@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/remote-ahead-behind-cache.test.ts

@@ -1,89 +0,0 @@
-// DDR-132 — remote ahead/behind probe: in-memory TTL cache + in-flight dedupe.
-//
-// Verifies the cache WRAPPER (TTL-serve / invalidate / in-flight coalesce) fully
-// offline, with no network and no git spawn. Trick: the probe's DDR-131 transport
-// gate classifies a bare local-path remote as `unsafe`, so `remoteAheadBehind`
-// returns a FRESH `{ahead:0,behind:0}` object on every *uncached* evaluation
-// without touching the network. Object IDENTITY (`Object.is`) therefore tells a
-// cache-serve (same reference) apart from a re-run (new reference) — a stronger
-// signal than value equality, and one the security hardening can't invalidate.
-//
-// (The real fetch/count path needs a reachable github.com remote and is covered
-// by the manual native dogfood — same offline ceiling DDR-131 records for
-// `gitFetchRemote`. This file owns the wrapper semantics only.)
-//
-// This file deliberately does NOT set MAUDE_USE_SYSTEM_GIT (it would leak into the
-// shared bun-test process and flip other files' iso-engine expectations).
-
-import { afterEach, beforeEach, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { invalidateRemoteProbe, remoteAheadBehind } from '../git/service.ts';
-
-function git(cwd: string, args: string[]): void {
-  const p = Bun.spawnSync(['git', ...args], {
-    cwd,
-    env: { ...process.env, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null' },
-  });
-  if (p.exitCode !== 0) throw new Error(`git ${args.join(' ')}: ${p.stderr.toString()}`);
-}
-
-let work: string;
-
-beforeEach(() => {
-  work = mkdtempSync(join(tmpdir(), 'maude-ab-work-'));
-  git(work, ['init', '-q', '-b', 'main']);
-  git(work, ['config', 'user.email', 't@t.dev']);
-  git(work, ['config', 'user.name', 'Tester']);
-  writeFileSync(join(work, 'a.txt'), 'hello\n');
-  git(work, ['add', '.']);
-  git(work, ['commit', '-q', '-m', 'init']);
-  // A bare local path → DDR-131 transport gate classifies it `unsafe` → the probe
-  // returns {0,0} with no spawn. (Any value is fine; we assert on identity.)
-  git(work, ['remote', 'add', 'origin', '/var/empty/maude-test-remote']);
-});
-
-afterEach(() => {
-  invalidateRemoteProbe(work);
-  rmSync(work, { recursive: true, force: true });
-});
-
-test('a second call within the TTL serves the cached object (no re-run)', async () => {
-  const a = await remoteAheadBehind(work, undefined);
-  expect(a).toEqual({ ahead: 0, behind: 0 });
-  const b = await remoteAheadBehind(work, undefined);
-  expect(Object.is(a, b)).toBe(true); // same reference ⇒ served from cache
-});
-
-test('invalidateRemoteProbe forces a fresh evaluation (new object)', async () => {
-  const a = await remoteAheadBehind(work, undefined);
-  invalidateRemoteProbe(work);
-  const c = await remoteAheadBehind(work, undefined);
-  expect(c).toEqual({ ahead: 0, behind: 0 });
-  expect(Object.is(a, c)).toBe(false); // new reference ⇒ re-ran after invalidation
-});
-
-test('SECURITY (DDR-133 F1): the unattended probe never fetches a non-github HTTP remote', async () => {
-  // Repoint origin to a non-github HTTPS host (a poisoned `.git/config` riding a clone).
-  // With system git auto-preferred (DDR-133), the host-allowlist must gate this probe
-  // BEFORE the engine branch — otherwise an http transport reached `git fetch` against
-  // ANY host on the unattended 45s poll (SSRF / presence beacon). The guard returns
-  // {0,0} with NO spawn; a regression would attempt the fetch and reject/hang here.
