@fungi.computer/bonsai 0.0.0-stage → 0.0.1

package/test/hooks.test.ts

@@ -0,0 +1,250 @@
+import { describe, expect, it } from "vitest";
+import * as z from "zod";
+import {
+  hookSpec,
+  signHook,
+  signStandardWebhook,
+  verifyHook,
+  type HookEvent,
+  type HookEventType,
+} from "../shared/hooks.js";
+import { buildAppDeclaration } from "@fungi.computer/agar/backend-declaration";
+import { appBackend as bonsaiBackend } from "../backend/methods.js";
+import bonsaiMetadata from "../package.json" with { type: "json" };
+const appDeclaration = buildAppDeclaration(
+  bonsaiBackend,
+  bonsaiMetadata.fungi.app,
+);
+
+const event: HookEvent = {
+  type: "git.push",
+  timestamp: "2026-10-10T20:00:00.000Z",
+  data: {
+    spec: hookSpec,
+    eventId: "evt_7",
+    repository: {
+      name: "pond--ada",
+      canonical: "pond",
+      cloneUrl: "https://bonsai.example/git/pond--ada.git",
+    },
+    actor: "ada",
+    activity: {
+      id: 7,
+      at: 1,
+      type: "push",
+      repo: "pond--ada",
+      actor: "ada",
+      data: {
+        updates: [
+          {
+            ref: "refs/heads/main",
+            before: "a".repeat(40),
+            after: "b".repeat(40),
+          },
+        ],
+        commits: [{ hash: "b".repeat(40), message: "Add food" }],
+        paths: ["src/food.ts"],
+      },
+    },
+  },
+};
+
+describe("hook signatures", () => {
+  it("verifies what it signs", async () => {
+    const body = JSON.stringify(event);
+    const header = await signHook("whsec_test", body, 1000);
+    expect(await verifyHook("whsec_test", body, header, 1010)).toEqual({
+      ok: true,
+      event,
+    });
+  });
+
+  it("refuses a wrong secret, a changed body and a stale timestamp", async () => {
+    const body = JSON.stringify(event);
+    const header = await signHook("whsec_test", body, 1000);
+    expect(await verifyHook("whsec_other", body, header, 1000)).toEqual({
+      ok: false,
+      reason: "signature",
+    });
+    expect(await verifyHook("whsec_test", `${body} `, header, 1000)).toEqual({
+      ok: false,
+      reason: "signature",
+    });
+    expect(await verifyHook("whsec_test", body, header, 2000)).toEqual({
+      ok: false,
+      reason: "stale",
+    });
+    expect(await verifyHook("whsec_test", body, null, 1000)).toEqual({
+      ok: false,
+      reason: "signature",
+    });
+  });
+});
+
+describe("Standard Webhooks signing", () => {
+  it("matches the specification's test vector", async () => {
+    expect(
+      await signStandardWebhook(
+        "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw",
+        "msg_p5jXN8AQM9LWM0D4loKWxJek",
+        1614265330,
+        '{"test": 2432232314}',
+      ),
+    ).toBe("v1,g0hM9SsE+OTPJTGt/tmIKtSyZlE3uFJELVlNIOLJ1OE=");
+  });
+});
+
+const identity = {
+  repo: "pond",
+  number: 1,
+  sourceRepo: "pond--ada",
+  sourceRef: "main",
+  targetRef: "main",
+  head: "b".repeat(40),
+};
+const declaredActivities = {
+  "git.push": event.data.activity,
+  "git.fork": {
+    ...event.data.activity,
+    type: "fork",
+    data: { fork: "pond--ada" },
+  },
+  "repo.created": { ...event.data.activity, type: "repo.created", data: {} },
+  "change.opened": {
+    ...event.data.activity,
+    type: "change.opened",
+    data: { change: identity },
+  },
+  "change.updated": {
+    ...event.data.activity,
+    type: "change.updated",
+    data: { change: identity },
+  },
+  "change.approved": {
+    ...event.data.activity,
+    type: "change.approved",
+    data: { change: identity },
