@1agh/maude 1.0.11 → 1.2.0

package/apps/studio/test/git-branches.test.ts

@@ -1,341 +0,0 @@
-// Phase 29 (E4) — drafts (branches). List / create / switch against a REAL local
-// git repo via the default isomorphic-git engine (no network). The vocabulary
-// mapping (draft=branch, "Shared version"=main) lives in the UI; this proves the
-// plumbing + the dash-led / duplicate / dirty-tree guards.
-
-import { afterEach, beforeEach, expect, test } from 'bun:test';
-import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import {
-  gitCheckout,
-  gitCreateBranch,
-  gitFetchRemote,
-  gitFoldDraft,
-  gitListBranches,
-  gitPull,
-  gitPush,
-  remoteAheadBehind,
-} from '../git/service.ts';
-
-let dir: string;
-
-function shIn(cwd: string, args: string[]): void {
-  const p = Bun.spawnSync(['git', ...args], {
-    cwd,
-    env: { ...process.env, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null' },
-  });
-  if (p.exitCode !== 0) throw new Error(`git ${args.join(' ')}: ${p.stderr.toString()}`);
-}
-function sh(args: string[]): void {
-  shIn(dir, args);
-}
-
-beforeEach(() => {
-  dir = mkdtempSync(join(tmpdir(), 'maude-drafts-'));
-  sh(['init', '-q']);
-  sh(['config', 'user.email', 't@t.dev']);
-  sh(['config', 'user.name', 'Tester']);
-  writeFileSync(join(dir, 'a.txt'), 'hello\n');
-  sh(['add', '.']);
-  sh(['commit', '-q', '-m', 'init']);
-});
-afterEach(() => rmSync(dir, { recursive: true, force: true }));
-
-test('lists the default branch as current', async () => {
-  const branches = await gitListBranches(dir);
-  expect(branches.length).toBe(1);
-  expect(branches[0].current).toBe(true);
-  expect(['main', 'master']).toContain(branches[0].name);
-});
-
-test('carries a last-commit time so the UI can sort by recents', async () => {
-  const branches = await gitListBranches(dir);
-  expect(typeof branches[0].updatedAt).toBe('number');
-  expect(branches[0].updatedAt).toBeGreaterThan(0);
-});
-
-test('creates a new draft off HEAD and switches to it', async () => {
-  const res = await gitCreateBranch(dir, 'nav-redesign');
-  expect(res.ok).toBe(true);
-  expect(res.branch).toBe('nav-redesign');
-  const branches = await gitListBranches(dir);
-  const cur = branches.find((b) => b.current);
-  expect(cur?.name).toBe('nav-redesign');
-  expect(branches.map((b) => b.name).sort()).toContain('nav-redesign');
-});
-
-test('switches back to the shared version', async () => {
-  const before = await gitListBranches(dir);
-  const shared = before[0].name; // main/master
-  await gitCreateBranch(dir, 'pricing-experiment');
-  const res = await gitCheckout(dir, shared);
-  expect(res.ok).toBe(true);
-  const cur = (await gitListBranches(dir)).find((b) => b.current);
-  expect(cur?.name).toBe(shared);
-});
-
-test('rejects a dash-led / malformed draft name (argv-injection guard)', async () => {
-  const r1 = await gitCreateBranch(dir, '--upload-pack=evil');
-  expect(r1.ok).toBe(false);
-  const r2 = await gitCreateBranch(dir, 'has spaces');
-  expect(r2.ok).toBe(false);
-});
-
-test('fold: rejects a draft that does not exist', async () => {
-  const r = await gitFoldDraft(dir, 'ghost', undefined, {});
-  expect(r.ok).toBe(false);
-  expect(r.error).toMatch(/doesn't exist/i);
-});
-
-test('fold: rejects folding the Shared version into itself', async () => {
-  const shared = (await gitListBranches(dir)).find((b) => b.current)?.name as string;
-  const r = await gitFoldDraft(dir, shared, undefined, {});
-  expect(r.ok).toBe(false);
-  expect(r.error).toMatch(/already the Shared version/i);
-});
-
-test('fold: merges the draft into the Shared version locally; a tokenless publish leaves the draft intact', async () => {
-  const shared = (await gitListBranches(dir)).find((b) => b.current)?.name as string;
-  await gitCreateBranch(dir, 'nav'); // checks out 'nav'
-  writeFileSync(join(dir, 'b.txt'), 'draft work\n');
-  sh(['add', '.']);
-  sh(['commit', '-q', '-m', 'draft work']);
-  const r = await gitFoldDraft(dir, 'nav', undefined, {});
-  // No token/remote → the publish step returns authRequired, so the draft is NOT removed…
-  expect(r.ok).toBe(false);
-  expect(r.authRequired).toBe(true);
-  // …but the merge landed: the Shared version (now checked out) contains the draft's file…
-  expect(existsSync(join(dir, 'b.txt'))).toBe(true);
-  expect((await gitListBranches(dir)).find((b) => b.current)?.name).toBe(shared);
-  // …and the draft still exists (not deleted on a failed publish).
