@1agh/maude 1.0.9 → 1.2.0

package/cli/lib/figma-codegen-reachability.test.mjs

@@ -1,104 +0,0 @@
-// DDR-219 D2 regression guard — the codegen channel is a CONTROL, not an intent.
-//
-// The first draft of DDR-219 routed Figma Dev Mode codegen through the REMOTE
-// MCP (`https://mcp.figma.com/mcp`) and treated our own code's inability to
-// reach it as the safety property. The design-stage review took that apart:
-//
-//   - the remote catalog "allowlist" is enforced on a self-reported OAuth
-//     `client_name`, and a public bypass for it exists — so it is a waitlist,
-//     not a boundary;
-//   - the LOCAL Dev Mode server (`http://127.0.0.1:3845/mcp`) takes plain
-//     loopback HTTP with NO credential and no catalog gate at all, so nothing
-//     but intent stands between a future contributor and `fetch(...)` inside
-//     `apps/studio/figma/`;
-//   - DDR-185's `curl-local` *permits* that endpoint by construction (its rule
-//     is "every resolved address is loopback", and 127.0.0.1 is), and an ACP
-//     session auto-approves `Bash(maude:*)` — so the one egress control the
-//     session trusts is, for this specific service, an allow rule.
-//
-// Reaching the remote endpoint from product code would put a third-party model's
-// output into an ingestion path that DDR-216 D1 says is deterministic end to
-// end. Reaching the local one from anywhere except the single designated client
-// would make codegen a bulk ingestion route by accident — DDR-219 D1's table
-// silently false, its fallback never firing, and nothing in CI noticing.
-//
-// So both halves are asserted here rather than described in a decision record.
-
-import assert from 'node:assert/strict';
-import { execSync } from 'node:child_process';
-import { test } from 'node:test';
-
-/** The ONE module allowed to name the local Dev Mode endpoint (DDR-219 D2). */
-const CODEGEN_CLIENT = 'apps/studio/figma/codegen-client.ts';
-
-/**
- * Tests under the Figma lane may name it too, and the widening is narrow on
- * purpose. `codegen-client.test.ts` asserts the endpoint constant — that IS the
- * control ("the URL is never influenced by input"), and a guard that forbids
- * asserting the thing it guards would push the assertion out of the repo.
- * `from-codegen.test.ts` carries a captured response fixture whose asset
- * constants are loopback URLs, and the property under test is that the converter
- * DISCARDS them — which can only be asserted against a fixture that has them.
- *
- * Neither executes anything against the port. What stays absolutely banned is a
- * second non-test module reaching it, which is the shape that would make codegen
- * a bulk ingestion route by accident.
- */
-const TEST_FILE_RE = /^apps\/studio\/figma\/[a-z-]+\.test\.ts$/;
-
-/** Trees that ship or execute. Prose (`.ai/`, `docs/`, `site/`) may name both. */
-const RUNTIME_TREES = ['apps/studio', 'cli', 'plugins'];
-
-/** Source only. `node_modules` vendors binaries that contain arbitrary strings
- *  (the bundled agent-sdk `claude` matched `mcp.figma.com` on the first run),
- *  and `dist/` is build output, not a code path anyone edits. `-I` drops binary
- *  files outright so a vendored blob can never turn this guard into noise —
- *  a guard that cries wolf gets deleted, which would be worse than not having it. */
-function grep(pattern, trees) {
-  // `|| true` because grep exits 1 on no-match, which is the passing case.
-  const out = execSync(
-    `grep -rlIE --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=.git ${JSON.stringify(pattern)} ${trees.join(' ')} 2>/dev/null || true`,
-    { encoding: 'utf8', cwd: new URL('../../', import.meta.url).pathname }
-  );
-  return out
-    .trim()
-    .split('\n')
-    .filter(Boolean)
-    .filter((f) => !f.endsWith('figma-codegen-reachability.test.mjs'));
-}
-
-test('no runtime code names the REMOTE Figma MCP endpoint', () => {
-  const offenders = grep('mcp\\.figma\\.com', RUNTIME_TREES);
-  assert.deepEqual(
-    offenders,
-    [],
-    `These files name the remote Figma MCP endpoint. It is banned from every runtime code path (DDR-219 D2, and \`feature-figma-import\` § Out of scope before it): it is reachable only by a catalog-listed agent client, so any use here means a model is in the ingestion path. Codegen goes over the LOCAL server, with apps/studio as the client:\n  ${offenders.join('\n  ')}`
-  );
-});
-
-test('only the designated client names the LOCAL Dev Mode endpoint', () => {
-  // Match the endpoint shape, not a bare `3845`, which could legitimately occur
-  // as a byte count or a hash fragment.