+  },
+  "change.checks_requested": {
+    ...event.data.activity,
+    type: "change.checks_requested",
+    data: { change: identity },
+  },
+  "change.checked": {
+    ...event.data.activity,
+    type: "change.checked",
+    data: { change: identity },
+  },
+  "change.closed": {
+    ...event.data.activity,
+    type: "change.closed",
+    data: { change: identity },
+  },
+  "change.merged": {
+    ...event.data.activity,
+    type: "merge",
+    data: {
+      change: identity,
+      from: "pond--ada",
+      ref: "main",
+      before: "a".repeat(40),
+      after: "b".repeat(40),
+    },
+  },
+  "change.conflicted": {
+    ...event.data.activity,
+    type: "merge.conflict",
+    data: {
+      change: identity,
+      from: "pond--ada",
+      ref: "main",
+      paths: ["src/food.ts"],
+    },
+  },
+} satisfies Record<HookEventType, HookEvent["data"]["activity"]>;
+
+describe("declared hook payloads", () => {
+  it("declares the capability needed to emit Git and stored Change hooks", () => {
+    expect(appDeclaration.capabilities).toContain("app.events.emit");
+  });
+
+  it("declares the Git and stored Change hook event names", () => {
+    expect(Object.keys(appDeclaration.api?.events ?? {}).sort()).toEqual([
+      "change.approved",
+      "change.checked",
+      "change.checks_requested",
+      "change.closed",
+      "change.conflicted",
+      "change.merged",
+      "change.opened",
+      "change.updated",
+      "git.fork",
+      "git.push",
+      "repo.created",
+    ]);
+  });
+
+  it.each(Object.entries(declaredActivities))(
+    "declares the full %s envelope with its own event type",
+    (type, activity) => {
+      const declared = appDeclaration.api?.events?.[type];
+      expect(declared).toBeDefined();
+      if (!declared) throw new Error(`${type} is undeclared`);
+      const payload = z.fromJSONSchema({ ...declared.payload });
+      const data = type.startsWith("change.")
+        ? { ...event.data, activity, change: identity }
+        : { ...event.data, activity };
+      const emitted = { ...event, type, data };
+      expect(payload.parse(emitted)).toEqual(emitted);
+      expect(payload.safeParse(emitted.data).success).toBe(false);
+      expect(
+        payload.safeParse({
+          ...emitted,
+          type: type === "git.push" ? "git.fork" : "git.push",
+        }).success,
+      ).toBe(false);
+      expect(payload.safeParse({ ...emitted, extra: true }).success).toBe(
+        false,
+      );
+      expect(
+        payload.safeParse({
+          ...emitted,
+          data: { ...emitted.data, spec: "unknown" },
+        }).success,
+      ).toBe(false);
+      expect(
+        payload.safeParse({
+          ...emitted,
+          data: {
+            ...emitted.data,
+            activity: { ...activity, data: { unexpected: true } },
+          },
+        }).success,
+      ).toBe(false);
+    },
+  );
+});
+
+it("signs event permission on every outbox-producing write and none of the reads", () => {
+  const methods = appDeclaration.api?.methods;
+  if (methods === undefined) throw new Error("Bonsai API missing");
+  expect(methods["insights.layout.save"]?.requires).toEqual([
+    "app.events.emit",
+  ]);
+  expect(methods["changes.merge"]?.requires).toEqual([
+    "git.repository",
+    "app.events.emit",
+  ]);
+  const writes = Object.values(methods).filter(
+    (method) => method.effect === "write",
+  );
+  const reads = Object.values(methods).filter(
+    (method) => method.effect === "read",
+  );
+  expect(writes.length).toBeGreaterThan(0);
