kcg-code 0.0.0-stage → 0.1.0

package/src/server/services/__tests__/opencode.test.ts

@@ -0,0 +1,320 @@
+/**
+ * Unit test helper murni `opencode-client.ts` & `opencode-server.ts`.
+ *
+ * Yang diuji (tanpa jaringan/proses sungguhan):
+ * - `parseSseFrame` / `normalizeEvent`: parsing & normalisasi event SSE.
+ * - `parseListeningPort`: ekstraksi port dari baris log server.
+ * - `flattenProviders`: respons GET /config/providers -> daftar model UI.
+ * - `flattenAgents`: respons GET /agent -> daftar mode (primary/all saja).
+ * - `configFingerprint`: deteksi perubahan file config opencode.
+ * - `ensureFreshServer`: restart saat fingerprint config berubah.
+ */
+import { expect, test } from "bun:test";
+import { mkdtempSync, utimesSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import fc from "fast-check";
+import type { OpenCodeClient } from "../opencode-client";
+import { flattenAgents, flattenMcp, flattenProviders, flattenSkills } from "../opencode-client";
+import {
+  configFingerprint,
+  createOpenCodeServerManager,
+  parseListeningPort,
+  type ServerProcessLike,
+} from "../opencode-server";
+import { normalizeEvent, parseSseFrame } from "../opencode-sse";
+
+test("parseSseFrame: mengambil baris data; frame tanpa data -> null", () => {
+  expect(parseSseFrame('data: {"a":1}\n\n')).toBe('{"a":1}');
+  expect(parseSseFrame("event: x\ndata: hello\n")).toBe("hello");
+  expect(parseSseFrame("comment saja\n\n")).toBeNull();
+  expect(parseSseFrame("")).toBeNull();
+});
+
+test("normalizeEvent: {id,type,properties} -> event datar (type + properties)", () => {
+  const ev = normalizeEvent({
+    id: "evt_1",
+    type: "permission.asked",
+    properties: { requestID: "per_1", sessionID: "ses_1", permission: "bash:ls" },
+  });
+  expect(ev).toEqual({
+    id: "evt_1",
+    type: "permission.asked",
+    requestID: "per_1",
+    sessionID: "ses_1",
+    permission: "bash:ls",
+  });
+
+  // Payload tanpa properties -> tetap aman.
+  expect(normalizeEvent({ type: "server.connected" })).toEqual({ type: "server.connected" });
+
+  // Payload invalid -> null.
+  expect(normalizeEvent(null)).toBeNull();
+  expect(normalizeEvent("x")).toBeNull();
+  expect(normalizeEvent({})).toBeNull();
+  expect(normalizeEvent({ id: 1 })).toBeNull();
+});
+
+test("flattenAgents: hanya primary/all; subagent murni disaring", () => {
+  const agents = flattenAgents([
+    { name: "build", mode: "primary", description: "Full tool access" },
+    { name: "plan", mode: "primary", description: "Planning only" },
+    { name: "general", mode: "subagent", description: "Sub-agent" },
+    { name: "explore", mode: "all", description: null },
+    { name: "", mode: "primary" },
+    "rusak",
+  ]);
+  expect(agents.map((a) => a.name)).toEqual(["build", "plan", "explore"]);
+  expect(agents[2]).toEqual({ name: "explore", mode: "all", description: null });
+});
+
+test("flattenAgents: payload bukan array / kosong -> []", () => {
+  expect(flattenAgents(null)).toEqual([]);
+  expect(flattenAgents({})).toEqual([]);
+  expect(flattenAgents([])).toEqual([]);
+});
+
+test("parseListeningPort: mengekstrak port dari baris log opencode", () => {
+  expect(parseListeningPort("opencode server listening on http://127.0.0.1:4096")).toBe(4096);
+  expect(parseListeningPort("listening on http://0.0.0.0:4599")).toBe(4599);
+  expect(parseListeningPort("beberapa teks tanpa port")).toBeNull();
+  expect(parseListeningPort("port 80 di tengah teks")).toBeNull();
+});
+
+test("parseListeningPort: properti — port valid apa pun selalu diekstrak", () => {
+  fc.assert(
+    fc.property(fc.integer({ min: 1024, max: 65535 }), (p) => {
+      expect(parseListeningPort(`opencode server listening on http://127.0.0.1:${p}`)).toBe(p);
+    }),
+    { numRuns: 50 },
+  );
+});
+
+// ---------------------------------------------------------------------------
+// flattenProviders (GET /config/providers -> daftar model untuk UI)
+// ---------------------------------------------------------------------------
+
+test("flattenProviders: flatten provider + model dengan nama tampilan", () => {
