@fungi.computer/bonsai 0.1.0 → 0.2.0

package/test/git-push.worker.ts

@@ -1,3 +1,5 @@
+import * as S from "effect/Schema";
+import { repositoryWorkflowSourceSchema } from "@fungi.computer/workflows-wire";
 import {
   ReadCopyBudgetExceeded,
   countingGit,
@@ -8,7 +10,7 @@ import {
   type AppGitPushFact,
 } from "@fungi.computer/agar/git";
 import type { StandardWebhookPayload } from "@fungi.computer/oyster/git";
-import { BonsaiApp } from "../backend/index.js";
+import { BonsaiApp, type BonsaiEnv } from "../backend/index.js";
 import type { GitBinding } from "../backend/git.js";
 import type { HookEvent } from "../shared/hooks.js";
 
@@ -128,6 +130,7 @@ function growingGit(large: () => boolean): GitBinding {
 }
 
 export class BonsaiPushProbe extends BonsaiApp {
+  private readonly workflowRequests: unknown[];
   private readonly providerCalls: () => number;
   private readonly delivery: { failNext: boolean };
   private readonly emitted: {
@@ -162,8 +165,44 @@ export class BonsaiPushProbe extends BonsaiApp {
       limit: 10_000,
       signal: lifetime.signal,
     });
-    super(ctx, {
+    const workflowRequests: unknown[] = [];
+    const unsupported = () =>
+      Promise.reject(
+        new Error("Unexpected APPS operation in lifecycle handoff proof"),
+      );
+    const bindings: BonsaiEnv = {
       GIT: counted.git,
+      APPS: {
+        register: unsupported,
+        fork: unsupported,
+        build: unsupported,
+        buildStatus: unsupported,
+        select: unsupported,
+        // Only pond is already registered. Reading this source must not build.
+        repository: ({ repo }: { repo: string }) =>
+          Promise.resolve(
+            repo === "pond"
+              ? S.decodeUnknownSync(repositoryWorkflowSourceSchema)({
+                  appId: "app_pond",
+                  installationId: "bonsai",
+                  callerAppId: "app_bonsai",
+                  callerSourceRevision: "git:" + "a".repeat(40),
+                })
+              : null,
+          ),
+      },
+      WORKFLOWS: {
+        runs: unused,
+        graphStatus: unused,
+        runGraph: (input) => {
+          workflowRequests.push(input);
+          return Promise.resolve({
+            kind: "started",
+            runId: "run_main",
+            planDigest: "sha256:" + "d".repeat(64),
+          });
+        },
+      },
       EVENTS: {
         emit: (type, payload, eventId) => {
           if (delivery.failNext) {
@@ -174,7 +213,9 @@ export class BonsaiPushProbe extends BonsaiApp {
           return Promise.resolve();
         },
       },
-    });
+    };
+    super(ctx, bindings);
+    this.workflowRequests = workflowRequests;
     this.providerCalls = counted.total;
     this.emitted = emitted;
     this.delivery = delivery;
@@ -224,6 +265,9 @@ export class BonsaiPushProbe extends BonsaiApp {
       };
     }
   }
+  workflowStarts(): Promise<string> {
+    return Promise.resolve(JSON.stringify(this.workflowRequests));
+  }
   calls(): Promise<number> {
     return Promise.resolve(this.providerCalls());
   }
@@ -252,6 +296,10 @@ export default {
   ): Promise<Response> {
     const url = new URL(request.url);
     const probe = env.PROBE.getByName(url.searchParams.get("probe") ?? "push");
+    if (url.pathname === "/workflow-starts")
+      return new Response(await probe.workflowStarts(), {
+        headers: { "Content-Type": "application/json" },
+      });
     if (url.pathname === "/grow") return Response.json(await probe.grow());
     if (url.pathname === "/calls")
       return Response.json({ calls: await probe.calls() });

package/test/merge-template-build.test.mjs

@@ -1,234 +1,77 @@
+import { URL } from "node:url";
 import assert from "node:assert/strict";
 import { readFile } from "node:fs/promises";
 import { test } from "node:test";
-import { URL } from "node:url";
-import { Script } from "node:vm";
 import * as S from "effect/Schema";
-import * as z from "zod";
 import {
-  catalogEvents,
   catalogMethods,
   compile,
-  triggerRun,
   validate,
   workflowDefinitionSchema,
 } from "@fungi.computer/braid";
 import { buildAppApi } from "@fungi.computer/agar/backend-declaration";
-import { activityEnvelope } from "../shared/hooks.ts";
-import { appBackend as bonsaiBackend } from "../backend/methods.ts";
-const bonsaiApi = buildAppApi(bonsaiBackend);
+import { appBackend } from "../backend/methods.ts";
 