+  expect(reads.length).toBeGreaterThan(0);
+  for (const method of writes)
+    expect(method.requires).toContain("app.events.emit");
+  for (const method of reads)
+    expect(method.requires).not.toContain("app.events.emit");
+});

package/test/insight-data.test.ts

@@ -0,0 +1,51 @@
+import { expect, it } from "vitest";
+import {
+  actorSplit,
+  contributionDays,
+  contributionWeeks,
+} from "../web/insight-data.js";
+import type { Agent, Graph } from "../shared/contract.js";
+const actors: Agent[] = [
+  { id: "human", name: "Human", kind: "human", color: "c0", createdAt: 0 },
+  { id: "agent", name: "Agent", kind: "agent", color: "c1", createdAt: 0 },
+];
+const now = Date.UTC(2026, 9, 12);
+const graph: Graph = {
+  lanes: [],
+  nodes: ["human", "agent", null].map((agent, index) => ({
+    hash: String(index),
+    parents: index === 1 ? ["parent1", "parent2"] : [],
+    lanes: [],
+    message: "test",
+    author: "Human",
+    agent,
+    origin: null,
+    committedAt: now / 1000,
+  })),
+};
+it("classifies by recorded actor kind, never by display name or a missing origin", () => {
+  expect(actorSplit(graph, actors).commits).toEqual({
+    human: 1,
+    agent: 1,
+    unknown: 1,
+  });
+  expect(actorSplit(graph, actors).merges).toEqual({
+    human: 0,
+    agent: 1,
+    unknown: 0,
+  });
+  expect(
+    contributionWeeks(graph, actors, now).contributors.map((item) => item.kind),
+  ).toEqual(["human", "agent", "unknown"]);
+});
+it("counts unique graph commits into UTC days and keeps out-of-window commits out", () => {
+  const old = graph.nodes[0];
+  if (!old) throw new Error("Missing fixture node");
+  const days = contributionDays(
+    { ...graph, nodes: [...graph.nodes, { ...old, committedAt: 0 }] },
+    now,
+  );
+  expect(days).toHaveLength(182);
+  expect(days.at(-1)?.count).toBe(3);
+  expect(days.reduce((sum, day) => sum + day.count, 0)).toBe(3);
+});

package/test/insight-layout.test.mjs

@@ -0,0 +1,230 @@
+import { registerHooks } from "node:module";
+import { DatabaseSync } from "node:sqlite";
+import assert from "node:assert/strict";
+import { test } from "node:test";
+import { fromNodeSqlite } from "@fungi.computer/watchdog/node-sqlite";
+import { ensureBonsaiTables, BonsaiState } from "../backend/state.ts";
+import { appBackend } from "../backend/methods.ts";
+import { defaultLayout, insightLayout } from "../shared/insights.ts";
+
+const runtimeHooks = registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (specifier === "cloudflare:workers")
+      return {
+        url: import.meta
+          .resolve("@fungi.computer/oyster/testing/workers-runtime"),
+        shortCircuit: true,
+      };
+    return nextResolve(specifier, context);
+  },
+});
+const { BonsaiApp } = await import("../backend/index.ts");
+runtimeHooks.deregister();
+
+test("host push question uses authenticated IDs and refuses every update or unsupported shape", async () => {
+  const db = new DatabaseSync(":memory:");
+  try {
+    const storage = fromNodeSqlite(db);
+    const started = [];
+    const facet = new BonsaiApp(
+      { storage, waitUntil: (promise) => started.push(promise) },
+      { GIT: {}, EVENTS: { emit: () => Promise.resolve() } },
+    );
+    await Promise.all(started);
+    facet.bonsai.state.registerRepo({
+      name: "pond",
+      description: null,
+      parent: null,
+      owner: null,
+    });
+    facet.bonsai.state.registerRepo({
+      name: "pond--ada",
+      description: null,
+      parent: "pond",
+      owner: "agent_ada",
