reason: tokenFile },
+        ],
+      }) + '\\n');
+    `);
+    const result = await sweep(child, () => {});
+    const failed = (await result.done)?.failed ?? [];
+    sawArgv = failed.find((f) => f.key === 'argv')?.reason ?? '';
+    sawToken = failed.find((f) => f.key === 'token')?.reason ?? '';
+    sawMode = failed.find((f) => f.key === 'mode')?.reason ?? '';
+    const tokenFile = failed.find((f) => f.key === 'file')?.reason ?? '';
+
+    expect(sawToken).toBe('secret-token');
+    // `ps` shows argv to every user on the machine.
+    expect(sawArgv).not.toContain('secret-token');
+    expect(sawMode).toBe('600');
+    expect(existsSync(tokenFile)).toBe(false);
+  });
+});
+
+describe('the credential stays current across the boundary', () => {
+  test('the token file is written atomically — the child can never read half of it', async () => {
+    // The child re-reads this file per request; a plain overwrite is observable
+    // half-done, and half a bearer token is a 401 on every remaining upload.
+    const src = readFileSync(join(import.meta.dir, '..', 'sync', 'asset-sweep.ts'), 'utf8');
+    expect(src).toContain('renameSync(tmp, tokenFile)');
+    // And the parent keeps it current: a renewal mid-sweep must reach the child,
+    // which is why `token` is a GETTER and not the string it resolved to.
+    expect(src).toMatch(/token: \(\) => string/);
+    expect(src).toMatch(/setInterval\(/);
+  });
+});
+
+describe('the worker ships where the server can find it', () => {
+  test('the resolved script is a real file on disk (DDR-045, not a bunfs path)', () => {
+    const script = assetWorkerScript();
+    expect(script.endsWith(join('sync', 'asset-push-worker.ts'))).toBe(true);
+    expect(existsSync(script)).toBe(true);
+  });
+});
+
+// Temp roots outlive individual tests (the token-file case reads one back), so
+// they are swept once at the end rather than per-test.
+process.on('exit', () => {
+  for (const d of dirs) {
+    try {
+      if (existsSync(d) && readdirSync(d)) rmSync(d, { recursive: true, force: true });
+    } catch {
+      /* best-effort */
+    }
+  }
+});

