@webship.co/workspace 1.0.0-alpha1 → 1.0.0-beta2

package/core/workspace-app/tests/unit/checks-plan.test.js

@@ -0,0 +1,205 @@
+/**
+ * The checks resolver: what a package declares, and which of it is safe to run.
+ *
+ * This is the one place the alias map lives — the shell verb shells out to it and the dashboard
+ * requires it — so it is the one place worth testing hard. Every case here is a real shape found in
+ * this workspace, named in the comment, because a rule invented for a package that does not exist is
+ * a rule nobody can check.
+ *
+ * Fixtures are written to a temp directory: the resolver reads package.json, the lockfiles and
+ * node_modules from disk, and stubbing fs would test the stub.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+// Reached through WORKSPACE_ROOT rather than by counting ../ : the dashboard is bind-mounted at
+// /var/www/html inside its container, where a relative path out of the app leaves the mount
+// altogether. The app itself resolves the resolver the same way, in checks.js.
+const { ROOT } = require('../../workspaces');
+const {
+  resolvePlan, resolveRunner, resolveDeps, MASK, DENY_COMMAND, E2E_OK,
+} = require(path.join(ROOT, 'core', 'scripts', 'libs', 'checks_plan'));
+
+// A package on disk. `installed` fakes node_modules/.bin, which is what "runnable" means.
+function pkg(scripts, { installed = true, lock = 'yarn.lock', packageManager = null, extra = {} } = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-checks-'));
+  const json = { name: 'fixture', scripts };
+  if (packageManager) json.packageManager = packageManager;
+  fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify(json));
+  if (lock) fs.writeFileSync(path.join(dir, lock), '');
+  if (installed) fs.mkdirSync(path.join(dir, 'node_modules', '.bin'), { recursive: true });
+  for (const [rel, body] of Object.entries(extra)) {
+    fs.mkdirSync(path.join(dir, path.dirname(rel)), { recursive: true });
+    fs.writeFileSync(path.join(dir, rel), body);
+  }
+  return dir;
+}
+
+const row = (plan, id) => plan.rows.find((r) => r.id === id);
+
+test('a package is read in its own vocabulary, whatever it calls things', () => {
+  // themes/vartheme_bs5 and 21 products carry exactly this set.
+  const plan = resolvePlan(pkg({
+    'lint:js': 'eslint .', 'lint:css': 'stylelint "**/*.css"', 'lint:yaml': 'eslint --ext .yml .',
+    spellcheck: 'cspell lint .',
+  }));
+  assert.equal(row(plan, 'js').status, 'ready');
+  assert.equal(row(plan, 'js').script, 'lint:js');
+  assert.equal(row(plan, 'css').status, 'ready');
+  assert.equal(row(plan, 'yaml').status, 'ready');
+  assert.equal(row(plan, 'spelling').script, 'spellcheck');
+  // And says plainly what it does not cover.
+  assert.equal(row(plan, 'types').status, 'none');
+  assert.equal(row(plan, 'types').reason, 'not declared');
+});
+
+test('a package that spells them differently resolves to the same checks', () => {
+  // modules/canvas: lint:eslint / lint:stylelint / lint:cspell / lint:tsc / lint:prettier.
+  const plan = resolvePlan(pkg({
+    'lint:eslint': 'eslint src', 'lint:stylelint': 'stylelint "src/**/*.css"',
+    'lint:cspell': 'cspell .', 'lint:tsc': 'tsc --noEmit', 'lint:prettier': 'prettier --check .',
+  }));
+  for (const id of ['js', 'css', 'spelling', 'types', 'format']) {
+    assert.equal(row(plan, id).status, 'ready', `${id} should resolve`);
+  }
+});
+
+test('an aggregate does not run beside the parts it fans out to', () => {
+  // modules/canvas declares `lint` (concurrently) AND every part. Running both is double the work.
+  const plan = resolvePlan(pkg({ lint: 'concurrently "yarn lint:js" "yarn lint:css"', 'lint:js': 'eslint .', 'lint:css': 'stylelint "*.css"' }));
+  assert.ok(!plan.rows.some((r) => r.id === 'lint'), 'the aggregate row is dropped');
+  assert.equal(row(plan, 'js').status, 'ready');
+});
+
+test('an aggregate IS used when a package declares nothing else', () => {
+  const plan = resolvePlan(pkg({ lint: 'eslint . && stylelint "*.css"' }));
+  const agg = plan.rows.find((r) => r.id === 'lint');
+  assert.ok(agg, 'the aggregate row is emitted');
+  assert.equal(agg.status, 'ready');
+});
+
+test('a masked script fails the run rather than passing quietly', () => {
+  // modules/commerce_cart_flyout masks three of its lint scripts exactly like this.
