@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/git-log-format.test.ts

@@ -1,95 +0,0 @@
-// One log shape, three producers — feature-cloud-managed-git-posture.
-//
-// A History row is drawn by ONE renderer (`GitPanel`), and it can now be fed by
-// three different readers: system-git (`logSystem`), isomorphic-git (`logIso`)
-// and the cloud cell (`apps/hub/src/history.mjs`). The first and the third are
-// the same code — that is what `git/log-format.ts` is for. The second is a
-// separate implementation against a separate library, and it is the one that
-// can quietly drift.
-//
-// The failure mode is specific and quiet: a reader that stops emitting `date`
-// (or emits `authorName` instead of `author`) does not throw anywhere. It draws
-// a row with a blank field, on whichever of the two engines the reader happens
-// to be on — so it is invisible on the machine of whoever made the change.
-
-import { describe, expect, test } from 'bun:test';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { GIT_LOG_FORMAT, gitLogArgs, gitLogEnv, parseGitLog } from '../git/log-format.ts';
-
-const SERVICE = readFileSync(join(import.meta.dir, '..', 'git', 'service.ts'), 'utf8');
-
-/** The contract `GitLogEntry` declares and `GitPanel` reads. */
-const FIELDS = ['sha', 'message', 'author', 'email', 'date'] as const;
-
-describe('parseGitLog', () => {
-  test('produces exactly the declared fields', () => {
-    const rec = `abc123\x1fa message\x1fAda\x1fada@example.com\x1f2026-08-18T10:00:00+02:00\x1e`;
-    const [entry] = parseGitLog(rec);
-    expect(Object.keys(entry).sort()).toEqual([...FIELDS].sort());
-  });
-
-  test('survives every separator a commit subject can carry', () => {
-    const msg = 'fix: tabs\tquotes " and a | pipe, plus a comma';
-    const [entry] = parseGitLog(`sha\x1f${msg}\x1fAda\x1fa@b.c\x1f2026-08-18T10:00:00Z\x1e`);
-    expect(entry.message).toBe(msg);
-  });
-
-  test('a short record still yields strings, never undefined', () => {
-    // A renderer must never have to defend against a half-parsed row.
-    const [entry] = parseGitLog('justasha\x1fonly a message\x1e');
-    for (const f of FIELDS) expect(typeof entry[f]).toBe('string');
-  });
-
-  test('garbage is an empty list, never a throw', () => {
-    expect(parseGitLog('')).toEqual([]);
-    expect(parseGitLog('\x1e\x1e  \x1e')).toEqual([]);
-    // biome-ignore lint/suspicious/noExplicitAny: deliberately hostile input
-    expect(parseGitLog(null as any)).toEqual([]);
-  });
-});
-
-describe('gitLogArgs / gitLogEnv travel together', () => {
-  test('the format string is the one the parser splits on', () => {
-    expect(GIT_LOG_FORMAT).toContain('%x1f');
-    expect(GIT_LOG_FORMAT).toContain('%x1e');
-    expect(gitLogArgs(30)).toEqual(['log', '-n30', `--pretty=format:${GIT_LOG_FORMAT}`]);
-  });
-
-  test('a scoped log terminates its pathspec AND asks for literal pathspecs', () => {
-    // The `--` terminator alone does not close pathspec magic (`:(exclude)…`);
-    // GIT_LITERAL_PATHSPECS does, and the two must never be separated.
-    const args = gitLogArgs(10, '.design/ui/Card.tsx');
-    expect(args[args.length - 2]).toBe('--');
-    expect(args[args.length - 1]).toBe('.design/ui/Card.tsx');
-    expect(gitLogEnv('.design/ui/Card.tsx')).toEqual({ GIT_LITERAL_PATHSPECS: '1' });
-  });
-
-  test('an unscoped log asks for neither', () => {
-    expect(gitLogArgs(10)).not.toContain('--');
-    expect(gitLogEnv(undefined)).toBeUndefined();
-  });
-});
-
-describe('the isomorphic-git engine has not drifted from the shared shape', () => {
-  test('logSystem reads through the shared module rather than re-typing it', () => {
-    expect(SERVICE).toContain('gitLogArgs(limit, filepath), gitLogEnv(filepath)');
-    expect(SERVICE).toContain('return parseGitLog(r.stdout);');
-    // The old literal must be GONE, not merely unused — a leftover copy is the
-    // thing a later edit picks up.