-  git(work, ['remote', 'set-url', 'origin', 'https://evil.example.invalid/repo.git']);
-  invalidateRemoteProbe(work);
-  const r = await remoteAheadBehind(work, 'tok_must_never_be_sent');
-  expect(r).toEqual({ ahead: 0, behind: 0 });
-});
-
-test('concurrent callers coalesce onto one shared in-flight result', async () => {
-  const [a, b, c] = await Promise.all([
-    remoteAheadBehind(work, undefined),
-    remoteAheadBehind(work, undefined),
-    remoteAheadBehind(work, undefined),
-  ]);
-  // One shared in-flight promise (or the just-written cache) ⇒ identical reference,
-  // never three independent evaluations.
-  expect(Object.is(a, b)).toBe(true);
-  expect(Object.is(b, c)).toBe(true);
-});

package/apps/studio/test/reorder-api.test.ts

@@ -1,210 +0,0 @@
-// POST /_api/reorder round-trip (DDR-138, phase-12.1). Boots a real server,
-// serves a canvas (which injects data-cd-id + writes _locator.json), then drives
-// a node-move reorder through the HTTP layer and asserts: the source reorders on
-// disk, the response carries the recomputed movedId, a pre-reorder history
-// snapshot is written (so /design:rollback can undo it), and a cross-origin POST
-// is CSRF-rejected. Route unreachability from the canvas origin is proven
-// separately in canvas-origin-gate.test.ts.
-
-import { describe, expect, test } from 'bun:test';
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-const CANVAS_SRC = `export default function List() {
-  return (
-    <section>
-      <div>A</div>
-      <div>B</div>
-      <div>C</div>
-    </section>
-  );
-}
-`;
-
-/** After a GET of the canvas, read _locator.json and return the div ids ordered
- *  by source line (== authored order A, B, C). */
-async function divIdsByLine(main: string, designRoot: string): Promise<string[]> {
-  // Serving the canvas triggers pass-1 id injection + _locator.json write.
-  const r = await fetch(`${main}/.design/ui/List.tsx`, { signal: AbortSignal.timeout(2000) });
-  expect(r.status).toBe(200);
-  const locator = JSON.parse(readFileSync(join(designRoot, '_locator.json'), 'utf8'));
-  const map = locator['ui/List'] as Record<string, { line: number; jsxPath: string[] }>;
-  return Object.entries(map)
-    .filter(([, e]) => e.jsxPath[e.jsxPath.length - 1] === 'div')
-    .sort((a, b) => a[1].line - b[1].line)
-    .map(([id]) => id);
-}
-
-/** The visible letter order (A/B/C) in the on-disk source — reflects sibling order. */
-function letterOrder(src: string): string[] {
-  return [...src.matchAll(/>([ABC])</g)].map((m) => m[1] as string);
-}
-
-describe('POST /_api/reorder — HTTP round-trip', () => {
-  test('moves a sibling on disk, returns movedId, snapshots pre-reorder, CSRF-guards', async () => {
-    const { root, designRoot } = makeSandbox();
-    mkdirSync(join(designRoot, 'ui'), { recursive: true });
-    const canvasPath = join(designRoot, 'ui', 'List.tsx');
-    writeFileSync(canvasPath, CANVAS_SRC);
-
-    const port = nextPort();
-    const main = `http://localhost:${port}`;
-    const proc = await bootServer(root, port);
-    try {
-      const [aId, , cId] = await divIdsByLine(main, designRoot);
-
-      // Move A after C → order becomes B, C, A.
-      const res = await fetch(`${main}/_api/reorder`, {
-        method: 'POST',
-        // No Origin header → same-origin/programmatic; sameOriginWrite allows it.
-        body: JSON.stringify({ canvas: 'ui/List', id: aId, refId: cId, position: 'after' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(res.status).toBe(200);
-      const json = (await res.json()) as {
-        ok: boolean;
-        movedId: string | null;
-        semanticId: string | null;
-      };
-      expect(json.ok).toBe(true);
-      expect(json.movedId).toMatch(/^[0-9a-f]{8}$/);
-
-      // Source reordered on disk.
-      expect(letterOrder(readFileSync(canvasPath, 'utf8'))).toEqual(['B', 'C', 'A']);
-
-      // A pre-reorder snapshot landed under _history/ui-list/ (rollback path).