+  const plan = resolvePlan(pkg({ 'lint:css': 'stylelint "**/*.css" || exit 0' }));
+  assert.equal(row(plan, 'css').status, 'masked');
+  assert.match(row(plan, 'css').reason, /would be a lie/);
+  assert.ok(MASK.test('foo || true'), 'and || true is the same lie');
+});
+
+test('a script that writes is refused, however it is named', () => {
+  // modules/gin_lb calls its writer `lint-all`; themes/vartheme_bs5 ends theme:build with --fix.
+  const byName = resolvePlan(pkg({ 'lint:js': 'eslint "src/**/*.js" --fix' }));
+  assert.equal(row(byName, 'js').status, 'refused');
+  assert.match(row(byName, 'js').reason, /--fix/);
+  assert.ok(DENY_COMMAND.test('prettier --write .'));
+  assert.ok(DENY_COMMAND.test('nodemon server.js'));
+  assert.ok(DENY_COMMAND.test('lint-staged'));
+});
+
+test('a stylelint call that names no files is refused, because it checks nothing', () => {
+  // 21 of the 45 lint:css declarations in this tree are this shape.
+  const plan = resolvePlan(pkg({ 'lint:css': 'stylelint --config=.stylelintrc.json' }));
+  assert.equal(row(plan, 'css').status, 'refused');
+  assert.match(row(plan, 'css').reason, /names no files/);
+  // With a glob it is fine.
+  assert.equal(row(resolvePlan(pkg({ 'lint:css': 'stylelint --config=.stylelintrc.json "**/*.css"' })), 'css').status, 'ready');
+});
+
+test('the browser suite is off unless asked for, and never on a package', () => {
+  const scripts = { 'test:chromium': 'BROWSER=chromium cucumber-js --config cucumber.js' };
+  const off = resolvePlan(pkg(scripts));
+  assert.equal(off.rows.find((r) => r.id === 'e2e').status, 'none');
+  assert.match(off.rows.find((r) => r.id === 'e2e').reason, /add --e2e/);
+
+  const onPackage = resolvePlan(pkg(scripts), { e2e: true });
+  assert.equal(row(onPackage, 'e2e').status, 'refused');
+  assert.match(row(onPackage, 'e2e').reason, /no site to test against/);
+
+  const onSite = resolvePlan(pkg(scripts, { extra: { '.ddev/config.yaml': 'name: x\n' } }), { e2e: true });
+  assert.equal(row(onSite, 'e2e').status, 'ready');
+});
+
+test('a test script that is not a browser suite is not treated as one', () => {
+  // products/bootstrap_styles: `test` is a build. Running it as a suite would be wrong twice over.
+  const plan = resolvePlan(pkg({ test: 'npm run build && node scripts/check.js' }), { e2e: true });
+  assert.equal(row(plan, 'e2e').status, 'none');
+  assert.ok(E2E_OK.test('cucumber-js --config cucumber.js'));
+  assert.ok(E2E_OK.test('playwright test'));
+  assert.ok(!E2E_OK.test('jest'));
+});
+
+test('phpcs is skipped, never reported green, when the binary is not there', () => {
+  // 76 packages declare phpcs; the binary is a composer one and lives in a site, not in node_modules.
