brane 0.1.1 → 0.3.1

package/dist/test/narrative-menu.test.js

@@ -0,0 +1,150 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { narrativeMenuItems, revivesAsTwin, } from "../shared/narrative-menu.js";
+// Every handler distinct, so a test can tell which item was wired to what — the
+// failure this guards against is not a missing item but a mislabeled one.
+function options(over = {}) {
+    return {
+        onMeld: () => { },
+        onIsolate: () => { },
+        onExport: () => { },
+        onRecolor: () => { },
+        onTwin: () => { },
+        onRevive: () => { },
+        onEnd: () => { },
+        onArchiveToggle: () => { },
+        ...over,
+    };
+}
+const labels = (over = {}) => narrativeMenuItems(options(over)).map((i) => i.label);
+describe("narrativeMenuItems — Export scope", () => {
+    const exportItems = (over = {}) => narrativeMenuItems(options(over)).filter((i) => i.label.startsWith("Export"));
+    const exportLabels = (over = {}) => exportItems(over).map((i) => i.label);
+    it("is a single plain Export with no selection", () => {
+        assert.deepEqual(exportLabels(), ["Export"]);
+        assert.deepEqual(exportLabels({ selectedCount: 0 }), ["Export"]);
+    });
+    it("offers both sides of a selection, each naming its count", () => {
+        assert.deepEqual(exportLabels({ selectedCount: 1 }), [
+            "Export 1 selected",
+            "Export 1 excluded",
+        ]);
+        assert.deepEqual(exportLabels({ selectedCount: 12 }), [
+            "Export 12 selected",
+            "Export 12 excluded",
+        ]);
+    });
+    it("gives the two items distinct icons", () => {
+        // They sit adjacent in the menu and differ only in a word; an operator
+        // scanning icons should not have to read the label to tell them apart.
+        const icons = exportItems({ selectedCount: 3 }).map((i) => i.icon);
+        assert.deepEqual(icons, ["📨", "📤"]);
+    });
+    it("tells the press which scope was asked for", () => {
+        // The screen exports the selection or its complement off this argument
+        // alone — a handler that ignored it would export the same file twice.
+        const scopes = [];
+        for (const item of exportItems({ selectedCount: 2, onExport: (s) => scopes.push(s) })) {
+            item.onPress();
+        }
+        assert.deepEqual(scopes, ["selected", "excluded"]);
+    });
+    it("asks for the whole conversation when nothing is selected", () => {
+        const scopes = [];
+        exportItems({ onExport: (s) => scopes.push(s) })[0].onPress();
+        assert.deepEqual(scopes, ["all"]);
+    });
+    it("changes nothing else about the menu", () => {
+        assert.deepEqual(labels({ status: "active", mcpConnected: true, selectedCount: 2 }).filter((l) => !l.startsWith("Export")), labels({ status: "active", mcpConnected: true }).filter((l) => !l.startsWith("Export")));
+    });
+});
+describe("narrativeMenuItems", () => {
+    it("offers the same menu on a running narrative from either surface", () => {
+        // The builder exists so the detail header and the list card can't drift.
+        // This is that claim: one input, one menu, no surface-dependent branch.
+        assert.deepEqual(labels({ status: "active", mcpConnected: true }), [
+            "Meld",
+            "Isolate",
+            "Export",
+            "Recolor",
+            "Twin",
+            "End",
+            "Archive",
+        ]);
+    });
+    it("swaps End for Revive once the session is over", () => {
+        assert.ok(labels({ status: "active", mcpConnected: true }).includes("End"));
+        assert.ok(labels({ status: "ended" }).includes("Revive"));
+        assert.ok(!labels({ status: "ended" }).includes("End"));
+    });
+    it("treats an ended row still holding an MCP bridge as running", () => {
+        // A stale `ended` row that the daemon hasn't healed yet still has an agent
+        // on the bridge — offering Revive there would restart a live session.
+        assert.ok(labels({ status: "ended", mcpConnected: true }).includes("End"));
+    });
+    it("gives an external narrative no in-place lifecycle item at all", () => {
+        // No tmux process to end or resume; Twin is its only lifecycle action.
