@webship.co/workspace 1.0.0-alpha1 → 1.0.0-beta2

package/core/workspace-app/tests/unit/composer-menu.test.js

@@ -0,0 +1,187 @@
+/**
+ * The COMPOSER menu on a project row.
+ *
+ * What must never drift: it appears only where there is a composer.json; every command runs in a
+ * screen session through DDEV (`ddev composer`, or the dashboard's DDEV container), never a host
+ * composer; the handler runs only its tables, a real package name and a script the folder declares;
+ * a second click never stops a run that is still going; and COMPOSER sits right after SCREENS.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const composer = require('../../actions/composer');
+const { COMPOSER_RUN_ACTIONS, COMPOSER_PACKAGE_ACTIONS, SCRIPT_ROUTE, hasComposerJson, packageRefusal,
+  composerScripts, composerScreenCommand, sessionFinished } = composer;
+const { LINGER_MARK, lingerTail } = require('../../linger');
+// The GIT plugin's session line, for the comparison below: the same tail, the same no-prompt no-pager git.
+const gitScreenCommand = (label, args) => `GIT_TERMINAL_PROMPT=0 git --no-pager ${args.join(' ')}; ${lingerTail(label)}`;
+
+test('the menu offers install, update and the common commands, each with a handler', () => {
+  const labels = Object.values(COMPOSER_RUN_ACTIONS).map((a) => a.label);
+  for (const want of ['composer install', 'composer update', 'composer validate', 'composer outdated --direct', 'composer audit']) {
+    assert.ok(labels.includes(want), `missing: ${want}`);
+  }
+  for (const [route, act] of [...Object.entries(COMPOSER_RUN_ACTIONS), ...Object.entries(COMPOSER_PACKAGE_ACTIONS)]) {
+    assert.match(route, /^\/actions\/composer-[a-z-]+$/);
+    // Labels go into the session's closing echo, so they must stay shell-safe constants.
+    assert.match(act.label, /^[\w .()-]+$/, `label is not shell-safe: ${act.label}`);
+    assert.strictEqual(typeof composer[route], 'function', `${route} has no handler exported`);
+  }
+  assert.strictEqual(typeof composer[SCRIPT_ROUTE], 'function');
+});
+
+test('the everyday commands come first', () => {
+  const { COMPOSER_GROUPS } = composer;
+  assert.deepStrictEqual(COMPOSER_GROUPS, ['Daily', 'Inspect', 'Maintenance']);
+  const labels = Object.values(COMPOSER_RUN_ACTIONS).map((a) => a.label);
+  assert.deepStrictEqual(labels.slice(0, 4), ['composer install', 'composer update', 'composer outdated --direct', 'composer validate']);
+  // The groups follow the table's order, so a Daily entry can never sit below an Inspect one.
+  const order = Object.values(COMPOSER_RUN_ACTIONS).map((a) => COMPOSER_GROUPS.indexOf(a.group));
+  assert.ok(order.every((g) => g >= 0), 'every entry belongs to a shown group');
+  assert.deepStrictEqual(order, [...order].sort((x, y) => x - y), 'entries must be listed group by group, Daily first');
+  assert.deepStrictEqual(Object.values(COMPOSER_PACKAGE_ACTIONS).slice(0, 3).map((a) => a.button), ['require', 'update -W', 'remove']);
+});
+
+test('a command runs through DDEV, never a host composer, and stays open to be read', () => {
+  const act = COMPOSER_RUN_ACTIONS['/actions/composer-update'];
+  const ddev = composerScreenCommand(act.label, act.args, { isDdev: true, projectDir: '/home/u/workspace/dev/site1' });
+  assert.ok(ddev.startsWith('ddev composer --no-interaction --ansi update;'), ddev);
+  const plain = composerScreenCommand(act.label, act.args, { isDdev: false, projectDir: '/home/u/workspace/libraries/ace' });
+  assert.match(plain, /^cd '[^']+\/core\/workspace-app' && ddev exec -d '\/home\/u\/workspace\/libraries\/ace' composer --no-interaction --ansi update;/, plain);
+  for (const line of [ddev, plain]) {
+    assert.ok(!/(^|[;&|]\s*)composer\b/.test(line), `a bare host composer: ${line}`);
+    assert.ok(line.includes(LINGER_MARK), 'the session must wait to be read');
+    // The runner wraps this in an outer `bash -lc "…"`: any $ would be expanded there, too early.
+    assert.ok(!line.includes('$'), `a $ would be expanded by the runner's outer shell: ${line}`);
+  }
+  // The shared tail must not have changed what a git session runs.