+  const without = resolvePlan(pkg({ phpcs: 'phpcs --standard=./.phpcs.xml .' }));
+  assert.equal(row(without, 'php').status, 'skipped');
+  assert.match(row(without, 'php').reason, /no vendor\/bin\/phpcs/);
+
+  const with_ = resolvePlan(pkg({ phpcs: 'phpcs .' }, { extra: { 'vendor/bin/phpcs': '#!/bin/sh\n' } }));
+  assert.equal(row(with_, 'php').status, 'ready');
+});
+
+test('a site carrying the ddev-dev-tools add-on gets php and twig from it', () => {
+  const dir = pkg({}, { extra: {
+    '.ddev/config.yaml': 'name: x\n',
+    '.ddev/commands/web/dev-phpcs': '#!/bin/bash\n',
+  } });
+  const plan = resolvePlan(dir);
+  assert.equal(row(plan, 'php').status, 'ready');
+  assert.equal(row(plan, 'php').command, 'ddev dev-phpcs --all');
+  assert.equal(row(plan, 'twig').command, 'ddev dev-twigcs --all');
+});
+
+test('the package manager is chosen from what the package says, and says why', () => {
+  assert.deepEqual(resolveRunner(pkg({}, { lock: 'yarn.lock' })), { runner: 'yarn', reason: 'yarn.lock' });
+  assert.deepEqual(resolveRunner(pkg({}, { lock: 'package-lock.json' })), { runner: 'npm', reason: 'package-lock.json' });
+  const berry = resolveRunner(pkg({}, { lock: null, packageManager: 'yarn@4.9.3' }));
+  assert.equal(berry.runner, 'yarn');
+  assert.match(berry.reason, /yarn@4\.9\.3/);
+  const none = resolveRunner(pkg({}, { lock: null }));
+  assert.equal(none.runner, null);
+  assert.match(none.reason, /pass --runner/);
+});
+
+test('a stale .pnp.cjs is not an installed package', () => {
+  // products/webship_core: a PnP file left over beside a .yarnrc.yml that now asks for node-modules.
+  // Believing it made every check fail with "Couldn't find the node_modules state file".
+  const stale = pkg({ 'lint:yaml': 'eslint --ext .yml .' }, {
+    installed: false, extra: { '.pnp.cjs': '// old', '.yarnrc.yml': 'nodeLinker: node-modules\n' },
+  });
+  assert.equal(resolveDeps(stale).installed, false);
+  assert.match(resolveDeps(stale).evidence, /stale/);
+  assert.equal(row(resolvePlan(stale), 'yaml').status, 'deps-missing');
+
+  // Real PnP, with no nodeLinker override, is runnable and has no node_modules at all.
+  const pnp = pkg({}, { installed: false, extra: { '.pnp.cjs': '// real' } });
+  assert.equal(resolveDeps(pnp).installed, true);
+});
+
+test('--only and --skip narrow the run without hiding what exists', () => {
+  const scripts = { 'lint:js': 'eslint .', 'lint:css': 'stylelint "*.css"', 'lint:yaml': 'eslint --ext .yml .' };
+  const only = resolvePlan(pkg(scripts), { only: 'js' });
+  assert.equal(row(only, 'js').status, 'ready');
+  assert.equal(row(only, 'css').status, 'none');
+  assert.match(row(only, 'css').reason, /not in --only/);
+
+  const skip = resolvePlan(pkg(scripts), { skip: 'css' });
+  assert.equal(row(skip, 'js').status, 'ready');
+  assert.equal(row(skip, 'css').status, 'skipped');
+});
+
+test('every row is always reported, so a gap is visible rather than absent', () => {
+  const plan = resolvePlan(pkg({ 'lint:js': 'eslint .' }));
+  assert.deepEqual(plan.rows.map((r) => r.id),
+    ['format', 'js', 'css', 'yaml', 'spelling', 'types', 'php', 'twig', 'e2e']);
+});
+
+test('a directory with no package.json is not an error, it is a package with nothing to run', () => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-checks-'));
+  const plan = resolvePlan(dir);
+  assert.equal(plan.hasPackageJson, false);
+  assert.ok(plan.rows.every((r) => r.status === 'none'));
+});

package/core/workspace-app/tests/unit/claude-args.test.js

@@ -0,0 +1,182 @@
+/**
+ * The Claude Code arguments the New screen form offers, read from `claude --help`.
+ *
+ * The form used to carry a permission-mode select and one free-text box called "more claude options",
+ * which meant knowing the flags by heart and typing them with no check at all until the screen either
+ * started or died. The CLI documents every one of them, so the list is PARSED rather than kept here by
+ * hand — the same reason the icon chooser parses the vendored sprite and builder-args.js reads a
+ * builder's own argparse block.
+ *
+ * Parsed against a fixture of the real help text, so these tests do not need claude on the machine and
+ * do not change meaning when it is updated.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+
+const ca = require('../../claude-args');
+
+// The two-column shape `claude --help` prints: flags, a wide gap, then a description that wraps — and
+// that starts on the next line when the flags are too long for the column.
+const HELP = `Usage: claude [options] [command] [prompt]
+
+Options:
+  --add-dir <directories...>            Additional directories to allow tool
+                                        access to
+  --agent <agent>                       Agent for the current session. Overrides
+                                        the 'agent' setting.