+        const external = labels({ role: "external", status: "ended" });
+        assert.ok(!external.includes("Revive"));
+        assert.ok(!external.includes("End"));
+        assert.ok(external.includes("Twin"));
+    });
+    it("keeps Revive on an absorbed import, which reaches Twin through it", () => {
+        assert.ok(labels({ role: "absorbed", status: "ended" }).includes("Revive"));
+    });
+    it("flips the archive item both ways", () => {
+        assert.ok(labels({ archived: false }).includes("Archive"));
+        assert.ok(labels({ archived: true }).includes("Unarchive"));
+    });
+    it("flips isolate by where the app is served from", () => {
+        assert.ok(labels({ isIsolated: false }).includes("Isolate"));
+        assert.ok(labels({ isIsolated: true }).includes("Unisolate"));
+    });
+    it("wires each item to its own handler", () => {
+        const fired = [];
+        const items = narrativeMenuItems(options({
+            status: "ended",
+            onMeld: () => fired.push("meld"),
+            onIsolate: () => fired.push("isolate"),
+            onExport: () => fired.push("export"),
+            onRecolor: () => fired.push("recolor"),
+            onTwin: () => fired.push("twin"),
+            onRevive: () => fired.push("revive"),
+            onArchiveToggle: () => fired.push("archive"),
+        }));
+        for (const item of items)
+            item.onPress();
+        assert.deepEqual(fired, ["meld", "isolate", "export", "recolor", "twin", "revive", "archive"]);
+    });
+    it("gives every item an icon and a unique label", () => {
+        // ContextMenu keys its buttons by label, so a duplicate would drop a row.
+        const items = narrativeMenuItems(options());
+        assert.ok(items.every((i) => i.icon));
+        assert.equal(new Set(items.map((i) => i.label)).size, items.length);
+    });
+});
+describe("revivesAsTwin", () => {
+    it("names the roles with nothing to resume", () => {
+        assert.equal(revivesAsTwin("external"), true);
+        assert.equal(revivesAsTwin("absorbed"), true);
+    });
+    it("leaves every ordinary role to revive in place", () => {
+        for (const role of ["worker", "twin", "keeper", "utility", null, undefined]) {
+            assert.equal(revivesAsTwin(role), false, `role: ${role}`);
+        }
+    });
+});
+describe("narrativeMenuItems — Isolate", () => {
+    it("reads Isolate on a shared app and Unisolate on a daemon's own bundle", () => {
+        assert.ok(labels().includes("Isolate"));
+        assert.ok(labels({ isIsolated: true }).includes("Unisolate"));
+    });
+    it("is left out when there is nowhere to go, and nothing else moves", () => {
+        // A daemon's own bundle whose daemon reported no app host: offering the
+        // item would mean a link to a host the app made up.
+        const without = labels({ isIsolated: true, canIsolate: false });
+        assert.ok(!without.includes("Isolate") && !without.includes("Unisolate"));
+        assert.deepEqual(without, labels({ isIsolated: true }).filter((l) => l !== "Unisolate"));
+    });
+});
+//# sourceMappingURL=narrative-menu.test.js.map

package/dist/test/narrative-sort.test.js

@@ -0,0 +1,75 @@
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { sortNarratives } from "../shared/narrative-sort.js";
+const row = (id, status, created_at, mcp_connected = false) => ({ id, status, created_at, mcp_connected });
+const ids = (rows) => sortNarratives(rows).map((n) => n.id);
+describe("sortNarratives", () => {
+    test("sinks ended below everything else", () => {
+        const rows = [
+            row("dead-old", "ended", 100),
+            row("live", "active", 200),
+            row("dead-new", "ended", 900),
+            row("idle", "idle", 300),
+        ];
+        assert.deepEqual(ids(rows), ["idle", "live", "dead-new", "dead-old"]);
+    });
+    test("newest first within each group", () => {
+        const rows = [row("a", "active", 100), row("c", "active", 300), row("b", "active", 200)];
+        assert.deepEqual(ids(rows), ["c", "b", "a"]);
+    });
+    // The whole point of the change this file guards: a bridge dropping must not
+    // reorder anything. Same rows, `mcp_connected` inverted — same order.
+    test("mcp_connected does not affect order", () => {
+        const rows = [
+            row("first", "active", 300, false),
+            row("second", "active", 200, true),
+            row("third", "active", 100, false),
+        ];
+        const flipped = rows.map((n) => ({ ...n, mcp_connected: !n.mcp_connected }));
+        assert.deepEqual(ids(rows), ["first", "second", "third"]);
+        assert.deepEqual(ids(flipped), ["first", "second", "third"]);
+    });
+    // A connected-but-ended narrative gets the dead badge, so it must sort with
+    // the dead. This is the case where the old three-way rank disagreed with the
+    // badge outright: it ranked such a row *first*.
