flea-qml 0.0.0-stage → 0.2.0

package/test/manual-terminal-ui.mjs

@@ -0,0 +1,47 @@
+// bun test/manual-terminal-ui.mjs (requires the sibling buninu-browser checkout).
+import {mkdtempSync,mkdirSync,rmSync} from 'node:fs';
+import {join} from 'node:path';
+import {tmpdir} from 'node:os';
+import assert from 'node:assert/strict';
+const repo=Bun.fileURLToPath(new URL('../',import.meta.url));
+const dir=mkdtempSync(join(tmpdir(),'flea-terminal-ui-'));
+process.env.XDG_DATA_HOME=join(dir,'data');process.env.XDG_CONFIG_HOME=join(dir,'config');process.env.XDG_CACHE_HOME=join(dir,'cache');process.env.FLEA_PATH=dir;process.env.BUNINU_BUN=process.execPath;
+for(const p of ['data','config','cache'])mkdirSync(join(dir,p));
+const {createBrowser}=await import('../../buninu-browser/lib/headless-shell.js');
+const file=join(repo,'ui/boot/.terminal-check-'+process.pid+'.qml');
+await Bun.write(file,`import QtQuick\nimport Quickshell\nimport ".." as Flea\nFloatingWindow { id: win; width:900; height:600; Loader {anchors.fill:parent; source:"../WindowBody.qml";onLoaded:{item.host=win;globalThis.testBody=item;globalThis.terminalService=Flea.TerminalService}} }`);
+const browser=await createBrowser({spareRenderer:false});
+const run=s=>browser.context.evaluate(s);
+const until=async(s)=>{for(let i=0;i<200;i++){if(await run(s))return;await Bun.sleep(100);}throw Error('UI timeout '+s+' '+await run('document.body.innerText.slice(-2500)'));};
+try {
+ await browser.context.navigate(Bun.pathToFileURL(file).href);
+ await until('!!globalThis.testBody && !testBody.currentPane.listInFlight');
+ await run('testBody.currentPane.openTerminal()');
+ await until('!!testBody.currentPane.terminalId');
+ await until('Object.values(terminalService.tabs).some(t=>t.url?.includes("reconnect-token"))');
+ const one=await run('Object.values(terminalService.tabs)[0].url');
+ await run('testBody.currentPane.openTerminal()');
+ await until('Object.values(terminalService.tabs).length===2 && Object.values(terminalService.tabs).every(t=>t.url?.includes("reconnect-token"))');
+ const urls=await run('Object.values(terminalService.tabs).map(t=>t.url)');
+ assert.equal(new URL(urls[0]).host,new URL(urls[1]).host);assert.notEqual(urls[0],urls[1]);
+ assert.equal(await run('testBody.currentPane.tabs.items.length'),3);
+ console.log('PASS two terminal tabs, shared listener, distinct sessions',new URL(one).port);
+ // Child frame text confirms scripts load; input/PTY tested separately by the wire test.
+ await Bun.sleep(12000);
+ const target=new URL(urls[1]);
+ const monitor=new WebSocket(target.origin+target.pathname.replace(/\/$/,'/ws').replace(/^http/,'ws'),'webtty');
+ let output='';
+ monitor.onopen=()=>monitor.send(JSON.stringify({AuthToken:'',ReadOnly:true,ReconnectToken:target.searchParams.get('reconnect-token')}));
+ monitor.onmessage=e=>{const data=String(e.data);if(data[0]==='1')output+=Buffer.from(data.slice(1),'base64').toString();};
+ await Bun.sleep(200);
+ assert.equal(await run('document.activeElement.tagName'),'TEXTAREA','new terminal must own keyboard without a click');
+ for(const key of "printf '%s%s\\n' FLEA_ QTWEB_OK")await browser.context.press(key);
+ await browser.context.press('Enter');
+ for(let i=0;i<100&&!output.includes('FLEA_QTWEB_OK');i++)await Bun.sleep(100);
+ monitor.close();
+ assert(output.includes('FLEA_QTWEB_OK'),'Keyboard did not reach terminal: '+output);
+ console.log('PASS keyboard traverses QML WebEngineView to its PTY');
+ await Bun.write('/tmp/flea-terminal-tabs.png',Buffer.from(await browser.context.screenshot({format:'png'}),'base64')); 
+ console.log('canvas',await run('[...document.querySelectorAll("canvas")].map(c=>({w:c.width,h:c.height,box:c.getBoundingClientRect().toJSON()}))'));
+ console.log('frames',await run('[...document.querySelectorAll("iframe")].map(f=>({src:f.src,text:f.contentDocument?.body?.innerText?.slice(-500)}))'));
+}finally{await browser.close();rmSync(file,{force:true});rmSync(dir,{recursive:true,force:true});}

package/test/manual-trash-ui.mjs

@@ -0,0 +1,86 @@
+// Run: bun test/manual-trash-ui.mjs (requires ../buninu-browser). Uses temporary fixtures only.
