@invisibleloop/pulse 0.20.38 → 0.20.39

package/src/cli/process-utils.test.js

@@ -1,114 +0,0 @@
-/**
- * Pulse — process-utils.js tests
- * run: node src/cli/process-utils.test.js
- *
- * killPulseServerOnPort must never kill a process it didn't spawn as a
- * Pulse dev/prod server — see its doc comment for the real user report
- * (an unrelated Next.js dev server on port 3000 was at risk of being
- * killed by a blind lsof|kill) this fixes.
- */
-
-import { test }   from 'node:test'
-import assert     from 'node:assert/strict'
-import { spawn }  from 'node:child_process'
-import net        from 'node:net'
-import { killPulseServerOnPort } from './process-utils.js'
-
-/** Find a free TCP port by binding to port 0 and reading it back. */
-async function freePort() {
-  return new Promise((resolve, reject) => {
-    const srv = net.createServer()
-    srv.listen(0, () => {
-      const { port } = srv.address()
-      srv.close(() => resolve(port))
-    })
-    srv.on('error', reject)
-  })
-}
-
-/** Spawn a plain (non-Pulse) process holding a port open, for negative tests. */
-function spawnPlainListener(port) {
-  const proc = spawn(process.execPath, ['-e', `
-    const net = require('net')
-    net.createServer().listen(${port})
-    setInterval(() => {}, 1000) // keep the process alive
-  `])
-  return proc
-}
-
-async function waitUntilListening(port, maxMs = 3000) {
-  const deadline = Date.now() + maxMs
-  while (Date.now() < deadline) {
-    const alive = await new Promise(resolve => {
-      const sock = net.createConnection(port, '127.0.0.1')
-      sock.on('connect', () => { sock.destroy(); resolve(true) })
-      sock.on('error',   () => resolve(false))
-    })
-    if (alive) return true
-    await new Promise(r => setTimeout(r, 50))
-  }
-  return false
-}
-
-async function waitUntilFree(port, maxMs = 3000) {
-  const deadline = Date.now() + maxMs
-  while (Date.now() < deadline) {
-    const alive = await new Promise(resolve => {
-      const sock = net.createConnection(port, '127.0.0.1')
-      sock.on('connect', () => { sock.destroy(); resolve(true) })
-      sock.on('error',   () => resolve(false))
-    })
-    if (!alive) return true
-    await new Promise(r => setTimeout(r, 50))
-  }
-  return false
-}
-
-test('killPulseServerOnPort does not kill a process whose command line has no Pulse marker', async () => {
-  const port = await freePort()
-  const proc = spawnPlainListener(port)
-  try {
-    assert.equal(await waitUntilListening(port), true, 'test listener never came up')
-
-    const result = killPulseServerOnPort(port)
-
-    assert.equal(result.killed.length, 0, 'must not report the unrelated process as killed')
-    assert.equal(result.skipped.length, 1, 'must report exactly one skipped process')
-    assert.equal(result.skipped[0].pid, String(proc.pid))
-    // The process must actually still be alive — not just unreported as killed.
-    assert.equal(await waitUntilFree(port, 300), false, 'the unrelated process must still be listening')
-  } finally {
-    proc.kill('SIGKILL')
-  }
-})
-
-test('killPulseServerOnPort kills a process whose command line matches a Pulse marker', async () => {
-  const port = await freePort()
-  // Simulate a Pulse dev server by giving the child process's argv a marker
-  // substring (cli/dev.js) without actually running the real dev server —
-  // exercises the same ps-based matching path a real `node .../cli/dev.js`
-  // invocation would hit.