+    test("ended sinks even while still bridged", () => {
+        const rows = [row("bridged-dead", "ended", 900, true), row("live", "active", 100)];
+        assert.deepEqual(ids(rows), ["live", "bridged-dead"]);
+    });
+    test("does not mutate its input", () => {
+        const rows = [row("a", "ended", 300), row("b", "active", 100)];
+        const before = rows.map((n) => n.id);
+        sortNarratives(rows);
+        assert.deepEqual(rows.map((n) => n.id), before);
+    });
+    test("empty and single-element lists are fine", () => {
+        assert.deepEqual(sortNarratives([]), []);
+        assert.deepEqual(ids([row("only", "ended", 1)]), ["only"]);
+    });
+});
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const read = (rel) => readFileSync(join(repoRoot, rel), "utf8");
+// Lints source the tarball doesn't ship (`expo/dist/` ships, the `.tsx` does
+// not). From an installed package — `brane doctor` — these skip with a reason
+// instead of failing on ENOENT.
+const skip = existsSync(join(repoRoot, "expo", "app", "index.tsx"))
+    ? false
+    : "expo source not shipped";
+// Every screen that lists narratives, and the local name each one had for its
+// own copy of the rule before the extraction.
+const LIST_SCREENS = ["expo/app/index.tsx", "expo/app/[nid].tsx"];
+describe("narrative-listing screens share one ordering rule", () => {
+    for (const file of LIST_SCREENS) {
+        test(file, { skip }, () => {
+            const src = read(file);
+            assert.match(src, /import \{ sortNarratives \} from "@shared\/narrative-sort"/, `${file} must order narratives through @shared/narrative-sort`);
+            // A local `rank` over `mcp_connected` is exactly the shape that drifted.
+            assert.doesNotMatch(src, /rank\s*=\s*\([^)]*\)\s*=>[\s\S]{0,80}?mcp_connected/, `${file} must not rank narratives on mcp_connected — use sortNarratives`);
+            assert.doesNotMatch(src, /function sortNarratives\b/, `${file} must not define its own sortNarratives`);
+        });
+    }
+});
+//# sourceMappingURL=narrative-sort.test.js.map

package/dist/test/no-pan.test.js

@@ -0,0 +1,60 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { TAP_FOCUS_GRACE_MS, dragAllowed, isTextEntry, layoutHeight, mustBlur, scrollBoxOf } from "../shared/no-pan.js";
+const box = (scrollTop, clientHeight = 100, scrollHeight = 300, overflowY = "auto", reversed = false) => scrollBoxOf({ overflowY, reversed, scrollTop, clientHeight, scrollHeight });
+const plain = { scrolls: false, roomAbove: 0, roomBelow: 0 };
+describe("no-pan", () => {
+    it("takes over taps on text fields only", () => {
+        assert.equal(isTextEntry({ tagName: "INPUT", type: "search" }), true);
+        assert.equal(isTextEntry({ tagName: "input" }), true, "no type is text");
+        assert.equal(isTextEntry({ tagName: "TEXTAREA" }), true);
+        assert.equal(isTextEntry({ tagName: "DIV", isContentEditable: true }), true);
+        assert.equal(isTextEntry({ tagName: "INPUT", type: "checkbox" }), false);
+        assert.equal(isTextEntry({ tagName: "INPUT", type: "submit" }), false);
+        assert.equal(isTextEntry({ tagName: "INPUT", type: "text", disabled: true }), false);
+        assert.equal(isTextEntry({ tagName: "TEXTAREA", readOnly: true }), false);
+        assert.equal(isTextEntry({ tagName: "BUTTON" }), false);
+    });
+    it("refuses a vertical drag nothing under the finger can scroll — the header, a bar", () => {
+        assert.equal(dragAllowed(0, 30, [plain, plain]), false);
+        assert.equal(dragAllowed(0, -30, [plain]), false);
+    });
+    it("lets a scroller take the drag while it can move that way", () => {
+        assert.equal(dragAllowed(0, 30, [plain, box(50)]), true, "finger down, content can go toward its top");
+        assert.equal(dragAllowed(0, -30, [plain, box(50)]), true);
+    });
+    it("refuses the drag a scroller at its end would hand on to the page", () => {
+        assert.equal(dragAllowed(0, 30, [box(0)]), false, "at the top, pulling down");
+        assert.equal(dragAllowed(0, -30, [box(200)]), false, "at the bottom, pushing up");
+        assert.equal(dragAllowed(0, -30, [box(200), box(10)]), true, "an outer scroller can still take it");
+    });
+    it("ignores boxes that are not scrollers, or have nothing to scroll", () => {
+        assert.equal(dragAllowed(0, -30, [box(0, 100, 300, "hidden")]), false);
+        assert.equal(dragAllowed(0, -30, [box(0, 100, 100)]), false);
+    });
+    it("reads a column-reverse scroller (the chat) the right way round", () => {
+        // At its bottom a reversed scroller's scrollTop is 0 and history is above.