-    expect(SERVICE).not.toContain("const fmt = '%H%x1f");
-  });
-
-  test('logIso still emits exactly the same five fields', () => {
-    // Source-level, because `logIso` is a private fallback with no seam to call
-    // it through: forcing the engine would mean exporting it, which invents an
-    // API for the test to check. The literal it returns IS the contract.
-    const body = SERVICE.slice(SERVICE.indexOf('async function logIso('));
-    const literal = body.slice(body.indexOf('return {'), body.indexOf('};') + 2);
-    for (const f of FIELDS) expect(literal).toContain(`${f}:`);
-    // …and nothing else, so a sixth field can't appear on one engine only.
-    const keys = [...literal.matchAll(/^\s{8}([a-zA-Z]+):/gm)].map((m) => m[1]);
-    expect(keys.sort()).toEqual([...FIELDS].sort());
-  });
-});

package/apps/studio/test/git-safe-rel.test.ts

@@ -1,132 +0,0 @@
-// `designRel` and the rels built on it, validated before they reach git —
-// F-13 / B12 of the v1.0.0 gate set.
-//
-// The finding was NOT "argv injection": every `runGit` / `run` call that carries
-// a dynamic path already puts it after a `--` separator, so a leading `-` is a
-// filename to git rather than a flag. The finding is CONTAINMENT, which `--`
-// does nothing about. A rel carrying `..` is a perfectly well-formed pathspec
-// that names a file outside the design root — and the autocommit path feeds
-// exactly such rels into `git add -- <paths>` inside a workspace cell, with no
-// human at the keyboard to notice `.github/workflows/release.yml` acquiring a
-// commit.
-//
-// So the shapes below are the hostile ones, and the two consumers that matter
-// are pinned: the containment PREFIX (which must never silently degrade to
-// "no filter") and the staging BATCH (which must drop the poisoned rel and keep
-// committing everybody else's work).
-
-import { describe, expect, test } from 'bun:test';
-
-import { isSafeGitRel, partitionSafeGitRels, safeGitPrefix } from '../git/safe-rel.ts';
-
-const HOSTILE: [string, string][] = [
-  ['../escape', 'parent traversal — the whole point'],
-  ['a/../../b', 'traversal in the middle, where a prefix check would not see it'],
-  ['..', 'bare parent'],
-  ['.', 'bare current — a pathspec meaning "everything"'],
-  ['a/./b', 'a no-op segment that normalises differently in two places'],
-  ['/etc/passwd', 'absolute'],
-  ['C:/Windows/System32', 'Windows-absolute'],
-  ['a\\..\\b', 'backslash separators — traversal that survives a forward-slash check'],
-  ['--upload-pack=/bin/sh', 'the flag-shaped rel the `--` separator exists for'],
-  ['-rf', 'a shorter one'],
-  ['a\u0000/../../b', 'NUL — truncates at the syscall boundary, so it is two paths'],
-  ['a\u001f/b', 'other control characters'],
-  ['a /b', 'trailing space in a segment — invisible in every UI that shows it'],
-  ['', 'empty'],
-  [`${'x/'.repeat(300)}y`, 'past the length cap'],
-];
-
-const BENIGN = [
-  '.design/ui/screen.tsx',
-  '.design/system/ds/README.md',
-  '.design/assets/a1b2c3d4.png',
-  'assets/logo.svg',
-  '.design/preview/_layout.css',
-  '.design/ui/My Canvas.tsx',
-  '.design/ui/-not-leading.tsx'.replace('/-not', '/not'),
-];
-
-describe('isSafeGitRel', () => {
-  for (const [rel, why] of HOSTILE) {
-    test(`refuses ${JSON.stringify(rel)} — ${why}`, () => {
-      expect(isSafeGitRel(rel)).toBe(false);
-    });
-  }
-
-  for (const rel of BENIGN) {
-    test(`admits ${JSON.stringify(rel)}`, () => {
-      expect(isSafeGitRel(rel)).toBe(true);
-    });
-  }
-
-  test('a non-string is refused rather than coerced', () => {
-    for (const v of [null, undefined, 42, {}, ['a']]) {
-      expect(isSafeGitRel(v)).toBe(false);
-    }
-  });
-});
-
-describe('safeGitPrefix — an absent prefix and a REFUSED one are different answers', () => {
-  test('absent is the empty prefix (no containment filter), and that is legitimate', () => {
-    expect(safeGitPrefix(undefined)).toBe('');
-    expect(safeGitPrefix('')).toBe('');
-    expect(safeGitPrefix(null)).toBe('');
-  });
-
-  test('a normal design root normalises', () => {
-    expect(safeGitPrefix('.design')).toBe('.design');
-    expect(safeGitPrefix('/.design/')).toBe('.design');
-    expect(safeGitPrefix('design\\root')).toBe('design/root');
-  });
-
-  test('a hostile prefix is null — NOT the empty string', () => {
-    // This distinction is the whole reason the function returns `string | null`.
