@1agh/maude 1.0.11 → 1.3.0

package/apps/studio/test/assets-s3.test.ts

@@ -1,249 +0,0 @@
-// Cloud Phase 3 Task 2 — the S3/R2 asset lane.
-//
-// Exercised against a live in-process S3-shaped server rather than MinIO: the
-// properties worth proving are content-addressing, verification of bytes
-// received from a semi-trusted hub, and never failing a local save because a
-// bucket was unreachable. None of those need a storage vendor.
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-
-import { createServer, type Server } from 'node:http';
-import type { AddressInfo } from 'node:net';
-// The HUB's independent SigV4 implementation — imported to pin the two against
-// each other, exactly as the doc-namespace grammars are pinned.
-import { signRequest as hubSignRequest } from '../../hub/src/s3.mjs';
-import {
-  createAssetMirror,
-  type S3Config,
-  s3ConfigFromEnv,
-  sha8,
-  sha8FromAssetPath,
-  signRequest,
-  verifyAssetBytes,
-} from '../assets-s3.ts';
-
-let server: Server;
-let store: Map<string, Uint8Array>;
-let seenAuth: string[];
-let cfg: S3Config;
-
-beforeAll(async () => {
-  store = new Map();
-  seenAuth = [];
-  server = createServer((req, res) => {
-    seenAuth.push(req.headers.authorization ?? '');
-    const key = decodeURIComponent(
-      new URL(req.url ?? '/', 'http://x').pathname.replace('/maude-assets/', '')
-    );
-    if (req.method === 'PUT') {
-      const chunks: Buffer[] = [];
-      req.on('data', (c) => chunks.push(c));
-      req.on('end', () => {
-        store.set(key, new Uint8Array(Buffer.concat(chunks)));
-        res.writeHead(200).end();
-      });
-      return;
-    }
-    if (req.method === 'HEAD') {
-      res.writeHead(store.has(key) ? 200 : 404).end();
-      return;
-    }
-    if (req.method === 'GET') {
-      const body = store.get(key);
-      if (!body) {
-        res.writeHead(404).end();
-        return;
-      }
-      res.writeHead(200).end(Buffer.from(body));
-      return;
-    }
-    res.writeHead(405).end();
-  });
-  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
-  cfg = {
-    endpoint: `http://127.0.0.1:${(server.address() as AddressInfo).port}`,
-    bucket: 'maude-assets',
-    accessKeyId: 'AKIAEXAMPLE',
-    secretAccessKey: 'secret',
-    region: 'auto',
-  };
-});
-
-afterAll(async () => {
-  await new Promise<void>((resolve) => server.close(() => resolve()));
-});
-
-const bytesFor = (s: string) => new TextEncoder().encode(s);
-const assetPath = (b: Uint8Array, ext = 'png') => `assets/${sha8(b)}.${ext}`;
-
-describe('content addressing', () => {
-  test('sha8 is stable and differs for different bytes', () => {
-    const a = bytesFor('hello');
-    expect(sha8(a)).toBe(sha8(new Uint8Array(a)));
-    expect(sha8(a)).not.toBe(sha8(bytesFor('hellp')));
-    expect(sha8(a)).toMatch(/^[0-9a-f]{8}$/);
-  });
-
-  test('sha8FromAssetPath accepts content-addressed paths and refuses others', () => {
-    expect(sha8FromAssetPath('assets/deadbeef.png')).toBe('deadbeef');
-    expect(sha8FromAssetPath('assets/deadbeef')).toBe('deadbeef');
-    expect(sha8FromAssetPath('assets/deadbeef.mp4')).toBe('deadbeef');
-    // The shapes the REAL corpus contains beyond saveAsset's own output — a
-    // dotted sidecar and hash+label ingested footage. A stricter pattern
-    // classified these as "not content addressed", which made the mirror
-    // refuse legitimate assets as unverifiable.