+    });
+    const update = {
+      ref: "refs/heads/main",
+      before: "a".repeat(40),
+      after: "b".repeat(40),
+    };
+    const question = {
+      repository: "pond--ada",
+      writer: { kind: "actor", actor: { kind: "agent", agentId: "agent_ada" } },
+      updates: [update],
+    };
+    const ask = (body) => facet.authorizeGitPush(body);
+    const allowed = await ask(question);
+    assert.deepEqual(allowed, { allowed: true });
+    const refused = await ask({
+      ...question,
+      repository: "pond",
+      updates: [update, { ...update, ref: "refs/heads/topic" }],
+    });
+    assert.deepEqual(refused, {
+      allowed: false,
+      refused: [
+        {
+          ref: "refs/heads/main",
+          message: "Writer cannot push to this repository",
+        },
+        {
+          ref: "refs/heads/topic",
+          message: "Writer cannot push to this repository",
+        },
+      ],
+    });
+    for (const invalid of [
+      { repo: "pond", actor: { name: "levi", kind: "human" } },
+      {
+        ...question,
+        writer: {
+          kind: "actor",
+          actor: { kind: "human", name: "levi" },
+        },
+      },
+      { ...question, updates: Array.from({ length: 257 }, () => update) },
+    ])
+      await assert.rejects(() => ask(invalid));
+    const member = await ask({
+      ...question,
+      repository: "pond",
+      writer: { kind: "actor", actor: { kind: "member", memberId: "levi" } },
+    });
+    assert.deepEqual(member, { allowed: true });
+    assert.deepEqual(facet.bonsai.state.events(null, 20), []);
+  } finally {
+    db.close();
+  }
+});
+
+test("App methods retain layouts by trusted caller and repository across reopening", async () => {
+  const db = new DatabaseSync(":memory:");
+  try {
+    const storage = fromNodeSqlite(db);
+    ensureBonsaiTables(storage.sql);
+    const context = {
+      bonsai: {
+        state: new BonsaiState(storage.sql, (body) => body()),
+        events: { emit: () => Promise.resolve() },
+      },
+    };
+    const member = (memberId) => ({
+      computerId: null,
+      actor: { kind: "member", memberId },
+    });
+    const call = (method, input, caller) =>
+      appBackend.call(method, input, context, caller);
+    await call(
+      "insights.layout.save",
+      { repo: "pond", tiles: defaultLayout },
+      member("a"),
+    );
+    await call(
+      "insights.layout.save",
+      { repo: "pond", tiles: { view: "overview", placements: [] } },
+      member("b"),
+    );
+    context.bonsai.state = new BonsaiState(storage.sql, (body) => body());
+    assert.deepEqual(
+      await call("insights.layout.get", { repo: "pond" }, member("a")),
+      { tiles: defaultLayout },
+    );
+    assert.deepEqual(
+      await call("insights.layout.get", { repo: "pond" }, member("b")),
+      { tiles: { view: "overview", placements: [] } },
+    );
+    assert.deepEqual(
+      await call("insights.layout.get", { repo: "other" }, member("a")),
+      { tiles: null },
+    );
+    assert.deepEqual(
+      await call(
+        "insights.layout.get",
+        { repo: "pond" },
+        { computerId: null, actor: { kind: "agent", agentId: "a" } },
+      ),
+      { tiles: null },
+    );
+    await assert.rejects(() =>
+      call(
+        "insights.layout.save",
+        {
+          repo: "pond",
+          tiles: { view: "overview", placements: [] },
+          actor: "a",
+        },
+        member("b"),
+      ),
+    );
+    assert.deepEqual(
