@webship.co/workspace 1.0.0-beta1 → 1.0.0-rc1

package/core/workspace-app/tests/unit/settings-raw.test.js

@@ -0,0 +1,177 @@
+/**
+ * Editing a settings file as raw YAML, beside the field-by-field form.
+ *
+ * The form is the safer way and stays the default: it edits one value on one known line and leaves the
+ * comments, the quoting and the list blocks exactly as they were. But some changes are not a value — a
+ * key that does not exist yet, a block moved, a comment written for the next person — and for those the
+ * form has no answer at all.
+ *
+ * The rule it must not break is the one the whole settings editor is built around: **a secret's value
+ * never leaves the server.** A raw editor sends the whole file out and takes the whole file back, so
+ * every secret goes out wearing a mask and any value still wearing it comes back as what is on disk.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const yaml = require('js-yaml');
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'settings-raw-'));
+process.env.WORKSPACE_CONFIG = tmp;
+process.on('exit', () => fs.rmSync(tmp, { recursive: true, force: true }));
+
+const sf = require('../../settings-file');
+const { CONFIG_DIR } = require('../../workspaces');
+
+// A fixture, not the machine's own settings: these tests must never read a real token, and a test that
+// writes over somebody's configuration to prove it can write is not a test anyone should run twice.
+const FIXTURE = `# The hub settings.
+account:
+  # The admin username a fresh install is created with.
+  user: webmaster
+  pass: not-a-secret-by-design
+figma:
+  token: fig-abc
+git:
+  github:
+    token: gh-one
+  drupal:
+    token: dr-two
+  bitbucket:
+    token: bb-three
+style:
+  mode: light          # light | dark | system
+workspaces:
+  - dev
+  - test
+`;
+
+const FILE = 'settings.yml';
+const full = path.join(CONFIG_DIR, FILE);
+const restore = () => fs.writeFileSync(full, FIXTURE);
+restore();
+
+test('every secret leaves wearing a mask, and its value does not', () => {
+  restore();
+  const read = sf.readSettingsText(FILE);
+  assert.ok(read, 'the file is readable');
+  const rows = sf.readSettingsRows(FILE).filter((r) => r.secret && r.value.trim());
+  assert.strictEqual(rows.length, 4, 'the fixture holds four secrets — and account.pass is not one of them');
+  const out = read.text.split('\n');
+  for (const r of rows) {
+    assert.ok(read.masked.includes(r.dotted), `${r.dotted} is masked`);
+    assert.ok(out[r.line].includes(sf.SECRET_MASK), `${r.dotted}'s line carries the mask`);
+    assert.ok(!out[r.line].includes(r.value), `${r.dotted}'s value is not on its line`);
+  }
+});
+
+test('the mask is visible and unlikely to be typed by accident', () => {
+  // A row of dots would look like a value somebody had set.
+  assert.match(sf.SECRET_MASK, /kept/);
+  assert.ok(sf.SECRET_MASK.length > 8);
+});
+
+test('a file saved back unchanged is byte for byte what it was', () => {
+  restore();
+  const before = fs.readFileSync(full, 'utf8');
+  const { text } = sf.readSettingsText(FILE);
+  const res = sf.writeSettingsText(FILE, text, { yaml });
+  assert.ok(res.kept.length, 'it says which secrets it put back');
+  assert.strictEqual(fs.readFileSync(full, 'utf8').trimEnd(), before.trimEnd(),
+    'comments, order, quoting and every secret survive a round trip');
+  restore();
+});
+
+test('a masked secret is matched by its whole path, not by its key', () => {
+  // Three services each have a key called `token`. Matching by key gave all three the first one's
+  // value — one service's token copied onto another.
