@1agh/maude 1.0.9 → 1.2.0

package/apps/studio/test/read-only-gate.test.ts

@@ -1,188 +0,0 @@
-// Cloud Phase 25 C2 — the local half of the read-only gate.
-//
-// When the linked hub's credential carries the `viewer` role (vouched at
-// workspace sign-in, stored in hubs.json), the LOCAL dev-server refuses
-// project-mutating writes with a legible 403 — so a viewer's clone can never
-// silently diverge from the cell (which refuses the same writes at sync,
-// Phase 25 C1). Writes are default-denied with a short allowlist
-// (READ_ONLY_ALLOWED_WRITES in http.ts): per-user runtime state (camera,
-// ui-prefs) plus the two role-granted verbs the cell itself allows (export,
-// session management).
-
-import { afterAll, describe, expect, test } from 'bun:test';
-import { readFileSync, writeFileSync } from 'node:fs';
-import { join } from 'node:path';
-import type { Subprocess } from 'bun';
-
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-const HUB_URL = 'http://hub.invalid:9';
-
-/** Sandbox linked to a hub whose credential vouches `role`. */
-function makeLinkedSandbox(role?: string) {
-  const { root, designRoot } = makeSandbox();
-  const cfgPath = join(designRoot, 'config.json');
-  const cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
-  cfg.linkedHub = { url: HUB_URL, linkedAt: Date.now() };
-  writeFileSync(cfgPath, JSON.stringify(cfg, null, 2));
-  // The hubs.json credential store the role is read from (isHubReadOnly).
-  const hubsPath = join(root, 'hubs.json');
-  writeFileSync(
-    hubsPath,
-    JSON.stringify({
-      hubs: { [HUB_URL]: { token: 't', linkedAt: Date.now(), ...(role ? { role } : {}) } },
-    })
-  );
-  return { root, designRoot, hubsPath };
-}
-
-const procs: Subprocess[] = [];
-afterAll(async () => {
-  for (const p of procs) await killProc(p);
-});
-
-async function boot(role?: string) {
-  const { root, hubsPath } = makeLinkedSandbox(role);
-  const port = nextPort();
-  const proc = await bootServer(root, port, { HUBS_CONFIG_PATH: hubsPath });
-  procs.push(proc);
-  return { base: `http://localhost:${port}` };
-}
-
-describe('read-only gate — viewer role refuses project writes locally', () => {
-  test('viewer: writes 403 read-only, per-user + role-granted writes pass, /_config says so', async () => {
-    const { base } = await boot('viewer');
-
-    // /_config tells the client at boot.
-    const cfg = (await (await fetch(`${base}/_config`)).json()) as { readOnly?: boolean };
-    expect(cfg.readOnly).toBe(true);
-
-    // Project-mutating writes: refused with the legible read-only shape.
-    const editText = await fetch(`${base}/_api/edit-text`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ file: 'ui/fixture.html', text: 'x' }),
-    });
-    expect(editText.status).toBe(403);
-    const body = (await editText.json()) as { error?: string; message?: string };
-    expect(body.error).toBe('read-only');
-    expect(body.message).toContain('viewer');
-
-    // Canvas create + delete-element + git commit: same refusal.
-    for (const [path, method] of [
-      ['/_api/canvas', 'POST'],
-      ['/_api/delete-element', 'POST'],
-      ['/_api/git/commit', 'POST'],
-      ['/_api/fs-mkdir', 'POST'],
-      ['/_api/annotations', 'PUT'],
-      ['/_api/acp/chat', 'POST'],
-      // Cloud Phase 27 D2 — both USED to be on READ_ONLY_ALLOWED_WRITES, on the
-      // reasoning that "viewing another branch is not changing one". Both
-      // rewrite the working TREE, and the tree is shared: a viewer switching
-      // branches replaces the files under whoever is mid-edit. The cell's proxy
-      // refuses them too, but this is the gate the hub-linked desktop and the
-      // self-host path consult, where no manifest runs at all.
