acrylblends 0.7.7 → 0.8.0

package/templates/notes/test/notes.test.ts

@@ -0,0 +1,280 @@
+import assert from 'node:assert/strict'
+import { mkdirSync } from 'node:fs'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { join } from 'node:path'
+import { after, test } from 'node:test'
+import { fileURLToPath } from 'node:url'
+import type {} from '../plugins/acryl-db/src/cordis.ts'
+import type { Db } from '../plugins/acryl-db/src/index.ts'
+import { testClient } from '../plugins/acryl-router/src/helpers/index.ts'
+import { pinnedInstance, withPort } from '../plugins/instance/index.ts'
+import { createApp as boot } from '../src/app.ts'
+import { createApi, createApp } from '../src/notes-app.ts'
+
+/** Throwaway homes and databases live inside the project (`.acrylblends/` is ignored by git), because a sandboxed agent may not write to the system temp folder. */
+const scratch = join(fileURLToPath(new URL('..', import.meta.url)), '.acrylblends', 'test')
+mkdirSync(scratch, { recursive: true })
+
+const projectRoot = fileURLToPath(new URL('..', import.meta.url))
+
+/**
+ * A fresh database file in a throwaway home with the real migrations, opened by the app's own `db` row (the whole Cordis app boots, so the test exercises the same
+ * composition as production). Every app is stopped, and its home removed, when the tests end.
+ */
+const stops: (() => Promise<void>)[] = []
+after(() => Promise.all(stops.map((stop) => stop())))
+async function booted() {
+  const home = await mkdtemp(join(scratch, 'notes-test-'))
+  const app = await boot(withPort(pinnedInstance(home, { root: projectRoot }), 0), {
+    database: join(home, 'test.sqlite'),
+    listen: false,
+  })
+  stops.push(async () => {
+    await app.stop()
+    await rm(home, { recursive: true, force: true })
+  })
+  return app
+}
+async function memoryDb(): Promise<Db> {
+  return (await booted()).root.db
+}
+
+const form = (data: Record<string, string>, cookie = ''): RequestInit => ({
+  method: 'POST',
+  body: new URLSearchParams(data),
+  headers: { origin: 'http://localhost', ...(cookie ? { cookie } : {}) },
+})
+
+async function signedUp(app: ReturnType<typeof createApp>, email = 'a@example.com') {
+  const res = await app.request('/signup', form({ email, password: 'correct horse' }))
+  assert.equal(res.status, 303)
+  return (res.headers.get('set-cookie') ?? '').split(';')[0] ?? ''
+}
+
+test('the home page sends a visitor to the notes, which send them to log in', async () => {
+  const app = createApp(await memoryDb())
+  assert.equal((await app.request('/')).headers.get('location'), '/notes')
+  const res = await app.request('/notes')
+  assert.equal(res.status, 302)
+  assert.equal(res.headers.get('location'), '/login')
+})
+
+test('sign up validates, refuses a duplicate, and starts a session', async () => {
+  const app = createApp(await memoryDb())
+  assert.match(await (await app.request('/signup')).text(), /Create account/)
+  const bad = await app.request('/signup', form({ email: 'nope', password: 'short' }))
+  assert.equal(bad.status, 400)
+  const text = await bad.text()
+  assert.match(text, /valid email/)
+  assert.match(text, /at least 8 characters/)
+  const cookie = await signedUp(app)
+  assert.match(cookie, /^sid=/)
+  const again = await app.request(
+    '/signup',
+    form({ email: 'a@example.com', password: 'correct horse' }),
+  )
+  assert.equal(again.status, 400)
+  assert.match(await again.text(), /already has an account/)
+})
+
+test('log in checks the password; log out ends the session', async () => {
+  const app = createApp(await memoryDb())
+  const first = await signedUp(app)
+  assert.match(await (await app.request('/login')).text(), /Log in/)
+  const wrong = await app.request(
+    '/login',
+    form({ email: 'a@example.com', password: 'nope nope nope' }),
+  )
+  assert.equal(wrong.status, 401)
+  assert.match(await wrong.text(), /Wrong email or password/)
+  const empty = await app.request('/login', form({ email: '', password: '' }))
+  assert.equal(empty.status, 400)
+  const ok = await app.request(
+    '/login',
+    form({ email: 'a@example.com', password: 'correct horse' }),
+  )
+  assert.equal(ok.status, 303)
