@webship.co/workspace 1.0.0-beta1 → 1.0.0-rc1

package/core/workspace-app/tests/unit/claude-session.test.js

@@ -0,0 +1,41 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const path = require('path');
+
+const root = path.join(__dirname, '..', '..');
+const read = (...p) => fs.readFileSync(path.join(root, ...p), 'utf8');
+
+test('exit types /exit and then Enter, only into a live Claude Code session, and only with confirm', () => {
+  const src = read('actions', 'claude-session.js');
+  assert.match(src, /if \(form\.confirm !== 'yes'\)/);
+  assert.match(src, /if \(!\(await isClaudeSession\(session\)\)\)/);
+  assert.match(src, /\['-S', session, '-X', 'stuff', '\\x1b'\]/);
+  assert.match(src, /\['-S', session, '-X', 'stuff', '\/exit'\]/);
+  assert.match(src, /\['-S', session, '-X', 'stuff', '\\r'\]/);
+});
+
+test('resume starts claude --resume with the newest conversation in that folder, never an id from the request', () => {
+  const src = read('actions', 'claude-session.js');
+  assert.match(src, /claudeSessions\.sessionsFor\(dir, \{ limit: 1, resumableOnly: true \}\)/);
+  assert.match(src, /cmd: `exec claude --resume \$\{last\.id\}`/);
+  assert.match(src, /claudeSessions\.isSessionId\(last\.id\)/);
+  assert.doesNotMatch(src, /form\.(id|resume)/);
+});
+
+test('the SCREENS menu offers Exit for each live Claude session, and Resume when none runs', () => {
+  const { menuItems } = require('../../actions/claude-session');
+  const agents = new Set(['dev--p1--claude']);
+  const html = menuItems({ ws: 'dev', project: 'p1', sessions: [{ session: 'dev--p1--claude', state: 'Detached' }, { session: 'dev--p1--shell', state: 'Detached' }], agents, dir: '' });
+  assert.match(html, /class="arm-step" title="Exit Claude Code in dev--p1--claude \(\/exit\)"/);
+  assert.equal((html.match(/claude-exit/g) || []).length, 1);
+  assert.doesNotMatch(html, /claude-resume/);
+  assert.equal(menuItems({ ws: 'dev', project: 'p1', sessions: [], agents: new Set(), dir: '' }), '');
+});
+
+test('the Screens page, the card menu and the actions are wired in', () => {
+  assert.match(read('server.js'), /\.\.\.require\('\.\/actions\/claude-session'\)/);
+  assert.match(read('server.js'), /require\('\.\/actions\/claude-session'\)\.menuItems\(/);
+  assert.match(read('screens.js'), /claudeHere\.has\(s\.session\) && !dead \?/);
+  assert.match(read('actions', 'screens.js'), /\n  onHostScreen,\n/);
+});

package/core/workspace-app/tests/unit/command-flags.test.js

@@ -0,0 +1,45 @@
+/**
+ * commandFlags feeds two surfaces that must not lie: the AI context's command
+ * contract and the Run-a-tool flag hints. It resolves the args/arg-*.sh a
+ * command sources — including through the `arg-${distribution_name}.sh`
+ * indirection every builder uses — so these tests pin both paths against the
+ * real shipped files.
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const path = require('path');
+
+const { commandFlags, ROOT } = require('../../workspaces');
+
+const dev = path.join(ROOT, 'dev');
+
+test('a builder with a variable arg file resolves to the real contract', () => {
+  const flags = commandFlags(dev, 'cmd-drupal11-recommended-project.sh').map((f) => f.long);
+  for (const expected of ['--install', '--launch', '--dev']) {
+    assert.ok(flags.includes(expected), `${expected} in ${flags}`);
+  }
+});
+
+test('a site-template builder reports no flags, because its parser takes a name and nothing else', () => {
+  // arg-site-template.sh declares only PROJECT_NAME. A hint offering --install here would be a
+  // hint for a flag the build exits on.
+  const templates = path.join(ROOT, 'site-templates');
+  assert.deepStrictEqual(commandFlags(templates, 'cmd-byte-project.sh'), []);
+  assert.deepStrictEqual(commandFlags(templates, 'cmd-website_starter-project.sh'), []);
+});
+
+test('a distribution builder reports its opt-in install, with the help text that travels with it', () => {
+  const flags = commandFlags(dev, 'cmd-webship11-0-x-project.sh');
+  const longs = flags.map((f) => f.long);
+  assert.ok(longs.includes('--install'));
+  assert.ok(longs.includes('--add-users'));
+  // The help text travels with the flag — that is what the hints show.