-    // Empty means "match everything", so a caller that mapped a refusal onto ''
-    // would answer a traversal attempt by WIDENING the scope to the whole
-    // repository. The caller (`normPrefix`) falls back to '.design' instead.
-    //
-    // A LEADING SLASH IS NOT HOSTILE HERE, and this is the one place the prefix
-    // reading differs from the pathspec reading. `context.ts` already strips
-    // `^/+` off `cfg.designRoot`, i.e. a configured `/.design` has always meant
-    // "`.design`, relative to the repo root" — so `/etc/passwd` reads as the
-    // prefix `etc/passwd`, which names a directory that does not exist and
-    // therefore matches nothing. Harmless as a CONTAINMENT FILTER; still
-    // refused by `isSafeGitRel` where it would be used as a PATHSPEC.
-    const rootRelative = new Set(['/etc/passwd']);
-    for (const [rel] of HOSTILE) {
-      if (rel === '') continue; // '' is the absent case, tested above
-      if (rootRelative.has(rel)) {
-        expect(safeGitPrefix(rel)).toBe('etc/passwd');
-        continue;
-      }
-      expect(safeGitPrefix(rel)).toBeNull();
-    }
-  });
-});
-
-describe('partitionSafeGitRels — one poisoned rel must not wedge the batch', () => {
-  test('splits a mixed batch, keeping the order of each side', () => {
-    const { safe, refused } = partitionSafeGitRels([
-      '.design/ui/a.tsx',
-      '../../.github/workflows/release.yml',
-      '.design/ui/b.tsx',
-      '-rf',
-      '.design/system/ds/README.md',
-    ]);
-    expect(safe).toEqual(['.design/ui/a.tsx', '.design/ui/b.tsx', '.design/system/ds/README.md']);
-    expect(refused).toEqual(['../../.github/workflows/release.yml', '-rf']);
-  });
-
-  test('an all-clean batch is unchanged', () => {
-    const { safe, refused } = partitionSafeGitRels(BENIGN);
-    expect(safe).toEqual(BENIGN);
-    expect(refused).toEqual([]);
-  });
-
-  test('an all-hostile batch stages nothing rather than throwing', () => {
-    const { safe, refused } = partitionSafeGitRels(['../a', '/b', '..']);
-    expect(safe).toEqual([]);
-    expect(refused).toHaveLength(3);
-  });
-});

package/apps/studio/test/git-system-engine.test.ts

@@ -1,135 +0,0 @@
-// The engine a CELL actually runs — Cloud Phase 27 D2.
-//
-// WHY THIS FILE EXISTS. `MAUDE_USE_SYSTEM_GIT=1` used to be an escape hatch
-// nobody set, so `commitSystem` and the system-git halves of checkout / branch /
-// discard / fold had no coverage at all while their isomorphic-git twins had
-// plenty. D2 makes every cloud tenant's saves go through exactly those halves
-// (studio-child.mjs pins it, because two git engines over one index is not a
-// race a careful caller can avoid — it is two programs writing one file).
-//
-// Shipping that flip while its code path was the untested one would be trading a
-// known bug for an unmeasured one. These are the same assertions the iso engine
-// already gets, run against the engine the cloud uses.
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import {
-  gitCheckout,
-  gitCommit,
-  gitCreateBranch,
-  gitDiscard,
-  gitListBranches,
-  gitStatus,
-} from '../git/service.ts';
-
-let dir: string;
-let saved: string | undefined;
-
-function run(args: string[], cwd: string) {
-  const r = Bun.spawnSync(['git', ...args], { cwd });
-  return { code: r.exitCode, stdout: r.stdout.toString(), stderr: r.stderr.toString() };
-}
-
-beforeEach(() => {
-  saved = process.env.MAUDE_USE_SYSTEM_GIT;
-  // The whole point: the flag is read LIVE, so it can be scoped to this file
-  // instead of leaking into every other suite through a module-load const.