-  const proc = spawn(process.execPath, ['-e', `
-    const net = require('net')
-    net.createServer().listen(${port})
-    setInterval(() => {}, 1000)
-  `, '--', 'cli/dev.js'])
-  try {
-    assert.equal(await waitUntilListening(port), true, 'test listener never came up')
-
-    const result = killPulseServerOnPort(port)
-
-    assert.equal(result.skipped.length, 0, 'must not skip a process matching a Pulse marker')
-    assert.equal(result.killed.length, 1)
-    assert.equal(result.killed[0], String(proc.pid))
-    assert.equal(await waitUntilFree(port), true, 'the matched process must actually be killed')
-  } finally {
-    try { proc.kill('SIGKILL') } catch { /* already dead */ }
-  }
-})
-
-test('killPulseServerOnPort on a free port returns empty killed and skipped', async () => {
-  const port = await freePort()
-  const result = killPulseServerOnPort(port)
-  assert.deepEqual(result, { killed: [], skipped: [] })
-})

package/src/cli/review.test.js

@@ -1,143 +0,0 @@
-/**
- * Pulse — review.js tests
- * run: node src/cli/review.test.js
- *
- * Shared logic behind pulse_review (MCP tool) and `pulse review` (CLI
- * command). The MCP tool's output talks directly to an agent ("you are now
- * a senior code reviewer") — these tests specifically confirm that framing
- * does NOT leak into the CLI's human-facing output, since that was the main
- * risk in this extraction.
- */
-
-import { test }   from 'node:test'
-import assert     from 'node:assert/strict'
-import fs         from 'node:fs'
-import os         from 'node:os'
-import path       from 'node:path'
-import { runQuickReview, formatQuickReview, runFullReview, formatFullReview } from './review.js'
-
-function tmpProject() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pulse-review-test-'))
-  fs.mkdirSync(path.join(root, 'src', 'pages'), { recursive: true })
-  return root
-}
-
-function writeSpec(root, name, content) {
-  const file = path.join(root, 'src', 'pages', name)
-  fs.writeFileSync(file, content)
-  return file
-}
-
-// ── Quick mode ────────────────────────────────────────────────────────────
-
-test('quick review flags a modalOpen state pattern', async () => {
-  const root = tmpProject()
-  const file = writeSpec(root, 'bad.js',
-    `export default {\n  route: '/x',\n  state: { modalOpen: false },\n  view: (state) => \`<main id="main-content">\${state.modalOpen ? 'open' : ''}</main>\`,\n}`)
-  const source = fs.readFileSync(file, 'utf8')
-  const result = await runQuickReview(source, file)
-  assert.equal(result.issues.some(i => i.includes('modalOpen')), true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('quick review flags a hex colour in rendered HTML', async () => {
-  const root = tmpProject()
-  const file = writeSpec(root, 'bad.js',
-    `export default {\n  route: '/x',\n  state: {},\n  view: () => '<main id="main-content"><h1 style="color:#ff0000">hi</h1></main>',\n}`)
-  const source = fs.readFileSync(file, 'utf8')
-  const result = await runQuickReview(source, file)
-  assert.equal(result.warnings.some(w => w.includes('hex')), true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('quick review reports no issues for a clean spec', async () => {
-  const root = tmpProject()
-  const file = writeSpec(root, 'good.js',
-    `export default {\n  route: '/x',\n  state: {},\n  view: () => '<main id="main-content"><h1>hi</h1></main>',\n}`)
-  const source = fs.readFileSync(file, 'utf8')
-  const result = await runQuickReview(source, file)
-  assert.equal(result.issues.length, 0)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('formatQuickReview agentFacing:true tells the agent to run pulse_validate then /verify', () => {
-  const output = formatQuickReview({ issues: [], warnings: [], confirms: [] }, { agentFacing: true })
-  assert.match(output, /pulse_validate/)
-  assert.match(output, /\/verify/)
-})
-
-test('formatQuickReview agentFacing:false (CLI default) uses plain human phrasing', () => {
-  const output = formatQuickReview({ issues: [], warnings: [], confirms: [] }, { agentFacing: false })
-  assert.match(output, /pulse validate/)
