@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/sync-hardening.test.ts

@@ -1,586 +0,0 @@
-// DDR-054 hardening tests — Phase 9 Task 4 follow-up.
-//
-// Targets the 8 quick-win fixes recorded in DDR-054 §2 against the findings
-// in `.ai/logs/security-reviews/phase-9-task-4-bidi-fs-sync-{defender,attacker}.md`.
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  mkdtempSync,
-  readFileSync,
-  rmSync,
-  symlinkSync,
-  writeFileSync,
-} from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import * as Y from 'yjs';
-
-import { createCanvasSyncAgent } from '../sync/agent.ts';
-import { atomicWrite } from '../sync/atomic-write.ts';
-import {
-  applyAnnotationsToDoc,
-  applyCommentsToDoc,
-  applyHtmlToDoc,
-  htmlFromDoc,
-  MAX_ANNOTATIONS_BYTES,
-  MAX_COMMENTS_BYTES,
-  MAX_HTML_BYTES,
-} from '../sync/codec.ts';
-import { createEchoGuard, hashBytes } from '../sync/echo-guard.ts';
-import { createFsReader } from '../sync/fs-mirror.ts';
-import { checkUrlScheme, createSyncRuntime } from '../sync/index.ts';
-
-let dir: string;
-
-beforeEach(() => {
-  dir = mkdtempSync(join(tmpdir(), 'sync-hardening-'));
-});
-
-afterEach(() => {
-  rmSync(dir, { recursive: true, force: true });
-});
-
-/* ---------------------------------------------------------------- §2a CI guard */
-
-describe('DDR-054 §2a — CI environment gate', () => {
-  let savedCi: string | undefined;
-  let savedGha: string | undefined;
-  let savedOverride: string | undefined;
-
-  beforeEach(() => {
-    savedCi = process.env.CI;
-    savedGha = process.env.GITHUB_ACTIONS;
-    savedOverride = process.env.MAUDE_SYNC_IN_CI;
-    delete process.env.CI;
-    delete process.env.GITHUB_ACTIONS;
-    delete process.env.MAUDE_SYNC_IN_CI;
-  });
-
-  afterEach(() => {
-    if (savedCi === undefined) {
-      delete process.env.CI;
-    } else process.env.CI = savedCi;
-    if (savedGha === undefined) {
-      delete process.env.GITHUB_ACTIONS;
-    } else process.env.GITHUB_ACTIONS = savedGha;
-    if (savedOverride === undefined) {
-      delete process.env.MAUDE_SYNC_IN_CI;
-    } else process.env.MAUDE_SYNC_IN_CI = savedOverride;
-  });
-
-  function makeMinimalCtxLinked() {
-    const designRoot = join(dir, 'design');
-    mkdirSync(join(designRoot, 'ui'), { recursive: true });
-    return {
-      cfg: {
-        name: 't',
-        projectLabel: null,
-        designRoot: 'design',
-        canvasGroups: [{ label: 'Canvases', path: 'ui' }],
-        rootClass: 'app',
-        themeDefault: 'dark' as const,
-        tokensCssRel: 'system/x.css',
-        teamAccentDefault: null,
-        handoffTargets: [],
-        newCanvasDir: 'ui',
-        newComponentDir: 'ui/components',
-        linkedHub: { url: 'https://h.example.com', linkedAt: 1 },
-        _source: 'defaults' as const,
-      },
-      projectLabel: 't',
-      paths: {
-        repoRoot: dir,
-        designRel: 'design',
-        designRoot,
-        serverInfoFile: '',
-        activeFile: '',
-        commentsDir: join(designRoot, '_comments'),
-        canvasStateDir: '',
-        historyDir: '',
-        tokensUrlRel: '',
-        systemDirRel: 'system',
-      },
-      // biome-ignore lint/suspicious/noExplicitAny: minimal bus stub
-      bus: { on: () => () => {}, emit: () => {} } as any,
-    };
-  }
-
-  test('CI=true → createSyncRuntime returns null', () => {
-    process.env.CI = 'true';
-    expect(createSyncRuntime(makeMinimalCtxLinked())).toBeNull();
-  });
-
-  test('CI=1 → createSyncRuntime returns null', () => {
-    process.env.CI = '1';
-    expect(createSyncRuntime(makeMinimalCtxLinked())).toBeNull();
-  });
-
-  test('GITHUB_ACTIONS=true → createSyncRuntime returns null', () => {
-    process.env.GITHUB_ACTIONS = 'true';
-    expect(createSyncRuntime(makeMinimalCtxLinked())).toBeNull();
-  });
-
-  test('MAUDE_SYNC_IN_CI=1 overrides the CI gate (still null because no token, but past the CI check)', () => {
-    process.env.CI = 'true';
-    process.env.MAUDE_SYNC_IN_CI = '1';
-    // Will return null because no token in hubs.json — but the CI gate
-    // didn't short-circuit. Asserting null here is technically the same
-    // shape, so we instead verify by injecting a token path.