+  fs.writeFileSync(full, [
+    'git:', '  github:', '    token: gh-one', '  drupal:', '    token: dr-two', '  bitbucket:', '    token: bb-three', '',
+  ].join('\n'));
+  const { text, masked } = sf.readSettingsText(FILE);
+  assert.deepStrictEqual(masked, ['git.github.token', 'git.drupal.token', 'git.bitbucket.token']);
+  assert.strictEqual((text.match(new RegExp(sf.SECRET_MASK.replace(/[.*+?^${}()|[\]\\<>—]/g, '\\$&'), 'g')) || []).length, 3);
+  sf.writeSettingsText(FILE, text, { yaml });
+  const back = fs.readFileSync(full, 'utf8');
+  assert.match(back, /github:\n\s+token: gh-one/);
+  assert.match(back, /drupal:\n\s+token: dr-two/);
+  assert.match(back, /bitbucket:\n\s+token: bb-three/);
+  restore();
+});
+
+test('typing over the mask is how a new secret is set', () => {
+  fs.writeFileSync(full, 'git:\n  github:\n    token: old-one\n');
+  const { text } = sf.readSettingsText(FILE);
+  sf.writeSettingsText(FILE, text.replace(sf.SECRET_MASK, 'a-new-one'), { yaml });
+  assert.match(fs.readFileSync(full, 'utf8'), /token: a-new-one/);
+  restore();
+});
+
+test('a masked value with nothing behind it is written empty, never as the mask', () => {
+  fs.writeFileSync(full, 'git:\n  github:\n    token: old-one\n');
+  const { text } = sf.readSettingsText(FILE);
+  // The key was renamed while the mask was still on it: there is no value to put back.
+  sf.writeSettingsText(FILE, text.replace('token:', 'other_token:'), { yaml });
+  const back = fs.readFileSync(full, 'utf8');
+  assert.ok(!back.includes(sf.SECRET_MASK), 'the mask never reaches the file');
+  assert.match(back, /other_token:\s*$/m);
+  restore();
+});
+
+test('a file that does not parse is refused, and nothing is written', () => {
+  restore();
+  const before = fs.readFileSync(full, 'utf8');
+  const res = sf.writeSettingsText(FILE, 'a: 1\n  : : no\n', { yaml });
+  assert.match(res.error, /not YAML/);
+  assert.strictEqual(fs.readFileSync(full, 'utf8'), before,
+    'a settings file that does not parse takes the whole configuration with it');
+});
+
+test('an empty file, and a file that is not a mapping, are refused too', () => {
+  restore();
+  const before = fs.readFileSync(full, 'utf8');
+  assert.match(sf.writeSettingsText(FILE, '   ', { yaml }).error, /empty file/);
+  assert.match(sf.writeSettingsText(FILE, '- one\n- two\n', { yaml }).error, /mapping/);
+  assert.strictEqual(fs.readFileSync(full, 'utf8'), before);
+});
+
+test('a file that cannot be read is null, not an empty editor', () => {
+  assert.strictEqual(sf.readSettingsText('workspace.nosuchthing.settings.yml'), null);
+});
+
+/* ------------------------------------------------------------------ *
+ * How it is wired
+ * ------------------------------------------------------------------ */
+
+const server = fs.readFileSync(path.join(__dirname, '..', '..', 'server.js'), 'utf8');
+
+test('both ways are offered on every settings file, and fields is the default', () => {
+  assert.match(server, /function settingsModesHtml\(file, raw\)/);
+  assert.match(server, /'Fields', !raw/);
+  assert.match(server, /'Raw YAML', raw/);
+  assert.match(server, /\?raw=1/);
+  assert.match(server, /const raw = new URL\(req\.url, 'http:\/\/localhost'\)\.searchParams\.get\('raw'\) === '1';/);
+});
+
+test('the raw save carries the mtime, and is refused when the file changed underneath', () => {
+  assert.match(server, /if \(String\(form\.mtime \|\| ''\) !== String\(mtime\)\) \{/);
+  assert.match(server, /That file changed since this editor was opened — nothing was written/);
+  assert.match(server, /, 409\)/);
+});
+
+test('a refusal keeps what was typed', () => {
+  assert.match(server, /a refusal that threw away what was typed would be worse/);
+  assert.match(server, /settingsRawHtml\(file, `<div class="msg error">\$\{esc\(result\.error\)\}/);
+});
+
+test('only a settings file can be written this way', () => {
+  const block = server.slice(server.indexOf("pathname === '/actions/save-settings-raw'"), server.indexOf("pathname === '/actions/save-settings'"));
+  assert.match(block, /if \(!SETTINGS_FILE_RE\.test\(file\)\)/);
+  assert.match(block, /Ambiguous request/, 'a duplicated file field is refused rather than guessed at');
+});
+
+test('the action is logged once, by the central audit, so no secret reaches the log twice', () => {
+  assert.match(server, /No audit\(\) call: every action is already logged centrally/);
+});

package/core/workspace-app/tests/unit/shared-prefs.test.js

@@ -0,0 +1,49 @@
+/**
+ * One dashboard, one set of preferences.