+import {mkdtempSync,mkdirSync,writeFileSync,rmSync} from 'node:fs';
+import {join} from 'node:path';
+import {tmpdir} from 'node:os';
+const repo=Bun.fileURLToPath(new URL('../',import.meta.url));
+const dir=mkdtempSync(join(tmpdir(),'flea-trash-ui-'));
+process.env.XDG_DATA_HOME=join(dir,'data');process.env.XDG_CONFIG_HOME=join(dir,'config');process.env.XDG_CACHE_HOME=join(dir,'cache');process.env.HOME=dir;process.env.FLEA_PATH=dir;process.env.BUNINU_BUN=process.execPath;
+for(const p of ['data','config','cache'])mkdirSync(join(dir,p));
+const {trashOne}=await import('../src/trash.js');
+writeFileSync(join(dir,'preview.txt'),'HELLO TRASH PREVIEW\nline two');trashOne(join(dir,'preview.txt'));
+writeFileSync(join(dir,'other.txt'),'SECOND');trashOne(join(dir,'other.txt'));
+mkdirSync(join(dir,'folder'));writeFileSync(join(dir,'folder','child'),'child');trashOne(join(dir,'folder'));
+const {createBrowser}=await import('../../buninu-browser/lib/headless-shell.js');
+const file=join(repo,'ui/boot/.trash-check-'+process.pid+'.qml');
+await Bun.write(file,`import QtQuick\nimport Quickshell\nimport ".." as Flea\nFloatingWindow { id: win; width:900; height:600; Loader {id:body; anchors.fill:parent; Component.onCompleted:{globalThis.testLoader=body;setSource("${Bun.pathToFileURL(join(repo,"ui/WindowBody.qml")).href}")} onStatusChanged:console.log("TESTLOADER",status) ; onLoaded:{item.host=win;globalThis.testBody=item}} }`);
+const browser=await createBrowser({spareRenderer:false});
+const run=s=>browser.context.evaluate(s);
+try {
+ await browser.context.addInitScript(`globalThis.compileErrors=[];const compile=__qmlHost.compile;__qmlHost.compile=(...a)=>{try{return compile(...a)}catch(e){compileErrors.push(String(e));throw e}}`);
+ await browser.context.navigate(Bun.pathToFileURL(file).href);
+ console.log('loaded',await run('document.body.innerText.slice(0,5000)'));
+ for(let i=0;i<30;i++){if(await run('!!globalThis.testBody && !testBody.currentPane.listInFlight'))break;await Bun.sleep(100)}
+ if(!await run('!!globalThis.testBody'))throw Error('testBody missing '+JSON.stringify(await run('({status:globalThis.testLoader?.status,source:globalThis.testLoader?.source,text:document.body.innerText,errors:globalThis.compileErrors})'))) ;
+ console.log('initial',await run('({text:document.body.innerText.slice(0,150),mode:testBody.currentPane.recentMode})'));
+ for(const address of ['trash:/','trash://','trash:///']) {
+  if(await run('testBody.currentPane.recentMode === "trash"')) {
+   await run('testBody.currentPane.closeRecent()');
+   for(let i=0;i<150;i++){if(await run('!testBody.currentPane.listInFlight'))break;await Bun.sleep(100)}
+  }
+  await run(`testBody.currentPane.chromeBar.startEdit();testBody.currentPane.chromeBar.pathField.text=${JSON.stringify(address)};testBody.currentPane.chromeBar.commitEdit()`);
+  for(let i=0;i<150;i++){if(await run('!testBody.currentPane.listInFlight'))break;await Bun.sleep(100)}
+  if(!await run('testBody.currentPane.recentMode === "trash" && testBody.currentPane.path === "/" && testBody.currentPane.chromeBar.path === "trash:///"'))throw Error('Trash address failed: '+address);
+ }
+ await run('testBody.currentPane.chromeBar.startEdit()');
+ if(await run('testBody.currentPane.chromeBar.editText')!=='trash:///')throw Error('Trash edit address acquired an extra slash');
+ await run('testBody.currentPane.chromeBar.closeEdit()');
+ console.log('PASS all Trash address aliases, display and unchanged backing path');
+ const paths=await run('testBody.currentPane.rows.map(r=>r.trash.original)');
+ if(paths.length!==3 || paths.some(p=>!p.startsWith(dir+'/')))throw Error('External trash detected; refusing mutation');
+ console.log('trash',await run('({text:document.body.innerText,mode:testBody.currentPane.recentMode,rows:testBody.currentPane.total,cursor:testBody.currentPane.cursorRow})'));
+ await run('testBody.currentPane.setCursor(testBody.currentPane.rows.findIndex(r=>r.n.endsWith("preview.txt")))');
+ if(await run('testBody.currentPane.statusBar.selectedName')!=='preview.txt')throw Error('Trash status filename is not the original name');
+ if(!await run('testBody.currentPane.statusBar.fileNameItem.visible && testBody.currentPane.statusBar.fileNameItem.width > 0'))throw Error('Status filename has no visible space');
+ console.log('PASS status filename uses the original Trash name');
+ // Exercise only the presentation component with a name wider than the window;
+ // keep the actual fixture paths and operation identities untouched.