-    // Easier: verify the gate logic with a missing-token path.
-    expect(createSyncRuntime(makeMinimalCtxLinked())).toBeNull();
-    // Note: the meaningful assertion is "didn't print [sync] disabled in CI"
-    // which is implicit by code path — this test exists as a regression net
-    // against accidentally removing the override.
-  });
-});
-
-/* ------------------------------------------- Phase 27 D2 — a cell owns its history */
-
-describe('Cloud Phase 27 D2 — a workspace cell ignores the tenant´s linkedHub', () => {
-  let saved: string | undefined;
-
-  beforeEach(() => {
-    saved = process.env.MAUDE_WORKSPACE_MODE;
-  });
-  afterEach(() => {
-    if (saved === undefined) {
-      delete process.env.MAUDE_WORKSPACE_MODE;
-    } else process.env.MAUDE_WORKSPACE_MODE = saved;
-  });
-
-  function linkedCtx() {
-    const designRoot = join(dir, 'design');
-    mkdirSync(join(designRoot, 'ui'), { recursive: true });
-    return {
-      cfg: {
-        name: 't',
-        projectLabel: null,
-        designRoot: 'design',
-        canvasGroups: [{ label: 'Canvases', path: 'ui' }],
-        rootClass: 'app',
-        themeDefault: 'dark' as const,
-        tokensCssRel: 'system/x.css',
-        teamAccentDefault: null,
-        handoffTargets: [],
-        newCanvasDir: 'ui',
-        newComponentDir: 'ui/components',
-        // The TENANT's committed config, carrying whatever hub their desktop
-        // was linked to. It is versioned, so it arrives in the cell with the
-        // checkout.
-        linkedHub: { url: 'https://someone-elses-hub.example.com', linkedAt: 1 },
-        _source: 'defaults' as const,
-      },
-      projectLabel: 't',
-      paths: {
-        repoRoot: dir,
-        designRel: 'design',
-        designRoot,
-        serverInfoFile: '',
-        activeFile: '',
-        commentsDir: join(designRoot, '_comments'),
-        canvasStateDir: '',
-        historyDir: '',
-        tokensUrlRel: '',
-        systemDirRel: 'system',
-      },
-      // biome-ignore lint/suspicious/noExplicitAny: minimal bus stub
-      bus: { on: () => () => {}, emit: () => {} } as any,
-    };
-  }
-
-  test('in a cell it refuses, and says which authority won', () => {
-    // Honouring the tenant's `linkedHub` inside a cell would dial OUT to a
-    // third-party hub carrying their canvases, and start a SECOND autocommit
-    // over the tree the hub is already committing. Both were unreachable by
-    // accident (no `~/.config/maude/hubs.json` in a cell), and an accident is
-    // not an invariant.
-    const warned: string[] = [];
-    const original = console.warn;
-    console.warn = (...args: unknown[]) => warned.push(args.map(String).join(' '));
-    process.env.MAUDE_WORKSPACE_MODE = '1';
-    try {
-      expect(createSyncRuntime(linkedCtx())).toBeNull();
-      // Not just null — null for THIS reason. Without the message this test
-      // would pass on the missing-token path it is meant to precede.
-      expect(warned.join(' ')).toContain('the hub owns history');
-    } finally {
-      console.warn = original;
-    }
-  });
-});
-
-/* ---------------------------------------------------------------- §2b .tsx refusal */
-
-// Coverage moved to sync-runtime.test.ts > discoverCanvases >
-// "finds .html files but EXCLUDES .tsx" — kept centralized with the discovery
-// fixture there. This stub asserts the file at hand documents the location.