+ *
+ * The theme, the rail, the assistant's view and whether it is open are per PERSON, not per workspace —
+ * but they lived in localStorage, which is per-origin, and this dashboard spans <workspace>.<hub>
+ * subdomains. So the theme was a different theme on /dev than on modules.workspace…, with no way to
+ * set it once. The lists' page-size cookie already had to be scoped to the hub for the same reason.
+ */
+
+const assert = require('node:assert');
+const { test } = require('node:test');
+const fs = require('fs');
+const path = require('path');
+
+const app = path.join(__dirname, '..', '..');
+const server = fs.readFileSync(path.join(app, 'server.js'), 'utf8');
+const ui = fs.readFileSync(path.join(app, 'public', 'ui.js'), 'utf8');
+const head = server.slice(server.indexOf('window.wsPref='), server.indexOf('</script>'));
+
+test('the preference helpers are in the head, so the first paint can read them', () => {
+  assert.match(head, /window\.wsPref\s*=\s*function\(name,fallback\)/);
+  assert.match(head, /window\.wsPrefSet\s*=\s*function\(name,value\)/);
+  // The pre-paint script is what applies the theme and the rail; reading a preference there is the
+  // whole point, since doing it later shows the wrong one for a frame.
+  assert.ok(server.indexOf('window.wsPref=') < server.indexOf("wsPref('ws-theme'"), 'defined before it is used');
+});
+
+test('a preference is written to a cookie on the HUB domain', () => {
+  assert.match(head, /document\.cookie=name\+'='\+encodeURIComponent\(value\)\+'; Path=\/; Domain=\.\$\{hubDomain\(\)\}/,
+    'not the page host: a cookie on dev.workspace… would be the same bug in another form');
+  assert.match(head, /Max-Age=31536000/, 'a preference outlives the tab');
+  assert.match(head, /SameSite=Lax/);
+});
+
+test('localStorage stays as the fallback, so a browser that set one before is not reset', () => {
+  assert.match(head, /var ls=localStorage\.getItem\(name\);/);
+  assert.match(head, /if\(ls!==null\)return ls;/);
+  // The cookie is read FIRST, or a stale per-origin value would keep winning on that subdomain.
+  assert.ok(head.indexOf('document.cookie.match') < head.indexOf('localStorage.getItem'), 'cookie first');
+  assert.match(head, /try\{localStorage\.setItem\(name,value\);\}catch\(e\)\{\}/, 'and both are written');
+});
+
+test('nothing writes these preferences straight to localStorage any more', () => {
+  for (const key of ['ws-theme', 'actions-collapsed', 'ws-assistant-view', 'ws-assistant-open', 'ws-page-width']) {
+    assert.ok(!new RegExp(`localStorage\\.setItem\\('${key}'`).test(ui), `${key} must go through wsPrefSet`);
+    assert.ok(!new RegExp(`localStorage\\.getItem\\('${key}'`).test(ui), `${key} must be read with wsPref`);
+    assert.ok(!new RegExp(`localStorage\\.getItem\\('${key}'`).test(server), `${key} must be read with wsPref`);
+  }
+});

package/core/workspace-app/tests/unit/speech.test.js

@@ -0,0 +1,290 @@
+/**
+ * The voice config the assistant panel is handed.
+ *
+ * Every case here guards a failure that is SILENT at runtime: deep-chat ignores a key it does not
+ * recognise and accepts one it does, so a wrong shape produces no error, no warning and no visible
+ * difference until someone dictates a sentence and the message sends itself.