-  expect((await gitListBranches(dir)).some((b) => b.name === 'nav')).toBe(true);
-});
-
-test('fold: a GitHub remote takes the PR path — pushes the draft, never locally merges main (DDR-162)', async () => {
-  // isGitHubRemote(github.com) → PR flow: publish the DRAFT branch (fails here — no
-  // real access) and NEVER merge/modify the local Shared version. `false` as the ssh
-  // command fails the transport instantly, so there's no network to github.com.
-  const prevSsh = process.env.GIT_SSH_COMMAND;
-  process.env.GIT_SSH_COMMAND = 'false';
-  const shared = (await gitListBranches(dir)).find((b) => b.current)?.name as string;
-  sh(['remote', 'add', 'origin', 'git@github.com:fake-org/fake-repo.git']);
-  await gitCreateBranch(dir, 'nav'); // now on 'nav'
-  writeFileSync(join(dir, 'b.txt'), 'draft work\n');
-  sh(['add', '.']);
-  sh(['commit', '-q', '-m', 'draft work']);
-  const r = await gitFoldDraft(dir, 'nav', undefined, {});
-  process.env.GIT_SSH_COMMAND = prevSsh ?? '';
-  // The draft push failed (fake repo) → not ok, and NOT the iso transport error…
-  expect(r.ok).toBe(false);
-  expect(r.error || '').not.toMatch(/unrecognized transport/i);
-  // …but crucially the Shared version was NEVER locally merged/modified…
-  sh(['checkout', shared]);
-  expect(existsSync(join(dir, 'b.txt'))).toBe(false);
-  // …and the draft still exists (nothing destroyed on a failed publish).
-  expect((await gitListBranches(dir)).some((b) => b.name === 'nav')).toBe(true);
-});
-
-// ── remote drafts (phase: surface remote branches) ───────────────────────────
-
-/** Stand up a bare "remote" with main + a teammate draft, clone it locally (system
- *  git, no network — a file:// remote), and return the clone dir. The clone has a
- *  LOCAL main plus refs/remotes/origin/{main,teammate-draft}. */
-function cloneWithRemoteDraft(): { remote: string; clone: string } {
-  const remote = mkdtempSync(join(tmpdir(), 'maude-remote-'));
-  shIn(remote, ['init', '-q', '--bare']);
-  sh(['remote', 'add', 'origin', remote]);
-  const head = (
-    Bun.spawnSync(['git', 'rev-parse', '--abbrev-ref', 'HEAD'], { cwd: dir }).stdout.toString() ||
-    'main'
-  ).trim();
-  sh(['push', '-q', 'origin', head]);
-  sh(['checkout', '-q', '-b', 'teammate-draft']);
-  writeFileSync(join(dir, 'team.txt'), 'team work\n');
-  sh(['add', '.']);
-  sh(['commit', '-q', '-m', 'team work']);
-  sh(['push', '-q', 'origin', 'teammate-draft']);
-  sh(['checkout', '-q', head]); // leave the source repo back on the shared version
-  const clone = mkdtempSync(join(tmpdir(), 'maude-clone-'));
-  shIn(clone, ['clone', '-q', remote, '.']);
-  return { remote, clone };
-}
-
-test('surfaces a remote-only draft and tags where=remote / where=both', async () => {
-  const { clone } = cloneWithRemoteDraft();
-  const branches = await gitListBranches(clone);
-  const team = branches.find((b) => b.name === 'teammate-draft');
-  const shared = branches.find((b) => ['main', 'master'].includes(b.name));