-  const offenders = grep('(localhost|127\\.0\\.0\\.1|:)3845', RUNTIME_TREES).filter(
-    (f) => f !== CODEGEN_CLIENT && !TEST_FILE_RE.test(f)
-  );
-  assert.deepEqual(
-    offenders,
-    [],
-    `Only ${CODEGEN_CLIENT} may reach the local Figma Dev Mode MCP server (DDR-219 D2). A second caller makes codegen an ingestion route by accident — and the local server is UNAUTHENTICATED loopback, so there is no credential step to notice it. If codegen is genuinely needed elsewhere, route it through the client:\n  ${offenders.join('\n  ')}`
-  );
-});
-
-test('no canvas-reachable codegen route exists', () => {
-  // A canvas-origin codegen route would hand the untrusted iframe (DDR-054) a
-  // primitive that reads the user's open Figma document. It belongs in NEITHER
-  // allowlist — the same standing rule DDR-088 sets for every privileged route.
-  const offenders = grep('CANVAS_SAFE_API[^\\n]*codegen|codegen[^\\n]*CANVAS_SAFE_API', [
-    'apps/studio',
-  ]);
-  assert.deepEqual(
-    offenders,
-    [],
-    `A codegen route appears near CANVAS_SAFE_API. Codegen is privileged-origin only (DDR-219 D2):\n  ${offenders.join('\n  ')}`
-  );
-});

package/cli/lib/figma-import-controls.test.mjs

@@ -1,70 +0,0 @@
-// DDR-216 D7 + D8 existence guard — the anti-recurrence test.
-//
-// This repo has now written the same mistake into three consecutive decision
-// records: a DDR asserts a control, nobody builds it, and the NEXT DDR cites it
-// as an existing mitigation. DDR-216 D7 promised `/design:edit` a pre-flight
-// untrusted-content banner on an imported canvas; D8 promised Pass A.10 run
-// promoted-to-blocker for `imported-figma`. Both were "shipped" in prose. When
-// DDR-219 leaned on the A.10 promotion as a control that was "still enforced,
-// unchanged", the design-stage review ran one command —
-//
-//     grep -rn "imported-figma" plugins/     →  zero matches
-//
-// — and the whole chain came apart. A decision record cannot assert its way to a
-// control. This test is the cheapest possible thing that would have caught it,
-// and it is deliberately dumb: it checks the string is REACHABLE from the files
-// that must act on it, not that the behaviour is correct.
-
-import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-import { test } from 'node:test';
-
-const root = new URL('../../', import.meta.url).pathname;
-const read = (p) => readFileSync(root + p, 'utf8');
-
-test('DDR-216 D7 — /design:edit banners an imported canvas before reading it', () => {
-  const edit = read('plugins/design/commands/edit.md');
-  assert.match(
-    edit,
-    /imported-figma/,
-    "/design:edit must detect an `imported-figma` canvas at pre-flight (DDR-216 D7). Without it, several hundred third-party strings enter a tool-holding agent's context with nothing saying what they are."
-  );
-  assert.match(
-    edit,
-    /untrusted content, never instructions/i,
-    "The banner must say the content is untrusted and is never instructions — that exact framing is the control (DDR-216 D7, DDR-085's whiteboard trust model)."
-  );
-});
-
-test('DDR-216 D8 — Pass A.10 is promoted to blocker on an imported canvas', () => {
-  const keeper = read('plugins/design/agents/design-system-keeper.md');
-  const a10 = keeper.slice(keeper.indexOf('## Pass A.10'));
-  assert.notEqual(a10, '', 'Pass A.10 section is missing from design-system-keeper.');
-  assert.match(
-    a10,
-    /imported-figma/,
-    'Pass A.10 must special-case `imported-figma` (DDR-216 D8). As a plain warning it is not a gate.'
-  );
-  assert.match(
-    a10,
-    /blocker/i,
-    'A.10 findings must be blockers on an imported canvas — the mass-drift stacking ladder exists to avoid nagging a human over one deliberate overlay, and that reasoning does not survive a machine-authored file.'