+ */
+
+'use strict';
+
+const test = require('node:test');
+const assert = require('node:assert');
+
+const { assistantSettings, assistantIdentity, speechToTextConfig, textToSpeechConfig, panelConfig } = require('../../speech');
+
+const of = (assistant) => panelConfig({ assistant });
+
+test('with nothing configured, the recogniser is pinned to en-US', () => {
+  // en-US ships as the default rather than the browser's language: most dictation here is English,
+  // and a browser set to something else was silently recognising the wrong one.
+  const { speechToText } = of({});
+  assert.deepStrictEqual(speechToText.webSpeech, { language: 'en-US' });
+  assert.strictEqual(speechToText.displayInterimResults, true);
+  assert.strictEqual(speechToText.stopAfterSubmit, true);
+  assert.strictEqual(speechToText.submitAfterSilence, 2500);
+});
+
+test('a language pins the recogniser — the setting that decides whether dictation works at all', () => {
+  // Left on the wrong language, web speech does not fail: it returns confident nonsense.
+  const { speechToText, textToSpeech } = of({ speech_language: 'ar-JO' });
+  assert.deepStrictEqual(speechToText.webSpeech, { language: 'ar-JO' });
+  // And the reply is spoken in the language it was asked in, without setting it twice.
+  assert.strictEqual(textToSpeech.lang, 'ar-JO');
+});
+
+test('no commands are sent when none are configured', () => {
+  // The key must be ABSENT. An empty `commands` object is not "no commands" to deep-chat.
+  assert.ok(!('commands' in of({}).speechToText));
+});
+
+test('only the commands actually given a phrase are sent', () => {
+  const { speechToText } = of({ command_submit: 'send it', command_clear: '  ', command_stop: 'halt' });
+  assert.deepStrictEqual(speechToText.commands, {
+    submit: 'send it',
+    stop: 'halt',
+    settings: { substrings: false, caseSensitive: false },
+  });
+  // A whitespace-only phrase is not a command; it would arm on almost anything.
+  assert.ok(!('removeAllText' in speechToText.commands));
+});
+
+test('substring matching is off, so a command word inside a sentence does not fire', () => {
+  // deep-chat defaults this to true: "submit the form" would send the message mid-sentence.
+  const { speechToText } = of({ command_submit: 'submit' });
+  assert.strictEqual(speechToText.commands.settings.substrings, false);
+});
+
+test('submit-after-silence of 0 removes the key rather than sending zero', () => {
+  // 0 means "never send for me". deep-chat wants the key absent for that; zero would be read as
+  // "submit immediately", which sends a half-dictated sentence.
+  assert.ok(!('submitAfterSilence' in of({ submit_after_silence: 0 }).speechToText));
+});
+
+test('voice off removes the microphone rather than leaving a dead button', () => {
+  assert.strictEqual(of({ voice_input: false }).speechToText, false);
+  assert.strictEqual(of({ voice_output: false }).textToSpeech, false);
+});
+
+test('a voice name is passed only when set, so an empty one cannot silence the reply', () => {
+  assert.ok(!('voiceName' in of({}).textToSpeech));
+  assert.strictEqual(of({ voice_name: 'Google US English' }).textToSpeech.voiceName, 'Google US English');
+});
+
+test('rate, pitch and volume carry through', () => {
+  const { textToSpeech } = of({ speech_rate: 1.25, speech_pitch: 0.9, speech_volume: 0.5 });
+  assert.strictEqual(textToSpeech.rate, 1.25);
+  assert.strictEqual(textToSpeech.pitch, 0.9);
+  assert.strictEqual(textToSpeech.volume, 0.5);
+});
+
+test('speech colours are tokens, so both themes follow', () => {
+  const { textColor } = of({}).speechToText;
+  assert.match(textColor.interim, /^var\(--/);
+  assert.match(textColor.final, /^var\(--/);
+});
+
+test('the microphone button is styled in all three states', () => {
+  const { button } = of({}).speechToText;
+  for (const state of ['default', 'active', 'commandMode']) {
+    assert.ok(button[state], `the ${state} microphone state has no styling`);
+  }
+});
+
+test('Azure is never configured — its audio leaves the machine', () => {
+  const all = JSON.stringify(of({ speech_language: 'ar-JO', command_submit: 'go' }));
+  assert.ok(!/azure/i.test(all));
+});
+
+test('strings survive a YAML round trip as "false" and as numbers', () => {
+  // parse_yaml hands values back as strings, so `voice_input: false` arrives as the STRING "false".
