@wenrwa/marketplace-cli 0.8.7 → 0.8.9

package/dist/__tests__/bridge-env-names.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-env-names.test.js

@@ -0,0 +1,243 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * tp-02 (docs/prd/team-preview.md story 39) — the Keys list reads key NAMES
+ * from a workspace's `.env`, never the values. Both lanes:
+ *   - hosted: relay `env-names` frame → `env-names-result` (requestId echoed)
+ *   - local:  GET /local-env-names/:workspaceId on the loopback bridge
+ * Every test runs a real `.env` fixture on disk and asserts the bytes that
+ * actually leave the bridge.
+ */
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const ws_1 = require("ws");
+const envNames_1 = require("../bridge/envNames");
+const relayClient_1 = require("../bridge/relayClient");
+const server_1 = require("../bridge/server");
+const sessionManager_1 = require("../bridge/sessionManager");
+class FakePty {
+    write() { }
+    resize() { }
+    kill() { }
+    onData() { }
+    onExit() { }
+}
+const factory = { spawn: () => new FakePty() };
+const SECRET = 'sk_live_9f8e7d6c5b4a';
+const PUBLIC_VALUE = 'pk_test_visible_x';
+function fixtureRoot(envText) {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'tp02-env-'));
+    if (envText !== null)
+        fs.writeFileSync(path.join(root, '.env'), envText);
+    return root;
+}
+const FIXTURE = [
+    '# my keys',
+    `FOO=${SECRET}`,
+    `export NEXT_PUBLIC_BAR="${PUBLIC_VALUE}"`,
+    'not a line',
+    '',
+].join('\n');
+function assertNoValueBytes(raw) {
+    expect(raw).not.toContain(SECRET);
+    expect(raw).not.toContain(PUBLIC_VALUE);
+    expect(raw).not.toContain('sk_live');
+}
+describe('readEnvNames (tp-02)', () => {
+    it('a .env with FOO=secret and NEXT_PUBLIC_BAR=x yields ["FOO","NEXT_PUBLIC_BAR"] and no value', () => {
+        const root = fixtureRoot(FIXTURE);
+        const result = (0, envNames_1.readEnvNames)(root);
+        expect(result).toEqual({ ok: true, names: ['FOO', 'NEXT_PUBLIC_BAR'] });
+        assertNoValueBytes(JSON.stringify(result));
+    });
+    it('no .env yet → an empty list, not an error', () => {
+        expect((0, envNames_1.readEnvNames)(fixtureRoot(null))).toEqual({ ok: true, names: [] });
+    });
+    it('no folder → a typed refusal', () => {
+        expect((0, envNames_1.readEnvNames)(null)).toEqual({ ok: false, reason: 'no-folder' });
+    });
+    it('a symlinked .env is not followed', () => {
+        const elsewhere = fixtureRoot(FIXTURE);
+        const root = fixtureRoot(null);
+        fs.symlinkSync(path.join(elsewhere, '.env'), path.join(root, '.env'));
+        expect((0, envNames_1.readEnvNames)(root)).toEqual({ ok: false, reason: 'not-a-file' });
+    });
+    it('duplicate names are listed once, sorted', () => {
+        const root = fixtureRoot('ZED=1\nALPHA=2\nZED=3\n');
+        expect((0, envNames_1.readEnvNames)(root)).toEqual({ ok: true, names: ['ALPHA', 'ZED'] });
+    });
+});
+describe('handleEnvNamesFrame (tp-02)', () => {
+    it('echoes requestId + workspaceId and carries names only', () => {
+        const root = fixtureRoot(FIXTURE);
+        const reply = (0, envNames_1.handleEnvNamesFrame)({ requestId: 'en-1', workspaceId: 'ws-1' }, (id) => (id === 'ws-1' ? root : null));
+        expect(reply).toEqual({ t: 'env-names-result', requestId: 'en-1', workspaceId: 'ws-1', ok: true, names: ['FOO', 'NEXT_PUBLIC_BAR'] });
+        assertNoValueBytes(JSON.stringify(reply));
+    });
+    it('an unresolvable workspace → typed refusal with requestId (never a hang)', () => {
+        const reply = (0, envNames_1.handleEnvNamesFrame)({ requestId: 'en-2', workspaceId: '../etc' }, () => null);
+        expect(reply).toEqual({ t: 'env-names-result', requestId: 'en-2', workspaceId: '../etc', ok: false, reason: 'no-folder' });
+    });
+});
+// ── hosted lane: the relay frame ────────────────────────────────────────────
+function frameQueue(ws) {
+    const frames = [];
+    const waiters = [];
+    ws.on('message', (raw) => {
+        const s = String(raw);
+        const w = waiters.shift();
+        if (w)
+            w(s);
+        else