+  const install = flags.find((f) => f.long === '--install');
+  assert.ok(install.short === '-i');
+  assert.ok(install.help.length > 10);
+});
+
+test('a script with no arg file yields an empty contract, not a throw', () => {
+  assert.deepStrictEqual(commandFlags(dev, 'no-such-script.sh'), []);
+});

package/core/workspace-app/tests/unit/command-palette.test.js

@@ -0,0 +1,105 @@
+/**
+ * The command palette, the shortcut sheet and the go-to chords.
+ *
+ * Nothing in the dashboard answered a keyboard: every move was a pointer to a card or a menu. Ctrl or Cmd + K
+ * (and "/") opens one list of workspaces, pages, projects and a few actions; "?" is the sheet; "g" then a letter
+ * goes to a workspace. None of it fires while somebody types in a field, and the page behind is out of reach
+ * while the palette is open.
+ */
+
+const { test, before, after } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const APP = path.join(__dirname, '../..');
+const REPO = path.join(APP, '../..');
+const { copyConfig } = require('./_isolated-config');
+const read = (f) => fs.readFileSync(path.join(APP, f), 'utf8');
+
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'ws-palette-root-'));
+process.env.WORKSPACE_ROOT = root;
+const { buildIndex, PAGES } = require('../../palette-index');
+
+before(() => {
+  fs.mkdirSync(path.join(root, 'core'), { recursive: true });
+  copyConfig(path.join(REPO, 'core/config'), path.join(root, 'core/config'));
+  fs.symlinkSync(path.join(REPO, 'core/scripts'), path.join(root, 'core/scripts'));
+  fs.symlinkSync(APP, path.join(root, 'core/workspace-app'));
+  fs.mkdirSync(path.join(root, 'dev/site-one/.ddev'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'dev/site-one/.ddev/config.yaml'), 'name: site-one\n');
+  fs.mkdirSync(path.join(root, 'dev/plain-folder'), { recursive: true });
+  fs.mkdirSync(path.join(root, 'dev/.hidden'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'dev/a-file.md'), 'x');
+  fs.mkdirSync(path.join(root, 'videos'), { recursive: true });
+});
+after(() => fs.rmSync(root, { recursive: true, force: true }));
+
+test('the index lists workspaces, the pages, and the project folders of workspaces that hold projects', () => {
+  const idx = buildIndex();
+  assert.ok(idx.workspaces.some((w) => w.key === 'dev' && /^https:\/\/dev\./.test(w.url)));
+  assert.deepStrictEqual(idx.pages.map((p) => p.url), PAGES.map((p) => p.url));
+  const names = idx.projects.filter((p) => p.ws === 'dev').map((p) => p.name).sort();
+  assert.deepStrictEqual(names, ['plain-folder', 'site-one'], 'folders only: no file, no hidden folder');
+  const site = idx.projects.find((p) => p.name === 'site-one');
+  assert.strictEqual(site.ddev, true);
+  assert.match(site.url, /^https:\/\/site-one\.dev\./, 'a DDEV project opens its site');
+  assert.match(idx.projects.find((p) => p.name === 'plain-folder').url, /^https:\/\/dev\.[^/]+\/$/, 'a folder opens its workspace');
+  assert.ok(!idx.projects.some((p) => p.ws === 'videos'), 'a files workspace has no projects to list');
+});
+
+test('it opens on Ctrl or Cmd + K and "/", the sheet on "?", and chords on "g" then a letter', () => {
+  const js = read('public/palette.js');
+  assert.match(js, /\(e\.ctrlKey \|\| e\.metaKey\) && !e\.altKey && !e\.shiftKey && k\.toLowerCase\(\) === 'k'/);
+  assert.match(js, /if \(k === '\/'\) \{ e\.preventDefault\(\); open\(''\); return; \}/);
+  assert.match(js, /if \(k === '\?'\) \{ e\.preventDefault\(\); open\('\?'\); return; \}/);
+  assert.match(js, /if \(k === 'g'\) \{ chord = Date\.now\(\); \}/);
+  assert.match(js, /Date\.now\(\) - chord < 1200/, 'the second key has to come within a moment');
+});
+
+test('it never fires while somebody is typing, or while a modal is open', () => {
+  const js = read('public/palette.js');
+  assert.match(js, /n === 'input' \|\| n === 'textarea' \|\| n === 'select' \|\| t\.isContentEditable/);
+  assert.match(js, /\.ace_editor, \.xterm/, 'an editor and a terminal are somewhere to type');
+  assert.match(js, /if \(typing\(e\.target\) \|\| modalOpen\(\)\) return;/);
+});
+
+test('it is a dialog with a combobox and a listbox, announces its results, and holds the page behind it inert', () => {