+  assert.strictEqual(assistantSettings({ assistant: { voice_input: 'false' } }).voiceInput, false);
+  assert.strictEqual(assistantSettings({ assistant: { speech_rate: '1.5' } }).speechRate, 1.5);
+});
+
+test('a nonsense number falls back rather than reaching the browser', () => {
+  assert.strictEqual(assistantSettings({ assistant: { speech_rate: 'quickly' } }).speechRate, 1);
+});
+
+test('the two builders can be used on their own', () => {
+  const cfg = assistantSettings({ assistant: { voice_name: 'X' } });
+  assert.ok(speechToTextConfig(cfg).webSpeech);
+  assert.strictEqual(textToSpeechConfig(cfg).voiceName, 'X');
+});
+
+test('the words for "not set" all resolve to nothing, so no row in settings.yml is empty', () => {
+  // `speech_language: ""` reads as a setting somebody forgot to finish. The file says a word.
+  for (const word of ['auto', 'default', 'off', 'none', 'browser', 'AUTO', 'Off']) {
+    const { speechToText, textToSpeech } = of({
+      speech_language: word, voice_name: word, command_submit: word,
+    });
+    assert.strictEqual(speechToText.webSpeech, true, `${word} pinned a language`);  // auto = browser
+    assert.ok(!('commands' in speechToText), `${word} armed a voice command`);
+    assert.ok(!('voiceName' in textToSpeech), `${word} was used as a voice name`);
+  }
+});
+
+test('the field microphones get the same language as the assistant', () => {
+  // Before this they were pinned to document.documentElement.lang and ignored the setting, so
+  // 35 microphones stayed on English while the assistant moved.
+  const { fieldMic, speechToText } = of({ speech_language: 'ar-JO' });
+  assert.strictEqual(fieldMic.lang, 'ar-JO');
+  assert.strictEqual(speechToText.webSpeech.language, 'ar-JO');
+});
+
+test('turning the microphone off removes the field mics too', () => {
+  assert.strictEqual(of({ voice_input: false }).fieldMic, false);
+});
+
+test('every offered language is a usable BCP-47 tag, and "follow the browser" stays reachable', () => {
+  const { LANGUAGES } = require('../../speech');
+  assert.strictEqual(LANGUAGES[0][0], 'auto', 'the browser default must be the first option');
+  for (const [code, label] of LANGUAGES.slice(1)) {
+    assert.match(code, /^[a-z]{2}-[A-Z]{2}$/, `${code} is not a BCP-47 tag`);
+    assert.ok(label.length > 3, `${code} has no readable label`);
+  }
+});
+
+test('a voice command is a checkbox: true listens for the command\'s own word', () => {
+  // A text box holding `off` asked people to type a phrase when what they wanted was to switch
+  // something on. `true` means "listen for the obvious word".
+  const { speechToText } = of({ command_stop: true, command_submit: true });
+  assert.strictEqual(speechToText.commands.stop, 'stop');
+  assert.strictEqual(speechToText.commands.submit, 'submit');
+});
+
+test('a phrase of your own still works — the only way to have one in another language', () => {
+  const { speechToText } = of({ command_stop: 'توقف' });
+  assert.strictEqual(speechToText.commands.stop, 'توقف');
+});
+
+test('false and off both mean no command, so the old spelling keeps working', () => {
+  for (const v of [false, 'false', 'off', 'no']) {
+    assert.ok(!('commands' in of({ command_stop: v }).speechToText), `${v} armed a command`);
+  }
+});
+
+test('the language dropdown is fed from the module, so the form and the resolver cannot disagree', () => {
+  // settings.labels.yml says `options: from:speech-languages` rather than repeating the list. A copy
+  // there would drift from the one the resolver validates against, and the drift would be invisible.
+  const fs = require('fs');
+  const path = require('path');
+  // CONFIG_DIR, not a relative walk: the app runs from /var/www/html inside its container, so
+  // ../../.. lands outside the tree and the file is simply not found.
