@polderlabs/bizar 3.23.1 → 4.2.0

package/bizar-dash/tests/memory-store.test.mjs

@@ -0,0 +1,390 @@
+/**
+ * tests/memory-store.test.mjs
+ *
+ * Tests for the MarkdownMemoryStore.
+ */
+
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { mkdirSync, rmSync, writeFileSync, existsSync, readFileSync } from 'node:fs';
+
+const TEST_MEMORY_STORE = await import('../src/server/memory-store.mjs').then((m) => m);
+
+describe('memory-store', () => {
+  let projectRoot;
+  let otherRoot;
+
+  beforeEach(() => {
+    projectRoot = join(tmpdir(), `bizar-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    otherRoot = join(tmpdir(), `bizar-test-other-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(projectRoot, { recursive: true });
+    mkdirSync(otherRoot, { recursive: true });
+    mkdirSync(join(projectRoot, '.bizar'), { recursive: true });
+  });
+
+  afterEach(() => {
+    try { rmSync(projectRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+    try { rmSync(otherRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  // ── resolveVault ──────────────────────────────────────────────────────────────
+
+  describe('resolveVault', () => {
+    it('returns .obsidian path in local-only mode', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      const { vaultRoot, mode } = TEST_MEMORY_STORE.resolveVault(projectRoot);
+      assert.strictEqual(mode, 'local-only');
+      assert.strictEqual(vaultRoot, join(projectRoot, '.obsidian'));
+    });
+
+    it('returns shared repo path in managed mode with ~ expanded', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'managed', path: '~/data/memory', remote: null, branch: 'main', namespace: 'projects/my-proj' },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      const { vaultRoot, mode } = TEST_MEMORY_STORE.resolveVault(projectRoot);
+      assert.strictEqual(mode, 'managed');
+      assert.ok(vaultRoot.includes('data/memory'));
+      assert.ok(vaultRoot.includes('projects'));
+      assert.ok(vaultRoot.includes('my-proj'));
+    });
+  });
+
+  // ── initVault ────────────────────────────────────────────────────────────────
+
+  describe('initVault', () => {
+    it('creates .obsidian/ with subdirs in local-only mode', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      const result = TEST_MEMORY_STORE.initVault(projectRoot);
+      assert.ok(result.ok);
+      assert.ok(existsSync(join(projectRoot, '.obsidian')));
+      assert.ok(existsSync(join(projectRoot, '.obsidian', 'decisions')));
+      assert.ok(existsSync(join(projectRoot, '.obsidian', 'patterns')));
+      assert.ok(existsSync(join(projectRoot, '.obsidian', 'api')));
+    });
+
+    // F7: project namespace is NOT created at initVault time (only the shared
+    // repo parent dirs — projects/, global/, users/ — are created)
+    it('F7: does NOT create project namespace directory at initVault in managed mode', () => {
+      const sharedRepo = join(tmpdir(), `shared-repo-${Date.now()}`);
+      mkdirSync(sharedRepo, { recursive: true });
+
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'managed', path: sharedRepo, remote: null, branch: 'main', namespace: 'projects/my-proj' },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+
+      const result = TEST_MEMORY_STORE.initVault(projectRoot);
+      assert.ok(result.ok);
+      // projects/ directory should exist (created by initVault)
+      assert.ok(existsSync(join(sharedRepo, 'projects')));
+      // But the project-specific namespace (projects/my-proj/) should NOT be created yet
+      const expectedNsDir = join(sharedRepo, 'projects', 'my-proj');
+      assert.ok(!existsSync(expectedNsDir), 'project namespace should NOT be created at initVault');
+    });
+  });
+
+  // ── writeNote / readNote / listNotes ─────────────────────────────────────────
+
+  describe('writeNote + readNote', () => {
+    it('writes and reads a note back', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+
+      const note = {
+        frontmatter: {
+          memory_id: 'test_note_1',
+          type: 'architecture_decision',
+          project_id: 'my-proj',
+          status: 'active',
+          confidence: 'verified',
