create-harness-vibe-coding 0.8.19 → 0.9.3

package/src/wf-ui-server/__tests__/workspace-reveal.test.mjs

@@ -0,0 +1,138 @@
+import test, { afterEach } from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import fs from 'node:fs';
+import path from 'node:path';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+import { startServer, stopServer } from '../server.mjs';
+import { planRevealWorkspacePath } from '../workspace-store.mjs';
+
+// task-wf-ui-terminal-explorer-ux AC-009: /api/workspace/reveal must validate
+// containment + existence before launching anything, and construct the right
+// per-platform spawn plan. Plan-level tests never spawn; the HTTP-level test
+// runs the route under WF_UI_REVEAL_DRY_RUN=1 so no OS window opens.
+
+const cleanup = [];
+
+afterEach(async () => {
+  while (cleanup.length) {
+    const item = cleanup.pop();
+    if (item.server) await stopServer(item.server);
+    if (item.root) fs.rmSync(item.root, { recursive: true, force: true });
+  }
+});
+
+function tempRoot() {
+  const root = makeHarnessTempRoot('wf-workspace-reveal-');
+  cleanup.push({ root });
+  return root;
+}
+
+function requestJson(baseUrl, method, route, payload) {
+  const url = new URL(route, baseUrl);
+  const body = payload === undefined ? null : JSON.stringify(payload);
+  return new Promise((resolve, reject) => {
+    const req = http.request({
+      hostname: url.hostname,
+      port: url.port,
+      path: url.pathname,
+      method,
+      headers: body ? { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body) } : {},
+    }, (res) => {
+      let raw = '';
+      res.on('data', chunk => { raw += chunk; });
+      res.on('end', () => {
+        let data = null;
+        try { data = raw ? JSON.parse(raw) : null; } catch { /* non-JSON body */ }
+        resolve({ status: res.statusCode, data, raw });
+      });
+    });
+    req.on('error', reject);
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
+test('planRevealWorkspacePath rejects paths escaping the workspace', () => {
+  const root = tempRoot();
+  assert.throws(
+    () => planRevealWorkspacePath(root, '../outside-secret.txt'),
+    (e) => e.statusCode === 400,
+    'traversal must be rejected with a 400-class WorkspaceStoreError',
+  );
+  assert.throws(
+    () => planRevealWorkspacePath(root, '..'),
+    (e) => e.statusCode === 400,
+    'bare parent traversal must be rejected',
+  );
+});
+
+test('planRevealWorkspacePath rejects missing paths with 404', () => {
+  const root = tempRoot();
+  assert.throws(
+    () => planRevealWorkspacePath(root, 'does-not-exist.md'),
+    (e) => e.statusCode === 404 && e.code === 'NOT_FOUND',
+    'missing paths must 404 before any spawn plan is built',
+  );
+});
+
+test('planRevealWorkspacePath builds the per-platform plan for file and directory', () => {
+  const root = tempRoot();
+  fs.mkdirSync(path.join(root, 'sub'), { recursive: true });
+  fs.writeFileSync(path.join(root, 'sub', 'note.md'), '# hi');
+
+  const filePlan = planRevealWorkspacePath(root, 'sub/note.md');
+  assert.equal(filePlan.path, 'sub/note.md');
+  assert.equal(filePlan.isDirectory, false);
+  assert.equal(filePlan.absolutePath, path.join(root, 'sub', 'note.md'));
+
+  const dirPlan = planRevealWorkspacePath(root, 'sub');
+  assert.equal(dirPlan.isDirectory, true);
+  assert.equal(dirPlan.absolutePath, path.join(root, 'sub'));
+
+  if (process.platform === 'win32') {
+    assert.equal(filePlan.command, 'explorer.exe');
+    assert.equal(filePlan.args[0], `/select,${filePlan.absolutePath}`);
+    assert.deepEqual(dirPlan.args, [dirPlan.absolutePath]);
+  } else if (process.platform === 'darwin') {
+    assert.equal(filePlan.command, 'open');
+    assert.deepEqual(filePlan.args, ['-R', filePlan.absolutePath]);
+    assert.deepEqual(dirPlan.args, [dirPlan.absolutePath]);
+  } else {
+    assert.equal(filePlan.command, 'xdg-open');
+    assert.deepEqual(filePlan.args, [path.dirname(filePlan.absolutePath)]);
+    assert.deepEqual(dirPlan.args, [dirPlan.absolutePath]);
+  }
+
+  // Absolute paths inside the workspace are also accepted (File node framing).