+      await call("insights.layout.get", { repo: "pond" }, member("a")),
+      { tiles: defaultLayout },
+    );
+  } finally {
+    db.close();
+  }
+});
+
+test("placements reject duplicate tiles, unknown tiles and invalid spans", () => {
+  assert.equal(
+    insightLayout.safeParse({
+      view: "overview",
+      placements: [{ id: "network", col: 0, row: 0, w: 0, h: 1 }],
+    }).success,
+    false,
+  );
+  assert.equal(
+    insightLayout.safeParse({
+      view: "overview",
+      placements: [defaultLayout.placements[0], defaultLayout.placements[0]],
+    }).success,
+    false,
+  );
+  assert.equal(
+    insightLayout.safeParse({
+      view: "overview",
+      placements: [{ id: "invented", col: 0, row: 0, w: 1, h: 1 }],
+    }).success,
+    false,
+  );
+});
+
+test("old or invalid stored layouts are discarded without writes; saves stay strict", async () => {
+  const db = new DatabaseSync(":memory:");
+  try {
+    const storage = fromNodeSqlite(db);
+    ensureBonsaiTables(storage.sql);
+    const state = new BonsaiState(storage.sql, (body) => body());
+    const old = JSON.stringify([
+      { id: "branches", col: 0, row: 0, w: 3, h: 2 },
+    ]);
+    storage.sql.exec(
+      "INSERT INTO insight_layouts (actor, repo, tiles) VALUES (?, ?, ?)",
+      "a",
+      "pond",
+      old,
+    );
+    assert.equal(state.layout("a", "pond"), null);
+    assert.equal(
+      storage.sql
+        .exec("SELECT tiles FROM insight_layouts WHERE actor = ?", "a")
+        .one().tiles,
+      old,
+    );
+    assert.throws(() => state.saveLayout("a", "pond", JSON.parse(old)));
+    assert.equal(
+      storage.sql
+        .exec("SELECT tiles FROM insight_layouts WHERE actor = ?", "a")
+        .one().tiles,
+      old,
+    );
+    state.saveLayout("a", "pond", { view: "overview", placements: [] });
+    assert.deepEqual(state.layout("a", "pond"), {
+      view: "overview",
+      placements: [],
+    });
+  } finally {
+    db.close();
+  }
+});

package/test/insights.test.ts

@@ -0,0 +1,154 @@
+import { bindingOf } from "./git-binding.fixture.js";
+import { expect, it } from "vitest";
+import { advanceLineAges, readCodeInsights } from "../backend/insights.js";
+import type { GitStore } from "../backend/git.js";
+import type { Commit } from "@fungi.computer/agar/roles/files";
+
+it("preserves unchanged ages while deleting and replacing lines", () => {
+  expect(
+    advanceLineAges("old\nkeep\ndelete\n", "new\nkeep\n", [1, 2, 3], 10),
+  ).toEqual([10, 2]);
+  expect(advanceLineAges("", "last", [], 5)).toEqual([5]);
+  expect(advanceLineAges("same\n", "same\n", [null], 5)).toEqual([null]);
+});
+
+function fixture(length = 3) {
+  let reads = 0;
+  const commit = (index: number): Commit => ({
+    hash: String(index),
+    treeHash: `tree${String(index)}`,
+    parents: index > 1 ? [String(index - 1)] : [],
+    message: "edit",
+    author: { name: "a", email: "a@local" },
+    committer: { name: "a", email: "a@local" },
+    authoredAt: index * 86400,
+    committedAt: index * 86400,
+  });
+  const unused = () => Promise.reject(new Error("Unexpected Git operation"));
+  const store: GitStore = {
+    get binding() {
+      return bindingOf(this);
+    },
+    cloneUrl: unused,
+    create: unused,
+    fork: unused,
+    info: unused,
+    refs: unused,
+    exchange: unused,
+    log: () => Promise.resolve([commit(length)]),
+    commit: (_repo, hash) => Promise.resolve(commit(Number(hash))),
+    tree: (_repo, hash) => {
+      reads++;
+      return Promise.resolve([
+        {
+          name: "file.ts",