+          created: new Date().toISOString(),
+          updated: new Date().toISOString(),
+          tags: ['arch', 'api'],
+        },
+        body: '# Architecture\n\nThis is the body.',
+      };
+
+      const written = TEST_MEMORY_STORE.writeNote(projectRoot, 'decisions/adrs.md', note);
+      assert.strictEqual(written.relPath, 'decisions/adrs.md');
+      assert.strictEqual(written.schemaValid, true);
+
+      const readBack = TEST_MEMORY_STORE.readNote(projectRoot, 'decisions/adrs.md');
+      assert.ok(readBack);
+      assert.strictEqual(readBack.frontmatter.type, 'architecture_decision');
+      assert.ok(readBack.body.includes('Architecture'));
+    });
+
+    it('F7: creates project namespace directory on first writeNote', () => {
+      const sharedRepo = join(tmpdir(), `shared-repo-writer-${Date.now()}`);
+      mkdirSync(sharedRepo, { recursive: true });
+      mkdirSync(join(sharedRepo, 'projects'), { recursive: true });
+
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'managed', path: sharedRepo, remote: null, branch: 'main', namespace: 'projects/my-proj' },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+
+      // Pre-condition: namespace dir does not exist
+      const expectedNsDir = join(sharedRepo, 'projects', 'my-proj');
+      assert.ok(!existsSync(expectedNsDir));
+
+      TEST_MEMORY_STORE.writeNote(projectRoot, 'decisions/adrs.md', {
+        frontmatter: {
+          memory_id: 'test_note_ns',
+          type: 'architecture_decision',
+          project_id: 'my-proj',
+          status: 'active',
+          confidence: 'verified',
+          created: new Date().toISOString(),
+          updated: new Date().toISOString(),
+          tags: [],
+        },
+        body: 'test',
+      });
+
+      // Post-condition: namespace dir was created
+      assert.ok(existsSync(expectedNsDir), 'project namespace should be created on first writeNote');
+    });
+
+    it('rejects notes missing required fields', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+
+      assert.throws(() => {
+        TEST_MEMORY_STORE.writeNote(projectRoot, 'test.md', {
+          frontmatter: { title: 'No required fields' },
+          body: 'body',
+        });
+      }, /schema validation failed/);
+    });
+
+    it('rejects when HIGH-severity secret is present', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+
+      assert.throws(() => {
+        TEST_MEMORY_STORE.writeNote(projectRoot, 'test.md', {
+          frontmatter: {
+            memory_id: 'test_secret',
+            type: 'session_summary',
+            project_id: 'my-proj',
+            status: 'active',
+            confidence: 'verified',
+            created: new Date().toISOString(),
+            updated: new Date().toISOString(),
+            tags: [],
+          },
+          body: 'AKIAIOSFODNN7EXAMPLE is an AWS key',
+        });
+      }, /HIGH-severity secret detected/);
+    });
+
+    it('warns but succeeds on MEDIUM-severity secret', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+
+      // Should not throw
+      const written = TEST_MEMORY_STORE.writeNote(projectRoot, 'test.md', {
+        frontmatter: {
+          memory_id: 'test_med',
+          type: 'session_summary',
+          project_id: 'my-proj',
+          status: 'active',
+          confidence: 'verified',
+          created: new Date().toISOString(),
+          updated: new Date().toISOString(),
+          tags: [],
+        },
+        body: 'api_key: abcdefghijklmnopqrstuvwxyz123456',
+      });
+      assert.ok(written);
+    });
+  });
+
+  // ── path safety ─────────────────────────────────────────────────────────────
+
+  describe('path safety', () => {
+    it('readNote returns null for path traversal attempt', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+
+      const result = TEST_MEMORY_STORE.readNote(projectRoot, '../../../etc/passwd');
+      assert.strictEqual(result, null);
+    });
+
+    it('writeNote rejects path traversal attempt', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+
+      assert.throws(() => {
+        TEST_MEMORY_STORE.writeNote(projectRoot, '../../../etc/passwd', {
