brane 0.1.1 → 0.3.0

package/dist/test/block-glyphs.test.js

@@ -0,0 +1,68 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { blockGlyphClass, blockGlyphStylesheet, paintBlockGlyphs, } from "../shared/block-glyphs.js";
+// The terminal mirror paints block elements rather than typesetting them, so
+// `brane meld`'s QR code has no gap between rows. These pin the two halves
+// that have to agree: every glyph the painter wraps has a rule that paints it,
+// and the painter leaves everything else — nearly every line — alone.
+const ALL_BLOCKS = Array.from({ length: 0x20 }, (_, i) => 0x2580 + i);
+describe("paintBlockGlyphs", () => {
+    it("returns a line with no block element unchanged", () => {
+        const html = '<span style="color:rgb(0,187,0)">$ ls -la</span> ─│ ●';
+        assert.equal(paintBlockGlyphs(html), html);
+    });
+    it("wraps each block element in its own span, keeping the character", () => {
+        assert.equal(paintBlockGlyphs("a▀▄b"), 'a<span class="tb tb-2580">▀</span><span class="tb tb-2584">▄</span>b');
+    });
+    it("paints inside ansi_up's color spans, so currentColor is the SGR color", () => {
+        const html = '<span style="color:rgb(255,0,0)">█</span>';
+        assert.equal(paintBlockGlyphs(html), '<span style="color:rgb(255,0,0)"><span class="tb tb-2588">█</span></span>');
+    });
+    it("keeps the text content identical, so copy yields the real characters", () => {
+        const line = "▄▄▄▄▄▄▄ ▄ ▄▄ ░▒▓ ▙▟";
+        const stripped = paintBlockGlyphs(line).replace(/<[^>]*>/g, "");
+        assert.equal(stripped, line);
+    });
+    it("covers every codepoint in U+2580–U+259F", () => {
+        const line = String.fromCharCode(...ALL_BLOCKS);
+        const classes = [...paintBlockGlyphs(line).matchAll(/class="tb (tb-[0-9a-f]+)"/g)].map((m) => m[1]);
+        assert.deepEqual(classes, ALL_BLOCKS.map(blockGlyphClass));
+    });
+    it("leaves the neighbors of the range alone", () => {
+        const line = "╿■"; // ╿ and ■, just outside the block
+        assert.equal(paintBlockGlyphs(line), line);
+    });
+});
+describe("blockGlyphStylesheet", () => {
+    const css = blockGlyphStylesheet(1.4);
+    it("gives every class the painter emits a background rule", () => {
+        for (const cp of ALL_BLOCKS) {
+            assert.match(css, new RegExp(`\\.${blockGlyphClass(cp)}\\{background:`), `U+${cp.toString(16)}`);
+        }
+    });
+    it("makes the cell exactly one line box tall and one cell wide", () => {
+        assert.match(css, /\.tb\{[^}]*height:1\.4em/);
+        assert.match(css, /\.tb\{[^}]*width:1ch/);
+        assert.match(css, /\.tb\{[^}]*vertical-align:top/);
+    });
+    it("hides the glyph without touching color, which the paint is drawn in", () => {
+        assert.match(css, /-webkit-text-fill-color:transparent/);
+        assert.doesNotMatch(css, /[{;]color:/);
+    });
+    it("paints half blocks as one full-tile gradient with a hard stop", () => {
+        assert.match(css, /\.tb-2580\{background:linear-gradient\(to bottom,currentColor 50%,transparent 50%\)\}/);
+        assert.match(css, /\.tb-2584\{background:linear-gradient\(to top,currentColor 50%,transparent 50%\)\}/);
+        assert.match(css, /\.tb-2590\{background:linear-gradient\(to left,currentColor 50%,transparent 50%\)\}/);
+        assert.match(css, /\.tb-2588\{background:currentColor\}/);
+    });
+    it("paints quadrants as one conic sweep: ▚ is upper-left and lower-right", () => {
+        assert.match(css, /\.tb-259a\{background:conic-gradient\(at 50% 50%,transparent 0 25%,currentColor 0 50%,transparent 0 75%,currentColor 0\)\}/);
+    });
+    // A layer sized and positioned inside the cell anti-aliases its own edges on
+    // the fractional pixels a 16.8px row lands on, leaving a hairline between
+    // lit rows. Full-tile images take the box's snapped edges instead.
