@1agh/maude 1.0.9 → 1.2.0

package/cli/commands/doctor.test.mjs

@@ -1,237 +0,0 @@
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const REPO_ROOT = resolve(__dirname, '..', '..');
-const MAUDE_BIN = resolve(REPO_ROOT, 'cli', 'bin', 'maude.mjs');
-
-function spawnDoctor(args, cwd) {
-  return spawnSync('node', [MAUDE_BIN, 'doctor', ...args], {
-    cwd,
-    encoding: 'utf8',
-    env: { ...process.env, NO_COLOR: '1' },
-  });
-}
-
-function makeTempRepo() {
-  const root = mkdtempSync(join(tmpdir(), 'doctor-'));
-  // Symlink the plugin manifests + schema in by writing minimal copies of
-  // each — we don't need the full repo, just the files doctor reads.
-  // Easier: write a stripped repo with package.json + .ai + plugins/.
-  mkdirSync(join(root, '.ai'), { recursive: true });
-  mkdirSync(join(root, 'plugins/design'), { recursive: true });
-  mkdirSync(join(root, 'plugins/flow/.claude-plugin'), { recursive: true });
-  return root;
-}
-
-function copyAsset(src, destRel, fixtureRoot) {
-  const content = readFileSync(resolve(REPO_ROOT, src), 'utf8');
-  const dest = join(fixtureRoot, destRel);
-  mkdirSync(dirname(dest), { recursive: true });
-  writeFileSync(dest, content);
-}
-
-function bootstrap(fixtureRoot) {
-  // Drop ALL manifests + schema into the fixture so doctor can resolve them
-  // from cwd. The CLI uses `pkgRoot` for plugin manifests (passed via
-  // cli/bin/maude.mjs as repo root) AND cwd for .ai/workflows.config.json.
-  // Since we spawn with cwd=fixtureRoot and `pkgRoot` is resolved from the
-  // CLI's package.json location, doctor will still load manifests from the
-  // real repo root. That's intentional: we test the workflow, not a
-  // hypothetical "fake plugin manifests".
-  // What we DO need in the fixture: a valid `.ai/workflows.config.json` or
-  // an absent one (for the "config not found" branch).
-  void fixtureRoot;
-  void copyAsset;
-}
-
-test('healthy minimal config — no schema errors, exit reflects health', () => {
-  const root = makeTempRepo();
-  bootstrap(root);
-  // Drop a minimal valid config.
-  writeFileSync(
-    join(root, '.ai/workflows.config.json'),
-    `${JSON.stringify({ name: 'x' }, null, 2)}\n`
-  );
-
-  const r = spawnDoctor([], root);
-  // No drift / additions because there's no package.json in the temp repo.
-  assert.match(r.stdout, /Config schema/);
-  assert.match(r.stdout, /✓ valid/);
-  // exit 0 unless hard dep missing on the dev machine (these tests assume
-  // the machine running them has node + git — both checked at the test
-  // suite level by tests A7 etc.).
-});
-
-test('schema error: unknown top-level property forces exit 1', () => {
-  const root = makeTempRepo();
-  writeFileSync(
-    join(root, '.ai/workflows.config.json'),
-    `${JSON.stringify({ name: 'x', futureKnob: true }, null, 2)}\n`
-  );
-
-  const r = spawnDoctor([], root);
-  assert.equal(r.status, 1);
-  assert.match(r.stdout, /unknown property "futureKnob"/);
-});
-
-test('schema error: enum violation surfaces suggestion in output', () => {
-  const root = makeTempRepo();
-  writeFileSync(
-    join(root, '.ai/workflows.config.json'),
-    `${JSON.stringify({ name: 'x', conventions: { commits: 'conventionall' } }, null, 2)}\n`
-  );
-
-  const r = spawnDoctor([], root);
-  assert.equal(r.status, 1);
-  assert.match(r.stdout, /conventions\/commits/);
-  assert.match(r.stdout, /suggestion: "conventional"/);
-});
-
-test('--json emits structured envelope', () => {
-  const root = makeTempRepo();
-  writeFileSync(
-    join(root, '.ai/workflows.config.json'),
-    `${JSON.stringify({ name: 'x' }, null, 2)}\n`
-  );
-
-  const r = spawnDoctor(['--json'], root);
-  // Parse — must be valid JSON.