-  assert.doesNotMatch(output, /pulse_validate/, 'CLI output must not reference the MCP tool name pulse_validate')
-  assert.doesNotMatch(output, /\/verify/, 'CLI output must not reference the /verify slash command')
-})
-
-// ── Full mode ─────────────────────────────────────────────────────────────
-
-test('full review runs the schema validator and reports auto-checks', async () => {
-  const root = tmpProject()
-  const file = writeSpec(root, 'good.js',
-    `export default {\n  route: '/x',\n  meta: { title: 't', description: 'd', theme: 'dark' },\n  view: () => '<main id="main-content"><h1>hi</h1></main>',\n}`)
-  const source = fs.readFileSync(file, 'utf8')
-  const result = await runFullReview(source, file)
-  assert.match(result.validationResult, /Valid ✓/)
-  assert.equal(result.autoChecks.length > 0, true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('full review auto-checks flag modalOpen and malformed _storeUpdate', async () => {
-  const root = tmpProject()
-  const file = writeSpec(root, 'bad.js',
-    `export default {\n  route: '/x',\n  state: { modalOpen: false },\n  actions: {\n    save: {\n      onSuccess: (state) => ({ _storeUpdate: true }),\n      onError: (state, err) => ({ error: err.message }),\n      run: async () => {},\n    },\n  },\n  view: () => '<main id="main-content">x</main>',\n}`)
-  const source = fs.readFileSync(file, 'utf8')
-  const result = await runFullReview(source, file)
-  assert.equal(result.autoChecks.some(c => c.includes('modalOpen')), true)
-  assert.equal(result.autoChecks.some(c => c.includes('_storeUpdate')), true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('formatFullReview agentFacing:true opens with "you are now a senior code reviewer"', async () => {
-  const root = tmpProject()
-  const file = writeSpec(root, 'good.js',
-    `export default {\n  route: '/x',\n  meta: { title: 't', description: 'd', theme: 'dark' },\n  view: () => '<main id="main-content">x</main>',\n}`)
-  const source = fs.readFileSync(file, 'utf8')
-  const result = await runFullReview(source, file)
-  const output = formatFullReview(result, { source, file, agentFacing: true })
-  assert.match(output, /you are now a \*\*senior code reviewer\*\*/i)
-  assert.match(output, /Continue to the verification workflow/)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('formatFullReview agentFacing:false (CLI default) never says "you are now a reviewer" or references agent-only workflow', async () => {
-  const root = tmpProject()
-  const file = writeSpec(root, 'good.js',
-    `export default {\n  route: '/x',\n  meta: { title: 't', description: 'd', theme: 'dark' },\n  view: () => '<main id="main-content">x</main>',\n}`)
-  const source = fs.readFileSync(file, 'utf8')
-  const result = await runFullReview(source, file)
-  const output = formatFullReview(result, { source, file, agentFacing: false })
-  assert.doesNotMatch(output, /you are now a/i,
-    'CLI output must not carry the agent-directive "you are now a reviewer" framing')
-  assert.doesNotMatch(output, /Continue to the verification workflow/,
-    'CLI output must not tell a human to "continue to the verification workflow" — that instruction is for an agent session')
-  assert.match(output, new RegExp(`Spec: ${file.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`),
-    'CLI output should plainly name the file being reviewed')
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('the checklist reference material is identical in both agentFacing modes', async () => {
-  const root = tmpProject()
-  const file = writeSpec(root, 'good.js',
-    `export default {\n  route: '/x',\n  meta: { title: 't', description: 'd', theme: 'dark' },\n  view: () => '<main id="main-content">x</main>',\n}`)
-  const source = fs.readFileSync(file, 'utf8')
-  const result = await runFullReview(source, file)
-  const agentOutput = formatFullReview(result, { source, file, agentFacing: true })
-  const humanOutput = formatFullReview(result, { source, file, agentFacing: false })
-  // Both must contain the same checklist section headers — only the framing
-  // around them (intro/closing) should differ, never the checklist itself.