+        assert.equal(dragAllowed(0, 30, [box(0, 100, 300, "auto", true)]), true, "at the bottom, pulling down into history");
+        assert.equal(dragAllowed(0, -30, [box(0, 100, 300, "auto", true)]), false, "nothing below the bottom");
+        assert.equal(dragAllowed(0, 30, [box(-200, 100, 300, "auto", true)]), false, "at the top of history");
+        assert.equal(dragAllowed(0, -30, [box(-200, 100, 300, "auto", true)]), true);
+    });
+    it("never guards a horizontal drag", () => {
+        assert.equal(dragAllowed(40, 10, [plain]), true);
+    });
+    it("sizes the layout to the visible area, and freezes it while zoomed", () => {
+        assert.equal(layoutHeight(412.6, 1, null), 413);
+        assert.equal(layoutHeight(200, 2, 766), 766);
+        assert.equal(layoutHeight(200, 2, null), null);
+    });
+    it("never leaves a text field focused with the keyboard down on a touch screen", () => {
+        const base = { touch: true, textEntryFocused: true, keyboardUp: false, msSinceTapFocus: 60_000 };
+        assert.equal(mustBlur(base), true, "swiped away, autofocused, or focused from code");
+        assert.equal(mustBlur({ ...base, keyboardUp: true }), false, "typing");
+        assert.equal(mustBlur({ ...base, msSinceTapFocus: 200 }), false, "our tap, keyboard still rising");
+        assert.equal(mustBlur({ ...base, msSinceTapFocus: TAP_FOCUS_GRACE_MS + 1 }), true, "our tap, but the keyboard never came");
+        assert.equal(mustBlur({ ...base, textEntryFocused: false }), false, "nothing to blur");
+        assert.equal(mustBlur({ ...base, touch: false }), false, "a desktop has no soft keyboard to wait for");
+    });
+});
+//# sourceMappingURL=no-pan.test.js.map

package/dist/test/pane-layout.test.js

@@ -0,0 +1,153 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { CANONICAL_TABS } from "../shared/view-url.js";
+import { visiblePanes, selectPane } from "../shared/pane-layout.js";
+// The bug these pin is one a rendering test would not have caught, because the
+// render is correct: tapping the terminal in a Chat+Terminal split really did
+// select the terminal, and really did draw it full width. What broke was the
+// *tap* — the pane grew under the finger between pointerdown and pointerup, so
+// no click was ever dispatched and the quick key sent nothing. The invariant
+// that prevents it is about the visible set, not about pixels: selecting a
+// pane you can already see must not change which panes are visible.
+/** Every subset of the tab set, as a Set — 8 of them. */
+function pinPowerset() {
+    const out = [];
+    for (let mask = 0; mask < 1 << CANONICAL_TABS.length; mask++) {
+        const pins = new Set();
+        CANONICAL_TABS.forEach((t, i) => { if (mask & (1 << i))
+            pins.add(t); });
+        out.push(pins);
+    }
+    return out;
+}
+const show = (active, pins) => `${active}+[${[...pins].sort().join(",")}]`;
+describe("visiblePanes", () => {
+    it("is the active pane plus the pinned ones, in tab-bar order", () => {
+        assert.deepEqual(visiblePanes("terminal", new Set()), ["terminal"]);
+        assert.deepEqual(visiblePanes("terminal", new Set(["chat"])), ["chat", "terminal"]);
+        // Pinning the active pane is not a second pane.