+  const js = read('public/palette.js');
+  assert.match(js, /role="dialog" aria-modal="true" aria-label="Command palette"/);
+  assert.match(js, /role="combobox" aria-expanded="true" aria-controls="palette-list" aria-autocomplete="list"/);
+  assert.match(js, /role="listbox" aria-label="Results"/);
+  assert.match(js, /setAttribute\('role', 'option'\)/);
+  assert.match(js, /aria-activedescendant/);
+  assert.match(js, /aria-live="polite"/);
+  assert.match(js, /el\.inert = true/);
+  assert.match(js, /returnTo\.focus\(\)/, 'focus goes back to where it was');
+});
+
+test('it is served on every page, from one small JSON route', () => {
+  const server = read('server.js');
+  assert.match(server, /<script src="\$\{assetUrl\('\/palette\.js'\)\}" defer><\/script>/);
+  assert.match(server, /pathname === '\/fragments\/palette\.json'/);
+  assert.match(server, /'Cache-Control': 'no-store'/);
+});
+
+test('the stylesheet is a component with a visible selected row and honours reduced motion', () => {
+  const css = read('public/css/components/command-palette.css');
+  assert.match(css, /\.palette-row\[aria-selected="true"\] \{ background: var\(--subtle-brand\);/);
+  assert.match(css, /prefers-reduced-motion: reduce/);
+  assert.match(css, /#palette\[hidden\] \{ display: none; \}/);
+  assert.match(require('../../themes').assembleCss(''), /\/\* component: command-palette \*\//);
+});
+
+test('there is a visible way in: a toolbar button that says what key opens it', () => {
+  const server = read('server.js');
+  assert.match(server, /class="uk-navbar-item palette-trigger" type="button"/);
+  assert.match(server, /aria-label="Open the command palette" aria-keyshortcuts="Control\+K Meta\+K"/);
+  assert.match(read('public/palette.js'), /closest\('\.palette-trigger'\)/);
+  assert.match(read('public/palette.js'), /k\.textContent = '⌘K'/);
+});
+
+test('letters-in-order matches are a fallback, not noise next to real matches', () => {
+  assert.match(read('public/palette.js'), /out\.some\(function \(x\) \{ return x\.score >= 40; \}\)\) out = out\.filter\(function \(x\) \{ return x\.score >= 40; \}\)/);
+});

package/core/workspace-app/tests/unit/commands-center.test.js

@@ -0,0 +1,338 @@
+/**
+ * The command catalog and the Commands page: commands as data, what each runs on, and the page out of Settings.
+ *
+ * What must never drift: every built-in command is valid; a line never carries $ or a backtick, and a value reaches it
+ * only single-quoted and only where its target gives one; a target stays inside its workspace or project; yours replace
+ * a built-in one by id, and a broken file of yours leaves the built-in ones; a write never overwrites a newer file; and
+ * Commands is its own page, with Settings → Commands and Row actions sending you to it.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'commands-'));
+process.env.COMMANDS_FILE = path.join(tmp, 'commands.yml');
+process.env.ROW_ACTIONS_FILE = path.join(tmp, 'row-actions.yml');
+process.env.ROW_ACTIONS_SEEN_FILE = path.join(tmp, 'row-actions.seen.json');
+process.env.ROW_ACTIONS_HISTORY_FILE = path.join(tmp, 'row-actions.history.jsonl');
+process.on('exit', () => fs.rmSync(tmp, { recursive: true, force: true }));
+
+const cc = require('../../commands');
+
+const APP = path.join(__dirname, '..', '..');
+const cmd = (over = {}) => cc.cleanCommand({ id: 'cr', label: 'Rebuild caches', on: 'project', run: 'ddev drush cr', ...over });
+const refusal = (over) => cc.commandRefusal(cmd(over));
+const shipped = () => { delete process.env.COMMANDS_DEFAULTS_FILE; cc.invalidateCatalog(); };
+
+test('every built-in command is valid, has its own id, and every kind of target has some', () => {
+  shipped();
+  fs.rmSync(process.env.COMMANDS_FILE, { force: true });
+  const cat = cc.loadCatalog();
+  assert.strictEqual(cat.builtinError, '');
+  assert.deepStrictEqual(cat.problems, []);
+  assert.ok(cat.builtin.length >= 10);
+  assert.strictEqual(new Set(cat.builtin.map((e) => e.id)).size, cat.builtin.length);
+  for (const on of Object.keys(cc.ON)) assert.ok(cat.builtin.some((e) => e.on === on), `no built-in command runs on ${on}`);
+  // DDEV only: no built-in command runs composer or drush on the host.