-  process.env.MAUDE_USE_SYSTEM_GIT = '1';
-
-  dir = mkdtempSync(join(tmpdir(), 'maude-system-git-'));
-  run(['init', '-b', 'main'], dir);
-  run(['config', 'user.name', 'Test'], dir);
-  run(['config', 'user.email', 'test@example.com'], dir);
-  mkdirSync(join(dir, '.design', 'ui'), { recursive: true });
-  writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 1;\n');
-  run(['add', '-A'], dir);
-  run(['commit', '-m', 'seed'], dir);
-});
-
-afterEach(() => {
-  if (saved === undefined) {
-    delete process.env.MAUDE_USE_SYSTEM_GIT;
-  } else process.env.MAUDE_USE_SYSTEM_GIT = saved;
-  rmSync(dir, { recursive: true, force: true });
-});
-
-describe('the system-git engine a cell runs on', () => {
-  test('a save commits exactly the selected file and nothing else', async () => {
-    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 2;\n');
-    writeFileSync(join(dir, '.design', 'ui', 'Other.tsx'), 'export const other = 1;\n');
-
-    const res = await gitCommit(dir, 'update home', ['.design/ui/Home.tsx'], {
-      designPrefix: '.design',
-    });
-    expect(res.ok).toBe(true);
-
-    // The other file is still uncommitted — "Save selected" must mean selected.
-    const after = await gitStatus(dir, { designPrefix: '.design' });
-    expect(after.files.map((f) => f.path)).toEqual(['.design/ui/Other.tsx']);
-  });
-
-  test('save-all commits every change in scope', async () => {
-    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 3;\n');
-    writeFileSync(join(dir, '.design', 'ui', 'New.tsx'), 'export const n = 1;\n');
-
-    const res = await gitCommit(dir, 'save all', undefined, { designPrefix: '.design' });
-    expect(res.ok).toBe(true);
-    expect((await gitStatus(dir, { designPrefix: '.design' })).clean).toBe(true);
-  });
-
-  test('nothing to save is a refusal, not an empty commit', async () => {
-    const before = run(['rev-list', '--count', 'HEAD'], dir).stdout.trim();
-    const res = await gitCommit(dir, 'nothing', undefined, { designPrefix: '.design' });
-    expect(res.ok).toBe(false);
-    expect(run(['rev-list', '--count', 'HEAD'], dir).stdout.trim()).toBe(before);
-  });
-
-  test('discard restores a tracked file and deletes an untracked one', async () => {
-    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'wrecked\n');
-    writeFileSync(join(dir, '.design', 'ui', 'Scratch.tsx'), 'temporary\n');
-
-    const res = await gitDiscard(dir, ['.design/ui/Home.tsx', '.design/ui/Scratch.tsx'], {
-      designPrefix: '.design',
-    });
-    expect(res.ok).toBe(true);
-    expect(readFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'utf8')).toBe(
-      'export const v = 1;\n'
-    );
-    expect(existsSync(join(dir, '.design', 'ui', 'Scratch.tsx'))).toBe(false);
-  });
-
-  test('a draft is created, switched to, and switched back', async () => {
-    const made = await gitCreateBranch(dir, 'nav-redesign');
-    expect(made.ok).toBe(true);
-    expect(run(['rev-parse', '--abbrev-ref', 'HEAD'], dir).stdout.trim()).toBe('nav-redesign');
-
-    const back = await gitCheckout(dir, 'main');
-    expect(back.ok).toBe(true);
-    expect(run(['rev-parse', '--abbrev-ref', 'HEAD'], dir).stdout.trim()).toBe('main');
-
-    expect((await gitListBranches(dir)).map((b) => b.name).sort()).toEqual([
-      'main',
-      'nav-redesign',
-    ]);
-  });
-
-  test('switching with unsaved changes says so instead of losing them', async () => {
-    await gitCreateBranch(dir, 'draft');
-    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 99;\n');
-    await gitCommit(dir, 'draft edit', undefined, { designPrefix: '.design' });
-    await gitCheckout(dir, 'main');
-
-    // Now dirty on main in a way the switch would clobber.