+  assert.match(gitScreenCommand('git status', ['status']),
+    /^GIT_TERMINAL_PROMPT=0 git --no-pager status; echo; echo "git status finished\. Press Enter to close this session, or leave it: it closes by itself in 15 minutes\."; timeout --foreground 900 /);
+});
+
+test('a package must look like a package; only require takes a constraint', () => {
+  const req = COMPOSER_PACKAGE_ACTIONS['/actions/composer-require'];
+  const rm = COMPOSER_PACKAGE_ACTIONS['/actions/composer-remove'];
+  assert.strictEqual(packageRefusal('drupal/token', rm), '');
+  assert.strictEqual(packageRefusal('drupal/token:^1.15', req), '');
+  assert.strictEqual(packageRefusal('drupal/core-recommended:>=11.2 <11.4', req), '');
+  assert.notStrictEqual(packageRefusal('drupal/token:^1.15', rm), '', 'remove takes no constraint');
+  for (const bad of ['', 'token', 'Drupal/Token', "drupal/token'; rm -rf ~; '", 'drupal/token:$(id)', 'drupal/token:`id`', 'drupal/token;id', 'drupal/token:1\\2', 'drupal/token:"1"']) {
+    assert.notStrictEqual(packageRefusal(bad, req), '', `must be refused: ${bad}`);
+  }
+});
+
+test('custom scripts come from composer.json with their aliases; hooks and unsafe names do not', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'composermenu-'));
+  try {
+    fs.writeFileSync(path.join(tmp, 'composer.json'), JSON.stringify({
+      scripts: {
+        'post-update-cmd': ['@php -r "1;"'],
+        'pre-install-cmd': 'x',
+        'drupal-libraries-sync': 'node sync.js',
+        'phpcs:fix': 'phpcbf',
+        'bad name; id': 'x',
+      },
+      'scripts-aliases': { 'drupal-libraries-sync': ['dls', 'bad alias!'] },
+      'scripts-descriptions': { 'phpcs:fix': 'Fix coding standards' },
+    }));
+    assert.strictEqual(hasComposerJson(tmp), true);
+    const found = composerScripts(tmp);
+    assert.deepStrictEqual(found.map((s) => s.name), ['drupal-libraries-sync', 'phpcs:fix']);
+    assert.deepStrictEqual(found[0].aliases, ['dls']);
+    assert.strictEqual(found[1].description, 'Fix coding standards');
+    fs.writeFileSync(path.join(tmp, 'composer.json'), '{ not json');
+    assert.deepStrictEqual(composerScripts(tmp), []);
+    assert.strictEqual(hasComposerJson(path.join(tmp, 'missing')), false);
+  } finally { fs.rmSync(tmp, { recursive: true, force: true }); }
+});
+
+test('the handler refuses anything outside its tables, bad input, and a folder without composer.json', async () => {
+  const call = async (pathname, form) => {
+    const out = {};
+    await composer[SCRIPT_ROUTE]({ form, send: (html, code = 200) => { out.html = html; out.code = code; }, workspace: 'test', pathname });
+    return out;
+  };
+  let r = await call('/actions/composer-exec', { projectName: 'anything' });
+  assert.strictEqual(r.code, 404, 'a route outside the tables must not run');
+  r = await call('/actions/composer-install', { projectName: '../etc' });
+  assert.strictEqual(r.code, 400);
+  r = await call('/actions/composer-require', { projectName: 'anything', package: 'drupal/x; id' });
+  assert.strictEqual(r.code, 400);
+  assert.match(r.html, /not a package name/);
+  r = await call(SCRIPT_ROUTE, { projectName: 'anything', script: 'x; id' });
+  assert.strictEqual(r.code, 400);
+  r = await call('/actions/composer-install', { projectName: 'no-such-project-for-composer-menu-test' });
+  assert.strictEqual(r.code, 400);
+  assert.match(r.html, /has no composer\.json/);
+});
+
+test('a second click replaces only a session that has finished', () => {
+  assert.strictEqual(sessionFinished(`Installing…\ncomposer install finished. ${LINGER_MARK}, or leave it: it closes by itself in 15 minutes.\n\n`), true);
+  assert.strictEqual(sessionFinished('Updating dependencies\n  - Upgrading drupal/core (11.2.0 => 11.2.1)\n'), false, 'a run still going must be left alone');
+  assert.strictEqual(sessionFinished(''), false, 'no log is not proof it finished');
+  const src = fs.readFileSync(path.join(__dirname, '..', '..', 'actions', 'composer.js'), 'utf8');
+  assert.match(src, /if \(!sessionFinished\(sessionLogTail\(started\.session\)\)\) return \{ \.\.\.started, stillRunning: true \};\s*\n\s*await hostRunnerRequest\('stop'/,
+    'the stop must come only after the finished check');
+  assert.ok(!/<pre\b|terminal-pre/.test(src), 'composer output must not be rendered in the page');
+});
+
+test('only a full workspace installs; everywhere else composer.json is only added to', () => {
+  const full = composer.composerActionsFor('full');
+  assert.ok(full.run['/actions/composer-install'] && full.run['/actions/composer-update'] && full.scripts);
+  // Manifest is the default: an unset or unknown mode must never install.