package/apps/studio/test/sync-connection-state.test.ts

@@ -269,3 +269,69 @@ describe('what this run pulled down', () => {
     expect(pulled?.count).toBe(50);
   });
 });
+
+describe('per-item list (feature-sync-progress-modal)', () => {
+  test('items carries every doc with its state, actionable states first', () => {
+    const { monitor } = makeMonitor();
+    monitor.noteDocState('ui-a', 'connected');
+    monitor.noteDocState('ui-b', 'pending');
+    monitor.noteDocState('ui-c', 'auth-rejected', 'not-authorized');
+    const items = monitor.snapshot().items;
+    expect(items).toEqual([
+      { slug: 'ui-c', state: 'auth-rejected', reason: 'not-authorized' },
+      { slug: 'ui-b', state: 'pending' },
+      { slug: 'ui-a', state: 'connected' },
+    ]);
+  });
+
+  test('a recovered doc drops its stale reason', () => {
+    const { monitor } = makeMonitor();
+    monitor.noteDocState('ui-a', 'auth-rejected', 'invalid-token');
+    monitor.noteDocState('ui-a', 'connected');
+    expect(monitor.snapshot().items).toEqual([{ slug: 'ui-a', state: 'connected' }]);
+  });
+
+  test('the reason is LATCHED per rejection episode — reason flips never emit', () => {
+    // The rejection text is hub-controlled. If a reason change emitted, a hub
+    // alternating messages on an open socket would force a full emit (items
+    // rebuild + synchronous _sync.json write + WS fanout) per frame — the
+    // amplification the security review flagged (2026-08-11). Repeat frames
+    // for an already-rejected doc must stay a no-op, whatever their text.
+    const { monitor, changes } = makeMonitor();
+    monitor.noteDocState('ui-a', 'auth-rejected', 'rate-limit');
+    const emitted = changes.length;
+    monitor.noteDocState('ui-a', 'auth-rejected', 'invalid-token');
+    monitor.noteDocState('ui-a', 'auth-rejected', 'invalid-token');
+    expect(changes.length).toBe(emitted);
+    expect(monitor.snapshot().items?.[0]?.reason).toBe('rate-limit');
+    // A NEW episode (re-probe cleared the state) records a fresh reason.
+    monitor.noteDocState('ui-a', 'pending');
+    monitor.noteDocState('ui-a', 'auth-rejected', 'invalid-token');
+    expect(monitor.snapshot().items?.[0]?.reason).toBe('invalid-token');
+  });
+
+  test('the cap truncates only the connected tail, and itemsTruncated says how much', () => {
+    const { monitor } = makeMonitor();
+    // 210 connected + 1 rejected + 1 pending: the interesting rows must
+    // survive the 200-row cap; the dropped tail is all `connected`.
+    for (let i = 0; i < 210; i++) monitor.noteDocState(`ui-ok-${i}`, 'connected');
+    monitor.noteDocState('ui-refused', 'auth-rejected', 'generic');
+    monitor.noteDocState('ui-waiting', 'pending');
+    const snap = monitor.snapshot();
+    expect(snap.items).toHaveLength(200);
+    expect(snap.itemsTruncated).toBe(12);
+    expect(snap.items?.[0]).toEqual({
+      slug: 'ui-refused',
+      state: 'auth-rejected',
+      reason: 'generic',
+    });
+    expect(snap.items?.[1]).toEqual({ slug: 'ui-waiting', state: 'pending' });
+    expect(snap.items?.slice(2).every((i) => i.state === 'connected')).toBe(true);
+  });
+
+  test('under the cap, itemsTruncated is absent (additive-payload hygiene)', () => {
+    const { monitor } = makeMonitor();
+    monitor.noteDocState('ui-a', 'connected');
+    expect(monitor.snapshot().itemsTruncated).toBeUndefined();
+  });
+});

