@webship.co/workspace 1.0.0-alpha1 → 1.0.0-beta2

package/core/workspace-app/tests/unit/builder-args.test.js

@@ -0,0 +1,113 @@
+/**
+ * The Build form's Arguments panel must offer exactly what each builder accepts.
+ *
+ * Ground truth is the builder's own argparse: every arg source in the tree is run
+ * with --help and its flags compared with what builder-args.js returns. The old
+ * parser guessed the arg file from distribution_name and was wrong for 96
+ * builders — a panel full of flags for the Drupal CMS site-template builders, whose
+ * parser takes a name and nothing else, and flags the Webship site-template parser
+ * refuses outright.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const { parseBuilderArgs, argSourceOf } = require('../../builder-args');
+
+const ROOT = path.join(__dirname, '..', '..', '..', '..');
+const SCRIPTS = path.join(ROOT, 'core', 'scripts');
+
+function builders() {
+  const out = [];
+  for (const w of fs.readdirSync(ROOT)) {
+    const dir = path.join(ROOT, w);
+    let names = [];
+    try { names = fs.readdirSync(dir); } catch (_) { continue; }
+    for (const f of names) if (/^cmd-.*project.*\.sh$/.test(f)) out.push({ w, dir, f });
+  }
+  return out;
+}
+
+/** The flags a builder's real parser prints for --help, without running the builder. */
+function realFlags({ w, dir, f }) {
+  const src = fs.readFileSync(path.join(dir, f), 'utf8');
+  const where = argSourceOf(src, ROOT);
+  if (!where) return null;
+  // Replay the builder's own assignments so an unquoted heredoc expands as it would.
+  const assigns = [...src.matchAll(/^[ \t]*([A-Za-z_][A-Za-z0-9_]*)="([^"$`]*)";?[ \t]*(?:#.*)?$/gm)]
+    .map((m) => `${m[1]}=${JSON.stringify(m[2])}`).join('; ');
+  const settings = path.join(ROOT, 'core', 'config', `workspace.${w}.settings.yml`);
+  const parser = where.kind === 'inline'
+    ? `bash ${JSON.stringify(path.join(dir, f))} --help`
+    : `source ${JSON.stringify(where.file)}`;
+  const script = `
+    WORKSPACE_SCRIPTS=${JSON.stringify(SCRIPTS)}; source "$WORKSPACE_SCRIPTS/bootstrap.sh" >/dev/null 2>&1
+    [ -f ${JSON.stringify(settings)} ] && eval $(parse_yaml ${JSON.stringify(settings)})
+    ${assigns}
+    set -- probe --help
+    ${parser}`;
+  const r = spawnSync('bash', ['-c', script], { encoding: 'utf8', timeout: 20000, stdio: ['ignore', 'pipe', 'pipe'] });
+  const help = `${r.stdout}\n${r.stderr}`;
+  return new Set([...help.matchAll(/(?:^|[\s,\[])(--[a-z][a-z0-9-]*)/g)].map((m) => m[1]).filter((x) => x !== '--help'));
+}
+
+test('every builder: the panel offers exactly the flags its real parser accepts', () => {
+  const all = builders();
+  assert.ok(all.length > 100, `expected the whole tree, found ${all.length} builders`);
+  // One --help per distinct source: the flag SET depends only on the file.
+  const bySource = new Map();
+  const failures = [];
+  for (const b of all) {
+    const src = fs.readFileSync(path.join(b.dir, b.f), 'utf8');
+    const where = argSourceOf(src, ROOT);
+    const key = where ? (where.kind === 'inline' ? `inline:${b.w}/${b.f}` : where.file) : null;
+    if (!key) continue;
+    if (!bySource.has(key)) bySource.set(key, realFlags(b));
+    const expected = bySource.get(key);
+    if (!expected || !expected.size) continue;
+    const got = new Set(parseBuilderArgs(b.dir, b.f, ROOT).map((a) => a.flag));
+    const missing = [...expected].filter((x) => !got.has(x));
+    const extra = [...got].filter((x) => !expected.has(x));
+    if (missing.length || extra.length) failures.push(`${b.w}/${b.f}: missing ${missing.join(' ') || '-'}; refused-by-parser ${extra.join(' ') || '-'}`);
+  }
+  assert.deepStrictEqual(failures, [], failures.slice(0, 12).join('\n'));
+});
+
+test('Drupal CMS site-template builders take a name and nothing else', () => {
+  // arg-site-template.sh declares only PROJECT_NAME: the template decides what the site is, so
+  // there is nothing left to choose, and a panel that offered --install or --php-version would be
+  // offering flags the build exits on.