+  const absPlan = planRevealWorkspacePath(root, filePlan.absolutePath);
+  assert.equal(absPlan.path, 'sub/note.md');
+});
+
+test('POST /api/workspace/reveal validates under dry-run and never spawns', async () => {
+  const prev = process.env.WF_UI_REVEAL_DRY_RUN;
+  process.env.WF_UI_REVEAL_DRY_RUN = '1';
+  try {
+    const root = makeHarnessTempRoot('wf-workspace-reveal-http-');
+    fs.mkdirSync(path.join(root, 'Harness', 'tasks'), { recursive: true });
+    fs.mkdirSync(path.join(root, 'docs'), { recursive: true });
+    fs.writeFileSync(path.join(root, 'docs', 'readme.md'), '# doc');
+    const started = await startServer({ projectRoot: root, host: '127.0.0.1', port: 0 });
+    cleanup.push({ server: started.server, root });
+    const baseUrl = `http://127.0.0.1:${started.port}`;
+
+    const ok = await requestJson(baseUrl, 'POST', '/api/workspace/reveal', { path: 'docs/readme.md' });
+    assert.equal(ok.status, 200);
+    assert.equal(ok.data.ok, true);
+    assert.equal(ok.data.dryRun, true);
+    assert.equal(ok.data.path, 'docs/readme.md');
+
+    const traversal = await requestJson(baseUrl, 'POST', '/api/workspace/reveal', { path: '../../etc/passwd' });
+    assert.equal(traversal.status, 400);
+
+    const missing = await requestJson(baseUrl, 'POST', '/api/workspace/reveal', { path: 'nope.txt' });
+    assert.equal(missing.status, 404);
+  } finally {
+    process.env.WF_UI_REVEAL_DRY_RUN = prev;
+  }
+});

package/src/wf-ui-server/__tests__/workspace-store-hardening.test.mjs

@@ -0,0 +1,255 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+
+async function loadWorkspaceStore() {
+  return import('../workspace-store.mjs');
+}
+
+function makeProject(prefix = 'wf-workspace-store-hardening-') {
+  const projectRoot = makeHarnessTempRoot(prefix);
+  fs.mkdirSync(path.join(projectRoot, 'Harness', 'tasks'), { recursive: true });
+  return projectRoot;
+}
+
+function readJsonl(filePath) {
+  return fs.readFileSync(filePath, 'utf8')
+    .trim()
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map(line => JSON.parse(line));
+}
+
+function writeJsonl(filePath, rows) {
+  fs.writeFileSync(filePath, `${rows.map(row => JSON.stringify(row)).join('\n')}\n`, 'utf8');
+}
+
+function contentBase64(text) {
+  return Buffer.from(text, 'utf8').toString('base64');
+}
+
+function createEscapeDirectoryLink(t, projectRoot) {
+  const outsideRoot = makeHarnessTempRoot('wf-workspace-outside-');
+  fs.writeFileSync(path.join(outsideRoot, 'secret.txt'), 'outside-secret', 'utf8');
+  const linkPath = path.join(projectRoot, 'linked-outside');
+  try {
+    fs.symlinkSync(outsideRoot, linkPath, process.platform === 'win32' ? 'junction' : 'dir');
+  } catch (err) {
+    fs.rmSync(outsideRoot, { recursive: true, force: true });
+    t.skip(`Symlink/junction creation unavailable on this platform: ${err.message}`);
+    return null;
+  }
+  return { outsideRoot, linkPath };
+}
+
+test('AC-002 hardening rejects malformed base64 for create-file without writing corrupt data', async () => {
+  const projectRoot = makeProject();
+  try {
+    const { applyWorkspaceOperation } = await loadWorkspaceStore();
+
+    assert.throws(() => applyWorkspaceOperation(projectRoot, {
+      op: 'create-file',
+      target: 'src/corrupt.txt',
+      contentBase64: 'not-valid-base64!!!',
+    }), /base64|invalid|malformed/i);
+    assert.equal(fs.existsSync(path.join(projectRoot, 'src', 'corrupt.txt')), false);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-002 hardening rejects malformed base64 for write without changing existing content', async () => {
+  const projectRoot = makeProject();
+  try {
+    const { applyWorkspaceOperation } = await loadWorkspaceStore();
+    fs.mkdirSync(path.join(projectRoot, 'src'), { recursive: true });
+    fs.writeFileSync(path.join(projectRoot, 'src', 'existing.txt'), 'keep', 'utf8');
+
+    assert.throws(() => applyWorkspaceOperation(projectRoot, {
+      op: 'write',
+      target: 'src/existing.txt',