+  for (const e of cat.builtin) assert.doesNotMatch(cc.lineOf(e), /(^|[;&|]\s*)(composer|drush) /, e.id);
+});
+
+test('a line never carries $ or a backtick, and a value only where its target gives one', () => {
+  assert.strictEqual(refusal({}), '');
+  assert.match(refusal({ run: 'echo $HOME' }), /\$ or a backtick/);
+  assert.match(refusal({ run: 'echo `id`' }), /\$ or a backtick/);
+  assert.match(refusal({ on: 'workspace', run: 'ls {{project}}' }), /\{\{project\}\} needs "on" to be project or folder or file/);
+  assert.match(refusal({ on: 'project', run: 'head {{file}}' }), /needs "on" to be file/);
+  assert.match(refusal({ run: 'echo {{home}}' }), /is not a value a command can use/);
+  assert.match(refusal({ run: 'git switch {{opt.branch}}' }), /no option called branch/);
+  assert.strictEqual(refusal({ run: 'git switch {{opt.branch}}', options: [{ name: 'branch', required: true }] }), '');
+  assert.match(refusal({ script: 'dev/cmd-tools-backup-dev.sh' }), /either run .* and not both/);
+  assert.match(refusal({ run: '', script: 'dev/../cmd-x.sh' }), /script is <workspace>\/cmd-<name>\.sh/);
+  assert.match(refusal({ args: '{{project}}' }), /args go with a script/);
+  assert.match(refusal({ on: 'everywhere' }), /"on" is workspace, project, folder, file/);
+  assert.match(refusal({ id: 'Bad Id' }), /the id is lower-case/);
+  assert.match(refusal({ label: 'قل مرحبا' }), /the label is letters/);
+  assert.strictEqual(refusal({ on: 'file', run: 'head -n 5 -- {{file}}' }), '');
+});
+
+test('yours replace a built-in one by id, in its place; a broken file of yours leaves the built-in ones', () => {
+  const defaults = path.join(tmp, 'defaults.yml');
+  fs.writeFileSync(defaults, 'commands:\n  - { id: one, label: One, on: project, run: echo one }\n  - { id: two, label: Two, on: project, run: echo two }\n');
+  process.env.COMMANDS_DEFAULTS_FILE = defaults;
+  fs.writeFileSync(process.env.COMMANDS_FILE, 'commands:\n'
+    + '  - { id: one, label: My one, on: project, run: echo mine }\n'
+    + '  - { id: three, label: Three, on: file, run: "head {{file}}" }\n'
+    + '  - { id: bad, label: Bad, on: project, run: echo $HOME }\n');
+  cc.invalidateCatalog();
+  let cat = cc.loadCatalog();
+  assert.deepStrictEqual(cat.commands.map((e) => [e.id, e.source, !!e.overrides]), [['one', 'yours', true], ['two', 'builtin', false], ['three', 'yours', false]]);
+  assert.strictEqual(cat.commands[0].label, 'My one');
+  assert.match(cat.problems.join(' '), /bad: .*\$ or a backtick/);
+
+  fs.writeFileSync(process.env.COMMANDS_FILE, 'commands: [\n');
+  cc.invalidateCatalog();
+  cat = cc.loadCatalog();
+  assert.match(cat.error, /not valid YAML/);
+  assert.deepStrictEqual(cat.commands.map((e) => e.id), ['one', 'two']);
+  shipped();
+});
+
+test('a write never overwrites a newer file, and no commands at all removes the file', () => {
+  fs.rmSync(process.env.COMMANDS_FILE, { force: true });
+  cc.invalidateCatalog();
+  cc.saveYourCommands([cmd()], '');
+  assert.match(fs.readFileSync(process.env.COMMANDS_FILE, 'utf8'), /run: ddev drush cr/);
+  assert.throws(() => cc.saveYourCommands([cmd({ label: 'Other' })], '1'), (err) => err.code === 'CHANGED');
+  cc.saveYourCommands([], String(Math.floor(fs.statSync(process.env.COMMANDS_FILE).mtimeMs)));
+  assert.ok(!fs.existsSync(process.env.COMMANDS_FILE));
+});
+
+test('Definition refuses an empty paste and a YAML alias bomb, and says what would change', () => {
+  shipped();
+  assert.match(cc.checkDefinition('').errors.join(' '), /empty/);
+  const levels = ['a: &a [x, x, x, x, x, x, x, x, x]'];
+  for (const [i, k] of ['b', 'c', 'd', 'e'].entries()) levels.push(`${k}: &${k} [${Array(9).fill(`*${'abcd'[i]}`).join(', ')}]`);
+  const started = Date.now();
+  assert.match(cc.checkDefinition([...levels, 'commands: []'].join('\n')).errors.join(' '), /too large or too deeply nested/);
+  assert.ok(Date.now() - started < 2000);
+  assert.match(cc.checkDefinition('commands:\n  - { id: x, label: X, on: project, run: echo $X }\n').errors.join(' '), /Command 1 \(x\): .*\$ or a backtick/);
+  const r = cc.checkDefinition('commands:\n  - { id: ddev-restart, label: Restart it, on: project, when: [ddev], run: ddev restart }\n  - { id: mine, label: Mine, on: workspace, run: ls }\n');
+  assert.deepStrictEqual(r.errors, []);
+  assert.match(r.notes.join(' '), /Adds ddev-restart, mine\./);
+  assert.match(r.notes.join(' '), /Your version of the built-in ddev-restart\./);