+  const payload = {
+    providers: [
+      {
+        id: "kcgcode",
+        name: "kcgcode",
+        models: {
+          "kiro/claude-opus-5": { id: "kiro/claude-opus-5", name: "Claude Opus 5" },
+          "mimo/mimo-v2.5": { id: "mimo/mimo-v2.5" }, // tanpa name -> fallback id
+        },
+      },
+    ],
+  };
+  expect(flattenProviders(payload)).toEqual([
+    {
+      providerID: "kcgcode",
+      providerName: "kcgcode",
+      modelID: "kiro/claude-opus-5",
+      name: "Claude Opus 5",
+    },
+    {
+      providerID: "kcgcode",
+      providerName: "kcgcode",
+      modelID: "mimo/mimo-v2.5",
+      name: "mimo/mimo-v2.5",
+    },
+  ]);
+});
+
+test("flattenProviders: model deprecated disaring", () => {
+  const payload = {
+    providers: [
+      {
+        id: "p",
+        name: "P",
+        models: {
+          lama: { id: "lama", status: "deprecated" },
+          baru: { id: "baru", status: "active" },
+        },
+      },
+    ],
+  };
+  const out = flattenProviders(payload);
+  expect(out.map((m) => m.modelID)).toEqual(["baru"]);
+});
+
+test("flattenProviders: payload tidak valid / kosong -> []", () => {
+  expect(flattenProviders(null)).toEqual([]);
+  expect(flattenProviders({})).toEqual([]);
+  expect(flattenProviders({ providers: "bukan array" })).toEqual([]);
+  // provider tanpa id / tanpa models diabaikan
+  expect(flattenProviders({ providers: [{ name: "tanpa-id" }, { id: "kosong" }] })).toEqual([]);
+});
+
+test("flattenProviders: provider name kosong fallback ke id", () => {
+  const out = flattenProviders({
+    providers: [{ id: "opencode", name: "", models: { m1: { id: "m1", name: "M1" } } }],
+  });
+  expect(out[0]).toMatchObject({ providerID: "opencode", providerName: "opencode" });
+});
+
+// ---------------------------------------------------------------------------
+// configFingerprint / ensureFreshServer (live reread config opencode)
+// ---------------------------------------------------------------------------
+
+function makeFakeProc(port: number): ServerProcessLike & { kills: string[] } {
+  const kills: string[] = [];
+  let resolveExited: (code: number | null) => void = () => {};
+  const exited = new Promise<number | null>((res) => {
+    resolveExited = res;
+  });
+  const stdout = new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.close();
+    },
+  });
+  // stderr sengaja tidak di-close: ensureServer menunggu baris "listening".
+  const stderr = new ReadableStream<Uint8Array>({
+    start(controller) {
+      const enc = new TextEncoder();
+      controller.enqueue(enc.encode(`opencode server listening on http://127.0.0.1:${port}\n`));
+    },
+  });
+  return {
+    kills,
+    kill(signal) {
+      kills.push(signal);
+      resolveExited(0);
+    },
+    exited,
+    stderr,
+    stdout,
+    pid: undefined,
+  };
+}
+
+function makeFakeClientFactory() {
+  const clients: OpenCodeClient[] = [];
+  const factory = (): OpenCodeClient => {
+    const client = {
+      health: async () => true,
+      subscribeEvents: () => () => {},
+    } as unknown as OpenCodeClient;
+    clients.push(client);
+    return client;
+  };
+  return { clients, factory };
+}
+
+function makeFastManager() {
+  const procs: ReturnType<typeof makeFakeProc>[] = [];
+  const { clients, factory } = makeFakeClientFactory();
+  let nextPort = 9000;
+  const manager = createOpenCodeServerManager({
+    portTimeoutMs: 2000,
+    readyTimeoutMs: 2000,
+    spawn: () => {
+      const proc = makeFakeProc(nextPort++);
+      procs.push(proc);
+      return proc;
+    },
+    clientFactory: factory,
+  });
+  return { manager, procs, clients };
+}
+
+test("configFingerprint: file project ikut masuk dan berubah saat disentuh", () => {
+  const dir = mkdtempSync(join(tmpdir(), "kcg-fp-"));
+  const base = configFingerprint(dir);
+  const p = join(dir, "opencode.json");
+  writeFileSync(p, "{}");
+  const t = new Date("2026-01-01T00:00:00Z");
+  utimesSync(p, t, t);
+  const fp1 = configFingerprint(dir);
+  expect(fp1).toContain("opencode.json");
+  expect(fp1).not.toBe(base);
+  // Stabil bila file tidak disentuh.