+      contentBase64: '!!!!',
+    }), /base64|invalid|malformed/i);
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'src', 'existing.txt'), 'utf8'), 'keep');
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-001 hardening workspace tree rejects symlink or junction escapes instead of following them', async (t) => {
+  const projectRoot = makeProject();
+  let linkFixture;
+  try {
+    linkFixture = createEscapeDirectoryLink(t, projectRoot);
+    if (!linkFixture) return;
+    const { listWorkspaceTree } = await loadWorkspaceStore();
+
+    assert.throws(() => listWorkspaceTree(projectRoot, { path: 'linked-outside' }), /symlink|junction|outside workspace|escape/i);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+    if (linkFixture?.outsideRoot) fs.rmSync(linkFixture.outsideRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-002 hardening workspace write rejects symlink or junction escapes before mutating outside files', async (t) => {
+  const projectRoot = makeProject();
+  let linkFixture;
+  try {
+    linkFixture = createEscapeDirectoryLink(t, projectRoot);
+    if (!linkFixture) return;
+    const { applyWorkspaceOperation } = await loadWorkspaceStore();
+
+    assert.throws(() => applyWorkspaceOperation(projectRoot, {
+      op: 'write',
+      target: 'linked-outside/secret.txt',
+      contentBase64: contentBase64('mutated'),
+    }), /symlink|junction|outside workspace|escape/i);
+    assert.equal(fs.readFileSync(path.join(linkFixture.outsideRoot, 'secret.txt'), 'utf8'), 'outside-secret');
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+    if (linkFixture?.outsideRoot) fs.rmSync(linkFixture.outsideRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-004 hardening terminal context builder rejects symlink or junction escaped workspace files', async (t) => {
+  const projectRoot = makeProject();
+  let linkFixture;
+  try {
+    linkFixture = createEscapeDirectoryLink(t, projectRoot);
+    if (!linkFixture) return;
+    const { buildTerminalContextInput } = await loadWorkspaceStore();
+
+    assert.throws(() => buildTerminalContextInput(projectRoot, {
+      items: [{ kind: 'workspace-file', path: 'linked-outside/secret.txt', format: 'tag' }],
+    }), /symlink|junction|outside workspace|escape/i);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+    if (linkFixture?.outsideRoot) fs.rmSync(linkFixture.outsideRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-002 hardening rejects stale non-latest undo when later operations affect the same path', async () => {
+  const projectRoot = makeProject();
+  try {
+    const { applyWorkspaceOperation, undoWorkspaceOperation } = await loadWorkspaceStore();
+
+    const created = applyWorkspaceOperation(projectRoot, {
+      op: 'create-file',
+      target: 'src/a.txt',
+      contentBase64: contentBase64('v1'),
+    });
+    applyWorkspaceOperation(projectRoot, {
+      op: 'write',
+      target: 'src/a.txt',
+      contentBase64: contentBase64('v2'),
+    });
+
+    assert.throws(() => undoWorkspaceOperation(projectRoot, { opId: created.opId }), /conflict|stale|newer|latest/i);
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'src', 'a.txt'), 'utf8'), 'v2');
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-002 hardening restore-trash validates mutable JSONL source remains under the op trash root', async () => {
+  const projectRoot = makeProject();
+  const outsideRoot = makeHarnessTempRoot('wf-trash-corrupt-outside-');
+  try {
+    const { applyWorkspaceOperation, undoWorkspaceOperation, workspaceOpsLogPath } = await loadWorkspaceStore();
+    fs.mkdirSync(path.join(projectRoot, 'docs'), { recursive: true });
+    fs.writeFileSync(path.join(projectRoot, 'docs', 'a.txt'), 'original', 'utf8');
+    const outsideFile = path.join(outsideRoot, 'outside.txt');
+    fs.writeFileSync(outsideFile, 'outside', 'utf8');
+
+    const deleted = applyWorkspaceOperation(projectRoot, {
+      op: 'delete',
+      source: 'docs/a.txt',
+    });