-  );
-});
-
-test('A.10 does not let an imported canvas skip via its declared kind', () => {
-  // The skip condition is "no kind=\"web\" artboard" — and on an import the
-  // TRANSLATOR picks the kind, so the gate would be satisfied by the very code
-  // it audits. DDR-216 D8's Round-1 correction named this; the exception closes it.
-  const keeper = read('plugins/design/agents/design-system-keeper.md');
-  const a10 = keeper.slice(keeper.indexOf('## Pass A.10'), keeper.indexOf('## Pass B'));
-  const skipIdx = a10.indexOf('Skip entirely');
-  assert.ok(skipIdx > -1, 'A.10 skip condition not found — did the section change shape?');
-  assert.match(
-    a10.slice(skipIdx, skipIdx + 1200),
-    // `[\s\S]` rather than `[^]` — same "any char incl. newline" meaning, but
-    // `[^]` is a negated EMPTY class, which biome flags and which reads as a typo.
-    /EXCEPTION[\s\S]*imported-figma/,
-    'The skip condition must carry an explicit imported-canvas exception, stated next to the skip itself where a reader will actually meet it.'
-  );
-});

package/cli/lib/flow-design-integration.test.mjs

@@ -1,165 +0,0 @@
-// Phase 11 (flow ⇄ design integration) regression guard.
-//
-// The slash-command orchestration (/flow:plan canvas detection, /flow:done
-// handoff sweep, codebase-intelligence design section, ddr-keeper canvas prompt)
-// is LLM-driven markdown — not unit-testable. What IS deterministic, and what
-// this test locks down, is the *contract* that wiring depends on:
-//
-//   1. The canvas `.meta.json` schema accepts the Phase 11 fields
-//      (status enum, handoffCommit, tags, brief_sha) and rejects a bad status.
-//   2. The flow config schema accepts `paths.designRoot`, the real skeleton
-//      config validates, and the field stays OPTIONAL (no regression for
-//      projects without the design plugin).
-//   3. The /flow:done status round-trip (ready-for-handoff → handed-off +
-//      handoffCommit) produces schema-valid output at both ends.
-//   4. The markdown wiring for all four integrations is present (grep guard) —
-//      a future edit that deletes a section fails loudly here.
-
-import assert from 'node:assert/strict';
-import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { test } from 'node:test';
-import Ajv2020 from 'ajv/dist/2020.js';
-import addFormats from 'ajv-formats';
-import { lintConfig } from './config-lint.mjs';
-
-const read = (p) => readFileSync(resolve(p), 'utf8');
-const readJson = (p) => JSON.parse(read(p));
-
-const META_SCHEMA = readJson('apps/studio/canvas-meta.schema.json');
-const FLOW_SCHEMA = readJson('plugins/flow/.claude-plugin/config.schema.json');
-const SKELETON = readJson('plugins/flow/templates/ai-skeleton/workflows.config.json');
-
-const ajv = new Ajv2020({ allErrors: true, strict: false });
-addFormats(ajv);
-const validateMeta = ajv.compile(META_SCHEMA);
-
-// ── 1. canvas-meta schema accepts the Phase 11 fields ──────────────────────
-
-test('canvas-meta: accepts status + tags (ready-for-handoff)', () => {
-  const ok = validateMeta({
-    title: 'Dark Mode Toggle',
-    sections: [{ id: 'hero', label: 'Hero' }],
-    tags: ['dark-mode'],
-    status: 'ready-for-handoff',
-  });
-  assert.equal(ok, true, JSON.stringify(validateMeta.errors));
-});
-
-test('canvas-meta: accepts handed-off + handoffCommit + brief_sha', () => {
-  const ok = validateMeta({
-    title: 'Settings',
-    sections: [],
-    status: 'handed-off',
-    handoffCommit: '8dd832b',
-    brief_sha: 'abc123def456',
-  });
-  assert.equal(ok, true, JSON.stringify(validateMeta.errors));
-});
-
-test('canvas-meta: every status enum value is accepted', () => {
-  for (const status of ['draft', 'in-review', 'ready-for-handoff', 'handed-off']) {
-    const ok = validateMeta({ title: 'X', sections: [], status });
-    assert.equal(ok, true, `status=${status}: ${JSON.stringify(validateMeta.errors)}`);
-  }
-});
-
-test('canvas-meta: a bogus status enum is REJECTED', () => {
-  const ok = validateMeta({ title: 'X', sections: [], status: 'shipped' });
-  assert.equal(ok, false, 'expected status="shipped" to be rejected by the enum');
-});
-
