ea1c823 · 0cfb9f2 · b7dc11b · ec17c9a
@@ -491,12 +491,12 @@
answers
| `ui://forge/asks` | `asks`, `asks_act` | One row per waiting decision with its button; after a press, the receipt. |
| `ui://forge/wave` | `waves` | One wave: headline, highlights with their why, pull numbers. |
| `ui://forge/map` | `map` | The plan: per pillar ready, working and waiting counts, the first ready issues. |
| `ui://forge/feed` | `feed` | The latest timeline items, how many are new. |
| `ui://forge/feed` | `feed` | The newest timeline items, at most 20, each linked; how many are new. |
| `ui://forge/pull` | `pull` | One pull: state, check, conflicts, head → base, preview link. |
| `ui://forge/pulls` | `pulls` | A repository's pulls, one row each, with check state. |
| `ui://forge/pulls` | `pulls` | Pulls, at most 20: `#N title`, state, check and review word, each linked. |
| `ui://forge/runs` | `runs` | Recent runs, newest first, linked to their logs. |
| `ui://forge/asked` | `asked` | What people asked the crew for and where each ask stands. |
| `ui://forge/explore` | `explore` | Apps and forges ranked by real metrics. |
| `ui://forge/explore` | `explore` | Apps, people and forges ranked, at most 20: name, kind, the numbers (and likes or ship time when sorted by them), linked; only what you may see. |
| `ui://forge/issue` | `issue` | One issue: title, state, assignee, labels, what it waits for. |
| `ui://forge/flow` | `flow` | The pipeline: per stage counts, oldest waiting, the bottleneck. |
| `ui://forge/scorecard` | `scorecard` | The crew's scorecard per agent (forge admin). |
@@ -103,7 +103,16 @@
const list = (v: unknown): unknown[] => (Array.isArray(v) ? v : []);
const text = (v: unknown): string =>
  typeof v === "string" ? v : typeof v === "number" ? String(v) : "";
const LIMIT = 12;
const FEED_LIMIT = 10;
const FEED_LIMIT = 20;
/** A pull's review word: the pile's `verdict`, or the counts a repository's list carries. */
function reviewWord(verdict: string, approvals: number, changesRequested: number): string {
  const asked = changesRequested > 0;
  if (verdict === "approved" || (approvals > 0 && !asked)) return "approved";
  if (verdict === "changes_requested" || asked) return "changes requested";
  return "no review";
}
const EXPLORE_ROWS = 20;
const PULLS_LIMIT = 20;
export const SEARCH_ROWS = 20;
export const ISSUES_ROWS = 20;
@@ -414,14 +423,17 @@
export function cardFor(
    // The tool stops at `limit`: a full answer may be the first of more.
    const cut = typeof extra["limit"] === "number" && pulls.length >= extra["limit"];
    status = `${pulls.length}${cut ? "+" : ""} ${extra["state"] === "closed" ? "closed" : "open"}`;
    const slug = text(extra["repo"]);
    const state = extra["state"] === "closed" ? "closed" : "open";
    for (const p of pulls.slice(0, PULLS_LIMIT)) {
      const number = text(p["number"]);
      const check = text(p["check"]);
      const slug = text(p["repo"]) || text(extra["repo"]);
      const path = `/${slug}/pulls/${number}`;
      const verdict = text(p["verdict"]);
      const review = reviewWord(verdict, Number(p["approvals"]), Number(p["changesRequested"]));
      rows.push({
        label: `#${number} ${text(p["title"])}`.trim(),
        value: checkWord(check),
        value: `${state} · ${checkWord(check)} · ${review}`,
        ...(web(origin) && slugOf(slug) && /^[1-9]\d*$/.test(number) && here(origin, path)
          ? { link: origin + path }
          : {}),
@@ -632,7 +644,8 @@
export function cardFor(
    const items = list(obj(value)["items"]).map(obj);
    const query = text(obj(value)["query"]);
    status = `${items.length} ranked${query === "" ? "" : ` · ${query}`}`;
    for (const i of items.slice(0, FEED_LIMIT)) {
    const sort = /(?:^|\s)sort:(\w+)/i.exec(query)?.[1]?.toLowerCase();
    for (const i of items.slice(0, EXPLORE_ROWS)) {
      const n = obj(i["numbers"]);
      const link = text(i["url"]);