-      ['/_api/git/checkout', 'POST'],
-      ['/_api/git/pull', 'POST'],
-    ] as const) {
-      const r = await fetch(base + path, { method, body: '{}' });
-      expect(`${path} ${r.status}`).toBe(`${path} 403`);
-    }
-
-    // canvas-meta: the LAYOUT lane is refused…
-    const layout = await fetch(`${base}/_api/canvas-meta`, {
-      method: 'PATCH',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({
-        file: '.design/ui/fixture.html',
-        patch: { layout: { artboards: [] } },
-      }),
-    });
-    expect(layout.status).toBe(403);
-    // …the VIEWPORT lane (per-user camera) is not.
-    const viewport = await fetch(`${base}/_api/canvas-meta`, {
-      method: 'PATCH',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({
-        file: '.design/ui/fixture.html',
-        patch: { viewport: { x: 0, y: 0, zoom: 1 } },
-      }),
-    });
-    expect(viewport.status).not.toBe(403);
-
-    // Per-user runtime state stays writable (DDR-115 taxonomy).
-    const camera = await fetch(`${base}/_canvas-state`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ file: '.design/ui/fixture.html', viewport: { x: 1, y: 2, zoom: 1 } }),
-    });
-    expect(camera.status).toBe(204);
-
-    // Role-granted verb: export reaches its handler (may 400 on shape, never 403).
-    const exp = await fetch(`${base}/_api/export`, { method: 'POST', body: '{}' });
-    expect(exp.status).not.toBe(403);
-
-    // Reads are untouched.
-    expect((await fetch(`${base}/_index-data`)).status).toBe(200);
-    expect((await fetch(`${base}/_comments-all`)).status).toBe(200);
-  }, 30000);
-
-  test('member (no role on the credential): writes are NOT gated', async () => {
-    const { base } = await boot(undefined);
-    const cfg = (await (await fetch(`${base}/_config`)).json()) as { readOnly?: boolean };
-    expect(cfg.readOnly).toBe(false);
-    // A write reaches its handler (400 on bad shape — not the 403 refusal).
-    const r = await fetch(`${base}/_api/edit-text`, { method: 'POST', body: '{}' });
-    expect(r.status).not.toBe(403);
-  }, 30000);
-});
-
-// ---------------------------------------------------------------------------
-// Cloud Phase 27 — the one write a viewer holds.
-//
-// The role matrix has said `viewer.comment === true` since Phase 25 C4 and the
-// People page promises it in those words. This list did not have it, so a
-// viewer's comment was allowed by the authority (the cell's proxy) and then
-// refused by the defence-in-depth layer behind it. Found by commenting as a
-// viewer against a real cell, not by reading either file.
-
-describe('a viewer may comment — the matrix says so, and so must this gate', () => {
-  test('comment + reply pass; annotate still does not', async () => {
-    const { base } = await boot('viewer');
-
-    const comment = await fetch(`${base}/_comments`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ file: 'ui/Sample.tsx', text: 'looks off to me' }),
-    });
-    expect(comment.status).not.toBe(403);
-
-    const reply = await fetch(`${base}/_api/comments/abc123/reply`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ text: 'agreed' }),
-    });
-    expect(reply.status).not.toBe(403);
-
-    // An annotation is drawn ON the design and versioned with it — the matrix
-    // files it with `edit`, and that distinction has to survive this change.
-    const annotate = await fetch(`${base}/_api/annotations`, {
-      method: 'PUT',
-      headers: { 'content-type': 'application/json' },
-      body: JSON.stringify({ file: 'ui/Sample.tsx', svg: '<svg/>' }),
-    });
-    expect(annotate.status).toBe(403);
-  });
-
-  test('the reply pattern does not open the whole comment namespace', async () => {
-    const { base } = await boot('viewer');
-    for (const path of [
-      '/_api/comments/abc/delete',
-      '/_api/comments/abc/reply/../../edit-text',
-      '/_api/comments//reply',
-    ]) {
-      const res = await fetch(`${base}${path}`, { method: 'POST' });
-      expect(res.status).not.toBe(200);
-    }
-  });
-});

package/apps/studio/test/read-only-role.test.ts

@@ -1,95 +0,0 @@
-// The client learns it is a viewer at BOOT — Cloud Phase 25 C2.