-describe('DDR-054 §2b — .tsx refusal in sync discovery', () => {
-  test('coverage location: sync-runtime.test.ts discoverCanvases EXCLUDES .tsx', () => {
-    expect(true).toBe(true);
-  });
-});
-
-/* ---------------------------------------------------------------- §2c symlink-safe write */
-
-describe('DDR-054 §2c — atomic-write symlink/EXCL hardening', () => {
-  test('fails when tmp path already exists (O_EXCL)', () => {
-    // Pre-create a file matching the predictable prefix shape we'd race for.
-    // 128-bit suffix makes prediction infeasible — instead we test the
-    // primitive: stage a tmp file at a path the function would attempt, then
-    // verify the function refuses to write through it.
-    const target = join(dir, 'a.html');
-    const fakeTmp = `${target}.tmp.0000000000000000000000000000000000`; // 32 hex chars
-    writeFileSync(fakeTmp, 'pre-existing');
-    // The function picks a random suffix so collisions are negligible, but
-    // we verify the 'wx' open flag rejects a pre-existing file by directly
-    // pointing atomicWrite at the same predictable path via a wrapper test:
-    // here, just confirm atomicWrite still works alongside an unrelated pre-
-    // existing tmp file (sanity that the random suffix doesn't collide).
-    atomicWrite(target, 'final');
-    expect(readFileSync(target, 'utf8')).toBe('final');
-    // The pre-existing fake tmp is untouched.
-    expect(readFileSync(fakeTmp, 'utf8')).toBe('pre-existing');
-  });
-
-  test('does not follow symlinks at the target path (overwrites the file, not the link target)', () => {
-    // POSIX renameSync replaces the symlink with the new file atomically;
-    // the original target of the symlink is NOT clobbered. This is the
-    // hardened behavior we want. Skip on Windows where symlinks need
-    // elevation.
-    if (process.platform === 'win32') return;
-    const linkTarget = join(dir, 'sensitive.txt');
-    writeFileSync(linkTarget, 'SECRET');
-    const canvas = join(dir, 'canvas.html');
-    symlinkSync(linkTarget, canvas);
-    atomicWrite(canvas, 'new-content');
-    // The link is replaced with a regular file containing the new content.
-    expect(readFileSync(canvas, 'utf8')).toBe('new-content');
-    // The original sensitive file is untouched.
-    expect(readFileSync(linkTarget, 'utf8')).toBe('SECRET');
-  });
-
-  test('tmp file is created with mode 0600 (owner-only readable)', () => {
-    if (process.platform === 'win32') return;
-    const target = join(dir, 'b.html');
-    atomicWrite(target, 'hi');
-    // The tmp is renamed away before we can stat it, so we verify the FINAL
-    // file's mode reflects the staged 0600. Bun/Node renameSync preserves
-    // mode from the source file.
-    const stats = require('node:fs').statSync(target);
-    expect((stats.mode & 0o777).toString(8)).toBe('600');
-  });
-});
-
-/* ---------------------------------------------------------------- §2d size caps */
-
-describe('DDR-054 §2d — codec size caps', () => {
-  test('applyHtmlToDoc refuses oversize content', () => {
-    const doc = new Y.Doc();
-    applyHtmlToDoc(doc, 'seed');
-    const huge = 'x'.repeat(MAX_HTML_BYTES + 1);
-    const changed = applyHtmlToDoc(doc, huge);
-    expect(changed).toBe(false);
-    expect(htmlFromDoc(doc)).toBe('seed');
-  });
-
-  test('applyCommentsToDoc refuses oversize serialized payload', () => {
-    const doc = new Y.Doc();
-    // Generate a comments array whose JSON serialization exceeds the cap.