-  for (const heading of ['### Structure', '### Mutations & actions', '### Components & HTML', '### Accessibility', '### Defensive coding']) {
-    assert.equal(agentOutput.includes(heading), true, `agent output missing ${heading}`)
-    assert.equal(humanOutput.includes(heading), true, `human output missing ${heading}`)
-  }
-  fs.rmSync(root, { recursive: true, force: true })
-})

package/src/cli/stamp.test.js

@@ -1,149 +0,0 @@
-/**
- * Pulse — stamp.js tests
- * run: node src/cli/stamp.test.js
- *
- * Shared logic behind pulse_stamp (MCP tool) and `pulse stamp` (CLI
- * command). Regression coverage: a real Lighthouse run that passed the
- * score bar in a /verify session was found to be silently never saved via
- * `pulse save-report` — prose-only documentation for that step wasn't
- * enough, so full-mode pulse_stamp now refuses to write the stamp unless
- * it finds real evidence a report was saved.
- */
-
-import { test }   from 'node:test'
-import assert     from 'node:assert/strict'
-import fs         from 'node:fs'
-import os         from 'node:os'
-import path       from 'node:path'
-import { writeStamp, formatStampResult } from './stamp.js'
-
-function tmpProject() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'pulse-stamp-test-'))
-}
-
-function writeReport(root, slug, { ageMs = 0 } = {}) {
-  const dir = path.join(root, '.pulse', 'reports', slug)
-  fs.mkdirSync(dir, { recursive: true })
-  const file = path.join(dir, `${Date.now()}.json`)
-  fs.writeFileSync(file, JSON.stringify({ timestamp: new Date().toISOString(), scores: {} }))
-  if (ageMs > 0) {
-    const past = new Date(Date.now() - ageMs)
-    fs.utimesSync(file, past, past)
-  }
-  return file
-}
-
-// ── Quick mode / no route ───────────────────────────────────────────────
-
-test('writeStamp with no route stamps unconditionally', () => {
-  const root = tmpProject()
-  const result = writeStamp(root)
-  assert.equal(result.stamped, true)
-  assert.equal(fs.existsSync(path.join(root, '.pulse-verified')), true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('writeStamp in quick mode stamps even with no saved report', () => {
-  const root = tmpProject()
-  const result = writeStamp(root, { route: '/dashboard', mode: 'quick' })
-  assert.equal(result.stamped, true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-// ── Full mode — the actual regression this fixes ────────────────────────
-
-test('writeStamp in full mode refuses when no report was ever saved for the route', () => {
-  const root = tmpProject()
-  const result = writeStamp(root, { route: '/dashboard', mode: 'full' })
-  assert.equal(result.stamped, false)
-  assert.equal(result.refused, true)
-  assert.match(result.reason, /No Lighthouse report saved/)
-  assert.equal(fs.existsSync(path.join(root, '.pulse-verified')), false, 'must not write the stamp file at all')
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('writeStamp in full mode refuses when the only report is older than the window', () => {
-  const root = tmpProject()
-  writeReport(root, 'dashboard', { ageMs: 20 * 60 * 1000 }) // 20 min old
-  const result = writeStamp(root, { route: '/dashboard', mode: 'full' })
-  assert.equal(result.stamped, false)
-  assert.equal(result.refused, true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('writeStamp in full mode stamps when a recent report exists for the route', () => {
-  const root = tmpProject()
-  writeReport(root, 'dashboard')
-  const result = writeStamp(root, { route: '/dashboard', mode: 'full' })
-  assert.equal(result.stamped, true)
-  assert.equal(result.refused, false)
-  assert.equal(fs.existsSync(path.join(root, '.pulse-verified')), true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('writeStamp full mode checks the same slug pulse save-report would use for this route', () => {
-  const root = tmpProject()
-  // Root route '/' slugs to 'home' — same as report.js's urlToSlug.