+    it("never sizes or positions a layer", () => {
+        assert.doesNotMatch(css, /no-repeat|\s\/\s/);
+    });
+});
+//# sourceMappingURL=block-glyphs.test.js.map

package/dist/test/cert-manager.test.js

@@ -0,0 +1,262 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { execFileSync } from "node:child_process";
+import { inspectCert, parseCertExpiry } from "../tls.js";
+import { CertManager } from "../daemon/cert-manager.js";
+function opensslAvailable() {
+    try {
+        execFileSync("openssl", ["version"], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Returns true if the local openssl supports `-not_before`/`-not_after` on
+ * `openssl req`. macOS LibreSSL and OpenSSL 3.x do; older OpenSSL 1.x does
+ * not. Tests that need explicit date control skip when this is false.
+ */
+function opensslSupportsExplicitDates() {
+    if (!HAS_OPENSSL)
+        return false;
+    try {
+        const dir = mkdtempSync(join(tmpdir(), "brane-openssl-probe-"));
+        execFileSync("openssl", [
+            "req", "-x509", "-newkey", "rsa:2048", "-nodes",
+            "-keyout", join(dir, "k"), "-out", join(dir, "c"),
+            "-subj", "/CN=probe",
+            "-not_before", "20200101000000Z",
+            "-not_after", "20200102000000Z",
+        ], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function formatAsn1Time(d) {
+    // openssl wants YYYYMMDDHHMMSSZ (UTC).
+    const pad = (n) => String(n).padStart(2, "0");
+    return (String(d.getUTCFullYear()) +
+        pad(d.getUTCMonth() + 1) +
+        pad(d.getUTCDate()) +
+        pad(d.getUTCHours()) +
+        pad(d.getUTCMinutes()) +
+        pad(d.getUTCSeconds()) + "Z");
+}
+function generateSelfSignedCert(opts) {
+    const dir = mkdtempSync(join(tmpdir(), "brane-cert-gen-"));
+    const keyPath = join(dir, "k.pem");
+    const certPath = join(dir, "c.pem");
+    const args = [
+        "req", "-x509", "-newkey", "rsa:2048", "-nodes",
+        "-keyout", keyPath, "-out", certPath,
+        "-subj", `/CN=${opts.host}`,
+    ];
+    if (opts.notBefore) {
+        // Explicit notBefore/notAfter (used for expired-cert tests). Requires
+        // an openssl that supports the flags; callers gate on this.
+        const notBefore = opts.notBefore;
+        const notAfter = new Date(notBefore.getTime() + opts.notAfterOffsetMs);
+        args.push("-not_before", formatAsn1Time(notBefore));
+        args.push("-not_after", formatAsn1Time(notAfter));
+    }
+    else {
+        // Days-based path — what most tests use. Round up to >= 1 day.