package/apps/studio/test/sync-panel-surface.test.ts

@@ -0,0 +1,123 @@
+// feature-sync-progress-modal — the Sync panel + HUB SYNC chip surface.
+//
+// Source-level assertions (cloud-shell-surfaces style): what these pin is
+// exactly what would regress — someone dropping the linked-only gate (a solo
+// project would get a dock tab that opens onto nothing), rewiring the chip
+// away from the dock helpers (breaking the one-panel-per-side invariant), or
+// the panel inventing sync vocabulary / dropping the a11y live region the
+// CloudBar note established.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const STUDIO = join(import.meta.dir, '..');
+const APP = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
+const PANEL = readFileSync(join(STUDIO, 'client', 'panels', 'SyncPanel.jsx'), 'utf8');
+
+describe('the Sync panel exists only where a hub link exists', () => {
+  test('sync is a dock panel with a right-side default', () => {
+    expect(APP).toContain("{ id: 'sync', label: 'Sync' }");
+    expect(APP).toMatch(/sync: 'right'/);
+  });
+
+  test('panelAvailable gates sync on a live syncStatus — solo projects get no tab', () => {
+    expect(APP).toContain("if (id === 'sync') return !!syncStatus;");
+  });
+
+  test('the chip toggles through the dock helpers, not a raw setState', () => {
+    // toggleRightPanel keeps the one-panel-per-side invariant; a bare
+    // setSyncPanelOpen(true) here would let Sync render behind an open sibling.
+    expect(APP).toMatch(/onOpenSync=\{syncStatus \? \(\) => toggleRightPanel\('sync'\)/);
+  });
+
+  test('the chip is a real button with pressed-state semantics', () => {
+    expect(APP).toContain('data-testid="open-sync"');
+    expect(APP).toMatch(/aria-pressed=\{syncOpen\}/);
+  });
+
+  test('the span fallback remains for sessions without a handler', () => {
+    // Older wiring / no-handler renders must keep the passive chip rather
+    // than a dead button.
+    expect(APP).toMatch(/onOpenSync \? \(/);
+  });
+});
+
+describe('the Sync panel speaks the presentation vocabulary, safely', () => {
+  test('the header sentence comes from syncPresentation — the one shared rule', () => {
+    expect(PANEL).toContain("from '../../sync/presentation.ts'");
+    expect(PANEL).toContain('syncPresentation(status');
+  });
+
+  test('rows map DocSyncState onto existing words, never new ones', () => {
+    expect(PANEL).toMatch(/pending: 'syncing'/);
+    expect(PANEL).toMatch(/connected: 'synced'/);
+    expect(PANEL).toMatch(/'auth-rejected': 'refused'/);
+  });
+
+  test('every name that reaches the DOM goes through safeName', () => {
+    // Slugs and asset keys are local, but the payload is read back off disk —
+    // bounded text-only rendering is the house rule (DDR-054).
+    expect(PANEL).toContain('import { safeDetail, safeName, syncPresentation }');
+    expect(PANEL).not.toMatch(/dangerouslySetInnerHTML/);
+  });
+
+  test('the live header is a polite status region (the CloudBar a11y pattern)', () => {
+    expect(PANEL).toMatch(/role="status" aria-live="polite"/);
+  });
+
+  test('the asset lane renders from the payload, with the retry promise', () => {
+    expect(PANEL).toContain('data-testid="sync-assets"');
+    expect(PANEL).toContain('retry on the next launch');
+  });
+});
+
+describe('the panel reads the off-disk payload fail-closed (DDR-102 discipline)', () => {
+  test('items, assets and the header counts all pass a readCounts-style gate', () => {
+    // `_sync.json` is JSON.parse with no schema — a partial write or older
+    // producer must degrade to "nothing to show", never crash or print NaN
+    // (security review 2026-08-11, defender W1).
+    expect(PANEL).toContain('function readItems(');
+    expect(PANEL).toContain('function readAssets(');
+    expect(PANEL).toContain('readItems(status?.items)');
+    expect(PANEL).toContain('readAssets(status?.assets)');
+    expect(PANEL).toMatch(/Number\.isInteger/);
+    // The header chip validates the same counts the note fails closed on.
+    expect(PANEL).toMatch(
+      /\[rawDocs\.synced, rawDocs\.pending, rawDocs\.rejected\]\.every\(isCount\)/
+    );
+  });
+});
+
+// feature-sync-resync-and-out-of-process-sweep — the panel gained the one
+// control the whole feature exists for. What is pinned here is not that a
+// button renders, but the three properties that make it safe to press: it
+// re-runs the WHOLE sync (not just assets), it cannot be spammed, and cancel
+// reaches only the sweep.
+describe('the Resync control', () => {
+  test('it calls the whole-sync route, not an asset-only one', () => {
+    expect(PANEL).toContain("fetch('/_api/sync/resync'");
+    expect(PANEL).toContain('data-testid="sync-resync"');
+  });
+
+  test('it disables itself while running AND during the cooldown', () => {
+    // A resync re-authenticates every document against the DDR-102 600/min
+    // bucket; without the cooldown an impatient person pins their own hub.
+    expect(PANEL).toContain('disabled={resyncing || cooling}');
+    expect(PANEL).toMatch(/RESYNC_COOLDOWN_MS = [\d_]+/);
+  });
+
+  test('a 409 reads as "already restarting", never as a failure', () => {
+    expect(PANEL).toMatch(/res\.status === 409/);
+  });
+
+  test('cancel is scoped to the sweep and only offered while one runs', () => {
+    expect(PANEL).toContain("fetch('/_api/sync/cancel-assets'");
+    expect(PANEL).toContain('data-testid="sync-assets-cancel"');
+    expect(PANEL).toMatch(/!assets\.finished && \(/);
+  });
+
+  test('the note is sanitized too — server detail is still bounded text', () => {
+    expect(PANEL).toContain("safeDetail(note, '')");
+  });
+});