+            frames.push(s);
+    });
+    return {
+        nextRaw: () => frames.length > 0 ? Promise.resolve(frames.shift()) : new Promise((r) => waiters.push(r)),
+    };
+}
+function startFakeRelay() {
+    return new Promise((resolve) => {
+        const wss = new ws_1.WebSocketServer({ port: 0, host: '127.0.0.1' });
+        const queue = [];
+        const waiters = [];
+        wss.on('connection', (ws) => { const w = waiters.shift(); if (w)
+            w(ws);
+        else
+            queue.push(ws); });
+        wss.on('listening', () => {
+            const addr = wss.address();
+            const port = typeof addr === 'object' && addr ? addr.port : 0;
+            resolve({ wss, port, nextConnection: () => (queue.length > 0 ? Promise.resolve(queue.shift()) : new Promise((r) => waiters.push(r))) });
+        });
+    });
+}
+function closeRelay(wss) {
+    return new Promise((resolve, reject) => {
+        for (const client of wss.clients)
+            client.terminate();
+        wss.close((err) => (err ? reject(err) : resolve()));
+    });
+}
+describe('relay client — env-names frame (tp-02, hosted lane)', () => {
+    it('replies env-names-result with the names; no value byte is on the wire', async () => {
+        const root = fixtureRoot(FIXTURE);
+        const relay = await startFakeRelay();
+        const sessions = new sessionManager_1.SessionManager(factory);
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions,
+            resolveEnvNamesRoot: (workspaceId) => (workspaceId === 'ws-7' ? root : null),
+        });
+        const ws = await relay.nextConnection();
+        const q = frameQueue(ws);
+        await q.nextRaw(); // auth
+        ws.send(JSON.stringify({ t: 'env-names', requestId: 'req-1', workspaceId: 'ws-7' }));
+        const raw = await q.nextRaw();
+        expect(JSON.parse(raw)).toEqual({ t: 'env-names-result', requestId: 'req-1', workspaceId: 'ws-7', ok: true, names: ['FOO', 'NEXT_PUBLIC_BAR'] });
+        assertNoValueBytes(raw);
+        // A file read, never a PTY.
+        expect(sessions.list()).toEqual([]);
+        handle.close();
+        await closeRelay(relay.wss);
+    });
+    it('a bridge without the reader wired replies a typed refusal echoing requestId', async () => {
+        const relay = await startFakeRelay();
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions: new sessionManager_1.SessionManager(factory),
+        });
+        const ws = await relay.nextConnection();
+        const q = frameQueue(ws);
+        await q.nextRaw(); // auth
+        ws.send(JSON.stringify({ t: 'env-names', requestId: 'req-2', workspaceId: 'ws-7' }));
+        expect(JSON.parse(await q.nextRaw())).toEqual({
+            t: 'env-names-result', requestId: 'req-2', workspaceId: 'ws-7', ok: false, reason: 'bridge-cannot-read-env-names',
+        });
+        handle.close();
+        await closeRelay(relay.wss);
+    });
+});
+// ── local lane: the loopback route ──────────────────────────────────────────
+const ORIGIN = 'https://app.hiveop.io';
+const TOKEN = 'session-token-123';
+describe('bridge HTTP server — GET /local-env-names/:workspaceId (tp-02, local lane)', () => {
+    let handle;
+    afterEach(async () => { await handle.close(); });
+    const start = (root) => (0, server_1.startBridgeServer)({
+        sessionToken: TOKEN,
+        allowedOrigin: ORIGIN,
+        sessions: new sessionManager_1.SessionManager(factory),
+        resolveEnvNamesRoot: (workspaceId) => (workspaceId === 'ws-1' ? root : null),
+    });
+    const get = (workspaceId, opts = {}) => fetch(`http://127.0.0.1:${handle.port}/local-env-names/${workspaceId}${opts.token !== undefined ? `?token=${opts.token}` : ''}`, { headers: { origin: opts.origin ?? ORIGIN } });
+    it('returns the names for a registered workspace; no value byte in the body', async () => {
+        handle = await start(fixtureRoot(FIXTURE));
+        const res = await get('ws-1', { token: TOKEN });
+        expect(res.status).toBe(200);
+        expect(res.headers.get('access-control-allow-origin')).toBe(ORIGIN);
+        const raw = await res.text();
+        expect(JSON.parse(raw)).toEqual({ names: ['FOO', 'NEXT_PUBLIC_BAR'] });