+  const cookie = (ok.headers.get('set-cookie') ?? '').split(';')[0] ?? ''
+  assert.equal((await app.request('/notes', { headers: { cookie } })).status, 200)
+  const out = await app.request('/logout', form({}, cookie))
+  assert.equal(out.headers.get('location'), '/login')
+  assert.equal((await app.request('/notes', { headers: { cookie } })).status, 302)
+  assert.equal((await app.request('/notes', { headers: { cookie: first } })).status, 200)
+})
+
+test('create, search, edit and delete a note through the forms', async () => {
+  const app = createApp(await memoryDb())
+  const cookie = await signedUp(app)
+  assert.match(
+    await (await app.request('/notes/new', { headers: { cookie } })).text(),
+    /data-island="counter"/,
+  )
+
+  const invalid = await app.request('/notes', form({ title: ' ', body: 'x' }, cookie))
+  assert.equal(invalid.status, 400)
+  assert.match(await invalid.text(), /Give the note a title/)
+
+  assert.equal(
+    (await app.request('/notes', form({ title: 'Groceries', body: 'milk and eggs' }, cookie)))
+      .status,
+    303,
+  )
+  assert.equal(
+    (await app.request('/notes', form({ title: 'Ideas', body: 'a framework' }, cookie))).status,
+    303,
+  )
+
+  const list = await (await app.request('/notes', { headers: { cookie } })).text()
+  assert.match(list, /Groceries/)
+  assert.match(list, /Ideas/)
+  const found = await (await app.request('/notes?q=eggs', { headers: { cookie } })).text()
+  assert.match(found, /Groceries/)
+  assert.doesNotMatch(found, /Ideas/)
+  assert.match(
+    await (await app.request('/notes?q=zzz', { headers: { cookie } })).text(),
+    /No note matches/,
+  )
+
+  const edit = await app.request('/notes/1/edit', { headers: { cookie } })
+  assert.match(await edit.text(), /milk and eggs/)
+  const toolong = await app.request('/notes/1', form({ title: 'x'.repeat(81), body: '' }, cookie))
+  assert.equal(toolong.status, 400)
+  assert.match(await toolong.text(), /at most 80/)
+  assert.equal(
+    (await app.request('/notes/1', form({ title: 'Shopping', body: 'oat milk' }, cookie))).status,
+    303,
+  )
+  assert.match(await (await app.request('/notes', { headers: { cookie } })).text(), /Shopping/)
+  assert.equal((await app.request('/notes/99', form({ title: 'x', body: '' }, cookie))).status, 404)
+  assert.equal((await app.request('/notes/99/edit', { headers: { cookie } })).status, 404)
+
+  assert.equal((await app.request('/notes/1/delete', form({}, cookie))).status, 303)
+  assert.equal((await app.request('/notes/1/delete', form({}, cookie))).status, 404)
+  assert.doesNotMatch(
+    await (await app.request('/notes', { headers: { cookie } })).text(),
+    /Shopping/,
+  )
+})
+
+test("one user cannot read or change another user's notes", async () => {
+  const app = createApp(await memoryDb())
+  const alice = await signedUp(app, 'alice@example.com')
+  const bob = await signedUp(app, 'bob@example.com')
+  await app.request('/notes', form({ title: 'Secret', body: 'alice only' }, alice))
+  assert.equal((await app.request('/notes/1/edit', { headers: { cookie: bob } })).status, 404)
+  assert.equal((await app.request('/notes/1/delete', form({}, bob))).status, 404)
+  assert.match(await (await app.request('/notes', { headers: { cookie: alice } })).text(), /Secret/)
+})
+
+test('the JSON API needs a session and validates input', async () => {
+  const db = await memoryDb()
+  const app = createApp(db)
+  const cookie = await signedUp(app)
+  const res = await app.request('/api/notes')
+  assert.equal(res.status, 401)
+  const bad = await app.request('/api/notes', {
+    method: 'POST',
+    headers: { cookie, 'content-type': 'application/json' },
+    body: JSON.stringify({ title: '' }),
+  })
+  assert.equal(bad.status, 400)
+  const body = (await bad.json()) as { issues: { message: string }[] }
+  assert.match(body.issues[0]?.message ?? '', /title/)
+})
+
+test('the typed client covers every API route', async () => {
+  const db = await memoryDb()
+  const app = createApp(db)
+  const cookie = await signedUp(app)
+  const client = testClient(createApi(db))
+  const as = { headers: { cookie } }
+
+  const created = await client.index.$post({ json: { title: 'First', body: 'hello' } }, as)
