neoctl-web 0.1.14 → 0.1.16

package/plugins/downloads/downloads.test.mjs

@@ -1,83 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import os from 'node:os';
-import http from 'node:http';
-import { spawnSync } from 'node:child_process';
-import { createPlugin } from './index.mjs';
-
-async function setup(t) {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'downloads-test-'));
-  const outside = await fs.mkdtemp(path.join(os.tmpdir(), 'outside-workspace-'));
-  const source = path.join(outside, '中文 [report].txt');
-  await fs.writeFile(source, 'original contents');
-  const context = { appDataDir: root, env: {} };
-  let plugin = createPlugin(context);
-  const server = http.createServer(async (req, res) => {
-    try { if (!await plugin.route(req, res, new URL(req.url, 'http://localhost'))) { res.statusCode = 404; res.end(); } }
-    catch (error) { res.statusCode = 500; res.end(error.message); }
-  });
-  await new Promise((r) => server.listen(0, '127.0.0.1', r));
-  t.after(async () => { server.closeAllConnections(); await new Promise((r) => server.close(r)); await fs.rm(root, { recursive: true, force: true }); await fs.rm(outside, { recursive: true, force: true }); });
-  return { root, outside, source, plugin, base: `http://127.0.0.1:${server.address().port}`, restart() { plugin = createPlugin(context); } };
-}
-
-test('arbitrary outside-workspace file: only metadata stored, no copies, no expiry', async (t) => {
-  const f = await setup(t);
-  const result = await f.plugin.tools[0].execute({ paths: [f.source] }, { cwd: f.root });
-  assert.equal(result.ok, true);
-  const d = result.output.downloads[0];
-  assert.equal(d.expiresAt, null); assert.equal(d.expiresAtEpochMs, null);
-  assert.equal(result.output._ui.resources[0].expiresAt, undefined);
-  const storedDir = path.join(f.root, 'downloads', d.id);
-  assert.deepEqual(await fs.readdir(storedDir), ['entry.json']);
-  const record = JSON.parse(await fs.readFile(path.join(storedDir, 'entry.json'), 'utf8'));
-  assert.equal(record.absolutePath, f.source);
-  const r = await fetch(f.base + d.url);
-  assert.equal(r.status, 200); assert.match(r.headers.get('content-disposition'), /^attachment;/);
-  assert.equal(await r.text(), 'original contents');
-  const head = await fetch(f.base + d.url, { method: 'HEAD' });
-  assert.equal(head.status, 200); assert.equal(head.headers.get('content-length'), '17'); assert.equal(await head.text(), '');
-});
-
-test('mapping survives restart and future clock; serves current original bytes and length', async (t) => {
-  const f = await setup(t), d = (await f.plugin.tools[0].execute({ paths: [f.source] })).output.downloads[0];
-  const script = `import { DownloadRegistry } from ${JSON.stringify(new URL('./downloads.mjs', import.meta.url).href)}; Date.now = () => 9999999999999; const e = await new DownloadRegistry({ storageDir: ${JSON.stringify(path.join(f.root, 'downloads'))} }).get(${JSON.stringify(d.id)}); if (!e || e.expiresAt !== null) process.exit(1); console.log(e.id);`;
-  const child = spawnSync(process.execPath, ['--input-type=module', '-e', script], { encoding: 'utf8' });
-  assert.equal(child.status, 0, child.stderr);
-  f.restart();
-  await fs.writeFile(f.source, 'updated longer original contents');
-  const r = await fetch(f.base + d.url); assert.equal(r.status, 200); assert.equal(r.headers.get('content-length'), '32'); assert.equal(await r.text(), 'updated longer original contents');
-});
-
-test('moving or deleting the original invalidates the link, no fallback copy', async (t) => {