+  --allowedTools, --allowed-tools <tools...>
+      Comma or space-separated list of tool names to allow (e.g. "Bash(git *)
+      Edit")
+  --autocompact <auto|tokens>           Auto-compact window size (auto, or
+                                        100k-1M tokens)
+  --bg, --background                    Start the session in the background and
+                                        return immediately
+  -c, --continue                        Continue the most recent conversation in
+                                        the current directory
+  --debug [filter]                      Enable debug mode with optional category
+                                        filtering
+  --max-budget-usd <amount>             Maximum dollar amount to spend on API
+                                        calls (only works with --print)
+  --model <model>                       Model for the current session
+  --output-format <format>              Output format (only works with --print):
+                                        "text" (default) (choices: "text",
+                                        "json")
+  --permission-mode <mode>              Permission mode to use for the session
+                                        (choices: "acceptEdits", "auto",
+                                        "bypassPermissions", "plan")
+  -p, --print                           Print response and exit
+  --prompt-suggestions [value]          Enable prompt suggestions (choices:
+                                        "true", "false", preset: "true")
+  -r, --resume [value]                  Resume a conversation by session ID
+  --verbose                             Override verbose mode setting from config
+  -v, --version                         Output the version number
+
+Commands:
+  doctor                                Check the health of your installation
+`;
+
+const parsed = ca.parseOptions(HELP);
+const by = (name) => parsed.find((o) => o.name === name);
+
+test('the two columns are told apart, wrapped description and all', () => {
+  assert.strictEqual(by('--model').description, 'Model for the current session');
+  assert.strictEqual(by('--add-dir').description, 'Additional directories to allow tool access to',
+    'a description that wraps is one description, not two options');
+  assert.strictEqual(by('--allowed-tools').description,
+    'Comma or space-separated list of tool names to allow (e.g. "Bash(git *) Edit")',
+    'and one that starts on the line below still belongs to the flags above it');
+});
+
+test('a flag says what it takes, and whether it repeats', () => {
+  assert.strictEqual(by('--verbose').takes, 'none');
+  assert.strictEqual(by('--model').takes, 'required');
+  assert.strictEqual(by('--debug').takes, 'optional');
+  assert.strictEqual(by('--add-dir').repeatable, true, '<directories...> is a list');
+  assert.strictEqual(by('--model').repeatable, false);
+  assert.strictEqual(by('--add-dir').placeholder, 'directories');
+});
+
+test('aliases are kept, and the long one is the name', () => {
+  assert.deepStrictEqual(by('--allowed-tools').flags, ['--allowedTools', '--allowed-tools']);
+  assert.deepStrictEqual(by('--continue').flags, ['-c', '--continue']);
+});
+
+test('only what the CLI calls a choice is a choice', () => {
+  assert.deepStrictEqual(by('--permission-mode').choices, ['acceptEdits', 'auto', 'bypassPermissions', 'plan']);
+  assert.deepStrictEqual(by('--prompt-suggestions').choices, ['true', 'false'],
+    'the preset: inside the same parenthesis is not one of them');
+  assert.deepStrictEqual(by('--autocompact').choices, [],
+    '<auto|tokens> is the SHAPE of the value ("auto, or 100k-1M tokens") — a select there would refuse 200k');
+  assert.strictEqual(by('--autocompact').placeholder, 'auto|tokens', 'it is a placeholder instead');
+});
+
+test('what only works with --print is not offered: a screen IS the interactive session', () => {
+  const offered = parsed.filter(ca.usableOnAScreen).map((o) => o.name);
+  assert.ok(!offered.includes('--max-budget-usd'));
+  assert.ok(!offered.includes('--output-format'));
+  assert.ok(!offered.includes('--print'));
+});
+
+test('what starts the session somewhere else is not offered either', () => {
+  const offered = parsed.filter(ca.usableOnAScreen).map((o) => o.name);
+  assert.ok(!offered.includes('--background'), 'it returns immediately, so the screen would hold nothing');
+  assert.ok(!offered.includes('--version'));
+  for (const name of Object.keys(ca.WITHHELD)) {
+    assert.ok(ca.WITHHELD[name].length > 10, `${name} says WHY it is held back, so the decision can be argued with`);
+  }
+});
+
+test('what the form already asks about is not asked twice', () => {