-// The stock Workflows template that builds and installs an App on merge.
-async function buildOnMergeTemplate() {
-  const template = z
-    .object({ definition: z.json() })
-    .parse(
-      JSON.parse(
-        await readFile(
-          new URL(
-            "../../trellis/templates/bonsai-build-on-merge.json",
-            import.meta.url,
-          ),
-          "utf8",
-        ),
+async function template() {
+  const file = JSON.parse(
+    await readFile(
+      new URL(
+        "../../trellis/templates/bonsai-build-on-merge.json",
+        import.meta.url,
       ),
-    );
-  return S.decodeUnknownSync(workflowDefinitionSchema)(template.definition);
+      "utf8",
+    ),
+  );
+  return S.decodeUnknownSync(workflowDefinitionSchema)(file.definition);
 }
 
-async function installedCatalog() {
-  return {
+test("the lifecycle build template compiles against Bonsai's maintained method declarations", async () => {
+  const definition = await template();
+  const catalog = {
     app_bonsai: {
-      methods: (await catalogMethods(bonsaiApi.methods)).methods,
-      events: (await catalogEvents(bonsaiApi.events)).events,
+      methods: (await catalogMethods(buildAppApi(appBackend).methods)).methods,
     },
   };
-}
-
-function findNode(definition, id) {
-  const node = definition.nodes.find((candidate) => candidate.id === id);
-  assert.ok(node, `missing node ${id}`);
-  return node;
-}
-
-// Only the external Code execution boundary is replaced by Node VM here.
-const evaluate = async (code, input) =>
-  z.json().parse(
-    await new Script(`(async () => { ${code} })()`).runInNewContext({
-      env: { INPUT: { read: () => Promise.resolve(input) } },
-    }),
-  );
-
-const after = "c".repeat(40);
-// The envelope Bonsai's outbox emits when a Change merges into `repo`.
-function mergedEnvelope({ repo = "my-app", ref = "main" } = {}) {
-  return activityEnvelope(
-    {
-      id: 41,
-      at: Date.UTC(2026, 9, 15, 4),
-      type: "merge",
-      repo,
-      actor: "morel",
-      data: {
-        change: {
-          repo,
-          number: 3,
-          sourceRepo: `${repo}--morel`,
-          sourceRef: "edit",
-          targetRef: ref,
-          head: "b".repeat(40),
-        },
-        from: `${repo}--morel`,
-        ref,
-        before: "a".repeat(40),
-        after,
-      },
-    },
-    {
-      name: `${repo}--morel`,
-      canonical: repo,
-      cloneUrl: `https://bonsai.example/git/${repo}--morel.git`,
-    },
-  );
-}
-
-test("pins the build-on-merge template to Bonsai's maintained declarations", async () => {
-  const definition = await buildOnMergeTemplate();
-  const catalog = await installedCatalog();
   assert.deepEqual(validate(definition, catalog), []);
   const compiled = await compile(definition, catalog, {
     bonsai: { appId: "app_bonsai", installationId: "bonsai" },
   });
   assert.ok(compiled.ok, JSON.stringify(compiled));
-  // No key, token or Git pass rides in the definition: every step is an App
-  // method call made as the arming owner.
-  const text = JSON.stringify(definition);
-  assert.doesNotMatch(text, /gitAccess|OYSTER_OWNER_KEY|Authorization|token/iu);
-  // The run starts the build of the merged commit, then waits on that job.
-  const build = findNode(definition, "build");
-  assert.ok(build.kind === "app");
-  assert.equal(build.method, "apps.build");
-  assert.deepEqual(build.values.sourceRevision, {
-    from: { node: "merged", port: "sourceRevision" },
-  });
-  const status = findNode(definition, "build-status");
-  assert.ok(status.kind === "app");
-  assert.equal(status.method, "apps.buildStatus");
-  assert.deepEqual(status.values.jobId, {
-    from: { node: "build", port: "jobId" },
-  });
-  assert.equal(
-    catalog.app_bonsai.methods["apps.buildStatus"].pending,
-    true,
-    "the Workflow waits on the job through a pending method",
+  assert.doesNotMatch(
+    JSON.stringify(definition),
+    /gitAccess|OYSTER_OWNER_KEY|Authorization|token/iu,
   );
-});
-
-test("starts on a merge into the App's source main, at the merged commit", async () => {
-  const definition = await buildOnMergeTemplate();
-  const trigger = definition.triggers?.find(
-    (item) => item.on === "event" && item.event === "change.merged",
-  );
-  assert.ok(trigger);
-  const payload = mergedEnvelope();
-  const outcome = triggerRun(definition, trigger.id, {
-    eventId: payload.data.eventId,
-    payload,
-  });
-  assert.equal(outcome.kind, "start", JSON.stringify(outcome));
-  // The owner setting defaults to showing the Workflows review UI.
-  assert.equal(outcome.input.reviewBeforeInstall, true);
-  const merged = findNode(definition, "merged");
-  assert.ok(merged.kind === "code");
   assert.deepEqual(
-    await evaluate(merged.source, {
-      payload: outcome.input.payload,
-      appId: outcome.input.appId,
-    }),
-    { appId: outcome.input.appId, sourceRevision: `git:${after}` },
+    definition.nodes.map((node) =>
+      node.kind === "app" ? node.method : node.kind,
+    ),
+    ["apps.build", "apps.verifyBuild", "apps.install"],
   );
-  for (const other of [{ repo: "elsewhere" }, { ref: "release" }]) {
-    const skipped = mergedEnvelope(other);
-    assert.deepEqual(
-      triggerRun(definition, trigger.id, {
-        eventId: skipped.data.eventId,
-        payload: skipped,
-      }),
-      { kind: "ignored" },
-      JSON.stringify(other),
-    );
-  }
+  assert.equal(catalog.app_bonsai.methods["apps.verifyBuild"].pending, true);
 });
 