+  const dir = path.join(ROOT, 'site-templates');
+  for (const f of ['cmd-byte-project.sh', 'cmd-haven-project.sh', 'cmd-website_starter-project.sh']) {
+    assert.deepStrictEqual(parseBuilderArgs(dir, f, ROOT), [], `${f} takes no flags`);
+  }
+});
+
+test('Webship site-template builders: no flags their parser refuses, and only the ones it takes', () => {
+  const dir = path.join(ROOT, 'site-templates');
+  const flagsOf = (f) => parseBuilderArgs(dir, f, ROOT).map((x) => x.flag).sort();
+  // The Website line's parser takes the users and the pending fixes, nothing from the distribution set.
+  assert.deepStrictEqual(flagsOf('cmd-website_starter-1-0-x-project.sh'), ['--add-users', '--with-pending-fixes']);
+  assert.deepStrictEqual(flagsOf('cmd-webship_portal-1-0-x-project.sh'), ['--add-users', '--with-pending-fixes']);
+  // The Webships line's parser takes the users alone.
+  assert.deepStrictEqual(flagsOf('cmd-webships_starter-1-0-x-project.sh'), ['--add-users']);
+  for (const refused of ['--install', '--enable', '--skip-set-default-settings', '--skip-drop-database', '--php-version']) {
+    assert.ok(!flagsOf('cmd-website_starter-1-0-x-project.sh').includes(refused),
+      `${refused} would make the build exit with "unrecognized arguments"`);
+  }
+});
+
+test('no default is ever shown as unexpanded shell text', () => {
+  for (const b of builders()) {
+    for (const a of parseBuilderArgs(b.dir, b.f, ROOT)) {
+      assert.ok(!String(a.def).includes('${'), `${b.w}/${b.f} ${a.flag} shows "${a.def}"`);
+    }
+  }
+});
+
+test('builders that source through distribution_name are unchanged', () => {
+  const flags = parseBuilderArgs(path.join(ROOT, 'dev'), 'cmd-webship11-0-x-project.sh', ROOT).map((x) => x.flag);
+  for (const f of ['--install', '--add-users', '--enable', '--php-version']) assert.ok(flags.includes(f), `webship11 lost ${f}`);
+});

package/core/workspace-app/tests/unit/builders.test.js

@@ -0,0 +1,158 @@
+/**
+ * Which cmd-*.sh the Build a new project picker offers.
+ *
+ * Getting this wrong is invisible: a builder that is filtered out does not error, it is simply not
+ * in the list, and nobody notices until somebody goes looking for the one they came for. That is
+ * exactly what happened — `cmd-automated-testing-*-project.sh` was excluded by name, so the test
+ * workspace offered nine of its fourteen builders and the five missing ones were the reason to open
+ * that page at all.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const { findBuilderScripts, builderLabel } = require('../../workspaces');
+
+function folder(names) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-builders-'));
+  for (const [name, body] of Object.entries(names)) fs.writeFileSync(path.join(dir, name), body);
+  return dir;
+}
+
+test('a builder is a cmd-*-project.sh that is not a per-project tool', () => {
+  const dir = folder({
+    'cmd-webship11-0-x-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-drupal11-recommended-project.sh': '#!/usr/bin/env bash\n',
+    // Tools, however they end: backup and graphify act ON a project, they do not build one.
+    'cmd-tools-backup-dev.sh': '#!/usr/bin/env bash\n',
+    'cmd-tool-something-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-tools-graphify.sh': '#!/usr/bin/env bash\n',
+    // Not a command at all.
+    'AGENTS.md': '# x\n',
+  });
+  assert.deepEqual(findBuilderScripts(dir),
+    ['cmd-drupal11-recommended-project.sh', 'cmd-webship11-0-x-project.sh']);
+});
+
+test('an automated-testing builder is a builder', () => {
+  // It builds a whole site and scaffolds its testing stack on top, which is why the test workspace
+  // exists. It was excluded by name, and the list it was missing from was the one that needed it.