+        assert.deepEqual(visiblePanes("chat", new Set(["chat"])), ["chat"]);
+        assert.deepEqual(visiblePanes("files", new Set(["terminal", "chat"])), ["chat", "terminal", "files"]);
+    });
+});
+describe("selectPane", () => {
+    it("selecting a visible pane leaves the visible set untouched", () => {
+        for (const pins of pinPowerset()) {
+            for (const active of CANONICAL_TABS) {
+                const before = visiblePanes(active, pins);
+                for (const tapped of before) {
+                    const next = selectPane(active, pins, tapped);
+                    assert.deepEqual(visiblePanes(next.active, next.pinned), before, `${show(active, pins)} tapping ${tapped}`);
+                    assert.equal(next.active, tapped, `${show(active, pins)} tapping ${tapped}`);
+                }
+            }
+        }
+    });
+    it("the split that motivated this: Chat active, Terminal pinned", () => {
+        // The ordinary way an operator gets a split — and the case where the naive
+        // `setActiveTab` dropped Chat, because Chat was visible only by being
+        // active. Both panes must survive a tap on the terminal.
+        const next = selectPane("chat", new Set(["terminal"]), "terminal");
+        assert.deepEqual(visiblePanes(next.active, next.pinned), ["chat", "terminal"]);
+        assert.equal(next.active, "terminal");
+        // Chat stays by being pinned on the way past; the terminal keeps the pin
+        // the operator gave it.
+        assert.deepEqual([...next.pinned].sort(), ["chat", "terminal"]);
+    });
+    it("never unpins anything: a pin comes off only through its toggle", () => {
+        // Tapping into a pinned pane used to unpin it, since being active shows
+        // it anyway. The visible set survived that tap, but the pin did not, so
+        // the next tab change dropped a pane the operator had pinned.
+        for (const pins of pinPowerset()) {
+            for (const active of CANONICAL_TABS) {
+                for (const tapped of CANONICAL_TABS) {
+                    const next = selectPane(active, pins, tapped);
+                    for (const pin of pins) {
+                        assert.ok(next.pinned.has(pin), `${show(active, pins)} tapping ${tapped} unpinned ${pin}`);
+                    }
+                }
+            }
+        }
+    });
+    it("Terminal and Files pinned: tapping between them keeps both pins", () => {
+        const pins = new Set(["terminal", "files"]);
+        const toFiles = selectPane("terminal", pins, "files");
+        assert.deepEqual([...toFiles.pinned].sort(), ["files", "terminal"]);
+        const back = selectPane(toFiles.active, toFiles.pinned, "terminal");
+        assert.deepEqual([...back.pinned].sort(), ["files", "terminal"]);
+        assert.deepEqual(visiblePanes(back.active, back.pinned), ["terminal", "files"]);
+    });
+    it("never shrinks the visible set, even when the tapped pane was hidden", () => {
+        // The reveal case (`revealTerminal`): a hidden pane joins the visible set
+        // rather than replacing it.
+        for (const pins of pinPowerset()) {
+            for (const active of CANONICAL_TABS) {
+                for (const tapped of CANONICAL_TABS) {
+                    const before = new Set(visiblePanes(active, pins));
+                    const next = selectPane(active, pins, tapped);
+                    for (const pane of before) {
+                        assert.ok(visiblePanes(next.active, next.pinned).includes(pane), `${show(active, pins)} tapping ${tapped} dropped ${pane}`);
+                    }
+                }
+            }
+        }
+    });
+    it("is idempotent and does not mutate its input", () => {
+        const pins = new Set(["terminal"]);
+        const once = selectPane("chat", pins, "terminal");
+        assert.deepEqual([...pins], ["terminal"], "input set was mutated");
+        const twice = selectPane(once.active, once.pinned, "terminal");
+        assert.equal(twice.active, once.active);
+        assert.deepEqual([...twice.pinned].sort(), [...once.pinned].sort());
+    });
+});
+// The rest of the fix is a DOM rule that has no pure form: the pane-select
+// listener must ignore presses that land on a control. Reading the source is
+// how `api-request.test.ts` and `key-routing.test.ts` pin their invisible
+// invariants, and this one is invisible in the same way — put `activateTab`
+// back in the handler and every test still passes while the quick bar goes
+// back to eating every other tap.
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const screen = join(repoRoot, "expo", "app", "[nid].tsx");
+// `expo/dist` ships in the tarball; the .tsx does not. From an install this
+// skips with a reason rather than failing on ENOENT — see `brane doctor`.