+  for (const mode of ['manifest', undefined, '', 'Full', 'anything']) {
+    const m = composer.composerActionsFor(mode);
+    assert.deepStrictEqual(Object.keys(m.run), ['/actions/composer-validate'], `mode ${mode} runs more than validate`);
+    assert.strictEqual(m.scripts, false, `mode ${mode} offers scripts`);
+    assert.deepStrictEqual(Object.keys(m.packages).sort(),
+      ['/actions/composer-remove', '/actions/composer-require', '/actions/composer-require-dev']);
+    for (const a of Object.values(m.packages)) {
+      assert.ok(a.args.includes('--no-update'), `${a.label} would install: ${a.args.join(' ')}`);
+      assert.match(a.label, /^[\w .()-]+$/, `label is not shell-safe: ${a.label}`);
+    }
+  }
+  const { loadWorkspaces } = require('../../workspaces');
+  const ws = loadWorkspaces();
+  for (const key of ['dev', 'test', 'demos', 'sandboxes', 'projects']) {
+    if (ws[key]) assert.strictEqual(ws[key].composerMode, 'full', `${key} is a site workspace and should be full`);
+  }
+  for (const key of ['products', 'modules', 'themes', 'recipes', 'profiles']) {
+    if (ws[key]) assert.strictEqual(ws[key].composerMode, 'manifest', `${key} holds package clones and must not install`);
+  }
+});
+
+test('the handler refuses install in a manifest workspace before touching the folder', async () => {
+  const { loadWorkspaces } = require('../../workspaces');
+  const manifestWs = Object.keys(loadWorkspaces()).find((k) => loadWorkspaces()[k].composerMode === 'manifest');
+  if (!manifestWs) return; // a tree without one
+  for (const route of ['/actions/composer-install', '/actions/composer-update', '/actions/composer-update-package', SCRIPT_ROUTE]) {
+    const out = {};
+    await composer[route]({ form: { projectName: 'anything', script: 'x', package: 'drupal/token' },
+      send: (html, code = 200) => { out.html = html; out.code = code; }, workspace: manifestWs, pathname: route });
+    assert.strictEqual(out.code, 403, `${route} must be refused in ${manifestWs}`);
+    assert.match(out.html, /only edits composer\.json/);
+  }
+});
+
+test('the row shows COMPOSER right after SCREENS, only where there is a composer.json', () => {
+  const src = fs.readFileSync(path.join(__dirname, '..', '..', 'server.js'), 'utf8');
+  assert.match(src, /\.\.\.require\('\.\/actions\/composer'\)/, 'the composer routes are not merged');
+  // Where the buttons sit is Commands → Buttons now (row-layout.js); by default COMPOSER comes right after SCREENS.
+  const { DEFAULT_LINES } = require('../../row-layout');
+  assert.strictEqual(DEFAULT_LINES[1][DEFAULT_LINES[1].indexOf('screens') + 1], 'composer', 'COMPOSER must come right after SCREENS by default');
+  assert.strictEqual((src.match(/\bcomposer: composerMenu\b/g) || []).length, 1, 'handed to the layout once per row');
+  const fn = src.slice(src.indexOf('function composerMenuHtml'), src.indexOf('function openWithMenuHtml'));
+  assert.match(fn, /if \(!hasComposerJson\(projectPath\)\) return '';/, 'no composer.json, no button');
+  assert.match(fn, /hx-include="closest \.composer-package"/);
+  assert.match(fn, /SCRIPT_ROUTE/, 'the scripts from composer.json must be offered');
+  // The full menu is too long for one column: commands on the left, a package and the scripts on the right.
+  assert.match(fn, /const body = manifest\s*\n(\s*\/\/[^\n]*\n)*\s*\? `<ul class="uk-nav uk-dropdown-nav">\$\{head\}\s*\n\s*<li class="uk-nav-divider"><\/li>\$\{packageBlock\}\$\{groups\}<\/ul>`/,
+    'the short manifest menu stays one column, with the package field before validate');
+  assert.match(fn, /<div class="composer-columns">\s*\n\s*<ul class="uk-nav uk-dropdown-nav composer-col-commands">\$\{head\}\$\{groups\}<\/ul>\s*\n\s*<ul class="uk-nav uk-dropdown-nav composer-col-inputs">\$\{packageBlock\}\$\{scriptsBlock\}<\/ul>/,
+    'the full menu must be two columns');
+});

package/core/workspace-app/tests/unit/config-yaml.test.js

@@ -0,0 +1,116 @@
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+const yaml = require('js-yaml');
+
+const CONFIG = path.join(__dirname, '..', '..', '..', 'config');
+
+// Every .yml in core/config must actually be YAML.
+//
+// core/config/norms.yml was NOT, for as long as it had existed: one entry began with a
+// backtick (a reserved indicator) and two carried a colon-space (read as a key separator).
+// Nothing broke, because the only reader `cat`s it into a prompt — but it sat beside
+// settings.yml and the workspace.*.settings.yml files, which ARE parsed, and anything that
+// walked the directory would have thrown or silently produced nothing. `parse_yaml` gave
+// zero variables from it. Found by a testing round rather than by a failure, which is the
+// wrong way round; this makes the next one fail loudly instead.