      const kindOf = text(i["kind"]);
@@ -643,6 +656,8 @@
export function cardFor(
            ? text(i["description"])
            : `${text(n["forks"])} forks · ${text(n["ships"])} ships · ${text(n["awakeHours"])} h awake${
                kindOf === "person" ? ` · ${text(n["apps"])} apps` : ""
              }${sort === "likes" ? ` · ${text(n["likes"])} likes` : ""}${
                sort === "fresh" && text(i["shippedAt"]) !== "" ? ` · shipped ${timeAgo(text(i["shippedAt"]))}` : ""
              }`,
        ...(here(origin, link) ? { link: origin + link } : {}),
      });
@@ -1,9 +1,9 @@
/** The explore card: the top ten rows with their numbers, linked only to this forge, escaped by the shared shell. */
/** The explore card: the top twenty rows with their numbers, linked only to this forge, escaped by the shared shell. */
import { expect, test } from "bun:test";
import { CARD_OF_TOOL, cardFor } from "../src/web/studio/cards.ts";
const numbers = { forks: 1, ships: 2, awakeHours: 3, apps: 0 };
const many = Array.from({ length: 12 }, (_, n) => ({
const many = Array.from({ length: 25 }, (_, n) => ({
  kind: "app",
  name: n === 0 ? "<img src=x onerror=alert(1)>" : `app${n}`,
  url: `/bob/app${n}`,
@@ -17,9 +17,9 @@
test("the explore tool draws the explore card", () => {
  expect(CARD_OF_TOOL["explore"]).toBe("explore");
});
test("the card keeps ten rows, with numbers and links, and Make it yours beside the app", () => {
test("the card keeps twenty rows, with numbers and links, and Make it yours beside the app", () => {
  const c = cardFor("explore", { query: "", items: many }, "https://forge.test")!;
  expect(c.rows.filter((r) => r.label !== "Make it yours")).toHaveLength(10);
  expect(c.rows.filter((r) => r.label !== "Make it yours")).toHaveLength(20);
  expect(c.rows[0]).toEqual({
    label: "app · <img src=x onerror=alert(1)>",
    value: "1 forks · 2 ships · 3 h awake",
@@ -0,0 +1,138 @@
/**
 * MCP `explore`, `pulls` and `feed` each draw their `ui://forge/…` card (#11294):
 * the card is present, a hostile string arrives as text, a stranger's card
 * holds no private row, and each stops at 20 rows.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { openPull } from "../src/actions/pulls.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { createApp as insertApp } from "../src/core/apps.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { cardFor } from "../src/web/studio/cards.ts";
import { promote } from "./helpers/members.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const EVIL = "<img src=x onerror=alert(1)>";
describe("explore, pulls and feed cards", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let strangerTok = "";
  let id = 1;
  const card = async (name: string, args: unknown = {}) => {
    const res = await fetch(`${servers.url}/mcp`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        accept: "application/json, text/event-stream",
        authorization: `Bearer ${strangerTok}`,
      },
      body: JSON.stringify({ jsonrpc: "2.0", id: id++, method: "tools/call", params: { name, arguments: args } }),
    });
    return ((await res.json()) as any).result.structuredContent.card;
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-mcp-cards-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    const mk = async (username: string, first = false): Promise<User> => {
      const u = await createUser(app.db, { origin: "seed", trusted: true, username, email: `${username}@forge.local`, password: "a-good-passphrase", adminIfFirst: first });
      if (!u.ok) throw new Error(u.error);
      promote(app.db, u.value);
      return u.value;
    };
    await mk("founder", true);
    const alice = await mk("alice");
    const bob = await mk("bob");
    strangerTok = createToken(app.db, bob.id, "ro", "ro").token;
    const open = await createRepo(app, alice, { name: "openapp", visibility: "public" });