+  const dir = folder({
+    'cmd-automated-testing-webship11-0-x-project.sh': '#!/usr/bin/env bash\n\n# workspace-name: Webship 11.0.x + Automated Testing (webship-js)\n',
+    'cmd-webship11-0-x-project.sh': '#!/usr/bin/env bash\n\n# workspace-name: Webship 11.0.x\n',
+  });
+  const found = findBuilderScripts(dir);
+  assert.equal(found.length, 2);
+  assert.ok(found.includes('cmd-automated-testing-webship11-0-x-project.sh'));
+});
+
+test('a builder label names the site and what is set up, not the runner', () => {
+  // Which runner drives it — Playwright underneath webship-js — is an implementation detail of the
+  // stack. In the label it dates the entry and makes two builders that do the same thing look like
+  // two different things. The stack itself (webship-js) is what is set up, so it may be named.
+  const { ROOT } = require('../../workspaces');
+  const dir = path.join(ROOT, 'test');
+  if (!fs.existsSync(dir)) return;
+  for (const f of findBuilderScripts(dir)) {
+    const label = builderLabel(dir, f);
+    assert.ok(!/playwright|cypress|nightwatch/i.test(label), `${f} names its runner in the label: ${label}`);
+    if (f.startsWith('cmd-automated-testing-')) {
+      assert.match(label, /\+ Automated Testing\b/, `${f} should say what it sets up`);
+    }
+  }
+});
+
+test('a builder is labelled by its own header, not by its filename', () => {
+  const dir = folder({
+    'cmd-automated-testing-webship11-0-x-project.sh': '#!/usr/bin/env bash\n\n# workspace-name: Webship 11.0.x + Automated Testing (webship-js)\n',
+    'cmd-nameless-project.sh': '#!/usr/bin/env bash\n',
+  });
+  assert.equal(builderLabel(dir, 'cmd-automated-testing-webship11-0-x-project.sh'),
+    'Webship 11.0.x + Automated Testing (webship-js)');
+  // No header is not an error — the filename is a worse name, not no name.
+  assert.equal(builderLabel(dir, 'cmd-nameless-project.sh'), 'cmd-nameless-project.sh');
+});
+
+test('a pinned builder says the release it installs, and pairs with a branch one', () => {
+  // `11-0-x` is the branch (11.0.x-dev) and `11-0-0` is the released tag (~11.0.0). The label says
+  // "Webship 11.0.0" beside "Webship 11.0.x": the last digit is the whole difference between a tag
+  // and a branch, and it must be in the label. Asserted against the tree, in every workspace that builds.
+  const { ROOT } = require('../../workspaces');
+  for (const ws of ['dev', 'test', 'demos', 'sandboxes']) {
+    const dir = path.join(ROOT, ws);
+    if (!fs.existsSync(dir)) continue;
+    for (const f of findBuilderScripts(dir)) {
+      const twin = /-(\d+)-(\d+)-0-/.exec(f);
+      if (!twin) continue;
+      const body = fs.readFileSync(path.join(dir, f), 'utf8');
+      assert.match(body, /^(site_version|[a-z]+_version|site_template_version_default)="~/m,
+        `${ws}/${f} is named as a release but does not pin one`);
+      assert.ok(builderLabel(dir, f).includes(`${twin[1]}.${twin[2]}.0`),
+        `${ws}/${f} installs ${twin[1]}.${twin[2]}.0 but its label does not say so: ${builderLabel(dir, f)}`);
+      // Every pinned builder is the twin of a branch one, never an orphan.
+      assert.ok(fs.existsSync(path.join(dir, f.replace(/-(\d+)-(\d+)-0-/, '-$1-$2-x-'))),
+        `${ws}/${f} has no branch twin`);
+    }
+  }
+});
+
+test('the test workspace really does offer every builder it ships', () => {
+  // Against the tree itself: the bug was a filter that looked right in isolation.
+  const dir = path.join(require('../../workspaces').ROOT, 'test');
+  if (!fs.existsSync(dir)) return;                       // a clone without the workspaces built
+  const onDisk = fs.readdirSync(dir)
+    .filter((f) => /^cmd-.*-project\.sh$/.test(f) && !/^cmd-tools?-/.test(f)).sort();
+  // Compared as a SET: the list is no longer alphabetical — BUILDER_ORDER puts the current
+  // Drupal, the next one, Webship and the site templates at the head — and what this test is
+  // about is that nothing is missing, not what order it comes in.