-  expect(team?.where).toBe('remote'); // only on the remote in a fresh clone
-  expect(team?.current).toBe(false);
-  expect(shared?.where).toBe('both'); // checked out locally AND on the remote
-  expect(shared?.current).toBe(true);
-  rmSync(clone, { recursive: true, force: true });
-});
-
-test('switches onto a remote-only draft by creating a local tracking branch', async () => {
-  const { clone } = cloneWithRemoteDraft();
-  const res = await gitCheckout(clone, 'teammate-draft');
-  expect(res.ok).toBe(true);
-  const after = await gitListBranches(clone);
-  const team = after.find((b) => b.name === 'teammate-draft');
-  expect(team?.current).toBe(true);
-  expect(team?.where).toBe('both'); // now local AND remote
-  expect(existsSync(join(clone, 'team.txt'))).toBe(true); // the draft's content landed
-  rmSync(clone, { recursive: true, force: true });
-});
-
-test('checkout of a never-fetched draft asks for a Refresh, not a raw error', async () => {
-  const res = await gitCheckout(dir, 'ghost-remote-draft');
-  expect(res.ok).toBe(false);
-  expect(res.error).toMatch(/refresh/i);
-});
-
-test('fetch of an HTTPS remote without a token reports authRequired (iso engine)', async () => {
-  // iso-git can't use a system credential helper, so a tokenless HTTPS refresh
-  // short-circuits to authRequired BEFORE any network call. Pin iso for this
-  // assertion (DDR-133: with system git available a tokenless fetch instead uses the
-  // dev's credential helper — that path is covered by the git-lifecycle e2e).
-  const prev = process.env.MAUDE_NO_SYSTEM_GIT;
-  process.env.MAUDE_NO_SYSTEM_GIT = '1';
-  try {
-    sh(['remote', 'add', 'origin', 'https://github.com/example/repo.git']);
-    const r = await gitFetchRemote(dir, undefined);
-    expect(r.ok).toBe(false);
-    expect(r.authRequired).toBe(true);
-  } finally {
-    if (prev === undefined) delete process.env.MAUDE_NO_SYSTEM_GIT;
-    else process.env.MAUDE_NO_SYSTEM_GIT = prev;
-  }
-});
-
-test('an ssh remote routes to system git, never the iso transport error', async () => {
-  // iso-git speaks HTTP(S) only; an ssh remote must go through the git binary
-  // (user's ssh-agent, no token). A .invalid host fails fast at DNS — no network.
-  process.env.GIT_SSH_COMMAND =
-    'ssh -o BatchMode=yes -o ConnectTimeout=2 -o StrictHostKeyChecking=no';
-  sh(['remote', 'add', 'origin', 'git@nonexistent.invalid:team/app.git']);
-  const r = await gitFetchRemote(dir, undefined);
-  process.env.GIT_SSH_COMMAND = '';
-  expect(r.ok).toBe(false);
-  expect(r.authRequired).toBeFalsy(); // ssh failure is not a GitHub sign-in prompt
-  expect(r.error || '').not.toMatch(/unrecognized transport/i); // didn't fall into iso
-});
-
-// ── publish / get-latest over ssh (DDR-131/DDR-133 parity — the gap that shipped) ──
-// gitFetchRemote was hardened for ssh; gitPush/gitPull historically routed on the
-// USE_SYSTEM_GIT env flag only (default off) and fell into iso → "unrecognized
-// transport protocol: ssh". These prove the write paths now take the same gate.