    const secret = await createRepo(app, alice, { name: "hiddenapp", visibility: "private" });
    if (!open.ok || !secret.ok) throw new Error("repos");
    for (const repo of [open.value, secret.value]) {
      const rec = insertApp(app.db, { repoId: repo.id, slug: `alice-${repo.name}`, access: repo.visibility === "public" ? "public" : "private" });
      if (!rec.ok) throw new Error(rec.error);
      app.db.run("INSERT INTO feed_like (viewer_id, item_id, repo_id) VALUES (?1, ?2, ?3)", [alice.id, `like-${repo.name}`, repo.id]);
      const seeded = await commitToBranch(app, alice, repo, { message: "Start", files: [{ path: "README.md", content: "# x\n" }] });
      if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
      const pushed = await commitToBranch(app, alice, repo, { branch: "feature/x", base: "main", message: "x", files: [{ path: "x.ts", content: "export const x = 1;\n" }] });
      if (!pushed.ok) throw new Error(JSON.stringify(pushed.error));
      const pr = await openPull(app, alice, repo, { title: `pull of ${repo.name}`, baseBranch: "main", headBranch: "feature/x" });
      if (!pr.ok) throw new Error(String(pr.error));
    }
    for (const [repo, summary] of [[open.value, EVIL], [secret.value, "hush-secret"]] as const)
      app.bus.append({ kind: "run.finished", repoId: repo.id, actorId: alice.id, payload: { kind: "deploy", state: "ok", summary, runId: `r-${repo.name}` } });
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("explore draws its card for a stranger: the ranked public app, linked, and not the private one", async () => {
    const c = await card("explore", {});
    expect(c.kind).toBe("explore");
    const row = c.rows.find((r: any) => r.label === "app · alice/openapp");
    expect(row).toBeDefined();
    expect(row.link).toBe(`${servers.url}/alice/openapp`);
    expect(JSON.stringify(c)).not.toContain("hiddenapp");
    expect(c.rows.length).toBeLessThanOrEqual(20);
  });
  test("feed draws its card for a stranger: the public run's row with its text escaped, not the private one", async () => {
    const c = await card("feed", {});
    expect(c.kind).toBe("feed");
    const row = c.rows.find((r: any) => r.label.includes(EVIL));
    expect(row).toBeDefined();
    const all = JSON.stringify(c);
    expect(all).not.toContain("hush-secret");
    expect(all).not.toContain("hiddenapp");
  });
  test("pulls with no repo, as a stranger: the public pull's row, linked to its own repo, and not the private one", async () => {
    const c = await card("pulls", {});
    expect(c.kind).toBe("pulls");
    const row = c.rows.find((r: any) => r.label.includes("pull of openapp"));
    expect(row).toBeDefined();
    expect(row.value).toBe("open · none · no review");
    expect(row.link).toBe(`${servers.url}/alice/openapp/pulls/1`);
    expect(JSON.stringify(c)).not.toContain("hiddenapp");
    expect(c.rows).toHaveLength(1);
  });
  test("a pull row says state, check and review, linked to its pull", () => {
    const c = cardFor("pulls", { pulls: [{ repo: "alice/game", number: 3, title: EVIL, check: "ok", verdict: "approved" }, { repo: "alice/game", number: 4, title: "t", check: "failed", verdict: "changes_requested" }] }, "https://forge.test", {})!;
    expect(c.rows[0]).toEqual({ label: `#3 ${EVIL}`, value: "open · green · approved", link: "https://forge.test/alice/game/pulls/3" });
    expect(c.rows[1]!.value).toBe("open · red · changes requested");
  });
  test("each card stops at 20 rows", () => {
    const pulls = Array.from({ length: 30 }, (_, i) => ({ number: i + 1, title: "t", check: "ok" }));
    expect(cardFor("pulls", { pulls }, "https://forge.test", { repo: "a/b" })!.rows).toHaveLength(20);
    const items = Array.from({ length: 30 }, (_, i) => ({ kind: "forge", name: `f${i}`, url: `/f${i}`, description: "d", numbers: {} }));
    expect(cardFor("explore", { query: "", items }, "https://forge.test")!.rows).toHaveLength(20);
