@1agh/maude 0.60.3 → 0.60.4

package/apps/studio/test/cloud-managed-save-surfaces.test.ts

@@ -0,0 +1,90 @@
+// DDR-218's withdrawal, applied to EVERY surface that reports a save state.
+//
+// The decision withdrew the working-tree half of the Changes surface whenever
+// somebody else commits this project — a cloud cell (`historyOnly`, `cfg.cloud`)
+// or the cell behind a linked+credentialed desktop repo (`cloudManaged`). It
+// landed in GitPanel only. `app.jsx` went on computing the dirty count a second
+// time, ungated, and handing it to the toolbar menu and the status-bar chip, so
+// both shells kept rendering "N unsaved" — the exact claim the withdrawal exists
+// to delete. Reported again 2026-08-14 ("89 unsaved changes on the cloud, 36 on
+// the desktop"), which is what these assertions are here to stop.
+//
+// Source-level (sync-panel-surface style): what they pin is what would regress —
+// someone re-deriving the posture at a call site, or adding a THIRD surface that
+// reads `gitStatus.files.length` directly.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const STUDIO = join(import.meta.dir, '..');
+const APP = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
+const PANEL = readFileSync(join(STUDIO, 'client', 'panels', 'GitPanel.jsx'), 'utf8');
+
+describe('one expression owns "who is saving this project"', () => {
+  test('both postures are named once, at the top level', () => {
+    expect(APP).toContain('const cellManaged = !!cfg.cloud;');
+    expect(APP).toContain('const cloudManaged = !cfg.cloud && !!cloudLinkedHub?.credentialed;');
+    expect(APP).toContain('const savingIsManaged = cellManaged || cloudManaged;');
+  });
+
+  test('the GitPanel call site consumes those names rather than re-deriving them', () => {
+    // Re-deriving is how the two halves drift apart in the first place.
+    expect(APP).toContain('historyOnly={cellManaged}');
+    expect(APP).toContain('cloudManaged={cloudManaged}');
+  });
+});
+
+describe('the dirty COUNT is withheld wherever saving is managed', () => {
+  test('unsavedCount is gated, not raw', () => {
+    expect(APP).toContain(
+      'const unsavedCount = savingIsManaged ? 0 : gitStatus?.files?.length || 0;'
+    );
+  });
+
+  test('no surface reads the raw file count for display', () => {
+    // Exactly one `gitStatus?.files?.length` may exist, and it is the gated one
+    // above. A second occurrence is a new leak by construction.
+    const raw = APP.match(/gitStatus\?\.files\?\.length/g) ?? [];
+    expect(raw.length).toBe(1);
+  });
+
+  test('every changesCount consumer is fed the gated value', () => {
+    const feeds = APP.match(/changesCount=\{[^}]+\}/g) ?? [];
+    expect(feeds.length).toBeGreaterThan(0);
+    for (const feed of feeds) expect(feed).toBe('changesCount={unsavedCount}');
+  });
+});
+
+describe('the status-bar chip names the mechanism instead of a count', () => {
+  test('it receives the posture', () => {
+    expect(APP).toContain('savingIsManaged={savingIsManaged}');
+    expect(APP).toMatch(/savingIsManaged = false,/);
+  });
+
+  test('managed saving short-circuits the whole unsaved / to-publish ladder', () => {
+    expect(APP).toMatch(/\{savingIsManaged\s*\?/);
+    expect(APP).toContain("'cloud saving'");
+  });
+
+  test('"N to publish" is withheld too — Publish is withdrawn in that posture', () => {
+    // A gated count alone would fall through to the unpushed branch, which is
+    // the same local-git offer wearing a different label.
+    expect(APP).toContain('unpushed={savingIsManaged ? 0 : gitStatus?.unpushed || 0}');
+  });
+});
+
+describe('the panel half of DDR-218 is still intact', () => {
+  test('withdrawal covers both postures', () => {
+    expect(PANEL).toContain('const withdrawn = historyOnly || cloudManaged;');
+  });
+
+  test('the panel badge stays gated on it', () => {
+    expect(PANEL).toMatch(/!withdrawn && count > 0/);
+  });
+
+  test('the cloud-managed note keeps its testid and names the live mechanism', () => {
+    expect(PANEL).toContain('data-testid="git-cloud-managed"');
+    expect(PANEL).toMatch(/Cloud is saving/);
+  });
+});