-    expect(sha8FromAssetPath('assets/deadbeef.photo.json')).toBe('deadbeef');
-    expect(sha8FromAssetPath('assets/deadbeef.footage.json')).toBe('deadbeef');
-    expect(sha8FromAssetPath('assets/deadbeef-cloud.mp4')).toBe('deadbeef');
-    expect(sha8FromAssetPath('assets/deadbeef-cloud.srt')).toBe('deadbeef');
-    // Legacy / hand-placed / traversal shapes are not content-addressed. The
-    // 8 hex chars must be a COMPLETE token — `deadbeef1` is a different name.
-    expect(sha8FromAssetPath('assets/my-photo.png')).toBe(null);
-    expect(sha8FromAssetPath('assets/DEADBEEF.png')).toBe(null);
-    expect(sha8FromAssetPath('assets/deadbeef1.png')).toBe(null);
-    expect(sha8FromAssetPath('assets/deadbeefcafe.png')).toBe(null);
-    expect(sha8FromAssetPath('assets/sub/deadbeef.png')).toBe(null);
-    expect(sha8FromAssetPath('../assets/deadbeef.png')).toBe(null);
-    expect(sha8FromAssetPath('')).toBe(null);
-  });
-
-  test('verifyAssetBytes is the check that makes a semi-trusted hub usable', () => {
-    const bytes = bytesFor('the real image');
-    const path = assetPath(bytes);
-    expect(verifyAssetBytes(path, bytes)).toBe(true);
-    // ...including the labelled and sidecar shapes.
-    expect(verifyAssetBytes(`assets/${sha8(bytes)}-cloud.mp4`, bytes)).toBe(true);
-    expect(verifyAssetBytes(`assets/${sha8(bytes)}.photo.json`, bytes)).toBe(true);
-    // Substituted content under the same name — the attack DDR-054 describes.
-    expect(verifyAssetBytes(path, bytesFor('malicious replacement'))).toBe(false);
-    // A path with no content address cannot be verified, so it is not trusted.
-    expect(verifyAssetBytes('assets/logo.png', bytes)).toBe(false);
-  });
-});
-
-describe('config', () => {
-  test('an unconfigured lane is the default, not an error', () => {
-    expect(s3ConfigFromEnv({})).toBe(null);
-    // Partial config must not half-enable the lane.
-    expect(s3ConfigFromEnv({ MAUDE_S3_BUCKET: 'b', MAUDE_S3_ENDPOINT: 'e' })).toBe(null);
-    const mirror = createAssetMirror(null);
-    expect(mirror.configured).toBe(false);
-  });
-
-  test('a full env set configures it, trailing slash trimmed, region defaulted', () => {
-    const resolved = s3ConfigFromEnv({
-      MAUDE_S3_ENDPOINT: 'https://acct.r2.cloudflarestorage.com/',
-      MAUDE_S3_BUCKET: 'maude-assets',
-      MAUDE_S3_ACCESS_KEY_ID: 'AKIA',
-      MAUDE_S3_SECRET_ACCESS_KEY: 'secret',
-    });
-    expect(resolved?.endpoint).toBe('https://acct.r2.cloudflarestorage.com');
-    expect(resolved?.region).toBe('auto');
-  });
-});
-
-describe('SigV4 — pinned against the hub implementation', () => {
-  test('studio and hub sign the same request identically', () => {
-    // Two independent implementations in two independently-built packages. If
-    // they drift, one of them is wrong against real R2 and nobody would notice
-    // until a deploy.