+  expect(configFingerprint(dir)).toBe(fp1);
+  // Sentuh file -> fingerprint berubah.
+  utimesSync(p, new Date("2026-01-02T00:00:00Z"), new Date("2026-01-02T00:00:00Z"));
+  expect(configFingerprint(dir)).not.toBe(fp1);
+});
+
+test("ensureFreshServer: config tak berubah -> instance sama; berubah -> restart", async () => {
+  const dir = mkdtempSync(join(tmpdir(), "kcg-fresh-"));
+  const { manager, procs } = makeFastManager();
+
+  const first = await manager.ensureFreshServer("p1", dir);
+  expect(first.ok).toBe(true);
+  if (!first.ok) return;
+  expect(procs).toHaveLength(1);
+
+  // Config tidak berubah: tidak spawn ulang.
+  const second = await manager.ensureFreshServer("p1", dir);
+  expect(second.ok).toBe(true);
+  expect(procs).toHaveLength(1);
+  if (second.ok) expect(second.data.baseUrl).toBe(first.data.baseUrl);
+
+  // Ubah config project -> fingerprint beda -> stop + spawn baru.
+  writeFileSync(join(dir, "opencode.json"), "{}");
+  const third = await manager.ensureFreshServer("p1", dir);
+  expect(third.ok).toBe(true);
+  if (!third.ok) return;
+  expect(procs).toHaveLength(2);
+  expect(procs[0]?.kills).toContain("SIGTERM");
+  expect(third.data.baseUrl).not.toBe(first.data.baseUrl);
+});
+
+test("flattenMcp: map nama -> status, terurut; status tak dikenal -> unknown", () => {
+  expect(
+    flattenMcp({
+      zeta: { status: "connected" },
+      alpha: { status: "failed", error: "spawn ENOENT" },
+      mid: { status: "weird" },
+      "": { status: "connected" },
+    }),
+  ).toEqual([
+    { name: "alpha", status: "failed", error: "spawn ENOENT" },
+    { name: "mid", status: "unknown", error: null },
+    { name: "zeta", status: "connected", error: null },
+  ]);
+  expect(flattenMcp(null)).toEqual([]);
+  expect(flattenMcp([])).toEqual([]);
+});
+
+test("flattenSkills: klasifikasi asal (builtin/project/global), content dibuang", () => {
+  const out = flattenSkills(
+    [
+      {
+        name: "shadcn",
+        description: "UI",
+        location: "/work/app/.agents/skills/shadcn/SKILL.md",
+        content: "x",
+      },
+      { name: "customize", description: "", location: "<built-in>", content: "x" },
+      {
+        name: "firecrawl",
+        description: "Web",
+        location: "/home/u/.config/opencode/skills/f/SKILL.md",
+      },
+      // Prefix path mirip tapi bukan di dalam Project -> global.
+      { name: "other", location: "/work/app-2/SKILL.md" },
+      { description: "tanpa nama" },
+    ],
+    "/work/app/",
+  );
+  expect(out).toEqual([
+    { name: "customize", description: null, location: null, source: "builtin" },
+    {
+      name: "firecrawl",
+      description: "Web",
+      location: "/home/u/.config/opencode/skills/f/SKILL.md",
+      source: "global",
+    },
+    { name: "other", description: null, location: "/work/app-2/SKILL.md", source: "global" },
+    {
+      name: "shadcn",
+      description: "UI",
+      location: "/work/app/.agents/skills/shadcn/SKILL.md",
+      source: "project",
+    },
+  ]);
+  expect(flattenSkills({})).toEqual([]);
+});

package/src/server/services/__tests__/project-manager.test.ts

@@ -0,0 +1,190 @@
+/**
+ * Property & unit test `project-manager.ts` (task 8.2, 8.3).
