@invisibleloop/pulse 0.20.0 → 0.20.2

package/src/cli/dev.js

@@ -11,7 +11,7 @@
 import path    from 'path'
 import fs      from 'fs'
 import { createServer } from '../server/index.js'
-import { loadPages }    from './discover.js'
+import { loadPages, loadStore } from './discover.js'
 import * as log         from './logger.js'
 
 // ---------------------------------------------------------------------------
@@ -109,6 +109,10 @@ const PUBLIC_DIR     = path.join(ROOT, 'public')
 
 const specs = await loadPages(ROOT)
 
+// Auto-discover the global store — pulse.store.js in the project root.
+// Mirrors page discovery; no custom server entry needed.
+const store = await loadStore(ROOT)
+
 if (specs.length === 0) {
   log.error('No pages found in src/pages/. Create a page to get started.')
   process.exit(1)
@@ -192,6 +196,9 @@ async function triggerReload(label = 'File changed') {
     try {
       const fresh = await loadPages(ROOT, now)
       updateSpecs(fresh)
+      // Hot-swap the store too — pulse.store.js edits take effect like spec edits
+      const freshStore = await loadStore(ROOT, now)
+      updateStore(freshStore)
       log.info(`${label} — specs reloaded`)
       checkUndefinedClasses(fresh)
     } catch (err) {
@@ -204,6 +211,11 @@ async function triggerReload(label = 'File changed') {
 // Watch src/ for changes to existing files (spec edits, component edits)
 fs.watch(path.join(ROOT, 'src'), { recursive: true }, () => triggerReload('File changed'))
 
+// Watch the store file — it lives in the project root, outside src/
+if (fs.existsSync(path.join(ROOT, 'pulse.store.js'))) {
+  fs.watch(path.join(ROOT, 'pulse.store.js'), () => triggerReload('Store changed'))
+}
+
 // Also watch the pages directory explicitly so macOS reliably fires on new file creation.
 // On macOS, fs.watch with recursive=true watches subdirectory contents but may not fire
 // for the parent dir entry when a brand-new file is created. Watching the dir non-recursively
@@ -227,7 +239,7 @@ const reloadScript = (nonce) => `<script nonce="${nonce}">
   })();
 </script>`
 
-const { updateSpecs } = await createServer(specs, {
+const { updateSpecs, updateStore } = await createServer(specs, {
   port:      PORT,
   stream:    true,
   staticDir: fs.existsSync(PUBLIC_DIR) ? PUBLIC_DIR : null,
@@ -235,6 +247,7 @@ const { updateSpecs } = await createServer(specs, {
   extraBody: reloadScript,
   dev:       true,
   agentMode: !!process.env.PULSE_AGENT_MODE,
+  ...(store ? { store } : {}),
   ...(_config.csp ? { csp: _config.csp } : {}),
   // Server options forwarded verbatim from pulse.config.js so dev behaves like
   // production — keep in sync with start.js PASSTHROUGH_OPTIONS
@@ -262,11 +275,14 @@ const { updateSpecs } = await createServer(specs, {
       // Strip server-only imports that can't resolve in the browser:
       //   - node:* built-ins (fs, path, etc.)
       //   - JSON files imported with `with { type: 'json' }` (e.g. package.json for version)
-      // These are only used inside spec.server functions or module-level server init;
-      // the client runtime never calls those code paths.
+      //   - the package ROOT (@invisibleloop/pulse) — that export is the server
+      //     itself (createServer, pushStore); the closing quote anchors the match
+      //     so subpaths like @invisibleloop/pulse/ui are untouched
+      // These are only used inside spec.server/submit functions or module-level
+      // server init; the client runtime never calls those code paths.
       let content = fs.readFileSync(filePath, 'utf-8')
       content = content.replace(
-        /^[ \t]*import\s+(?:\{[^}]*\}|[\w*]+(?:\s+as\s+\w+)?)\s+from\s+['"](?:node:[^'"]+|[^'"]*\.json)['"]\s*(?:with\s*\{[^}]*\})?\s*;?[ \t]*\n?/gm,
+        /^[ \t]*import\s+(?:\{[^}]*\}|[\w*]+(?:\s+as\s+\w+)?)\s+from\s+['"](?:node:[^'"]+|[^'"]*\.json|@invisibleloop\/pulse)['"]\s*(?:with\s*\{[^}]*\})?\s*;?[ \t]*\n?/gm,
         ''
       )
       res.writeHead(200, {
@@ -285,6 +301,11 @@ const { updateSpecs } = await createServer(specs, {
       return serveFile(filePath)
     }
 