-//
-// The alternative is learning it from the first refused write, which means
-// drawing somebody an editor and then taking it away. So the role the
-// workspace vouched for at sign-in is persisted with the credential and
-// resolved before the UI paints.
-//
-// This flag decides what the UI OFFERS. It is never what stops a write: the
-// cell enforces that (Phase 25 C1 — a read-only peer token, Hocuspocus
-// dropping SyncStep2/Update, one HTTP gate), and it holds whatever a patched
-// client believes about itself.
-
-import { describe, expect, test } from 'bun:test';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { saveHubCredential } from '../sync/hub-link.ts';
-import { signInToWorkspace } from '../sync/workspace-signin.ts';
-
-function withHome<T>(fn: (home: string) => T): T {
-  const home = mkdtempSync(join(tmpdir(), 'maude-ro-'));
-  const prevXdg = process.env.XDG_CONFIG_HOME;
-  process.env.XDG_CONFIG_HOME = home;
-  try {
-    return fn(home);
-  } finally {
-    if (prevXdg === undefined) delete process.env.XDG_CONFIG_HOME;
-    else process.env.XDG_CONFIG_HOME = prevXdg;
-    rmSync(home, { recursive: true, force: true });
-  }
-}
-
-describe('the vouched role is persisted with the credential', () => {
-  test('a viewer is recorded as one', () => {
-    withHome((home) => {
-      saveHubCredential('https://p.cloud.maude.sh', 'mau_tok', 'viewer');
-      const cfg = JSON.parse(readFileSync(join(home, 'maude', 'hubs.json'), 'utf8'));
-      expect(cfg.hubs['https://p.cloud.maude.sh'].role).toBe('viewer');
-    });
-  });
-
-  test('a credential written without a role stays write-capable', () => {
-    // The upgrade promise: nobody is demoted by shipping this.
-    withHome((home) => {
-      saveHubCredential('https://p.cloud.maude.sh', 'mau_tok');
-      const cfg = JSON.parse(readFileSync(join(home, 'maude', 'hubs.json'), 'utf8'));
-      expect(cfg.hubs['https://p.cloud.maude.sh'].role).toBeUndefined();
-    });
-  });
-});
-
-describe('sign-in carries the role through to the credential', () => {
-  const okHub = (role: string) =>
-    (async (url: string) => {
-      const u = String(url);
-      if (u.endsWith('/health')) return Response.json({ ok: true, version: '1.0.0' });
-      return Response.json({ token: 'mau_minted', user: { email: 'v@example.com', role } });
-    }) as unknown as typeof fetch;
-
-  test('a viewer sign-in saves the role, and reports it back', async () => {
-    const saved: Array<[string, string, string | undefined]> = [];
-    const res = await signInToWorkspace(
-      { url: 'https://p.cloud.maude.sh', email: 'v@example.com', password: 'x'.repeat(12) },
-      {
-        save: (u, t, r) => saved.push([u, t, r]),
-        fetchImpl: okHub('viewer'),
-      }
-    );
-    expect(res.status).toBe(200);
-    expect(saved[0][2]).toBe('viewer');
-    expect((res.json as { user: { role: string } }).user.role).toBe('viewer');
-  });
-
-  test('a hub that names no role is treated as member, never as viewer', async () => {
-    // Failing OPEN on the UI flag is correct: the cell is what refuses a
-    // write, so a wrong guess here costs a redundant affordance, never
-    // access. Guessing "viewer" instead would lock out every self-hoster
-    // whose hub predates this field.