+ await run('testBody.currentPane.statusBar.fileNameItem.name="完整檔案名稱-".repeat(40)+".txt"');
+ await Bun.sleep(100);
+ if(!await run('testBody.currentPane.statusBar.fileNameItem.contentWidth > testBody.currentPane.statusBar.fileNameItem.width'))throw Error('Long status filename cannot scroll');
+ await run('testBody.currentPane.statusBar.fileNameItem.contentX=testBody.currentPane.statusBar.fileNameItem.contentWidth-testBody.currentPane.statusBar.fileNameItem.width');
+ if(!await run('testBody.currentPane.statusBar.fileNameItem.contentX > 0'))throw Error('Long status filename did not scroll');
+ if(process.env.FLEA_STATUS_SCREENSHOT)await Bun.write(process.env.FLEA_STATUS_SCREENSHOT,Buffer.from(await browser.context.screenshot({format:'png'}),'base64'));
+ await run('testBody.currentPane.statusBar.fileNameItem.name=testBody.currentPane.statusBar.fileLabel');
+ if(await run('testBody.currentPane.statusBar.fileNameItem.contentX')!==0)throw Error('New filename did not reset scrolling');
+ console.log('PASS long status filename scrolling and reset');
+ await run('testBody.currentPane.act("preview")');await Bun.sleep(2000);
+ if(!await run('testBody.quickLookActive && document.body.innerText.includes("HELLO TRASH PREVIEW")'))throw Error('preview missing');
+ if(process.env.FLEA_TRASH_SCREENSHOT)await Bun.write(process.env.FLEA_TRASH_SCREENSHOT,Buffer.from(await browser.context.screenshot({format:'png'}),'base64'));
+ console.log('preview',await run('({active:testBody.quickLookActive,text:document.body.innerText.slice(-900)})'));
+ await run('testBody.currentPane.quickLook().close()');
+ await run('testBody.currentPane.act("filter");testBody.currentPane.filterQuery="preview"');
+ await Bun.sleep(150);
+ if(await run('testBody.currentPane.shown.length')!==1)throw Error('filter failed');
+ await run('testBody.currentPane.filterQuery="";testBody.currentPane.filterTyping=false');
+ const wait=async predicate=>{for(let i=0;i<200;i++){if(await run(predicate))return;await Bun.sleep(50)}throw Error('Timed out: '+predicate)};
+ await run('testBody.currentPane.open(testBody.currentPane.join("/",testBody.currentPane.rows.find(r=>r.d).n))');
+ await wait('!testBody.currentPane.listInFlight && testBody.currentPane.recentMode===""');
+ await run('testBody.currentPane.goBack()');
+ await wait('!testBody.currentPane.listInFlight && testBody.currentPane.recentMode==="trash"');
+ console.log('PASS filter and directory Back');
+ await run('testBody.currentPane.setCursor(testBody.currentPane.rows.findIndex(r=>r.n.endsWith("preview.txt")));testBody.currentPane.trash.action("deletePermanently")');
+ await wait('testBody.currentPane.trash.confirmationOpen');
+ await run('testBody.currentPane.trash.confirmation.cancel()');
+ await wait('!testBody.currentPane.trash.busy');
+ await run('testBody.currentPane.trash.action("restoreTrashSelection")');
+ await wait('!testBody.currentPane.trash.busy && !testBody.currentPane.listInFlight && testBody.currentPane.total===2');
+ if(!await Bun.file(join(dir,'preview.txt')).exists())throw Error('restore missing');
+ console.log('PASS cancel deletion and restore selected');
+ await run('testBody.currentPane.trash.action("emptyTrash")');
+ await wait('testBody.currentPane.trash.confirmationOpen');
+ // Opening the review is safe; never activate Empty Trash in a test, because
+ // mount-local trashes can exist outside the isolated HOME/XDG directories.
+ await run('testBody.currentPane.trash.confirmation.cancel()');
+ await wait('!testBody.currentPane.trash.busy');
+ console.log('PASS Empty Trash review and cancellation');
+}finally{browser.close();rmSync(file,{force:true});rmSync(dir,{recursive:true,force:true})}

package/test/markdown-diagrams.test.js

@@ -0,0 +1,93 @@
+// Mermaid diagrams in the Markdown previews: fences held out of the page and drawn by src/figure.js
+// (Pele in a Bun Worker), embedded as SVG pictures, and their source kept with a reason when not.