-test('canvas-meta: back-compat — a sidecar without any Phase 11 field still validates', () => {
-  const ok = validateMeta({ title: 'Legacy', sections: [{ id: 's', label: 'S' }] });
-  assert.equal(ok, true, JSON.stringify(validateMeta.errors));
-});
-
-test('canvas-meta: tags must be unique strings', () => {
-  assert.equal(validateMeta({ title: 'X', sections: [], tags: ['a', 'a'] }), false);
-  assert.equal(validateMeta({ title: 'X', sections: [], tags: [1, 2] }), false);
-});
-
-// ── 2. flow config schema: paths.designRoot ────────────────────────────────
-
-test('flow config: the real skeleton config (with paths.designRoot) validates', async () => {
-  const r = await lintConfig({ config: SKELETON, schema: FLOW_SCHEMA });
-  assert.equal(r.ok, true, JSON.stringify(r.errors));
-});
-
-test('flow config: skeleton declares paths.designRoot = .design', () => {
-  assert.equal(SKELETON.paths.designRoot, '.design');
-});
-
-test('flow config: paths.designRoot is OPTIONAL (no-regression for non-design projects)', async () => {
-  const r = await lintConfig({
-    config: { name: 'x', paths: { prd: '.ai/x-prd.md' } },
-    schema: FLOW_SCHEMA,
-  });
-  assert.equal(r.ok, true, JSON.stringify(r.errors));
-});
-
-test('flow config: a non-string paths.designRoot is rejected', async () => {
-  const r = await lintConfig({
-    config: { name: 'x', paths: { designRoot: 42 } },
-    schema: FLOW_SCHEMA,
-  });
-  assert.equal(r.ok, false);
-});
-
-test('flow config: paths.designRoot carries a default of .design', () => {
-  assert.equal(FLOW_SCHEMA.properties.paths.properties.designRoot.default, '.design');
-});
-
-// ── 3. /flow:done status round-trip stays schema-valid ─────────────────────
-
-test('done sweep round-trip: ready-for-handoff → handed-off + handoffCommit both valid', () => {
-  const before = { title: 'Canvas', sections: [], status: 'ready-for-handoff', tags: ['feat'] };
-  assert.equal(validateMeta(before), true, `before: ${JSON.stringify(validateMeta.errors)}`);
-
-  // what /flow:done step 5b writes:
-  const after = { ...before, status: 'handed-off', handoffCommit: 'deadbeef0123' };
-  assert.equal(validateMeta(after), true, `after: ${JSON.stringify(validateMeta.errors)}`);
-});
-
-// ── 4. markdown wiring guards (a deleted section fails here) ────────────────
-
-const PLAN = read('plugins/flow/commands/plan.md');
-const DONE = read('plugins/flow/commands/done.md');
-const MAP_CMD = read('plugins/flow/commands/setup-codebase-map.md');
-const CI_SKILL = read('plugins/flow/skills/codebase-intelligence/SKILL.md');
-const DDR_SKILL = read('plugins/flow/skills/ddr-keeper/SKILL.md');
-const RECORD_DDR = read('plugins/flow/commands/record-ddr.md');
-
-test('wiring: /flow:plan has Design Canvas Detection', () => {
-  assert.match(PLAN, /Design Canvas Detection/);
-  assert.match(PLAN, /paths\.designRoot/);
-  assert.match(PLAN, /### Design canvases/); // the Context References subsection
-});
-
-test('wiring: /flow:done has the handoff sweep + soft-gate DDR-066 reference', () => {
-  assert.match(DONE, /Design handoff sweep/);
-  assert.match(DONE, /ready-for-handoff/);
-  assert.match(DONE, /handed-off/);
-  assert.match(DONE, /handoffCommit/);
-  assert.match(DONE, /DDR-066/);
-});
-
-test('wiring: codebase map command + skill have the Design artifacts section', () => {
-  assert.match(MAP_CMD, /Map Design Artifacts/);
-  assert.match(MAP_CMD, /## Design artifacts/);
-  assert.match(CI_SKILL, /Design Artifact Scanning/);
-  assert.match(CI_SKILL, /### Design artifacts/);
-});
-
-test('wiring: ddr-keeper + record-ddr have the canvas-reference prompt', () => {
-  assert.match(DDR_SKILL, /Canvas reference for UI-affecting decisions/);
-  assert.match(DDR_SKILL, /Related canvas/);
-  assert.match(RECORD_DDR, /Related canvas/);
-});
-
-test('wiring: DDR-066 exists and is indexed', () => {
-  const ddr = read('.ai/archive/decisions/DDR-066-soft-handoff-prompt-in-flow-done.md');
-  assert.match(ddr, /soft prompt/i);
-  const index = read('.ai/archive/decisions/README.md');
-  assert.match(index, /DDR-066/);
-});

package/cli/lib/gitignore-block.test.mjs

@@ -1,136 +0,0 @@
-// gitignore-block helper tests — Phase 9 Task 9 (DDR-056).