-  const f = await setup(t), d = (await f.plugin.tools[0].execute({ paths: [f.source] })).output.downloads[0];
-  const moved = path.join(f.outside, 'moved.txt');
-  await fs.rename(f.source, moved);
-  const missing = await fetch(f.base + d.url); assert.equal(missing.status, 404); await missing.text();
-  f.restart(); const afterRestart = await fetch(f.base + d.url); assert.equal(afterRestart.status, 404); await afterRestart.text();
-  const next = (await f.plugin.tools[0].execute({ paths: [moved] })).output.downloads[0];
-  await fs.rm(moved);
-  const deleted = await fetch(f.base + next.url); assert.equal(deleted.status, 404); await deleted.text();
-});
-
-test('invalid paths, directories, missing files, malformed URLs and HTTP writes are rejected', async (t) => {
-  const f = await setup(t), tool = f.plugin.tools[0];
-  for (const paths of [[], ['relative'], [null], Array(21).fill(f.source)]) assert.throws(() => tool.validate({ paths }));
-  const result = await tool.execute({ paths: [f.source, f.outside, path.join(f.outside, 'absent')] });
-  assert.equal(result.ok, false); assert.equal(result.output.errors.length, 2); assert.equal(result.output.downloads.length, 1);
-  const d = result.output.downloads[0];
-  for (const suffix of ['%2e%2e%2fsecret', 'bad%', 'a'.repeat(36), d.id + '/extra']) {
-    const r = await fetch(f.base + '/api/downloads/' + suffix); assert.equal(r.status, 404); await r.text();
-  }
-  const post = await fetch(f.base + d.url, { method: 'POST' }); assert.equal(post.status, 405); await post.text();
-});
-
-test('concurrent exposure persists separate tiny mappings', async (t) => {
-  const f = await setup(t);
-  const results = await Promise.all(Array.from({ length: 8 }, () => f.plugin.tools[0].execute({ paths: [f.source] })));
-  const ids = results.map((r) => r.output.downloads[0].id);
-  assert.equal(new Set(ids).size, 8);
-  for (const id of ids) assert.deepEqual(await fs.readdir(path.join(f.root, 'downloads', id)), ['entry.json']);
-});

package/plugins/video-share/video-share.test.mjs

@@ -1,182 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import http from 'node:http';
-import { spawnSync } from 'node:child_process';
-import { createPlugin } from './index.mjs';
-import { VideoStore } from './store.mjs';
-import { parseRange, playerPage } from './http.mjs';
-
-async function setup(t) {
-  const root = await fs.mkdtemp(path.join(os.tmpdir(), 'video-share-test-'));
-  const source = path.join(root, '样例 video.mp4');
-  const bytes = Buffer.concat([Buffer.from([0, 0, 0, 24]), Buffer.from('ftypisom'), Buffer.alloc(1024, 7)]);
-  await fs.writeFile(source, bytes);
-  const context = { appDataDir: path.join(root, 'data'), env: {} };
-  let plugin = createPlugin(context);
-  const server = http.createServer(async (req, res) => {
-    try { if (!await plugin.route(req, res, new URL(req.url, 'http://localhost'))) { res.statusCode = 404; res.end(); } }
-    catch (error) { res.statusCode = 500; res.end(error.message); }
-  });
-  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
-  t.after(async () => { server.closeAllConnections(); await new Promise((r) => server.close(r)); await fs.rm(root, { recursive: true, force: true }); });
-  const base = `http://127.0.0.1:${server.address().port}`;
-  return { root, source, bytes, context, base, plugin, restart() { plugin = createPlugin(context); return plugin; } };
-}
-
-function expose(plugin, paths) { return plugin.tools.find((t) => t.name === 'expose_videos').execute({ paths }); }
-
-test('standalone publication, player, inline media and HEAD work without host imports', async (t) => {