+import { afterAll, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { DIAGRAMS_PER_PAGE, drawDiagrams, holdFormulas, markdownHtml, markdownPage } from "../src/markdown-html.js";
+import { figureTheme, renderDiagram, stopFigures } from "../src/figure.js";
+
+const folder = mkdtempSync(join(tmpdir(), "flea-diagrams-"));
+afterAll(() => { stopFigures(); rmSync(folder, { recursive: true, force: true }); });
+
+const FLOW = "flowchart TD\n  A[開始 😀] --> B[結束]";
+const pictures = (html) => [...html.matchAll(/<div class="diagram"><img alt="Mermaid diagram" src="data:image\/svg\+xml;base64,([^"]+)"><\/div>/g)]
+  .map((match) => Buffer.from(match[1], "base64").toString());
+
+test("Mermaid fences are held as the block view picks them, and other code stays code", () => {
+  const source = [
+    "```mermaid", "flowchart TD", "  A --> B", "```",
+    "~~~ Mermaid title", "pie", "~~~",
+    "  ```mermaid", "  sequenceDiagram", "    A->>B: hi", "  ```",
+    "```js", "const x = 1;", "```",
+    "```mermaid`", "not a fence opener", "```",
+    "$x$ and `$y$`",
+    "```mermaid", "flowchart LR", "  unclosed --> end",
+  ].join("\n");
+  const { text, diagrams, formulas } = holdFormulas(source);
+  expect(diagrams).toEqual(["flowchart TD\n  A --> B", "pie", "sequenceDiagram\n  A->>B: hi", "flowchart LR\n  unclosed --> end"]);
+  expect(text).toContain("```js\nconst x = 1;\n```");
+  expect(text).not.toContain("flowchart");
+  expect(formulas).toEqual([{ tex: "x", display: false }]);
+});
+
+test("a drawn diagram becomes a picture; a failed one keeps its source and says why", () => {
+  const svg = '<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10"><text>中文</text></svg>';
+  const source = "# T\n\n```mermaid\nA\n```\n\n```mermaid\nB & <b>\n```\n\n```mermaid\nC\n```\n";
+  const html = markdownPage(source, folder, {}, [{ svg }, { error: "Parse error <here>" }]);
+  expect(pictures(html)).toEqual([svg]);
+  expect(html).toContain("<pre><code>B &amp; &lt;b&gt;</code></pre><p class=\"diagram-error\">Diagram not drawn · Parse error &lt;here&gt;</p>");
+  // A page built without drawing (no answer for the fence) shows the plain source.
+  expect(html).toContain("<pre><code>C</code></pre>");
+  expect(html).not.toMatch(/[]|<p><div|<script/);
+});
+
+test("diagrams share the pictures' budget", () => {
+  const big = `<svg xmlns="http://www.w3.org/2000/svg">${"x".repeat((1 << 20) + 1)}</svg>`;
+  const html = markdownPage("```mermaid\nA\n```\n", folder, {}, [{ svg: big }]);
+  expect(pictures(html)).toEqual([]);
+  expect(html).toContain("Diagram not drawn · over the page's picture budget");
+});
+
+test("the HTML preview draws Chinese and emoji labels, and the page stays passive", async () => {
+  const path = join(folder, "doc.md");
+  writeFileSync(path, `# 圖\n\n\`\`\`mermaid\n${FLOW}\n\`\`\`\n\n\`\`\`mermaid\nflowchart TD\n  A -->\n\`\`\`\n`);
+  const answer = await markdownHtml({ path, token: 3, slot: "s", theme: { foreground: "#c0caf5", background: "#101315" } });
+  expect(answer).toMatchObject({ t: "markdownhtml", token: 3, slot: "s", state: "ready" });
+  const [svg] = pictures(answer.html);
+  expect(svg).toContain("開始 😀");
+  expect(svg).toContain("#c0caf5");
+  expect(svg).not.toMatch(/<script|<foreignObject|\son\w+=/i);
+  expect(answer.html).toMatch(/Diagram not drawn · Parse error on line 3: Expecting/);
+  expect(answer.html).not.toMatch(/<script/i);
+});
+
+test(`at most ${DIAGRAMS_PER_PAGE} diagrams are drawn for one page`, async () => {
+  const source = Array.from({ length: DIAGRAMS_PER_PAGE + 1 }, () => "```mermaid\nflowchart TD\n  A --> B\n```").join("\n\n");
+  const drawn = await drawDiagrams(source);
+  expect(drawn.slice(0, DIAGRAMS_PER_PAGE).every((answer) => answer.svg)).toBe(true);
+  expect(drawn.at(-1)).toEqual({ error: `more than ${DIAGRAMS_PER_PAGE} diagrams on the page` });
+});
+
+test("renderDiagram caches, reports errors, and recovers from a deadline", async () => {
+  const first = await renderDiagram(FLOW);
+  expect(first.svg).toContain("結束");
+  expect(await renderDiagram(FLOW)).toBe(first);
+  expect((await renderDiagram("flowchart TD\n  A -->")).error).toMatch(/^Parse error on line 3: Expecting/);
+  expect(await renderDiagram("  ")).toEqual({ error: "empty diagram" });
+  expect(await renderDiagram("x".repeat(32769))).toEqual({ error: "diagram over 32 KiB" });
+  const slow = "flowchart LR\n" + Array.from({ length: 300 }, (_, i) => `  N${i} --> N${(i * 7 + 3) % 300}`).join("\n");
+  expect(await renderDiagram(slow, {}, { timeout: 1 })).toEqual({ error: "diagram took over 0.001 s" });
+  // The stuck Worker was terminated; the next diagram starts a fresh one.