-
-import assert from 'node:assert/strict';
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { test } from 'node:test';
-
-import {
-  applyBlock,
-  BEGIN_MARKER,
-  buildBlock,
-  END_MARKER,
-  hasBlock,
-  writeGitignoreBlock,
-} from './gitignore-block.mjs';
-
-function withRepo(fn) {
-  const dir = mkdtempSync(join(tmpdir(), 'maude-gitignore-'));
-  try {
-    return fn(dir);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-}
-
-test('buildBlock includes the runtime paths and is marker-wrapped', () => {
-  const block = buildBlock('.design');
-  assert.ok(block.startsWith(BEGIN_MARKER));
-  assert.ok(block.trimEnd().endsWith(END_MARKER));
-  for (const p of [
-    '.design/_state/',
-    '.design/_server.json',
-    '.design/_server.log',
-    '.design/_server.lock',
-    '.design/_active.json',
-    '.design/_sync.json',
-    '.design/_preflight.json',
-    '.design/_locator.json',
-    '.design/_export-history.json',
-    '.design/_history/',
-    '.design/_trash/',
-    '.design/_draw/',
-    '.design/_smoke/',
-    '.design/_canvas-state/', // covers the DDR-115 `<slug>.view.json` camera
-    '.design/_chat/',
-    '.design/_untrusted/',
-    '.design/_comments/', // hub-sync-only (DDR-115)
-  ]) {
-    assert.ok(block.includes(p), `missing ${p}`);
-  }
-  // VERSIONED content must NOT be ignored (DDR-115 taxonomy).
-  assert.ok(!block.includes('.design/config.json'));
-  assert.ok(!/\.design\/\*\.html/.test(block));
-  // Annotations are versioned — never in the ignore block.
-  assert.ok(!/annotations\.svg/.test(block), 'annotations must stay versioned');
-});
-
-test('buildBlock honors a custom design root', () => {
-  const block = buildBlock('design');
-  assert.ok(block.includes('design/_server.json'));
-  assert.ok(!block.includes('.design/_server.json'));
-});
-
-test('writeGitignoreBlock creates .gitignore when absent', () => {
-  withRepo((dir) => {
-    const { action, path } = writeGitignoreBlock(dir);
-    assert.equal(action, 'created');
-    const text = readFileSync(path, 'utf8');
-    assert.ok(hasBlock(text));
-  });
-});
-
-test('writeGitignoreBlock is idempotent — second run is unchanged', () => {
-  withRepo((dir) => {
-    writeGitignoreBlock(dir);
-    const first = readFileSync(join(dir, '.gitignore'), 'utf8');
-    const { action } = writeGitignoreBlock(dir);
-    const second = readFileSync(join(dir, '.gitignore'), 'utf8');
-    assert.equal(action, 'unchanged');
-    assert.equal(first, second);
-    // Exactly one block — no duplication.
-    assert.equal(first.split(BEGIN_MARKER).length - 1, 1);
-  });
-});
-
-test('writeGitignoreBlock preserves user content outside the markers', () => {
-  withRepo((dir) => {
-    const userContent = 'node_modules/\n*.log\n.env\n';
-    writeFileSync(join(dir, '.gitignore'), userContent);
-    writeGitignoreBlock(dir);
-    const text = readFileSync(join(dir, '.gitignore'), 'utf8');
-    assert.ok(text.includes('node_modules/'));
-    assert.ok(text.includes('.env'));
-    assert.ok(hasBlock(text));
-  });
-});
-
-test('writeGitignoreBlock updates an existing block in place (no duplication)', () => {
-  withRepo((dir) => {
-    // Seed a stale block with a different design root.