+  const { CONFIG_DIR } = require('../../workspaces');
+  const labels = fs.readFileSync(path.join(CONFIG_DIR, 'settings.labels.yml'), 'utf8');
+  assert.match(labels, /options:\s*["']?from:speech-languages/,
+    'the language options are spelled out in the labels file instead of coming from speech.js');
+});
+
+test('a command describes itself, and shell variables in that description are resolved', () => {
+  // Read from the script, not from a list beside it: 218 of the 239 commands already carry an
+  // ARGPARSE_DESCRIPTION, and a second copy would be wrong the first time somebody edited a command
+  // without knowing the copy existed.
+  const { commandDescription } = require('../../workspaces');
+  const path = require('path');
+  const { ROOT } = require('../../workspaces');
+
+  const built = commandDescription(path.join(ROOT, 'dev'), 'cmd-webship11-0-x-project.sh');
+  assert.ok(built, 'a builder with ARGPARSE_DESCRIPTION described itself as nothing');
+  // `Build a ${distribution_title} ${site_version} project` must not reach a person raw.
+  assert.ok(!/\$\{|\$[a-zA-Z_]/.test(built), `an unresolved variable is shown: "${built}"`);
+});
+
+test('a command with no description at all returns empty rather than throwing', () => {
+  const { commandDescription } = require('../../workspaces');
+  assert.strictEqual(commandDescription('/nonexistent', 'cmd-nope.sh'), '');
+});
+
+test('a command title is short, and a builder keeps its product name however long', () => {
+  const { commandTitle, ROOT } = require('../../workspaces');
+  const path = require('path');
+
+  // Derived from the file name when nothing brief is declared: cmd-tools-reclaim.sh -> "Reclaim".
+  assert.strictEqual(commandTitle(path.join(ROOT, 'products'), 'cmd-tools-reclaim.sh'), 'Reclaim');
+
+  // A builder's `# workspace-name:` is a PRODUCT name, not a sentence, so it survives at any length.
+  const builder = commandTitle(path.join(ROOT, 'site-templates'), 'cmd-website_starter-1-0-x-project.sh');
+  assert.match(builder, /Website Starter/, `a builder lost its product name: "${builder}"`);
+
+  // A tools command using that header as free text gets a short derived title instead, because the
+  // declared one repeats the description underneath it.
+  const tools = commandTitle(path.join(ROOT, 'products'), 'cmd-tools-graphify.sh');
+  assert.ok(tools.split(/\s+/).length <= 4, `title is not short: "${tools}"`);
+});
+
+test('every command in every workspace folder has a description', () => {
+  const { commandDescription, ROOT } = require('../../workspaces');
+  const fs = require('fs');
+  const path = require('path');
+  const missing = [];
+  for (const d of fs.readdirSync(ROOT)) {
+    let files = [];
+    try { files = fs.readdirSync(path.join(ROOT, d)).filter((f) => /^cmd-.*\.sh$/.test(f)); } catch (_) { continue; }
+    for (const f of files) if (!commandDescription(path.join(ROOT, d), f)) missing.push(`${d}/${f}`);
+  }
+  assert.deepStrictEqual(missing, [], 'these commands describe themselves as nothing');
+});
+
+
+/* ---------- what the assistant is CALLED, and what its composer says ---------- */
+
+// One dashboard, twenty-four workspaces, one assistant whose conversation follows you between them.
+// The name and the placeholder are configuration at two levels: settings.yml for the home dashboard
+// and everything unscoped, and a workspace's own file for its page. The rule is the same at each
+// level — say nothing and you inherit — so shipping the keys in every workspace file costs nothing.
+
+const id = (global, own) => assistantIdentity({ assistant: global }, own ? { assistant: own } : null);
+
+test('with nothing configured it is the AI Assistant, and the composer says nothing', () => {
+  assert.deepStrictEqual(assistantIdentity(), { name: 'AI Assistant', placeholder: '' });
+  // An empty field with a cursor in it already says "type here", and a prompt that suggests what to
+  // ask narrows what gets asked. The empty string still has to REACH deep-chat: left unset, the
+  // component renders its own library placeholder about `connect` and the demo property.