+test('every YAML file in core/config parses', () => {
+  const files = fs.readdirSync(CONFIG).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
+  assert.ok(files.length > 5, `expected the config directory, found ${files.length} files`);
+  const broken = [];
+  for (const f of files) {
+    try { yaml.load(fs.readFileSync(path.join(CONFIG, f), 'utf8')); } catch (e) {
+      broken.push(`${f}: ${String(e.message).split('\n')[0]}`);
+    }
+  }
+  assert.deepEqual(broken, [], 'these are not valid YAML');
+});
+
+test('norms.yml carries the three lists cmd-spdd.sh states it does', () => {
+  const d = yaml.load(fs.readFileSync(path.join(CONFIG, 'norms.yml'), 'utf8'));
+  for (const key of ['norms', 'safeguards', 'canvas_required_sections']) {
+    assert.ok(Array.isArray(d[key]) && d[key].length, `norms.yml has no ${key} list`);
+  }
+});
+
+test('the workspace registry and every workspace settings file parse', () => {
+  const settings = yaml.load(fs.readFileSync(path.join(CONFIG, 'settings.yml'), 'utf8'));
+  assert.ok(Array.isArray(settings.workspaces) && settings.workspaces.length, 'no workspaces list');
+  const missing = settings.workspaces.filter(
+    (w) => !fs.existsSync(path.join(CONFIG, `workspace.${w}.settings.yml`)));
+  // A registered workspace with no settings file renders as a card that configures nothing.
+  assert.deepEqual(missing, [], 'registered workspaces with no settings file');
+});
+
+// The release a machine runs comes from core/workspace-app/.app-version, written by
+// install.sh, sync-tooling.sh --pull and update.sh. package.json's "version" is npm
+// metadata for an app that is never published, and it has said 1.0.0 since the first
+// commit — which is worse than no answer, because it looks like one. Nothing may read it
+// for display, or two numbers start disagreeing in public.
+test('nothing displays package.json version — .app-version is the only source', () => {
+  const app = path.join(__dirname, '..', '..');
+  const readers = [];
+  for (const f of ['server.js', 'workspaces.js', 'screens.js', 'assistant.js']) {
+    const src = fs.readFileSync(path.join(app, f), 'utf8');
+    // require('./package.json').version, or reading the file and pulling .version out
+    if (/package\.json'\s*\)\s*\.version|packageJson\.version/.test(src)) readers.push(f);
+  }
+  assert.deepEqual(readers, [], 'these read package.json version — use appVersion() instead');
+});
+
+test('appVersion reads the stamp, and says nothing when there is none', () => {
+  const { appVersion } = require(path.join(__dirname, '..', '..', 'workspaces'));
+  const v = appVersion();
+  assert.equal(typeof v, 'string');
+  // Either a real tag, or empty. Never a placeholder, never a guess.
+  if (v) assert.match(v, /^[0-9]+\.[0-9]+\.[0-9]+/, `unexpected version stamp: ${v}`);
+});
+
+
+/* ---------- the assistant's name and placeholder, at both levels ---------- */
+
+test('settings.yml names the assistant and says what its composer shows', () => {
+  const text = fs.readFileSync(path.join(CONFIG, 'settings.yml'), 'utf8');
+  assert.match(text, /^\s{2}name: AI Assistant$/m, 'the default name, for the home dashboard');
+  assert.match(text, /^\s{2}placeholder: /m, 'and what the composer says when empty');
+});
+
+test('every workspace can be given its own, from the dashboard', () => {
+  // The settings editor writes values onto lines that already exist — it does not add keys — so a
+  // workspace whose file has no `assistant:` block offers no field to edit and the setting looks
+  // like it does not exist. The shipped value is `default`, which means "inherit", so twenty-four
+  // files carrying the key do not pin the name against a rename in settings.yml.
+  const settings = yaml.load(fs.readFileSync(path.join(CONFIG, 'settings.yml'), 'utf8'));
+  const without = [];
+  for (const w of settings.workspaces) {
+    const f = path.join(CONFIG, `workspace.${w}.settings.yml`);
+    if (!fs.existsSync(f)) continue;
+    const own = yaml.load(fs.readFileSync(f, 'utf8')) || {};
+    if (!own.assistant || own.assistant.name === undefined || own.assistant.placeholder === undefined) without.push(w);
+  }
+  assert.deepEqual(without, [], 'these workspaces cannot name their assistant from the dashboard');
+});
+
+test('both settings are explained in the editor, not shown as bare keys', () => {
+  // Without a label a row renders as the raw key — here, `name` and `placeholder` sitting under a
+  // workspace's own `doc: name:` and `presentation:`, which is two rows called name on one page.
+  const labels = yaml.load(fs.readFileSync(path.join(CONFIG, 'settings.labels.yml'), 'utf8'));
+  for (const k of ['assistant.name', 'assistant.placeholder']) {
+    assert.ok(labels[k] && labels[k].label, `${k} has no label`);
+    assert.ok(labels[k].info, `${k} says nothing about what it does`);
+  }
+});
+
+test('the composer is never handed an empty placeholder', () => {
+  // deep-chat reads it as `placeholder.text || "Ask me anything!"`, so an empty string does not
+  // remove its placeholder, it restores deep-chat's. Whatever is passed must be a real string, and
+  // the hiding is done in CSS — which also keeps the aria-label that textbox needs.