package/apps/studio/test/exporters/jobs.test.ts

@@ -53,7 +53,11 @@ describe('exporters/jobs — concurrency gate', () => {
       let sawThirdQueued = false;
       let maxRunningObserved = 0;
       let allDone = false;
-      const deadline = Date.now() + 4000;
+      // Generous: the assertion below is "the queue drains at all", not "it
+      // drains fast". The budget only has to outlast DEFLATE over the seeded
+      // sandbox on the slowest machine we run on — a budget tuned to one
+      // machine's disk speed fails there while the queue is working fine.
+      const deadline = Date.now() + 20_000;
       while (Date.now() < deadline && !allDone) {
         const jobs = await listJobs(port);
         const byId = new Map(jobs.map((j) => [j.id, j]));
@@ -74,7 +78,7 @@ describe('exporters/jobs — concurrency gate', () => {
     } finally {
       await killProc(proc);
     }
-  });
+  }, 30_000);
 });
 
 describe('exporters/jobs — pending-queue cap (security fan-out, /flow:done)', () => {
@@ -109,7 +113,9 @@ describe('exporters/jobs — pending-queue cap (security fan-out, /flow:done)',
       // Once jobs drain below the cap, enqueue works again — this is a
       // capacity limit, not a permanent lockout.
       let drained = false;
-      const deadline = Date.now() + 5000;
+      // Same reasoning as the concurrency gate above — budget for the slowest
+      // machine, since what's under test is that the cap lifts, not latency.
+      const deadline = Date.now() + 20_000;
       while (Date.now() < deadline && !drained) {
         const jobs = await listJobs(port);
         drained = jobs.every((j) => j.status === 'done' || j.status === 'failed');
@@ -121,7 +127,7 @@ describe('exporters/jobs — pending-queue cap (security fan-out, /flow:done)',
     } finally {
       await killProc(proc);
     }
-  });
+  }, 30_000);
 });
 
 describe('exporters/jobs — list() + history under concurrency', () => {

package/apps/studio/test/git-cloud-posture.test.ts

@@ -37,8 +37,17 @@ describe('a cloud-linked repo shows ONE save mechanism (DDR-218)', () => {
   });
 
   test('the app gate is the CORROBORATED link, and the cell posture is untouched', () => {
-    expect(APP).toContain('cloudManaged={!cfg.cloud && !!cloudLinkedHub?.credentialed}');
-    expect(APP).toContain('historyOnly={!!cfg.cloud}');
+    // Hoisted to a single top-level definition (2026-08-14) so the toolbar and
+    // status bar read the SAME posture the panel does — see
+    // cloud-managed-save-surfaces.test.ts. The gate itself is unchanged, and
+    // `credentialed` is the load-bearing half: config.json alone is
+    // attacker-authorable (B2), so a link claim without corroboration must
+    // never reach this posture.
+    expect(APP).toContain('const cloudManaged = !cfg.cloud && !!cloudLinkedHub?.credentialed;');
+    expect(APP).toContain('const cellManaged = !!cfg.cloud;');
+    // …and the panel is fed from those names, not a re-derivation.
+    expect(APP).toContain('cloudManaged={cloudManaged}');
+    expect(APP).toContain('historyOnly={cellManaged}');
   });
 