+          frontmatter: { memory_id: 'hax', type: 'session_summary', project_id: 'p', status: 'active', confidence: 'verified', created: '2026-01-01', updated: '2026-01-01', tags: [] },
+          body: 'hax',
+        });
+      }, /Invalid note path/);
+    });
+  });
+
+  // ── listNotes ────────────────────────────────────────────────────────────────
+
+  describe('listNotes', () => {
+    it('returns all notes in vault', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+
+      TEST_MEMORY_STORE.writeNote(projectRoot, 'note1.md', {
+        frontmatter: { memory_id: 'n1', type: 'session_summary', project_id: 'p', status: 'active', confidence: 'verified', created: '2026-01-01', updated: '2026-01-01', tags: [] },
+        body: 'note 1',
+      });
+      TEST_MEMORY_STORE.writeNote(projectRoot, 'note2.md', {
+        frontmatter: { memory_id: 'n2', type: 'session_summary', project_id: 'p', status: 'active', confidence: 'verified', created: '2026-01-01', updated: '2026-01-01', tags: [] },
+        body: 'note 2',
+      });
+
+      const notes = TEST_MEMORY_STORE.listNotes(projectRoot);
+      assert.strictEqual(notes.length, 2);
+    });
+  });
+
+  // ── searchVault ─────────────────────────────────────────────────────────────
+
+  describe('searchVault', () => {
+    it('finds a note by exact substring', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+
+      TEST_MEMORY_STORE.writeNote(projectRoot, 'search-test.md', {
+        frontmatter: { memory_id: 'st1', type: 'session_summary', project_id: 'p', status: 'active', confidence: 'verified', created: '2026-01-01', updated: '2026-01-01', tags: [] },
+        body: 'This note is about PostgreSQL optimization techniques.',
+      });
+
+      const results = TEST_MEMORY_STORE.searchVault(projectRoot, 'PostgreSQL');
+      assert.strictEqual(results.length, 1);
+      assert.strictEqual(results[0].relPath, 'search-test.md');
+    });
+
+    it('returns empty array for no matches', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+      const results = TEST_MEMORY_STORE.searchVault(projectRoot, 'nonexistentquery');
+      assert.strictEqual(results.length, 0);
+    });
+  });
+
+  // ── deleteNote ───────────────────────────────────────────────────────────────
+
+  describe('deleteNote', () => {
+    it('deletes an existing note', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+
+      TEST_MEMORY_STORE.writeNote(projectRoot, 'to-delete.md', {
+        frontmatter: { memory_id: 'td1', type: 'session_summary', project_id: 'p', status: 'active', confidence: 'verified', created: '2026-01-01', updated: '2026-01-01', tags: [] },
+        body: 'delete me',
+      });
+
+      const ok = TEST_MEMORY_STORE.deleteNote(projectRoot, 'to-delete.md');
+      assert.strictEqual(ok, true);
+
+      const readBack = TEST_MEMORY_STORE.readNote(projectRoot, 'to-delete.md');
+      assert.strictEqual(readBack, null);
+    });
+
+    it('returns false for non-existent note', () => {
+      TEST_MEMORY_STORE.saveConfig(projectRoot, {
+        version: 1, backend: 'bizar-local', projectId: 'my-proj',
+        memoryRepo: { mode: 'local-only', path: join(projectRoot, '.obsidian'), remote: null, branch: 'main', namespace: null },
+        namespaces: { project: 'projects/my-proj', global: 'global/bizar', user: 'users/local' },
+        lightrag: { enabled: false, host: '127.0.0.1', port: 9621, workingDir: join(projectRoot, '.bizar', 'lightrag') },
+        git: { autoPullOnSessionStart: false, autoCommitOnMemoryWrite: false, autoPushOnSessionEnd: false, commitAuthor: 'Bizar Memory <bizar-memory@local>', commitMessageTemplate: 'memory(my-proj): {summary}' },
+      });
+      TEST_MEMORY_STORE.initVault(projectRoot);
+      const ok = TEST_MEMORY_STORE.deleteNote(projectRoot, 'does-not-exist.md');
+      assert.strictEqual(ok, false);
+    });
+  });
+});

package/bizar-dash/tests/memory-sync.test.mjs

@@ -0,0 +1,141 @@
+/**
+ * tests/memory-sync.test.mjs
+ *
+ * Integration tests for the memory sync orchestrator (C6).
+ * Tests: clean sync commits, secret-blocked sync is rejected, F6 commit message.