+  assert.strictEqual(panelConfig().placeholder, '');
+  assert.strictEqual(panelConfig().name, 'AI Assistant');
+});
+
+test('a workspace renames its assistant for its own page and nowhere else', () => {
+  assert.deepStrictEqual(id({ name: 'AI Assistant' }, { name: 'Design Assistant' }),
+    { name: 'Design Assistant', placeholder: '' });
+  // …and the global one is untouched by it, which is the half a per-page override gets wrong.
+  assert.strictEqual(id({ name: 'AI Assistant' }).name, 'AI Assistant');
+});
+
+test('saying nothing means inherit, at either level', () => {
+  // The whole reason every workspace file can ship `name: default`: twenty-four pinned copies of
+  // the name would make a rename in settings.yml reach nothing.
+  for (const unset of ['default', 'auto', 'none', 'off', '', undefined]) {
+    assert.strictEqual(id({ name: 'Studio' }, { name: unset }).name, 'Studio', `own: ${unset}`);
+    assert.strictEqual(id({ placeholder: 'Ask me…' }, { placeholder: unset }).placeholder, 'Ask me…');
+  }
+  // And an unset GLOBAL falls through to what ships, rather than to an empty heading.
+  assert.strictEqual(id({ name: 'none' }).name, 'AI Assistant');
+});
+
+test('a placeholder is a real string, whichever level set it', () => {
+  assert.strictEqual(id({ placeholder: 'Ask about the workspace…' }).placeholder, 'Ask about the workspace…');
+  assert.strictEqual(id({}, { placeholder: 'Ask about the Penpot instances…' }).placeholder,
+    'Ask about the Penpot instances…');
+});
+
+test('the identity travels with the panel config, so the page is handed one object', () => {
+  const cfg = panelConfig({ assistant: { name: 'Studio', placeholder: 'Ask…' } });
+  assert.strictEqual(cfg.name, 'Studio');
+  assert.strictEqual(cfg.placeholder, 'Ask…');
+  // Still the voice config it always was: the identity is added to it, not instead of it.
+  assert.ok(cfg.speechToText, 'the microphone survives');
+});
+
+test('the avatar is Druplicon unless it is none, and the memory folder never leaves the workspace tree', () => {
+  assert.strictEqual(assistantSettings({}).avatar, 'druplicon');
+  assert.strictEqual(assistantSettings({ assistant: { avatar: 'none' } }).avatar, 'none');
+  assert.strictEqual(assistantSettings({ assistant: { avatar: 'clippy' } }).avatar, 'druplicon');
+  assert.strictEqual(panelConfig({ assistant: { avatar: 'none' } }).avatar, 'none');
+  assert.strictEqual(assistantSettings({}).memory, 'core/workspace-app/.memory');
+  assert.strictEqual(assistantSettings({ assistant: { memory: 'docs/team-memory' } }).memory, 'docs/team-memory');
+  for (const bad of ['../outside', '/etc', 'docs/../../x', 'a b', '']) {
+    assert.strictEqual(assistantSettings({ assistant: { memory: bad } }).memory, 'core/workspace-app/.memory', bad);
+  }
+});

package/core/workspace-app/tests/unit/static-caching.test.js

@@ -0,0 +1,39 @@
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+
+const APP = path.join(__dirname, '..', '..');
+const src = fs.readFileSync(path.join(APP, 'server.js'), 'utf8');
+const serveStatic = src.slice(src.indexOf('function serveStatic'), src.indexOf('function serveStatic') + 2600);
+
+// Static assets were served with a Content-Type and nothing else: no Cache-Control, no ETag, no
+// Last-Modified. With no validator a browser has nothing to revalidate against, so it refetched
+// them — 300 KB gzipped per visit, the 1.4 MB Tabler sprite included. A repeat visit now costs
+// zero bytes. None of that is visible in the UI, which is why it needs a test.