+          hash: hash === "tree1" ? "blob1" : "blob2",
+          mode: "100644",
+          type: "blob",
+        },
+      ]);
+    },
+    blob: (_repo, hash) => {
+      reads++;
+      return Promise.resolve(
+        new TextEncoder().encode(
+          hash === "blob1" ? "keep\nold\n" : "keep\nnew\n",
+        ),
+      );
+    },
+  };
+  return { store, reads: () => reads };
+}
+
+it("counts current lines and changed blobs, and shares a cached snapshot", async () => {
+  const f = fixture();
+  const result = await readCodeInsights(f.store, "repo", "main", 4 * 86400000);
+  expect(result.files).toEqual([{ path: "file.ts", lines: 2, changes: 2 }]);
+  expect(result.ageHistory.at(-1)?.lines[0]).toBe(2);
+  expect(result.partial).toBe(false);
+  const reads = f.reads();
+  expect(await readCodeInsights(f.store, "repo", "main", 4 * 86400000)).toEqual(
+    result,
+  );
+  expect(f.reads()).toBe(reads);
+});
+
+it("leaves pre-sample lines unknown instead of assigning a fabricated birthday", async () => {
+  const f = fixture(50);
+  const result = await readCodeInsights(f.store, "repo", "main", 60 * 86400000);
+  expect(result.commits).toBe(40);
+  expect(result.partial).toBe(true);
+  expect(result.ageHistory.at(-1)?.lines[4]).toBe(2);
+});
+
+it("bounds text-file sampling and reports omissions", async () => {
+  const f = fixture(1);
+  const store: GitStore = {
+    get binding() {
+      return bindingOf(this);
+    },
+    ...f.store,
+    tree: () =>
+      Promise.resolve(
+        Array.from({ length: 100 }, (_, index) => ({
+          name: `file${String(index)}.ts`,
+          hash: "blob1",
+          mode: "100644",
+          type: "blob" as const,
+        })),
+      ),
+  };
+  const result = await readCodeInsights(store, "large", "main", 4 * 86400000);
+  expect(result.files).toHaveLength(80);
+  expect(result.omittedFiles).toBe(20);
+  expect(result.partial).toBe(true);
+});
+
+it("does not report unavailable Git objects as empty successful data", async () => {
+  const f = fixture(1);
+  const store: GitStore = { ...f.store, blob: () => Promise.resolve(null) };
+  await expect(readCodeInsights(store, "broken", "main")).rejects.toThrow(
+    "Git blob is missing",
+  );
+  await expect(readCodeInsights(store, "broken", "main")).rejects.toThrow(
+    "Git blob is missing",
+  );
+});
+
+it("ages unchanged lines between historical snapshots and today", async () => {
+  const f = fixture();
+  const result = await readCodeInsights(f.store, "ages", "main", 40 * 86400000);
+  expect(result.ageHistory.map((snapshot) => snapshot.at)).toEqual([
+    86400,
+    2 * 86400,
+    3 * 86400,
+    40 * 86400,
+  ]);
+  expect(result.ageHistory[0]?.lines).toEqual([2, 0, 0, 0, 0]);
+  expect(result.ageHistory.at(-1)?.lines).toEqual([0, 0, 2, 0, 0]);
+});
+
+it("retains historical line counts when a later snapshot deletes lines", async () => {
+  const f = fixture();
+  const store: GitStore = {
+    get binding() {
+      return bindingOf(this);
+    },
+    ...f.store,
+    blob: (_repo, hash) =>
+      Promise.resolve(
+        new TextEncoder().encode(
+          hash === "blob1" ? "keep\ndelete\n" : "keep\n",
+        ),
+      ),
+  };
+  const result = await readCodeInsights(
+    store,
+    "deletions",
+    "main",
+    40 * 86400000,
+  );
+  expect(result.ageHistory[0]?.lines.reduce((a, b) => a + b, 0)).toBe(2);
+  expect(result.ageHistory[1]?.lines.reduce((a, b) => a + b, 0)).toBe(1);
+  expect(result.ageHistory.at(-1)?.lines).toEqual([0, 0, 1, 0, 0]);
+});