-  const env = JSON.parse(r.stdout);
-  assert.ok(env.deps);
-  assert.ok(env.config);
-  assert.ok(env.summary);
-  assert.equal(typeof env.summary.healthy, 'boolean');
-  assert.equal(typeof env.summary.schemaErrors, 'number');
-});
-
-test('--plugin design scopes deps to one plugin (config still global)', () => {
-  const root = makeTempRepo();
-  writeFileSync(
-    join(root, '.ai/workflows.config.json'),
-    `${JSON.stringify({ name: 'x' }, null, 2)}\n`
-  );
-
-  const r = spawnDoctor(['--plugin', 'design', '--json'], root);
-  const env = JSON.parse(r.stdout);
-  assert.ok(env.deps.design);
-  assert.equal(env.deps.flow, undefined);
-  // Config section is still present.
-  assert.equal(env.config.exists, true);
-});
-
-test('config missing — section reports not-found, no schema check', () => {
-  const root = makeTempRepo();
-  // No .ai/workflows.config.json — leave .ai dir but no file.
-
-  const r = spawnDoctor(['--json'], root);
-  const env = JSON.parse(r.stdout);
-  assert.equal(env.config.exists, false);
-  assert.equal(env.summary.schemaErrors, 0);
-});
-
-test('--fix on config with unknown property drops it; existing values preserved', () => {
-  const root = makeTempRepo();
-  const initial = {
-    name: 'x',
-    futureKnob: true,
-    conventions: { prohibited: ['lodash'] },
-  };
-  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify(initial, null, 2)}\n`);
-
-  // --fix doesn't prompt for installs because there are no missing deps on
-  // the dev machine. Provide empty stdin just in case.
-  spawnSync('node', [MAUDE_BIN, 'doctor', '--fix'], {
-    cwd: root,
-    encoding: 'utf8',
-    input: '',
-    env: { ...process.env, NO_COLOR: '1' },
-  });
-
-  const after = JSON.parse(readFileSync(join(root, '.ai/workflows.config.json'), 'utf8'));
-  assert.equal(after.futureKnob, undefined, 'unknown property should be dropped');
-  // User-tuned value preserved.
-  assert.deepEqual(after.conventions.prohibited, ['lodash']);
-});
-
-test('summary line reflects counts (drift/additions tracked via package.json)', () => {
-  const root = makeTempRepo();
-  writeFileSync(
-    join(root, '.ai/workflows.config.json'),
-    `${JSON.stringify({ name: 'x', stack: { language: 'javascript' } }, null, 2)}\n`
-  );
-  // Drop a tsconfig so the language detector picks up TS.
-  writeFileSync(join(root, 'tsconfig.json'), '{}');
-  writeFileSync(
-    join(root, 'package.json'),
-    JSON.stringify({ name: 'x', scripts: { lint: 'echo' } })
-  );
-
-  const r = spawnDoctor(['--json'], root);
-  const env = JSON.parse(r.stdout);
-  // Drift: language js → typescript.
-  const langDrift = env.config.drift.find((d) => d.key === 'language');
-  assert.ok(langDrift, `expected language drift, got ${JSON.stringify(env.config.drift)}`);
-  assert.equal(langDrift.detected, 'typescript');
-  // Quality addition: lint.
-  const lintAdd = env.config.qualityAdditions.find((a) => a.gate === 'lint');
-  assert.ok(lintAdd);
-});
-
-// ── DDR-079: design-hub / TSX-sync section (report-only, local) ──────────────
-function writeDesign(root, linkedHub) {
-  mkdirSync(join(root, '.design'), { recursive: true });
-  writeFileSync(
-    join(root, '.design/config.json'),
-    JSON.stringify({ name: 't', designRoot: '.design', ...(linkedHub ? { linkedHub } : {}) })
-  );
-}
-
-test('DDR-079: linked design config with no syncTsx → on (default) + advisory', () => {
-  const root = makeTempRepo();
-  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify({ name: 'x' })}\n`);
-  writeDesign(root, { url: 'https://hub.example.com', linkedAt: 1 });
-  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
-  assert.equal(env.design.linked, true);
-  assert.equal(env.design.hubUrl, 'https://hub.example.com');
-  assert.equal(env.design.tsxSync, 'on (default)');
-  assert.match(env.design.advisory, /defaults ON/);
-});
-
-test('DDR-079: syncTsx:false → off (opted out), no advisory', () => {
-  const root = makeTempRepo();
-  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify({ name: 'x' })}\n`);
-  writeDesign(root, { url: 'https://hub.example.com', linkedAt: 1, syncTsx: false });
-  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
-  assert.equal(env.design.tsxSync, 'off (opted out)');
-  assert.equal(env.design.advisory, null);
-});
-
-test('DDR-079: syncTsx:true → on (explicit), no advisory', () => {
-  const root = makeTempRepo();
-  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify({ name: 'x' })}\n`);
-  writeDesign(root, { url: 'https://hub.example.com', linkedAt: 1, syncTsx: true });
-  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
-  assert.equal(env.design.tsxSync, 'on (explicit)');
-  assert.equal(env.design.advisory, null);
-});
-
-test('design section reports solo when .design/config.json has no linkedHub', () => {
-  const root = makeTempRepo();
-  writeDesign(root, null);
-  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
-  assert.equal(env.design.exists, true);
-  assert.equal(env.design.linked, false);
-});
-
-test('design section absent when no .design/config.json', () => {
-  const root = makeTempRepo();
-  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
-  assert.equal(env.design.exists, false);
-});

package/cli/commands/hub-workspace.test.mjs

@@ -1,275 +0,0 @@
-// `maude hub workspace-up` end-to-end via spawnSync — the properties that only
-// hold on the REAL command surface, not on the planning layer under it.