-
-test('gitPush: an ssh remote routes to system git, never the iso transport error', async () => {
-  process.env.GIT_SSH_COMMAND =
-    'ssh -o BatchMode=yes -o ConnectTimeout=2 -o StrictHostKeyChecking=no';
-  sh(['remote', 'add', 'origin', 'git@nonexistent.invalid:team/app.git']);
-  const r = await gitPush(dir, undefined, {});
-  process.env.GIT_SSH_COMMAND = '';
-  expect(r.ok).toBe(false);
-  expect(r.authRequired).toBeFalsy(); // an ssh failure is not a GitHub sign-in prompt
-  expect(r.error || '').not.toMatch(/unrecognized transport/i); // didn't fall into iso
-});
-
-test('gitPull: an ssh remote routes to system git, never the iso transport error', async () => {
-  process.env.GIT_SSH_COMMAND =
-    'ssh -o BatchMode=yes -o ConnectTimeout=2 -o StrictHostKeyChecking=no';
-  sh(['remote', 'add', 'origin', 'git@nonexistent.invalid:team/app.git']);
-  const r = await gitPull(dir, undefined, {});
-  process.env.GIT_SSH_COMMAND = '';
-  expect(r.ok).toBe(false);
-  expect(r.authRequired).toBeFalsy();
-  expect(r.error || '').not.toMatch(/unrecognized transport/i);
-});
-
-test('SECURITY: gitPush refuses an unsafe (ext::) remote — no spawn, no RCE', async () => {
-  // A poisoned .git/config remote — must be refused BEFORE any git spawn (the payload
-  // never runs); classifyRemoteUrl reads the url via iso getConfig, not the git binary.
-  const sentinel = join(dir, 'PWNED_PUSH');
-  sh(['remote', 'add', 'origin', `ext::sh -c "touch ${sentinel}"`]);
-  const r = await gitPush(dir, 'tok_should_not_be_used', {});
-  expect(r.ok).toBe(false);
-  expect(r.error).toMatch(/github\.com/i); // "can only sync github.com…"
-  expect(existsSync(sentinel)).toBe(false); // payload NEVER executed
-});
-
-test('SECURITY: gitPush does not send the GitHub token to a non-GitHub HTTPS host', async () => {
-  sh(['remote', 'add', 'origin', 'https://evil.example.com/repo.git']);
-  const r = await gitPush(dir, 'tok_secret', {});
-  expect(r.ok).toBe(false);
-  expect(r.error).toMatch(/github\.com/i); // refused by policy, token never attached
-});
-
-test('SECURITY: a backslash-@ host-confusion remote is refused, PAT never attached (F1)', async () => {
-  // `https://github.com\@evil` — new URL() parses host=github.com (backslash → '/'),
-  // but git/curl dials `evil` (backslash = path/userinfo char). The token-host allowlist
-  // must reject the parser differential and NOT lend the PAT — on every token path:
-  // explicit fetch, the unattended ahead/behind probe (the zero-click trigger), and push.
-  sh(['remote', 'add', 'origin', 'https://github.com\\@evil.example/x.git']);
-  const f = await gitFetchRemote(dir, 'tok_secret');
-  expect(f.ok).toBe(false);
-  expect(f.error).toMatch(/github\.com/i); // refused by policy — token never attached
-  const ab = await remoteAheadBehind(dir, 'tok_secret');
-  expect(ab).toEqual({ ahead: 0, behind: 0 }); // the unattended probe refuses too (0/0, no fetch)
-  const p = await gitPush(dir, 'tok_secret', {});
-  expect(p.ok).toBe(false);
-  expect(p.error).toMatch(/github\.com/i);
-});
-
-test('SECURITY: the unattended probe refuses a repo with a url.insteadOf rewrite (verify re-review)', async () => {
-  // A clean github `origin.url` (passes isTrustedTokenHost) + a poisoned
-  // `url.<attacker>.insteadOf` that redirects github.com → attacker (only the system
-  // engine honors it). git would dial the attacker; the zero-click probe must refuse.