-  const f = await setup(t);
-  const result = await expose(f.plugin, [f.source]);
-  assert.equal(result.ok, true);
-  const v = result.output.videos[0];
-  assert.equal(v.expiresAt, null);
-  assert.equal(result.output._ui.resources[0].kind, 'embed');
-  assert.equal(result.output._ui.presentationLevel, 'primary');
-  assert.equal(v.markdown, undefined);
-  assert.equal(v.reference, undefined);
-  assert.equal(result.output._ui.resources[0].downloadName, undefined);
-  const page = await fetch(f.base + v.url);
-  assert.equal(page.status, 200);
-  assert.match(page.headers.get('content-security-policy'), /default-src 'none'/);
-  assert.match(await page.text(), /<video controls playsinline preload="metadata"/);
-  const media = await fetch(f.base + v.mediaUrl);
-  assert.equal(media.headers.get('content-type'), 'video/mp4');
-  assert.match(media.headers.get('content-disposition'), /^inline;/);
-  assert.equal(media.headers.get('accept-ranges'), 'bytes');
-  assert.deepEqual(Buffer.from(await media.arrayBuffer()), f.bytes);
-  const head = await fetch(f.base + v.mediaUrl, { method: 'HEAD' });
-  assert.equal(head.status, 200);
-  assert.equal(Number(head.headers.get('content-length')), f.bytes.length);
-  assert.equal((await head.arrayBuffer()).byteLength, 0);
-});
-
-test('byte range seeking: bounded, open-ended, suffix, clamped, invalid, If-Range', async (t) => {
-  const f = await setup(t), v = (await expose(f.plugin, [f.source])).output.videos[0];
-  for (const [range, start, end] of [['bytes=2-9', 2, 9], ['bytes=1000-', 1000, f.bytes.length - 1], ['bytes=-9', f.bytes.length - 9, f.bytes.length - 1], ['bytes=2-999999', 2, f.bytes.length - 1]]) {
-    const r = await fetch(f.base + v.mediaUrl, { headers: { Range: range } });
-    assert.equal(r.status, 206);
-    assert.equal(r.headers.get('content-range'), `bytes ${start}-${end}/${f.bytes.length}`);
-    assert.deepEqual(Buffer.from(await r.arrayBuffer()), f.bytes.subarray(start, end + 1));
-  }
-  for (const range of ['bytes=99999-', 'bytes=4-2', 'bytes=-0', 'bytes=-', 'bytes=x-y']) {
-    const r = await fetch(f.base + v.mediaUrl, { headers: { Range: range } });
-    assert.equal(r.status, 416); assert.equal(r.headers.get('content-range'), `bytes */${f.bytes.length}`); await r.text();
-  }
-  for (const headers of [{ Range: 'bytes=0-1,4-5' }, { Range: 'bytes=0-2', 'If-Range': '"stale"' }]) {
-    const r = await fetch(f.base + v.mediaUrl, { headers }); assert.equal(r.status, 200); await r.arrayBuffer();
-  }
-  const full = await fetch(f.base + v.mediaUrl); const etag = full.headers.get('etag'); await full.arrayBuffer();
-  const r = await fetch(f.base + v.mediaUrl, { headers: { Range: 'bytes=0-1', 'If-Range': etag } });
-  assert.equal(r.status, 206); await r.arrayBuffer();
-  assert.equal(parseRange('bytes=0-0', 0), false);
-});
-
-test('zero-copy original-path mapping survives restart and a fresh Node process without TTL', async (t) => {
-  const f = await setup(t), v = (await expose(f.plugin, [f.source])).output.videos[0];
-  const recordDir = path.join(f.context.appDataDir, 'video-share', v.id);
-  assert.deepEqual(await fs.readdir(recordDir), ['entry.json']);
-  const record = JSON.parse(await fs.readFile(path.join(recordDir, 'entry.json'), 'utf8'));
-  assert.equal(record.absolutePath, f.source);
-  f.restart();
-  const r = await fetch(f.base + v.mediaUrl); assert.equal(r.status, 200); assert.deepEqual(Buffer.from(await r.arrayBuffer()), f.bytes);