-    const huge = Array.from({ length: 100_000 }, (_, i) => ({
-      id: `c${i}`,
-      body: 'x'.repeat(200),
-    }));
-    const changed = applyCommentsToDoc(doc, huge);
-    expect(changed).toBe(false);
-    expect(doc.getArray('comments').length).toBe(0);
-  });
-
-  test('applyAnnotationsToDoc refuses oversize SVG', () => {
-    const doc = new Y.Doc();
-    const huge = `<svg>${'x'.repeat(MAX_ANNOTATIONS_BYTES + 1)}</svg>`;
-    const changed = applyAnnotationsToDoc(doc, huge);
-    expect(changed).toBe(false);
-  });
-
-  test('caps are exported (consumers can reference them)', () => {
-    expect(MAX_HTML_BYTES).toBe(4 * 1024 * 1024);
-    expect(MAX_COMMENTS_BYTES).toBe(1024 * 1024);
-    expect(MAX_ANNOTATIONS_BYTES).toBe(1024 * 1024);
-  });
-});
-
-/* ---------------------------------------------------------------- §2e scheme allowlist */
-
-describe('DDR-054 §2e — scheme allowlist', () => {
-  test('accepts https://', () => {
-    expect(checkUrlScheme('https://hub.example.com')).toBeNull();
-  });
-
-  test('accepts wss://', () => {
-    expect(checkUrlScheme('wss://hub.example.com')).toBeNull();
-  });
-
-  test('accepts http://localhost (loopback dev)', () => {
-    expect(checkUrlScheme('http://localhost:1234')).toBeNull();
-    expect(checkUrlScheme('http://127.0.0.1:1234')).toBeNull();
-  });
-
-  test('accepts ws://localhost (loopback dev)', () => {
-    expect(checkUrlScheme('ws://localhost:1234')).toBeNull();
-  });
-
-  test('refuses http:// to a non-loopback host', () => {
-    const err = checkUrlScheme('http://hub.example.com');
-    expect(err).not.toBeNull();
-    expect(err).toContain('plaintext');
-  });
-
-  test('refuses ws:// to a non-loopback host', () => {
-    const err = checkUrlScheme('ws://hub.example.com');
-    expect(err).not.toBeNull();
-    expect(err).toContain('plaintext');
-  });
-
-  test('refuses unsupported schemes', () => {
-    const err = checkUrlScheme('file:///etc/passwd');
-    expect(err).not.toBeNull();
-    expect(err).toContain('unsupported');
-  });
-
-  test('refuses malformed URL', () => {
-    const err = checkUrlScheme('not a url');
-    expect(err).not.toBeNull();
-    expect(err).toContain('invalid');
-  });
-});
-
-/* ---------------------------------------------------------------- §2f path containment */
-
-describe('DDR-054 §2f — fs-mirror path containment', () => {
-  test('rejects relative paths with .. segments before arming the timer', async () => {
-    let fired = false;
-    const r = createFsReader({
-      rootDir: dir,
-      quietMs: 10,
-      accept: () => true,
-      onRead: () => {
-        fired = true;
-      },
-    });
-    r.notify('../etc/passwd');
-    r.notify('foo/../../etc/passwd');
-    expect(r.pending()).toBe(0);
-    await new Promise((res) => setTimeout(res, 30));
-    expect(fired).toBe(false);
-    r.stop();
-  });
-
-  test('rejects absolute paths', async () => {
-    let fired = false;
-    const r = createFsReader({
-      rootDir: dir,
-      quietMs: 10,
-      accept: () => true,
-      onRead: () => {
-        fired = true;
-      },
-    });
-    r.notify('/etc/passwd');
-    expect(r.pending()).toBe(0);
-    await new Promise((res) => setTimeout(res, 30));
-    expect(fired).toBe(false);
-    r.stop();
-  });
-
-  test('accepts normal in-tree paths', async () => {
-    writeFileSync(join(dir, 'ok.html'), 'ok');
-    let fired = false;
-    const r = createFsReader({
-      rootDir: dir,
-      quietMs: 10,
-      accept: () => true,
-      onRead: () => {
-        fired = true;
-      },
-    });
-    r.notify('ok.html');
-    await new Promise((res) => setTimeout(res, 40));
-    expect(fired).toBe(true);
-    r.stop();
-  });
-});
-
-/* ---------------------------------------------------------------- §2g JSON reviver */
-
-describe('DDR-054 §2g — JSON.parse __proto__ reviver in agent', () => {
-  test('strips __proto__ key from parsed comments JSON', () => {
-    const doc = new Y.Doc();
-    const echoGuard = createEchoGuard();
-    const paths = {
-      html: join(dir, 'screen.html'),
-      comments: join(dir, '_comments', 'screen.json'),
-      annotations: join(dir, 'screen.annotations.svg'),
-    };
-    const agent = createCanvasSyncAgent({
-      slug: 'screen',
-      doc,
-      paths,
-      echoGuard,
-      flushMs: 0,
-    });
-    agent.start();
-
-    // Malicious comments JSON containing __proto__ + constructor + prototype
-    // keys. The reviver returns undefined for these, so the parsed objects
-    // lose those keys before they get pushed into Y.Array.