+  assert.deepEqual([...findBuilderScripts(dir)].sort(), onDisk);
+  assert.ok(onDisk.some((f) => f.startsWith('cmd-automated-testing-')), 'including the testing ones');
+});
+
+test('the builders people reach for are at the head of the list, in order', () => {
+  // Alphabetical put the `cmd-automated-testing-…` builds above everything in the test workspace,
+  // and `cmd-cucumber11-…` above Drupal and Webship everywhere else.
+  const dir = folder({
+    'cmd-automated-testing-webship11-0-x-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-drupal9-recommended-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-website_starter-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-cucumber11-0-x-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-webships2-0-x-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-webship11-0-0-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-webship11-0-x-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-drupalcms2-x-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-drupal12-recommended-project.sh': '#!/usr/bin/env bash\n',
+    'cmd-drupal11-recommended-project.sh': '#!/usr/bin/env bash\n',
+  });
+  assert.deepEqual(findBuilderScripts(dir).slice(0, 8), [
+    // The three bases, then Webship — the branch and its pinned twin together, the alphabet between them.
+    'cmd-drupal11-recommended-project.sh',
+    'cmd-drupal12-recommended-project.sh',
+    'cmd-drupalcms2-x-project.sh',
+    'cmd-webship11-0-0-project.sh',
+    'cmd-webship11-0-x-project.sh',
+    'cmd-webships2-0-x-project.sh',
+    'cmd-cucumber11-0-x-project.sh',
+    'cmd-website_starter-project.sh',
+  ]);
+  // Everything unnamed keeps its alphabetical place below, so a new builder needs no code
+  // change unless it belongs at the top.
+  assert.deepEqual(findBuilderScripts(dir).slice(8), [
+    'cmd-automated-testing-webship11-0-x-project.sh',
+    'cmd-drupal9-recommended-project.sh',
+  ]);
+});
+
+test('every workspace that builds sites offers Drupal 12', () => {
+  const { ROOT } = require('../../workspaces');
+  for (const ws of ['dev', 'test', 'demos', 'sandboxes', 'projects']) {
+    const dir = path.join(ROOT, ws);
+    if (!fs.existsSync(dir)) continue;                   // a clone without the workspaces built
+    const found = findBuilderScripts(dir);
+    assert.ok(found.includes('cmd-drupal12-recommended-project.sh'), `${ws} has the Drupal 12 builder`);
+    assert.equal(builderLabel(dir, 'cmd-drupal12-recommended-project.sh'), 'Drupal 12 (latest)');
+  }
+});

package/core/workspace-app/tests/unit/card-state-toggle.test.js

@@ -0,0 +1,29 @@
+'use strict';
+const test = require('node:test');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const server = fs.readFileSync(path.join(__dirname, '../../server.js'), 'utf8');
+const css = fs.readFileSync(path.join(__dirname, '../../public/css/components/project-cards.css'), 'utf8');
+
+test('the state chip on a card switches the project: Stopped and Paused start it, Running stops it', () => {
+  assert.match(server, /const act = st === 'running' \? 'Stop' : 'Start';/);
+  assert.match(server, /hx-post="\/actions\/ddev-\$\{act\.toLowerCase\(\)\}"/);
+  assert.match(server, /<button type="button" class="uk-label \$\{cls\} state-chip state-toggle/);
+});
+
+test('stopping from the chip goes through the confirm dialog; starting does not', () => {
+  assert.match(server, /state-toggle\$\{st === 'running' \? ' arm-step' : ''\}/);
+  assert.match(server, /\$\{st === 'running' \? ' hx-trigger="confirmed-remove"' : ''\}/);
+});
+
+test('a DDEV state other than these three is shown, not offered as a switch', () => {
+  assert.match(server, /if \(!st\) return `<span class="uk-label state-chip state-chip-off">/);
+});
+
+test('hovering the chip says what a click does, and Paused has its own colour and stripe', () => {
+  assert.match(css, /\.state-toggle:is\(:hover, :focus-visible\) \.state-act \{ visibility: visible; \}/);
+  assert.match(css, /\.state-chip-paused \{ background: var\(--warning-soft\); color: var\(--warning-ink\);/);
+  assert.match(css, /\.project-row\.pcard:has\(\.state-chip-paused\) \{ --pcard-stripe: var\(--warning\); \}/);
+});

package/core/workspace-app/tests/unit/changelog.test.js

@@ -0,0 +1,177 @@
+/**
+ * Reading the changelogs in products/.