+  assert.equal(created.status, 201)
+  const { note } = await created.json()
+  assert.equal(note.title, 'First')
+
+  const listed = await client.index.$get({ query: { q: 'hel' } }, as)
+  assert.equal((await listed.json()).notes.length, 1)
+
+  const got = await client[':id'].$get({ param: { id: String(note.id) } }, as)
+  assert.equal(got.status, 200)
+  const missing = await client[':id'].$get({ param: { id: '99' } }, as)
+  assert.equal(missing.status, 404)
+
+  const updated = await client[':id'].$put(
+    { param: { id: String(note.id) }, json: { title: 'Renamed', body: '' } },
+    as,
+  )
+  assert.equal(updated.status, 200)
+
+  const gone = await client[':id'].$delete({ param: { id: String(note.id) } }, as)
+  assert.equal(gone.status, 200)
+  assert.equal((await client[':id'].$delete({ param: { id: String(note.id) } }, as)).status, 404)
+})
+
+test('csrf refuses a form POST from another site', async () => {
+  const app = createApp(await memoryDb())
+  const res = await app.request('/signup', {
+    method: 'POST',
+    body: new URLSearchParams({ email: 'a@example.com', password: 'correct horse' }),
+    headers: { origin: 'https://evil.example' },
+  })
+  assert.equal(res.status, 403)
+})
+
+test('the session cookie is Secure over HTTPS, and behind a proxy only when the proxy is trusted', async () => {
+  const body = new URLSearchParams({ email: 'a@example.com', password: 'correct horse' })
+  const flags = async (url: string, headers: Record<string, string>, trustProxy: boolean) => {
+    const app = createApp(await memoryDb(), { trustProxy })
+    const origin = new URL(url).origin
+    const res = await app.request(url, { method: 'POST', body, headers: { origin, ...headers } })
+    assert.equal(res.status, 303)
+    return res.headers.get('set-cookie') ?? ''
+  }
+  assert.doesNotMatch(await flags('http://localhost/signup', {}, false), /Secure/i)
+  assert.match(await flags('https://localhost/signup', {}, false), /Secure/i)
+  const forwarded = { 'x-forwarded-proto': 'https' }
+  assert.doesNotMatch(await flags('http://localhost/signup', forwarded, false), /Secure/i)
+  assert.match(await flags('http://localhost/signup', forwarded, true), /Secure/i)
+})
+
+test('behind a proxy csrf accepts the public origin and still refuses others', async () => {
+  const app = createApp(await memoryDb(), { publicOrigin: 'https://notes.example.com' })
+  const post = (origin: string) =>
+    app.request('/signup', {
+      method: 'POST',
+      body: new URLSearchParams({ email: 'a@example.com', password: 'correct horse' }),
+      headers: { origin },
+    })
+  assert.equal((await post('https://notes.example.com')).status, 303)
+  assert.equal((await post('https://evil.example')).status, 403)
+})
+
+test('an error answers a plain 500 with no stack and no detail', async () => {
+  const fail = async (): Promise<never> => {
+    throw new Error('secret detail at /srv/app/db.ts:1')
+  }
+  const broken: Db = { exec: fail, run: fail, get: fail, all: fail, transaction: fail }
+  const app = createApp(broken)
+  const res = await app.request('/notes', { headers: { cookie: 'sid=anything' } })
+  assert.equal(res.status, 500)
+  assert.equal(await res.text(), 'Internal Server Error')
+})
+
+test('the note form loads the character counter, a client component compiled for the browser and served by the running app', async () => {
+  const running = await booted()
+  const app = createApp(running.root.db)
+  const cookie = await signedUp(app)
+  assert.match(
+    await (await app.request('/notes/new', { headers: { cookie } })).text(),
+    /src="\/client\/counter\.tsx"/,
+  )
+  // Through the router and the server, as a browser asks: the client folder is mounted by src/routes.ts.
+  const module = await running.root.router.request('/client/counter.tsx')
+  assert.equal(module.status, 200)
+  assert.match(module.headers.get('content-type') ?? '', /javascript/)
+  assert.doesNotMatch(await module.text(), /<Count/)
+  assert.equal((await running.root.router.request('/client/@acrylblends/jsx-dom.js')).status, 200)
+  assert.equal((await running.root.router.request('/client/../src/db.ts')).status, 404)
+})