-    const saved: Array<[string, string, string | undefined]> = [];
-    const res = await signInToWorkspace(
-      { url: 'https://hub.example.com', email: 'm@example.com', password: 'x'.repeat(12) },
-      {
-        save: (u, t, r) => saved.push([u, t, r]),
-        fetchImpl: (async (url: string) => {
-          const u = String(url);
-          if (u.endsWith('/health')) return Response.json({ ok: true, version: '1.0.0' });
-          return Response.json({ token: 'mau_minted', user: { email: 'm@example.com' } });
-        }) as unknown as typeof fetch,
-      }
-    );
-    expect(res.status).toBe(200);
-    expect(saved[0][2]).toBe('member');
-  });
-});

package/apps/studio/test/readiness.test.ts

@@ -1,226 +0,0 @@
-// Readiness probe (DDR-128) — plugin-registry scan + PATH resolution. The
-// login-shell fallback's full correctness is proven on the packaged `.app`
-// (native-verification ceiling); here we cover the registry-scan branches, the
-// no-throw contracts, and the report shape. The probe is async (the fallback shells
-// out off the event loop — DDR-128 hardening), so everything awaits.
-
-import { describe, expect, test } from 'bun:test';
-import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { probeReadiness, resolveOnPath } from '../readiness.ts';
-
-const MARKET_OK = {
-  maude: { source: { source: 'github', repo: '1aGh/maude' }, installLocation: '/x' },
-};
-const INSTALLED_BOTH = {
-  version: 2,
-  plugins: {
-    'design@maude': [{ scope: 'user', version: '0.29.0' }],
-    'flow@maude': [{ scope: 'user', version: '0.29.0' }],
-  },
-};
-const INSTALLED_DESIGN_ONLY = { version: 2, plugins: { 'design@maude': [{ scope: 'user' }] } };
-// `/flow` is no longer part of the chat (2026-07-03) — the gate tracks `design`
-// alone, so a registry with flow-but-not-design is the "design missing" case.
-const INSTALLED_FLOW_ONLY = { version: 2, plugins: { 'flow@maude': [{ scope: 'user' }] } };
-
-function fixtureClaudeDir(opts: { markets?: unknown; installed?: unknown }): string {
-  const dir = mkdtempSync(join(tmpdir(), 'maude-readiness-'));
-  const pluginsDir = join(dir, 'plugins');
-  mkdirSync(pluginsDir, { recursive: true });
-  if (opts.markets !== undefined)
-    writeFileSync(join(pluginsDir, 'known_marketplaces.json'), JSON.stringify(opts.markets));
-  if (opts.installed !== undefined)
-    writeFileSync(join(pluginsDir, 'installed_plugins.json'), JSON.stringify(opts.installed));
-  return dir;
-}
-
-async function withClaudeDir<T>(dir: string, fn: () => Promise<T> | T): Promise<T> {
-  const saved = process.env.CLAUDE_CONFIG_DIR;
-  process.env.CLAUDE_CONFIG_DIR = dir;
-  try {
-    return await fn();
-  } finally {
-    if (saved === undefined) delete process.env.CLAUDE_CONFIG_DIR;
-    else process.env.CLAUDE_CONFIG_DIR = saved;
-  }
-}
-
-/** Plugins row under the given ~/.claude fixture. `nativeBootstrap:false` sets
- *  MAUDE_NO_PLUGIN_BOOTSTRAP to force the web / manual (DDR-128) path — needed to
- *  isolate the registry scan, since this suite runs in the dev tree where the
- *  bundled plugin dirs resolve and DDR-143 auto-load would otherwise mask it. */
-const pluginsItem = async (dir: string, opts: { nativeBootstrap?: boolean } = {}) => {
-  const savedOptOut = process.env.MAUDE_NO_PLUGIN_BOOTSTRAP;
-  if (opts.nativeBootstrap === false) process.env.MAUDE_NO_PLUGIN_BOOTSTRAP = '1';
-  try {
-    return (await withClaudeDir(dir, () => probeReadiness())).items.find(
-      (i) => i.id === 'plugins'
-    )!;
-  } finally {
-    if (savedOptOut === undefined) delete process.env.MAUDE_NO_PLUGIN_BOOTSTRAP;
-    else process.env.MAUDE_NO_PLUGIN_BOOTSTRAP = savedOptOut;
-  }
-};
-
-// Registry-scan branches under the WEB / manual path (auto-bootstrap opted out) —
-// the pure DDR-128 detect-and-guide behavior, still what a `maude design serve`
-// user sees.