+        const days = Math.max(1, Math.ceil(opts.notAfterOffsetMs / 86_400_000));
+        args.push("-days", String(days));
+    }
+    try {
+        execFileSync("openssl", args, { stdio: ["ignore", "ignore", "pipe"] });
+    }
+    catch (err) {
+        const e = err;
+        const stderr = e.stderr?.toString() ?? "";
+        throw new Error(`openssl req failed (exit ${e.status ?? "?"}): ${stderr.trim() || "(no stderr)"}\n` +
+            `args: ${args.join(" ")}`);
+    }
+    const cert = readFileSync(certPath);
+    const key = readFileSync(keyPath);
+    if (cert.length === 0) {
+        throw new Error(`openssl produced an empty cert file at ${certPath}`);
+    }
+    return { cert, key };
+}
+function setupCertDir(initial) {
+    const dir = mkdtempSync(join(tmpdir(), "brane-certmgr-"));
+    const certsDir = join(dir, "certs");
+    mkdirSync(certsDir, { recursive: true });
+    const certPath = join(certsDir, "tls.crt");
+    const keyPath = join(certsDir, "tls.key");
+    if (initial) {
+        writeFileSync(certPath, initial.cert);
+        writeFileSync(keyPath, initial.key);
+    }
+    return { certPath, keyPath, dir };
+}
+const HAS_OPENSSL = opensslAvailable();
+const HAS_OPENSSL_DATES = HAS_OPENSSL && opensslSupportsExplicitDates();
+describe("parseCertExpiry / inspectCert", () => {
+    it("returns null for a missing file", () => {
+        assert.equal(parseCertExpiry("/tmp/definitely-not-a-cert-file-xyz"), null);
+        assert.equal(inspectCert("/tmp/definitely-not-a-cert-file-xyz"), null);
+    });
+    it("returns null for a non-PEM file", () => {
+        const dir = mkdtempSync(join(tmpdir(), "brane-bad-cert-"));
+        const path = join(dir, "garbage.crt");
+        writeFileSync(path, "this is not a certificate\n");
+        assert.equal(parseCertExpiry(path), null);
+        assert.equal(inspectCert(path), null);
+    });
+    it("parses a real cert's expiry and subject", { skip: !HAS_OPENSSL }, () => {
+        const { cert } = generateSelfSignedCert({ host: "test.example.com", notAfterOffsetMs: 30 * 86_400_000 });
+        const dir = mkdtempSync(join(tmpdir(), "brane-good-cert-"));
+        const path = join(dir, "ok.crt");
+        writeFileSync(path, cert);
+        const inspected = inspectCert(path);
+        assert.ok(inspected, "expected cert to inspect");
+        assert.ok(inspected.notAfter.getTime() > Date.now(), "expected notAfter in the future");
+        assert.match(inspected.subject, /CN=test\.example\.com/);
+    });
+});
+describe("CertManager.ensureCert", () => {
+    it("reports disabled when there is no cert and no Tailscale", { skip: !HAS_OPENSSL }, async () => {
+        const { certPath, keyPath } = setupCertDir();
+        const mgr = new CertManager({
+            certPath, keyPath,
+            onReload: () => { },
+            resolveHost: () => undefined,
+        });
+        const ok = await mgr.ensureCert();
+        assert.equal(ok, false);
+        assert.equal(mgr.getStatus().state, "disabled");
+        assert.equal(mgr.getStatus().expiresAt, null);
+        mgr.stop();
+    });
+    it("treats a valid existing cert as the steady state without invoking tailscale", { skip: !HAS_OPENSSL }, async () => {
+        const fixture = generateSelfSignedCert({ host: "host.example.com", notAfterOffsetMs: 60 * 86_400_000 });
+        const { certPath, keyPath } = setupCertDir(fixture);
+        let reloadFired = false;
+        const mgr = new CertManager({
+            certPath, keyPath,
+            onReload: () => { reloadFired = true; },
+            resolveHost: () => "host.example.com",
+        });
+        const ok = await mgr.ensureCert();
+        assert.equal(ok, true);
+        assert.equal(mgr.getStatus().state, "valid");
+        const status = mgr.getStatus();
+        assert.ok(status.expiresAt && status.expiresAt.getTime() > Date.now());
+        // ensureCert must not reload — the file on disk is already what HTTPS
+        // would bind with.
+        assert.equal(reloadFired, false);
+        mgr.stop();
+    });
+    it("returns false when the cert is genuinely expired and Tailscale is gone", { skip: !HAS_OPENSSL_DATES }, async () => {
+        // Genuinely expired: notBefore six years ago, notAfter five years ago.