package/templates/notes/test/server.test.ts

@@ -0,0 +1,78 @@
+import assert from 'node:assert/strict'
+import { spawn } from 'node:child_process'
+import { once } from 'node:events'
+import { mkdirSync, mkdtempSync } from 'node:fs'
+import { createServer } from 'node:net'
+import { join } from 'node:path'
+import { test } from 'node:test'
+import { fileURLToPath } from 'node:url'
+
+/** Throwaway homes and databases live inside the project (`.acrylblends/` is ignored by git), because a sandboxed agent may not write to the system temp folder. */
+const scratch = join(fileURLToPath(new URL('..', import.meta.url)), '.acrylblends', 'test')
+mkdirSync(scratch, { recursive: true })
+
+/** A sandbox may forbid listening on a port (Codex's workspace-write does); the tests that start the real server are skipped there, and every other test runs in process. */
+const canListen = await new Promise<boolean>((done) => {
+  const probe = createServer()
+  probe.once('error', () => done(false))
+  probe.listen(0, '127.0.0.1', () => probe.close(() => done(true)))
+})
+const skip = canListen ? false : 'this environment does not allow listening on a port'
+if (!canListen)
+  console.log(
+    `skipped: the tests that start the real server (${skip}); every other test ran in process`,
+  )
+
+/** Start `src/main.ts` the way `npm start` does, on a port the system chooses, and read the address it prints. */
+async function start(env: Record<string, string> = {}) {
+  const child = spawn(
+    process.execPath,
+    ['--import', './plugins/acryl-node-server/src/register.ts', 'src/main.ts'],
+    {
+      env: {
+        ...process.env,
+        PORT: '0',
+        ACRYL_DOOR: 'off',
+        ACRYLBLENDS_HOME: mkdtempSync(join(scratch, 'notes-home-')),
+        NOTES_DB: join(mkdtempSync(join(scratch, 'notes-')), 'notes.sqlite'),
+        ...env,
+      },
+      stdio: ['ignore', 'pipe', 'inherit'],
+    },
+  )
+  let out = ''
+  const address = await new Promise<string>((resolve, reject) => {
+    child.once('exit', (code) =>
+      reject(new Error(`the server exited with ${code} before it listened`)),
+    )
+    child.stdout.on('data', (chunk) => {
+      out += chunk
+      const match = /listening on (http:\/\/\S+)/.exec(out)
+      if (match?.[1]) resolve(match[1])
+    })
+  })
+  return { child, address }
+}
+
+test('the server listens on 127.0.0.1 unless HOST says otherwise', { skip }, async () => {
+  const { child, address } = await start()
+  try {
+    assert.match(address, /^http:\/\/127\.0\.0\.1:\d+$/)
+  } finally {
+    child.kill('SIGTERM')
+    await once(child, 'exit')
+  }
+})
+
+for (const signal of ['SIGTERM', 'SIGINT'] as const) {
+  test(`${signal} stops the server cleanly and frees the port`, { skip }, async () => {
+    const { child, address } = await start()
+    assert.equal((await fetch(`${address}/signup`)).status, 200)
+    const started = Date.now()
+    child.kill(signal)
+    const [code] = await once(child, 'exit')
+    assert.equal(code, 0)
+    assert.ok(Date.now() - started < 5000, 'the server took too long to stop')
+    await assert.rejects(fetch(address), 'the port should be free')
+  })
+}

package/templates/notes/tsconfig.json

@@ -0,0 +1,20 @@
+{
+  "compilerOptions": {
+    "target": "ES2024",
+    "lib": ["ES2024", "DOM", "DOM.Iterable"],
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "noImplicitOverride": true,
+    "verbatimModuleSyntax": true,
+    "erasableSyntaxOnly": true,
+    "allowImportingTsExtensions": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "types": ["node"],
+    "jsx": "react-jsx",
+    "jsxImportSource": "#acryl-jsx"
+  },
+  "include": ["src", "test", "plugins"],
+  "exclude": ["src/client"]
+}

package/templates/todo/README.md

@@ -24,4 +24,4 @@ The routes only answer a caller on this machine: a request from another site's p
 Open `$URL/todo` for the page. Stop the app and start it again: the list is still there (`<home>/todo.json`, `.acrylblends/` unless `ACRYLBLENDS_HOME` says otherwise).
 