    const feed = Array.from({ length: 30 }, (_, i) => ({ actor: "a", what: `w${i}`, link: `/x/${i}`, at: "2026-01-01T00:00:00Z" }));
    expect(cardFor("feed", { items: feed }, "https://forge.test")!.rows).toHaveLength(20);
  });
  test("explore names the signal it ranks on", () => {
    const items = [{ kind: "app", name: "a", url: "/o/a", numbers: { forks: 1, ships: 2, awakeHours: 3, likes: 9 } }];
    const c = cardFor("explore", { query: "sort:likes", items }, "https://forge.test")!;
    expect(c.rows[0]!.value).toContain("9 likes");
    const ago = new Date(Date.now() - 3 * 3600_000).toISOString();
    const fresh = cardFor("explore", { query: "sort:fresh", items: [{ ...items[0], shippedAt: ago }] }, "https://forge.test")!;
    expect(fresh.rows[0]!.value).toMatch(/ · shipped \d+ ?h/);
    expect(fresh.rows[0]!.value).not.toContain("likes");
  });
});
@@ -85,8 +85,8 @@
describe("MCP pulls card", () => {
    expect(card.status).toBe("2 open");
    const [two, one] = [numbers[1]!, numbers[0]!];
    expect(card.rows).toEqual([
      { label: `#${two} ${EVIL}`, value: "none", link: `${servers.url}/alice/game/pulls/${two}` },
      { label: `#${one} First`, value: "none", link: `${servers.url}/alice/game/pulls/${one}` },
      { label: `#${two} ${EVIL}`, value: "open · none · no review", link: `${servers.url}/alice/game/pulls/${two}` },
      { label: `#${one} First`, value: "open · none · no review", link: `${servers.url}/alice/game/pulls/${one}` },
    ]);
    const text = JSON.parse(body.result.content[0].text);
    expect(text.pulls.map((p: any) => p.number)).toEqual([two, one]);
@@ -107,7 +107,7 @@
describe("MCP pulls card", () => {
      number: i + 1, title: `P${i + 1}`, check,
    }));
    const card = cardFor("pulls", { pulls }, "https://forge.test", { repo: "alice/game", state: "open" })!;
    expect(card.rows.map((r) => r.value)).toEqual(["green", "red", "running", "running", "none", "cancelled"]);
    expect(card.rows.map((r) => r.value)).toEqual(["green", "red", "running", "running", "none", "cancelled"].map((w) => `open · ${w} · no review`));
    expect(card.rows[0]!.link).toBe("https://forge.test/alice/game/pulls/1");
    const many = Array.from({ length: 30 }, (_, i) => ({ number: i + 1, title: "t", check: "ok" }));
@@ -1479,9 +1479,9 @@
describe("the forge over MCP", () => {
    expect(cardFor("asks", { rows: lines }, "javascript:x")!.rows.every((r) => r.link === undefined)).toBe(true);
  });
  test("the feed card draws one linked row per item, ten at most, escaped as text", async () => {
  test("the feed card draws one linked row per item, twenty at most, escaped as text", async () => {
    const { cardFor } = await import("../src/web/studio/cards.ts");
    const items = Array.from({ length: 12 }, (_, n) => ({
    const items = Array.from({ length: 25 }, (_, n) => ({
      actor: "scout",
      what: n === 0 ? "<b>shipped</b>" : `did ${n}`,
      app: "alice/game",
@@ -1492,7 +1492,7 @@
describe("the forge over MCP", () => {
    expect(card.kind).toBe("feed");
    expect(card.title).toBe("Feed");
    expect(card.status).toBe("Latest");
    expect(card.rows).toHaveLength(10);
    expect(card.rows).toHaveLength(20);
    expect(card.rows[0]).toEqual({
      label: "scout: <b>shipped</b>",
      value: "alice/game · just now",
		@@ -491,12 +491,12 @@ answers
491	491	\| `ui://forge/asks` \| `asks`, `asks_act` \| One row per waiting decision with its button; after a press, the receipt. \|
492	492	\| `ui://forge/wave` \| `waves` \| One wave: headline, highlights with their why, pull numbers. \|
493	493	\| `ui://forge/map` \| `map` \| The plan: per pillar ready, working and waiting counts, the first ready issues. \|
494		\| `ui://forge/feed` \| `feed` \| The latest timeline items, how many are new. \|
	494	\| `ui://forge/feed` \| `feed` \| The newest timeline items, at most 20, each linked; how many are new. \|