-  sh(['remote', 'add', 'origin', 'https://github.com/owner/repo.git']);
-  sh(['config', '--local', 'url.https://attacker.example/.insteadOf', 'https://github.com/']);
-  const ab = await remoteAheadBehind(dir, 'tok_secret');
-  expect(ab).toEqual({ ahead: 0, behind: 0 });
-});
-
-// ── transport-injection hardening (adversarial review of 75a2f0d) ────────────
-
-test('SECURITY: refuses to fetch an `ext::` (command-executing) remote — no spawn, no RCE', async () => {
-  // A poisoned .git/config remote url. `git fetch origin` would resolve this and
-  // run the shell command; classifyRemoteUrl must refuse BEFORE any spawn.
-  const sentinel = join(dir, 'PWNED');
-  sh(['remote', 'add', 'origin', `ext::sh -c "touch ${sentinel}"`]);
-  const r = await gitFetchRemote(dir, 'tok_should_not_be_used');
-  expect(r.ok).toBe(false);
-  expect(r.error).toMatch(/github\.com/i); // "can only refresh github.com…"
-  expect(existsSync(sentinel)).toBe(false); // the payload NEVER executed
-});
-
-test('SECURITY: the unattended ahead/behind probe refuses an `ext::` remote (0/0, no spawn)', async () => {
-  const sentinel = join(dir, 'PWNED2');
-  sh(['remote', 'add', 'origin', `ext::sh -c "touch ${sentinel}"`]);
-  const ab = await remoteAheadBehind(dir, 'tok_should_not_be_used');
-  expect(ab).toEqual({ ahead: 0, behind: 0 });
-  expect(existsSync(sentinel)).toBe(false);
-});
-
-test('SECURITY: refuses a file:// / local-path remote (local-read vector, no spawn)', async () => {
-  sh(['remote', 'add', 'origin', 'file:///etc/passwd']);
-  const r = await gitFetchRemote(dir, 'tok');
-  expect(r.ok).toBe(false);
-  expect(r.error).toMatch(/github\.com/i); // refused by policy, never handed to git
-});
-
-test('SECURITY: does not send the GitHub token to a non-GitHub HTTPS host', async () => {
-  // A non-github HTTPS remote must NOT receive the keychain PAT (exfil/SSRF).
-  sh(['remote', 'add', 'origin', 'https://evil.example.com/repo.git']);
-  const r = await gitFetchRemote(dir, 'tok_secret');
-  expect(r.ok).toBe(false);
-  expect(r.error).toMatch(/github\.com/i); // refused, token never attached
-});
-
-test('rejects creating a draft that already exists', async () => {
-  await gitCreateBranch(dir, 'dupe');
-  // back to a fresh ref first so create (which checks out) has a clean base
-  const shared = (await gitListBranches(dir)).find((b) => !b.current);
-  if (shared) await gitCheckout(dir, shared.name);
-  const r = await gitCreateBranch(dir, 'dupe');
-  expect(r.ok).toBe(false);
-  expect(r.error).toMatch(/already exists/i);
-});

package/apps/studio/test/git-cloud-posture.test.ts

@@ -1,59 +0,0 @@
-// DDR-218 (fix 8, sync RCA 2026-08-10) — the cloud-managed GitPanel posture.
-//
-// Source-level assertions, the cloud-shell-surfaces pattern: what these pin is
-// exactly what would regress — someone gating the withdrawal on `historyOnly`
-// alone (dropping the desktop half), breaking the live connect/disconnect
-// reaction, or wiring `cloudManaged` from something other than the
-// CORROBORATED link (`credentialed` — config.json alone is attacker-authorable,
-// B2).
-
-import { describe, expect, test } from 'bun:test';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-const STUDIO = join(import.meta.dir, '..');
-const APP = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
-const GIT_PANEL = readFileSync(join(STUDIO, 'client', 'panels', 'GitPanel.jsx'), 'utf8');
-const CLOUD_BAR = readFileSync(join(STUDIO, 'client', 'panels', 'CloudBar.jsx'), 'utf8');
-
-describe('a cloud-linked repo shows ONE save mechanism (DDR-218)', () => {
-  test('cloudManaged withdraws exactly like the cell-side historyOnly', () => {
-    expect(GIT_PANEL).toContain('const withdrawn = historyOnly || cloudManaged;');
-    // Every render gate the working-tree half hides behind must read the
-    // merged flag — a `!historyOnly` guard reintroduces the desktop leak.
