@invisibleloop/pulse 0.20.1 → 0.20.3

package/src/cli/cli.test.js

@@ -158,6 +158,78 @@ console.log('\nStore auto-discovery\n')
   }
 }
 
+// ---------------------------------------------------------------------------
+// Coverage-check exemptions
+// ---------------------------------------------------------------------------
+// Regression: the stop hook blocked every session on uncovered guard/submit/
+// sitemap/meta lines (server-only, untestable), and c8 ignore comments were
+// not honoured because Node's built-in coverage ignores them.
+
+console.log('\nCoverage-check exemptions\n')
+
+{
+  const { computeExemptLines } = await import('../agent/coverage-check.js')
+
+  const src = [
+    /*  1 */ `export default {`,
+    /*  2 */ `  route: '/x',`,
+    /*  3 */ `  guard: async (ctx) => {`,
+    /*  4 */ `    if (!ctx.cookies.session) return { redirect: '/login' }`,
+    /*  5 */ `  },`,
+    /*  6 */ `  submit: async (ctx) => {`,
+    /*  7 */ `    return { redirect: '/done' }`,
+    /*  8 */ `  },`,
+    /*  9 */ `  sitemap: async () => ['/a'],`,
+    /* 10 */ `  meta: {`,
+    /* 11 */ `    title: async (ctx) => fetchTitle(ctx),`,
+    /* 12 */ `  },`,
+    /* 13 */ `  view: (state) => state.n,`,
+    /* 14 */ `  helpers: () => {`,
+    /* 15 */ `    /* c8 ignore next 2 */`,
+    /* 16 */ `    impossibleBranch()`,
+    /* 17 */ `    alsoImpossible()`,
+    /* 18 */ `    normalCode()`,
+    /* 19 */ `  },`,
+    /* 20 */ `}`,
+  ].join('\n')
+
+  const exempt = computeExemptLines(src)
+
+  test('guard, submit, sitemap, and meta blocks are exempt', () => {
+    for (const n of [3, 4, 5, 6, 7, 8, 9, 10, 11, 12]) {
+      if (!exempt.has(n)) throw new Error(`Expected line ${n} to be exempt`)
+    }
+  })
+
+  test('view and ordinary helper code are NOT exempt', () => {
+    for (const n of [13, 18]) {
+      if (exempt.has(n)) throw new Error(`Line ${n} must not be exempt`)
+    }
+  })
+
+  test('c8 ignore next N exempts exactly the following N lines', () => {
+    for (const n of [15, 16, 17]) {
+      if (!exempt.has(n)) throw new Error(`Expected line ${n} to be exempt via c8 ignore`)
+    }
+    if (exempt.has(18)) throw new Error('Line 18 is beyond the ignore count and must not be exempt')
+  })
+
+  test('c8 ignore start/stop exempts the whole range', () => {
+    const ranged = computeExemptLines([
+      `const a = 1`,            // 1
+      `/* c8 ignore start */`,  // 2
+      `untestable1()`,          // 3
+      `untestable2()`,          // 4
+      `/* c8 ignore stop */`,   // 5
+      `const b = 2`,            // 6
+    ].join('\n'))
+    for (const n of [2, 3, 4, 5]) {
+      if (!ranged.has(n)) throw new Error(`Expected line ${n} exempt in range`)
+    }
+    if (ranged.has(6)) throw new Error('Line after stop must not be exempt')
+  })
+}
+
 // ---------------------------------------------------------------------------
 
 console.log(`\n${passed + failed} tests: ${passed} passed, ${failed} failed\n`)

package/src/cli/dev.js

@@ -118,6 +118,15 @@ if (specs.length === 0) {
   process.exit(1)
 }
 
+// Warn if a production build exists — public/dist/ is ignored by the dev server
+// (manifest: {} forces source-file hydration) but its presence can cause confusion
+// because static files in public/dist/ ARE served by the static file handler.
+// If the user ran pulse build and sees stale styles, deleting public/dist/ fixes it.
+const DIST_DIR = path.join(ROOT, 'public', 'dist')
+if (fs.existsSync(path.join(DIST_DIR, 'manifest.json'))) {
+  console.warn(`\n  ⚠  A production build exists in public/dist/\n     Dev mode ignores the manifest and always serves source files, but if\n     styles look wrong after a build, run: rm -rf public/dist/\n`)
+}
+
 // ---------------------------------------------------------------------------
 // Hot reload — SSE clients + file watcher
 // ---------------------------------------------------------------------------
@@ -257,6 +266,14 @@ const { updateSpecs, updateStore } = await createServer(specs, {
   onRequest(req, res) {
     const url = req.url.split('?')[0]
 