-test("installs only a passing build of the merged commit", async () => {
-  const definition = await buildOnMergeTemplate();
-  const built = findNode(definition, "built");
-  assert.ok(built.kind === "code");
-  const sourceRevision = `git:${after}`;
-  const release = {
-    appId: "app_myapp",
-    releaseId: "rel_built",
-    artifact: { provenance: { sourceRevision } },
-  };
-  assert.deepEqual(
-    await evaluate(built.source, {
-      status: "succeeded",
-      detail: null,
-      release,
-      sourceRevision,
-    }),
-    {
-      release,
-      summary: `Built rel_built of app_myapp from ${sourceRevision}`,
-    },
-  );
-  await assert.rejects(
-    evaluate(built.source, {
-      status: "failed",
-      detail: "tsc exited 2",
-      release: null,
-      sourceRevision,
-    }),
-    /The build did not pass: tsc exited 2/u,
-  );
-  await assert.rejects(
-    evaluate(built.source, {
-      status: "succeeded",
-      detail: null,
-      release,
-      sourceRevision: `git:${"d".repeat(40)}`,
-    }),
-    /not the merged commit/u,
-  );
-});
-
-test("routes the Release through review only when Review before install is on", async () => {
-  const definition = await buildOnMergeTemplate();
-  const gate = findNode(definition, "review-gate");
-  assert.ok(gate.kind === "condition");
-  assert.deepEqual(gate.test, {
-    op: "eq",
-    left: { from: { node: "$input", port: "reviewBeforeInstall" } },
-    right: { literal: true },
-  });
-  // The review is reached only from the gate's true outlet, automatic
-  // install only from its false one; install takes whichever ran.
-  const review = findNode(definition, "review");
-  assert.ok(review.kind === "review");
-  assert.deepEqual(review.show[0], { node: "to-review", port: "release" });
-  assert.deepEqual(findNode(definition, "to-review").fields.review, {
-    from: { node: "review-gate", port: "true" },
+test("verification gates installation and the template neither configures nor promises review", async () => {
+  const definition = await template();
+  const verify = definition.nodes.find((node) => node.id === "verify");
+  const install = definition.nodes.find((node) => node.id === "install");
+  assert.ok(verify?.kind === "app");
+  assert.ok(install?.kind === "app");
+  assert.deepEqual(verify.values.jobId, {
+    from: { node: "build", port: "jobId" },
   });
-  assert.deepEqual(findNode(definition, "automatic").fields.automatic, {
-    from: { node: "review-gate", port: "false" },
+  assert.deepEqual(verify.values.sourceRevision, {
+    from: { node: "$input", port: "sourceRevision" },
   });
-  const install = findNode(definition, "install");
-  assert.ok(install.kind === "app");
-  assert.equal(install.method, "apps.install");
   assert.deepEqual(install.values.release, {
-    coalesce: [
-      { from: { node: "review", port: "approved" } },
-      { from: { node: "automatic", port: "release" } },
-    ],
+    from: { node: "verify", port: "release" },
   });
+  assert.doesNotMatch(
+    JSON.stringify(definition),
+    /reviewBeforeInstall|review-gate|review before install|"kind":"review"/iu,
+  );
+  assert.equal(
+    definition.triggers,
+    undefined,
+    "the host lifecycle starts this template through WORKFLOWS, not a guest merge event",
+  );
 });