-describe('readiness — plugin registry scan (web / manual path)', () => {
-  test('design@maude + marketplace present → plugins item is present, no remediation', async () => {
-    const item = await pluginsItem(
-      fixtureClaudeDir({ markets: MARKET_OK, installed: INSTALLED_DESIGN_ONLY }),
-      { nativeBootstrap: false }
-    );
-    expect(item.status).toBe('present');
-    expect(item.remediation).toBeUndefined();
-  });
-
-  test('design@maude NOT installed → missing, names the absent design@maude + offers the fix', async () => {
-    // flow-only registry: `/flow` is irrelevant to the chat now, so this reads as
-    // "design missing" — the gate tracks design alone.
-    const item = await pluginsItem(
-      fixtureClaudeDir({ markets: MARKET_OK, installed: INSTALLED_FLOW_ONLY }),
-      { nativeBootstrap: false }
-    );
-    expect(item.status).toBe('missing');
-    expect(item.detail).toContain('design@maude');
-    expect(item.remediation).toContain('/plugin install');
-  });
-
-  test('registry absent → unknown (Claude Code internal contract; never throws)', async () => {
-    const item = await pluginsItem(fixtureClaudeDir({}), { nativeBootstrap: false });
-    expect(item.status).toBe('unknown');
-  });
-
-  test('plugin presence is the gate — a foreign-repo marketplace does not change a design-installed verdict', async () => {
-    const item = await pluginsItem(
-      fixtureClaudeDir({
-        markets: { other: { source: { repo: 'someone/else' } } },
-        installed: INSTALLED_BOTH,
-      }),
-      { nativeBootstrap: false }
-    );
-    expect(item.status).toBe('present');
-  });
-});
-
-// DDR-143 / DDR-168 — on the native/desktop path the ACP session ALWAYS loads
-// the bundled plugins, so the row is satisfied even against a pristine
-// registry, AND even when a marketplace copy is also installed at the user
-// level (DDR-168 removed the old scan-gated no-op — the bundled copy wins
-// regardless of disk state). This suite runs in the dev tree, so the bundled
-// plugin dirs resolve → native context is on by default (no opt-out).
-describe('readiness — plugin auto-bootstrap (native, DDR-143/DDR-168)', () => {
-  test('pristine registry → present + "Bundled with this app" detail, no manual remediation', async () => {
-    const item = await pluginsItem(fixtureClaudeDir({}));
-    expect(item.status).toBe('present');
-    expect(item.detail).toContain('Bundled with this app');
-    expect(item.remediation).toBeUndefined();
-  });
-
-  test('design NOT installed (flow-only registry) → still present (design is bundled, no red wall)', async () => {
-    const item = await pluginsItem(
-      fixtureClaudeDir({ markets: MARKET_OK, installed: INSTALLED_FLOW_ONLY })
-    );
-    expect(item.status).toBe('present');
-    expect(item.detail).toContain('Bundled with this app');
-    expect(item.remediation).toBeUndefined();
-  });
-
-  test('design ALSO installed on disk → present, STILL reads as bundled (DDR-168 — no more "is installed" framing)', async () => {
-    const item = await pluginsItem(
-      fixtureClaudeDir({ markets: MARKET_OK, installed: INSTALLED_DESIGN_ONLY })
-    );
-    expect(item.status).toBe('present');
-    expect(item.detail).toContain('Bundled with this app');
-  });
-});
-
-describe('readiness — resolveOnPath', () => {
-  test('finds a binary that is on PATH', async () => {
-    const hit = await resolveOnPath('sh');
-    expect(hit).not.toBeNull();
-    expect(existsSync(hit!)).toBe(true);
-  });
-
-  test('returns null for a bogus binary without throwing', async () => {
-    expect(await resolveOnPath('maude-definitely-not-real-xyz')).toBeNull();
-  });
-
-  test('login-shell fallback recovers a binary hidden from the app PATH', async () => {
-    const saved = process.env.PATH;
-    try {
-      // Simulate the truncated/empty GUI env so Bun.which misses and the fallback fires.