+ *
+ * The parser's job is to be right about files nobody wrote for it. Three formats are in the tree
+ * and each is tested on its own shape, because a reader that works for the products somebody
+ * remembered is a reader people stop trusting the first time a version is missing.
+ */
+
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert');
+
+const {
+  parseChangelog, kindOf, looksLikeVersion, listChangelogs, changelogFor, releasesFor, changelogIndex,
+} = require('../../changelog');
+
+/* ---------------- the formats ---------------- */
+
+test('Keep a Changelog: version, date, and the kind from the section', () => {
+  const [rel] = parseChangelog(`# Changelog
+
+## [1.0.3] - 2026-09-14
+### Added
+- Add a Newsletter Canvas page at \`/newsletter\`
+
+### Fixed
+- Give the footer Subscribe button a link destination
+`);
+  assert.equal(rel.version, '1.0.3');
+  assert.equal(rel.date, '2026-09-14');
+  assert.deepEqual(rel.entries.map((e) => e.kind), ['Added', 'Fixed']);
+  assert.deepEqual(rel.entries.map((e) => e.tone), ['success', 'danger']);
+});
+
+// The bug this was written for: the date separator used to match any dash, so `# 11.0.0-rc1` parsed
+// as version `11.0.0` with `rc1` where the date goes — and a file with six releases showed three of
+// them called 11.0.0. The separator has to be surrounded by whitespace.
+test('a version with a suffix keeps its suffix', () => {
+  const releases = parseChangelog(`# 11.0.0
+- task: something
+
+# 11.0.0-rc1
+- task: something else
+
+# 11.0.0-beta2
+- task: a third thing
+`);
+  assert.deepEqual(releases.map((r) => r.version), ['11.0.0', '11.0.0-rc1', '11.0.0-beta2']);
+  assert.deepEqual(releases.map((r) => r.date), ['', '', '']);
+});
+
+test('the old Drupal .txt: a title line underlined with dashes', () => {
+  const releases = parseChangelog(`Menu Position 7.x-1.1, 2012-02-22
+---------------------------------
+- #1439948 by reglogge: form validation fails
+
+Menu Position 7.x-1.0, 2011-11-01
+---------------------------------
+- by davereid: rowCount does not work on sqlite
+`);
+  assert.equal(releases.length, 2);
+  assert.equal(releases[0].version, 'Menu Position 7.x-1.1');
+  assert.equal(releases[0].date, '2012-02-22');
+  assert.equal(releases[1].date, '2011-11-01');
+});
+
+test('a prefix on the entry beats the section it sits under', () => {
+  // These files disagree with themselves in practice — a `fix:` often lives under `### Added` —
+  // and the prefix is the more specific statement.
+  const [rel] = parseChangelog(`## [1.0.0] - 2026-01-01
+### Added
+- fix: [#1](https://example.com) this is really a fix
+- feat: and this is really a feature
+`);
+  assert.deepEqual(rel.entries.map((e) => e.kind), ['Fixed', 'Added']);
+  // The prefix is consumed, not left in the text.
+  assert.ok(!rel.entries[0].text.startsWith('fix:'), rel.entries[0].text);
+});
+
+test('a hard-wrapped entry is one entry, not four', () => {
+  const [rel] = parseChangelog(`## [1.0.0] - 2026-01-01
+### Fixed
+- fix: a finding that runs
+  across three
+  separate lines
+`);
+  assert.equal(rel.entries.length, 1);
+  assert.match(rel.entries[0].text, /runs across three separate lines/);
+});
+
+test('the Webship shape: a release is grouped by package', () => {
+  const [rel] = parseChangelog(`# 11.0.0
+### At a glance
+* The suite reaches its first stable release.