+        assertNoValueBytes(raw);
+    });
+    it('401 without the session token, 403 from a foreign origin', async () => {
+        handle = await start(fixtureRoot(FIXTURE));
+        expect((await get('ws-1')).status).toBe(401);
+        expect((await get('ws-1', { token: 'nope' })).status).toBe(401);
+        expect((await get('ws-1', { token: TOKEN, origin: 'https://evil.example' })).status).toBe(403);
+    });
+    it('404 for a workspace not registered on this device', async () => {
+        handle = await start(fixtureRoot(FIXTURE));
+        expect((await get('ws-other', { token: TOKEN })).status).toBe(404);
+    });
+    it('answers the Private-Network preflight', async () => {
+        handle = await start(fixtureRoot(FIXTURE));
+        const res = await fetch(`http://127.0.0.1:${handle.port}/local-env-names/ws-1`, {
+            method: 'OPTIONS',
+            headers: { origin: ORIGIN },
+        });
+        expect(res.status).toBe(204);
+        expect(res.headers.get('access-control-allow-private-network')).toBe('true');
+    });
+    it('/discovery advertises the env-names capability when wired', async () => {
+        handle = await start(fixtureRoot(FIXTURE));
+        const res = await fetch(`http://127.0.0.1:${handle.port}/discovery`, { headers: { origin: ORIGIN } });
+        const body = await res.json();
+        expect(body.capabilities).toContain('env-names');
+    });
+});

package/dist/__tests__/bridge-preview-checkout.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/bridge-preview-checkout.test.js

@@ -0,0 +1,294 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * tp-05 — the Team preview checkout on the owner's hosted machine, against a
+ * REAL git fixture and REAL child processes (docs/prd/team-preview.md
+ * module 5, ADR-0014).
+ *
+ * The fixture: a bare "remote", the owner's working copy cloned from it (with
+ * a gitignored `.env` and, in one test, an uncommitted edit), and a tiny
+ * package whose `build` copies message.txt into dist/ (or fails when
+ * BREAK_BUILD exists) and whose `start` serves dist/ plus two env values on
+ * PORT. Every server is stopped by exact PID in teardown (runner.shutdown).
+ */
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const http = __importStar(require("http"));
+const net = __importStar(require("net"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const previewCheckout_1 = require("../bridge/previewCheckout");
+jest.setTimeout(120_000);
+function git(cwd, ...args) {
+    return (0, child_process_1.execFileSync)('git', args, {
+        cwd,
+        encoding: 'utf8',
+        env: { ...process.env, GIT_AUTHOR_NAME: 't', GIT_AUTHOR_EMAIL: 't@t', GIT_COMMITTER_NAME: 't', GIT_COMMITTER_EMAIL: 't@t' },
+    });
+}
+function freePort() {
+    return new Promise((resolve) => {
+        const srv = net.createServer();
+        srv.listen(0, '127.0.0.1', () => {
+            const port = srv.address().port;
+            srv.close(() => resolve(port));
+        });
+    });
+}
+function get(port) {
+    return new Promise((resolve, reject) => {
+        http.get({ host: '127.0.0.1', port, path: '/' }, (res) => {
+            let body = '';
+            res.on('data', (c) => (body += c));
+            res.on('end', () => resolve(body));
+        }).on('error', reject);
+    });
+}
+const BUILD_JS = `
+const fs = require('fs');
+if (fs.existsSync('BREAK_BUILD')) { console.error('build broke on purpose'); process.exit(1); }
+fs.mkdirSync('dist', { recursive: true });
+fs.copyFileSync('message.txt', 'dist/message.txt');
+`;
+const SERVER_JS = `
+const fs = require('fs');
+require('http').createServer((req, res) => {
+  res.end(JSON.stringify({
+    message: fs.readFileSync('dist/message.txt', 'utf8').trim(),
+    secret: process.env.OWNER_SECRET || null,
+    bridgeToken: process.env.WENRWA_CONNECT_TOKEN || null,
+    relayToken: process.env.RELAY_TOKEN || null,
+    gitToken: process.env.WENRWA_GIT_TOKEN || null,
+    port: process.env.PORT,
+  }));
+}).listen(Number(process.env.PORT), process.env.HOST);
+`;
+// A server that ignores HOST and listens on every interface.