 - `blend.yaml` is the app as data. `npm run lock` records what it is built from; `npm run save` commits it, refusing secrets and public remotes for a private app.
-- The framework plugins are in `src/plugins/acryl-*/src`. Do not edit them: they are ACRYL's, vendored; the text that explains them is in the ACRYLBLENDS docs.
+- The framework plugins are in `plugins/acryl-*/src`. Do not edit them: they are ACRYL's, vendored; the text that explains them is in the ACRYLBLENDS docs.

package/templates/todo/gitignore

@@ -1,2 +1,3 @@
 node_modules/
 .acrylblends/
+.acryl/

package/templates/todo/package.json

@@ -4,20 +4,20 @@
   "private": true,
   "type": "module",
   "imports": {
-    "#acryl-jsx/jsx-runtime": "./src/plugins/acryl-router/src/core/jsx/jsx-runtime.ts",
-    "#acryl-jsx/jsx-dev-runtime": "./src/plugins/acryl-router/src/core/jsx/jsx-dev-runtime.ts"
+    "#acryl-jsx/jsx-runtime": "./plugins/acryl-router/src/core/jsx/jsx-runtime.ts",
+    "#acryl-jsx/jsx-dev-runtime": "./plugins/acryl-router/src/core/jsx/jsx-dev-runtime.ts"
   },
   "engines": {
     "node": ">=22.19.0"
   },
   "scripts": {
-    "start": "node --import ./src/plugins/acryl-node-server/src/register.ts src/main.ts",
-    "dev": "node --watch --import ./src/plugins/acryl-node-server/src/register.ts src/main.ts",
-    "test": "node --import ./src/plugins/acryl-node-server/src/register.ts --test \"test/**/*.test.{ts,tsx}\"",
+    "start": "node --import ./plugins/acryl-node-server/src/register.ts src/main.ts",
+    "dev": "node --watch --import ./plugins/acryl-node-server/src/register.ts src/main.ts",
+    "test": "node --import ./plugins/acryl-node-server/src/register.ts --test \"test/**/*.test.{ts,tsx}\"",
     "check": "tsc --noEmit",
-    "lock": "node src/plugins/manifest/lock.ts",
-    "save": "node src/plugins/save/cli.ts",
-    "upgrade": "node src/plugins/manifest/upgrade-cli.ts"
+    "lock": "node plugins/manifest/lock.ts",
+    "save": "node plugins/save/cli.ts",
+    "upgrade": "node plugins/manifest/upgrade-cli.ts"
   },
   "dependencies": {
     "typescript": "6.0.3"

package/templates/todo/src/app.ts

@@ -1,16 +1,16 @@
 import { join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { Context, type Fiber } from '@deepseek-ai/cordis'
-import * as nodeServer from './plugins/acryl-node-server/src/index.ts'
-import * as router from './plugins/acryl-router/src/index.ts'
-import * as state from './plugins/acryl-state/src/index.ts'
-import { type AppInstance, instance } from './plugins/instance/index.ts'
+import * as nodeServer from '../plugins/acryl-node-server/src/index.ts'
+import * as router from '../plugins/acryl-router/src/index.ts'
+import * as state from '../plugins/acryl-state/src/index.ts'
+import { type AppInstance, instance } from '../plugins/instance/index.ts'
 import {
   blueprintsIn,
   compose,
   loadManifest,
   type ParameterValue,
-} from './plugins/manifest/index.ts'
+} from '../plugins/manifest/index.ts'
 import * as todo from './todo.ts'
 
 /** The plugins this app's code provides. `blend.yaml` chooses, orders and configures them. */
@@ -38,8 +38,19 @@ export function readManifest(values?: Readonly<Record<string, ParameterValue>>)
   })
 }
 