-//
-// Both cases come from the first live AWS run of `workspace-up` (2026-08-20).
-
-import assert from 'node:assert/strict';
-import { spawnSync } from 'node:child_process';
-import { chmodSync, existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { dirname, join, resolve } from 'node:path';
-import { test } from 'node:test';
-import { fileURLToPath } from 'node:url';
-
-const BIN = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'maude.mjs');
-
-const { classifyDrillFailure } = await import('./hub-workspace.mjs');
-
-function runCli(args, { cwd, env } = {}) {
-  return spawnSync(process.execPath, [BIN, ...args], {
-    cwd,
-    encoding: 'utf8',
-    env: { ...process.env, ...env },
-  });
-}
-
-function withDir(fn) {
-  const dir = mkdtempSync(join(tmpdir(), 'maude-workspace-'));
-  try {
-    return fn(dir);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-const BASE = [
-  'hub',
-  'workspace-up',
-  '--domain',
-  'design.acme.com',
-  '--acme-email',
-  'ops@acme.com',
-  '--admin-email',
-  'ops@acme.com',
-];
-
-// M3 — the recommended seed URL is
-// `https://x-access-token:<PAT>@github.com/org/repo.git` (`seed-repo.mjs`
-// accepts no other shape), and this command printed it unredacted, `--dry-run`
-// included. On the live run the PAT landed in SSM command history, CloudTrail
-// and a session transcript, and had to be revoked.
-test('--dry-run never prints the seed URL credential', () => {
-  withDir((dir) => {
-    const r = runCli(
-      [...BASE, '--dry-run', '--seed-repo', 'https://x-access-token:SECRET123@github.com/o/r.git'],
-      { cwd: dir }
-    );
-    assert.equal(r.status, 0, r.stderr);
-    const out = `${r.stdout}${r.stderr}`;
-    assert.ok(!out.includes('SECRET123'), 'the token must not reach stdout or stderr');
-    assert.match(out, /https:\/\/\*\*\*@github\.com\/o\/r\.git/);
-  });
-});
-
-// M2 — `--admin-password` beat the existing `.env`, so the new value was
-// written to disk while `seedFirstUser()` (first boot only) kept the old one.
-// The verification step then reported `HTTP 401 — the first user cannot sign
-// in`, and the only repair anyone found was `docker compose down -v`: on a
-// live box, losing the project rather than fixing the password.
-test('--admin-password on a re-run is refused, not silently written', () => {
-  withDir((dir) => {
-    const first = runCli([...BASE, '--dry-run', '--admin-password', 'first-password-ok'], {
-      cwd: dir,
-    });
-    assert.equal(first.status, 0, first.stderr);
-
-    // Stand in for a hub that has already booted once.
-    writeFileSync(
-      join(dir, '.env'),
-      "MAUDE_ADMIN_EMAIL='ops@acme.com'\nMAUDE_ADMIN_PASSWORD='first-password-ok'\nHUB_SECRET='abc'\n",
-      { mode: 0o600 }
-    );
-
-    const rerun = runCli([...BASE, '--admin-password', 'second-password-ok'], { cwd: dir });
-    assert.notEqual(rerun.status, 0, 'a re-run with a new password must not report success');
-    assert.match(`${rerun.stdout}${rerun.stderr}`, /already exists/i);
-    // The file on disk must still describe the password the database holds.