-  const script = `import { VideoStore } from ${JSON.stringify(new URL('./store.mjs', import.meta.url).href)}; Date.now = () => 9999999999999; const e = await new VideoStore(${JSON.stringify(path.join(f.context.appDataDir, 'video-share'))}).get(${JSON.stringify(v.id)}); if (!e || 'expiresAt' in e) process.exit(1); console.log(e.id);`;
-  const child = spawnSync(process.execPath, ['--input-type=module', '-e', script], { encoding: 'utf8' });
-  assert.equal(child.status, 0, child.stderr); assert.match(child.stdout, new RegExp(v.id));
-});
-
-test('revoke persists across restarts; guessing, traversal, writes and missing blobs fail closed', async (t) => {
-  const f = await setup(t), v = (await expose(f.plugin, [f.source])).output.videos[0];
-  for (const suffix of ['f'.repeat(48), '%2e%2e%2fsecret', v.id + '/media/extra']) {
-    const r = await fetch(f.base + '/api/video-share/' + suffix); assert.equal(r.status, 404); await r.text();
-  }
-  const post = await fetch(f.base + v.url, { method: 'POST' }); assert.equal(post.status, 405); await post.text();
-  const revoke = f.plugin.tools.find((t) => t.name === 'revoke_videos');
-  assert.equal((await revoke.execute({ ids: [v.id] })).output.results[0].revoked, true);
-  assert.equal((await revoke.execute({ ids: [v.id] })).output.results[0].revoked, false);
-  f.restart(); const gone = await fetch(f.base + v.mediaUrl); assert.equal(gone.status, 404); await gone.text();
-  assert.equal((await fs.stat(f.source)).isFile(), true);
-  const next = (await expose(f.plugin, [f.source])).output.videos[0];
-  await fs.rm(f.source);
-  const missing = await fetch(f.base + next.mediaUrl); assert.equal(missing.status, 404); await missing.text();
-});
-
-test('validation, partial batches, signatures, escaping and public origin', async (t) => {
-  const f = await setup(t), tool = f.plugin.tools[0];
-  for (const paths of [[], ['relative.mp4'], [12], Array(21).fill(f.source)]) assert.throws(() => tool.validate({ paths }));
-  const fake = path.join(f.root, 'fake.mp4'); await fs.writeFile(fake, '<script>not video</script>');
-  const result = await expose(f.plugin, [f.source, fake, path.join(f.root, 'a.txt')]);
-  assert.equal(result.ok, false); assert.equal(result.output.videos.length, 1); assert.equal(result.output.errors.length, 2);
-  const html = playerPage({ filename: '<script>alert(1)</script>', id: 'a'.repeat(48) });
-  assert.ok(!html.includes('<script>')); assert.match(html, /&lt;script&gt;/);
-  const publicPlugin = createPlugin({ ...f.context, env: { NEO_VIDEO_SHARE_PUBLIC_ORIGIN: 'https://videos.example.com' } });
-  const v = (await expose(publicPlugin, [f.source])).output.videos[0];
-  assert.ok(v.url.startsWith('https://videos.example.com/api/video-share/')); assert.equal(v.reference, undefined);
-  assert.ok((await expose(publicPlugin, [f.source])).output._ui.resources[0].url.startsWith('/api/video-share/'));
-  assert.throws(() => createPlugin({ env: { NEO_VIDEO_SHARE_PUBLIC_ORIGIN: 'https://host/path' } }));
-});
-
-test('concurrent publishers use independent atomic records', async (t) => {
-  const f = await setup(t);
-  const store = new VideoStore(path.join(f.context.appDataDir, 'video-share'));
-  const entries = await Promise.all(Array.from({ length: 8 }, () => store.publish(f.source)));
-  assert.equal(new Set(entries.map((e) => e.id)).size, 8);
-  for (const e of entries) assert.equal((await store.get(e.id)).id, e.id);
-  assert.ok((await fs.readdir(store.directory)).every((s) => !s.startsWith('.pending')));
-});
-
-test('source move invalidates player and media after restart, no fallback copy', async (t) => {