-      const histDir = join(designRoot, '_history', 'ui-list');
-      expect(existsSync(histDir)).toBe(true);
-      const metas = readdirSync(histDir)
-        .filter((f) => f.endsWith('.json'))
-        .map((f) => JSON.parse(readFileSync(join(histDir, f), 'utf8')) as { reason: string });
-      expect(metas.some((m) => m.reason === 'pre-reorder')).toBe(true);
-
-      // Cross-origin POST is CSRF-rejected (403), leaving the file untouched.
-      const forged = await fetch(`${main}/_api/reorder`, {
-        method: 'POST',
-        headers: { origin: 'http://evil.example' },
-        body: JSON.stringify({ canvas: 'ui/List', id: cId, refId: aId, position: 'before' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(forged.status).toBe(403);
-      expect(letterOrder(readFileSync(canvasPath, 'utf8'))).toEqual(['B', 'C', 'A']);
-
-      // A self-move is a 422 refusal (guardrail), not a 500.
-      const bad = await fetch(`${main}/_api/reorder`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/List', id: aId, refId: aId, position: 'after' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(bad.status).toBe(422);
-    } finally {
-      await killProc(proc);
-    }
-  });
-});
-
-describe('POST /_api/reorder-revert — Cmd+Z round-trip', () => {
-  test('undo restores the pre-reorder source, redo re-applies, stale content 409s', async () => {
-    const { root, designRoot } = makeSandbox();
-    mkdirSync(join(designRoot, 'ui'), { recursive: true });
-    const canvasPath = join(designRoot, 'ui', 'List.tsx');
-    writeFileSync(canvasPath, CANVAS_SRC);
-
-    const port = nextPort();
-    const main = `http://localhost:${port}`;
-    const proc = await bootServer(root, port);
-    try {
-      const [aId, , cId] = await divIdsByLine(main, designRoot);
-
-      // Reorder A after C → B, C, A; the response carries the revert-log seq.
-      const res = await fetch(`${main}/_api/reorder`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/List', id: aId, refId: cId, position: 'after' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      const json = (await res.json()) as { ok: boolean; seq: number };
-      expect(json.ok).toBe(true);
-      expect(typeof json.seq).toBe('number');
-      expect(letterOrder(readFileSync(canvasPath, 'utf8'))).toEqual(['B', 'C', 'A']);
-
-      // Undo → back to A, B, C.
-      const undo = await fetch(`${main}/_api/reorder-revert`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/List', seq: json.seq, dir: 'undo' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(undo.status).toBe(200);
-      expect(letterOrder(readFileSync(canvasPath, 'utf8'))).toEqual(['A', 'B', 'C']);
-
-      // Redo → B, C, A again.
-      const redo = await fetch(`${main}/_api/reorder-revert`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/List', seq: json.seq, dir: 'redo' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(redo.status).toBe(200);
-      expect(letterOrder(readFileSync(canvasPath, 'utf8'))).toEqual(['B', 'C', 'A']);
-
-      // External edit → undo refuses with 409 and leaves the file alone.
-      const edited = readFileSync(canvasPath, 'utf8').replace('>B<', '>B!<');
-      writeFileSync(canvasPath, edited);
-      const stale = await fetch(`${main}/_api/reorder-revert`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/List', seq: json.seq, dir: 'undo' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(stale.status).toBe(409);
-      expect(readFileSync(canvasPath, 'utf8')).toBe(edited);
-
-      // Unknown seq → 404; forged cross-origin POST → 403.
-      const missing = await fetch(`${main}/_api/reorder-revert`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/List', seq: 99999, dir: 'undo' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(missing.status).toBe(404);
-      const forged = await fetch(`${main}/_api/reorder-revert`, {
-        method: 'POST',
-        headers: { origin: 'http://evil.example' },
-        body: JSON.stringify({ canvas: 'ui/List', seq: json.seq, dir: 'undo' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(forged.status).toBe(403);
-    } finally {
-      await killProc(proc);
-    }
-  });
-});
-
-// Adversarial F3 (DDR-139): a REJECTED reorder must NOT deposit a _history
-// snapshot — the pre-move snapshot + revert-log are written only on a confirmed
-// write, so a stream of failing requests can't disk-fill _history.