-    const malicious = JSON.stringify([
-      { id: 'c1', __proto__: { polluted: true }, body: 'ok' },
-      { id: 'c2', constructor: { hijacked: true } },
-      { id: 'c3', prototype: { tainted: true } },
-    ]);
-    const bytes = new TextEncoder().encode(malicious);
-    agent.applyFromFs({
-      path: paths.comments,
-      bytes,
-      hash: hashBytes(bytes),
-    });
-
-    const arr = doc.getArray('comments').toArray() as Array<Record<string, unknown>>;
-    expect(arr.length).toBe(3);
-    expect(arr[0]).toEqual({ id: 'c1', body: 'ok' });
-    expect(arr[1]).toEqual({ id: 'c2' });
-    expect(arr[2]).toEqual({ id: 'c3' });
-    // Most importantly — no prototype pollution.
-    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
-    agent.stop();
-  });
-});
-
-/* ---------------------------------------------------------------- §2h hubs mode warn */
-
-// Coverage in sync-hubs-config.test.ts > "warns once when hubs.json is
-// world/group readable" — kept centralized with the hubs-config fixture.
-describe('DDR-054 §2h — hubs.json mode warning', () => {
-  test('coverage location: sync-hubs-config.test.ts mode-warning case', () => {
-    expect(true).toBe(true);
-  });
-});
-
-/* ---------------------------------------------------------------- §2i auto-clear adopt */
-
-describe('DDR-054 §2i — auto-clear adopt after first success', () => {
-  // The clearAdoptFlag function is invoked at the end of adopt reconcile.
-  // We verify the behavior end-to-end through the runtime tests
-  // (sync-runtime.test.ts > "adopt mode") asserts the doc receives local
-  // state. Adding the disk-side assertion here keeps the §2i contract
-  // pinned: after a successful adopt, the .design/config.json file no
-  // longer has the `adopt` flag set.
-  //
-  // Lighter test here — just verify that running with a config that has
-  // adopt:true, after a successful adopt against in-memory provider,
-  // updates the on-disk config file.
-  //
-  // Full integration is covered by the sync-runtime "adopt mode" test
-  // composed with this disk assertion (kept in this file to localize the
-  // §2i logic verification).
-  test('clears adopt:true from .design/config.json after all canvases reconcile', async () => {
-    // We exercise the boot path via createSyncRuntime so the auto-clear
-    // logic in sync/index.ts fires.
-    const designRoot = join(dir, 'design');
-    mkdirSync(join(designRoot, 'ui'), { recursive: true });
-    mkdirSync(join(dir, '.design'), { recursive: true });
-    const cfgPath = join(dir, '.design', 'config.json');
-    const initial = {
-      name: 't',
-      designRoot: 'design',
-      linkedHub: { url: 'https://h.example.com', linkedAt: 1, adopt: true },
-    };
-    writeFileSync(cfgPath, `${JSON.stringify(initial, null, 2)}\n`);
-    writeFileSync(join(designRoot, 'ui', 'a.html'), '<button>local</button>');
-
-    // Stub hubs.json with a valid token so the runtime gets past the token
-    // check.
-    const hubsPath = join(dir, 'hubs.json');
-    writeFileSync(
-      hubsPath,
-      JSON.stringify({ hubs: { 'https://h.example.com': { token: 'tok', linkedAt: 1 } } })
-    );
-    chmodSync(hubsPath, 0o600);
-    const savedHubsEnv = process.env.HUBS_CONFIG_PATH;
-    process.env.HUBS_CONFIG_PATH = hubsPath;
-    const savedCi = process.env.CI;
-    delete process.env.CI;
-
-    try {
-      const ctx = {
-        cfg: {
-          name: 't',
-          projectLabel: null,
-          designRoot: 'design',
-          canvasGroups: [{ label: 'Canvases', path: 'ui' }],
-          rootClass: 'app',
-          themeDefault: 'dark' as const,
-          tokensCssRel: 'system/x.css',
-          teamAccentDefault: null,
-          handoffTargets: [],
-          newCanvasDir: 'ui',
-          newComponentDir: 'ui/components',
-          linkedHub: initial.linkedHub,
-          _source: '.design/config.json' as const,
-        },
-        projectLabel: 't',
-        paths: {
-          repoRoot: dir,
-          designRel: 'design',
-          designRoot,
-          serverInfoFile: '',
-          activeFile: '',
-          commentsDir: join(designRoot, '_comments'),
-          canvasStateDir: '',
-          historyDir: '',
-          tokensUrlRel: '',
-          systemDirRel: 'system',
-        },
-        // biome-ignore lint/suspicious/noExplicitAny: minimal bus stub
-        bus: { on: () => () => {}, emit: () => {} } as any,
-      };
-
-      const runtime = createSyncRuntime(ctx, {
-        providerFactory: () => {
-          const local = new Y.Doc();
-          return {
-            document: local,
-            async onceSynced() {},
-            destroy() {
-              local.destroy();
-            },
-          };
-        },
-      });
-      expect(runtime).not.toBeNull();
-      await runtime?.start();
-      // Adopt reconcile is async via onceSynced().then() — give it a tick.