-    const shared = {
-      endpoint: 'https://acct.r2.cloudflarestorage.com',
-      bucket: 'maude-assets',
-      accessKeyId: 'AKIAEXAMPLE',
-      secretAccessKey: 'wJalrXUtnFEMI',
-      region: 'auto',
-    };
-    const now = new Date('2026-07-28T20:30:00Z');
-    for (const key of ['assets/deadbeef.png', 'assets/a b+c!.png', 'assets/ünïcode.png']) {
-      for (const body of [null, bytesFor('payload')]) {
-        const mine = signRequest(shared, { method: 'PUT', key, body, now });
-        const theirs = hubSignRequest(shared, { method: 'PUT', key, body, now });
-        expect(mine.headers.authorization).toBe(theirs.headers.authorization);
-        expect(mine.url).toBe(theirs.url);
-      }
-    }
-  });
-
-  test('the payload is signed, so different bytes give a different signature', () => {
-    const now = new Date('2026-07-28T20:30:00Z');
-    const a = signRequest(cfg, { method: 'PUT', key: 'assets/x.png', body: bytesFor('a'), now });
-    const b = signRequest(cfg, { method: 'PUT', key: 'assets/x.png', body: bytesFor('b'), now });
-    expect(a.headers.authorization).not.toBe(b.headers.authorization);
-  });
-});
-
-describe('the mirror, against a live S3-shaped server', () => {
-  test('push then pull round-trips, and every request is signed', async () => {
-    const mirror = createAssetMirror(cfg);
-    const bytes = bytesFor('a small png, pretend');
-    const rel = assetPath(bytes);
-
-    expect(await mirror.push(rel, bytes)).toBe(true);
-    expect(await mirror.has(rel)).toBe(true);
-    const pulled = await mirror.pull(rel);
-    expect(pulled).not.toBe(null);
-    expect([...(pulled ?? [])]).toEqual([...bytes]);
-
-    expect(seenAuth.length).toBeGreaterThan(0);
-    expect(seenAuth.every((a) => a.startsWith('AWS4-HMAC-SHA256 Credential='))).toBe(true);
-  });
-
-  test('push is idempotent — content addressing means a re-push is a no-op', async () => {
-    const mirror = createAssetMirror(cfg);
-    const bytes = bytesFor('idempotent content');
-    const rel = assetPath(bytes);
-    expect(await mirror.push(rel, bytes)).toBe(true);
-    const sizeAfterFirst = store.size;
-    expect(await mirror.push(rel, bytes)).toBe(true);
-    expect(store.size).toBe(sizeAfterFirst);
-  });
-
-  test('a missing object pulls as null, not an error', async () => {
-    const mirror = createAssetMirror(cfg);
-    expect(await mirror.pull('assets/00000000.png')).toBe(null);
-    expect(await mirror.has('assets/00000000.png')).toBe(false);
-  });
-
-  test('SUBSTITUTED bytes are REFUSED — the hub cannot swap an asset', async () => {
-    // Plant content under a name it does not hash to, exactly as a compromised
-    // or malicious hub would. The pull must refuse rather than write it to disk,
-    // where it would poison every peer that later mirrors from us.
-    const honest = bytesFor('the real asset');
-    const rel = assetPath(honest);
-    store.set(rel, bytesFor('malicious replacement of the same length!!'));
-
-    const warnings: string[] = [];
-    const mirror = createAssetMirror(cfg, { log: { warn: (m: string) => warnings.push(m) } });
-    expect(await mirror.pull(rel)).toBe(null);
-    expect(warnings.join(' ')).toMatch(/does not hash to its own name/);
-  });
-
-  test('an unreachable bucket NEVER fails the caller — it returns false', async () => {
-    // The local file is already on disk and in git; the bucket is the redundant
-    // copy. Throwing here would turn a network blip into a failed save.
-    const dead = createAssetMirror(
-      { ...cfg, endpoint: 'http://127.0.0.1:1' },
-      { log: { warn: () => {} } }
-    );
-    expect(await dead.push('assets/deadbeef.png', bytesFor('x'))).toBe(false);
-    expect(await dead.pull('assets/deadbeef.png')).toBe(null);
-    expect(await dead.has('assets/deadbeef.png')).toBe(false);
-  });
-
-  test('a non-2xx response is handled like a miss, not a crash', async () => {
-    const mirror = createAssetMirror(
-      { ...cfg, bucket: 'wrong-bucket' },
-      { log: { warn: () => {} } }
-    );
-    expect(await mirror.pull('assets/deadbeef.png')).toBe(null);
-  });
-
-  test('the unconfigured mirror answers safely for every verb', async () => {
-    const mirror = createAssetMirror(null);
-    expect(await mirror.push('assets/deadbeef.png', bytesFor('x'))).toBe(false);
-    expect(await mirror.pull('assets/deadbeef.png')).toBe(null);
-    expect(await mirror.has('assets/deadbeef.png')).toBe(false);
-    expect(mirror.describe).toBe('none');
-  });
-});

package/apps/studio/test/binary-smoke.test.ts

@@ -1,47 +0,0 @@
-// Smoke: dist/maude-<platform> compiles + spawns + exits cleanly.