-      process.env.PATH = '';
-      const hit = await resolveOnPath('sh');
-      // When a login shell is usable it must recover an absolute, real path. In a
-      // sandbox with no usable login shell the fallback returns null — we don't fail
-      // on that, but a non-null result must be a real absolute path.
-      if (hit !== null) {
-        expect(hit.startsWith('/')).toBe(true);
-        expect(existsSync(hit)).toBe(true);
-      }
-    } finally {
-      if (saved === undefined) delete process.env.PATH;
-      else process.env.PATH = saved;
-    }
-  });
-});
-
-describe('readiness — report shape', () => {
-  test('always returns the five items with stable ids and a boolean ready', async () => {
-    const report = await probeReadiness();
-    expect(report.items.map((i) => i.id)).toEqual([
-      'claude',
-      'maude',
-      'plugins',
-      'agent-browser',
-      'adapter',
-    ]);
-    expect(typeof report.ready).toBe('boolean');
-  });
-
-  test('screenshot engine: required + present (bundled) on native → never blocks ready', async () => {
-    // Native (this dev tree): agent-browser is bundled, so the row is first-class
-    // (required) but PRESENT — it can't turn `ready` false.
-    const ab = (await probeReadiness()).items.find((i) => i.id === 'agent-browser')!;
-    expect(ab.required).toBe(true);
-    expect(ab.status).toBe('present');
-  });
-
-  test('screenshot engine: optional on the web/opt-out path', async () => {
-    const saved = process.env.MAUDE_NO_PLUGIN_BOOTSTRAP;
-    process.env.MAUDE_NO_PLUGIN_BOOTSTRAP = '1'; // force native=false
-    try {
-      const ab = (await probeReadiness()).items.find((i) => i.id === 'agent-browser')!;
-      expect(ab.required).toBe(false);
-    } finally {
-      if (saved === undefined) delete process.env.MAUDE_NO_PLUGIN_BOOTSTRAP;
-      else process.env.MAUDE_NO_PLUGIN_BOOTSTRAP = saved;
-    }
-  });
-
-  test('adapter row tracks the real chat gate (resolveAdapterEntry) and is required', async () => {
-    const saved = process.env.MAUDE_ACP_ADAPTER_ENTRY;
-    try {
-      // Point the override at a real file → the bridge is "bundled".
-      process.env.MAUDE_ACP_ADAPTER_ENTRY = import.meta.path;
-      const present = (await probeReadiness()).items.find((i) => i.id === 'adapter')!;
-      expect(present.required).toBe(true);
-      expect(present.status).toBe('present');
-
-      // Point it at a missing path → the row goes missing with remediation, the
-      // honest signal the v0.31–0.32 builds lacked (all other rows green, chat dead).
-      process.env.MAUDE_ACP_ADAPTER_ENTRY = join(tmpdir(), 'no-such-acp-adapter-xyz');
-      const missing = (await probeReadiness()).items.find((i) => i.id === 'adapter')!;
-      expect(missing.status).toBe('missing');
-      expect(missing.remediation).toBeDefined();
-    } finally {
-      if (saved === undefined) delete process.env.MAUDE_ACP_ADAPTER_ENTRY;
-      else process.env.MAUDE_ACP_ADAPTER_ENTRY = saved;
-    }
-  });
-});

package/apps/studio/test/remote-ahead-behind-cache.test.ts

@@ -1,89 +0,0 @@
-// DDR-132 — remote ahead/behind probe: in-memory TTL cache + in-flight dedupe.
-//
-// Verifies the cache WRAPPER (TTL-serve / invalidate / in-flight coalesce) fully
-// offline, with no network and no git spawn. Trick: the probe's DDR-131 transport
-// gate classifies a bare local-path remote as `unsafe`, so `remoteAheadBehind`
-// returns a FRESH `{ahead:0,behind:0}` object on every *uncached* evaluation
-// without touching the network. Object IDENTITY (`Object.is`) therefore tells a
-// cache-serve (same reference) apart from a re-run (new reference) — a stronger
-// signal than value equality, and one the security hardening can't invalidate.