+ * - Property 29: Pembuatan Project unik berhasil round-trip (10.4)
+ * - Property 30: Nama/path Project duplikat selalu ditolak (10.5, 10.6)
+ * - Unit 8.3: edge case path & nama (10.3, 10.7)
+ */
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import fc from "fast-check";
+import { openSessionStore } from "../../../db";
+import { createProjectManager } from "../project-manager";
+
+let root: string;
+
+const SAFE_CHARS = "abcdefghijklmnopqrstuvwxyz0123456789_-";
+
+function safeNameArb() {
+  return fc
+    .array(fc.constantFrom(...SAFE_CHARS.split("")), { minLength: 1, maxLength: 12 })
+    .map((segs) => segs.join(""));
+}
+
+function safePathArb() {
+  return fc
+    .array(
+      fc
+        .array(fc.constantFrom(...SAFE_CHARS.split("")), { minLength: 1, maxLength: 8 })
+        .map((segs) => segs.join("")),
+      { minLength: 1, maxLength: 3 },
+    )
+    .map((segs) => segs.join("/"));
+}
+
+beforeAll(() => {
+  root = mkdtempSync(path.join(tmpdir(), "kcg-proj-"));
+});
+
+afterAll(() => {
+  rmSync(root, { recursive: true, force: true });
+});
+
+/** Store fresh per-run agar nama/path antar-run tidak konflik. */
+function freshManager() {
+  const store = openSessionStore(":memory:");
+  return { store, pm: createProjectManager(root, store) };
+}
+
+// Feature: kcg-code, Property 29: Pembuatan Project unik berhasil round-trip
+test("Property 29: createProject sukses -> direktori ada & listProjects menyertakannya", () => {
+  fc.assert(
+    fc.property(safeNameArb(), safePathArb(), (name, relPath) => {
+      const { store, pm } = freshManager();
+      try {
+        const res = pm.createProject(name, relPath);
+        expect(res.ok).toBe(true);
+        if (res.ok) {
+          // Direktori dibuat bila belum ada (Requirement 10.4)
+          expect(existsSync(res.data.path)).toBe(true);
+          // Round-trip: listProjects menyertakan Project baru
+          const listed = pm.listProjects();
+          expect(listed.some((p) => p.id === res.data.id && p.name === name)).toBe(true);
+          // Store menyimpan nama & path yang sama
+          expect(res.data.path.startsWith(path.resolve(root))).toBe(true);
+        }
+      } finally {
+        store.close();
+      }
+    }),
+    { numRuns: 100 },
+  );
+});
+
+// Feature: kcg-code, Property 30: Nama atau path Project duplikat selalu ditolak
+test("Property 30: nama duplikat -> NAME_TAKEN; path duplikat -> PATH_TAKEN", () => {
+  fc.assert(
+    fc.property(safeNameArb(), safePathArb(), (name, relPath) => {
+      const { store, pm } = freshManager();
+      try {
+        const first = pm.createProject(name, relPath);
+        expect(first.ok).toBe(true);
+        const before = pm.listProjects().length;
+
+        // Nama sama, path berbeda
+        const dupName = pm.createProject(name, `${relPath}-x`);
+        expect(dupName.ok).toBe(false);
+        if (!dupName.ok) expect(dupName.error).toBe("NAME_TAKEN");
+
+        // Path sama, nama berbeda
+        const dupPath = pm.createProject(`${name}-x`, relPath);
+        expect(dupPath.ok).toBe(false);
+        if (!dupPath.ok) expect(dupPath.error).toBe("PATH_TAKEN");
+
+        // Tidak menambah baris projects baru
+        expect(pm.listProjects().length).toBe(before);
+      } finally {
+        store.close();
+      }
+    }),
+    { numRuns: 100 },
+  );
+});
+
+// ---- Task 8.3: unit test edge case path & nama ----
+test("8.3: path mengandung ../etc ditolak", () => {
+  const { pm } = freshManager();
+  const res = pm.createProject("proj", "../etc");
+  expect(res.ok).toBe(false);
+  if (!res.ok) expect(res.error).toBe("PATH_OUTSIDE_SANDBOX");
+});
+
+test("8.3: path absolut di luar sandbox ditolak", () => {
+  const { pm } = freshManager();
+  const res = pm.createProject("proj", "/etc");
+  expect(res.ok).toBe(false);
+  if (!res.ok) expect(res.error).toBe("PATH_OUTSIDE_SANDBOX");
+});
+
+test("8.3: nama direktori dengan karakter unicode diterima", () => {
+  const { store, pm } = freshManager();
+  const res = pm.createProject("proj-unicode", "proyék-✓/sub");
+  expect(res.ok).toBe(true);
+  if (res.ok) {
+    expect(existsSync(res.data.path)).toBe(true);
+    expect(res.data.path).toContain("proyék-✓");
+  }
+  store.close();
+});
+
+test("8.3: nama/path dengan karakter terlarang OS ditolak", () => {
+  const { pm } = freshManager();
+  const res = pm.createProject("proj", `bad\0dir`);
+  expect(res.ok).toBe(false);
+  if (!res.ok) expect(res.error).toBe("INVALID_PATH_CHARS");
+});
+
+test("8.3: listDirectory path tidak ditemukan -> PATH_NOT_FOUND", () => {
+  const { pm } = freshManager();
+  const res = pm.listDirectory("tidak-ada");
+  expect(res.ok).toBe(false);
+  if (!res.ok) expect(res.error).toBe("PATH_NOT_FOUND");
+});
+
+test("deleteProject: pendaftaran hilang tapi direktori kerja tetap ada", () => {
+  const { store, pm } = freshManager();
+  const created = pm.createProject("hapus-saya", "hapus-saya");
+  expect(created.ok).toBe(true);
+  if (!created.ok) return;
+
+  expect(pm.deleteProject(created.data.id).ok).toBe(true);
+  expect(pm.listProjects().some((p) => p.id === created.data.id)).toBe(false);
+  // Project hanyalah referensi ke folder — isinya milik pengguna, jangan dihapus.