package/test/storyboard-save-https-git.fixture.mjs

@@ -2,45 +2,51 @@ import { Buffer } from "node:buffer";
 import { execFileSync, spawn } from "node:child_process";
 import { once } from "node:events";
 import { createServer } from "node:https";
-import { mkdtemp, readFile } from "node:fs/promises";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import process from "node:process";
 import { URL } from "node:url";
 
+async function createCertificate() {
+  const certDir = await mkdtemp(join(tmpdir(), "storyboard-save-tls-"));
+  try {
+    const keyPath = join(certDir, "key.pem");
+    const certPath = join(certDir, "cert.pem");
+    execFileSync(
+      "openssl",
+      [
+        "req",
+        "-x509",
+        "-newkey",
+        "rsa:2048",
+        "-keyout",
+        keyPath,
+        "-out",
+        certPath,
+        "-days",
+        "1",
+        "-nodes",
+        "-subj",
+        "/CN=127.0.0.1",
+      ],
+      { stdio: ["ignore", "pipe", "pipe"] },
+    );
+    return { key: await readFile(keyPath), cert: await readFile(certPath) };
+  } finally {
+    await rm(certDir, { recursive: true, force: true });
+  }
+}
+
 /**
  * A real git smart-HTTP server over real TLS (self-signed), proxying to the
  * maintained `git http-backend` CGI program against a directory of real bare
- * repositories. workflowGitPassResultSchema requires an `https:` remote
- * (packages/agar/src/computer-contracts.ts); this gives Shed's real `run`
- * handler and git's real client something genuine to fetch and push against,
- * rather than a stand-in local path.
+ * repositories. The host-supplied $FUNGI_GIT_REMOTE is an `https:` remote;
+ * this gives Shed's real `run` handler and git's real client something
+ * genuine to fetch and push against, rather than a stand-in local path.
  */
 export async function startHttpsGitServer(reposRoot) {
-  const certDir = await mkdtemp(join(tmpdir(), "storyboard-save-tls-"));
-  const keyPath = join(certDir, "key.pem");
-  const certPath = join(certDir, "cert.pem");
-  execFileSync(
-    "openssl",
-    [
-      "req",
-      "-x509",
-      "-newkey",
-      "rsa:2048",
-      "-keyout",
-      keyPath,
-      "-out",
-      certPath,
-      "-days",
-      "1",
-      "-nodes",
-      "-subj",
-      "/CN=127.0.0.1",
-    ],
-    { stdio: ["ignore", "pipe", "pipe"] },
-  );
-  const key = await readFile(keyPath);
-  const cert = await readFile(certPath);
+  const { key, cert } = await createCertificate();
   function cgi(request, response) {
     const url = new URL(request.url, "https://localhost");
     const child = spawn("git", ["http-backend"], {

package/test/storyboard-save-template.test.mjs

@@ -1,10 +1,16 @@
 import assert from "node:assert/strict";
 import { Buffer } from "node:buffer";
-import { spawn } from "node:child_process";
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
 import { dirname, join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
-import { mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import {
+  mkdir,
+  mkdtemp,
+  readFile,
+  readdir,
+  rm,
+  writeFile,
+} from "node:fs/promises";
 import { tmpdir } from "node:os";
 import process from "node:process";
 import { test } from "node:test";
@@ -24,7 +30,7 @@ import {
 // Shed's, Prints', Inkcap's and Bonsai's sources are pinned at runtime only;
 // Bonsai's compiler options do not own them.
 import { buildAppApi } from "@fungi.computer/agar/backend-declaration";
-import { mintComputerProcessId } from "@fungi.computer/computer/operations";
+import { mintComputerProcessId } from "@fungi.computer/computer-contract";
 import { appBackend as bonsaiBackend } from "../backend/methods.ts";
 import { appBackend as shedBackend } from "../../shed/backend/methods.ts";
 import { createShedRuns } from "../../shed/backend/runs.ts";
@@ -37,6 +43,50 @@ import {
 
 const execFileAsync = promisify(execFile);
 