+const skip = !existsSync(screen) ? "expo source not shipped" : false;
+describe("the pane-select listener", () => {
+    it("selects through selectPane, not through activateTab", { skip }, () => {
+        const src = readFileSync(screen, "utf8");
+        const start = src.indexOf('document.addEventListener("pointerdown"');
+        assert.notEqual(start, -1, "pointerdown pane-select listener not found");
+        const handler = src.slice(src.lastIndexOf("const handler", start), start);
+        assert.match(handler, /selectVisiblePane\(pane\)/);
+        assert.doesNotMatch(handler, /activateTab\(/, "pane selection must preserve the visible set (selectPane), not just set the tab");
+    });
+    it("listens only while its screen is the foreground route", { skip }, () => {
+        // The Stack keeps screens behind the top one mounted. A hidden screen's
+        // listener heard taps on the screen in front, selected a pane in its own
+        // layout (pinning its Chat), and router.setParams — which writes to the
+        // focused route — put that layout into the visible screen's URL.
+        const src = readFileSync(screen, "utf8");
+        const start = src.indexOf('document.addEventListener("pointerdown"');
+        const effect = src.slice(src.lastIndexOf("useEffect(", start), start);
+        assert.match(effect, /if \(!screenFocused\) return;/);
+        const deps = src.slice(start, src.indexOf("]);", start));
+        assert.match(deps, /\[screenFocused,/, "screenFocused must be an effect dependency");
+    });
+    it("ignores presses that land on a control", { skip }, () => {
+        const src = readFileSync(screen, "utf8");
+        const start = src.indexOf('document.addEventListener("pointerdown"');
+        const handler = src.slice(src.lastIndexOf("const handler", start), start);
+        assert.match(handler, /closest\?\.\(INTERACTIVE_SELECTOR\)\) return;/);
+        // The bail must come before the pane is read, or it bails after the work.
+        assert.ok(handler.indexOf("INTERACTIVE_SELECTOR") < handler.indexOf('closest?.("[data-pane]")'), "the control bail must precede the pane lookup");
+        // Text fields are not controls for this purpose: clicking into the
+        // composer is a request to type there, and the tab should follow.
+        const selector = src.match(/const INTERACTIVE_SELECTOR =\s*([^;]+);/);
+        assert.ok(selector, "INTERACTIVE_SELECTOR not found");
+        assert.doesNotMatch(selector[1], /input|textarea/);
+    });
+});
+//# sourceMappingURL=pane-layout.test.js.map

package/dist/test/paths.test.js

@@ -0,0 +1,37 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { homedir } from "node:os";
+import { toPortablePath, fromPortablePath } from "../db/schema.js";
+describe("toPortablePath", () => {
+    it("converts home directory to ~", () => {
+        assert.equal(toPortablePath(homedir()), "~");
+    });
+    it("converts path under home to ~/relative", () => {
+        const home = homedir();
+        assert.equal(toPortablePath(`${home}/dev/myproject`), "~/dev/myproject");
+    });
+    it("leaves paths outside home unchanged", () => {
+        assert.equal(toPortablePath("/tmp/something"), "/tmp/something");
+    });
+    it("does not match partial home prefix", () => {
+        const home = homedir();
+        // e.g., /Users/benjamin should not match /Users/ben
+        assert.equal(toPortablePath(`${home}zzz/extra`), `${home}zzz/extra`);
+    });
+});
+describe("fromPortablePath", () => {
+    it("resolves ~ to home directory", () => {
+        assert.equal(fromPortablePath("~"), homedir());
+    });
+    it("resolves ~/relative to absolute path", () => {
+        assert.equal(fromPortablePath("~/dev/myproject"), `${homedir()}/dev/myproject`);
+    });
+    it("leaves absolute paths unchanged", () => {
+        assert.equal(fromPortablePath("/tmp/something"), "/tmp/something");
+    });
+    it("round-trips through toPortablePath", () => {
+        const original = `${homedir()}/dev/test-project`;
+        assert.equal(fromPortablePath(toPortablePath(original)), original);
+    });
+});
+//# sourceMappingURL=paths.test.js.map

package/dist/test/payload-inline.test.js

@@ -0,0 +1,91 @@
+import { test, describe } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+import { isInlinePayload, attachmentDisposition } from "../shared/payload-inline.js";
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+describe("isInlinePayload", () => {
+    test("images render inline", () => {
+        for (const p of ["a.png", "a.JPG", "a.jpeg", "a.gif", "a.webp", "a.bmp", "a.avif", "a.svg"]) {
+            assert.equal(isInlinePayload(p), true, p);
+        }
+    });
+    test("everything else is a file, including what a browser could display", () => {
+        // The question is not "can the browser render it" — it is "does brane
+        // render it inline". A `.pdf` or `.html` a browser would happily make a
+        // page of is exactly the case this exists to catch.