-  const f = await setup(t), v = (await expose(f.plugin, [f.source])).output.videos[0];
-  await fs.rename(f.source, path.join(f.root, 'moved.mp4'));
-  f.restart();
-  for (const url of [v.url, v.mediaUrl]) {
-    const r = await fetch(f.base + url); assert.equal(r.status, 404); await r.text();
-  }
-  assert.deepEqual(await fs.readdir(path.join(f.context.appDataDir, 'video-share', v.id)), ['entry.json']);
-});
-
-test('same-path updates serve current bytes and invalidate old If-Range validators', async (t) => {
-  const f = await setup(t), v = (await expose(f.plugin, [f.source])).output.videos[0];
-  const before = await fetch(f.base + v.mediaUrl); const oldTag = before.headers.get('etag'); await before.arrayBuffer();
-  const updated = Buffer.from(f.bytes); updated[100] = 42;
-  await fs.writeFile(f.source, updated);
-  await fs.utimes(f.source, new Date(), new Date(Date.now() + 5000));
-  const r = await fetch(f.base + v.mediaUrl, { headers: { Range: 'bytes=0-9', 'If-Range': oldTag } });
-  assert.equal(r.status, 200); assert.notEqual(r.headers.get('etag'), oldTag);
-  assert.deepEqual(Buffer.from(await r.arrayBuffer()), updated);
-});
-
-test('v1 copied publications are not silently used as zero-copy sources', async (t) => {
-  const f = await setup(t), id = 'a'.repeat(48);
-  const dir = path.join(f.context.appDataDir, 'video-share', id);
-  await fs.mkdir(dir, { recursive: true });
-  await fs.writeFile(path.join(dir, 'entry.json'), JSON.stringify({ version: 1, id, filename: 'old.mp4', contentType: 'video/mp4' }));
-  await fs.writeFile(path.join(dir, 'media'), f.bytes);
-  const r = await fetch(f.base + '/api/video-share/' + id + '/media'); assert.equal(r.status, 404); await r.text();
-  assert.deepEqual(await fs.readFile(path.join(dir, 'media')), f.bytes); // no automatic user-data deletion
-});
-
-test('presenter embeds valid videos including partial failures and historical results, no text links', async (t) => {
-  const f = await setup(t);
-  const result = await expose(f.plugin, [f.source, path.join(f.root, 'missing.mp4')]);
-  assert.equal(result.ok, false);
-  const shown = f.plugin.presentToolResult({ toolName: 'expose_videos', output: result.output, ok: false });
-  assert.equal(shown.presentationLevel, 'primary');
-  assert.equal(shown.resources.length, 1);
-  assert.equal(shown.resources[0].kind, 'embed');
-  assert.match(shown.resources[0].url, /\?embed=1$/);
-  assert.ok(!shown.text.includes('/api/'));
-  assert.match(result.output.usage, /Do not repeat video URLs/);
-  const old = { videos: [{ ...result.output.videos[0], url: 'https://untrusted.example/', markdown: '[old](https://untrusted.example/)' }] };
-  assert.ok(f.plugin.presentToolResult({ toolName: 'expose_videos', output: old, ok: true }).resources[0].url.startsWith('/api/video-share/'));
-  assert.equal(f.plugin.presentToolResult({ toolName: 'revoke_videos', output: result.output }), undefined);
-  assert.equal(f.plugin.presentToolResult({ toolName: 'expose_videos', output: { videos: [{ id: '../escape' }] } }), undefined);
-  const page = await fetch(f.base + shown.resources[0].url + '&theme=light');
-  const html = await page.text();
-  assert.equal(page.status, 200); assert.match(html, /data-theme="light"/);
-  assert.ok(!/<a\b|target=|window\.open/.test(html));
-  assert.match(html, /<video controls playsinline/);
-});

package/plugins/xhs-artifact/version.test.mjs

@@ -1,151 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { Worker } from 'node:worker_threads';
-import { execFileSync } from 'node:child_process';