   test('CloudBar lifts every link change the posture depends on', () => {

package/apps/studio/test/sync-asset-pull.test.ts

@@ -0,0 +1,161 @@
+// The downward asset lane — see sync/asset-pull.ts.
+//
+// Regression cover for the reported "obrázky v annotations se nevykreslí":
+// `<slug>.annotations.svg` synced, its `assets/<sha8>.png` did not, and the
+// canvas rendered a broken-image glyph on every peer but the one that made it.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
+
+import { pullAssets, referencedAssets } from '../sync/asset-pull.ts';
+
+function project(files: Record<string, string>): string {
+  const root = mkdtempSync(path.join(tmpdir(), 'maude-asset-pull-'));
+  for (const [rel, body] of Object.entries(files)) {
+    const abs = path.join(root, rel);
+    mkdirSync(path.dirname(abs), { recursive: true });
+    writeFileSync(abs, body);
+  }
+  return root;
+}
+
+const annotation = (name: string) =>
+  `<svg xmlns="http://www.w3.org/2000/svg"><image data-tool="image" href="assets/${name}"/></svg>`;
+
+/** A hub that serves every asset as three bytes. */
+const servingFetch = (seen: string[] = []) =>
+  (async (url: string) => {
+    seen.push(String(url));
+    return new Response(new Uint8Array([1, 2, 3]), { status: 200 });
+  }) as unknown as typeof fetch;
+
+describe('referencedAssets', () => {
+  test('finds the image an annotation references', () => {
+    const root = project({ 'ui-board.annotations.svg': annotation('c0fa9c7f.png') });
+    expect(referencedAssets(root)).toEqual(['c0fa9c7f.png']);
+  });
+
+  test('reads canvas bodies and sidecars too, deduplicating', () => {
+    const root = project({
+      'ui-board.annotations.svg': annotation('a.png'),
+      'ui/card.tsx': `<img src="assets/b.jpg" /><img src="assets/a.png" />`,
+      'ui/card.css': `.x { background: url(assets/c.webp) }`,
+    });
+    expect(referencedAssets(root)).toEqual(['a.png', 'b.jpg', 'c.webp']);
+  });
+
+  test('refuses a reference that could place a file outside assets/', () => {
+    // An annotation can itself have arrived from the hub, so a name found in
+    // one is untrusted input.
+    const root = project({
+      'ui-board.annotations.svg': [
+        '<svg>',
+        '<image href="assets/../../etc/passwd"/>',
+        '<image href="assets/ok.png"/>',
+        '</svg>',
+      ].join(''),
+    });
+    expect(referencedAssets(root)).toEqual(['ok.png']);
+  });
+
+  test('refuses an extension outside the asset allowlist', () => {
+    const root = project({
+      'ui/card.tsx': `"assets/payload.sh" "assets/x.tsx" "assets/real.png"`,
+    });
+    expect(referencedAssets(root)).toEqual(['real.png']);
+  });
+
+  test('ignores runtime directories — a trashed canvas wants nothing', () => {
+    const root = project({
+      '_trash/old-deleted-1/old.annotations.svg': annotation('ghost.png'),
+      '_history/ui-board/1.tsx': `"assets/older.png"`,
+      'ui-board.annotations.svg': annotation('live.png'),
+    });
+    expect(referencedAssets(root)).toEqual(['live.png']);
+  });
+});
+
+describe('pullAssets', () => {
+  const opts = (root: string, fetchImpl: typeof fetch) => ({
+    designRoot: root,
+    hubUrl: 'https://hub.example/',
+    token: () => 'tok',
+    fetchImpl,
+    log: { log: () => {}, warn: () => {} },