+  expect((await renderDiagram("sequenceDiagram\n  甲->>乙: 你好")).svg).toContain("你好");
+});
+
+test("figureTheme keeps colours, a plain font name and whole advance tables, and dates a Gantt chart", () => {
+  const advances = Array.from({ length: 95 }, () => 500);
+  const theme = figureTheme({ fg: '"><script>', background: "#101315", font: "Noto Sans CJK TC", advances, boldAdvances: [1, 2] },
+    "gantt\n  title 計畫", new Date(2026, 10, 15, 23));
+  expect(theme).toMatchObject({ fg: "#d8dee9", bg: "#101315", font: "Noto Sans CJK TC", advances, boldAdvances: [] });
+  expect(theme.today).toBe(Date.UTC(2026, 10, 15, 12));
+  expect(figureTheme({ font: 'x" onload="y' }).font).toBe("sans-serif");
+  expect(figureTheme({}, "flowchart TD").today).toBeUndefined();
+});

package/test/markdown-html.test.js

@@ -0,0 +1,105 @@
+import { test, expect, afterAll } from "bun:test";
+import { mkdtempSync, writeFileSync, mkdirSync, symlinkSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { markdownPage, cleanHtml, holdFormulas, linkAllowed, pageStyle, markdownHtml, MARKDOWN_LIMIT } from "../src/markdown-html.js";
+
+const root = mkdtempSync(join(tmpdir(), "flea-md-html-"));
+const docs = join(root, "docs");
+mkdirSync(docs);
+// A 1x1 PNG.
+const PNG = Buffer.from("iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==", "base64");
+writeFileSync(join(docs, "pic.png"), PNG);
+writeFileSync(join(root, "secret.png"), PNG);
+symlinkSync(join(root, "secret.png"), join(docs, "link.png"));
+afterAll(() => rmSync(root, { recursive: true, force: true }));
+const body = (markdown) => markdownPage(markdown, docs).replace(/^[\s\S]*?<\/style>/, "");
+
+test("Markdown becomes headings, lists, tables, code and task boxes", () => {
+  const html = body("# Title\n\n- **bold** and *it*\n- `code`\n\n| a | b |\n|---|---|\n| 1 | 2 |\n\n```js\nlet x = 1 < 2;\n```\n\n- [x] done\n- [ ] todo\n");
+  expect(html).toContain("<h1>Title</h1>");
+  expect(html).toContain("<strong>bold</strong>");
+  expect(html).toContain("<table>");
+  expect(html).toContain("let x = 1 &lt; 2;");
+  expect(html).toContain('<input checked type="checkbox" disabled>');
+  expect(html).not.toMatch(/<script|<style(?![^]*<\/style>[^]*$)/);
+});
+
+test("TeX in $…$ and $$…$$ and raw MathML become formulas; code and prices stay text", () => {
+  const html = body("Inline $x^2$ and\n\n$$\\frac{a}{b}$$\n\n<math><mi>y</mi></math>\n\n`$not$` costs $5 and $10\n\n```\n$also not$\n```\n");
+  expect((html.match(/<math/g) ?? []).length).toBe(3);
+  expect(html).toContain('<math display="block">');
+  expect(html).toContain("<code>$not$</code>");
+  expect(html).toContain("costs $5 and $10");
+  expect(html).toContain("$also not$");
+});
+
+test("a formula that fails is shown as its source, escaped", () => {
+  const html = body("Bad $\\frac{1}{$ and <math><mi title=x>a</mi></math>");
+  expect(html).toContain('<code class="formula-source">$\\frac{1}{$</code>');
+  expect(html).toContain("&lt;math&gt;&lt;mi title=x&gt;a&lt;/mi&gt;&lt;/math&gt;");
+});
+
+test("active content, raw-text elements and foreign markup never survive", () => {
+  const attacks = [
+    "<script>alert(1)</script>", "<style>body{background:url(http://x)}</style>", "<iframe src=x></iframe>",
+    "<textarea><img src=x onerror=alert(1)></textarea>", "<title><script>alert(1)</script></title>",
+    "<svg><script>alert(1)</script></svg>", "<object data=x></object>", "<embed src=x>",
+    "<noscript><img src=x onerror=alert(1)></noscript>", "<xmp><img src=x onerror=alert(1)></xmp>",
+  ];
+  for (const attack of attacks) {