-  writeReport(root, 'home')
-  const result = writeStamp(root, { route: '/', mode: 'full' })
-  assert.equal(result.stamped, true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('a report saved for a different route does not satisfy the check', () => {
-  const root = tmpProject()
-  writeReport(root, 'about') // saved for /about, not /dashboard
-  const result = writeStamp(root, { route: '/dashboard', mode: 'full' })
-  assert.equal(result.stamped, false)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-// ── Error-journal auto-resolve ───────────────────────────────────────────
-
-test('writeStamp with a route marks unresolved error-journal entries for that route resolved', () => {
-  const root = tmpProject()
-  fs.mkdirSync(path.join(root, '.pulse'), { recursive: true })
-  fs.writeFileSync(path.join(root, '.pulse', 'errors.json'), JSON.stringify([
-    { id: '1', ts: '2026-01-01T00:00:00.000Z', route: '/dashboard', phase: 'view', message: 'x', stack: '', resolved: false },
-    { id: '2', ts: '2026-01-01T00:00:00.000Z', route: '/other',     phase: 'view', message: 'y', stack: '', resolved: false },
-  ]))
-
-  const result = writeStamp(root, { route: '/dashboard' })
-  assert.equal(result.stamped, true)
-  assert.equal(result.resolvedCount, 1)
-
-  const entries = JSON.parse(fs.readFileSync(path.join(root, '.pulse', 'errors.json'), 'utf8'))
-  assert.equal(entries.find(e => e.id === '1').resolved, true)
-  assert.equal(entries.find(e => e.id === '2').resolved, false, 'must not resolve entries for a different route')
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-// ── formatStampResult ────────────────────────────────────────────────────
-
-test('formatStampResult agentFacing:true on refusal tells the agent to retry pulse_stamp', () => {
-  const output = formatStampResult({ stamped: false, refused: true, reason: 'no report', resolvedCount: 0, ts: null }, { agentFacing: true })
-  assert.match(output, /Refusing to stamp/)
-  assert.match(output, /call pulse_stamp again/)
-})
-
-test('formatStampResult agentFacing:false (CLI) omits the pulse_stamp-specific retry phrasing', () => {
-  const output = formatStampResult({ stamped: false, refused: true, reason: 'no report', resolvedCount: 0, ts: null }, { agentFacing: false })
-  assert.match(output, /Refusing to stamp/)
-  assert.doesNotMatch(output, /pulse_stamp/, 'CLI output must not reference the MCP tool name pulse_stamp')
-})
-
-test('formatStampResult distinguishes a real write failure from a policy refusal', () => {
-  const output = formatStampResult({ stamped: false, refused: false, reason: 'disk full', resolvedCount: 0, ts: null }, { agentFacing: true })
-  assert.match(output, /Failed to stamp/)
-  assert.doesNotMatch(output, /Refusing to stamp/)
-})
-
-test('formatStampResult on success reports resolved count when nonzero', () => {
-  const output = formatStampResult({ stamped: true, refused: false, reason: null, resolvedCount: 2, ts: '123' }, { agentFacing: true })
-  assert.match(output, /2 error-journal entries marked resolved/)
-})
-
-test('formatStampResult on success says nothing about resolving when count is zero', () => {
-  const output = formatStampResult({ stamped: true, refused: false, reason: null, resolvedCount: 0, ts: '123' }, { agentFacing: true })
-  assert.doesNotMatch(output, /marked resolved/)
-})

package/src/cli/validate.test.js

@@ -1,153 +0,0 @@
-/**
- * Pulse — validate.js tests
- * run: node src/cli/validate.test.js
- *
- * This is the shared logic behind both pulse_validate (MCP tool) and
- * `pulse validate` (CLI command) — a real end-to-end test here is the
- * guarantee that a human running the CLI gets the exact same check an
- * agent gets, since both call into this same module.