+  expect(existsSync(created.data.path)).toBe(true);
+  store.close();
+});
+
+test("deleteProject: id tak dikenal -> PROJECT_NOT_FOUND", () => {
+  const { store, pm } = freshManager();
+  const res = pm.deleteProject("tidak-ada");
+  expect(res.ok).toBe(false);
+  if (!res.ok) expect(res.error).toBe("PROJECT_NOT_FOUND");
+  store.close();
+});
+
+test("getProject: mengembalikan Project yang baru dibuat", () => {
+  const { store, pm } = freshManager();
+  const created = pm.createProject("ambil-saya", "ambil-saya");
+  expect(created.ok).toBe(true);
+  if (!created.ok) return;
+
+  const got = pm.getProject(created.data.id);
+  expect(got.ok).toBe(true);
+  if (got.ok) expect(got.data.name).toBe("ambil-saya");
+  expect(pm.getProject("tidak-ada").ok).toBe(false);
+  store.close();
+});
+
+test("8.3: listDirectory hanya mengembalikan direktori (bukan file)", () => {
+  const { pm } = freshManager();
+  const sub = mkdtempSync(path.join(root, "listtest-"));
+  mkdirSync(path.join(sub, "dir1"));
+  writeFileSync(path.join(sub, "file.txt"), "x");
+  const rel = path.relative(root, sub);
+  const res = pm.listDirectory(rel);
+  expect(res.ok).toBe(true);
+  if (res.ok) {
+    expect(res.data.entries).toEqual(["dir1"]);
+  }
+});

package/src/server/services/__tests__/sandbox.test.ts

@@ -0,0 +1,141 @@
+/**
+ * Property test `sandbox.ts` (task 7.2).
+ * - Property 27: Folder_Browser mengembalikan persis sub-direktori (10.2)
+ * - Property 28: Path di luar Sandbox_Root selalu ditolak (10.3, 10.7)
+ */
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import fc from "fast-check";
+import { openSessionStore } from "../../../db";
+import { createProjectManager } from "../project-manager";
+import { resolveWithinSandbox } from "../sandbox";
+
+let root: string;
+let outsideDir: string;
+let store: ReturnType<typeof openSessionStore>;
+
+beforeAll(() => {
+  root = mkdtempSync(path.join(tmpdir(), "kcg-sandbox-"));
+  outsideDir = mkdtempSync(path.join(tmpdir(), "kcg-outside-"));
+  mkdirSync(path.join(root, "a", "a1"), { recursive: true });
+  mkdirSync(path.join(root, "a", "a2"), { recursive: true });
+  mkdirSync(path.join(root, "b", "b1"), { recursive: true });
+  mkdirSync(path.join(root, "b", "b2"), { recursive: true });
+  writeFileSync(path.join(root, "a", "file.txt"), "x");
+  writeFileSync(path.join(root, "top.txt"), "x");
+  // Symlink yang mengarah keluar sandbox (harus ditolak).