+    // Global store — pulse.store.js lives in the project root (not src/), and the
+    // dev hydrate bootstrap imports it so client store mutations register.
+    // serveFile strips node:/server-only imports, same treatment as page specs.
+    if (url === '/pulse.store.js' && serveFile(path.join(ROOT, 'pulse.store.js'))) return false
+
     // Project source — /src/pages/, /src/components/, /src/lib/, etc.
     // Falls back to framework source for imports like /src/ui/ that sub-projects
     // resolve from relative paths (e.g. docs component pages → ../../../../src/ui/).

package/src/cli/discover.js

@@ -111,3 +111,29 @@ export async function loadPages(projectRoot, bust = 0) {
 
   return specs
 }
+
+/**
+ * Auto-discover the global store definition from pulse.store.js in the
+ * project root. Returns the store definition with `hydrate` set to its
+ * browser-importable path (used by the dev inline bootstrap), or null when
+ * the file doesn't exist.
+ *
+ * Mirrors page auto-discovery: pulse.store.js is the documented filename
+ * convention, so CLI-managed projects (pulse dev / pulse start) get the
+ * store without writing a custom server entry.
+ *
+ * @param {string} projectRoot
+ * @returns {Promise<object|null>}
+ */
+export async function loadStore(projectRoot, cacheBust = null) {
+  const storePath = path.join(projectRoot, 'pulse.store.js')
+  if (!fs.existsSync(storePath)) return null
+
+  const url = 'file://' + storePath + (cacheBust ? `?t=${cacheBust}` : '')
+  const mod = await import(url)
+  const def = mod.default
+  if (!def || typeof def !== 'object') {
+    throw new Error('pulse.store.js must export a default store object ({ state?, server?, mutations? })')
+  }
+  return { ...def, hydrate: def.hydrate || '/pulse.store.js' }
+}

package/src/cli/index.js

@@ -269,8 +269,11 @@ async function runStop(root) {
     } catch { /* use default */ }
   }
   try {
-    execSync(`lsof -ti:${port} | xargs kill -9 2>/dev/null; true`, { stdio: 'inherit' })
-    console.log(`\n⚡ Dev server on port ${port} stopped.\n`)
+    // Kill the dev server AND the local production server (dev port + 1) —
+    // pulse_build spawns the prod server detached, so without this it lingers
+    // after the session and blocks the next build's Lighthouse run.
+    execSync(`lsof -ti:${port} | xargs kill -9 2>/dev/null; lsof -ti:${port + 1} | xargs kill -9 2>/dev/null; true`, { stdio: 'inherit' })
+    console.log(`\n⚡ Servers on ports ${port} (dev) and ${port + 1} (prod) stopped.\n`)
   } catch { /* nothing was running */ }
 }
 