- */
-
-import { test }   from 'node:test'
-import assert     from 'node:assert/strict'
-import fs         from 'node:fs'
-import os         from 'node:os'
-import path       from 'node:path'
-import { validateContent, validateFile, formatValidationResult } from './validate.js'
-
-function tmpProject() {
-  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'pulse-validate-test-'))
-  fs.mkdirSync(path.join(root, 'src', 'pages'), { recursive: true })
-  return root
-}
-
-test('a valid spec with no meta.theme passes with a warning', async () => {
-  const root = tmpProject()
-  const content = `export default {\n  route: '/x',\n  meta: { title: 't', description: 'd' },\n  view: () => '<main id="main-content">x</main>',\n}`
-  const result = await validateContent(content, root)
-  assert.equal(result.valid, true)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('an invalid route (no leading slash) fails validation', async () => {
-  const root = tmpProject()
-  const content = `export default {\n  route: 'no-slash',\n  view: () => '',\n}`
-  const result = await validateContent(content, root)
-  assert.equal(result.valid, false)
-  assert.match(result.schemaOutput, /must start with "\/"/)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('prop-alias check flags nav({ brand }) and suggests logo', async () => {
-  const root = tmpProject()
-  const content = `export default {\n  route: '/x',\n  view: () => nav({ brand: 'Site', links: [] }),\n}`
-  const result = await validateContent(content, root)
-  assert.equal(result.sourceWarnings.length, 1)
-  assert.match(result.sourceWarnings[0], /"brand" is not a recognised prop for nav\(\)/)
-  assert.match(result.sourceWarnings[0], /did you mean "logo"/)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('prop-alias check does NOT flag autocomplete correctly placed inside attrs', async () => {
-  const root = tmpProject()
-  const content = `export default {\n  route: '/x',\n  view: () => input({ attrs: { autocomplete: 'email' } }),\n}`
-  const result = await validateContent(content, root)
-  assert.equal(result.sourceWarnings.length, 0,
-    `Expected no warnings for the recommended attrs pattern, got: ${JSON.stringify(result.sourceWarnings)}`)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('external image host warning fires when unlisted in pulse.config.js CSP', async () => {
-  const root = tmpProject()
-  const content = `export default {\n  route: '/x',\n  view: () => \`<img src="https://images.unsplash.com/photo-1">\`,\n}`
-  const result = await validateContent(content, root)
-  assert.equal(result.sourceWarnings.length, 1)
-  assert.match(result.sourceWarnings[0], /External image host detected \(Unsplash\)/)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('external image host warning is suppressed when the bare host is in pulse.config.js', async () => {
-  const root = tmpProject()
-  fs.writeFileSync(path.join(root, 'pulse.config.js'),
-    `export default { csp: { 'img-src': ['images.unsplash.com'] } }`)
-  const content = `export default {\n  route: '/x',\n  view: () => \`<img src="https://images.unsplash.com/photo-1">\`,\n}`
-  const result = await validateContent(content, root)
-  assert.equal(result.sourceWarnings.length, 0,
-    `Expected no warning when the bare host is already configured, got: ${JSON.stringify(result.sourceWarnings)}`)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('inline <script> warning does NOT fire for external scripts with a src', async () => {
-  const root = tmpProject()
-  const view = [
-    '<script src="/menu.js" defer></script>',
-    '<script defer src="/a.js"></script>',
-    '<script type="module" src=\'/b.js\'></script>',
-  ].join('')
-  const content = `export default {\n  route: '/x',\n  view: () => \`<main id="main-content">${view}</main>\`,\n}`
-  const result = await validateContent(content, root)
-  assert.equal(result.valid, true)
-  assert.doesNotMatch(result.schemaOutput, /Inline <script>/,