-      await new Promise((res) => setTimeout(res, 30));
-      await runtime?.stop();
-
-      // .design/config.json should no longer have linkedHub.adopt set.
-      const after = JSON.parse(readFileSync(cfgPath, 'utf8'));
-      expect(after.linkedHub.adopt).toBeUndefined();
-      expect(typeof after.linkedHub.lastAdoptedAt).toBe('number');
-    } finally {
-      if (savedHubsEnv === undefined) {
-        delete process.env.HUBS_CONFIG_PATH;
-      } else process.env.HUBS_CONFIG_PATH = savedHubsEnv;
-      if (savedCi !== undefined) process.env.CI = savedCi;
-    }
-  });
-});
-
-/* ---------------------------------------------------------------- helpers */
-
-// Re-imports used only as type-place-holders in the file's prelude; suppress
-// the unused-import lint for clarity.
-const _refs = { existsSync };

package/apps/studio/test/sync-hub-listing.test.ts

@@ -1,46 +0,0 @@
-// The hub's listing, and the one question the seed asks of it.
-//
-// THE FINDING (attacker seat, 2026-08-19, HIGH). The listing was indexed by
-// `slugFromDocName`, which strips `ws/<workspace>/<branch>/`, while
-// `diffRemoteDocs` — fed the SAME listing twelve lines later — compares full
-// document names. So a `hero` on `main` answered for another peer's `hero` on
-// `feat/x`: that peer's cold-start seed returned `defer-hub-state` forever,
-// logging that the hub's state was on its way, and the canvas never synced in
-// either direction. Peer tokens are commonly `scope: '*'`, so one listing spans
-// every namespace on the hub — no hostile hub required, one teammate reusing a
-// canvas name on another branch is the whole exploit.
-
-import { describe, expect, test } from 'bun:test';
-
-import { hubHolds, indexHubDocs } from '../sync/hub-listing.ts';
-
-describe('the hub listing index', () => {
-  test('a same-slug document in ANOTHER namespace does not answer for mine', () => {
-    const index = indexHubDocs([{ name: 'ws/acme/main/ui-hero', bytes: 2931 }]);
-    expect(hubHolds(index, 'ws/acme/feat-x/ui-hero')).toBe(false);
-    expect(hubHolds(index, 'ws/acme/main/ui-hero')).toBe(true);
-  });
-
-  test('a legacy flat name is its own key, not a match for a namespaced one', () => {
-    const index = indexHubDocs([{ name: 'ui-hero', bytes: 10 }]);
-    expect(hubHolds(index, 'ws/acme/main/ui-hero')).toBe(false);
-    expect(hubHolds(index, 'ui-hero')).toBe(true);
-  });
-
-  test('a row that exists but carries nothing is not state', () => {
-    // Deferring to an empty document would leave a canvas that never syncs in
-    // either direction — the document exists, and holds none of the work.
-    const index = indexHubDocs([{ name: 'ui-hero', bytes: 0 }, { name: 'ui-other' }]);
-    expect(hubHolds(index, 'ui-hero')).toBe(false);
-    expect(hubHolds(index, 'ui-other')).toBe(false);
-  });
-
-  test('an unnamed row is dropped rather than coerced into a blank key', () => {
-    const index = indexHubDocs([
-      { name: '', bytes: 5 },
-      { name: undefined as unknown as string, bytes: 5 },
-    ]);
-    expect(index.size).toBe(0);
-    expect(hubHolds(index, '')).toBe(false);
-  });
-});