+    const html = body(`before\n\n${attack}\n\nafter`);
+    expect(html).not.toMatch(/<(script|style|iframe|object|embed|svg|img|textarea|title|xmp|noscript)[\s>]/i);
+    expect(html).toContain("after");
+  }
+});
+
+test("only the allowed attributes stay; links keep http, https, mailto and relative targets", () => {
+  const html = body('<p align="center" onclick="alert(1)" style="color:red" class="c" id="i">x</p>\n\n' +
+    '[ok](https://example.com) [mail](mailto:a@b.c) [rel](other.md) [js](javascript:alert(1)) <a href="jav&#x61;script:alert(1)">e</a> <a href="data:text/html,x">d</a>');
+  expect(html).toContain('<p align="center">x</p>');
+  expect(html).not.toMatch(/onclick|style=|class="c"|id="i"/);
+  expect(html).toContain('href="https://example.com"');
+  expect(html).toContain('href="mailto:a@b.c"');
+  expect(html).toContain('href="other.md"');
+  expect(html).not.toMatch(/javascript|jav&|data:text/i);
+  for (const [target, allowed] of [["https://x", true], ["#top", true], ["a/b.md", true], ["JaVaScRiPt:x", false],
+    ["java\tscript:x", false], ["%6Aavascript:x", false], ["vbscript:x", false], ["file:///etc/passwd", false]])
+    expect(linkAllowed(target)).toBe(allowed);
+});
+
+test("pictures: inside the folder embedded, remote ones named, escapes dropped", () => {
+  const html = body("![a](pic.png) ![r](https://img.shields.io/badge/x.svg) ![up](../secret.png) ![abs](/etc/passwd.png) ![ln](link.png) ![d](data:image/png;base64,AAAA)");
+  expect(html).toMatch(/<img alt="a" src="data:image\/png;base64,[A-Za-z0-9+/=]+">/);
+  expect(html).toContain('<span class="remote">Remote image not loaded · img.shields.io</span>');
+  // Outside the folder (by .., by absolute path or through a symbolic link) and data: are not loaded.
+  expect((html.match(/<img/g) ?? []).length).toBe(1);
+  for (const alt of ["up", "abs", "ln", "d"]) expect(html).toContain(`<span class="alt">${alt}</span>`);
+});
+
+test("the theme only accepts #rrggbb colours", () => {
+  const style = pageStyle({ foreground: "red;}</style><script>alert(1)</script>", background: "#101010", bodyPx: "99" });
+  expect(style).not.toContain("script");
+  expect(style).toContain("background:#101010");
+  expect(style).toContain("font:40px");
+});
+
+test("formula markers in the source are neutralised and text never becomes markup", () => {
+  const { text, formulas } = holdFormulas("0 and $x$");
+  expect(formulas.length).toBe(1);
+  expect(text.startsWith("�0�")).toBe(true);
+  expect(cleanHtml("<p>a &lt;b&gt; c</p>", docs)).toBe("<p>a &lt;b&gt; c</p>");
+});
+
+test("the backend answer reads the file and refuses one over the limit", async () => {
+  const path = join(docs, "note.md");
+  writeFileSync(path, "# Note\n\n$x$\n");
+  const ready = await markdownHtml({ path, slot: "look", token: 3, theme: {} });
+  expect(ready).toMatchObject({ t: "markdownhtml", slot: "look", token: 3, state: "ready" });
+  expect(ready.html.startsWith("<!doctype html>")).toBe(true);
+  expect(ready.html).toContain("<math>");
+  const big = join(docs, "big.md");
+  writeFileSync(big, "x".repeat(MARKDOWN_LIMIT + 1));
+  expect((await markdownHtml({ path: big, token: 4 })).state).toBe("failed");
+  expect((await markdownHtml({ path: join(docs, "missing.md"), token: 5 })).state).toBe("failed");
+});

package/test/mathml.test.js

@@ -0,0 +1,92 @@
+import { test, expect } from "bun:test";
+import { texToMathML, cleanMathML, cleanStyle, length, MATH_LIMIT } from "../src/mathml.js";
+
+const ELEMENT = /<\/?([a-z][a-z0-9-]*)/g;
+// Every element and attribute name in some cleaned markup.