+        for (const p of ["a.pdf", "a.html", "a.txt", "a.json", "a.zip", "a"]) {
+            assert.equal(isInlinePayload(p), false, p);
+        }
+    });
+    test("the extension must end the name", () => {
+        assert.equal(isInlinePayload("a.png.html"), false);
+        assert.equal(isInlinePayload("png"), false);
+    });
+    test("a full payload path answers the same as its basename", () => {
+        assert.equal(isInlinePayload("claude-4c7289d1/shot.png"), true);
+        assert.equal(isInlinePayload("claude-4c7289d1/notes.md"), false);
+    });
+    test("a dot in a directory name is not the file's extension", () => {
+        assert.equal(isInlinePayload("shots.png/README"), false);
+    });
+});
+describe("attachmentDisposition", () => {
+    test("a plain name is a quoted attachment", () => {
+        assert.equal(attachmentDisposition("notes.md"), 'attachment; filename="notes.md"');
+    });
+    test("a quote in the name cannot end the quoted string early", () => {
+        // Otherwise `"; filename="evil.exe` is an injection into the parameter
+        // list, and the browser saves under the second name.
+        assert.equal(attachmentDisposition('a".txt'), 'attachment; filename="a\\".txt"');
+        // A backslash never survives as itself: it is a path separator on the
+        // other kind of machine, so it is neutralized before quoting rather than
+        // escaped into the header.
+        assert.equal(attachmentDisposition("a\\b.txt"), 'attachment; filename="a_b.txt"');
+    });
+    test("a non-ASCII name sends both parameters", () => {
+        const d = attachmentDisposition("réponse.txt");
+        assert.match(d, /^attachment; filename="r_ponse\.txt"; filename\*=UTF-8''/);
+        assert.ok(d.endsWith("r%C3%A9ponse.txt"), d);
+    });
+    test("path separators and control characters never reach the header", () => {
+        // A payload filename is whatever an agent narrated: a CR would end the
+        // header, and a slash would suggest a directory to save into.
+        assert.equal(attachmentDisposition("../../etc/passwd"), 'attachment; filename=".._.._etc_passwd"');
+        assert.equal(attachmentDisposition("a\r\nX-Evil: 1"), 'attachment; filename="aX-Evil: 1"');
+    });
+    test("a name that survives none of that still yields something saveable", () => {
+        assert.equal(attachmentDisposition(""), 'attachment; filename="download"');
+        assert.equal(attachmentDisposition(" "), 'attachment; filename=" "');
+    });
+});
+// The rule is only as good as its call sites, and this is a regression use
+// cannot show you: opening a tokened URL as a page looks perfectly fine until
+// someone saves it. Same shape as the source lint in `api-request.test.ts`.
+const chatSource = join(repoRoot, "expo", "app", "[nid].tsx");
+const filesSource = join(repoRoot, "expo", "components", "FilesView.tsx");
+const sourcesPresent = existsSync(chatSource) && existsSync(filesSource);
+describe("the app never navigates to a tokened daemon URL", {
+    skip: sourcesPresent ? false : "expo source not shipped",
+}, () => {
+    const sources = sourcesPresent
+        ? [
+            { path: "expo/app/[nid].tsx", text: readFileSync(chatSource, "utf8") },
+            { path: "expo/components/FilesView.tsx", text: readFileSync(filesSource, "utf8") },
+        ]
+        : [];
+    test("no window.open on a payload or raw-file URL", () => {
+        for (const { path, text } of sources) {
+            for (const m of text.matchAll(/window\.open\(([^)]*)\)/g)) {
+                assert.ok(!/payloadUrl|filesRawUrl/.test(m[1]), `${path}: window.open(${m[1]}) — download it instead; the URL carries the token`);
+            }
+        }
+    });
+    test("both files reach those URLs through the download helper", () => {
+        for (const { path, text } of sources) {
+            assert.match(text, /from "@\/lib\/download"/, `${path} should import the helper`);
+        }
+    });
+});
+//# sourceMappingURL=payload-inline.test.js.map

package/dist/test/precache-fonts.test.js

@@ -0,0 +1,72 @@
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { existsSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+// The service worker's KaTeX split, held to the stylesheet it serves.