package/apps/studio/test/sync-resync-routes.test.ts

@@ -0,0 +1,125 @@
+// `/_api/sync/resync` + `/_api/sync/cancel-assets` — the MAIN-origin half.
+//
+// `canvas-origin-gate.test.ts` already asserts both routes are unreachable from
+// the segregated canvas origin. That alone proves the wrong property: the main
+// origin is reachable from any website the user happens to visit while the dev
+// server is up. A cross-site POST that lands here would re-authenticate every
+// document against the person's own hub and re-run a whole-project upload — an
+// amplification primitive against their own DDR-102 rate-limit budget, with an
+// opaque response and a very real side effect.
+//
+// So this file asserts the complementary half — the same posture the Figma
+// routes carry (DDR-216 D3): cross-origin write → 403, foreign Host → 403,
+// wrong method → 405. Both halves are required; neither is sufficient.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import type { Subprocess } from 'bun';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+const HTTP = readFileSync(join(import.meta.dir, '..', 'http.ts'), 'utf8');
+
+let proc: Subprocess;
+let base: string;
+
+const ROUTES = ['/_api/sync/resync', '/_api/sync/cancel-assets'];
+
+beforeAll(async () => {
+  const { root } = makeSandbox();
+  const port = nextPort();
+  base = `http://localhost:${port}`;
+  proc = await bootServer(root, port);
+});
+
+afterAll(async () => {
+  await killProc(proc);
+});
+
+describe('cross-origin writes are refused (the CSRF guard)', () => {
+  for (const route of ROUTES) {
+    test(`POST ${route} from another origin is 403`, async () => {
+      const res = await fetch(`${base}${route}`, {
+        method: 'POST',
+        headers: { Origin: 'https://evil.example' },
+      });
+      expect(res.status).toBe(403);
+    });
+
+    test(`a CORS-simple POST to ${route} is still refused`, async () => {
+      // No preflight, unreadable response — but the side effect would land.
+      const res = await fetch(`${base}${route}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'text/plain', Origin: 'https://evil.example' },
+        body: '{}',
+      });
+      expect(res.status).toBe(403);
+    });
+  }
+});
+
+describe('a foreign Host header is refused (the DNS-rebinding guard)', () => {
+  for (const route of ROUTES) {
+    test(`POST ${route} with a rebinding Host is 403`, async () => {
+      const res = await fetch(`${base}${route}`, {
+        method: 'POST',
+        headers: { Host: 'sync.127.0.0.1.nip.io' },
+      });
+      expect(res.status).toBe(403);
+    });
+  }
+});
+
+describe('method gating', () => {
+  for (const route of ROUTES) {
+    test(`GET ${route} is 405 — resync is a write`, async () => {
+      expect((await fetch(`${base}${route}`)).status).toBe(405);
+    });
+  }
+});
+
+// Source-level, because these two properties only show up on a LINKED project
+// with a live hub — a state a booted sandbox cannot reach — and they are
+// exactly the two that would be silently wrong.
+describe('the route is wired to the whole-sync restart, and refuses rather than queues', () => {
+  test('restart() is called with NO argument — this route can never unlink', () => {
+    // `restart(null)` is the DETACH lane: it clears the in-memory link and
+    // cycles to solo. A resync that passed a falsy value through would
+    // disconnect the person's project instead of re-checking it.
+    expect(HTTP).toContain('const sync = await control.restart();');
+    expect(HTTP).not.toMatch(/sync\/resync[\s\S]{0,900}restart\(null\)/);
+  });
+
+  test('a cycle in flight is a 409, not a second full re-link', () => {
+    expect(HTTP).toMatch(/control\.busy\?\.\(\)/);
+    expect(HTTP).toMatch(/status: 409[\s\S]{0,120}'busy'/);
+  });
+
+  test('cancel reaches the sweep through the live runtime, not the supervisor', () => {
+    expect(HTTP).toContain('ctx.syncControl?.current?.()?.cancelAssetSweep() ?? false');
+  });
+});
+
+describe('same-origin behaviour on an unlinked project', () => {
+  test('resync answers honestly rather than pretending it synced', async () => {
+    // The sandbox project has no linkedHub, so the supervisor is present but
+    // declines. The panel hides the control in this state; the ROUTE still has
+    // to give a truthful answer to anything that reaches it.
+    const res = await fetch(`${base}/_api/sync/resync`, { method: 'POST' });
+    expect(res.status).toBe(200);
+    const json = (await res.json()) as {
+      ok: boolean;
+      sync?: { syncing: boolean; reason?: string };
+    };
+    expect(json.ok).toBe(true);
+    expect(json.sync?.syncing).toBe(false);
+    expect(json.sync?.reason).toBe('unlinked');
+  });
+
+  test('cancelling with no sweep in flight says so instead of erroring', async () => {
+    const res = await fetch(`${base}/_api/sync/cancel-assets`, { method: 'POST' });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true, cancelled: false });
+  });
+});