+/** The manifest without its server row: the app is then reached in process, through `root.router.request`. */
+function withoutServer<M extends { plugins: readonly { use: string }[] }>(manifest: M): M {
+  return {
+    ...manifest,
+    plugins: manifest.plugins.map((row) =>
+      row.use === 'acryl-node-server' ? { ...row, disabled: true } : row,
+    ),
+  }
+}
+
 export interface App {
   readonly root: Context
+  /** The address the server listens on; empty when the app was made with `listen: false`. */
   readonly url: string
   stop(): Promise<void>
 }
@@ -47,7 +58,11 @@ export interface App {
 /** The app: `instance` first (where it lives, chosen at run time), then the manifest's rows in order. */
 export async function createApp(
   chosen: AppInstance,
-  options: { values?: Readonly<Record<string, ParameterValue>> } = {},
+  options: {
+    values?: Readonly<Record<string, ParameterValue>>
+    /** Start the HTTP server (default). Tests pass `false` and call `app.root.router.request(path)`: it needs no port, so it also runs where a sandbox forbids listening. */
+    listen?: boolean
+  } = {},
 ): Promise<App> {
   const manifest = readManifest(options.values)
   const root = new Context()
@@ -55,15 +70,20 @@ export async function createApp(
   await first.await()
   const fibers: Fiber[] = [
     first,
-    ...(await compose(root, manifest, registry, {
-      // Runtime values the manifest cannot hold: where the list is kept (in the app's home) and where the server listens.
-      todo: { file: join(chosen.home, 'todo.json') },
-      server: { port: chosen.port.start, scan: chosen.port.scan ? 20 : 0 },
-    })),
+    ...(await compose(
+      root,
+      options.listen === false ? withoutServer(manifest) : manifest,
+      registry,
+      {
+        // Runtime values the manifest cannot hold: where the list is kept (in the app's home) and where the server listens.
+        todo: { file: join(chosen.home, 'todo.json') },
+        server: { port: chosen.port.start, scan: chosen.port.scan ? 20 : 0 },
+      },
+    )),
   ]
   return {
     root,
-    url: root.nodeServer.url,
+    url: options.listen === false ? '' : root.nodeServer.url,
     async stop() {
       for (const fiber of [...fibers].reverse()) await fiber.dispose()
     },

package/templates/todo/src/main.ts

@@ -1,6 +1,6 @@
 import { fileURLToPath } from 'node:url'
+import { selectInstance } from '../plugins/instance/index.ts'
 import { APP_NAME, createApp } from './app.ts'
-import { selectInstance } from './plugins/instance/index.ts'
 
 // The composition root: the one place that reads the environment (through selectInstance) and chooses where the app lives.
 const chosen = selectInstance({

package/templates/todo/src/todo.ts

@@ -6,10 +6,10 @@
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs'
 import { dirname } from 'node:path'
 import type { Context } from '@deepseek-ai/cordis'
-import { Acryl, HTTPException } from './plugins/acryl-router/src/index.ts'
-import { bodyLimit, loopbackOnly, trimTrailingSlash } from './plugins/acryl-router/src/middleware/index.ts'
-import { schemaValidator, streamSSE, type StandardSchema } from './plugins/acryl-router/src/helpers/index.ts'
-import type {} from './plugins/acryl-state/src/index.ts'
+import { Acryl, HTTPException } from '../plugins/acryl-router/src/index.ts'
+import { bodyLimit, loopbackOnly, trimTrailingSlash } from '../plugins/acryl-router/src/middleware/index.ts'
+import { schemaValidator, streamSSE, type StandardSchema } from '../plugins/acryl-router/src/helpers/index.ts'
+import type {} from '../plugins/acryl-state/src/index.ts'
 import { PAGE } from './page.ts'
 
 /** Stable Cordis plugin name, equal to the package name and the Loader row id. */

package/templates/todo/test/todo.test.ts

@@ -1,17 +1,22 @@
 import assert from 'node:assert/strict'
+import { mkdirSync } from 'node:fs'
 import { mkdtemp, rm } from 'node:fs/promises'
-import { tmpdir } from 'node:os'
+import { createServer } from 'node:net'
 import { join } from 'node:path'
 import { test } from 'node:test'
 import { fileURLToPath } from 'node:url'
+import { pinnedInstance, withPort } from '../plugins/instance/index.ts'
 import { type App, createApp, readManifest } from '../src/app.ts'
-import { pinnedInstance, withPort } from '../src/plugins/instance/index.ts'
+
+/** Throwaway homes live inside the project (`.acrylblends/` is ignored by git): a sandboxed agent may not write to the system temp folder. */
+const scratch = join(fileURLToPath(new URL('..', import.meta.url)), '.acrylblends', 'test')
+mkdirSync(scratch, { recursive: true })
 
 const projectRoot = fileURLToPath(new URL('..', import.meta.url))
 