+  });
+
+  test('fetches a referenced asset this machine does not have', async () => {
+    const root = project({ 'ui-board.annotations.svg': annotation('c0fa9c7f.png') });
+    const seen: string[] = [];
+    const res = await pullAssets(opts(root, servingFetch(seen)));
+
+    expect(res.pulled).toEqual(['c0fa9c7f.png']);
+    expect(seen).toEqual(['https://hub.example/assets/c0fa9c7f.png']);
+    expect(readFileSync(path.join(root, 'assets/c0fa9c7f.png'))).toEqual(Buffer.from([1, 2, 3]));
+  });
+
+  test('asks for nothing when every reference is already on disk', async () => {
+    const root = project({
+      'ui-board.annotations.svg': annotation('have.png'),
+      'assets/have.png': 'bytes',
+    });
+    let called = 0;
+    const counting = (async () => {
+      called += 1;
+      return new Response('x', { status: 200 });
+    }) as unknown as typeof fetch;
+
+    const res = await pullAssets(opts(root, counting));
+    expect(called).toBe(0);
+    expect(res.present).toBe(1);
+    expect(res.pulled).toEqual([]);
+  });
+
+  test('is idempotent — a second pass costs no requests', async () => {
+    const root = project({ 'ui-board.annotations.svg': annotation('x.png') });
+    await pullAssets(opts(root, servingFetch()));
+    const seen: string[] = [];
+    const second = await pullAssets(opts(root, servingFetch(seen)));
+    expect(seen).toEqual([]);
+    expect(second.pulled).toEqual([]);
+  });
+
+  test('a 404 is recorded and retried, never fatal', async () => {
+    // Ordinary: the peer that owns the bytes has not pushed them yet.
+    const root = project({ 'ui-board.annotations.svg': annotation('later.png') });
+    const missing = (async () => new Response('nope', { status: 404 })) as unknown as typeof fetch;
+    const res = await pullAssets(opts(root, missing));
+    expect(res.pulled).toEqual([]);
+    expect(res.failed).toEqual([{ name: 'later.png', reason: 'HTTP 404' }]);
+    expect(existsSync(path.join(root, 'assets/later.png'))).toBe(false);
+  });
+
+  test('a throwing hub is not fatal either', async () => {
+    const root = project({ 'ui-board.annotations.svg': annotation('x.png') });
+    const boom = (async () => {
+      throw new Error('offline');
+    }) as unknown as typeof fetch;
+    const res = await pullAssets(opts(root, boom));
+    expect(res.pulled).toEqual([]);
+    expect(res.failed[0]?.reason).toBe('offline');
+  });
+
+  test('refuses an empty body rather than writing a zero-byte image', async () => {
+    const root = project({ 'ui-board.annotations.svg': annotation('x.png') });
+    const empty = (async () =>
+      new Response(new Uint8Array([]), { status: 200 })) as unknown as typeof fetch;
+    const res = await pullAssets(opts(root, empty));
+    expect(res.pulled).toEqual([]);
+    expect(existsSync(path.join(root, 'assets/x.png'))).toBe(false);
+  });
+
+  test('leaves no .part file behind on success', async () => {
+    // The write is temp-then-rename so the dev server serving this very path
+    // never reads a half-written image.
+    const root = project({ 'ui-board.annotations.svg': annotation('x.png') });
+    await pullAssets(opts(root, servingFetch()));
+    expect(existsSync(path.join(root, 'assets/x.png.part'))).toBe(false);
+  });
+});