495	495	\| `ui://forge/pull` \| `pull` \| One pull: state, check, conflicts, head → base, preview link. \|
496		\| `ui://forge/pulls` \| `pulls` \| A repository's pulls, one row each, with check state. \|
	496	\| `ui://forge/pulls` \| `pulls` \| Pulls, at most 20: `#N title`, state, check and review word, each linked. \|
497	497	\| `ui://forge/runs` \| `runs` \| Recent runs, newest first, linked to their logs. \|
498	498	\| `ui://forge/asked` \| `asked` \| What people asked the crew for and where each ask stands. \|
499		\| `ui://forge/explore` \| `explore` \| Apps and forges ranked by real metrics. \|
	499	\| `ui://forge/explore` \| `explore` \| Apps, people and forges ranked, at most 20: name, kind, the numbers (and likes or ship time when sorted by them), linked; only what you may see. \|
500	500	\| `ui://forge/issue` \| `issue` \| One issue: title, state, assignee, labels, what it waits for. \|
501	501	\| `ui://forge/flow` \| `flow` \| The pipeline: per stage counts, oldest waiting, the bottleneck. \|
502	502	\| `ui://forge/scorecard` \| `scorecard` \| The crew's scorecard per agent (forge admin). \|
		@@ -103,7 +103,16 @@ const list = (v: unknown): unknown[] => (Array.isArray(v) ? v : []);
103	103	const text = (v: unknown): string =>
104	104	typeof v === "string" ? v : typeof v === "number" ? String(v) : "";
105	105	const LIMIT = 12;
106		const FEED_LIMIT = 10;
	106	const FEED_LIMIT = 20;
	107
	108	/** A pull's review word: the pile's `verdict`, or the counts a repository's list carries. */
	109	function reviewWord(verdict: string, approvals: number, changesRequested: number): string {
	110	const asked = changesRequested > 0;
	111	if (verdict === "approved" \|\| (approvals > 0 && !asked)) return "approved";
	112	if (verdict === "changes_requested" \|\| asked) return "changes requested";
	113	return "no review";
	114	}
	115	const EXPLORE_ROWS = 20;
107	116	const PULLS_LIMIT = 20;
108	117	export const SEARCH_ROWS = 20;
109	118	export const ISSUES_ROWS = 20;
		@@ -414,14 +423,17 @@ export function cardFor(
414	423	// The tool stops at `limit`: a full answer may be the first of more.
415	424	const cut = typeof extra["limit"] === "number" && pulls.length >= extra["limit"];
416	425	status = `${pulls.length}${cut ? "+" : ""} ${extra["state"] === "closed" ? "closed" : "open"}`;
417		const slug = text(extra["repo"]);
	426	const state = extra["state"] === "closed" ? "closed" : "open";
418	427	for (const p of pulls.slice(0, PULLS_LIMIT)) {
419	428	const number = text(p["number"]);
420	429	const check = text(p["check"]);
	430	const slug = text(p["repo"]) \|\| text(extra["repo"]);
421	431	const path = `/${slug}/pulls/${number}`;
	432	const verdict = text(p["verdict"]);
	433	const review = reviewWord(verdict, Number(p["approvals"]), Number(p["changesRequested"]));
422	434	rows.push({
423	435	label: `#${number} ${text(p["title"])}`.trim(),
424		value: checkWord(check),
	436	value: `${state} · ${checkWord(check)} · ${review}`,
425	437	...(web(origin) && slugOf(slug) && /^[1-9]\d*$/.test(number) && here(origin, path)
426	438	? { link: origin + path }
427	439	: {}),
		@@ -632,7 +644,8 @@ export function cardFor(
632	644	const items = list(obj(value)["items"]).map(obj);
633	645	const query = text(obj(value)["query"]);
634	646	status = `${items.length} ranked${query === "" ? "" : ` · ${query}`}`;
635		for (const i of items.slice(0, FEED_LIMIT)) {
	647	const sort = /(?:^\|\s)sort:(\w+)/i.exec(query)?.[1]?.toLowerCase();
	648	for (const i of items.slice(0, EXPLORE_ROWS)) {
636	649	const n = obj(i["numbers"]);
637	650	const link = text(i["url"]);
638	651	const kindOf = text(i["kind"]);
		@@ -643,6 +656,8 @@ export function cardFor(
643	656	? text(i["description"])
644	657	: `${text(n["forks"])} forks · ${text(n["ships"])} ships · ${text(n["awakeHours"])} h awake${
645	658	kindOf === "person" ? ` · ${text(n["apps"])} apps` : ""