+        // Asserts that an expired-cert-on-disk + no-Tailscale path lands in
+        // "disabled" rather than mistakenly reporting "valid".
+        const sixYearsAgo = new Date(Date.now() - 6 * 365 * 86_400_000);
+        const fixture = generateSelfSignedCert({
+            host: "h.example.com",
+            notBefore: sixYearsAgo,
+            notAfterOffsetMs: 365 * 86_400_000, // one year after notBefore -> still expired
+        });
+        const { certPath, keyPath } = setupCertDir(fixture);
+        const mgr = new CertManager({
+            certPath, keyPath,
+            onReload: () => { },
+            resolveHost: () => undefined, // no tailscale
+        });
+        const ok = await mgr.ensureCert();
+        assert.equal(ok, false);
+        assert.equal(mgr.getStatus().state, "disabled");
+        // expiresAt reflects the on-disk cert (caller may want to log it).
+        const expiry = mgr.getStatus().expiresAt;
+        assert.ok(expiry && expiry.getTime() < Date.now());
+        mgr.stop();
+    });
+    it("falls through to provisioning when the existing cert's CN doesn't match the Tailscale host", { skip: !HAS_OPENSSL }, async () => {
+        // Regression for the review item: a valid-but-wrong-subject cert
+        // would be accepted as "valid" by ensureCert and the daemon would
+        // bind HTTPS with the wrong cert. We can't actually shell out to
+        // tailscale in a test, so instead we assert ensureCert detects the
+        // mismatch and tries to provision (failing because tailscale isn't
+        // really there) rather than reporting "valid".
+        const fixture = generateSelfSignedCert({
+            host: "old.example.com",
+            notAfterOffsetMs: 60 * 86_400_000,
+        });
+        const { certPath, keyPath } = setupCertDir(fixture);
+        let provisionAttempted = false;
+        const mgr = new CertManager({
+            certPath, keyPath,
+            onReload: () => { },
+            // Host has changed since the cert was issued.
+            resolveHost: () => "new.example.com",
+            // Quiet the "Provisioning..." log line during the test; also
+            // gives us a way to detect that we actually entered Case C.
+            log: (_level, msg) => {
+                if (msg.includes("does not match"))
+                    provisionAttempted = true;
+            },
+        });
+        const ok = await mgr.ensureCert();
+        assert.equal(ok, false, "expected provisioning to fail (tailscale stub)");
+        assert.equal(provisionAttempted, true, "expected the subject-mismatch log line");
+        assert.notEqual(mgr.getStatus().state, "valid");
+        mgr.stop();
+    });
+});
+describe("CertManager.fs.watch hot reload", () => {
+    it("calls onReload when the cert file changes underneath us", { skip: !HAS_OPENSSL }, async () => {
+        const initial = generateSelfSignedCert({ host: "h.example.com", notAfterOffsetMs: 60 * 86_400_000 });
+        const { certPath, keyPath } = setupCertDir(initial);
+        let reloadCount = 0;
+        const reloadedCerts = [];
+        const mgr = new CertManager({
+            certPath, keyPath,
+            onReload: (cert) => { reloadCount++; reloadedCerts.push(cert); },
+            resolveHost: () => "h.example.com",
+        });
+        await mgr.ensureCert();
+        mgr.start();
+        // Give the watcher a tick to attach.
+        await sleep(50);
+        // Write a different cert: should trigger reload after debounce.
+        const replacement = generateSelfSignedCert({ host: "h.example.com", notAfterOffsetMs: 90 * 86_400_000 });
+        writeFileSync(certPath, replacement.cert);
+        writeFileSync(keyPath, replacement.key);
+        // Wait past the 200ms debounce.
+        await sleep(400);
+        assert.ok(reloadCount >= 1, `expected at least one reload, got ${reloadCount}`);
+        // The reloaded cert bytes must match what we wrote (not the original).