+for (const startupFails of [false, true]) {
+  test(`HTTPS Git fixture removes certificate files after ${startupFails ? "startup failure" : "server close"}`, async (t) => {
+    const work = await mkdtemp(
+      join(tmpdir(), "storyboard-save-fixture-check-"),
+    );
+    t.after(() => rm(work, { recursive: true, force: true }));
+    const scratch = join(work, "tmp");
+    await mkdir(scratch);
+    const fixture = new URL(
+      "./storyboard-save-https-git.fixture.mjs",
+      import.meta.url,
+    );
+    const env = {
+      ...process.env,
+      HOME: work,
+      TMPDIR: scratch,
+      TMP: scratch,
+      TEMP: scratch,
+    };
+    if (startupFails) env.OPENSSL_CONF = join(work, "missing-openssl.cnf");
+    // tmpdir() is process-local. Give the real producer its own environment,
+    // rather than changing the test runner's environment or mocking openssl.
+    await execFileAsync(
+      process.execPath,
+      [
+        "--input-type=module",
+        "--eval",
+        `
+        import assert from "node:assert/strict";
+        import { startHttpsGitServer } from ${JSON.stringify(fixture.href)};
+        const startup = startHttpsGitServer(${JSON.stringify(work)});
+        ${
+          startupFails
+            ? "await assert.rejects(startup, { status: 1 });"
+            : "const server = await startup; await server.close();"
+        }
+      `,
+      ],
+      { env },
+    );
+    assert.deepEqual(await readdir(scratch), []);
+  });
+}
+
 async function readTemplate(name) {
   const template = z
     .object({ definition: z.json() })
@@ -192,7 +242,13 @@ test("the Save to git flow runs through Shed's real run handler and Inkcap's rea
         procs.set(id, record);
         const child = spawn("bash", ["-c", localCommand], {
           cwd: cwd ? localize(cwd) : undefined,
-          env: { ...process.env, GIT_SSL_NO_VERIFY: "true" },
+          // The trusted host supplies the Git remote after admission; Shed
+          // and its command carry no credential.
+          env: {
+            ...process.env,
+            GIT_SSL_NO_VERIFY: "true",
+            FUNGI_GIT_REMOTE: remote,
+          },
         });
         let stderr = "";
         child.stderr.on("data", (chunk) => {
@@ -209,13 +265,6 @@ test("the Save to git flow runs through Shed's real run handler and Inkcap's rea
       processes() {
         return Promise.resolve({ processes: [...procs.values()] });
       },
-      workflowGitPass() {
-        return Promise.resolve({
-          passId: "pass_test",
-          remote,
-          expiresAt: Date.now() + 300000,
-        });
-      },
       async write({ path, content }) {
         const target = localize(path);
         await mkdir(dirname(target), { recursive: true });

package/vite.config.ts

@@ -2,12 +2,30 @@ import { fileURLToPath } from "node:url";
 import tailwindcss from "@tailwindcss/vite";
 import react from "@vitejs/plugin-react";
 import { defineConfig } from "vite";
+import { fungiFaviconHref } from "@fungi.computer/sigils/favicon";
 
 export default defineConfig({
   envDir: false,
   base: "./",
   root: fileURLToPath(new URL("./web", import.meta.url)),
-  plugins: [react(), tailwindcss()],
+  plugins: [
+    react(),
+    tailwindcss(),
+    {
+      name: "fungi-favicon",
+      transformIndexHtml: () => [
+        {
+          tag: "link",
+          attrs: {
+            rel: "icon",
+            type: "image/svg+xml",
+            href: fungiFaviconHref,
+          },
+          injectTo: "head",
+        },
+      ],
+    },
+  ],
   build: {
     target: "es2022",
     outDir: fileURLToPath(new URL("./.botanical/web", import.meta.url)),