	659	}${sort === "likes" ? ` · ${text(n["likes"])} likes` : ""}${
	660	sort === "fresh" && text(i["shippedAt"]) !== "" ? ` · shipped ${timeAgo(text(i["shippedAt"]))}` : ""
646	661	}`,
647	662	...(here(origin, link) ? { link: origin + link } : {}),
648	663	});
		@@ -1,9 +1,9 @@
1		/** The explore card: the top ten rows with their numbers, linked only to this forge, escaped by the shared shell. */
	1	/** The explore card: the top twenty rows with their numbers, linked only to this forge, escaped by the shared shell. */
2	2	import { expect, test } from "bun:test";
3	3	import { CARD_OF_TOOL, cardFor } from "../src/web/studio/cards.ts";
4	4
5	5	const numbers = { forks: 1, ships: 2, awakeHours: 3, apps: 0 };
6		const many = Array.from({ length: 12 }, (_, n) => ({
	6	const many = Array.from({ length: 25 }, (_, n) => ({
7	7	kind: "app",
8	8	name: n === 0 ? "<img src=x onerror=alert(1)>" : `app${n}`,
9	9	url: `/bob/app${n}`,
		@@ -17,9 +17,9 @@ test("the explore tool draws the explore card", () => {
17	17	expect(CARD_OF_TOOL["explore"]).toBe("explore");
18	18	});
19	19
20		test("the card keeps ten rows, with numbers and links, and Make it yours beside the app", () => {
	20	test("the card keeps twenty rows, with numbers and links, and Make it yours beside the app", () => {
21	21	const c = cardFor("explore", { query: "", items: many }, "https://forge.test")!;
22		expect(c.rows.filter((r) => r.label !== "Make it yours")).toHaveLength(10);
	22	expect(c.rows.filter((r) => r.label !== "Make it yours")).toHaveLength(20);
23	23	expect(c.rows[0]).toEqual({
24	24	label: "app · <img src=x onerror=alert(1)>",
25	25	value: "1 forks · 2 ships · 3 h awake",
		@@ -0,0 +1,138 @@
	1	/**
	2	* MCP `explore`, `pulls` and `feed` each draw their `ui://forge/…` card (#11294):
	3	* the card is present, a hostile string arrives as text, a stranger's card
	4	* holds no private row, and each stops at 20 rows.
	5	*/
	6	import { afterAll, beforeAll, describe, expect, test } from "bun:test";
	7	import { mkdtemp, rm } from "node:fs/promises";
	8	import { tmpdir } from "node:os";
	9	import { join } from "node:path";
	10	import { createApp, type App } from "../src/app.ts";
	11	import { openPull } from "../src/actions/pulls.ts";
	12	import { commitToBranch, createRepo } from "../src/actions/repos.ts";
	13	import { createApp as insertApp } from "../src/core/apps.ts";
	14	import { createToken } from "../src/core/tokens.ts";
	15	import { createUser, type User } from "../src/core/users.ts";
	16	import { serve, type Servers } from "../src/http/server.ts";
	17	import { cardFor } from "../src/web/studio/cards.ts";
	18	import { promote } from "./helpers/members.ts";
	19	import { quietLogs } from "./helpers/globals.ts";
	20
	21	quietLogs();
	22
	23	const EVIL = "<img src=x onerror=alert(1)>";
	24
	25	describe("explore, pulls and feed cards", () => {
	26	let dataDir: string;
	27	let app: App;
	28	let servers: Servers;
	29	let strangerTok = "";
	30	let id = 1;
	31
	32	const card = async (name: string, args: unknown = {}) => {
	33	const res = await fetch(`${servers.url}/mcp`, {
	34	method: "POST",
	35	headers: {
	36	"content-type": "application/json",
	37	accept: "application/json, text/event-stream",
	38	authorization: `Bearer ${strangerTok}`,
	39	},
	40	body: JSON.stringify({ jsonrpc: "2.0", id: id++, method: "tools/call", params: { name, arguments: args } }),
	41	});
	42	return ((await res.json()) as any).result.structuredContent.card;
	43	};
	44
	45	beforeAll(async () => {
	46	dataDir = await mkdtemp(join(tmpdir(), "forge-mcp-cards-"));
	47	app = createApp({ dataDir, port: 0 });
	48	servers = await serve(app);
	49	const mk = async (username: string, first = false): Promise<User> => {
	50	const u = await createUser(app.db, { origin: "seed", trusted: true, username, email: `${username}@forge.local`, password: "a-good-passphrase", adminIfFirst: first });
	51	if (!u.ok) throw new Error(u.error);
	52	promote(app.db, u.value);