+        assert.ok(reloadedCerts[reloadedCerts.length - 1].equals(replacement.cert));
+        mgr.stop();
+    });
+    it("does not call onReload when written bytes have the same notAfter", { skip: !HAS_OPENSSL }, async () => {
+        const fixture = generateSelfSignedCert({ host: "h.example.com", notAfterOffsetMs: 60 * 86_400_000 });
+        const { certPath, keyPath } = setupCertDir(fixture);
+        let reloadCount = 0;
+        const mgr = new CertManager({
+            certPath, keyPath,
+            onReload: () => { reloadCount++; },
+            resolveHost: () => "h.example.com",
+        });
+        await mgr.ensureCert();
+        mgr.start();
+        await sleep(50);
+        // Touch the file with the same bytes — fs.watch fires, but the
+        // notAfter hasn't changed, so we should suppress the reload.
+        writeFileSync(certPath, fixture.cert);
+        await sleep(400);
+        assert.equal(reloadCount, 0);
+        mgr.stop();
+    });
+});
+//# sourceMappingURL=cert-manager.test.js.map

package/dist/test/claude-live-session.test.js

@@ -0,0 +1,110 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { createTestDb } from "./helpers.js";
+import { liveSessionFromRegistryEntry, parsePanePids } from "../claude-live-session.js";
+import { maybeFollowLiveSession, getSessionIds } from "../daemon/server.js";
+import { appendEvent } from "../db/events.js";
+// A registry entry as Claude Code 2.1.281 writes it, trimmed to the fields read.
+const entry = (over = {}) => JSON.stringify({
+    pid: 50960,
+    sessionId: "f3238166-cc8a-4f28-bfd3-7586b2e1abd1",
+    cwd: "/Users/op/dev/app",
+    startedAt: 1_000_000,
+    kind: "interactive",
+    tmux: "claude-3j4583pl:@106.%106",
+    ...over,
+});
+const expect = { narrativeId: "claude-3j4583pl", pid: 50960, foldPath: "/Users/op/dev/app", launchedAt: 1_000_000 };
+describe("liveSessionFromRegistryEntry", () => {
+    it("reads the session of the narrative's own pane process", () => {
+        assert.equal(liveSessionFromRegistryEntry(entry(), expect), "f3238166-cc8a-4f28-bfd3-7586b2e1abd1");
+    });
+    it("refuses an entry for another pid (a recycled or foreign file)", () => {
+        assert.equal(liveSessionFromRegistryEntry(entry({ pid: 50961 }), expect), undefined);
+    });
+    it("refuses an entry naming another tmux session, prefixes included", () => {
+        assert.equal(liveSessionFromRegistryEntry(entry({ tmux: "claude-0i460qwe:@1.%1" }), expect), undefined);
+        assert.equal(liveSessionFromRegistryEntry(entry({ tmux: "claude-3j4583pl2:@1.%1" }), expect), undefined);
+        assert.equal(liveSessionFromRegistryEntry(entry({ tmux: undefined }), expect), undefined);
+    });
+    it("refuses an entry from another directory", () => {
+        assert.equal(liveSessionFromRegistryEntry(entry({ cwd: "/Users/op/dev/other" }), expect), undefined);
+    });
+    it("refuses an entry left by the pane's previous process (started before this launch)", () => {
+        assert.equal(liveSessionFromRegistryEntry(entry({ startedAt: 1_000_000 - 3_600_000 }), expect), undefined);
+    });
+    it("refuses a non-interactive process, and anything unparseable", () => {
+        assert.equal(liveSessionFromRegistryEntry(entry({ kind: "print" }), expect), undefined);
+        assert.equal(liveSessionFromRegistryEntry("{not json", expect), undefined);
+        assert.equal(liveSessionFromRegistryEntry("null", expect), undefined);
+        assert.equal(liveSessionFromRegistryEntry(entry({ sessionId: "" }), expect), undefined);