-    `Expected no inline-script warning for external scripts, got: ${result.schemaOutput}`)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('inline <script> warning still fires for real inline scripts', async () => {
-  const root = tmpProject()
-  const content = `export default {\n  route: '/x',\n  view: () => \`<main id="main-content"><script>alert(1)</script></main>\`,\n}`
-  const result = await validateContent(content, root)
-  assert.match(result.schemaOutput, /Inline <script> block detected/)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('inline <script> warning still fires when only data-src is present', async () => {
-  const root = tmpProject()
-  const content = `export default {\n  route: '/x',\n  view: () => \`<main id="main-content"><script data-src="/a.js">alert(1)</script></main>\`,\n}`
-  const result = await validateContent(content, root)
-  assert.match(result.schemaOutput, /Inline <script> block detected/)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('validateFile resolves relative imports from the spec\'s own directory', async () => {
-  const root = tmpProject()
-  fs.mkdirSync(path.join(root, 'src', 'components'), { recursive: true })
-  fs.mkdirSync(path.join(root, 'src', 'pages', 'news'), { recursive: true })
-  fs.writeFileSync(path.join(root, 'src', 'components', 'layout.js'),
-    `export const layout = ({ content }) => content`)
-  const specPath = path.join(root, 'src', 'pages', 'news', 'index.js')
-  fs.writeFileSync(specPath,
-    `import { layout } from '../../components/layout.js'\nexport default {\n  route: '/news',\n  meta: { title: 't', description: 'd' },\n  view: () => layout({ content: '<main id="main-content">news</main>' }),\n}`)
-  const result = await validateFile(specPath, root)
-  assert.equal(result.valid, true,
-    `Expected relative import to resolve from the spec's own directory, got: ${JSON.stringify(result)}`)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('validateFile returns an error object for a missing file', async () => {
-  const root = tmpProject()
-  const result = await validateFile(path.join(root, 'does-not-exist.js'), root)
-  assert.match(result.error, /File not found/)
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('formatValidationResult with nextSteps: true appends the agent browser-check reminder', async () => {
-  const root = tmpProject()
-  const content = `export default {\n  route: '/x',\n  meta: { title: 't', description: 'd', theme: 'dark' },\n  view: () => '<main id="main-content">x</main>',\n}`
-  const result = await validateContent(content, root)
-  const withNextSteps = formatValidationResult(result, { nextSteps: true })
-  const without = formatValidationResult(result, { nextSteps: false })
-  assert.match(withNextSteps, /browser check sequence/)
-  assert.doesNotMatch(without, /browser check sequence/,
-    'CLI output (nextSteps: false, the default) must not carry agent-only framing like "ask the user for design approval"')
-  fs.rmSync(root, { recursive: true, force: true })
-})
-
-test('formatValidationResult merges source warnings into a clean schema pass', async () => {
-  const root = tmpProject()
-  const content = `export default {\n  route: '/x',\n  meta: { title: 't', description: 'd', theme: 'dark' },\n  view: () => nav({ brand: 'x', links: [] }),\n}`
-  const result = await validateContent(content, root)
-  const output = formatValidationResult(result)
-  assert.match(output, /Valid ✓ — but fix these issues:/)
-  assert.match(output, /did you mean "logo"/)
-  fs.rmSync(root, { recursive: true, force: true })
-})

package/src/mcp/guards.test.js

@@ -1,90 +0,0 @@
-/**
- * MCP input guard tests — run with: node src/mcp/guards.test.js
- */
-
-import fs     from 'node:fs'
-import os     from 'node:os'
-import path   from 'node:path'
-import assert from 'node:assert/strict'
-import { resolveInRoot, isLoopbackUrl, isPrivateAddress, assertPublicUrl } from './guards.js'