-    expect(GIT_PANEL).toMatch(/\{!withdrawn && \(\s*<div className="gp-tabs"/);
-    expect(GIT_PANEL).toContain("{tab === 'changes' && !withdrawn ? (");
-  });
-
-  test('the posture reacts LIVE to connect/disconnect, not only at mount', () => {
-    // The initial useState alone would leave a freshly-linked panel on Changes.
-    expect(GIT_PANEL).toMatch(/useEffect\(\(\) => \{\s*if \(withdrawn\) setTab\('history'\);/);
-  });
-
-  test('the note names the active mechanism, and only in the desktop posture', () => {
-    expect(GIT_PANEL).toContain('data-testid="git-cloud-managed"');
-    expect(GIT_PANEL).toMatch(/\{cloudManaged && \(\s*<div className="gp-cloud-note"/);
-    expect(GIT_PANEL).toContain('Cloud is saving');
-  });
-
-  test('the app gate is the CORROBORATED link, and the cell posture is untouched', () => {
-    // Hoisted to a single top-level definition (2026-08-14) so the toolbar and
-    // status bar read the SAME posture the panel does — see
-    // cloud-managed-save-surfaces.test.ts. The gate itself is unchanged, and
-    // `credentialed` is the load-bearing half: config.json alone is
-    // attacker-authorable (B2), so a link claim without corroboration must
-    // never reach this posture.
-    expect(APP).toContain('const cloudManaged = !cfg.cloud && !!cloudLinkedHub?.credentialed;');
-    expect(APP).toContain('const cellManaged = !!cfg.cloud;');
-    // …and the panel is fed from those names, not a re-derivation.
-    expect(APP).toContain('cloudManaged={cloudManaged}');
-    expect(APP).toContain('historyOnly={cellManaged}');
-  });
-
-  test('CloudBar lifts every link change the posture depends on', () => {
-    // status resolve + attach + detach — the three places the link changes.
-    const lifts = CLOUD_BAR.match(/onLinkedHub\?\.\(/g) ?? [];
-    expect(lifts.length).toBeGreaterThanOrEqual(3);
-    expect(APP).toContain('onLinkedHub={setCloudLinkedHub}');
-  });
-});

package/apps/studio/test/git-grouping.test.ts

@@ -1,106 +0,0 @@
-// DDR-115 follow-up — Changes-panel canvas grouping (GitPanel variant A).
-// Verifies the pure grouping helpers: a canvas unifies with its same-stem
-// `.meta.json` + its slug-named `.annotations.svg`; loose / orphan files become
-// standalone "other" units; sort + slug-matching (spaces, subdirs) are correct.
-
-import { describe, expect, test } from 'bun:test';
-
-import { baseName, buildUnits, canvasSlug, supportLabel } from '../client/panels/git-grouping.js';
-
-const F = (path: string, status = 'modified') => ({ path, status });
-
-describe('GitPanel canvas grouping (buildUnits)', () => {
-  test('unifies a canvas with its same-stem meta and slug-matched annotation', () => {
-    const files = [
-      F('.design/ui/Pricing.tsx'),
-      F('.design/ui/Pricing.meta.json'),
-      F('.design/ui-pricing.annotations.svg'),
-    ];
-    const { canvasUnits, otherUnits } = buildUnits(files, '.design');
-    expect(canvasUnits.length).toBe(1);
-    expect(otherUnits.length).toBe(0);
-    const u = canvasUnits[0];
-    expect(u.primary.path).toBe('.design/ui/Pricing.tsx');
-    expect(u.supporting.map((s) => s.path).sort()).toEqual([
-      '.design/ui-pricing.annotations.svg',
-      '.design/ui/Pricing.meta.json',
-    ]);
-  });
-
-  test('canvas with spaces + subdir matches its annotation slug', () => {
-    // fileSlug('.design/ui/Sync Hub Admin.tsx') => 'ui-sync_hub_admin'
-    expect(canvasSlug('.design/ui/Sync Hub Admin.tsx', '.design')).toBe('ui-sync_hub_admin');
-    const files = [
-      F('.design/ui/Sync Hub Admin.tsx'),