+    const logPath = workspaceOpsLogPath(projectRoot);
+    const rows = readJsonl(logPath);
+    const row = rows.find(candidate => candidate.opId === deleted.opId);
+    row.inverse.source = outsideFile;
+    writeJsonl(logPath, rows);
+
+    assert.throws(() => undoWorkspaceOperation(projectRoot, { opId: deleted.opId }), /trash|corrupt|outside|escape/i);
+    assert.equal(fs.existsSync(outsideFile), true);
+    assert.equal(fs.existsSync(path.join(projectRoot, 'docs', 'a.txt')), false);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+    fs.rmSync(outsideRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-002 hardening workspace operations serialize revision assignment under reentrant writes', async () => {
+  const projectRoot = makeProject();
+  const originalWriteFileSync = fs.writeFileSync;
+  try {
+    const store = await loadWorkspaceStore();
+    let reentered = false;
+    fs.writeFileSync = function patchedWriteFileSync(filePath, ...args) {
+      const normalized = String(filePath).replace(/\\/g, '/');
+      if (!reentered && normalized.endsWith('/concurrent/a.txt')) {
+        reentered = true;
+        store.applyWorkspaceOperation(projectRoot, {
+          op: 'create-file',
+          target: 'concurrent/b.txt',
+          contentBase64: contentBase64('b'),
+        });
+      }
+      return originalWriteFileSync.call(this, filePath, ...args);
+    };
+
+    store.applyWorkspaceOperation(projectRoot, {
+      op: 'create-file',
+      target: 'concurrent/a.txt',
+      contentBase64: contentBase64('a'),
+    });
+
+    const revisions = readJsonl(store.workspaceOpsLogPath(projectRoot)).map(row => row.revision);
+    assert.equal(new Set(revisions).size, revisions.length, `duplicate revisions observed: ${revisions.join(', ')}`);
+    assert.deepEqual([...revisions].sort((a, b) => a - b), [1, 2]);
+  } finally {
+    fs.writeFileSync = originalWriteFileSync;
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-002 AC-003 hardening rejects Windows reserved and trailing-dot/space names', async () => {
+  const projectRoot = makeProject();
+  try {
+    const { applyWorkspaceOperation, storeUserFiles } = await loadWorkspaceStore();
+    const invalidNames = ['NUL', 'CON', 'PRN', 'COM1', 'trailing.', 'trailing '];
+    const workspaceFailures = [];
+    const userFileFailures = [];
+
+    for (const name of invalidNames) {
+      try {
+        applyWorkspaceOperation(projectRoot, {
+          op: 'create-file',
+          target: `reserved/${name}`,
+          contentBase64: contentBase64('bad'),
+        });
+        workspaceFailures.push(name);
+      } catch (err) {
+        assert.match(err.message, /reserved|invalid|filename|trailing/i);
+      }
+
+      try {
+        storeUserFiles(projectRoot, {
+          source: 'paste',
+          files: [{ name, mime: 'text/plain', contentBase64: contentBase64('bad') }],
+        });
+        userFileFailures.push(name);
+      } catch (err) {
+        assert.match(err.message, /reserved|invalid|filename|trailing/i);
+      }
+    }
+
+    assert.deepEqual(workspaceFailures, [], `workspace ops accepted invalid names: ${workspaceFailures.join(', ')}`);
+    assert.deepEqual(userFileFailures, [], `user-files accepted invalid names: ${userFileFailures.join(', ')}`);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});

package/src/wf-ui-server/__tests__/workspace-store.test.mjs

@@ -0,0 +1,208 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import path from 'node:path';
+import { makeHarnessTempRoot } from '../../../tests/support/temp-root.js';
+
+async function loadWorkspaceStore() {
+  return import('../workspace-store.mjs');
+}
+
+function makeProject() {
+  const projectRoot = makeHarnessTempRoot('wf-workspace-store-');
+  fs.mkdirSync(path.join(projectRoot, 'Harness', 'tasks'), { recursive: true });
+  return projectRoot;
+}
+
+function readJsonl(filePath) {
+  return fs.readFileSync(filePath, 'utf8')
+    .trim()
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map(line => JSON.parse(line));