+    // MCP hot-reload trigger — POST to this instead of killing the process
+    if (url === '/_pulse/trigger-reload' && req.method === 'POST') {
+      triggerReload('MCP trigger')
+      res.writeHead(204)
+      res.end()
+      return false
+    }
+
     // SSE endpoint — browser connects here to receive reload events
     if (url === '/_pulse/reload') {
       res.writeHead(200, {
@@ -275,11 +292,14 @@ const { updateSpecs, updateStore } = await createServer(specs, {
       // Strip server-only imports that can't resolve in the browser:
       //   - node:* built-ins (fs, path, etc.)
       //   - JSON files imported with `with { type: 'json' }` (e.g. package.json for version)
-      // These are only used inside spec.server functions or module-level server init;
-      // the client runtime never calls those code paths.
+      //   - the package ROOT (@invisibleloop/pulse) — that export is the server
+      //     itself (createServer, pushStore); the closing quote anchors the match
+      //     so subpaths like @invisibleloop/pulse/ui are untouched
+      // These are only used inside spec.server/submit functions or module-level
+      // server init; the client runtime never calls those code paths.
       let content = fs.readFileSync(filePath, 'utf-8')
       content = content.replace(
-        /^[ \t]*import\s+(?:\{[^}]*\}|[\w*]+(?:\s+as\s+\w+)?)\s+from\s+['"](?:node:[^'"]+|[^'"]*\.json)['"]\s*(?:with\s*\{[^}]*\})?\s*;?[ \t]*\n?/gm,
+        /^[ \t]*import\s+(?:\{[^}]*\}|[\w*]+(?:\s+as\s+\w+)?)\s+from\s+['"](?:node:[^'"]+|[^'"]*\.json|@invisibleloop\/pulse)['"]\s*(?:with\s*\{[^}]*\})?\s*;?[ \t]*\n?/gm,
         ''
       )
       res.writeHead(200, {

package/src/cli/index.js

@@ -269,8 +269,11 @@ async function runStop(root) {
     } catch { /* use default */ }
   }
   try {
-    execSync(`lsof -ti:${port} | xargs kill -9 2>/dev/null; true`, { stdio: 'inherit' })
-    console.log(`\n⚡ Dev server on port ${port} stopped.\n`)
+    // Kill the dev server AND the local production server (dev port + 1) —
+    // pulse_build spawns the prod server detached, so without this it lingers
+    // after the session and blocks the next build's Lighthouse run.
+    execSync(`lsof -ti:${port} | xargs kill -9 2>/dev/null; lsof -ti:${port + 1} | xargs kill -9 2>/dev/null; true`, { stdio: 'inherit' })
+    console.log(`\n⚡ Servers on ports ${port} (dev) and ${port + 1} (prod) stopped.\n`)
   } catch { /* nothing was running */ }
 }
 