package/src/cli/scaffold.js

@@ -207,7 +207,7 @@ ${port !== 3000 ? `  port: ${port},\n` : ''}${agent && agent !== 'claude' ? `  a
           hooks: [
             {
               type: 'command',
-              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let changed=new Set();let hasGit=false;try{execSync('git rev-parse --is-inside-work-tree',{stdio:'pipe'});hasGit=true;execSync('git status --porcelain',{encoding:'utf8'}).split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f)changed.add(f);});}catch{}if(!hasGit&&fs.existsSync('src/pages')){for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))changed.add('src/pages/'+f);}}const specs=[...changed].filter(f=>f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'));const missing=specs.filter(f=>{const t=f.replace(/\\.js$/,'.test.js');return!fs.existsSync(t)&&!changed.has(t);});if(missing.length){process.stdout.write(JSON.stringify({decision:'block',reason:'TESTS MISSING: '+missing.join(', ')+' — you must write tests before finishing. Use renderSync/render from @invisibleloop/pulse/testing to test view output, mutations, and any extracted logic functions. Run the tests with node to confirm they pass.\\n\\nEXCEPTION — waiting on the user: if you are ending this turn to wait for the user\\'s answer (e.g. the design-approval gate), call pulse_await_approval first, then ask and end your turn. Do not write tests or run /verify on an unapproved design.'}));}"`,
+              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let changed=new Set();let hasGit=false;try{execSync('git rev-parse --is-inside-work-tree',{stdio:'pipe'});hasGit=true;execSync('git status --porcelain',{encoding:'utf8'}).split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f)changed.add(f);});}catch{}if(!hasGit&&fs.existsSync('src/pages')){for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))changed.add('src/pages/'+f);}}const specs=[...changed].filter(f=>f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'));const missing=specs.filter(f=>{const t=f.replace(/\\.js$/,'.test.js');return!fs.existsSync(t)&&!changed.has(t);});if(missing.length){process.stdout.write(JSON.stringify({decision:'block',reason:'TESTS MISSING: '+missing.join(', ')+' — you must write tests before finishing. Use renderSync/render from @invisibleloop/pulse/testing to test view output, mutations, and any extracted logic functions. Run the tests with node to confirm they pass.\\n\\nEXCEPTION — pausing for the user: if you are ending this turn to wait for the user\\'s answer (design-approval gate) OR to report progress mid-verification (e.g. between Lighthouse runs across multiple pages), call pulse_await_approval first, then end your turn. Do not write tests or run /verify on an unapproved design.'}));}"`,
               statusMessage: 'Checking for missing tests...',
             },
             {
@@ -217,7 +217,7 @@ ${port !== 3000 ? `  port: ${port},\n` : ''}${agent && agent !== 'claude' ? `  a
             },
             {
               type: 'command',
-              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let specs=[];try{const out=execSync('git status --porcelain',{encoding:'utf8'});out.split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f&&f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'))specs.push(f);});}catch{if(fs.existsSync('src/pages'))for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))specs.push('src/pages/'+f);}}if(!specs.length)process.exit(0);const stamp='.pulse-verified';let stampMtime=0;try{stampMtime=fs.statSync(stamp).mtimeMs;}catch{}const stale=specs.filter(f=>{try{return fs.statSync(f).mtimeMs>stampMtime;}catch{return true;}});if(stale.length){process.stdout.write(JSON.stringify({decision:'block',reason:'VERIFY REQUIRED: These pages have not been verified since last edit:\\n'+stale.map(f=>'  '+f).join('\\n')+'\\n\\nIMPORTANT — check first: are you ending this turn to wait for the user\\'s answer (e.g. the design-approval question)? If so, do NOT run /verify — the user has not approved the design yet. Call pulse_await_approval, re-ask your question, and end your turn; this gate will let you stop.\\n\\nOtherwise run /verify for each changed page. /verify runs Lighthouse (desktop + mobile), performance trace, console check, and code review — then writes the stamp that clears this check.'}));}"`,
+              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let specs=[];try{const out=execSync('git status --porcelain',{encoding:'utf8'});out.split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f&&f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'))specs.push(f);});}catch{if(fs.existsSync('src/pages'))for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))specs.push('src/pages/'+f);}}if(!specs.length)process.exit(0);const stamp='.pulse-verified';let stampMtime=0;try{stampMtime=fs.statSync(stamp).mtimeMs;}catch{}const stale=specs.filter(f=>{try{return fs.statSync(f).mtimeMs>stampMtime;}catch{return true;}});if(stale.length){process.stdout.write(JSON.stringify({decision:'block',reason:'VERIFY REQUIRED: These pages have not been verified since last edit:\\n'+stale.map(f=>'  '+f).join('\\n')+'\\n\\nIMPORTANT — check first: are you ending this turn to wait for the user\\'s answer (design-approval question) or to report progress mid-verification (e.g. between Lighthouse runs across multiple pages)? If so, do NOT rush /verify — call pulse_await_approval and end your turn; this gate will let you stop, and the marker is consumed when the user replies.\\n\\nOtherwise run /verify for each changed page. /verify runs Lighthouse (desktop + mobile), performance trace, console check, and code review — then writes the stamp that clears this check.'}));}"`,
               statusMessage: 'Checking verification stamp...',
             }
           ]

package/src/cli/start.js

@@ -11,7 +11,7 @@
 import path from 'path'
 import fs   from 'fs'
 import { createServer } from '../server/index.js'
-import { loadPages }    from './discover.js'
+import { loadPages, loadStore } from './discover.js'
 
 const args    = process.argv.slice(2)
 const rootArg = args.indexOf('--root')
@@ -71,6 +71,9 @@ port = parseInt(process.env.PORT, 10) || port || 3000
 
 const specs = await loadPages(ROOT)
 