+}
+
+test('AC-001 workspace tree store returns a root-bounded lazy metadata listing', async () => {
+  const projectRoot = makeProject();
+  try {
+    fs.mkdirSync(path.join(projectRoot, 'src', 'nested'), { recursive: true });
+    fs.writeFileSync(path.join(projectRoot, 'src', 'app.js'), 'console.log("ok");\n');
+
+    const { listWorkspaceTree } = await loadWorkspaceStore();
+    const listing = listWorkspaceTree(projectRoot, { path: 'src' });
+
+    assert.equal(listing.root, projectRoot);
+    assert.equal(listing.path, 'src');
+    assert.equal(listing.absolutePath, path.join(projectRoot, 'src'));
+    assert.ok(Array.isArray(listing.entries));
+    assert.equal(listing.entries.some(entry => entry.path === 'src/app.js' && entry.type === 'file'), true);
+    assert.equal(listing.entries.some(entry => entry.path === 'src/nested' && entry.type === 'directory' && entry.hasChildren === false), true);
+    for (const entry of listing.entries) {
+      assert.equal(path.isAbsolute(entry.path), false, 'entry.path should be repo-relative');
+      assert.equal(typeof entry.name, 'string');
+      assert.match(entry.path, /^[^\\]+(?:\/[^\\]+)*$/);
+      assert.ok(entry.type === 'file' || entry.type === 'directory');
+      assert.equal(typeof entry.size, 'number');
+      assert.equal(typeof entry.mtime, 'string');
+      assert.equal(typeof entry.hasChildren, 'boolean');
+      assert.equal(Object.hasOwn(entry, 'children'), false, 'lazy listing should not inline child arrays');
+    }
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-001 workspace tree store denies traversal and reports missing directories', async () => {
+  const projectRoot = makeProject();
+  try {
+    const { listWorkspaceTree } = await loadWorkspaceStore();
+
+    assert.throws(() => listWorkspaceTree(projectRoot, { path: '../outside' }), {
+      name: 'Error',
+      message: /outside workspace|traversal|escape/i,
+    });
+    assert.throws(() => listWorkspaceTree(projectRoot, { path: 'missing-folder' }), {
+      name: 'Error',
+      message: /not found|missing/i,
+    });
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-002 workspace operations write disk, append JSONL records, and undo by latest or opId', async () => {
+  const projectRoot = makeProject();
+  try {
+    const {
+      applyWorkspaceOperation,
+      undoWorkspaceOperation,
+      workspaceOpsLogPath,
+    } = await loadWorkspaceStore();
+
+    const createdFile = await applyWorkspaceOperation(projectRoot, {
+      op: 'create-file',
+      target: 'src/new.txt',
+      contentBase64: Buffer.from('v1', 'utf8').toString('base64'),
+    });
+    assert.equal(createdFile.ok, true);
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'src', 'new.txt'), 'utf8'), 'v1');
+
+    const wrote = await applyWorkspaceOperation(projectRoot, {
+      op: 'write',
+      target: 'src/new.txt',
+      contentBase64: Buffer.from('v2', 'utf8').toString('base64'),
+    });
+    assert.equal(wrote.ok, true);
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'src', 'new.txt'), 'utf8'), 'v2');
+
+    const renamed = await applyWorkspaceOperation(projectRoot, {
+      op: 'rename',
+      source: 'src/new.txt',
+      target: 'src/renamed.txt',
+    });
+    assert.equal(renamed.ok, true);
+    assert.equal(fs.existsSync(path.join(projectRoot, 'src', 'new.txt')), false);
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'src', 'renamed.txt'), 'utf8'), 'v2');
+
+    const copied = await applyWorkspaceOperation(projectRoot, {
+      op: 'copy',
+      source: 'src/renamed.txt',
+      target: 'src/copy.txt',
+    });
+    assert.equal(copied.ok, true);
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'src', 'copy.txt'), 'utf8'), 'v2');
+
+    const moved = await applyWorkspaceOperation(projectRoot, {
+      op: 'move',
+      source: 'src/copy.txt',
+      target: 'src/nested/copy.txt',
+    });
+    assert.equal(moved.ok, true);