	53	return u.value;
	54	};
	55	await mk("founder", true);
	56	const alice = await mk("alice");
	57	const bob = await mk("bob");
	58	strangerTok = createToken(app.db, bob.id, "ro", "ro").token;
	59	const open = await createRepo(app, alice, { name: "openapp", visibility: "public" });
	60	const secret = await createRepo(app, alice, { name: "hiddenapp", visibility: "private" });
	61	if (!open.ok \|\| !secret.ok) throw new Error("repos");
	62	for (const repo of [open.value, secret.value]) {
	63	const rec = insertApp(app.db, { repoId: repo.id, slug: `alice-${repo.name}`, access: repo.visibility === "public" ? "public" : "private" });
	64	if (!rec.ok) throw new Error(rec.error);
	65	app.db.run("INSERT INTO feed_like (viewer_id, item_id, repo_id) VALUES (?1, ?2, ?3)", [alice.id, `like-${repo.name}`, repo.id]);
	66	const seeded = await commitToBranch(app, alice, repo, { message: "Start", files: [{ path: "README.md", content: "# x\n" }] });
	67	if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
	68	const pushed = await commitToBranch(app, alice, repo, { branch: "feature/x", base: "main", message: "x", files: [{ path: "x.ts", content: "export const x = 1;\n" }] });
	69	if (!pushed.ok) throw new Error(JSON.stringify(pushed.error));
	70	const pr = await openPull(app, alice, repo, { title: `pull of ${repo.name}`, baseBranch: "main", headBranch: "feature/x" });
	71	if (!pr.ok) throw new Error(String(pr.error));
	72	}
	73	for (const [repo, summary] of [[open.value, EVIL], [secret.value, "hush-secret"]] as const)
	74	app.bus.append({ kind: "run.finished", repoId: repo.id, actorId: alice.id, payload: { kind: "deploy", state: "ok", summary, runId: `r-${repo.name}` } });
	75	});
	76
	77	afterAll(async () => {
	78	servers.stop();
	79	app.close();
	80	await rm(dataDir, { recursive: true, force: true });
	81	});
	82
	83	test("explore draws its card for a stranger: the ranked public app, linked, and not the private one", async () => {
	84	const c = await card("explore", {});
	85	expect(c.kind).toBe("explore");
	86	const row = c.rows.find((r: any) => r.label === "app · alice/openapp");
	87	expect(row).toBeDefined();
	88	expect(row.link).toBe(`${servers.url}/alice/openapp`);
	89	expect(JSON.stringify(c)).not.toContain("hiddenapp");
	90	expect(c.rows.length).toBeLessThanOrEqual(20);
	91	});
	92
	93	test("feed draws its card for a stranger: the public run's row with its text escaped, not the private one", async () => {
	94	const c = await card("feed", {});
	95	expect(c.kind).toBe("feed");
	96	const row = c.rows.find((r: any) => r.label.includes(EVIL));
	97	expect(row).toBeDefined();
	98	const all = JSON.stringify(c);
	99	expect(all).not.toContain("hush-secret");
	100	expect(all).not.toContain("hiddenapp");
	101	});
	102
	103	test("pulls with no repo, as a stranger: the public pull's row, linked to its own repo, and not the private one", async () => {
	104	const c = await card("pulls", {});
	105	expect(c.kind).toBe("pulls");
	106	const row = c.rows.find((r: any) => r.label.includes("pull of openapp"));
	107	expect(row).toBeDefined();
	108	expect(row.value).toBe("open · none · no review");
	109	expect(row.link).toBe(`${servers.url}/alice/openapp/pulls/1`);
	110	expect(JSON.stringify(c)).not.toContain("hiddenapp");
	111	expect(c.rows).toHaveLength(1);
	112	});
	113
	114	test("a pull row says state, check and review, linked to its pull", () => {
	115	const c = cardFor("pulls", { pulls: [{ repo: "alice/game", number: 3, title: EVIL, check: "ok", verdict: "approved" }, { repo: "alice/game", number: 4, title: "t", check: "failed", verdict: "changes_requested" }] }, "https://forge.test", {})!;
	116	expect(c.rows[0]).toEqual({ label: `#3 ${EVIL}`, value: "open · green · approved", link: "https://forge.test/alice/game/pulls/3" });
	117	expect(c.rows[1]!.value).toBe("open · red · changes requested");
	118	});
	119
	120	test("each card stops at 20 rows", () => {