+// Auto-discover the global store — pulse.store.js in the project root
+const store = await loadStore(ROOT)
+
 if (specs.length === 0) {
   console.error('No pages found in src/pages/.')
   process.exit(1)
@@ -81,6 +84,7 @@ createServer(specs, {
   stream:       true,
   staticDir:    PUBLIC_DIR,
   defaultCache,
+  ...(store ? { store } : {}),
   ...(csp ? { csp } : {}),
   ...passthrough,
 })

package/src/mcp/mcp.test.js

@@ -114,6 +114,8 @@ const SYNC_PAIRS = [
   ['src/agent/checklist.md',        'docs/.claude/pulse-checklist.md'],
   ['src/agent/checklist.md',        'examples/.claude/pulse-checklist.md'],
   ['src/agent/commands/verify.md',  '.claude/commands/verify.md'],
+  ['src/agent/coverage-check.js',   'docs/.claude/coverage-check.js'],
+  ['src/agent/coverage-check.js',   'examples/.claude/coverage-check.js'],
 ]
 
 for (const [a, b] of SYNC_PAIRS) {
@@ -277,6 +279,48 @@ test('approval pause mechanism is wired end to end', () => {
     `Instruct: always call pulse_await_approval before asking, whichever way the question is asked.`)
 })
 
+test('pulse_validate prop-alias check excludes attrs blocks (false-positive fix)', () => {
+  // Regression: input({ attrs: { autocomplete } }) — the RECOMMENDED pattern —
+  // was flagged as a wrong top-level prop because the match crossed into the
+  // attrs object. The exclusion regex must be present in the alias loop.
+  assert(serverSrc.includes('attrs\\s*:\\s*\\{[^}]*$'),
+    'The PROP_ALIASES loop must exclude matches that fall inside an open attrs: { … } block')
+})
+
+test('pulse_validate CSP check matches config by host, not full URL', () => {
+  // Regression: CSP sources are valid without a scheme (images.unsplash.com),
+  // but the config check required https?:// — flagging correctly configured
+  // projects on every validate.
+  assert(serverSrc.includes('configImgSrc.includes(host)'),
+    'External-image CSP check must test the config for the bare host')
+  assert(serverSrc.includes(`host:    'images.unsplash.com'`),
+    'External image host entries must carry a bare host field')
+})
+
+test('validator resolves relative imports from the spec file\'s own directory', () => {
+  // Regression: the temp validation file was always written into src/pages/
+  // root, so subdirectory pages (src/pages/news/index.js) had their relative
+  // imports (../../components/layout.js) resolve from the wrong depth.
+  assert(/async function validateContent\(content, tmpDir = PAGES_DIR\)/.test(serverSrc),
+    'validateContent must accept a tmpDir parameter')
+  assert(serverSrc.includes('validateContent(content, path.dirname(fullPath))'),
+    'pulse_create_page must validate from the file\'s own directory')
+  assert(serverSrc.includes('validateContent(content, path.dirname(file))'),
+    'pulse_validate file mode must validate from the file\'s own directory')
+})
+
+test('package-root import is stripped from client bundles in build and dev', () => {
+  // Regression: import { pushStore } from '@invisibleloop/pulse' (the documented
+  // live-push pattern) pulled the entire server — http, fs, zlib — into the
+  // browser bundle and broke `pulse build`.
+  const buildSrc = fs.readFileSync(path.join(ROOT, 'scripts/build.js'), 'utf8')
+  const devSrc   = fs.readFileSync(path.join(ROOT, 'src/cli/dev.js'), 'utf8')
+  assert(buildSrc.includes(`'@invisibleloop/pulse/md', '@invisibleloop/pulse'`),
+    'build.js SERVER_ONLY_IMPORTS must include the package root')
+  assert(devSrc.includes(`@invisibleloop\\/pulse)['"]`),
+    'dev.js serveFile must strip package-root imports before serving specs to the browser')
+})
+
 test('pulse_check_contrast extracts variables from [data-theme="light"] blocks', () => {
   // Regression: the light-theme block pattern was an ungrouped alternation
   // (a|b) + '\\s*\\{([^}]+)\\}' — the body matcher bound only to the second