+  const ui = fs.readFileSync(path.join(__dirname, '..', '..', 'public', 'ui.js'), 'utf8');
+  assert.match(ui, /placeholder: \{ text: cfg\.placeholder \|\| `Message the \$\{cfg\.name \|\| 'AI Assistant'\}` \}/,
+    'an empty text here brings back "Ask me anything!"');
+  assert.match(ui, /#text-input:empty::before \{ content: "" !important; \}/,
+    'the placeholder is hidden by blanking what is drawn, not by blanking what it is called');
+  assert.match(ui, /\.deep-chat-intro \{ display: none !important; \}/,
+    'and the empty intro bubble is hidden, not left as a blank pill at the top of every transcript');
+});

package/core/workspace-app/tests/unit/confirm-dialog.test.js

@@ -0,0 +1,69 @@
+/**
+ * The confirm dialog (ui.js + the `#confirm-modal` in server.js's pageShell). Every important action —
+ * remove, delete, reset, a command that asks before it runs — is a `.arm-step` and must go through it.
+ *
+ * It replaced a two-step arm whose first click swapped the label for "⚠️ Sure?": a double click did the
+ * whole thing, and nothing ever said what was about to happen. What the guards here protect:
+ * the click must not navigate (these are links as well as buttons, and a link with an empty href
+ * reloads the page and loses the toast the request answers with), only Yes may fire the request, and
+ * every other way of closing the dialog — the X, Escape, the backdrop — must count as No.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const path = require('path');
+
+const app = path.join(__dirname, '..', '..');
+const ui = fs.readFileSync(path.join(app, 'public', 'ui.js'), 'utf8');
+const server = fs.readFileSync(path.join(app, 'server.js'), 'utf8');
+const open = ui.slice(ui.indexOf("const btn = e.target.closest('.arm-step');"), ui.indexOf('.confirm-yes'));
+
+test('the dialog is in every page, and says what it asks', () => {
+  const modal = server.slice(server.indexOf('id="confirm-modal"'), server.indexOf('id="confirm-modal"') + 900);
+  assert.ok(modal.length > 100, 'no #confirm-modal in pageShell');
+  assert.match(modal, /role="alertdialog"/, 'an alertdialog, so it is announced');
+  assert.match(modal, /stack: true/, 'it must stack: an action can be armed inside the editor modal');
+  assert.match(modal, /Wait!/);
+  assert.match(modal, /Are you sure you want to proceed with this action\?/);
+  assert.match(modal, /confirm-no[^>]*>No</, 'No');
+  assert.match(modal, /confirm-yes[^>]*>Yes</, 'Yes');
+  assert.ok(modal.indexOf('confirm-no') < modal.indexOf('confirm-yes'), 'No comes first: the safe answer is nearest');
+});
+
+test('arming opens the dialog, names the action, and navigates nowhere', () => {
+  assert.ok(open.length > 0, 'the .arm-step handler was not found');
+  assert.match(open, /e\.preventDefault\(\);/, 'the click must not navigate');
+  assert.match(open, /getAttribute\('title'\)/, 'an icon-only button says what it is in its title');
+  assert.match(open, /getElementById\('confirm-what'\)/, 'what is about to happen is written into the dialog');
+  assert.match(open, /UIkit\.modal\('#confirm-modal'\)\.show\(\)/);
+  assert.match(open, /window\.confirm\(/, 'with no UIkit on the page, the browser dialog rather than acting unasked');
+  assert.ok(!/htmx\.trigger/.test(open), 'opening the dialog must never fire the request by itself');
+});
+
+test('only Yes fires the request, and every other way out is No', () => {
+  const rest = ui.slice(ui.indexOf('.confirm-yes'), ui.indexOf('The field microphones'));
+  assert.match(rest, /^\.confirm-yes'\)\) \{[\s\S]*?runConfirmed\(btn\)/, 'Yes runs it');
+  assert.match(rest, /closest\('\.confirm-no'\)\) \{\s*\n\s*pendingConfirm = null;/, 'No forgets it');
+  assert.match(rest, /addEventListener\('hidden'[\s\S]*?confirm-modal[\s\S]*?pendingConfirm = null;/,
+    'the X, Escape and the backdrop are No as well');
+  assert.match(ui, /function runConfirmed\(btn\) \{\s*\n\s*pendingConfirm = null;/,
+    'the pending action is forgotten before it runs, so one Yes cannot fire twice');
+});
+
+test('the destructive actions are all armed', () => {
+  for (const [file, action] of [
+    ['server.js', '/actions/delete-item'],
+    ['server.js', '/actions/ddev-drush-sql-drop'],
+    ['server.js', '/actions/rag-remove'],
+    ['commands-page.js', '/actions/cc-remove'],
+    ['commands-page.js', '/actions/cc-reset'],
+  ]) {
+    const src = fs.readFileSync(path.join(app, file), 'utf8');
+    const i = src.indexOf(`hx-post="${action}"`);
+    assert.ok(i > 0, `${action} is gone from ${file}`);
+    const line = src.slice(src.lastIndexOf('\n', i - 1), src.indexOf('\n', i) + 400);
+    assert.match(line, /arm-step/, `${action} must ask first`);
+    assert.match(line, /hx-trigger="confirmed-remove"/, `${action} must fire only on the dialog's Yes`);
+  }
+});

package/core/workspace-app/tests/unit/create-card.test.js

@@ -0,0 +1,85 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const root = path.join(__dirname, '..', '..');
+const server = fs.readFileSync(path.join(root, 'server.js'), 'utf8');
+
+test('a project workspace asks "What would you like to create?" in its build card, with New folder in it', () => {
+  assert.match(server, /<h2 class="uk-h3 uk-margin-remove">What would you like to create\?<\/h2>\$\{folderBtn\}/);
+  assert.match(server, /class="uk-button uk-button-default uk-button-small create-folder-btn"/);
+  assert.doesNotMatch(server, /Build a new \$\{esc\(meta\.noun\)\}/);
+  // Files workspaces ask the same question inside their card: the create actions as a row, New folder on the right.