	121	const pulls = Array.from({ length: 30 }, (_, i) => ({ number: i + 1, title: "t", check: "ok" }));
	122	expect(cardFor("pulls", { pulls }, "https://forge.test", { repo: "a/b" })!.rows).toHaveLength(20);
	123	const items = Array.from({ length: 30 }, (_, i) => ({ kind: "forge", name: `f${i}`, url: `/f${i}`, description: "d", numbers: {} }));
	124	expect(cardFor("explore", { query: "", items }, "https://forge.test")!.rows).toHaveLength(20);
	125	const feed = Array.from({ length: 30 }, (_, i) => ({ actor: "a", what: `w${i}`, link: `/x/${i}`, at: "2026-01-01T00:00:00Z" }));
	126	expect(cardFor("feed", { items: feed }, "https://forge.test")!.rows).toHaveLength(20);
	127	});
	128
	129	test("explore names the signal it ranks on", () => {
	130	const items = [{ kind: "app", name: "a", url: "/o/a", numbers: { forks: 1, ships: 2, awakeHours: 3, likes: 9 } }];
	131	const c = cardFor("explore", { query: "sort:likes", items }, "https://forge.test")!;
	132	expect(c.rows[0]!.value).toContain("9 likes");
	133	const ago = new Date(Date.now() - 3 * 3600_000).toISOString();
	134	const fresh = cardFor("explore", { query: "sort:fresh", items: [{ ...items[0], shippedAt: ago }] }, "https://forge.test")!;
	135	expect(fresh.rows[0]!.value).toMatch(/ · shipped \d+ ?h/);
	136	expect(fresh.rows[0]!.value).not.toContain("likes");
	137	});
	138	});
		@@ -85,8 +85,8 @@ describe("MCP pulls card", () => {
85	85	expect(card.status).toBe("2 open");
86	86	const [two, one] = [numbers[1]!, numbers[0]!];
87	87	expect(card.rows).toEqual([
88		{ label: `#${two} ${EVIL}`, value: "none", link: `${servers.url}/alice/game/pulls/${two}` },
89		{ label: `#${one} First`, value: "none", link: `${servers.url}/alice/game/pulls/${one}` },
	88	{ label: `#${two} ${EVIL}`, value: "open · none · no review", link: `${servers.url}/alice/game/pulls/${two}` },
	89	{ label: `#${one} First`, value: "open · none · no review", link: `${servers.url}/alice/game/pulls/${one}` },
90	90	]);
91	91	const text = JSON.parse(body.result.content[0].text);
92	92	expect(text.pulls.map((p: any) => p.number)).toEqual([two, one]);
		@@ -107,7 +107,7 @@ describe("MCP pulls card", () => {
107	107	number: i + 1, title: `P${i + 1}`, check,
108	108	}));
109	109	const card = cardFor("pulls", { pulls }, "https://forge.test", { repo: "alice/game", state: "open" })!;
110		expect(card.rows.map((r) => r.value)).toEqual(["green", "red", "running", "running", "none", "cancelled"]);
	110	expect(card.rows.map((r) => r.value)).toEqual(["green", "red", "running", "running", "none", "cancelled"].map((w) => `open · ${w} · no review`));
111	111	expect(card.rows[0]!.link).toBe("https://forge.test/alice/game/pulls/1");
112	112
113	113	const many = Array.from({ length: 30 }, (_, i) => ({ number: i + 1, title: "t", check: "ok" }));
		@@ -1479,9 +1479,9 @@ describe("the forge over MCP", () => {
1479	1479	expect(cardFor("asks", { rows: lines }, "javascript:x")!.rows.every((r) => r.link === undefined)).toBe(true);
1480	1480	});
1481	1481
1482		test("the feed card draws one linked row per item, ten at most, escaped as text", async () => {
	1482	test("the feed card draws one linked row per item, twenty at most, escaped as text", async () => {
1483	1483	const { cardFor } = await import("../src/web/studio/cards.ts");
1484		const items = Array.from({ length: 12 }, (_, n) => ({
	1484	const items = Array.from({ length: 25 }, (_, n) => ({
1485	1485	actor: "scout",
1486	1486	what: n === 0 ? "<b>shipped</b>" : `did ${n}`,
1487	1487	app: "alice/game",
		@@ -1492,7 +1492,7 @@ describe("the forge over MCP", () => {
1492	1492	expect(card.kind).toBe("feed");
1493	1493	expect(card.title).toBe("Feed");
1494	1494	expect(card.status).toBe("Latest");
1495		expect(card.rows).toHaveLength(10);
	1495	expect(card.rows).toHaveLength(20);
1496	1496	expect(card.rows[0]).toEqual({
1497	1497	label: "scout: <b>shipped</b>",
1498	1498	value: "alice/game · just now",