+});
+
+test('a target stays inside its workspace or project, and gives only the values it has', () => {
+  const wsDir = path.join(tmp, 'ws1');
+  const site = path.join(wsDir, 'site');
+  fs.mkdirSync(path.join(site, 'web', 'modules'), { recursive: true });
+  fs.writeFileSync(path.join(site, 'composer.json'), '{}');
+  fs.writeFileSync(path.join(wsDir, 'notes.md'), '# notes');
+  const outside = fs.mkdtempSync(path.join(os.tmpdir(), 'commands-outside-'));
+  process.on('exit', () => fs.rmSync(outside, { recursive: true, force: true }));
+  fs.writeFileSync(path.join(outside, 'secret'), 'x');
+  fs.symlinkSync(outside, path.join(site, 'out'));
+  const env = { isValidWorkspace: (k) => k === 'ws1', workspaceDir: () => wsDir };
+  const at = (on, form) => cc.resolveTarget(cmd({ on, run: 'ls' }), { target_ws: 'ws1', ...form }, env);
+
+  assert.match(at('project', { target_ws: 'nope' }).error, /Pick a workspace/);
+  assert.match(at('project', {}).error, /Pick a project/);
+  assert.match(at('project', { target_project: '../etc' }).error, /not a project name/);
+  assert.match(at('file', { target_project: 'site', target_path: '../../etc/passwd' }).error, /relative path inside the target/);
+  assert.match(at('file', { target_project: 'site', target_path: 'out/secret' }).error, /leads outside site/);
+  assert.match(at('file', { target_project: 'site', target_path: 'a$b' }).error, /relative path inside the target/);
+  assert.match(at('folder', { target_project: 'site', target_path: 'composer.json' }).error, /is not a folder/);
+  assert.match(at('file', { target_project: 'site', target_path: 'web' }).error, /is not a file/);
+  assert.match(at('file', { target_project: 'site' }).error, /Name the file/);
+
+  let t = at('file', { target_project: 'site', target_path: './composer.json' });
+  assert.deepStrictEqual([t.cwd, t.vars.file, t.vars.folder, t.vars.project, t.where], [site, 'composer.json', '.', 'site', 'site/composer.json']);
+  t = at('folder', { target_project: 'site', target_path: 'web/modules/' });
+  assert.deepStrictEqual([t.cwd, t.vars.folder, t.vars.file], [path.join(site, 'web', 'modules'), 'web/modules', '']);
+  t = at('file', { target_path: 'notes.md' });
+  assert.deepStrictEqual([t.cwd, t.vars.project, t.where, t.name], [wsDir, '', 'notes.md', 'ws1/notes.md']);
+  t = at('workspace', { target_project: 'site' });
+  assert.deepStrictEqual([t.cwd, t.vars.project, t.name], [wsDir, '', 'ws1']);
+
+  const suggest = (on, typed) => cc.pathSuggestions(cmd({ on }), { target_ws: 'ws1', target_project: 'site', target_path: typed }, env);
+  assert.deepStrictEqual(suggest('folder', 'web/'), ['web/modules/']);
+  assert.deepStrictEqual(suggest('file', 'out/'), [], 'a link out of the project offers nothing');
+  assert.deepStrictEqual(suggest('file', '../'), []);
+});
+
+test('the line quotes every value, and prints the markers a run is read back from', () => {
+  const line = cc.commandLine(cmd({ on: 'file', run: 'head -n 5 -- {{file}}' }), { file: "it's here.txt" });
+  assert.strictEqual(line, `{ head -n 5 -- 'it'\\''s here.txt' ; } && echo "ROW-ACTION succeeded" || echo "ROW-ACTION failed"`);
+  const script = cc.commandLine(cmd({ run: '', script: 'dev/cmd-tools-backup-dev.sh', args: '{{project}} --keep 2' }), { project: 'site' }, {}, { workspaceDir: () => '/w/dev' });
+  assert.match(script, /^\{ bash '\/w\/dev\/cmd-tools-backup-dev\.sh' 'site' --keep 2 ; \}/);
+  const opt = cc.commandLine(cmd({ run: 'git switch {{opt.branch}}', options: [{ name: 'branch' }] }), {}, { branch: 'feature/x' });
+  assert.match(opt, /git switch 'feature\/x'/);
+});
+
+test('the list shows built-in, yours and scripts together, and filters by source and by what it runs on', () => {
+  shipped();
+  const cp = require('../../commands-page');
+  const scripts = [{ key: 'dev', label: 'Dev', items: [{ file: 'cmd-tools-backup-dev.sh', title: 'Back up', desc: 'Backs up a project' }] }];
+  let html = cp.catalogListHtml({ per: 'all', q: '' }, { scripts });
+  assert.match(html, /Scripts · Dev/);
+  assert.match(html, /href="\/commands\/c\/ddev-restart"/);
+  assert.match(html, /href="\/commands\/s\/dev\/cmd-tools-backup-dev\.sh"/);
+  html = cp.catalogListHtml({ per: 'all', q: '', source: 'script' }, { scripts });
+  assert.doesNotMatch(html, /\/commands\/c\//);
+  html = cp.catalogListHtml({ per: 'all', q: '', on: 'file' }, { scripts });
+  assert.match(html, /\/commands\/c\/file-head/);