-    writeFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'export const v = 1000;\n');
-    const res = await gitCheckout(dir, 'draft');
-    expect(res.ok).toBe(false);
-    expect(res.error).toContain('Save your changes');
-    // The unsaved bytes are still there — the refusal is the point.
-    expect(readFileSync(join(dir, '.design', 'ui', 'Home.tsx'), 'utf8')).toBe(
-      'export const v = 1000;\n'
-    );
-  });
-});

package/apps/studio/test/git-watch.test.ts

@@ -1,97 +0,0 @@
-// Phase 27 Task 5 (E2) — live dirty-state broadcast.
-//
-// Unit: the `isVersionable` gate. Integration: boot a real server against a git
-// sandbox, open the inspector WS, edit a canvas `.tsx`, and prove a `git-status`
-// message with the changed file arrives — the "badge increments within 500 ms"
-// acceptance (generous 2 s ceiling for fs.watch + debounce + git on CI).
-
-import { describe, expect, test } from 'bun:test';
-import { writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { __testing } from '../git/watch.ts';
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-describe('git/watch — isVersionable', () => {
-  const { isVersionable } = __testing;
-  test('matches versionable design content', () => {
-    for (const p of [
-      'ui/Pricing.tsx',
-      'ui/Pricing.css',
-      'ui/Pricing.meta.json',
-      'ui-pricing.annotations.svg',
-      '_comments/ui-pricing.json',
-      '_annotations/ui-pricing.svg',
-    ]) {
-      expect(isVersionable(p)).toBe(true);
-    }
-  });
-  test('ignores non-versionable noise', () => {
-    for (const p of ['ui/fixture.html', 'notes.txt', '_server.json', 'README.md']) {
-      expect(isVersionable(p)).toBe(false);
-    }
-  });
-});
-
-function sh(dir: string, args: string[]) {
-  Bun.spawnSync(['git', ...args], {
-    cwd: dir,
-    env: { ...process.env, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null' },
-  });
-}
-
-describe('git/watch — live broadcast', () => {
-  test('editing a canvas .tsx broadcasts git-status with the changed file', async () => {
-    const { root, designRoot } = makeSandbox();
-    sh(root, ['init', '-q', '-b', 'main']);
-    sh(root, ['config', 'user.email', 'tester@maude.local']);
-    sh(root, ['config', 'user.name', 'Tester']);
-    sh(root, ['config', 'commit.gpgsign', 'false']);
-    sh(root, ['add', '-A']);
-    sh(root, ['commit', '-qm', 'seed']);
-
-    const port = nextPort();
-    const proc = await bootServer(root, port);
-    let socket: WebSocket | null = null;
-    try {
-      const messages: Array<{ type: string; payload?: { files?: Array<{ path: string }> } }> = [];
-      const sock = new WebSocket(`ws://localhost:${port}/_ws`);
-      socket = sock;
-      await new Promise<void>((res, rej) => {
-        sock.addEventListener('open', () => res());
-        sock.addEventListener('error', () => rej(new Error('ws error')));
-        setTimeout(() => rej(new Error('ws open timeout')), 2000);
-      });
-      sock.addEventListener('message', (ev) => {
-        try {
-          messages.push(JSON.parse(String(ev.data)));
-        } catch {
-          /* ignore non-JSON */
-        }
-      });
-
-      // Edit a NEW canvas .tsx — triggers fs:any → gitWatch → git-status.
-      writeFileSync(join(designRoot, 'ui', 'Live.tsx'), 'export default () => null\n');
-
-      // Poll for the broadcast (debounce 300 ms + git status latency).
-      const deadline = Date.now() + 2000;
-      let hit: (typeof messages)[number] | undefined;
-      while (Date.now() < deadline) {
-        hit = messages.find(
-          (m) =>
-            m.type === 'git-status' && m.payload?.files?.some((f) => f.path.endsWith('Live.tsx'))
-        );
-        if (hit) break;
-        await Bun.sleep(50);
-      }
-      expect(hit).toBeDefined();
-    } finally {
-      try {
-        socket?.close();
-      } catch {
-        /* ignore */
-      }
-      await killProc(proc);
-    }
-  }, 10_000);
-});