-import { renderXhsEditorPage } from './editor-page.mjs';
-import { XhsArtifactRegistry, createOpenXhsArtifactEditorTool, createReadXhsArtifactTool, serveXhsArtifact } from './artifacts.mjs';
-const payload = { title: 'title', body: 'body', interaction: '', hashtags: [], images: [{ url: '', caption: 'planned', overlay: '', note: '' }], review: '' };
-function fixture(t) { const storageDir = fs.mkdtempSync(path.join(os.tmpdir(), 'xhs-version-')); t.after(() => fs.rmSync(storageDir, { recursive: true, force: true })); return new XhsArtifactRegistry({ storageDir }); }
-test('CAS rejects missing/stale versions, independent registries read disk, failed persistence does not publish', t => {
-  const a = fixture(t), item = a.add({ payload, sessionId: 's' });
-  const b = new XhsArtifactRegistry({ storageDir: a.storageDir }); b.get(item.id, 's');
-  assert.throws(() => a.update(item.id, { payload }, 's'), { code: 'version_conflict' });
-  a.update(item.id, { payload: { ...payload, body: 'saved' } }, 's', 1);
-  assert.equal(b.get(item.id, 's').version, 2);
-  assert.throws(() => b.update(item.id, { payload }, 's', 1), { code: 'version_conflict', current_version: 2 });
-  a.persist = () => { throw new Error('disk full'); };
-  assert.throws(() => a.update(item.id, { payload }, 's', 2), /disk full/);
-  assert.equal(a.get(item.id, 's').payload.body, 'saved');
-  assert.equal(fs.existsSync(a.artifactFile(item.id) + '.lock'), false);
-  assert.equal(a.get(item.id), undefined); assert.equal(a.get(item.id, 'other'), undefined);
-});
-test('parallel workers never both win same version', async t => {
-  for (let round = 0; round < Number(process.env.XHS_CAS_ROUNDS || 1); round++) {
-    const registry = fixture(t), item = registry.add({ payload, sessionId: 's' });
-    const moduleUrl = new URL('./artifacts.mjs', import.meta.url).href;
-    const run = body => new Promise((resolve, reject) => {
-      const worker = new Worker(`const {parentPort,workerData}=require('node:worker_threads'); import(workerData.moduleUrl).then(({XhsArtifactRegistry})=>{const r=new XhsArtifactRegistry({storageDir:workerData.dir});try{const a=r.update(workerData.id,{payload:workerData.payload},'s',1);parentPort.postMessage({version:a.version,body:a.payload.body})}catch(e){parentPort.postMessage({code:e.code,message:e.message,syscall:e.syscall,path:e.path,stack:e.stack})}})`, { eval: true, workerData: { moduleUrl, dir: registry.storageDir, id: item.id, payload: { ...payload, body } } }); worker.on('message', resolve); worker.on('error', reject);
-    });
-    const results = await Promise.all([run('one'), run('two'), run('three'), run('four')]);
-    const diagnostic = JSON.stringify({ round, results }, null, 2);
-    assert.equal(results.filter(r => r.version === 2).length, 1, diagnostic);
-    assert.equal(results.filter(r => ['artifact_busy', 'version_conflict'].includes(r.code)).length, 3, diagnostic);
-    assert.equal(registry.get(item.id, 's').payload.body, results.find(r => r.version === 2).body, diagnostic);
-    assert.equal(registry.get(item.id, 's').version, 2);
-  }
-});
-test('model cached read binds session/agent/id/version, preserves saved edits and rejects concurrent user save/replay/restart', async t => {
-  const registry = fixture(t), context = { session: { sessionId: 's' } };
-  const open = createOpenXhsArtifactEditorTool({ registry }), read = createReadXhsArtifactTool({ registry });
-  const item = registry.add({ payload, sessionId: 's' });
-  await assert.rejects(() => open.execute(open.validate({ artifact_id: item.id, payload }), context), { code: 'read_required' });