-    const stale = `keep-me\n${buildBlock('olddesign')}trailing\n`;
-    writeFileSync(join(dir, '.gitignore'), stale);
-    const { action } = writeGitignoreBlock(dir, { designRel: '.design' });
-    assert.equal(action, 'updated');
-    const text = readFileSync(join(dir, '.gitignore'), 'utf8');
-    assert.equal(text.split(BEGIN_MARKER).length - 1, 1, 'still exactly one block');
-    assert.ok(text.includes('.design/_server.json'));
-    assert.ok(!text.includes('olddesign/_server.json'));
-    assert.ok(text.includes('keep-me'));
-    assert.ok(text.includes('trailing'));
-  });
-});
-
-test('writeGitignoreBlock --dry-run does not touch disk', () => {
-  withRepo((dir) => {
-    const { action } = writeGitignoreBlock(dir, { dryRun: true });
-    assert.equal(action, 'created');
-    // File was not actually written.
-    assert.throws(() => readFileSync(join(dir, '.gitignore'), 'utf8'));
-  });
-});
-
-test('applyBlock appends to a file lacking a trailing newline cleanly', () => {
-  const out = applyBlock('a\nb', buildBlock('.design'));
-  assert.ok(out.includes('a\nb'));
-  assert.ok(hasBlock(out));
-  // No run-together: marker starts on its own line.
-  assert.ok(out.includes(`\n${BEGIN_MARKER}`));
-});
-
-test('hasBlock detects both markers', () => {
-  assert.ok(hasBlock(`x\n${BEGIN_MARKER}\ny\n${END_MARKER}\n`));
-  assert.ok(!hasBlock('just user content'));
-  assert.ok(!hasBlock(BEGIN_MARKER)); // begin without end
-});

package/cli/lib/gitignore-drift.test.mjs

@@ -1,156 +0,0 @@
-// Gitignore drift — the check that catches git dropping VERSIONED design work.
-//
-// The case that produced this file, verbatim from a real project: a
-// hand-authored pre-markers block carrying `.design/*.annotations.svg`, copied
-// from a v1.0 planning document that predates the DDR-115 correction. Not one
-// annotation sidecar had ever been committed. Both UIs rendered the draw layer;
-// no clone, backup or PR contained it; nothing said so.
-//
-// What is pinned here is mostly the NEGATIVE space. A detector that proposes
-// deleting lines from somebody's hand-written `.gitignore` is only as good as
-// its refusals, so most of these tests assert what it must NOT flag.
-
-import assert from 'node:assert/strict';
-import { test } from 'node:test';
-
-import {
-  describeGitignoreDrift,
-  findGitignoreDrift,
-  removeGitignoreDrift,
-} from './gitignore-drift.mjs';
-
-test('finds the real-world case: annotations ignored outside the markers', () => {
-  const gitignore = [
-    'node_modules/',
-    '',
-    '# design plugin dev-server runtime state',
-    '.design/_active.json',
-    '.design/_history/',
-    '.design/*.annotations.svg',
-    '.design/_chat/',
-  ].join('\n');
-  const drift = findGitignoreDrift(gitignore, '.design');
-  assert.equal(drift.length, 1);
-  assert.equal(drift[0].line, 6);
-  assert.equal(drift[0].text, '.design/*.annotations.svg');
-  assert.match(drift[0].what, /annotations/);
-});
-
-test('the runtime-state block is NOT drift — those paths are ignored by design', () => {
-  // Every line the block writer itself emits must come back clean, or the check
-  // would tell people to un-ignore their own `_history/` on every run.