+const WILD_SERVER_JS = `
+require('http').createServer((req, res) => res.end('exposed')).listen(Number(process.env.PORT));
+`;
+function makeFixture() {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'tp05-'));
+    const remote = path.join(root, 'remote.git');
+    const author = path.join(root, 'author');
+    git(root, 'init', '--bare', '-b', 'main', remote);
+    fs.mkdirSync(author);
+    git(author, 'init', '-b', 'main');
+    fs.writeFileSync(path.join(author, 'package.json'), JSON.stringify({
+        name: 'fx', version: '1.0.0', private: true,
+        scripts: { build: 'node build.js', start: 'node server.js', dev: 'node build.js && node server.js' },
+    }));
+    fs.writeFileSync(path.join(author, 'package-lock.json'), JSON.stringify({
+        name: 'fx', version: '1.0.0', lockfileVersion: 3, requires: true,
+        packages: { '': { name: 'fx', version: '1.0.0' } },
+    }));
+    fs.writeFileSync(path.join(author, 'build.js'), BUILD_JS);
+    fs.writeFileSync(path.join(author, 'server.js'), SERVER_JS);
+    fs.writeFileSync(path.join(author, 'server-wild.js'), WILD_SERVER_JS);
+    fs.writeFileSync(path.join(author, 'message.txt'), 'v1 from main\n');
+    fs.writeFileSync(path.join(author, '.gitignore'), '.env\ndist\nnode_modules\n');
+    git(author, 'add', '-A');
+    git(author, 'commit', '-m', 'v1');
+    git(author, 'remote', 'add', 'origin', remote);
+    git(author, 'push', 'origin', 'main');
+    // The owner's working copy: a separate clone with their gitignored .env.
+    const workingCopy = path.join(root, 'repos', 'ws-1');
+    fs.mkdirSync(path.dirname(workingCopy), { recursive: true });
+    git(root, 'clone', remote, workingCopy);
+    fs.writeFileSync(path.join(workingCopy, '.env'), 'OWNER_SECRET=sk_live_owner_value\n# a comment\nWENRWA_CONNECT_TOKEN=from-dotenv-refused\n');
+    return { root, remote, author, workingCopy, previews: path.join(root, 'previews') };
+}
+function pushChange(fx, files, msg) {
+    for (const [name, content] of Object.entries(files)) {
+        const p = path.join(fx.author, name);
+        if (content === null)
+            fs.rmSync(p, { force: true });
+        else
+            fs.writeFileSync(p, content);
+    }
+    git(fx.author, 'add', '-A');
+    git(fx.author, 'commit', '-m', msg);
+    git(fx.author, 'push', 'origin', 'main');
+    return git(fx.author, 'rev-parse', 'HEAD').trim();
+}
+describe('PreviewRunner (tp-05) — real git, real processes', () => {
+    let fx;
+    let port;
+    let runner;
+    beforeEach(async () => {
+        fx = makeFixture();
+        port = await freePort();
+        runner = new previewCheckout_1.PreviewRunner({
+            previewsBaseDir: fx.previews,
+            workingCopyDir: (ws) => path.join(fx.root, 'repos', ws),
+            port,
+            // The bridge's own env carries HiveOp credentials; none may reach the app.
+            baseEnv: { ...process.env, WENRWA_CONNECT_TOKEN: 'bridge-connect-token', RELAY_TOKEN: 'bridge-relay-token' },
+            readyTimeoutMs: { built: 20_000, dev: 20_000 },
+            probeIntervalMs: 100,
+            killGraceMs: 1_000,
+        });
+    });
+    afterEach(async () => {
+        await runner.shutdown();
+        fs.rmSync(fx.root, { recursive: true, force: true });
+    });
+    it("serves the start script on the preview port with the owner's .env, and none of the bridge's secrets", async () => {
+        const r = await runner.start({
+            workspaceId: 'ws-1',
+            repoUrl: fx.remote,
+            gitCredential: { token: 'git-token-must-not-reach-app', repoFullName: 'o/r' },
+        });
+        const head = git(fx.author, 'rev-parse', 'HEAD').trim();
+        expect(r).toMatchObject({ status: 'running', mode: 'built', sha: head, runningSha: head, builtSha: head });
+        const body = JSON.parse(await get(port));
+        expect(body).toEqual({
+            message: 'v1 from main',
+            secret: 'sk_live_owner_value',
+            bridgeToken: null,
+            relayToken: null,
+            gitToken: null,
+            port: String(port),
+        });
+        // A second start is answered as-is — no rebuild.