-//
-// We run this only when the compiled binary is already present. The full
-// `bun build --compile` step costs ~150 ms; CI matrix already proves it on
-// every release tag (Task 13). Local devs see this skip silently unless they
-// have already run `bun run build.ts --release`.
-
-import { describe, expect, test } from 'bun:test';
-import { join } from 'node:path';
-
-const PLATFORM_SLUG = (() => {
-  const p = process.platform;
-  const a = process.arch;
-  if (p === 'darwin') return a === 'arm64' ? 'darwin-arm64' : 'darwin-x64';
-  if (p === 'linux') return a === 'arm64' ? 'linux-arm64' : 'linux-x64';
-  if (p === 'win32') return 'win32-x64';
-  return null;
-})();
-
-describe('binary smoke', () => {
-  test('compiled binary boots and exits 0 on --help / handles unknown args gracefully', async () => {
-    if (!PLATFORM_SLUG) {
-      console.log('binary-smoke: unsupported host platform; skipping');
-      return;
-    }
-    const binPath = join(import.meta.dir, '..', 'dist', `maude-${PLATFORM_SLUG}`);
-    const exists = await Bun.file(binPath).exists();
-    if (!exists) {
-      console.log(
-        `binary-smoke: ${binPath} not built; skipping (run \`bun run build.ts --release\`)`
-      );
-      return;
-    }
-
-    // The compiled binary is the dev-server entry — invoking it with --root
-    // pointing at a temp dir without .design/ causes a fail-loud exit (1).
-    // That's enough to prove the binary is a valid executable.
-    const proc = Bun.spawn({
-      cmd: [binPath, '--root', '/tmp/nonexistent-maude-test'],
-      stdout: 'pipe',
-      stderr: 'pipe',
-      env: { ...process.env, NO_OPEN: '1' },
-    });
-    const code = await proc.exited;
-    expect(code === 0 || code === 1).toBe(true);
-  });
-});

package/apps/studio/test/boot-self-heal.test.ts

@@ -1,87 +0,0 @@
-// Boot artifact check — Phase 19 / DDR-044, simplified in v0.18.1.
-// v0.18.0 tried to `bun install` + `bun run build.ts` when node_modules/react
-// was missing; that misfired in every install scenario (see boot-self-heal.ts
-// header). v0.18.1 ships pre-built runtime bundles + just verifies they're
-// reachable. Missing artifact == broken install, not first-boot gap.
-
-import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
-import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { bootSelfHeal, type SelfHealOptions } from '../boot-self-heal.ts';
-
-let TMP: string;
-
-beforeEach(() => {
-  TMP = mkdtempSync(join(tmpdir(), 'maude-self-heal-'));
-  mkdirSync(join(TMP, 'dist', 'runtime'), { recursive: true });
-});
-
-afterEach(() => {
-  rmSync(TMP, { recursive: true, force: true });
-});
-
-function harness(extra: Partial<SelfHealOptions> = {}) {
-  const logs: string[] = [];
-  let exited: number | null = null;
-  const opts: SelfHealOptions = {
-    here: TMP,
-    log: (m) => logs.push(m),
-    exit: ((code: number) => {
-      exited = code;
-      throw new Error(`__exit:${code}`);
-    }) as never,
-    ...extra,
-  };
-  return { opts, logs, getExited: () => exited };
-}
-
-function seedAll() {
-  writeFileSync(join(TMP, 'dist', 'client.bundle.js'), '/* stub */');
-  writeFileSync(join(TMP, 'dist', 'runtime', 'react.js'), '/* stub */');
-}
-
-describe('bootSelfHeal', () => {
-  test('passes when both required artifacts present', async () => {
-    seedAll();
-    const { opts, logs } = harness();
-    const result = await bootSelfHeal(opts);
-    expect(result.verified).toEqual(['client.bundle.js', 'runtime/react.js']);
-    expect(logs).toEqual([]);
-  });
-
-  test('exits 1 with remediation when dist/client.bundle.js missing', async () => {
-    writeFileSync(join(TMP, 'dist', 'runtime', 'react.js'), '/* stub */');
-    const { opts, logs, getExited } = harness();
-    await expect(bootSelfHeal(opts)).rejects.toThrow('__exit:1');
-    expect(getExited()).toBe(1);
-    const msg = logs.join('\n');
-    expect(msg).toMatch(/dist\/client\.bundle\.js/);
-    expect(msg).toMatch(/npm uninstall -g @1agh\/maude/);
-  });
-
-  test('exits 1 with remediation when dist/runtime/react.js missing', async () => {
-    writeFileSync(join(TMP, 'dist', 'client.bundle.js'), '/* stub */');
-    const { opts, logs, getExited } = harness();
-    await expect(bootSelfHeal(opts)).rejects.toThrow('__exit:1');
-    expect(getExited()).toBe(1);
-    const msg = logs.join('\n');
-    expect(msg).toMatch(/dist\/runtime\/react\.js/);
-  });
-
-  test('lists ALL missing artifacts in one message (not first-fail-only)', async () => {
-    // Nothing seeded — both missing.