+  assert.doesNotMatch(server, /class="ws-create"/);
+  assert.match(server, /const folder = create\.find\(\(it\) => it\.id === 'new-folder'\);/);
+  assert.match(server, /<div class="create-actions">\$\{rest\.map\(\(it\) => it\.html\)\.join\(''\)\}<\/div>/);
+});
+
+test('the build form offers Claude Code after the build, with its prompt shown only when ticked', () => {
+  assert.match(server, /name="ai_after" value="1"> Start AI<\/label>/);
+  assert.match(server, /name="ai_prompt"[^>]*><\/textarea>/);
+  assert.doesNotMatch(server, /name="ai_prompt"[^>]*placeholder=/);
+  const css = fs.readFileSync(path.join(root, 'public/css/components/create-card.css'), 'utf8');
+  assert.match(css, /:has\(input\[name="ai_after"\]:checked\) \.build-ai-prompt \{ display: block; \}/);
+});
+
+test('the build ends with the step that starts Claude Code, so a failed build starts nothing', () => {
+  assert.match(server, /cmdLine \+= ` && \$\{after\.step\}`;/);
+  assert.match(server, /installed: flags\.some\(\(f\) => f === '--install' \|\| f === '-i'\)/);
+});
+
+test('the step writes a private prompt and payload, and the shell line holds only paths', () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'ai-'));
+  const old = process.env.WORKSPACE_ROOT;
+  try {
+    const ai = require('../../build-ai');
+    const { ROOT } = require('../../workspaces');
+    const r = ai.afterBuildStep({ ws: 'dev', dir: path.join(ROOT, 'dev'), project: 'v11x00b9', label: 'Webship 11', installed: true,
+      text: 'Run $(rm -rf /) and `whoami`' });
+    assert.equal(r.session, 'dev--v11x00b9--claude');
+    assert.doesNotMatch(r.step, /rm -rf|whoami/);
+    assert.match(r.step, /^node '.*scripts\/screen-then\.js' '.*\.screens\/prompts\/dev--v11x00b9--claude\.start\.json'$/);
+    // The step runs on the host, so the helper is found from the workspace root, never the container's own path.
+    assert.ok(r.step.startsWith(`node '${path.join(ROOT, 'core', 'workspace-app', 'scripts', 'screen-then.js')}'`));
+    const payloadFile = r.step.match(/'([^']+\.start\.json)'$/)[1];
+    const payload = JSON.parse(fs.readFileSync(payloadFile, 'utf8'));
+    assert.match(payload.cmd, /^exec env WEBSHIP_WORKSPACE='dev' WEBSHIP_PROJECT='v11x00b9' .* claude "\$\(cat '.*dev--v11x00b9--claude\.txt'\)"$/);
+    assert.equal(payload.dir, path.join(ROOT, 'dev', 'v11x00b9'));
+    const prompt = fs.readFileSync(payload.cmd.match(/cat '([^']+)'/)[1], 'utf8');
+    assert.match(prompt, /^The project dev\/v11x00b9 was just built here with Webship 11 and installed\.\n\nRun \$\(rm -rf \/\)/);
+    assert.equal(fs.statSync(payloadFile).mode & 0o777, 0o600);
+    fs.unlinkSync(payloadFile);
+    fs.unlinkSync(payload.cmd.match(/cat '([^']+)'/)[1]);
+  } finally {
+    if (old === undefined) delete process.env.WORKSPACE_ROOT; else process.env.WORKSPACE_ROOT = old;
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('Start AI offers the Claude Code options New screen offers, with the local agents as a list and no placeholders', () => {
+  assert.match(server, /claudeArgsHtml\(\{ target: `ws:\$\{bm\[1\]\}`, agentSelect: true \}\)\)\.replace\(\/ placeholder="\[\^"\]\*"\/g, ''\)/);
+  assert.match(server, /const \{ words, problems \} = claudeArgs\.flagsFromForm\(options, form\);\n      if \(problems\.length\)/);
+  const screens = fs.readFileSync(path.join(root, 'screens.js'), 'utf8');
+  assert.match(screens, /claudeArgFieldHtml\(o, valueOf\(o\), suggestionsFor\(o\), !!p\.agentSelect && o\.name === '--agent'\)/);
+  assert.match(screens, /<option value="">None<\/option>/);
+});
+
+test('the chosen Claude Code options go on the claude line after the build', () => {
+  const ai = require('../../build-ai');
+  const { ROOT } = require('../../workspaces');
+  const r = ai.afterBuildStep({ ws: 'dev', dir: path.join(ROOT, 'dev'), project: 'v11x00b8', flags: ['--agent', 'webship-ai-expert', '--permission-mode', 'plan'] });
+  const payloadFile = r.step.match(/'([^']+\.start\.json)'$/)[1];
+  const payload = JSON.parse(fs.readFileSync(payloadFile, 'utf8'));
+  assert.match(payload.cmd, / claude --agent webship-ai-expert --permission-mode plan "\$\(cat '/);
+  fs.unlinkSync(payloadFile);
+  fs.unlinkSync(payload.cmd.match(/cat '([^']+)'/)[1]);
+});
+
+test('the Start AI prompt is an Ace editor, loaded only when Start AI is ticked, with @ suggestions', () => {
+  assert.match(server, /name="ai_prompt" rows="5" maxlength="4000" aria-label="What the AI should do"\n\s+data-ace-on-demand="markdown" data-mentions="\/fragments\/ai-suggest\/\$\{esc\(key\)\}"><\/textarea>/);
+  const ui = fs.readFileSync(path.join(root, 'public/ui.js'), 'utf8');
+  assert.match(ui, /matches\('input\[name="ai_after"\]'\)/);
+  assert.match(ui, /ta\.dataset\.ace = ta\.dataset\.aceOnDemand;\n  attachAce\(form\);/);
+});

package/core/workspace-app/tests/unit/ddev-addons.test.js

@@ -0,0 +1,144 @@
+/**
+ * DDEV add-ons: what a project has, and what it could.