+  symlinkSync(outsideDir, path.join(root, "evil-link"));
+  store = openSessionStore(":memory:");
+});
+
+afterAll(() => {
+  store?.close();
+  rmSync(root, { recursive: true, force: true });
+  rmSync(outsideDir, { recursive: true, force: true });
+});
+
+// Feature: kcg-code, Property 27: Folder_Browser mengembalikan persis sub-direktori dalam sandbox
+test("Property 27: listDirectory mengembalikan persis sub-direktori untuk sub-path valid", () => {
+  const pm = createProjectManager(root, store);
+  const validPaths = ["", "a", "a/a1", "a/a2", "b", "b/b1", "b/b2"];
+  const expected = new Map<string, string[]>([
+    ["", ["a", "b"]],
+    ["a", ["a1", "a2"]],
+    ["a/a1", []],
+    ["a/a2", []],
+    ["b", ["b1", "b2"]],
+    ["b/b1", []],
+    ["b/b2", []],
+  ]);
+
+  fc.assert(
+    fc.property(fc.constantFrom(...validPaths), (p) => {
+      const res = pm.listDirectory(p);
+      expect(res.ok).toBe(true);
+      if (res.ok) {
+        // Tepat himpunan sub-direktori: tidak ada yang hilang, tidak ada tambahan
+        expect(res.data.entries).toEqual(expected.get(p) ?? []);
+        // Tidak ada file, tidak ada entri dari luar sandbox
+        for (const entry of res.data.entries) {
+          expect(entry).not.toBe("file.txt");
+          expect(entry).not.toBe("top.txt");
+          expect(entry).not.toBe("evil-link");
+        }
+      }
+    }),
+    { numRuns: 100 },
+  );
+});
+
+// Feature: kcg-code, Property 28: Path di luar Sandbox_Root selalu ditolak
+test("Property 28: path dengan '..' selalu ditolak sebagai outside_sandbox", () => {
+  fc.assert(
+    fc.property(
+      fc.array(fc.constantFrom("a", "b", "c")).map((segs) => [...segs, "..", ...segs]),
+      (segs) => {
+        const p = segs.join("/");
+        const res = resolveWithinSandbox(root, p);
+        expect(res.ok).toBe(false);
+        if (!res.ok) expect(res.reason).toBe("outside_sandbox");
+      },
+    ),
+    { numRuns: 100 },
+  );
+});
+
+test("Property 28: path absolut di luar sandbox selalu ditolak", () => {
+  fc.assert(
+    fc.property(fc.constantFrom("/etc", "/tmp", "/usr", "/home"), (p) => {
+      const res = resolveWithinSandbox(root, p);
+      expect(res.ok).toBe(false);
+      if (!res.ok) expect(res.reason).toBe("outside_sandbox");
+    }),
+    { numRuns: 100 },
+  );
+});
+
+test("Property 28: symlink ke luar sandbox selalu ditolak", () => {
+  fc.assert(
+    fc.property(fc.constantFrom("evil-link", "evil-link/child", "evil-link/../.."), (p) => {
+      const res = resolveWithinSandbox(root, p);
+      expect(res.ok).toBe(false);
+      if (!res.ok) expect(res.reason).toBe("outside_sandbox");
+    }),
+    { numRuns: 100 },
+  );
+});
+
+test("Property 28: karakter terlarang OS -> invalid_chars", () => {
+  const forbiddenSeg = fc.array(fc.constantFrom("a", "b", "\0")).map((segs) => segs.join(""));
+  fc.assert(
+    fc.property(
+      fc
+        .array(forbiddenSeg, { minLength: 1, maxLength: 5 })
+        .filter((segs) => segs.some((s) => s.includes("\0"))),
+      (segs) => {
+        const res = resolveWithinSandbox(root, segs.join("/"));
+        expect(res.ok).toBe(false);
+        if (!res.ok) expect(res.reason).toBe("invalid_chars");
+      },
+    ),
+    { numRuns: 100 },
+  );
+});
+
+test("Property 28: listDirectory & createProject menolak path luar sandbox tanpa efek filesystem", () => {
+  const pm = createProjectManager(root, store);
+
+  const listRes = pm.listDirectory("../etc");
+  expect(listRes.ok).toBe(false);
+  if (!listRes.ok) expect(listRes.error).toBe("PATH_OUTSIDE_SANDBOX");
+
+  const createRes = pm.createProject("evils", "/etc/escape");
+  expect(createRes.ok).toBe(false);
+  if (!createRes.ok) expect(createRes.error).toBe("PATH_OUTSIDE_SANDBOX");
+
+  // Tidak ada direktori baru dibuat di luar sandbox
+  const outsideProbe = path.join(outsideDir, "escape");
+  expect(existsSync(outsideProbe)).toBe(false);
+});