-/** Boot the app on any free port with its data in `home`, run the test, always stop it. */
-async function withApp(home: string, run: (app: App) => Promise<void>) {
-  const app = await createApp(withPort(pinnedInstance(home, { root: projectRoot }), 0))
+/** Boot the app with its data in `home`, run the test, always stop it. In process by default (`app.root.router.request`); `listen` starts the real server on any free port. */
+async function withApp(home: string, run: (app: App) => Promise<void>, listen = false) {
+  const app = await createApp(withPort(pinnedInstance(home, { root: projectRoot }), 0), { listen })
   try {
     await run(app)
   } finally {
@@ -20,7 +25,7 @@ async function withApp(home: string, run: (app: App) => Promise<void>) {
 }
 
 async function withHome(run: (home: string) => Promise<void>) {
-  const home = await mkdtemp(join(tmpdir(), 'todo-test-'))
+  const home = await mkdtemp(join(scratch, 'todo-test-'))
   try {
     await run(home)
   } finally {
@@ -29,7 +34,7 @@ async function withHome(run: (home: string) => Promise<void>) {
 }
 
 const send = (app: App, method: string, path: string, body?: unknown) =>
-  fetch(`${app.url}${path}`, {
+  app.root.router.request(`${path}`, {
     method,
     headers: { 'content-type': 'application/json' },
     ...(body === undefined ? {} : { body: JSON.stringify(body) }),
@@ -53,21 +58,41 @@ test('creates, completes, lists and deletes', () =>
     }),
   ))
 
-test('a change from a foreign origin is refused; a plain request from this machine works', () =>
-  withHome((home) =>
-    withApp(home, async (app) => {
-      const post = (headers: Record<string, string>) =>
-        fetch(`${app.url}/todo/api`, {
-          method: 'POST',
-          headers: { 'content-type': 'application/json', ...headers },
-          body: JSON.stringify({ title: 'x' }),
-        })
-      assert.equal((await post({ origin: 'http://evil.example' })).status, 403)
-      assert.equal((await post({ origin: 'null' })).status, 403)
-      assert.equal((await post({})).status, 201)
-      assert.equal((await post({ origin: new URL(app.url).origin })).status, 201)
-    }),
-  ))
+/** A sandbox may forbid listening on a port (Codex's workspace-write does). The one test that needs a real connection (the origin check looks at who connected) is skipped there, and says so. */
+const canListen = await new Promise<boolean>((done) => {
+  const probe = createServer()
+  probe.once('error', () => done(false))
+  probe.listen(0, '127.0.0.1', () => probe.close(() => done(true)))
+})
+const skip = canListen ? false : 'this environment does not allow listening on a port'
+if (!canListen)
+  console.log(
+    `skipped: the test that starts the real server (${skip}); every other test ran in process`,
+  )
+
+test(
+  'a change from a foreign origin is refused; a plain request from this machine works',
+  { skip },
+  () =>
+    withHome((home) =>
+      withApp(
+        home,
+        async (app) => {
+          const post = (headers: Record<string, string>) =>
+            fetch(`${app.url}/todo/api`, {
+              method: 'POST',
+              headers: { 'content-type': 'application/json', ...headers },
+              body: JSON.stringify({ title: 'x' }),
+            })
+          assert.equal((await post({ origin: 'http://evil.example' })).status, 403)
+          assert.equal((await post({ origin: 'null' })).status, 403)
+          assert.equal((await post({})).status, 201)
+          assert.equal((await post({ origin: new URL(app.url).origin })).status, 201)
+        },
+        true,
+      ),
+    ),
+)
 
 test('rejects bad input and unknown ids', () =>
   withHome((home) =>
@@ -114,7 +139,7 @@ test('serves the page, and streams the list: now, and again on every change', ()
       assert.match(await page.text(), /<title>Todo<\/title>/)
 
       const controller = new AbortController()
-      const stream = await fetch(`${app.url}/todo/events`, { signal: controller.signal })
+      const stream = await app.root.router.request(`/todo/events`, { signal: controller.signal })
       const reader = stream.body!.getReader()
       const decoder = new TextDecoder()
       let text = ''

package/templates/todo/tsconfig.json

@@ -15,5 +15,5 @@
     "jsx": "react-jsx",
     "jsxImportSource": "#acryl-jsx"
   },
-  "include": ["src", "test"]
+  "include": ["src", "test", "plugins"]
 }