-    const { opts, logs } = harness();
-    await expect(bootSelfHeal(opts)).rejects.toThrow('__exit:1');
-    const msg = logs.join('\n');
-    expect(msg).toMatch(/dist\/client\.bundle\.js/);
-    expect(msg).toMatch(/dist\/runtime\/react\.js/);
-  });
-
-  test('remediation surfaces the looked-under path so user can verify', async () => {
-    const { opts, logs } = harness();
-    await expect(bootSelfHeal(opts)).rejects.toThrow();
-    expect(logs.join('\n')).toContain(TMP);
-  });
-});

package/apps/studio/test/browse-posture.test.tsx

@@ -1,107 +0,0 @@
-// browse-posture — feature-4 (browse/move split, DDR-187). The LOAD-BEARING
-// gate: a DOM-level proof that the boot-default `browse` tool is a pure native
-// pass-through (a real click handler under the cursor fires, nothing is
-// claimed), while the `move` (select) tool CLAIMS the same bare click (native
-// handler suppressed, onSelect dispatched). This promotes the input-router
-// comment-invariant ("bare clicks pass through") into an enforced test — the
-// canvas-origin-gate equivalent for the input posture.
-//
-// Needs a live DOM (capture-phase listeners + event dispatch + a real React
-// effect) — register happy-dom + drive a createRoot, same convention as
-// canvas-hmr-runtime.test.tsx / specimen-select.test.ts.
-
-import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
-import { GlobalRegistrator } from '@happy-dom/global-registrator';
-
-beforeAll(() => {
-  GlobalRegistrator.register();
-  (globalThis as unknown as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
-});
-afterAll(() => {
-  GlobalRegistrator.unregister();
-});
-
-import { act, useRef } from 'react';
-import { createRoot, type Root } from 'react-dom/client';
-
-import { type RouterCallbacks, type Tool, useInputRouter } from '../input-router.tsx';
-
-// A minimal host that mounts the router over a single native <button>. The
-// active tool is read fresh at event time via `getActiveTool` (a ref-backed
-// getter), so a test can flip the tool without re-rendering.
-function Harness({ getTool, callbacks }: { getTool: () => Tool; callbacks: RouterCallbacks }) {
-  const hostRef = useRef<HTMLDivElement | null>(null);
-  useInputRouter({ hostRef, getActiveTool: getTool, callbacks });
-  return (
-    <div ref={hostRef} className="dc-canvas">
-      <button type="button" id="native-btn">
-        Click me
-      </button>
-    </div>
-  );
-}
-
-function fireBareLeftClick(el: Element): void {
-  // The full native sequence the router gates: pointerdown → mousedown → click.