+test('static assets carry a validator and a cache policy', () => {
+  for (const h of ['ETag', 'Last-Modified', 'Cache-Control']) {
+    assert.ok(serveStatic.includes(h), `serveStatic no longer sets ${h}`);
+  }
+});
+
+test('a versioned URL is immutable, an unversioned one revalidates', () => {
+  // assetUrl appends ?v=<mtime>, so when the file changes the URL changes and a stale copy is
+  // unreachable rather than merely old. Anything without that must not be frozen for a year.
+  assert.ok(serveStatic.includes('immutable'), 'versioned assets are no longer immutable');
+  assert.ok(serveStatic.includes('must-revalidate'), 'unversioned assets no longer revalidate');
+  assert.match(serveStatic, /\[?\?&\]v=|v=/, 'no longer distinguishes versioned URLs');
+});
+
+test('a conditional request is answered 304 with no body', () => {
+  assert.ok(serveStatic.includes('304'), 'conditional requests are no longer answered 304');
+  assert.ok(/if-none-match/i.test(serveStatic), 'If-None-Match is no longer honoured');
+  assert.ok(/if-modified-since/i.test(serveStatic), 'If-Modified-Since is no longer honoured');
+});
+
+test('HEAD is routed with GET, and sends no body', () => {
+  // HEAD used to fall through to 405, which broke curl -I and any uptime check.
+  assert.match(src, /req\.method === 'GET' \|\| req\.method === 'HEAD'/,
+    'HEAD is no longer routed with GET');
+  assert.ok(serveStatic.includes("req.method === 'HEAD'"), 'serveStatic no longer skips the body for HEAD');
+});

package/core/workspace-app/tests/unit/status-language.test.js

@@ -0,0 +1,47 @@
+/**
+ * Status chips say what they mean.
+ *
+ * Found by the local webship-ai-ux-designer agent reviewing the live pages: an agent that had stopped to ask a
+ * question was labelled "agent running", the same words as one that was working (the difference was an amber
+ * colour, an emoji and a tooltip); a Stopped site took the same brand blue as the agent chip and was the loudest
+ * chip on its card; an attached session took the same amber as "waiting for you".
+ */
+
+const { test } = require('node:test');
+const assert = require('node:assert');
+const fs = require('fs');
+const path = require('path');
+
+const read = (f) => fs.readFileSync(path.join(__dirname, '..', '..', f), 'utf8');
+const server = read('server.js');
+const screens = read('screens.js');
+const css = read('public/css/components/project-rows.css');
+
+test('the agent chip says working, or waiting for you, in words', () => {
+  assert.match(server, /\$\{agentWaiting \? 'waiting for you' : 'agent working'\}/);
+  assert.ok(!/agent running\$\{/.test(server), 'the chip no longer says running');
+});
+
+test('the toolbar says how many are waiting, not only a hand', () => {
+  assert.match(server, /">✋ \$\{waiting\.length\} waiting<\/span>`/);
+});
+
+test('a stopped site is a quiet outline, a running one is green, and the dot is drawn by CSS', () => {
+  assert.match(server, /running: 'Running', paused: 'Paused', stopped: 'Stopped'/);
+  assert.match(server, /st === 'running' \? 'uk-label-success' : `state-chip-off state-chip-\$\{st\}`/);
+  assert.match(server, /<span class="state-dot" aria-hidden="true"><\/span><span class="state-word">/);
+  assert.ok(!/🟢 Running|⚪ \$\{/.test(server), 'no emoji: each machine draws them differently');
+  assert.match(css, /\.uk-label\.state-chip-off \{\s*background: transparent;\s*color: var\(--text-subtle\);\s*border: 1px solid var\(--line\);/);
+});
+
+test('on Screens, waiting names what it waits for, and an attached session is not amber', () => {
+  assert.match(screens, /✋ Waiting for you · \$\{esc\(ask\)\}/);
+  assert.match(screens, /replace\(\/\^waiting \(on\|for\) \/, ''\)/);
+  assert.match(screens, /attached \? 'screen-state-attached' : 'uk-label-success'/);
+  assert.match(css, /\.uk-label\.screen-state-attached \{\s*background: transparent;/);
+});
+
+test('the button that removes ended sessions says so', () => {
+  assert.match(screens, /Remove ended sessions<\/button>/);
+  assert.ok(!/Wipe dead<\/button>/.test(screens));
+});