-      F('.design/ui-sync_hub_admin.annotations.svg'),
-    ];
-    const { canvasUnits } = buildUnits(files, '.design');
-    expect(canvasUnits.length).toBe(1);
-    expect(canvasUnits[0].supporting.map((s) => s.path)).toEqual([
-      '.design/ui-sync_hub_admin.annotations.svg',
-    ]);
-  });
-
-  test('a meta with no canvas in the changeset is a standalone other unit', () => {
-    const { canvasUnits, otherUnits } = buildUnits([F('.design/ui/Orphan.meta.json')], '.design');
-    expect(canvasUnits.length).toBe(0);
-    expect(otherUnits.length).toBe(1);
-    expect(otherUnits[0].primary.path).toBe('.design/ui/Orphan.meta.json');
-    expect(otherUnits[0].supporting.length).toBe(0);
-  });
-
-  test('an annotation with no canvas in the changeset is a standalone other unit', () => {
-    const { canvasUnits, otherUnits } = buildUnits(
-      [F('.design/ui-ghost.annotations.svg')],
-      '.design'
-    );
-    expect(canvasUnits.length).toBe(0);
-    expect(otherUnits).toHaveLength(1);
-    expect(otherUnits[0].primary.path).toBe('.design/ui-ghost.annotations.svg');
-  });
-
-  test('loose files (config, DS tokens) are other units, never grouped under a canvas', () => {
-    const files = [
-      F('.design/ui/Pricing.tsx'),
-      F('.design/config.json'),
-      F('.design/system/project/tokens.css'),
-    ];
-    const { canvasUnits, otherUnits } = buildUnits(files, '.design');
-    expect(canvasUnits.map((u) => u.primary.path)).toEqual(['.design/ui/Pricing.tsx']);
-    expect(canvasUnits[0].supporting.length).toBe(0);
-    expect(otherUnits.map((u) => u.primary.path).sort()).toEqual([
-      '.design/config.json',
-      '.design/system/project/tokens.css',
-    ]);
-  });
-
-  test('multiple canvases are sorted by display name; each keeps its own sidecars', () => {
-    const files = [
-      F('.design/ui/Zebra.tsx'),
-      F('.design/ui/Zebra.meta.json'),
-      F('.design/ui/Alpha.tsx'),
-      F('.design/ui/Alpha.meta.json'),
-    ];
-    const { canvasUnits } = buildUnits(files, '.design');
-    expect(canvasUnits.map((u) => baseName(u.primary.path))).toEqual(['Alpha', 'Zebra']);
-    expect(canvasUnits[0].supporting.map((s) => s.path)).toEqual(['.design/ui/Alpha.meta.json']);
-    expect(canvasUnits[1].supporting.map((s) => s.path)).toEqual(['.design/ui/Zebra.meta.json']);
-  });
-
-  test('a meta does NOT cross-attach to a different-stem canvas (Pricing vs Pricing v3)', () => {
-    const files = [
-      F('.design/ui/Pricing.tsx'),
-      F('.design/ui/Pricing v3.meta.json'), // belongs to a (clean, absent) "Pricing v3" canvas
-    ];
-    const { canvasUnits, otherUnits } = buildUnits(files, '.design');
-    expect(canvasUnits[0].supporting.length).toBe(0); // not grabbed by "Pricing"
-    expect(otherUnits.map((u) => u.primary.path)).toEqual(['.design/ui/Pricing v3.meta.json']);
-  });
-
-  test('supportLabel + baseName render friendly names', () => {
-    expect(supportLabel('.design/ui/Pricing.meta.json')).toBe('Layout & settings');
-    expect(supportLabel('.design/ui-pricing.annotations.svg')).toBe('Annotations');
-    expect(baseName('.design/ui/Sync Hub Admin.tsx')).toBe('Sync Hub Admin');
-    expect(baseName('.design/ui-pricing.annotations.svg')).toBe('ui-pricing');
-  });
-});

package/apps/studio/test/git-lifecycle.test.ts

@@ -1,100 +0,0 @@
-// Unit: Task 7 — `.git/HEAD` watcher. We don't exercise fs.watch directly
-// (flaky across platforms in CI); instead we drive the module's public
-// surface: it gracefully no-ops when no .git/ exists, and the public stop()
-// is idempotent.