+const names = (html) => ({
+  elements: [...new Set([...html.matchAll(ELEMENT)].map((match) => match[1]))],
+  attributes: [...new Set([...html.matchAll(/\s([a-z-]+)="/g)].map((match) => match[1]))],
+});
+const ALLOWED_ELEMENTS = new Set(("math mrow mi mn mo ms mtext mspace mfrac msqrt mroot msub msup msubsup munder mover " +
+  "munderover mmultiscripts mprescripts none mtable mtr mtd mstyle mpadded mphantom menclose merror semantics").split(" "));
+const ALLOWED_ATTRIBUTES = new Set(("display displaystyle scriptlevel mathvariant form stretchy symmetric largeop movablelimits " +
+  "fence separator accent accentunder lspace rspace width height depth voffset minsize maxsize linethickness style").split(" "));
+const onlyAllowed = (html) => {
+  const found = names(html);
+  expect(found.elements.filter((name) => !ALLOWED_ELEMENTS.has(name))).toEqual([]);
+  expect(found.attributes.filter((name) => !ALLOWED_ATTRIBUTES.has(name))).toEqual([]);
+};
+
+test("a formula becomes one math element of MathML Core elements", () => {
+  const html = texToMathML("x=\\frac{-b\\pm\\sqrt{b^2-4ac}}{2a}", true);
+  expect(html.startsWith('<math display="block">')).toBe(true);
+  expect(html.endsWith("</math>")).toBe(true);
+  expect(html).toContain("<mfrac>");
+  expect(html).toContain("<msqrt>");
+  onlyAllowed(html);
+  for (const tex of ["\\begin{pmatrix}a&b\\\\c&d\\end{pmatrix}", "\\sum_{i=1}^n i", "\\boxed{E=mc^2}", "\\overbrace{a+b}^{n}", "\\hat x\\vec v", "\\text{中文 and emoji 😀}"])
+    onlyAllowed(texToMathML(tex, true));
+});
+
+test("trust is off: links, URLs, images and HTML commands stay text", () => {
+  for (const tex of ["\\href{javascript:alert(1)}{x}", "\\url{http://example.com}", "\\includegraphics{http://example.com/a.png}",
+    "\\htmlClass{x}{y}", "\\htmlStyle{background:url(http://x)}{y}", "\\htmlData{a=b}{y}", "\\htmlId{x}{y}"]) {
+    let html;
+    try { html = texToMathML(tex); } catch { continue; } // a refused command is an error, which is also safe
+    onlyAllowed(html);
+    // The command's name and argument may show as text; no attribute carries them.
+    expect(html).not.toMatch(/\s(?:href|src)="|url\(/i);
+  }
+});
+
+test("markup typed into TeX never becomes markup", () => {
+  for (const tex of ["\\text{<script>alert(1)</script>}", "\\text{</math><img src=x onerror=alert(1)>}", "\\mathrm{<b>x</b>}", "x<y>z"]) {
+    let html;
+    try { html = texToMathML(tex); } catch { continue; }
+    onlyAllowed(html);
+    // Typed markup survives only as escaped text.
+    expect(html).not.toMatch(/<(?:script|img|b)[\s>]/i);
+  }
+});
+
+test("runaway macros, huge sizes and long sources are refused", () => {
+  expect(() => texToMathML("\\def\\a{\\a\\a}\\a")).toThrow();
+  expect(() => texToMathML("x".repeat(MATH_LIMIT + 1))).toThrow();
+  const sized = texToMathML("\\rule{1000em}{1000em}\\kern{1000em}");
+  for (const [, value] of sized.matchAll(/(?:width|height|depth|lspace|rspace)="([^"]*)"/g)) expect(length(value)).toBe(true);
+});
+
+test("a TeX error is not turned into markup: the caller shows the source instead", () => {
+  expect(() => texToMathML("\\frac{1}{")).toThrow();
+  expect(() => texToMathML("\\text{a & b}")).toThrow();
+});
+
+test("the allowlist drops foreign content, handlers, links and unknown attributes", () => {
+  const html = cleanMathML('<math><mi onclick="alert(1)" href="x" title="t" class="c">a</mi><mtext>t<img src="x" onerror="alert(1)">u</img></mtext>' +
+    '<svg><script>alert(1)</script></svg><annotation-xml encoding="text/html"><b>x</b></annotation-xml><mo stretchy="maybe" form="infix">+</mo></math>');
+  expect(html).toBe('<math><mi>a</mi><mtext>t</mtext><mo form="infix">+</mo></math>');
+});
+
+test("style keeps colours and box spacing only", () => {
+  expect(cleanStyle("color:#ff0000;padding:3pt;border:1px solid;background:url(http://x);position:fixed;margin-left:-0.1667em")).toBe(
+    "color:#ff0000;padding:3pt;border:1px solid;margin-left:-0.1667em");
+  expect(cleanStyle("color:expression(alert(1));padding:1e9em;color:red")).toBe("");
+  expect(cleanStyle("padding:-1em;border:1px solid url(x)")).toBe("");
+});
+
+test("only strict, balanced markup with exactly one math root is accepted", () => {