+  const offered = parsed.filter(ca.usableOnAScreen).map((o) => o.name);
+  assert.ok(!offered.includes('--resume'), 'the Resume row asks this, and checks the id against that directory');
+  assert.ok(!offered.includes('--continue'));
+});
+
+test('everything else IS offered, including a flag added after this was written', () => {
+  const offered = parsed.filter(ca.usableOnAScreen).map((o) => o.name);
+  assert.deepStrictEqual(offered.sort(), ['--add-dir', '--agent', '--allowed-tools', '--autocompact',
+    '--debug', '--model', '--permission-mode', '--prompt-suggestions', '--verbose'].sort());
+});
+
+test('a field name cannot collide with the form own fields', () => {
+  assert.strictEqual(ca.fieldName('--add-dir'), 'arg_add_dir');
+  assert.strictEqual(ca.fieldName('--permission-mode'), 'arg_permission_mode');
+  for (const own of ['session', 'target', 'workspace', 'kind', 'command', 'resume', 'resume_on']) {
+    assert.notStrictEqual(ca.fieldName(`--${own}`), own);
+  }
+});
+
+test('a submitted form becomes shell words, in the order the CLI printed them', () => {
+  const { words, problems } = ca.flagsFromForm(parsed.filter(ca.usableOnAScreen), {
+    arg_model: 'opus', arg_permission_mode: 'bypassPermissions', arg_verbose: '1',
+  });
+  assert.deepStrictEqual(problems, []);
+  assert.deepStrictEqual(words, ['--model', 'opus', '--permission-mode', 'bypassPermissions', '--verbose']);
+});
+
+test('a repeatable flag takes its words one at a time, not as one argument', () => {
+  const { words } = ca.flagsFromForm(parsed.filter(ca.usableOnAScreen), { arg_add_dir: '../shared ../other' });
+  assert.deepStrictEqual(words, ['--add-dir', '../shared', '../other']);
+});
+
+test('an empty field asks for nothing', () => {
+  const { words } = ca.flagsFromForm(parsed.filter(ca.usableOnAScreen), { arg_model: '', arg_agent: '   ' });
+  assert.deepStrictEqual(words, []);
+});
+
+test('a value off the choice list is refused BY NAME, not dropped', () => {
+  const { words, problems } = ca.flagsFromForm(parsed.filter(ca.usableOnAScreen), { arg_permission_mode: 'whatever' });
+  assert.deepStrictEqual(words, []);
+  assert.match(problems[0], /--permission-mode does not take/);
+});
+
+test('nothing a shell would read reaches the command line', () => {
+  for (const bad of ['opus; rm -rf /', 'opus && curl x', '$(whoami)', '`id`', 'a\nb', "it's", 'x|y', 'a>b']) {
+    const { words, problems } = ca.flagsFromForm(parsed.filter(ca.usableOnAScreen), { arg_model: bad });
+    assert.deepStrictEqual(words, [], `refused: ${JSON.stringify(bad)}`);
+    assert.strictEqual(problems.length, 1, `and said so: ${JSON.stringify(bad)}`);
+  }
+  // The shapes a real value takes are all allowed.
+  for (const good of ['opus', 'claude-fable-5', '../shared', 'Bash,Edit,Read', 'user,project', 'a@b.example']) {
+    const { problems } = ca.flagsFromForm(parsed.filter(ca.usableOnAScreen), { arg_model: good });
+    assert.deepStrictEqual(problems, [], `allowed: ${good}`);
+  }
+});
+
+test('a field naming no option of this CLI is ignored, not passed through', () => {
+  const { words } = ca.flagsFromForm(parsed.filter(ca.usableOnAScreen), { arg_made_up: 'x', options: '--whatever' });
+  assert.deepStrictEqual(words, []);
+});
+
+test('the four asked about every time are asked about first', () => {
+  assert.deepStrictEqual(ca.COMMON, ['--model', '--permission-mode', '--effort', '--agent']);
+});
+
+test('help that says nothing is an error, not an empty list of options', async () => {
+  ca.forget();
+  const { options, error } = await ca.claudeOptions();
+  // On a machine with claude installed this reads the real help; on one without, it is the error path.
+  // Either is correct — what must never happen is an empty list reported as success.
+  assert.ok(error ? options.length === 0 : options.length > 0);
+});

package/core/workspace-app/tests/unit/claude-code-here.test.js

@@ -0,0 +1,15 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const path = require('path');
+
+const server = fs.readFileSync(path.join(__dirname, '..', '..', 'server.js'), 'utf8');
+
+test('the SCREENS menu offers Claude Code in the same folder, beside New screen here', () => {
+  assert.match(server, /screen-new-form\?workspace=\$\{encodeURIComponent\(sm\[1\]\)\}&project=\$\{encodeURIComponent\(sm\[2\]\)\}&kind=claude/);
+  assert.match(server, /Claude Code here…/);
+});
+
+test('the New screen form opens on Claude Code when asked, keeping the place it was opened for', () => {
+  assert.match(server, /if \(q\.get\('kind'\) === 'claude'\) pre = \{ \.\.\.\(pre \|\| \{\}\), kind: 'claude' \};/);
+});

package/core/workspace-app/tests/unit/claude-resume.test.js

@@ -0,0 +1,147 @@
+/**
+ * Resuming a Claude Code session in a screen.