-//
-// The flush-before-broadcast invariant is verified separately by the
-// collab-bridge tests and the persistence module's contract — registry
-// already exposes flushAll(). The integration with .git/HEAD writes is
-// exercised manually in the Task 7 acceptance test (Phase 8 plan validate row).
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-
-import { createGitLifecycle } from '../collab/git-lifecycle.ts';
-import { createRegistry } from '../collab/registry.ts';
-import type { RoomCallbacks } from '../collab/room.ts';
-import { type Context, createBus } from '../context.ts';
-
-function ctxFor(repoRoot: string): Context {
-  return {
-    cfg: {} as Context['cfg'],
-    projectLabel: 'test',
-    paths: {
-      repoRoot,
-      designRel: '.design',
-      designRoot: path.join(repoRoot, '.design'),
-      serverInfoFile: '',
-      activeFile: '',
-      commentsDir: '',
-      canvasStateDir: '',
-      historyDir: '',
-      tokensUrlRel: '',
-      systemDirRel: '',
-    },
-    bus: createBus(),
-  };
-}
-
-function noopCallbacks(): RoomCallbacks {
-  return { async seed() {}, async persistJson() {}, async persistBinary() {} };
-}
-
-describe('git-lifecycle', () => {
-  let tmp: string;
-
-  beforeEach(() => {
-    tmp = mkdtempSync(path.join(tmpdir(), 'maude-git-lifecycle-'));
-  });
-
-  afterEach(() => {
-    try {
-      rmSync(tmp, { recursive: true, force: true });
-    } catch {
-      /* ignore */
-    }
-  });
-
-  test('no .git/ directory → silent no-op (still returns a stop function)', () => {
-    const ctx = ctxFor(tmp);
-    const registry = createRegistry(noopCallbacks());
-    expect(existsSync(path.join(tmp, '.git'))).toBe(false);
-    const gl = createGitLifecycle(ctx, registry);
-    expect(typeof gl.stop).toBe('function');
-    gl.stop(); // idempotent
-    gl.stop();
-  });
-
-  test('with .git/HEAD present → watcher attaches without throwing', () => {
-    mkdirSync(path.join(tmp, '.git'), { recursive: true });
-    writeFileSync(path.join(tmp, '.git', 'HEAD'), 'ref: refs/heads/main\n');
-    const ctx = ctxFor(tmp);
-    const registry = createRegistry(noopCallbacks());
-    const gl = createGitLifecycle(ctx, registry);
-    expect(typeof gl.stop).toBe('function');
-    gl.stop();
-  });
-
-  test('emits git-lifecycle bus event on HEAD change (manual rewrite)', async () => {
-    mkdirSync(path.join(tmp, '.git'), { recursive: true });
-    writeFileSync(path.join(tmp, '.git', 'HEAD'), 'ref: refs/heads/main\n');
-    const ctx = ctxFor(tmp);
-    const registry = createRegistry(noopCallbacks());
-    const events: unknown[] = [];
-    ctx.bus.on('git-lifecycle', (e) => events.push(e));
-    const gl = createGitLifecycle(ctx, registry);
-
-    // Rewrite HEAD; the watcher fires + 250 ms debounce + flush. Wait > 500 ms
-    // to be safe with fs.watch + flushAll latency on macOS + Linux.
-    writeFileSync(path.join(tmp, '.git', 'HEAD'), 'ref: refs/heads/other\n');
-    await Bun.sleep(700);
-
-    expect(events.length).toBeGreaterThanOrEqual(1);
-    const evt = events[0] as { reason?: string; head?: string };
-    expect(evt.reason).toBe('head-changed');
-    expect(evt.head).toContain('refs/heads/other');
-    gl.stop();
-  });
-});