+  for (const bad of ["<math><mi>a<!-- x --></mi></math>", "<math><mi title=a>a</mi></math>", "<math><mi>a</mo></math>",
+    "<math><mi>a</mi>", "<math><mi>a</mi></math><math><mi>b</mi></math>", "<p><math><mi>x</mi></math></p>", "<math><![CDATA[x]]></math>"])
+    expect(() => cleanMathML(bad)).toThrow();
+});
+
+test("text keeps entities as text and escapes stray ampersands and brackets", () => {
+  expect(cleanMathML("<math><mtext>&lt;b&gt; &amp;bogus; & x > y</mtext></math>")).toBe("<math><mtext>&lt;b&gt; &amp;bogus; &amp; x &gt; y</mtext></math>");
+});
+
+test("nesting past the depth limit is dropped", () => {
+  const deep = "<math>" + "<mrow>".repeat(80) + "<mi>x</mi>" + "</mrow>".repeat(80) + "</math>";
+  const html = cleanMathML(deep);
+  expect((html.match(/<mrow>/g) ?? []).length).toBe(63);
+  expect(html).not.toContain("<mi>");
+});

package/test/menu-transfer.test.js

@@ -0,0 +1,57 @@
+import { test, expect, afterAll } from 'bun:test';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { menuaction, capturedPaths } from '../src/menu.js';
+import { collisions, transfer } from '../src/transfer.js';
+const dir=mkdtempSync(join(tmpdir(),'flea-menu-'));afterAll(()=>rmSync(dir,{recursive:true,force:true}));
+let serial=0;
+function setup() {
+ const id=++serial, root=join(dir,String(id));mkdirSync(root);
+ const src=join(root,'source'),dest=join(root,'dest');mkdirSync(src);mkdirSync(dest);
+ const path=join(src,'hello');writeFileSync(path,'original');
+ const messages=[],send=m=>messages.push(m),listing={path:src,rows:[{name:'hello'}]};
+ menuaction({id,op:'snapshot',rows:[0],cursor:0},send,listing,1);
+ return {id,path,src,dest,messages,send,listing};
+}
+async function done(s, request) {
+ transfer(request,s.send,s.listing,1);
+ for(let i=0;i<200;i++) {const result=s.messages.find(m=>m.t==='transferdone');if(result)return result; await Bun.sleep(5);}
+ throw Error('transfer did not complete: '+JSON.stringify(s.messages));
+}
+test('Copy to survives menu close',async()=>{
+ const s=setup();collisions({id:20,menuId:s.id,dest:s.dest},s.send,s.listing,1);
+ menuaction({id:s.id,op:'close'},s.send,s.listing,1);
+ const result=await done(s,{menuId:s.id,collideId:20,dest:s.dest,op:'copy',collide:'refuse'});
+ expect(result.ok).toBe(1);expect(readFileSync(join(s.dest,'hello'),'utf8')).toBe('original');
+});
+test('reject source replaced after collision question',async()=>{
+ const s=setup();collisions({id:21,menuId:s.id,dest:s.dest},s.send,s.listing,1);
+ menuaction({id:s.id,op:'close'},s.send,s.listing,1);
+ renameSync(s.path,s.path+'.old');writeFileSync(s.path,'replacement');
+ expect((await done(s,{menuId:s.id,collideId:21,dest:s.dest,op:'copy'})).failed).toBe(1);
+});
+test('question cannot authorize another destination or be reused',()=>{
+ const s=setup();collisions({id:22,menuId:s.id,dest:s.dest},s.send,s.listing,1);
+ menuaction({id:s.id,op:'close'},s.send,s.listing,1);
+ transfer({menuId:s.id,collideId:22,dest:s.src},s.send,s.listing,1);
+ expect(s.messages.at(-1).t).toBe('error');
+ transfer({menuId:s.id,collideId:22,dest:s.dest},s.send,s.listing,1);
+ expect(s.messages.at(-1).t).toBe('error');
+});
+test('invalid repeated snapshot clears old identity and refuses missing rows',()=>{
+ const s=setup();menuaction({id:s.id,op:'snapshot',rows:[0,99]},s.send,s.listing,1);
+ expect(s.messages.at(-1).ok).toBe(false);expect(capturedPaths(s.id)).toBeNull();
+});
+test('cursor outside selection also retains identity',()=>{
+ const s=setup(),cursor=join(s.src,'cursor');writeFileSync(cursor,'cursor');
+ menuaction({id:s.id,op:'snapshot',paths:[s.path],cursorPath:cursor},s.send,s.listing,1);
+ renameSync(cursor,cursor+'.old');writeFileSync(cursor,'replacement');
+ menuaction({id:s.id,op:'activate',action:'sharelink'},s.send,s.listing,1);
+ expect(s.messages.at(-1).ok).toBe(false);
+});
+test('keyboard menuId zero copies without a menu snapshot',async()=>{
+ const s=setup();collisions({id:99,menuId:0,rows:[0],dest:s.dest},s.send,s.listing,1);
+ const result=await done(s,{menuId:0,collideId:99,rows:[0],dest:s.dest,op:'copy',collide:'refuse'});
+ expect(result.ok).toBe(1);expect(readFileSync(join(s.dest,'hello'),'utf8')).toBe('original');
+});