-    assert.match(readFileSync(join(dir, '.env'), 'utf8'), /first-password-ok/);
-    assert.ok(!readFileSync(join(dir, '.env'), 'utf8').includes('second-password-ok'));
-  });
-});
-
-test('a re-run WITHOUT --admin-password still proceeds past the password gate', () => {
-  withDir((dir) => {
-    writeFileSync(
-      join(dir, '.env'),
-      "MAUDE_ADMIN_EMAIL='ops@acme.com'\nMAUDE_ADMIN_PASSWORD='first-password-ok'\nHUB_SECRET='abc'\n",
-      { mode: 0o600 }
-    );
-    const r = runCli([...BASE, '--dry-run'], { cwd: dir });
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(existsSync(join(dir, '.env')));
-  });
-});
-
-// M1 — on the live AWS run `restore-drill` reported a flat red `failed` for
-// something that was not a backup problem at all: the host clone had no
-// `node_modules`, so `backup.mjs` died on `Cannot find module
-// 'better-sqlite3'`, and the image ships the bundled server rather than
-// `cli/bin/maude.mjs`, so there was no third place to try. An operator reading
-// "the backup is broken" starts recovering from a problem they do not have.
-test('a drill that could not RUN is skipped, not failed', () => {
-  const verdict = classifyDrillFailure(
-    "maude hub backup: Cannot find module 'better-sqlite3'\nRequire stack: /x/apps/hub/src/backup.mjs"
-  );
-  assert.equal(verdict.ok, false);
-  assert.equal(verdict.skipped, true, 'unrunnable must not be reported as a failure');
-  assert.match(verdict.note, /could not run/i);
-});
-
-test('a missing backup engine is skipped too', () => {
-  const verdict = classifyDrillFailure(
-    'maude hub: the backup engine (apps/hub/src/backup.mjs) was not found.'
-  );
-  assert.equal(verdict.skipped, true);
-});
-
-test('no generation yet is skipped and says when to retry', () => {
-  const verdict = classifyDrillFailure('no complete backup generation exists');
-  assert.equal(verdict.skipped, true);
-  assert.match(verdict.note, /6h/);
-});
-
-// The drill doing its job must stay loud — this is the case the skips above
-// must never swallow.
-test('a REAL restore failure is still a failure', () => {
-  const verdict = classifyDrillFailure('restored database has documents 0 — refusing to pass');
-  assert.equal(verdict.ok, false);
-  assert.ok(!verdict.skipped, 'an empty restore is a genuine failure, not a skip');
-  assert.match(verdict.note, /provisioning drill failed/);
-});
-
-// M7 — without a canvas domain the stack comes up green and every canvas is a
-// blank frame. Verification never catches it (all eight steps pass), so the
-// COMMAND has to say it — loudly, in both the dry run and the real one.
-test('--dry-run without --canvas-domain warns that canvases will not render remotely', () => {
-  withDir((dir) => {
-    const r = runCli([...BASE, '--dry-run'], { cwd: dir });
-    assert.equal(r.status, 0, r.stderr);
-    assert.match(`${r.stdout}${r.stderr}`, /canvases will NOT render in remote browsers/i);
-    assert.match(r.stdout, /canvas\s+NOT SET/);
-  });
-});
-
-test('--canvas-domain silences the warning and renders the full chain', () => {
-  withDir((dir) => {
-    const r = runCli([...BASE, '--dry-run', '--canvas-domain', 'canvas.acme.com'], { cwd: dir });
-    assert.equal(r.status, 0, r.stderr);
-    const out = `${r.stdout}${r.stderr}`;
-    assert.ok(!/NOT render in remote browsers/i.test(out), 'warning must be gone');
-    assert.match(r.stdout, /canvas\s+https:\/\/canvas\.acme\.com/);
-    // The duty list tells the operator the second DNS record is on them.
-    assert.match(r.stdout, /DNS for the canvas domain/);
-  });
-});
-
-test('--local does not warn — localhost IS reachable from the browser that matters there', () => {
-  withDir((dir) => {
-    const r = runCli(
-      ['hub', 'workspace-up', '--local', '--admin-email', 'ops@acme.com', '--dry-run'],
-      { cwd: dir }
-    );
-    assert.equal(r.status, 0, r.stderr);
-    assert.ok(!/NOT render in remote browsers/i.test(`${r.stdout}${r.stderr}`));
-  });
-});
-
-// M10 — `--render` on a host the sidecar image is not published for.
-//
-// On the live AWS run the flag was accepted, the compose file was written, the
-// image PULLED (Docker falls back across architectures on pull), and the truth
-// arrived as `exec format error` in a container log — after 2.99 GB. The
-// judgement lives in `classifyRenderImage` (unit-tested next door); what is
-// only true out here is that the command asks BEFORE it writes.