+ */
+
+import { describe, it, beforeEach, afterEach } from 'node:test';
+import assert from 'node:assert';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { mkdirSync, rmSync, writeFileSync, existsSync, readFileSync } from 'node:fs';
+import { execSync } from 'node:child_process';
+
+const TEST_GIT = await import('../src/server/memory-git.mjs').then((m) => m);
+const TEST_STORE = await import('../src/server/memory-store.mjs').then((m) => m);
+const GIT_INSTALLED = TEST_GIT.isGitInstalled();
+
+describe('memory-sync', () => {
+  let bareRemote;
+  let workingDir;
+  let projectRoot;
+
+  beforeEach(() => {
+    bareRemote = null;
+    workingDir = null;
+    projectRoot = null;
+    if (!GIT_INSTALLED) return;
+
+    // Set up a bare remote + working clone
+    bareRemote = join(tmpdir(), `sync-remote-${Date.now()}.git`);
+    mkdirSync(bareRemote, { recursive: true });
+    try {
+      execSync('git', ['init', '--bare'], { cwd: bareRemote, encoding: 'utf8', stdio: 'pipe' });
+    } catch { try { rmSync(bareRemote, { recursive: true, force: true }); } catch { /* ignore */ } bareRemote = null; return; }
+
+    workingDir = join(tmpdir(), `sync-work-${Date.now()}`);
+    mkdirSync(workingDir, { recursive: true });
+    try {
+      execSync('git', ['clone', bareRemote, workingDir], { encoding: 'utf8', stdio: 'pipe' });
+      execSync('git', ['config', 'user.email', 'test@bizar.ai'], { cwd: workingDir, encoding: 'utf8', stdio: 'pipe' });
+      execSync('git', ['config', 'user.name', 'Bizar Test'], { cwd: workingDir, encoding: 'utf8', stdio: 'pipe' });
+    } catch { try { rmSync(workingDir, { recursive: true, force: true }); } catch { /* ignore */ } workingDir = null; return; }
+
+    projectRoot = workingDir;
+    mkdirSync(join(projectRoot, '.bizar'), { recursive: true });
+
+    // Configure memory in managed mode
+    TEST_STORE.saveConfig(projectRoot, {
+      mode: 'managed',
+      projectId: 'my-proj',
+      repoName: workingDir,
+      gitRemote: bareRemote,
+      branch: 'main',
+    });
+  });
+
+  afterEach(() => {
+    try { if (bareRemote) rmSync(bareRemote, { recursive: true, force: true }); } catch { /* ignore */ }
+    try { if (workingDir) rmSync(workingDir, { recursive: true, force: true }); } catch { /* ignore */ }
+    try { if (projectRoot) rmSync(projectRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  });
+
+  function writeCleanNote(relPath, body = 'This is a clean note.') {
+    if (!projectRoot) return;
+    TEST_STORE.writeNote(projectRoot, relPath, {
+      frontmatter: {
+        memory_id: `sync_${Date.now()}`,
+        type: 'session_summary',
+        project_id: 'my-proj',
+        status: 'active',
+        confidence: 'verified',
+        created: new Date().toISOString(),
+        updated: new Date().toISOString(),
+        tags: ['sync-test'],
+      },
+      body,
+    });
+  }
+
+  (GIT_INSTALLED ? it : it.skip)('clean note can be synced (committed)', () => {
+    if (!workingDir || !projectRoot) return;
+    writeCleanNote('sync-test/clean.md');
+    const gs = TEST_GIT.status(workingDir);
+    assert.strictEqual(gs.ok, true);
+    assert.ok(!gs.clean);
+    TEST_GIT.addAll(workingDir);
+    const result = TEST_GIT.commit(workingDir, '[memory-sync] 2026-01-01 test sync');
+    assert.strictEqual(result.ok, true);
+  });
+
+  (GIT_INSTALLED ? it : it.skip)('note with HIGH-severity secret is blocked', () => {
+    if (!projectRoot) return;
+    // writeNote should throw for HIGH-severity secret
+    assert.throws(() => {
+      TEST_STORE.writeNote(projectRoot, 'sync-test/secret.md', {
+        frontmatter: {
+          memory_id: 'sync_secret',
+          type: 'session_summary',
+          project_id: 'my-proj',
+          status: 'active',
+          confidence: 'verified',
+          created: new Date().toISOString(),
+          updated: new Date().toISOString(),
+          tags: [],
+        },
+        body: 'AKIAIOSFODNN7EXAMPLE is my AWS access key',
+      });
+    }, /HIGH-severity secret detected/);
+  });
+
+  (GIT_INSTALLED ? it : it.skip)('F6: git log contains [memory-sync] after clean sync', () => {
+    if (!workingDir || !projectRoot) return;
+    writeCleanNote('sync-test/f6-test.md', 'Testing F6 commit message format.');
+    TEST_GIT.addAll(workingDir);
+    const date = new Date().toISOString().replace(/T.*/, '');
+    const message = `[memory-sync] ${date} sync-test/f6-test.md`;
+    TEST_GIT.commit(workingDir, message);
+    const log = execSync('git', ['log', '-1', '--pretty=%B'], {
+      cwd: workingDir,
+      encoding: 'utf8',
+    }).trim();
+    assert.ok(log.startsWith('[memory-sync]'), `Expected log to start with "[memory-sync]", got: ${log}`);
+  });
+
+  (GIT_INSTALLED ? it : it.skip)('lock is released after error path', () => {
+    if (!workingDir) return;
+    const lock = TEST_GIT.acquireLock(workingDir);
+    assert.strictEqual(lock.error, undefined);
+    try {
+      throw new Error('simulated error');
+    } catch {
+      lock.release();
+    }
+    assert.ok(!existsSync(join(workingDir, '.sync.lock')));
+    // Can acquire after release
+    const lock2 = TEST_GIT.acquireLock(workingDir);
+    assert.strictEqual(lock2.error, undefined);
+    lock2.release();
+  });
+});