+ *
+ * A screen that dies — the machine reboots, the terminal closes, `screen -wipe` takes a dead one — does
+ * not take the conversation with it: the CLI keeps every session's transcript under
+ * ~/.claude/projects/<the directory, slashes turned into dashes>/<session id>.jsonl, and
+ * `claude --resume <id>` from that directory picks it back up.
+ *
+ * The thing that cost a screen to find: what is on disk is TWO things, and only one can be resumed.
+ * `<id>.jsonl` is the transcript, and `<id>/` is that session's tool results and subagents — which
+ * exists on its own for a session whose transcript was never written. Offering one of those gave a
+ * screen that answered "No conversation found with session ID" and died in the same second, which from
+ * the dashboard looks exactly like the feature being broken.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const home = fs.mkdtempSync(path.join(os.tmpdir(), 'claude-home-'));
+const realHome = os.homedir;
+os.homedir = () => home;
+process.on('exit', () => { os.homedir = realHome; fs.rmSync(home, { recursive: true, force: true }); });
+
+const cs = require('../../claude-sessions');
+
+const DIR = '/home/someone/workspace/dev/ha1x00b1';
+const SLUG = '-home-someone-workspace-dev-ha1x00b1';
+const projectDir = path.join(home, '.claude', 'projects', SLUG);
+fs.mkdirSync(projectDir, { recursive: true });
+
+const id = (n) => `${'0'.repeat(8 - String(n).length)}${n}-10da-41df-b92f-51c00661b38c`;
+const transcript = (n, lines) => fs.writeFileSync(path.join(projectDir, `${id(n)}.jsonl`), lines);
+const userLine = (text) => `${JSON.stringify({ type: 'user', message: { role: 'user', content: text } })}\n`;
+
+test("the CLI's own name for a directory is the absolute path with every slash turned into a dash", () => {
+  assert.strictEqual(cs.projectSlug(DIR), SLUG);
+  assert.strictEqual(cs.projectSlug('/home/someone/workspace/dev/ha1x00b1/'), SLUG, 'a trailing slash is the same directory');
+  assert.strictEqual(cs.projectDirFor(DIR), projectDir);
+});
+
+test('a session id is the uuid --resume takes, and nothing else is handed to a shell', () => {
+  assert.ok(cs.isSessionId('cc9ce3fd-10da-41df-b92f-51c00661b38c'));
+  assert.ok(cs.isSessionId('CC9CE3FD-10DA-41DF-B92F-51C00661B38C'), 'the CLI writes them lowercase but reads either');
+  assert.ok(!cs.isSessionId('cc9ce3fd'));
+  assert.ok(!cs.isSessionId('$(rm -rf ~)'));
+  assert.ok(!cs.isSessionId('../../../etc/passwd'));
+  assert.ok(!cs.isSessionId(''));
+});
+
+test('a directory with no history at all lists nothing, rather than failing', () => {
+  assert.deepStrictEqual(cs.sessionsFor('/home/someone/workspace/dev/never-used'), []);
+  assert.strictEqual(cs.hasSessions('/home/someone/workspace/dev/never-used'), false);
+});
+
+test('a transcript is resumable; a directory with no transcript is listed but never offered', () => {
+  transcript(1, userLine('build me a Webship 11 site'));
+  fs.mkdirSync(path.join(projectDir, id(2)), { recursive: true });   // tool results only: --resume finds nothing
+  fs.writeFileSync(path.join(projectDir, `${id(3)}.jsonl`), '');      // started and never got going
+
+  const all = cs.sessionsFor(DIR);
+  assert.deepStrictEqual(all.map((x) => x.id).sort(), [id(1), id(2), id(3)].sort(), 'all three are on disk');
+  assert.deepStrictEqual(all.filter((x) => x.resumable).map((x) => x.id), [id(1)]);
+
+  const offered = cs.sessionsFor(DIR, { resumableOnly: true });
+  assert.deepStrictEqual(offered.map((x) => x.id), [id(1)],
+    'an id --resume answers "No conversation found" for is a dead end, not a choice');
+  assert.strictEqual(cs.hasSessions(DIR), true);
+});
+
+test('the title is the first thing the person typed, so two sessions can be told apart', () => {
+  transcript(4, userLine('<system-reminder>a reminder</system-reminder> why does the install fail'));