-
-/**
- * A `docker` on PATH that answers exactly one question — which platforms an
- * image is published for — and exits non-zero for everything else, so a test
- * that slips past the gate fails loudly instead of trying to boot a stack.
- *
- * `manifest inspect --verbose` is the shape the real probe uses: an ARRAY of
- * descriptors for a manifest list, ONE object for a single-platform image.
- */
-function withFakeDocker({ platforms, missing = false }, fn) {
-  const dir = mkdtempSync(join(tmpdir(), 'maude-fake-docker-'));
-  let script;
-  if (missing) {
-    script =
-      '#!/bin/sh\ncase "$*" in\n' +
-      '  "manifest inspect --verbose "*) echo "manifest unknown" >&2; exit 1 ;;\n' +
-      'esac\nexit 90\n';
-  } else {
-    const descriptor = (p) => ({
-      Ref: 'ghcr.io/1agh/maude-render',
-      Descriptor: { platform: { os: p.split('/')[0], architecture: p.split('/')[1] } },
-    });
-    const body = platforms.length === 1 ? descriptor(platforms[0]) : platforms.map(descriptor);
-    script =
-      '#!/bin/sh\ncase "$*" in\n' +
-      '  "manifest inspect --verbose "*) cat <<\'JSON\'\n' +
-      `${JSON.stringify(body, null, 2)}\nJSON\n    exit 0 ;;\n` +
-      'esac\nexit 90\n';
-  }
-  const bin = join(dir, 'docker');
-  writeFileSync(bin, script);
-  chmodSync(bin, 0o755);
-  try {
-    return fn({ PATH: `${dir}:${process.env.PATH}` });
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-/** What `hostContainerPlatform()` will report inside the child process. */
-const HOST_PLATFORM = `linux/${{ x64: 'amd64', arm64: 'arm64' }[process.arch] ?? process.arch}`;
-
-test('--render on a host the image is not published for refuses, and writes NOTHING', () => {
-  withDir((dir) => {
-    // s390x so the case holds on any machine this suite runs on.
-    const r = withFakeDocker({ platforms: ['linux/s390x'] }, (env) =>
-      runCli([...BASE, '--render', '--image-tag', 'v1.0.2'], { cwd: dir, env })
-    );
-    assert.equal(r.status, 2, `${r.stdout}${r.stderr}`);
-    const out = `${r.stdout}${r.stderr}`;
-    assert.match(out, /--render cannot work on this machine/);
-    assert.match(out, /exec format error/);
-    assert.match(out, new RegExp(HOST_PLATFORM.replace('/', '\\/')));
-    // The whole point: no compose file naming a container that cannot start.
-    assert.ok(!existsSync(join(dir, 'docker-compose.yml')), 'no compose file may be written');
-    assert.ok(!existsSync(join(dir, '.env')), 'no .env may be written');
-  });
-});
-
-test('--render without --image-tag says the sidecar has no :latest, before pulling it', () => {
-  withDir((dir) => {
-    const r = withFakeDocker({ missing: true }, (env) =>
-      runCli([...BASE, '--render'], { cwd: dir, env })
-    );
-    assert.equal(r.status, 2, `${r.stdout}${r.stderr}`);
-    assert.match(`${r.stdout}${r.stderr}`, /RELEASE TAGS ONLY/);
-    assert.ok(!existsSync(join(dir, 'docker-compose.yml')));
-  });
-});
-
-test('--render on a multi-arch image covering this host proceeds', () => {
-  withDir((dir) => {
-    const r = withFakeDocker({ platforms: ['linux/amd64', 'linux/arm64', HOST_PLATFORM] }, (env) =>
-      runCli([...BASE, '--render', '--image-tag', 'v1.0.3', '--dry-run'], { cwd: dir, env })
-    );
-    assert.equal(r.status, 0, `${r.stdout}${r.stderr}`);
-    assert.match(r.stdout, /DRY RUN/);
-    assert.ok(!/cannot work on this machine/.test(`${r.stdout}${r.stderr}`));
-  });
-});
-
-test('no docker at all is a warning, not a refusal — an offline operator is not the bug', () => {
-  withDir((dir) => {
-    const r = runCli([...BASE, '--render', '--image-tag', 'v1.0.3', '--dry-run'], {
-      cwd: dir,
-      // An empty PATH: `which docker` cannot find anything.
-      env: { PATH: join(dir, 'nothing-here') },
-    });
-    assert.equal(r.status, 0, `${r.stdout}${r.stderr}`);
-    assert.match(r.stderr, /could not check whether/);
-  });
-});