+  assert.doesNotMatch(html, /ddev-restart/);
+});
+
+test('the handlers: add, refuse and keep what was typed, change a built-in, copy, delete, run by id only', async () => {
+  shipped();
+  fs.rmSync(process.env.COMMANDS_FILE, { force: true });
+  cc.invalidateCatalog();
+  const actions = require('../../actions/commands-center');
+  const call = async (route, form) => {
+    const out = {};
+    await actions[route]({ form, workspace: 'dev', pathname: route, send: (html, code = 200) => { out.html = html; out.code = code; } });
+    return out;
+  };
+  const mtime = () => String(cc.loadCatalog().mtime);
+
+  let r = await call('/actions/cc-save', { cc_label: 'Say hi', cc_on: 'project', cc_kind: 'run', cc_run: 'echo $HOME', mtime: mtime() });
+  assert.strictEqual(r.code, 400);
+  assert.match(r.html, /\$ or a backtick/);
+  assert.match(r.html, /name="cc_run"[^>]*>echo \$HOME<\/textarea>/, 'a refused form keeps what was typed');
+  r = await call('/actions/cc-save', { cc_label: 'Say hi', cc_on: 'folder', cc_kind: 'run', cc_run: 'ls -la', cc_when: 'git', cc_tags: 'files, look', mtime: mtime() });
+  assert.strictEqual(r.code, 200, r.html);
+  const e = cc.findCommand('say-hi');
+  assert.deepStrictEqual([e.source, e.on, e.when, e.tags], ['yours', 'folder', ['git'], ['files', 'look']]);
+  r = await call('/actions/cc-save', { cc_label: 'Again', cc_id: 'say-hi', cc_on: 'project', cc_kind: 'run', cc_run: 'ls', mtime: mtime() });
+  assert.strictEqual(r.code, 409);
+  r = await call('/actions/cc-save', { cc_label: 'Stale', cc_on: 'project', cc_kind: 'run', cc_run: 'ls', mtime: '1' });
+  assert.strictEqual(r.code, 409);
+  assert.match(r.html, /changed since this page was loaded/);
+
+  r = await call('/actions/cc-save', { id: 'ddev-restart', cc_label: 'Restart', cc_on: 'project', cc_when: 'ddev', cc_kind: 'run', cc_run: 'ddev restart --skip-hooks', mtime: mtime() });
+  assert.strictEqual(r.code, 200, r.html);
+  assert.strictEqual(cc.findCommand('ddev-restart').overrides, true);
+  r = await call('/actions/cc-remove', { id: 'ddev-describe', mtime: mtime() });
+  assert.strictEqual(r.code, 404, 'a built-in command cannot be deleted');
+  r = await call('/actions/cc-remove', { id: 'ddev-restart', mtime: mtime(), from: 'page' });
+  assert.strictEqual(r.code, 200, r.html);
+  assert.strictEqual(cc.findCommand('ddev-restart').source, 'builtin', 'deleting yours brings the built-in one back');
+
+  r = await call('/actions/cc-copy', { id: 'git-status', mtime: mtime() });
+  assert.strictEqual(r.code, 200, r.html);
+  assert.strictEqual(cc.findCommand('git-status-copy').label, 'Git status copy');
+
+  r = await call('/actions/cc-run', { id: 'no-such-command' });
+  assert.strictEqual(r.code, 404);
+  r = await call('/actions/cc-run', { id: 'git-status', target_ws: 'no-such-workspace' });
+  assert.strictEqual(r.code, 400);
+  assert.match(r.html, /Pick a workspace/);
+
+  r = await call('/actions/cc-definition-save', { definition: 'commands:\n  - { id: x, label: X, on: project, run: echo $X }\n', mtime: mtime() });
+  assert.strictEqual(r.code, 400);
+  assert.match(r.html, /id: x, label: X/, 'a refused definition keeps what was pasted');
+  r = await call('/actions/cc-reset', { mtime: mtime() });
+  assert.strictEqual(r.code, 200, r.html);
+  assert.ok(!fs.existsSync(process.env.COMMANDS_FILE));
+});
+
+test('code is edited and shown in Ace: YAML, shell steps, a one-line command, and a script read-only', () => {
+  shipped();
+  const cp = require('../../commands-page');
+  const rl = require('../../row-layout');
+  const def = cp.definitionBody();
+  assert.match(def, /<textarea[^>]*name="definition"[^>]*data-ace="yaml"/);
+  assert.match(def, /readonly[^>]*data-ace="yaml" data-ace-readonly="1" aria-label="The built-in commands"/);
+  const page = cp.commandPageBody(cc.findCommand('git-status'), { scripts: [] });
+  assert.match(page, /name="cc_run"[^>]*data-ace="sh" data-ace-single="1"/);
+  assert.match(page, /name="cc_args"[^>]*data-ace="sh" data-ace-single="1"/);
+  assert.match(page, /readonly[^>]*data-ace="yaml" data-ace-readonly="1" aria-label="This command as YAML"/);
+  assert.match(cp.scriptPageBody({ ws: 'dev', file: 'cmd-x.sh', source: 'echo hi\n' }), /readonly[^>]*data-ace="sh" data-ace-readonly="1"/);
+  const editor = rl.rowActionsEditorHtml();
+  assert.match(editor, /name="definition"[^>]*data-ace="yaml"/);
+  // The add-a-button fields moved into the modal, and its steps box is Ace too.