+  const one = cs.sessionsFor(DIR).find((x) => x.id === id(4));
+  assert.strictEqual(one.title, 'a reminder why does the install fail',
+    'the first thing typed, with the markup around it stripped rather than shown');
+
+  transcript(5, `${JSON.stringify({ type: 'user', message: { content: [{ type: 'text', text: 'a list of parts' }] } })}\n`);
+  assert.strictEqual(cs.sessionsFor(DIR).find((x) => x.id === id(5)).title, 'a list of parts');
+
+  transcript(6, 'half a line with no closing brace');
+  assert.strictEqual(cs.sessionsFor(DIR).find((x) => x.id === id(6)).title, '', 'an unreadable head is no title, not a crash');
+});
+
+test('newest first, and limited: the one just left is the one being looked for', () => {
+  const now = Date.now();
+  for (const n of [1, 4, 5, 6]) {
+    const f = path.join(projectDir, `${id(n)}.jsonl`);
+    fs.utimesSync(f, new Date(now - n * 60000), new Date(now - n * 60000));
+  }
+  const list = cs.sessionsFor(DIR, { resumableOnly: true });
+  assert.deepStrictEqual(list.map((x) => x.id), [id(1), id(4), id(5), id(6)]);
+  assert.strictEqual(cs.sessionsFor(DIR, { limit: 2 }).length, 2);
+});
+
+test('the memory directory is not a session', () => {
+  fs.mkdirSync(path.join(projectDir, 'memory'), { recursive: true });
+  assert.ok(!cs.sessionsFor(DIR).some((x) => x.id === 'memory'));
+});
+
+/* ------------------------------------------------------------------ *
+ * What the form and the runner do with it
+ * ------------------------------------------------------------------ */
+
+const read = (f) => fs.readFileSync(path.join(__dirname, '..', '..', f), 'utf8');
+const screens = read('screens.js');
+const action = read('actions/screens.js');
+const server = read('server.js');
+
+test('only an id that is resumable IN THIS DIRECTORY reaches the command line', () => {
+  assert.match(action, /claudeSessions\.isSessionId\(wanted\)/, 'a uuid, so nothing else can be spliced in');
+  assert.match(action, /\.some\(\(x\) => x\.id === wanted\)/, "and one this directory actually has");
+  assert.match(action, /const wanted = form\.resume_on \? String\(form\.resume \|\| ''\)\.trim\(\) : '';/,
+    'a select left on its default must not resume a session nobody asked to resume');
+  assert.match(action, /const resumeFlag = resumable \? `--resume \$\{resumable\}` : '';/);
+});
+
+test('the screen runs claude in the project directory, and nothing else changes', () => {
+  assert.match(action, /exec claude \$\{resumeFlag\} \$\{flags\}/);
+  assert.match(action, /No Claude session <code>/, 'an id that cannot be resumed is refused, not silently dropped');
+});
+
+test('the list offers only what --resume can open, and says so when there is nothing', () => {
+  assert.match(screens, /resumableOnly: true/);
+  assert.match(screens, /No Claude session to resume in/);
+  assert.match(screens, /no transcript written yet, so <code>--resume<\/code> cannot open/,
+    'a session with no transcript is reported rather than quietly missing');
+});
+
+test('the select is disabled until the checkbox is ticked, and the newest is preselected', () => {
+  assert.match(screens, /type="checkbox" name="resume_on"/);
+  assert.match(screens, /<select class="uk-select uk-form-small" name="resume" disabled/);
+  assert.match(screens, /s\.disabled=!this\.checked;/);
+  assert.match(screens, /\$\{i === 0 \? ' selected' : ''\}/);
+});
+
+test('changing the project reloads the list, and that request does not close the modal', () => {
+  assert.match(screens, /hx-get="\/fragments\/claude-sessions"/);
+  // The place select asks for the list itself now, rather than the row listening for that select to
+  // change: the select is re-rendered whenever the workspace changes, and a listener on the row would
+  // have been listening for an element that is no longer the same one.