-  registry.update(item.id, { payload: { ...payload, body: 'user edit' } }, 's', 1);
-  let latest = (await read.execute({ id: item.id }, context)).output;
-  const input = open.validate({ artifact_id: item.id, payload: { ...latest.artifact.payload, review: 'model review' } });
-  await assert.rejects(() => open.execute(input, { session: { sessionId: 'other' } }), { code: 'read_required' });
-  await assert.rejects(() => open.execute(input, { ...context, agentId: 'other-agent' }), { code: 'read_required' });
-  const other = registry.add({ payload, sessionId: 's' });
-  await assert.rejects(() => open.execute(open.validate({ artifact_id: other.id, payload }), context), { code: 'read_required' });
-  const updated = await open.execute(input, context); assert.equal(updated.output.artifact.payload.body, 'user edit');
-  await assert.rejects(() => open.execute(input, context), { code: 'read_required' });
-  latest = (await read.execute({ id: item.id }, context)).output;
-  registry.update(item.id, { payload: { ...payload, body: 'new user edit' } }, 's', 3);
-  await assert.rejects(() => open.execute(open.validate({ artifact_id: item.id, payload }), context), { code: 'version_conflict' });
-  assert.equal(registry.get(item.id, 's').payload.body, 'new user edit');
-  await read.execute({ id: item.id }, context);
-  registry.readVersions.get(registry.readKey(item.id, context)).expires = 0;
-  await assert.rejects(() => open.execute(input, context), { code: 'read_required' });
-  const restarted = new XhsArtifactRegistry({ storageDir: registry.storageDir });
-  assert.throws(() => restarted.updateFromRead(item.id, { payload }, context), { code: 'read_required' });
-});
-test('legacy version defaults to 1; HTTP conflict is explicit and isolated', async t => {
-  const registry = fixture(t), item = registry.add({ payload, sessionId: 's' });
-  const legacy = { ...item }; delete legacy.version; fs.writeFileSync(registry.artifactFile(item.id), JSON.stringify(legacy));
-  assert.equal(registry.get(item.id, 's').version, 1);
-  let status, body; const res = { writeHead(s) { status = s; }, end(text) { body = JSON.parse(text); } };
-  await serveXhsArtifact(registry, { method: 'PUT' }, res, item.id, async () => ({ title: payload.title, payload, expected_version: 0 }), 's');
-  assert.equal(status, 409); assert.equal(body.code, 'version_conflict'); assert.equal(body.current_version, 1);
-  await serveXhsArtifact(registry, { method: 'GET' }, res, item.id, null, 'other'); assert.equal(status, 404);
-  fs.writeFileSync(registry.artifactFile(item.id) + '.lock', 'crashed owner');
-  await serveXhsArtifact(registry, { method: 'PUT' }, res, item.id, async () => ({ title: payload.title, payload, expected_version: 1 }), 's');
-  assert.equal(status, 423); assert.equal(body.code, 'artifact_busy');
-  fs.unlinkSync(registry.artifactFile(item.id) + '.lock');
-  registry.update(item.id, { payload }, 's', 1); assert.equal(registry.get(item.id, 's').version, 2);
-});
-
-test('editor existing CSS is byte-equivalent to baseline', () => {
-  const baseline = execFileSync('git', ['show', 'HEAD:web/plugins/xhs-artifact/editor-page.mjs'], { encoding: 'utf8' });
-  const current = renderXhsEditorPage({ id: 'style', payload }, '/api/xhs-artifacts/style');
-  assert.equal(current.match(/<style>([\s\S]*?)<\/style>/)[1], baseline.match(/<style>([\s\S]*?)<\/style>/)[1]);
-});
-
-test('Windows replacement retries hold CAS lock; exhausted writes are 500 and preserve old JSON', async t => {