+  assert.match(rl.addButtonFormHtml(), /name="add_steps_new"[^>]*data-ace="sh"/);
+  const ui = fs.readFileSync(path.join(APP, 'public', 'ui.js'), 'utf8');
+  assert.match(ui, /const single = ta\.dataset\.aceSingle === '1';/, 'a one-line editor');
+  assert.match(ui, /bindKey: \{ win: 'Enter\|Shift-Enter', mac: 'Enter\|Shift-Enter' \}, exec: \(\) => \{\}/, 'Enter adds no line');
+  assert.match(ui, /if \(readOnly\) editor\.setOptions\(\{ readOnly: true/, 'a read-only editor');
+  assert.match(ui, /new ResizeObserver\(\(\) => editor\.resize\(\)\)\.observe\(host\)/, 'drawn again when a closed section opens');
+});
+
+test('an action step can use a command: its line, filled for the project, run from the right folder', () => {
+  shipped();
+  const rl = require('../../row-layout');
+  const env = { workspaceDir: (k) => `/w/${k}`, exists: () => true };
+  const ctx = { workspace: 'dev', project: 'site', projectDir: '/w/dev/site' };
+  const action = (steps, over = {}) => rl.cleanCustom({ id: 'a', label: 'A', button: 'ddev', group: 'g', steps, ...over });
+
+  assert.strictEqual(rl.customRefusal(action([{ use: 'git-status' }, 'echo done'])), '');
+  assert.match(rl.customRefusal(action([{ use: 'Bad Id' }])), /not a command id/);
+  assert.match(rl.customRefusal(action([{ use: 'git-status', command: 'ls' }])), /one or the other/);
+  assert.match(rl.useRefusal(action(['echo a', { use: 'no-such-command' }])), /step 2 uses no-such-command, which is not a command/);
+  assert.match(rl.useRefusal(action([{ use: 'file-head' }])), /runs on a file/);
+
+  assert.deepStrictEqual(rl.customToDoc(action([{ use: 'git-status' }])).steps, [{ use: 'git-status' }]);
+  const round = rl.cleanCustom(rl.customToDoc(action(['echo a', { use: 'drush-status', on_error: 'echo failed' }])));
+  assert.deepStrictEqual(round.steps.map(rl.stepText), ['echo a', 'use: drush-status']);
+  assert.strictEqual(round.steps[1].onError, 'echo failed');
+
+  let x = cc.expandSteps(action([{ use: 'git-status' }, 'echo done']), ctx, env);
+  assert.deepStrictEqual(x.entry.steps.map((s) => s.command), ['git status --short --branch', 'echo done'], 'a project command runs in the project');
+  x = cc.expandSteps(action([{ use: 'workspace-ddev-list' }]), ctx, env);
+  assert.strictEqual(x.entry.steps[0].command, "( cd '/w/dev' && ddev list )", 'a workspace command runs from the workspace folder');
+  x = cc.expandSteps(action([{ use: 'backup-dev-project' }]), ctx, env);
+  assert.strictEqual(x.entry.steps[0].command, "( cd '/w/dev' && bash '/w/dev/cmd-tools-backup-dev.sh' 'site' )", 'a script runs from its folder, the project in its arguments');
+  x = cc.expandSteps(action([{ use: 'backup-dev-project' }]), ctx, { ...env, exists: () => false });
+  assert.match(x.error, /does not exist/);
+  x = cc.expandSteps(action([{ use: 'gone' }]), ctx, env);
+  assert.match(x.error, /step 1 uses gone, which is not a command any more/);
+
+  const switcher = action([{ use: 'git-switch-branch' }]);
+  assert.deepStrictEqual(rl.effectiveOptions(switcher).map((o) => o.name), ['branch'], 'the options of a used command are asked for');
+  assert.match(rl.actionCommandLine(cc.expandSteps(switcher, ctx, env).entry, { branch: 'main' }), /git fetch --prune && git switch 'main'/);
+
+  const report = rl.checkDefinition('custom:\n  - { id: x, label: X, button: ddev, steps: [{ use: nope }] }\n', 'replace', rl.normalizeLayout({}));
+  assert.match(report.errors.join(' '), /uses nope, which is not a command/);
+});
+
+test('buttons hold commands: added from a button or from the command, listed where used, and kept while used', async () => {
+  shipped();