package/apps/studio/test/sync-status.test.ts

@@ -144,3 +144,31 @@ describe('sync status store — DDR-102 additive fields', () => {
     expect(p.state).toBe('online');
   });
 });
+
+describe('sync status store — asset lane (feature-sync-progress-modal)', () => {
+  test('updateAssets() merges progress into the payload + flushes', () => {
+    const { store, writes, broadcasts } = makeStore();
+    const progress = {
+      total: 10,
+      done: 4,
+      pushed: 3,
+      skipped: 1,
+      failedCount: 0,
+      failures: [],
+      active: 'assets/hero.png',
+      finished: false,
+    };
+    store.updateAssets(progress);
+    expect(writes[writes.length - 1].assets).toEqual(progress);
+    expect(broadcasts[broadcasts.length - 1].assets).toEqual(progress);
+    // …and a later monitor update keeps the asset lane (separate slices).
+    store.update(snap({ state: 'online' }));
+    expect(store.get().assets).toEqual(progress);
+  });
+
+  test('payloads before the first asset emit carry no assets field', () => {
+    const { store } = makeStore();
+    store.update(snap());
+    expect('assets' in store.get()).toBe(false);
+  });
+});

package/apps/studio/test/sync-supervisor.test.ts

@@ -77,6 +77,7 @@ function fakeRuntime(log: string[], id: string, size = 3): SyncRuntime {
     size: () => size,
     agentFor: () => undefined,
     status: () => null,
+    cancelAssetSweep: () => false,
   };
 }
 
@@ -188,6 +189,50 @@ describe('createSyncSupervisor', () => {
     rmSync(ctx.paths.repoRoot, { recursive: true, force: true });
   });
 
+  // feature-sync-resync-and-out-of-process-sweep — `busy()` is what lets the
+  // Resync route answer 409 instead of quietly queueing a second full re-link
+  // of every canvas. It reports the chain; it must never BE the chain.
+  test('busy() reports a cycle in flight and clears when it settles', async () => {
+    const ctx = makeCtx({ url: 'https://hub.example', linkedAt: 1 });
+    let release: () => void = () => {};
+    const held = new Promise<void>((r) => {
+      release = r;
+    });
+    const sup = createSyncSupervisor(ctx, {}, () => ({
+      start: () => held,
+      stop: async () => {},
+      size: () => 1,
+      agentFor: () => undefined,
+      status: () => null,
+      cancelAssetSweep: () => false,
+    }));
+
+    expect(sup.busy()).toBe(false);
+    const cycle = sup.start();
+    expect(sup.busy()).toBe(true);
+    release();
+    await cycle;
+    expect(sup.busy()).toBe(false);
+    rmSync(ctx.paths.repoRoot, { recursive: true, force: true });
+  });
+
+  test('busy() clears after a cycle that THREW — Resync never wedges shut', async () => {
+    const ctx = makeCtx({ url: 'https://hub.example', linkedAt: 1 });
+    const sup = createSyncSupervisor(ctx, {}, () => ({
+      start: async () => {
+        throw new Error('nope');
+      },
+      stop: async () => {},
+      size: () => 0,
+      agentFor: () => undefined,
+      status: () => null,
+      cancelAssetSweep: () => false,
+    }));
+    await sup.start();
+    expect(sup.busy()).toBe(false);
+    rmSync(ctx.paths.repoRoot, { recursive: true, force: true });
+  });
+
   test('a throwing start leaves the server up and answers with the reason', async () => {
     const ctx = makeCtx({ url: 'https://hub.example', linkedAt: 1 });
     const sup = createSyncSupervisor(ctx, {}, () => ({
@@ -198,6 +243,7 @@ describe('createSyncSupervisor', () => {
       size: () => 0,
       agentFor: () => undefined,
       status: () => null,
+      cancelAssetSweep: () => false,
     }));
     const out = await sup.start();
     expect(out.syncing).toBe(false);