-  const gitignore = [
-    '.design/_server.json',
-    '.design/_active.json',
-    '.design/_active.*.json',
-    '.design/_sync.json',
-    '.design/_history/',
-    '.design/_trash/',
-    '.design/_comments/',
-    '.design/_canvas-state/',
-    '.design/_untrusted/',
-    '.design/assets/',
-  ].join('\n');
-  assert.deepEqual(findGitignoreDrift(gitignore, '.design'), []);
-});
-
-test('lines INSIDE the maude block are skipped — a generator bug is fixed by the generator', () => {
-  const gitignore = [
-    '# maude:begin',
-    '.design/*.annotations.svg',
-    '# maude:end',
-    '.design/_history/',
-  ].join('\n');
-  assert.deepEqual(findGitignoreDrift(gitignore, '.design'), []);
-});
-
-test('a negation is the fix, not the fault', () => {
-  const gitignore = ['.design/', '!.design/*.annotations.svg'].join('\n');
-  assert.deepEqual(findGitignoreDrift(gitignore, '.design'), []);
-});
-
-test('comments and blank lines are not rules', () => {
-  const gitignore = ['', '# .design/*.annotations.svg', '   ', '#.design/*.tsx'].join('\n');
-  assert.deepEqual(findGitignoreDrift(gitignore, '.design'), []);
-});
-
-test('ignoring the WHOLE design root is a choice we do not second-guess', () => {
-  // Somebody who ignores `.design/` outright has decided their design work is
-  // not in this repo. That is coherent; flagging it would be nagging.
-  for (const line of ['.design', '.design/', '/.design/']) {
-    assert.deepEqual(findGitignoreDrift(line, '.design'), [], line);
-  }
-});
-
-test('a repo-wide rule is out of scope — it is a decision about a whole codebase', () => {
-  // `*.tsx` at the repo root is very possibly deliberate and is not ours to
-  // reinterpret from inside a design-tool diagnostic.
-  const gitignore = ['*.tsx', 'config.json', '*.meta.json'].join('\n');
-  assert.deepEqual(findGitignoreDrift(gitignore, '.design'), []);
-});
-
-test('a non-default design root is honoured', () => {
-  const gitignore = ['design/*.annotations.svg', '.design/*.annotations.svg'].join('\n');
-  const drift = findGitignoreDrift(gitignore, 'design');
-  assert.equal(drift.length, 1);
-  assert.equal(drift[0].line, 1);
-});
-
-test('anchors and trailing slashes are the same rule to git', () => {
-  const drift = findGitignoreDrift('/.design/system/', '.design');
-  assert.equal(drift.length, 1);
-  assert.match(drift[0].what, /design system/);
-});
-
-test('every versioned shape is covered, none of the runtime ones', () => {
-  const versioned = [
-    '.design/*.annotations.svg',
-    '.design/*.meta.json',
-    '.design/*.tsx',
-    '.design/config.json',
-    '.design/system/',
-    // The glob form. Both sides of the comparison must be normalised the same
-    // way — normalising only the pattern made this shape report clean while the
-    // module listed it as covered.
-    '.design/system/**',
-  ];
-  assert.equal(findGitignoreDrift(versioned.join('\n'), '.design').length, versioned.length);
-});
-
-test('removal deletes exactly the reported lines, byte-for-byte otherwise', () => {
-  const gitignore = [
-    'node_modules/',
-    '',
-    '# my own comment',
-    '.design/*.annotations.svg',
-    '.design/_history/',
-  ].join('\n');
-  const drift = findGitignoreDrift(gitignore, '.design');
-  const next = removeGitignoreDrift(gitignore, drift);
-  assert.equal(
-    next,
-    ['node_modules/', '', '# my own comment', '.design/_history/'].join('\n'),
-    'the user comment and the blank line survive'
-  );
-  // And the result is clean on a re-run — the fix converges.
-  assert.deepEqual(findGitignoreDrift(next, '.design'), []);
-});
-
-test('removal with no drift is a byte-identical no-op', () => {
-  const gitignore = 'node_modules/\n.design/_history/\n';
-  assert.equal(removeGitignoreDrift(gitignore, []), gitignore);
-  assert.equal(removeGitignoreDrift(gitignore, undefined), gitignore);
-});
-
-test('an absent or empty gitignore is not drift', () => {
-  assert.deepEqual(findGitignoreDrift('', '.design'), []);
-  assert.deepEqual(findGitignoreDrift(undefined, '.design'), []);
-});
-
-test('the description names the consequence, not just the rule', () => {
-  const drift = findGitignoreDrift('.design/*.annotations.svg', '.design');
-  const [line] = describeGitignoreDrift(drift);
-  assert.match(line, /\.gitignore:1/);
-  assert.match(line, /drops/);
-  assert.match(line, /DDR-115/);
-});