+ *
+ * An add-on is a repository DDEV copies into a project — a service (`ddev-redis`), a tool
+ * (`ddev-adminer`), a whole development setup (`ddev-drupal-contrib`). There are 287 in the registry
+ * and no way to reach any of them from here except a terminal.
+ *
+ * The one thing this feature must not get wrong: `ddev add-on get` installs from a URL or a local
+ * path as happily as from a repository, so it is a download-and-run from anywhere. A name that
+ * arrives from a browser is checked against the registry LISTING, not merely against a pattern.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const addons = require('../../ddev-addons');
+
+const APP = path.join(__dirname, '../..');
+const server = fs.readFileSync(path.join(APP, 'server.js'), 'utf8');
+const page = fs.readFileSync(path.join(APP, 'ddev-addons-page.js'), 'utf8');
+const actions = fs.readFileSync(path.join(APP, 'actions/ddev-addons.js'), 'utf8');
+
+/** A project with the metadata DDEV writes when it installs one. */
+function project(installed = {}) {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-addon-'));
+  fs.mkdirSync(path.join(dir, '.ddev', 'addon-metadata'), { recursive: true });
+  fs.writeFileSync(path.join(dir, '.ddev', 'config.yaml'), 'name: demo\ntype: drupal\n');
+  for (const [name, meta] of Object.entries(installed)) {
+    const d = path.join(dir, '.ddev', 'addon-metadata', name);
+    fs.mkdirSync(d, { recursive: true });
+    // The real shape, copied from an actual install of ddev/ddev-adminer.
+    fs.writeFileSync(path.join(d, 'manifest.yaml'),
+      `name: ${name}\nrepository: ${meta.repository}\nversion: ${meta.version}\n`
+      + `install_date: "${meta.date}"\nproject_files:\n    - docker-compose.${name}.yaml\n    - commands/host/${name}\nglobal_files: []\n`);
+  }
+  return dir;
+}
+
+test('installed add-ons are read from what DDEV recorded', () => {
+  // `.ddev/addon-metadata/<name>/manifest.yaml`, so listing them is a readdir and a project row
+  // costs no subprocess.
+  const dir = project({
+    adminer: { repository: 'ddev/ddev-adminer', version: 'v1.4.1', date: '2026-09-23T13:02:17+03:00' },
+    redis: { repository: 'ddev/ddev-redis', version: 'v2.2.0', date: '2026-09-23T14:10:00+03:00' },
+  });
+  const list = addons.installedAddons(dir);
+  assert.deepEqual(list.map((a) => a.name), ['redis', 'adminer'], 'newest first');
+  assert.equal(list[1].repository, 'ddev/ddev-adminer');
+  assert.equal(list[1].version, 'v1.4.1');
+  assert.deepEqual(list[1].files, ['docker-compose.adminer.yaml', 'commands/host/adminer'],
+    'what it owns, which is what removing it takes away');
+  assert.deepEqual(addons.installedAddons(project()), [], 'a project with none says none');
+  assert.deepEqual(addons.installedAddons('/no/such/project'), []);
+});
+
+test('only an owner/repo shape is even considered', () => {
+  // The rest of what `ddev add-on get` accepts is a download-and-run from anywhere.
+  for (const bad of ['https://example.com/x.tar.gz', '../../etc', '/tmp/evil', 'no-slash', 'a//b', '']) {
+    assert.equal(addons.ADDON_RE.test(bad), false, bad);
+  }
+  for (const good of ['ddev/ddev-redis', 'Lullabot/ddev-playwright', 'a.b/c_d-e']) {
+    assert.ok(addons.ADDON_RE.test(good), good);
+  }
+});
+
+test('the registry is the allowlist, and an unreadable one installs nothing', async () => {
+  // Verified against the live registry too: `evil/not-a-real-addon` is refused by name, and
+  // `ddev/ddev-redis` is accepted.