-  el.dispatchEvent(new MouseEvent('pointerdown', { bubbles: true, cancelable: true, button: 0 }));
-  el.dispatchEvent(new MouseEvent('mousedown', { bubbles: true, cancelable: true, button: 0 }));
-  el.dispatchEvent(new MouseEvent('click', { bubbles: true, cancelable: true, button: 0 }));
-}
-
-describe('browse tool — native pass-through (boot default)', () => {
-  test('bare click: native button handler FIRES, onSelect NOT dispatched', () => {
-    const el = document.createElement('div');
-    document.body.appendChild(el);
-    const root: Root = createRoot(el);
-    let selectCalls = 0;
-    let nativeClicks = 0;
-
-    act(() => {
-      root.render(
-        <Harness getTool={() => 'browse'} callbacks={{ onSelect: () => (selectCalls += 1) }} />
-      );
-    });
-
-    const btn = el.querySelector('#native-btn') as HTMLButtonElement;
-    btn.addEventListener('click', () => (nativeClicks += 1));
-    act(() => {
-      fireBareLeftClick(btn);
-    });
-
-    expect(selectCalls).toBe(0); // browse never selects
-    expect(nativeClicks).toBe(1); // the mock stays alive
-
-    act(() => root.unmount());
-    el.remove();
-  });
-});
-
-describe('move (select) tool — claims the bare click', () => {
-  test('bare click: native button handler SUPPRESSED, onSelect dispatched', () => {
-    const el = document.createElement('div');
-    document.body.appendChild(el);
-    const root: Root = createRoot(el);
-    let selectCalls = 0;
-    let nativeClicks = 0;
-
-    act(() => {
-      root.render(
-        <Harness getTool={() => 'move'} callbacks={{ onSelect: () => (selectCalls += 1) }} />
-      );
-    });
-
-    const btn = el.querySelector('#native-btn') as HTMLButtonElement;
-    btn.addEventListener('click', () => (nativeClicks += 1));
-    act(() => {
-      fireBareLeftClick(btn);
-    });
-
-    // Router claims the pointerdown (dispatches select) and swallows the
-    // synthetic click so the button under the cursor never activates.
-    expect(selectCalls).toBe(1);
-    expect(nativeClicks).toBe(0);
-
-    act(() => root.unmount());
-    el.remove();
-  });
-});

package/apps/studio/test/bundle-smoke.test.ts

@@ -1,46 +0,0 @@
-// Smoke: build.ts produces a parsable IIFE bundle that ships React 19.
-//
-// Builds into a DISPOSABLE directory (`MAUDE_DIST_DIR`), never the real one.
-// It used to write its unminified dev output straight over the committed
-// release artifacts — `dist/client.bundle.js` at 14 MB where 2 MB ships — so
-// merely running the test suite staged a broken release, silently, with no
-// server running and no obvious culprit. CLAUDE.md carried this for a while as
-// "observed, root cause unconfirmed". This test was the cause.
-
-import { describe, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { spawnSync } from 'bun';
-
-describe('client bundle', () => {
-  // A whole client build, so it sits right on bun's 5s default and tips over
-  // whenever the machine is busy. Given headroom explicitly rather than left as
-  // a flake — the thing under test is the bundle, not the wall clock.
-  test('build.ts produces a parsable IIFE bundle that ships React', async () => {
-    const here = join(import.meta.dir, '..');
-    const out = mkdtempSync(join(tmpdir(), 'maude-bundle-smoke-'));
-    try {
-      const result = spawnSync({
-        cmd: ['bun', 'run', join(here, 'build.ts')],
-        cwd: here,
-        stdout: 'pipe',
-        stderr: 'pipe',
-        env: { ...process.env, NODE_ENV: 'development', MAUDE_DIST_DIR: out },
-      });
-      expect(result.exitCode).toBe(0);
-
-      const bundle = Bun.file(join(out, 'client.bundle.js'));
-      expect(await bundle.exists()).toBe(true);
-      expect(bundle.size).toBeGreaterThan(50_000);
-
-      const src = await bundle.text();
-      // React 19 internal marker — exact constants change across minor versions,
-      // so we look for a stable substring on the IIFE shell + a known React API.
-      expect(src.includes('createRoot') || src.includes('react-dom')).toBe(true);
-      expect(src.includes('useState') || src.includes('react')).toBe(true);
-    } finally {
-      rmSync(out, { recursive: true, force: true });
-    }
-  }, 60_000);
-});