-
-let passed = 0
-let failed = 0
-
-async function test(label, fn) {
-  try { await fn(); console.log(`  ✓ ${label}`); passed++ }
-  catch (e) { console.log(`  ✗ ${label}\n      ${e.message}`); failed++ }
-}
-
-const base    = fs.mkdtempSync(path.join(os.tmpdir(), 'pulse-guards-'))
-const root    = path.join(base, 'project')
-const outside = path.join(base, 'outside')
-fs.mkdirSync(path.join(root, 'src', 'pages'), { recursive: true })
-fs.mkdirSync(outside)
-fs.writeFileSync(path.join(root, 'src', 'pages', 'a.js'), '')
-fs.writeFileSync(path.join(outside, 'secret.js'), '')
-fs.symlinkSync(outside, path.join(root, 'link'))
-
-console.log('\nresolveInRoot\n')
-
-await test('accepts absolute and relative paths inside the project', () => {
-  assert.equal(resolveInRoot(root, path.join(root, 'src/pages/a.js')), path.join(root, 'src/pages/a.js'))
-  assert.equal(resolveInRoot(root, 'src/pages/a.js'), path.join(root, 'src/pages/a.js'))
-})
-await test('accepts a not-yet-created file inside the project', () => {
-  assert.doesNotThrow(() => resolveInRoot(root, 'src/pages/new.js'))
-})
-await test('rejects absolute paths outside the project', () => {
-  assert.throws(() => resolveInRoot(root, path.join(outside, 'secret.js')), /inside the project/)
-})
-await test('rejects ../ traversal', () => {
-  assert.throws(() => resolveInRoot(root, '../outside/secret.js'), /inside the project/)
-  assert.throws(() => resolveInRoot(root, 'src/../../outside/secret.js'), /inside the project/)
-})
-await test('rejects a symlink inside the project that points outside it', () => {
-  assert.throws(() => resolveInRoot(root, 'link/secret.js'), /inside the project/)
-})
-await test('rejects a sibling directory sharing the root name prefix', () => {
-  fs.mkdirSync(root + '-evil')
-  assert.throws(() => resolveInRoot(root, root + '-evil/x.js'), /inside the project/)
-})
-
-console.log('\nisLoopbackUrl\n')
-
-await test('allows localhost, 127.x and ::1', () => {
-  for (const u of ['http://localhost:3000/', 'http://127.0.0.1:3000/x', 'http://[::1]:3000/', 'http://app.localhost/'])
-    assert.equal(isLoopbackUrl(u), true, u)
-})
-await test('rejects remote hosts, lookalikes and non-http schemes', () => {
-  for (const u of ['http://example.com/', 'http://localhost.evil.com/', 'http://169.254.169.254/', 'file:///etc/passwd', 'ftp://localhost/', 'nonsense'])
-    assert.equal(isLoopbackUrl(u), false, u)
-})
-
-console.log('\nisPrivateAddress / assertPublicUrl\n')
-
-await test('flags loopback, private, link-local, CGNAT and metadata addresses', () => {
-  for (const ip of ['127.0.0.1', '10.0.0.5', '172.16.0.1', '172.31.255.255', '192.168.1.1', '169.254.169.254', '100.64.0.1', '0.0.0.0', '::1', '::', 'fd00::1', 'fe80::1', '::ffff:10.0.0.1'])
-    assert.equal(isPrivateAddress(ip), true, ip)
-})
-await test('allows public addresses', () => {
-  for (const ip of ['8.8.8.8', '1.1.1.1', '172.32.0.1', '2606:4700:4700::1111'])
-    assert.equal(isPrivateAddress(ip), false, ip)
-})
-await test('assertPublicUrl rejects internal IP literals and non-http schemes', async () => {
-  await assert.rejects(assertPublicUrl('http://169.254.169.254/latest/meta-data/'), /not a public address/)
-  await assert.rejects(assertPublicUrl('http://127.0.0.1:3000/'), /not a public address/)
-  await assert.rejects(assertPublicUrl('http://[::1]/'), /not a public address/)
-  await assert.rejects(assertPublicUrl('file:///etc/passwd'), /only http/)
-})
-await test('assertPublicUrl rejects hostnames that resolve to loopback', async () => {
-  await assert.rejects(assertPublicUrl('http://localhost:3000/'), /non-public/)
-})
-await test('assertPublicUrl accepts a public IP literal', async () => {
-  await assertPublicUrl('https://1.1.1.1/')
-})
-
-fs.rmSync(base, { recursive: true, force: true })
-fs.rmSync(root + '-evil', { recursive: true, force: true })
-
-console.log(`\n${passed + failed} tests: ${passed} passed, ${failed} failed\n`)
-if (failed > 0) process.exit(1)