+
+#### Website Starter 1.0.1
+- fix: something in the starter
+
+#### Website Starter 1.0.1
+- feat: something in website_starter
+`);
+  assert.equal(rel.version, '11.0.0');
+  assert.deepEqual(rel.entries.map((e) => e.group),
+    ['At a glance', 'Website Starter 1.0.1', 'Website Starter 1.0.1']);
+});
+
+test('markdown is kept, because the reader must not show less than the file', () => {
+  const [rel] = parseChangelog(`## [1.0.0] - 2026-01-01
+- fix: [#3622817](https://www.drupal.org/i/3622817) a thing in \`config/optional\`
+`);
+  assert.match(rel.entries[0].text, /\[#3622817\]\(https:\/\/www\.drupal\.org\/i\/3622817\)/);
+  assert.match(rel.entries[0].text, /`config\/optional`/);
+});
+
+/* ---------------- the small pieces ---------------- */
+
+test('a kind maps to a label and a UIkit tone, whichever vocabulary it is written in', () => {
+  assert.deepEqual(kindOf('Added'), { label: 'Added', tone: 'success' });
+  assert.deepEqual(kindOf('feat'), { label: 'Added', tone: 'success' });
+  assert.deepEqual(kindOf('fix'), { label: 'Fixed', tone: 'danger' });
+  assert.deepEqual(kindOf('Security'), { label: 'Security', tone: 'danger' });
+  assert.equal(kindOf('At a glance'), null, 'prose is not a kind');
+  assert.equal(kindOf(''), null);
+});
+
+test('a heading is a version or it is prose', () => {
+  for (const v of ['1.0.3', '11.0.0-rc1', '8.x-1.1', 'Unreleased', 'v2.3']) {
+    assert.ok(looksLikeVersion(v), `${v} is a version`);
+  }
+  for (const p of ['At a glance', 'Changelog', 'Stability of Webship 11.0.0', 'Added']) {
+    assert.ok(!looksLikeVersion(p), `${p} is not a version`);
+  }
+});
+
+test('an empty file, and a file of nothing but prose, are no releases rather than a crash', () => {
+  assert.deepEqual(parseChangelog(''), []);
+  assert.deepEqual(parseChangelog('# Changelog\n\nAll notable changes are documented here.\n'), []);
+});
+
+/* ---------------- against the real tree ---------------- */
+
+test('a changelog anywhere in the tree is found, not only in products/', () => {
+  const found = listChangelogs();
+  assert.ok(found.length > 0, 'nothing in the tree keeps a changelog');
+  for (const c of found) {
+    assert.match(c.file, /^CHANGELOG\.(md|txt)$/i);
+    assert.ok(c.bytes > 0);
+    assert.ok(c.workspace, 'every entry names the workspace it was found in');
+  }
+  // The point of the change: it is a walk of every workspace, not a list of one.
+  const workspaces = new Set(found.map((c) => c.workspace));
+  assert.ok(workspaces.size > 1,
+    `only ${[...workspaces]} was walked — a built site in dev/ keeps one too`);
+});
+
+test('a name that climbs out of its workspace is refused', () => {
+  for (const bad of ['../etc', '..', 'a/b', 'no-such-item-here']) {
+    assert.equal(changelogFor('products', bad), null, `products/${bad} should not resolve`);
+    assert.equal(releasesFor('products', bad), null);
+  }
+  // And a workspace that is not one.
+  assert.equal(changelogFor('../../etc', 'passwd'), null);
+  assert.equal(changelogFor('no-such-workspace', 'x'), null);
+});
+
+test('the index summarises everything without throwing on any of it', () => {
+  const rows = changelogIndex();
+  assert.equal(rows.length, listChangelogs().length);
+  for (const r of rows) {
+    assert.equal(typeof r.releases, 'number');
+    assert.equal(typeof r.entries, 'number');
+    assert.ok(r.workspace);
+    // The newest release is the first in the file, never "Unreleased" — a version people can install.
+    assert.ok(!/^unreleased$/i.test(r.latest), `${r.label} reports Unreleased as its latest`);
+  }
+});

package/core/workspace-app/tests/unit/chat-thread.test.js

@@ -0,0 +1,92 @@
+/**
+ * The assistant's thread: what keeps one conversation across pages.
+ *
+ * The two things that can quietly break it are both checked here. The id must travel in a cookie
+ * scoped to the HUB domain — localStorage, or a cookie on the page's own host, would make /dev and
+ * /test two different conversations, which is the bug this exists to fix. And the thread must carry
+ * claude's session id, because a transcript redrawn in front of an agent that remembers none of it
+ * reads as memory and is not.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const path = require('path');
+
+const app = path.join(__dirname, '..', '..');
+const chats = require(path.join(app, 'chat-threads'));
+const { hubDomain } = require(path.join(app, 'workspaces'));
+
+const withCookie = (id) => ({ headers: { cookie: `ws-per=50; ws-chat=${id}; ws-theme=dark` } });
+
+test('the id comes from the cookie, and only in our own shape', () => {
+  const id = chats.newId();
+  assert.match(id, /^[a-f0-9]{32}$/);
+  assert.strictEqual(chats.threadIdFrom(withCookie(id)), id);
+  assert.strictEqual(chats.threadIdFrom({ headers: {} }), null);
+  // The id names a file, so anything that is not the shape we write is not read back.