+    });
+});
+describe("parsePanePids", () => {
+    it("maps each single-pane session to its pane pid", () => {
+        const pids = parsePanePids("claude-a 101\nclaude-b 202\n");
+        assert.equal(pids.get("claude-a"), 101);
+        assert.equal(pids.get("claude-b"), 202);
+    });
+    it("maps a multi-pane session to nothing — it has no single agent process", () => {
+        const pids = parsePanePids("claude-a 101\nclaude-a 303\nclaude-b 202\n");
+        assert.equal(pids.has("claude-a"), false);
+        assert.equal(pids.get("claude-b"), 202);
+    });
+    it("skips malformed lines", () => {
+        assert.equal(parsePanePids("\nclaude-a x\nclaude-b 1\n 7\n").size, 0);
+    });
+});
+describe("maybeFollowLiveSession", () => {
+    function seed(db, agent = "claude") {
+        db.prepare(`INSERT INTO narratives (id, brane_id, agent_type, role, created_at, status, fold_path, agent_session_id, session_ids)
+       VALUES ('n1', 'brane-test', ?, 'worker', 5000, 'active', '/tmp/fold', 'sess-launch', '["sess-launch"]')`).run(agent);
+    }
+    const pointer = (db) => db.prepare("SELECT agent_session_id FROM narratives WHERE id = 'n1'").get()
+        .agent_session_id;
+    it("follows a /clear: moves the pointer and keeps the old session in the cost set", () => {
+        const db = createTestDb();
+        seed(db);
+        const got = maybeFollowLiveSession(db, "n1", "claude", "/tmp/fold", 5000, "sess-launch", () => "sess-cleared");
+        assert.equal(got, "sess-cleared");
+        assert.equal(pointer(db), "sess-cleared");
+        assert.deepEqual(getSessionIds(db, "n1"), ["sess-launch", "sess-cleared"]);
+    });
+    it("is a no-op when the live session is the pointer, or there is no evidence", () => {
+        const db = createTestDb();
+        seed(db);
+        assert.equal(maybeFollowLiveSession(db, "n1", "claude", "/tmp/fold", 5000, "sess-launch", () => "sess-launch"), undefined);
+        assert.equal(maybeFollowLiveSession(db, "n1", "claude", "/tmp/fold", 5000, "sess-launch", () => undefined), undefined);
+        assert.equal(pointer(db), "sess-launch");
+        assert.deepEqual(getSessionIds(db, "n1"), ["sess-launch"]);
+    });
+    it("leaves capture-strategy agents to maybeCaptureSessionId", () => {
+        const db = createTestDb();
+        seed(db, "codex");
+        assert.equal(maybeFollowLiveSession(db, "n1", "codex", "/tmp/fold", 5000, "sess-launch", () => "other"), undefined);
+        assert.equal(pointer(db), "sess-launch");
+    });
+    it("anchors on the latest revive, not the spawn", () => {
+        const db = createTestDb();
+        seed(db);
+        appendEvent(db, "n1", "restarted", { content: "revived" });
+        const restartedAt = db.prepare("SELECT MAX(time) AS t FROM events WHERE type = 'restarted'").get().t;
+        let seen;
+        maybeFollowLiveSession(db, "n1", "claude", "/tmp/fold", 5000, "sess-launch", (o) => {
+            seen = o.launchedAt;
+            return undefined;
+        });
+        assert.equal(seen, restartedAt);
+    });
+    it("passes the fold as an absolute path", () => {
+        const db = createTestDb();
+        seed(db);
+        let fold;
+        maybeFollowLiveSession(db, "n1", "claude", "~/dev/app", 5000, "sess-launch", (o) => {
+            fold = o.foldPath;
+            return undefined;
+        });
+        assert.ok(fold && !fold.startsWith("~"), fold);
+    });
+});
+//# sourceMappingURL=claude-live-session.test.js.map