-describe('POST /_api/reorder — a rejected move writes no snapshot', () => {
-  test('an unknown-refId reorder 422s and leaves _history empty', async () => {
-    const { root, designRoot } = makeSandbox();
-    mkdirSync(join(designRoot, 'ui'), { recursive: true });
-    writeFileSync(join(designRoot, 'ui', 'List.tsx'), CANVAS_SRC);
-    const port = nextPort();
-    const main = `http://localhost:${port}`;
-    const proc = await bootServer(root, port);
-    try {
-      const [aId] = await divIdsByLine(main, designRoot);
-      const bad = await fetch(`${main}/_api/reorder`, {
-        method: 'POST',
-        body: JSON.stringify({ canvas: 'ui/List', id: aId, refId: 'deadbeef', position: 'after' }),
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(bad.status).toBe(422); // refId not found → moveElement throws
-      // No pre-reorder snapshot was written (the move never landed).
-      const histDir = join(designRoot, '_history', 'ui-list');
-      const snaps = existsSync(histDir)
-        ? readdirSync(histDir).filter((f) => f.endsWith('.json'))
-        : [];
-      expect(snaps.length).toBe(0);
-    } finally {
-      await killProc(proc);
-    }
-  });
-});

package/apps/studio/test/repo-concurrency.test.ts

@@ -1,146 +0,0 @@
-// Cloud Phase 27 D2 — the concurrency test the plan asks for by name:
-// "a concurrency test that runs an autocommit against a live canvas write."
-//
-// REAL GIT, REAL FILES, REAL CONTENTION. Everything else in this suite injects
-// its git runner, which is right for asserting what the code MEANS to do and
-// useless for asserting what two processes over one index actually DO. The
-// failure this exists to catch does not reproduce against a fake: it is
-// `.git/index.lock` colliding, or a commit landing between another commit's
-// `add` and its `commit`.
-//
-// What is asserted, in the order it matters:
-//   1. NOTHING IS LOST. Every byte written during the storm is either committed
-//      or still in the working tree at the end. That is the tenant's data.
-//   2. THE REPO IS NOT CORRUPT. `git fsck` and a clean `git status` afterwards.
-//   3. NO LOCK IS LEFT BEHIND. Neither git's nor ours — a leaked lock is a
-//      history that silently stops.
-
-import { describe, expect, test } from 'bun:test';
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { REPO_LOCK_FILE, withRepoLock } from '../git/repo-lock.ts';
-import { createAutoCommit } from '../sync/autocommit.ts';
-
-/** The same shape the cell uses on both sides: shell out to system git. */
-async function run(args: string[], { cwd }: { cwd: string }) {
-  const proc = Bun.spawn(['git', ...args], { cwd, stdout: 'pipe', stderr: 'pipe' });
-  const [stdout, stderr] = await Promise.all([
-    new Response(proc.stdout).text(),
-    new Response(proc.stderr).text(),
-  ]);
-  return { code: await proc.exited, stdout, stderr };
-}
-
-async function makeRepo(): Promise<string> {
-  const root = mkdtempSync(join(tmpdir(), 'maude-repo-concurrency-'));
-  await run(['init', '-b', 'main'], { cwd: root });
-  await run(['config', 'user.name', 'Test'], { cwd: root });
-  await run(['config', 'user.email', 'test@example.com'], { cwd: root });
-  mkdirSync(join(root, '.design', 'ui'), { recursive: true });
-  writeFileSync(join(root, '.design', 'ui', 'seed.tsx'), 'export const seed = 0;\n');
-  await run(['add', '-A'], { cwd: root });
-  await run(['commit', '-m', 'seed'], { cwd: root });
-  return root;
-}
-
-/** Atomic, exactly like every real writer in this codebase. */
-function writeCanvas(root: string, rel: string, body: string): void {
-  const abs = join(root, rel);
-  const tmp = `${abs}.tmp`;
-  writeFileSync(tmp, body);
-  Bun.spawnSync(['mv', tmp, abs]);
-}
-
-describe('two writers, one checkout', () => {
-  test('an autocommit against a live canvas write loses nothing and corrupts nothing', async () => {
-    const root = await makeRepo();
-    try {
-      const auto = createAutoCommit({
-        repoRoot: root,
-        run,
-        debounceMs: 5,
-        log: { warn() {}, error() {}, log() {} },
-      });
-
-      // The storm: twelve rounds of "a designer typed, the doc flushed to disk,
-      // the hub noticed" — with a SECOND writer (the studio's own git verbs,
-      // here standing in as a lock-taking committer) cutting in throughout.