+  const fn = actions;
+  assert.match(fn, /const known = await addons\.isKnownAddon\(repo\);/);
+  assert.match(fn, /if \(!known\.ok\) return send/);
+  const mod = fs.readFileSync(path.join(APP, 'ddev-addons.js'), 'utf8');
+  assert.match(mod, /if \(!reg\.list \|\| !reg\.list\.length\) \{\s*\n\s*return \{ ok: false/,
+    'a registry that could not be read refuses everything');
+});
+
+test('the registry comes from the topic, not from the table that truncates', () => {
+  // `ddev add-on list` renders a table and truncates 38 of the 294 names with `…`; a truncated name
+  // cannot be installed. The registry IS the GitHub topic, so that is what is asked.
+  const mod = fs.readFileSync(path.join(APP, 'ddev-addons.js'), 'utf8');
+  assert.match(mod, /const REGISTRY_TOPIC = 'ddev-get';/);
+  assert.match(mod, /run\('gh', \['search', 'repos', '--topic', REGISTRY_TOPIC/);
+  // And when it falls back to the table, a truncated row says so instead of offering a button.
+  assert.match(mod, /truncated: m\[1\]\.includes\('…'\)/);
+  assert.match(page, /name truncated/);
+  assert.match(page, /installButton\(r\.repo, vals, !r\.truncated\)/);
+});
+
+test('searching covers the description, the way ddev add-on search does', () => {
+  const list = [
+    { repo: 'ddev/ddev-solr', description: 'Apache Solr for DDEV' },
+    { repo: 'ddev/ddev-redis', description: 'Redis caching' },
+    { repo: 'someone/ddev-thing', description: 'Uses Solr under the hood' },
+  ];
+  assert.deepEqual(addons.searchAddons(list, 'solr').map((r) => r.repo), ['ddev/ddev-solr', 'someone/ddev-thing']);
+  assert.deepEqual(addons.searchAddons(list, 'REDIS').map((r) => r.repo), ['ddev/ddev-redis'], 'case does not matter');
+  assert.equal(addons.searchAddons(list, '').length, 3, 'an empty search is not a filter');
+});
+
+test('removing and updating name something this project actually has', () => {
+  assert.match(actions, /const found = installed\.find\(\(a\) => a\.name === name\);/);
+  assert.match(actions, /is not installed in this project/);
+  // Removing takes files out of the project, so it is confirmed — in the handler, not only in the markup.
+  assert.match(actions, /if \(removing && form\.confirm !== 'yes'\)/);
+  assert.match(page, /hx-trigger="confirmed-remove"/);
+});
+
+test('a recommendation that the registry does not list says THAT, not "truncated"', () => {
+  // Found by opening the panel: `ddev/ddev-playwright` does not exist — the maintained one is
+  // Lullabot's — and the row said "name truncated", which is a different problem and sent me looking
+  // in the wrong place. Two reasons, two messages.
+  assert.match(page, /why === 'unknown'/);
+  assert.match(page, /not in the registry/);
+  assert.match(page, /installButton\(r\.repo, vals, !!known, 'unknown'\)/, 'a recommendation is checked as a name');
+  assert.match(page, /installButton\(r\.repo, vals, !r\.truncated\)/, 'a registry row is checked as a truncation');
+  // And the name itself is fixed. Every recommendation was checked against the live registry.
+  assert.ok(addons.RECOMMENDED.some((r) => r.repo === 'Lullabot/ddev-playwright'));
+  assert.ok(!addons.RECOMMENDED.some((r) => r.repo === 'ddev/ddev-playwright'));
+});
+
+test('each recommendation says what it is for', () => {
+  // A list of eight repository names is a shelf; the reason is what makes it a recommendation.
+  assert.ok(addons.RECOMMENDED.length >= 6);
+  for (const r of addons.RECOMMENDED) {
+    assert.ok(addons.ADDON_RE.test(r.repo), r.repo);
+    assert.ok(r.why && r.why.length > 30, `${r.repo} says why`);
+  }
+  // And one already installed is not offered again.
+  assert.match(page, /RECOMMENDED\.filter\(\(r\) => !have\.has\(r\.repo\.toLowerCase\(\)\)\)/);
+});
+
+test('the panel is its own module, and the route only resolves the project', () => {
+  // One module per area, like the commands and navigation pages: what a panel looks like is one file
+  // to open, and server.js stays a router.
+  assert.match(server, /const \{ addonsPanelHtml \} = require\('\.\/ddev-addons-page'\);/);
+  assert.match(server, /const html = await addonsPanelHtml\(\{/);
+  assert.match(server, /\.\.\.require\('\.\/actions\/ddev-addons'\),/);
+  assert.match(page, /module\.exports = \{ addonsPanelHtml, PER_PAGE \};/);
+  // Installing writes into .ddev and does nothing until a restart — the panel says so.
+  assert.match(page, /needs a\s*\n\s*<strong>ddev restart<\/strong>/);
+});