+  assert.match(screens, /hx-target="#claude-resume-row"/);
+  assert.match(screens, /hx-on::after:request="event\.stopPropagation\(\)"/,
+    "the form's own after:request hides the modal — this row's request must not reach it");
+  assert.match(server, /\/fragments\/claude-sessions/, 'and the route exists');
+});

package/core/workspace-app/tests/unit/claude-screen-options.test.js

@@ -0,0 +1,84 @@
+/**
+ * The New screen form, on Claude Code: the model, the effort and the agent as lists, and the form
+ * opening where it was opened FROM.
+ *
+ * The bug underneath this one is the second half. A project row's SCREENS → "New screen here…" passes
+ * the workspace and the project, but the form only honoured them when a Jira key came with them — so
+ * it opened at the workspace ROOT, and a session started from it ran in ~/workspace instead of the
+ * project it was asked for. Nothing said so: the place selects simply read `root`.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+
+const claudeArgs = require('../../claude-args');
+const server = fs.readFileSync(path.join(__dirname, '../../server.js'), 'utf8');
+const screens = fs.readFileSync(path.join(__dirname, '../../screens.js'), 'utf8');
+
+const HELP = `
+Options:
+  --model <model>                       Model for the current session. Provide
+                                        an alias for the latest model (e.g.
+                                        'fable', 'opus', or 'sonnet') or a
+                                        model's full name (e.g.
+                                        'claude-fable-5').
+  --effort <level>                      Effort level for the current session
+                                        (low, medium, high, xhigh, max)
+  --autocompact <auto|tokens>           When to compact (default: auto)
+  --agent <agent>                       Agent for the current session. Overrides
+                                        the 'agent' setting.
+Commands:
+`;
+
+// No guard around this: a test that can skip itself silently is a test that can stop testing without
+// anyone noticing.
+const opt = (name) => claudeArgs.parseOptions(HELP).find((o) => o.name === name);
+
+test('an option that enumerates its values in prose gets a closed list', () => {
+  // `--effort <level>  … (low, medium, high, xhigh, max)` — a closed list said in a sentence rather
+  // than in the `(choices: …)` the help generator emits.
+  const effort = opt('--effort');
+  assert.deepEqual(effort.choices, ['low', 'medium', 'high', 'xhigh', 'max']);
+});
+
+test('a shape hint is still not a list of choices', () => {
+  // `<auto|tokens>` means "auto, or a number of tokens". Reading it as choices would refuse 200k, and
+  // the comment in claude-args.js says so; the prose rule must not undo that.
+  const auto = opt('--autocompact');
+  assert.deepEqual(auto.choices, [], 'pipes in the value placeholder are not choices');
+  // Nor is a lone default or a pair — three or more bare words is the bar.
+  assert.ok(!auto.choices.includes('auto'));
+});
+
+test('the model offers what the help NAMES, and still takes anything', () => {
+  const model = opt('--model');
+  assert.deepEqual(model.choices, [], 'never a closed list');
+  assert.ok(model.suggestions.includes('opus') && model.suggestions.includes('sonnet'),
+    'the aliases the CLI itself gives as examples');
+  // A select here would refuse every model released after this help text was read.
+  assert.match(screens, /an OPEN list \(--model, --agent\) is an input with a datalist/);
+});
+
+test('the agents offered are the ones that exist, by their frontmatter name', () => {
+  const agents = claudeArgs.installedAgents();
+  assert.ok(Array.isArray(agents));
+  // A rules document in the same folder is not an agent: the CLI dispatches on a frontmatter `name`,
+  // and RULES.md has none. Blocklisting the docs by name would work until somebody added another.
+  assert.ok(!agents.includes('RULES'), 'prose in the agents folder is not an agent');
+  assert.match(require('fs').readFileSync(path.join(__dirname, '../../claude-args.js'), 'utf8'),
+    /if \(!\/\^---\\s\*\$\/m\.test/, 'frontmatter is what makes it an agent');
+});
+
+test('the four asked for every time are the four laid out first', () => {
+  assert.deepEqual(claudeArgs.COMMON, ['--model', '--permission-mode', '--effort', '--agent']);
+});
+
+test('the form opens on the project it was opened from', () => {
+  // Without this the whole feature is a session in the wrong directory, which is what it was.
+  assert.match(server, /if \(!pre\) \{[\s\S]{0,400}pre = \{ workspace: ws, target: `p:\$\{ws\}:\$\{proj\}` \}/);
+  assert.match(server, /pre = \{ workspace: ws, target: `ws:\$\{ws\}` \}/,
+    'a workspace with no project still opens on that workspace');
+  assert.match(server, /opened at the workspace ROOT/, 'and the reason is written down');
+});