-      const rounds = 12;
-      const expected = new Map<string, string>();
-      const flights: Promise<unknown>[] = [];
-
-      for (let i = 0; i < rounds; i++) {
-        const rel = `.design/ui/canvas-${i % 4}.tsx`;
-        const body = `export const v = ${i};\n`;
-        writeCanvas(root, rel, body);
-        expected.set(rel, body);
-        auto.note(rel, { name: 'Alice', email: 'alice@example.com' });
-
-        if (i % 3 === 0) {
-          // The other process, doing what it does: taking the lock for a whole
-          // sequence and running git inside it.
-          flights.push(
-            withRepoLock(root, 'studio:commit', async () => {
-              await run(['add', '--', '.design'], { cwd: root });
-              await run(['commit', '-m', `studio ${i}`, '--allow-empty'], { cwd: root });
-            })
-          );
-        }
-        if (i % 2 === 0) flights.push(auto.flush());
-        await new Promise((r) => setTimeout(r, 3));
-      }
-
-      await Promise.all(flights);
-      await auto.flush();
-      auto.stop();
-
-      // 1. NOTHING IS LOST — every last write is on disk with the bytes we wrote.
-      for (const [rel, body] of expected) {
-        expect(readFileSync(join(root, rel), 'utf8')).toBe(body);
-      }
-
-      // 2. THE REPO IS NOT CORRUPT.
-      const fsck = await run(['fsck', '--no-progress'], { cwd: root });
-      expect(fsck.code).toBe(0);
-      const log = await run(['log', '--oneline'], { cwd: root });
-      expect(log.code).toBe(0);
-      expect(log.stdout.trim().split('\n').length).toBeGreaterThan(1);
-
-      // 3. NO LOCK LEFT BEHIND — neither git's nor ours.
-      expect(existsSync(join(root, '.git', 'index.lock'))).toBe(false);
-      expect(existsSync(join(root, '.git', REPO_LOCK_FILE))).toBe(false);
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  }, 30_000);
-
-  test('a commit sequence is never interleaved by another writer', async () => {
-    // The half-staged commit, precisely. Without a lock held ACROSS the
-    // sequence, the second writer's commit lands between the first's `add` and
-    // its `commit` and takes the staged file with it. `index.lock` cannot stop
-    // this — it is released the moment `add` returns.
-    const root = await makeRepo();
-    try {
-      const order: string[] = [];
-      const sequence = (name: string) =>
-        withRepoLock(root, `studio:${name}`, async () => {
-          order.push(`${name}:add`);
-          await run(['add', '-A'], { cwd: root });
-          await new Promise((r) => setTimeout(r, 25));
-          order.push(`${name}:commit`);
-          await run(['commit', '-m', name, '--allow-empty'], { cwd: root });
-        });
-
-      writeCanvas(root, '.design/ui/a.tsx', 'export const a = 1;\n');
-      await Promise.all([sequence('one'), sequence('two')]);
-
-      // add/commit/add/commit — never add/add/commit/commit.
-      expect(order[1]).toBe(order[0].replace(':add', ':commit'));
-      expect(order[3]).toBe(order[2].replace(':add', ':commit'));
-    } finally {
-      rmSync(root, { recursive: true, force: true });
-    }
-  }, 20_000);
-});