package/apps/studio/test/sync-asset-push.test.ts

@@ -21,7 +21,7 @@ function scratchDesignRoot(): string {
   return mkdtempSync(join(tmpdir(), 'asset-push-'));
 }
 
-describe('listPushableAssets — every assets/ dir, asset extensions only', () => {
+describe('listPushableAssets — classifier membership over the whole design root', () => {
   test('finds top-level content-addressed AND nested DS/brand assets', () => {
     const designRoot = scratchDesignRoot();
     // Class 1 — top-level content-addressed uploads (+ a .photo.json sidecar).
@@ -67,6 +67,51 @@ describe('listPushableAssets — every assets/ dir, asset extensions only', () =
     writeFileSync(join(designRoot, 'assets/a/b/c/d/e/f/g/x.png'), 'x');
     expect(listPushableAssets(designRoot)).toEqual([]);
   });
+
+  test('the file-plane widening: the RCA miss-list goes up, canvas lanes stay home', () => {
+    // feature-sync-file-plane — the sweep now carries what the fresh-link RCA
+    // named laneless: token stylesheets, docs, shared modules, underscore
+    // FILES. A canvas body and its named sidecars stay the CRDT lanes'.
+    const designRoot = scratchDesignRoot();
+    mkdirSync(join(designRoot, 'system/ds/preview'), { recursive: true });
+    writeFileSync(join(designRoot, 'config.json'), '{}');
+    writeFileSync(join(designRoot, 'system/ds/brand.css'), 'x');
+    writeFileSync(join(designRoot, 'system/ds/README.md'), 'x');
+    writeFileSync(join(designRoot, 'system/ds/preview/_brand-css.ts'), 'x');
+    writeFileSync(join(designRoot, 'system/ds/preview/_layout.css'), 'x');
+    writeFileSync(join(designRoot, 'system/ds/preview/specimen.tsx'), 'x');
+    writeFileSync(join(designRoot, 'system/ds/preview/specimen.css'), 'x'); // sibling css lane
+    writeFileSync(join(designRoot, 'system/ds/preview/specimen.meta.json'), '{}');
+    expect(listPushableAssets(designRoot, { syncFiles: true })).toEqual([
+      'system/ds/README.md',
+      'system/ds/brand.css',
+      'system/ds/preview/_brand-css.ts',
+      'system/ds/preview/_layout.css',
+    ]);
+    // Flag OFF ⇒ today's reach, byte-for-byte: none of these are binary
+    // media under an assets/ dir, so none of them move.
+    expect(listPushableAssets(designRoot)).toEqual([]);
+  });
+
+  test('declared canvasGroups decide what a canvas body IS', () => {
+    const designRoot = scratchDesignRoot();
+    mkdirSync(join(designRoot, 'mocks'), { recursive: true });
+    mkdirSync(join(designRoot, 'lib'), { recursive: true });
+    writeFileSync(join(designRoot, 'mocks/screen.tsx'), 'x');
+    writeFileSync(join(designRoot, 'lib/helpers.tsx'), 'x');
+    const groups = [{ path: 'mocks' }];
+    // `mocks/screen.tsx` is a canvas here; `lib/helpers.tsx` a shared module.
+    expect(listPushableAssets(designRoot, { canvasGroups: groups, syncFiles: true })).toEqual([
+      'lib/helpers.tsx',
+    ]);
+    // …and both the groups and the flag reach the walk through config.json —
+    // the out-of-process worker's path.
+    writeFileSync(
+      join(designRoot, 'config.json'),
+      JSON.stringify({ canvasGroups: groups, linkedHub: { url: 'http://h', syncFiles: true } })
+    );
+    expect(listPushableAssets(designRoot)).toEqual(['lib/helpers.tsx']);
+  });
 });
 
 describe('pushAssets — routes each class to the right hub endpoint', () => {
@@ -790,7 +835,12 @@ describe('the runtime sweeps on change, not only at boot', () => {
   const SYNC = readFileSync(join(import.meta.dir, '..', 'sync', 'index.ts'), 'utf8');
 
   test('the fs watcher decides with isPushableAssetRel and schedules a sweep', () => {
-    expect(SYNC).toContain('if (isPushableAssetRel(rel)) scheduleAssetSweep(');
+    // The predicate gets the project's OWN canvas groups — with the default
+    // set a custom-group project's shared module would answer canvas-owned
+    // and silently never schedule the sweep that uploads it.
+    expect(SYNC).toContain(
+      'if (isPushableAssetRel(rel, ctx.cfg.canvasGroups)) scheduleAssetSweep('
+    );
   });
 
   test('bursts coalesce, and a change DURING a sweep is not lost', () => {