package/src/cli/scaffold.js

@@ -207,7 +207,7 @@ ${port !== 3000 ? `  port: ${port},\n` : ''}${agent && agent !== 'claude' ? `  a
           hooks: [
             {
               type: 'command',
-              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let changed=new Set();let hasGit=false;try{execSync('git rev-parse --is-inside-work-tree',{stdio:'pipe'});hasGit=true;execSync('git status --porcelain',{encoding:'utf8'}).split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f)changed.add(f);});}catch{}if(!hasGit&&fs.existsSync('src/pages')){for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))changed.add('src/pages/'+f);}}const specs=[...changed].filter(f=>f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'));const missing=specs.filter(f=>{const t=f.replace(/\\.js$/,'.test.js');return!fs.existsSync(t)&&!changed.has(t);});if(missing.length){process.stdout.write(JSON.stringify({decision:'block',reason:'TESTS MISSING: '+missing.join(', ')+' — you must write tests before finishing. Use renderSync/render from @invisibleloop/pulse/testing to test view output, mutations, and any extracted logic functions. Run the tests with node to confirm they pass.\\n\\nEXCEPTION — waiting on the user: if you are ending this turn to wait for the user\\'s answer (e.g. the design-approval gate), call pulse_await_approval first, then ask and end your turn. Do not write tests or run /verify on an unapproved design.'}));}"`,
+              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let changed=new Set();let hasGit=false;try{execSync('git rev-parse --is-inside-work-tree',{stdio:'pipe'});hasGit=true;execSync('git status --porcelain',{encoding:'utf8'}).split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f)changed.add(f);});}catch{}if(!hasGit&&fs.existsSync('src/pages')){for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))changed.add('src/pages/'+f);}}const specs=[...changed].filter(f=>f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'));const missing=specs.filter(f=>{const t=f.replace(/\\.js$/,'.test.js');return!fs.existsSync(t)&&!changed.has(t);});if(missing.length){process.stdout.write(JSON.stringify({decision:'block',reason:'TESTS MISSING: '+missing.join(', ')+' — you must write tests before finishing. Use renderSync/render from @invisibleloop/pulse/testing to test view output, mutations, and any extracted logic functions. Run the tests with node to confirm they pass.\\n\\nEXCEPTION — pausing for the user: if you are ending this turn to wait for the user\\'s answer (design-approval gate) OR to report progress mid-verification (e.g. between Lighthouse runs across multiple pages), call pulse_await_approval first, then end your turn. Do not write tests or run /verify on an unapproved design.'}));}"`,
               statusMessage: 'Checking for missing tests...',
             },
             {
@@ -217,7 +217,7 @@ ${port !== 3000 ? `  port: ${port},\n` : ''}${agent && agent !== 'claude' ? `  a
             },
             {
               type: 'command',
-              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let specs=[];try{const out=execSync('git status --porcelain',{encoding:'utf8'});out.split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f&&f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'))specs.push(f);});}catch{if(fs.existsSync('src/pages'))for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))specs.push('src/pages/'+f);}}if(!specs.length)process.exit(0);const stamp='.pulse-verified';let stampMtime=0;try{stampMtime=fs.statSync(stamp).mtimeMs;}catch{}const stale=specs.filter(f=>{try{return fs.statSync(f).mtimeMs>stampMtime;}catch{return true;}});if(stale.length){process.stdout.write(JSON.stringify({decision:'block',reason:'VERIFY REQUIRED: These pages have not been verified since last edit:\\n'+stale.map(f=>'  '+f).join('\\n')+'\\n\\nIMPORTANT — check first: are you ending this turn to wait for the user\\'s answer (e.g. the design-approval question)? If so, do NOT run /verify — the user has not approved the design yet. Call pulse_await_approval, re-ask your question, and end your turn; this gate will let you stop.\\n\\nOtherwise run /verify for each changed page. /verify runs Lighthouse (desktop + mobile), performance trace, console check, and code review — then writes the stamp that clears this check.'}));}"`,
+              command: `node -e "const fs=require('fs');if(fs.existsSync('.pulse-awaiting-approval'))process.exit(0);const{execSync}=require('child_process');let specs=[];try{const out=execSync('git status --porcelain',{encoding:'utf8'});out.split('\\n').forEach(l=>{const f=l.slice(3).trim().split(' -> ').pop();if(f&&f.match(/^src\\/pages\\/.+\\.js$/)&&!f.endsWith('.test.js'))specs.push(f);});}catch{if(fs.existsSync('src/pages'))for(const f of fs.readdirSync('src/pages')){if(f.endsWith('.js')&&!f.endsWith('.test.js'))specs.push('src/pages/'+f);}}if(!specs.length)process.exit(0);const stamp='.pulse-verified';let stampMtime=0;try{stampMtime=fs.statSync(stamp).mtimeMs;}catch{}const stale=specs.filter(f=>{try{return fs.statSync(f).mtimeMs>stampMtime;}catch{return true;}});if(stale.length){process.stdout.write(JSON.stringify({decision:'block',reason:'VERIFY REQUIRED: These pages have not been verified since last edit:\\n'+stale.map(f=>'  '+f).join('\\n')+'\\n\\nIMPORTANT — check first: are you ending this turn to wait for the user\\'s answer (design-approval question) or to report progress mid-verification (e.g. between Lighthouse runs across multiple pages)? If so, do NOT rush /verify — call pulse_await_approval and end your turn; this gate will let you stop, and the marker is consumed when the user replies.\\n\\nOtherwise run /verify for each changed page. /verify runs Lighthouse (desktop + mobile), performance trace, console check, and code review — then writes the stamp that clears this check.'}));}"`,
               statusMessage: 'Checking verification stamp...',
             }
           ]