+        const again = await runner.start({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        expect(again).toMatchObject({ status: 'running', runningSha: head });
+    });
+    it("never shows an uncommitted edit from the owner's working copy, and a merge updates it", async () => {
+        fs.writeFileSync(path.join(fx.workingCopy, 'message.txt'), 'UNCOMMITTED owner edit\n');
+        fs.writeFileSync(path.join(fx.workingCopy, 'scratch.txt'), 'untracked\n');
+        await runner.start({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        expect(JSON.parse(await get(port)).message).toBe('v1 from main');
+        const v2 = pushChange(fx, { 'message.txt': 'v2 merged\n' }, 'v2');
+        const r = await runner.update({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        expect(r).toMatchObject({ status: 'running', sha: v2, runningSha: v2 });
+        expect(JSON.parse(await get(port)).message).toBe('v2 merged');
+        // The working copy itself was never touched.
+        expect(fs.readFileSync(path.join(fx.workingCopy, 'message.txt'), 'utf8')).toBe('UNCOMMITTED owner edit\n');
+        expect(fs.existsSync(path.join(fx.workingCopy, 'scratch.txt'))).toBe(true);
+        expect(git(fx.workingCopy, 'rev-parse', 'HEAD').trim()).not.toBe(v2);
+    });
+    it('a broken build keeps the old sha serving and reports build_failed', async () => {
+        const first = await runner.start({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        const v1 = first.runningSha;
+        const broken = pushChange(fx, { BREAK_BUILD: 'x', 'message.txt': 'v2 broken\n' }, 'broken');
+        const r = await runner.update({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        expect(r).toMatchObject({ status: 'build_failed', sha: broken, runningSha: v1, builtSha: v1 });
+        expect(JSON.parse(await get(port)).message).toBe('v1 from main');
+        // The log shows the failure, on an owner request.
+        expect(runner.logs({ workspaceId: 'ws-1' }).log).toContain('build broke on purpose');
+        // Fixing main brings the preview forward again.
+        const fixed = pushChange(fx, { BREAK_BUILD: null, 'message.txt': 'v3 fixed\n' }, 'fix');
+        expect(await runner.update({ workspaceId: 'ws-1', repoUrl: fx.remote })).toMatchObject({ status: 'running', runningSha: fixed });
+        expect(JSON.parse(await get(port)).message).toBe('v3 fixed');
+    });
+    it('pins to the remote default branch — another branch pushed to the remote never runs', async () => {
+        git(fx.author, 'checkout', '-b', 'feature');
+        fs.writeFileSync(path.join(fx.author, 'message.txt'), 'feature branch\n');
+        git(fx.author, 'commit', '-am', 'feature');
+        git(fx.author, 'push', 'origin', 'feature');
+        await runner.start({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        expect(JSON.parse(await get(port)).message).toBe('v1 from main');
+    });
+    it('stop frees the port; a second workspace cannot take the port while one serves', async () => {
+        await runner.start({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        const busy = await runner.start({ workspaceId: 'ws-2', repoUrl: fx.remote });
+        expect(busy).toMatchObject({ status: 'failed', reason: 'busy_other_workspace' });
+        expect(await runner.stop({ workspaceId: 'ws-1' })).toMatchObject({ status: 'stopped' });
+        await expect(get(port)).rejects.toThrow();
+    });
+    it('SECURITY: the app listens on 127.0.0.1 only — no other address of this machine reaches it', async () => {
+        const external = (0, previewCheckout_1.machineExternalAddresses)();
+        expect(external.length).toBeGreaterThan(0); // the check below must mean something
+        await runner.start({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        expect(JSON.parse(await get(port)).message).toBe('v1 from main');
+        expect(await (0, previewCheckout_1.listensBeyondLoopback)(port, external)).toBe(false);
+    });
+    it('SECURITY: an app that binds every interface is refused unsupported_bind, and the old version keeps serving', async () => {