+  for (const bad of ['../../etc/passwd', 'a'.repeat(31), 'A'.repeat(32), '']) {
+    assert.strictEqual(chats.threadIdFrom(withCookie(bad)), null, `${bad} was accepted`);
+  }
+});
+
+test('the cookie is scoped to the hub domain, so every workspace subdomain is one conversation', () => {
+  const c = chats.threadCookie(chats.newId());
+  assert.match(c, new RegExp(`Domain=\\.${hubDomain().replace(/\./g, '\\.')}`), 'not scoped to the hub');
+  assert.match(c, /Path=\//);
+  assert.match(c, /SameSite=Lax/);
+  // No Max-Age on purpose: the conversation belongs to this browsing session.
+  assert.ok(!/Max-Age/.test(c), 'the chat cookie must not outlive the browser');
+});
+
+test('a thread keeps the turns and the claude session, and reads back the same', () => {
+  let t = chats.loadThread(withCookie(chats.newId()));
+  assert.deepEqual(t.turns, []);
+  assert.strictEqual(t.sessionId, null);
+  t = chats.appendTurn(t, { role: 'user', text: 'what is running?' });
+  t = chats.appendTurn({ ...t, sessionId: 'abc-123' }, { role: 'ai', html: '<p>Two projects.</p>' });
+  try {
+    const back = chats.readThread(t.id);
+    assert.strictEqual(back.sessionId, 'abc-123', 'the session to resume must survive');
+    assert.deepEqual(chats.historyFor(back), [
+      { role: 'user', text: 'what is running?' },
+      { role: 'ai', html: '<p>Two projects.</p>' },
+    ], 'the history must be deep-chat’s own shape');
+    // Written 0600: it is a chat log, and it says so on disk.
+    assert.strictEqual(fs.statSync(path.join(chats.DIR, `${t.id}.json`)).mode & 0o777, 0o600);
+  } finally {
+    chats.clearThread(t.id);
+  }
+  assert.strictEqual(chats.readThread(t.id), null, 'clearing must remove the file');
+});
+
+test('a long conversation is trimmed from the front, not refused', () => {
+  let t = chats.loadThread({ headers: {} });
+  for (let i = 0; i < chats.MAX_TURNS + 10; i += 1) t = chats.appendTurn(t, { role: 'user', text: `turn ${i}` });
+  try {
+    assert.strictEqual(t.turns.length, chats.MAX_TURNS);
+    assert.strictEqual(t.turns[t.turns.length - 1].text, `turn ${chats.MAX_TURNS + 9}`, 'the newest turn must be kept');
+  } finally {
+    chats.clearThread(t.id);
+  }
+});
+
+test('the assistant resumes its session instead of starting over', () => {
+  const src = fs.readFileSync(path.join(app, 'assistant.js'), 'utf8');
+  assert.ok(!/'--no-session-persistence'/.test(src),
+    'that flag is what threw the conversation away; it must not come back');
+  assert.match(src, /'--session-id'/, 'the first turn names the session');
+  assert.match(src, /'--resume'/, 'every later turn resumes it');
+  assert.match(src, /if \(parsed\.session_id\) newSessionId/, 'what to resume next is read back from the run');
+  assert.match(src, /if \(sessionId && result\.code !== 0\)/,
+    'a session that is gone must still answer the question, on a fresh one');
+});
+
+test('the chat store is never committed and never synced', () => {
+  const ignore = fs.readFileSync(path.join(app, '..', '..', '.gitignore'), 'utf8');
+  assert.match(ignore, /core\/workspace-app\/\.chats\//, 'the chat log must be gitignored');
+  for (const f of ['scripts/update.sh', path.join('..', 'scripts', 'sync-tooling.sh')]) {
+    const sh = fs.readFileSync(path.join(app, f), 'utf8');
+    assert.match(sh, /--exclude=\.chats/, `${f} would overwrite the conversations`);
+  }
+});