package/src/mcp/mcp.test.js

@@ -114,6 +114,8 @@ const SYNC_PAIRS = [
   ['src/agent/checklist.md',        'docs/.claude/pulse-checklist.md'],
   ['src/agent/checklist.md',        'examples/.claude/pulse-checklist.md'],
   ['src/agent/commands/verify.md',  '.claude/commands/verify.md'],
+  ['src/agent/coverage-check.js',   'docs/.claude/coverage-check.js'],
+  ['src/agent/coverage-check.js',   'examples/.claude/coverage-check.js'],
 ]
 
 for (const [a, b] of SYNC_PAIRS) {
@@ -277,6 +279,48 @@ test('approval pause mechanism is wired end to end', () => {
     `Instruct: always call pulse_await_approval before asking, whichever way the question is asked.`)
 })
 
+test('pulse_validate prop-alias check excludes attrs blocks (false-positive fix)', () => {
+  // Regression: input({ attrs: { autocomplete } }) — the RECOMMENDED pattern —
+  // was flagged as a wrong top-level prop because the match crossed into the
+  // attrs object. The exclusion regex must be present in the alias loop.
+  assert(serverSrc.includes('attrs\\s*:\\s*\\{[^}]*$'),
+    'The PROP_ALIASES loop must exclude matches that fall inside an open attrs: { … } block')
+})
+
+test('pulse_validate CSP check matches config by host, not full URL', () => {
+  // Regression: CSP sources are valid without a scheme (images.unsplash.com),
+  // but the config check required https?:// — flagging correctly configured
+  // projects on every validate.
+  assert(serverSrc.includes('configImgSrc.includes(host)'),
+    'External-image CSP check must test the config for the bare host')
+  assert(serverSrc.includes(`host:    'images.unsplash.com'`),
+    'External image host entries must carry a bare host field')
+})
+
+test('validator resolves relative imports from the spec file\'s own directory', () => {
+  // Regression: the temp validation file was always written into src/pages/
+  // root, so subdirectory pages (src/pages/news/index.js) had their relative
+  // imports (../../components/layout.js) resolve from the wrong depth.
+  assert(/async function validateContent\(content, tmpDir = PAGES_DIR\)/.test(serverSrc),
+    'validateContent must accept a tmpDir parameter')
+  assert(serverSrc.includes('validateContent(content, path.dirname(fullPath))'),
+    'pulse_create_page must validate from the file\'s own directory')
+  assert(serverSrc.includes('validateContent(content, path.dirname(file))'),
+    'pulse_validate file mode must validate from the file\'s own directory')
+})
+
+test('package-root import is stripped from client bundles in build and dev', () => {
+  // Regression: import { pushStore } from '@invisibleloop/pulse' (the documented
+  // live-push pattern) pulled the entire server — http, fs, zlib — into the
+  // browser bundle and broke `pulse build`.
+  const buildSrc = fs.readFileSync(path.join(ROOT, 'scripts/build.js'), 'utf8')
+  const devSrc   = fs.readFileSync(path.join(ROOT, 'src/cli/dev.js'), 'utf8')
+  assert(buildSrc.includes(`'@invisibleloop/pulse/md', '@invisibleloop/pulse'`),
+    'build.js SERVER_ONLY_IMPORTS must include the package root')
+  assert(devSrc.includes(`@invisibleloop\\/pulse)['"]`),
+    'dev.js serveFile must strip package-root imports before serving specs to the browser')
+})
+
 test('pulse_check_contrast extracts variables from [data-theme="light"] blocks', () => {
   // Regression: the light-theme block pattern was an ungrouped alternation
   // (a|b) + '\\s*\\{([^}]+)\\}' — the body matcher bound only to the second