+  fs.rmSync(process.env.COMMANDS_FILE, { force: true });
+  cc.invalidateCatalog();
+  const rl = require('../../row-layout');
+  rl.resetRowLayout();
+  const handlers = { ...require('../../actions/row-actions'), ...require('../../actions/commands-center') };
+  const call = async (route, form) => {
+    const out = {};
+    await handlers[route]({ form, workspace: 'dev', pathname: route, send: (html, code = 200) => { out.html = html; out.code = code; } });
+    return out;
+  };
+
+  let r = await call('/actions/row-custom-add', { for_button: 'git', add_use_git: 'git-log', add_label_git: '', add_steps_git: '', add_when_git: 'any' });
+  assert.strictEqual(r.code, 200, r.html);
+  const a = rl.loadRowLayoutFresh().custom.find((c) => c.id === 'last-20-commits');
+  assert.deepStrictEqual([a.label, a.group, a.when, a.steps.map(rl.stepText)], ['Last 20 commits', 'Git', ['git'], ['use: git-log']], 'a command picked alone is the whole action');
+  r = await call('/actions/row-custom-add', { for_button: 'ddev', add_label_ddev: 'Refresh', add_steps_ddev: 'use: drush-cache-rebuild\nuse: nope', add_when_ddev: 'ddev' });
+  assert.strictEqual(r.code, 400);
+  assert.match(r.html, /uses nope, which is not a command/);
+  assert.match(rl.rowActionsEditorHtml(), /name="add_use_git"[\s\S]*?<option value="git-log">Last 20 commits<\/option>/, 'each Add an action box has the picker');
+
+  r = await call('/actions/cc-save', { cc_label: 'Say where', cc_on: 'project', cc_kind: 'run', cc_run: 'pwd', mtime: String(cc.loadCatalog().mtime) });
+  assert.strictEqual(r.code, 200, r.html);
+  r = await call('/actions/cc-add-to-button', { id: 'say-where', button: 'more', group: 'Mine', label: '', mtime: String(rl.layoutMtime()) });
+  assert.strictEqual(r.code, 200, r.html);
+  assert.match(r.html, /Added to More → Mine/);
+  assert.match(r.html, /<strong>More<\/strong> → Mine → Say where/, 'the command page lists where it is used');
+  assert.deepStrictEqual(cc.usedBy('say-where').map((x) => [x.button, x.label]), [['more', 'Say where']]);
+
+  r = await call('/actions/cc-remove', { id: 'say-where', mtime: String(cc.loadCatalog().mtime) });
+  assert.strictEqual(r.code, 409, 'a command a button uses cannot be deleted');
+  assert.match(r.html, /Say where is on a button: More → Mine → Say where/);
+  assert.match(cc.checkDefinition('commands: []\n').errors.join(' '), /removes say-where, which is used by More → Mine → Say where/);
+  r = await call('/actions/cc-reset', { mtime: String(cc.loadCatalog().mtime) });
+  assert.strictEqual(r.code, 409);
+
+  r = await call('/actions/cc-add-to-button', { id: 'file-head', button: 'more', mtime: String(rl.layoutMtime()) });
+  assert.strictEqual(r.code, 400);
+  assert.match(r.html, /runs on a file/);
+
+  rl.resetRowLayout();
+  cc.saveYourCommands([], '');
+});
+
+test('Commands is its own page: out of Settings, in the rail, and the old addresses send you to it', () => {
+  const src = fs.readFileSync(path.join(APP, 'server.js'), 'utf8');
+  assert.match(src, /'\/settings\/row-actions': '\/settings\/buttons'/);
+  assert.doesNotMatch(src, /tab\('\/settings\/(commands|row-actions)'/, 'Settings no longer carries the commands');
+  assert.match(src, /navLink\('\/commands', 'tabler:terminal-2', 'Commands'/);
+  assert.match(src, /\.\.\.require\('\.\/actions\/commands-center'\)/);
+  for (const route of ['/commands/c/', '/commands/s/', '/fragments/cc/run/', '/fragments/cc/script-run/']) {
+    assert.ok(src.includes(route.replace(/\//g, '\\/')), `no route for ${route}`);
+  }
+  assert.ok(!/function commandRowsHtml/.test(src), 'the old list is gone, not left beside the new one');
+});