+    assert.equal(fs.existsSync(path.join(projectRoot, 'src', 'copy.txt')), false);
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'src', 'nested', 'copy.txt'), 'utf8'), 'v2');
+
+    const folder = await applyWorkspaceOperation(projectRoot, {
+      op: 'create-folder',
+      target: 'notes',
+    });
+    assert.equal(folder.ok, true);
+    assert.equal(fs.statSync(path.join(projectRoot, 'notes')).isDirectory(), true);
+
+    const logPath = workspaceOpsLogPath(projectRoot);
+    const logRows = readJsonl(logPath);
+    assert.equal(logPath, path.join(projectRoot, 'Harness', 'a2a', 'workspace-ops.jsonl'));
+    assert.deepEqual(logRows.map(row => row.op), ['create-file', 'write', 'rename', 'copy', 'move', 'create-folder']);
+    for (const row of logRows) {
+      assert.equal(typeof row.opId, 'string');
+      assert.equal(typeof row.revision, 'number');
+      assert.equal(row.undoable, true);
+      assert.equal(typeof row.createdAt, 'string');
+    }
+
+    const undoLatest = await undoWorkspaceOperation(projectRoot, { opId: 'latest' });
+    assert.equal(undoLatest.ok, true);
+    assert.equal(undoLatest.undoneOpId, folder.opId);
+    assert.equal(fs.existsSync(path.join(projectRoot, 'notes')), false);
+
+    const undoMove = await undoWorkspaceOperation(projectRoot, { opId: moved.opId });
+    assert.equal(undoMove.ok, true);
+    assert.equal(fs.existsSync(path.join(projectRoot, 'src', 'nested', 'copy.txt')), false);
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'src', 'copy.txt'), 'utf8'), 'v2');
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-002 delete moves to same-volume trash and undo restores without recursive copy', async () => {
+  const projectRoot = makeProject();
+  try {
+    const { applyWorkspaceOperation, undoWorkspaceOperation } = await loadWorkspaceStore();
+    fs.mkdirSync(path.join(projectRoot, 'docs', 'deep'), { recursive: true });
+    fs.writeFileSync(path.join(projectRoot, 'docs', 'deep', 'guide.md'), '# Guide\n');
+
+    const deleted = await applyWorkspaceOperation(projectRoot, {
+      op: 'delete',
+      source: 'docs',
+    });
+
+    assert.equal(deleted.ok, true);
+    assert.equal(deleted.undoable, true);
+    assert.equal(fs.existsSync(path.join(projectRoot, 'docs')), false);
+    assert.equal(path.dirname(deleted.trashPath), path.join(projectRoot, 'Harness', '.trash', 'workspace-ops', deleted.opId));
+    assert.equal(fs.readFileSync(path.join(deleted.trashPath, 'deep', 'guide.md'), 'utf8'), '# Guide\n');
+    assert.equal(path.parse(deleted.trashPath).root.toLowerCase(), path.parse(projectRoot).root.toLowerCase());
+    assert.equal(deleted.strategy, 'rename-to-trash');
+
+    const restored = await undoWorkspaceOperation(projectRoot, { opId: deleted.opId });
+    assert.equal(restored.ok, true);
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'docs', 'deep', 'guide.md'), 'utf8'), '# Guide\n');
+    assert.equal(fs.existsSync(deleted.trashPath), false);
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});
+
+test('AC-002 workspace operations reject traversal and overwrite conflicts', async () => {
+  const projectRoot = makeProject();
+  try {
+    const { applyWorkspaceOperation } = await loadWorkspaceStore();
+    fs.mkdirSync(path.join(projectRoot, 'src'), { recursive: true });
+    fs.writeFileSync(path.join(projectRoot, 'src', 'existing.txt'), 'keep');
+
+    assert.throws(() => applyWorkspaceOperation(projectRoot, {
+      op: 'create-file',
+      target: '../escape.txt',
+      contentBase64: Buffer.from('bad').toString('base64'),
+    }), /outside workspace|traversal|escape/i);
+
+    assert.throws(() => applyWorkspaceOperation(projectRoot, {
+      op: 'create-file',
+      target: 'src/existing.txt',
+      contentBase64: Buffer.from('replace').toString('base64'),
+    }), /exists|overwrite/i);
+
+    assert.equal(fs.readFileSync(path.join(projectRoot, 'src', 'existing.txt'), 'utf8'), 'keep');
+  } finally {
+    fs.rmSync(projectRoot, { recursive: true, force: true });
+  }
+});