+        const first = await runner.start({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        const wild = pushChange(fx, { 'package.json': JSON.stringify({
+                name: 'fx', version: '1.0.0', private: true,
+                scripts: { build: 'node build.js', start: 'node server-wild.js' },
+            }) }, 'wild bind');
+        const r = await runner.update({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        expect(r).toMatchObject({ status: 'failed', reason: 'unsupported_bind', sha: wild, runningSha: first.runningSha });
+        expect(JSON.parse(await get(port)).message).toBe('v1 from main');
+        expect(await (0, previewCheckout_1.listensBeyondLoopback)(port, (0, previewCheckout_1.machineExternalAddresses)())).toBe(false);
+    });
+    it('SECURITY: an exposed app with nothing to fall back to is refused and not left running', async () => {
+        pushChange(fx, { 'package.json': JSON.stringify({
+                name: 'fx', version: '1.0.0', private: true,
+                scripts: { start: 'node server-wild.js' },
+            }) }, 'wild bind');
+        const r = await runner.start({ workspaceId: 'ws-1', repoUrl: fx.remote });
+        expect(r).toMatchObject({ status: 'failed', reason: 'unsupported_bind' });
+        expect(r.runningSha).toBeUndefined();
+        await expect(get(port)).rejects.toThrow();
+    });
+    it('a git failure reports failed / git_failed without starting anything', async () => {
+        const r = await runner.start({ workspaceId: 'ws-1', repoUrl: path.join(fx.root, 'nope.git') });
+        expect(r).toMatchObject({ status: 'failed', reason: 'git_failed' });
+        await expect(get(port)).rejects.toThrow();
+    });
+});
+describe('preview pure helpers (tp-05)', () => {
+    it('buildPreviewEnv passes only plain process names, then the repo .env, then PORT', () => {
+        const env = (0, previewCheckout_1.buildPreviewEnv)({ PATH: '/bin', HOME: '/home/w', WENRWA_CONNECT_TOKEN: 'x', RELAY_TOKEN: 'y', ANTHROPIC_API_KEY: 'z' }, { OWNER_SECRET: 's', PORT: '9999' }, 4100);
+        expect(env).toEqual({ PATH: '/bin', HOME: '/home/w', OWNER_SECRET: 's', PORT: '4100', HOST: '127.0.0.1', HOSTNAME: '127.0.0.1' });
+        // The repo .env cannot widen the bind.
+        expect((0, previewCheckout_1.buildPreviewEnv)({}, { HOST: '0.0.0.0', HOSTNAME: '::' }, 4800)).toMatchObject({ HOST: '127.0.0.1', HOSTNAME: '127.0.0.1' });
+    });
+    it('loopbackArgs pins Next and Vite/Astro servers to 127.0.0.1 and leaves other scripts alone', () => {
+        expect((0, previewCheckout_1.loopbackArgs)('next start')).toEqual(['-H', '127.0.0.1']);
+        expect((0, previewCheckout_1.loopbackArgs)('next dev --turbo')).toEqual(['-H', '127.0.0.1']);
+        expect((0, previewCheckout_1.loopbackArgs)('vite preview')).toEqual(['--host', '127.0.0.1']);
+        expect((0, previewCheckout_1.loopbackArgs)('astro dev')).toEqual(['--host', '127.0.0.1']);
+        expect((0, previewCheckout_1.loopbackArgs)('node server.js')).toEqual([]);
+        expect((0, previewCheckout_1.loopbackArgs)('next build && next start')).toEqual([]);
+    });
+    it('parseSymrefHead reads the remote default branch and rejects junk', () => {
+        expect((0, previewCheckout_1.parseSymrefHead)('ref: refs/heads/main\tHEAD\nabc123\tHEAD\n')).toBe('main');
+        expect((0, previewCheckout_1.parseSymrefHead)('ref: refs/heads/release/v2\tHEAD')).toBe('release/v2');
+        expect((0, previewCheckout_1.parseSymrefHead)('abc123\tHEAD')).toBeNull();
+        expect((0, previewCheckout_1.parseSymrefHead)('ref: refs/heads/a..b\tHEAD')).toBeNull();
+    });
+    it('installCommand follows the lockfile', () => {
+        expect((0, previewCheckout_1.installCommand)((f) => f === 'pnpm-lock.yaml')).toEqual(['pnpm', ['install', '--frozen-lockfile']]);
+        expect((0, previewCheckout_1.installCommand)((f) => f === 'yarn.lock')).toEqual(['yarn', ['install', '--frozen-lockfile']]);
+        expect((0, previewCheckout_1.installCommand)((f) => f === 'package-lock.json')).toEqual(['npm', ['ci']]);
+        expect((0, previewCheckout_1.installCommand)(() => false)).toEqual(['npm', ['install']]);
+    });
+});

package/dist/__tests__/bridge-preview-forwarder.test.d.ts

@@ -0,0 +1 @@
+export {};