-//
-// (The real fetch/count path needs a reachable github.com remote and is covered
-// by the manual native dogfood — same offline ceiling DDR-131 records for
-// `gitFetchRemote`. This file owns the wrapper semantics only.)
-//
-// This file deliberately does NOT set MAUDE_USE_SYSTEM_GIT (it would leak into the
-// shared bun-test process and flip other files' iso-engine expectations).
-
-import { afterEach, beforeEach, expect, test } from 'bun:test';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { invalidateRemoteProbe, remoteAheadBehind } from '../git/service.ts';
-
-function git(cwd: string, args: string[]): void {
-  const p = Bun.spawnSync(['git', ...args], {
-    cwd,
-    env: { ...process.env, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null' },
-  });
-  if (p.exitCode !== 0) throw new Error(`git ${args.join(' ')}: ${p.stderr.toString()}`);
-}
-
-let work: string;
-
-beforeEach(() => {
-  work = mkdtempSync(join(tmpdir(), 'maude-ab-work-'));
-  git(work, ['init', '-q', '-b', 'main']);
-  git(work, ['config', 'user.email', 't@t.dev']);
-  git(work, ['config', 'user.name', 'Tester']);
-  writeFileSync(join(work, 'a.txt'), 'hello\n');
-  git(work, ['add', '.']);
-  git(work, ['commit', '-q', '-m', 'init']);
-  // A bare local path → DDR-131 transport gate classifies it `unsafe` → the probe
-  // returns {0,0} with no spawn. (Any value is fine; we assert on identity.)
-  git(work, ['remote', 'add', 'origin', '/var/empty/maude-test-remote']);
-});
-
-afterEach(() => {
-  invalidateRemoteProbe(work);
-  rmSync(work, { recursive: true, force: true });
-});
-
-test('a second call within the TTL serves the cached object (no re-run)', async () => {
-  const a = await remoteAheadBehind(work, undefined);
-  expect(a).toEqual({ ahead: 0, behind: 0 });
-  const b = await remoteAheadBehind(work, undefined);
-  expect(Object.is(a, b)).toBe(true); // same reference ⇒ served from cache
-});
-
-test('invalidateRemoteProbe forces a fresh evaluation (new object)', async () => {
-  const a = await remoteAheadBehind(work, undefined);
-  invalidateRemoteProbe(work);
-  const c = await remoteAheadBehind(work, undefined);
-  expect(c).toEqual({ ahead: 0, behind: 0 });
-  expect(Object.is(a, c)).toBe(false); // new reference ⇒ re-ran after invalidation
-});
-
-test('SECURITY (DDR-133 F1): the unattended probe never fetches a non-github HTTP remote', async () => {
-  // Repoint origin to a non-github HTTPS host (a poisoned `.git/config` riding a clone).
-  // With system git auto-preferred (DDR-133), the host-allowlist must gate this probe
-  // BEFORE the engine branch — otherwise an http transport reached `git fetch` against
-  // ANY host on the unattended 45s poll (SSRF / presence beacon). The guard returns
-  // {0,0} with NO spawn; a regression would attempt the fetch and reject/hang here.
-  git(work, ['remote', 'set-url', 'origin', 'https://evil.example.invalid/repo.git']);
-  invalidateRemoteProbe(work);
-  const r = await remoteAheadBehind(work, 'tok_must_never_be_sent');
-  expect(r).toEqual({ ahead: 0, behind: 0 });
-});
-
-test('concurrent callers coalesce onto one shared in-flight result', async () => {
-  const [a, b, c] = await Promise.all([
-    remoteAheadBehind(work, undefined),
-    remoteAheadBehind(work, undefined),
-    remoteAheadBehind(work, undefined),
-  ]);
-  // One shared in-flight promise (or the just-written cache) ⇒ identical reference,
-  // never three independent evaluations.
-  expect(Object.is(a, b)).toBe(true);
-  expect(Object.is(b, c)).toBe(true);
-});