+//
+// gen-precache.mjs precaches the faces of the two families nearly every
+// equation uses and leaves the rest to sw.js's on-demand VENDOR_CACHE. Its own
+// build-time guard catches a *kept* face disappearing. This catches the other
+// direction: a KaTeX upgrade that adds a face to a kept family, which would
+// silently land in the tail and render in fallback glyphs offline.
+//
+// Reads source, which the npm tarball doesn't ship, so an installed package
+// skips rather than failing (`brane doctor` runs this suite).
+const repoRoot = join(dirname(fileURLToPath(import.meta.url)), "..", "..");
+const CSS = join(repoRoot, "expo", "public", "katex", "katex.min.css");
+const GEN = join(repoRoot, "expo", "scripts", "gen-precache.mjs");
+const SW = join(repoRoot, "expo", "public", "sw.js");
+const skip = [CSS, GEN, SW].some((p) => !existsSync(p)) ? "expo source not shipped" : false;
+/** family → the woff2 files its @font-face rules name. */
+function faces() {
+    const out = new Map();
+    const css = readFileSync(CSS, "utf8");
+    // KaTeX writes some family names quoted (`font-family:"KaTeX_SansSerif"`);
+    // an unquoted-only pattern skipped those rules, and a face added to a kept
+    // family under a quoted name would have made "kept whole" pass vacuously.
+    for (const m of css.matchAll(/@font-face\{[^}]*?font-family:"?([\w-]+)"?;[^}]*?url\(fonts\/([\w-]+\.woff2)\)/g)) {
+        out.set(m[1], [...(out.get(m[1]) ?? []), m[2]]);
+    }
+    const rules = (css.match(/@font-face\{/g) ?? []).length;
+    const parsed = [...out.values()].reduce((n, fs) => n + fs.length, 0);
+    assert.equal(parsed, rules, "every @font-face rule was parsed — none skipped by the pattern");
+    return out;
+}
+function shellFonts() {
+    const block = /const SHELL_FONTS = \[([\s\S]*?)\];/.exec(readFileSync(GEN, "utf8"));
+    assert.ok(block, "gen-precache.mjs declares SHELL_FONTS");
+    return [...block[1].matchAll(/"([^"]+)"/g)].map((m) => m[1]);
+}
+describe("the KaTeX precache split", () => {
+    it("every kept face is one the stylesheet uses", { skip }, () => {
+        const all = new Set([...faces().values()].flat());
+        assert.ok(all.size > 0, "parsed the stylesheet's @font-face rules");
+        for (const f of shellFonts())
+            assert.ok(all.has(f), `${f} is not in katex.min.css`);
+    });
+    it("a kept family is kept whole", { skip }, () => {
+        const kept = new Set(shellFonts());
+        const byFamily = faces();
+        const families = new Set([...byFamily].filter(([, fs]) => fs.some((f) => kept.has(f))).map(([fam]) => fam));
+        assert.deepEqual([...families].sort(), ["KaTeX_Main", "KaTeX_Math"]);
+        for (const fam of families) {
+            for (const f of byFamily.get(fam))
+                assert.ok(kept.has(f), `${f} (${fam}) would fall to the on-demand tail`);
+        }
+    });
+    it("an HTML answer to a static request is never cached", { skip }, () => {
+        // The servers answer an unknown path with the SPA shell and a 200; kept
+        // under a font's URL in VENDOR_CACHE, that would outlive every build.
+        const sw = readFileSync(SW, "utf8");
+        assert.match(sw, /response\.ok && !isShellFallback\(response\)/);
+        assert.match(sw, /function isShellFallback[\s\S]*?text\/html/);
+    });
+    it("the on-demand tail lives in a cache activate keeps", { skip }, () => {
+        const sw = readFileSync(SW, "utf8");
+        assert.match(sw, /__BRANE_VENDOR_CACHE__/, "the generator fills VENDOR_CACHE");
+        assert.match(sw, /k !== CACHE_NAME && k !== VENDOR_CACHE/, "activate spares the vendor cache");
+        assert.match(sw, /isVendor\(url\.pathname\) \? VENDOR_CACHE : CACHE_NAME/, "on-demand vendored files are stored there");
+    });
+});
+//# sourceMappingURL=precache-fonts.test.js.map