-  const registry = fixture(t), item = registry.add({ payload, sessionId: 's' });
-  const second = new XhsArtifactRegistry({ storageDir: registry.storageDir });
-  const originalRename = fs.renameSync;
-  let calls = 0;
-  try {
-    fs.renameSync = (from, to) => {
-      calls++;
-      assert.equal(registry.get(item.id, 's').version, 1);
-      assert.throws(() => second.update(item.id, { payload }, 's', 1), { code: 'artifact_busy' });
-      if (calls < 3) throw Object.assign(new Error('injected Windows sharing denial'), { code: 'EPERM' });
-      return originalRename(from, to);
-    };
-    if (process.platform === 'win32') {
-      registry.update(item.id, { payload: { ...payload, body: 'committed' } }, 's', 1);
-      assert.equal(calls, 3);
-      assert.equal(registry.get(item.id, 's').payload.body, 'committed');
-    }
-  } finally { fs.renameSync = originalRename; }
-  const before = registry.get(item.id, 's');
-  let status, response;
-  const res = { writeHead(value) { status = value; }, end(value) { response = JSON.parse(value); } };
-  for (const code of ['EPERM', 'ENOSPC']) {
-    calls = 0;
-    try {
-      fs.renameSync = () => { calls++; throw Object.assign(new Error('injected persistent failure'), { code }); };
-      await serveXhsArtifact(registry, { method: 'PUT' }, res, item.id, async () => ({ title: payload.title, payload, expected_version: before.version }), 's');
-    } finally { fs.renameSync = originalRename; }
-    assert.equal(status, 500);
-    assert.equal(response.code, 'artifact_write_failed');
-    assert.equal(response.storage_code, code);
-    assert.equal(calls, process.platform === 'win32' && code === 'EPERM' ? 21 : 1);
-    assert.deepEqual(registry.get(item.id, 's'), before);
-    assert.deepEqual(fs.readdirSync(registry.storageDir), [item.id + '.json']);
-  }
-  registry.update(item.id, { payload }, 's', before.version);
-  assert.equal(registry.get(item.id, 's').version, before.version + 1);
-});
-
-test('Windows lock open retries remain exclusive and persistent lock denial is not a conflict', async t => {
-  const registry = fixture(t), item = registry.add({ payload, sessionId: 's' });
-  const originalOpen = fs.openSync;
-  let calls = 0;
-  try {
-    fs.openSync = (name, flags, ...args) => {
-      if (flags === 'wx' && String(name).endsWith('.lock') && ++calls < 3) throw Object.assign(new Error('delete-pending lock'), { code: 'EPERM' });
-      return originalOpen(name, flags, ...args);
-    };
-    if (process.platform === 'win32') {
-      registry.update(item.id, { payload }, 's', 1);
-      assert.equal(calls, 3);
-    }
-  } finally { fs.openSync = originalOpen; }
-  const before = registry.get(item.id, 's');
-  let status, response;
-  const res = { writeHead(value) { status = value; }, end(value) { response = JSON.parse(value); } };
-  try {
-    fs.openSync = (name, flags, ...args) => {
-      if (flags === 'wx' && String(name).endsWith('.lock')) throw Object.assign(new Error('persistent permission denial'), { code: 'EACCES' });
-      return originalOpen(name, flags, ...args);
-    };
-    await serveXhsArtifact(registry, { method: 'PUT' }, res, item.id, async () => ({ title: payload.title, payload, expected_version: before.version }), 's');
-  } finally { fs.openSync = originalOpen; }
-  assert.equal(status, 500); assert.equal(response.code, 'artifact_write_failed'); assert.equal(response.storage_code, 'EACCES');
-  assert.deepEqual(registry.get(item.id, 's'), before);
-  assert.deepEqual(fs.readdirSync(registry.storageDir), [item.id + '.json']);
-});