6b59bd1 · 685b3ce · 7359559 · e0aaff5
@@ -738,12 +738,26 @@
bun run check:record  # the same, and rewrites scripts/test-times.json
`bun run check` is the gate: the same command `forge.json` declares, so what
it says here is what the deploy will say. It type-checks once, then runs the
test files `scripts/gate.ts` lists in `GATE` as parallel `bun test` shards
(`scripts/test-shards.ts`): one per CPU the process may use, at most eight,
and `FORGE_CHECK_SHARDS=2` turns that down on a small or busy host. Each
(`scripts/test-shards.ts`): one per CPU the process may use, no more than
one per 512 MiB of the memory its cgroup allows (16 on the 16-CPU, 8 GiB
check cell; the old ceiling of eight left half of it idle, #2038), and
`FORGE_CHECK_SHARDS=2` turns that down on a small or busy host. Each
shard's output is written whole as it finishes; the log ends with every
failing test from every shard, or on green with one line — how many tests,
across how many files, in how long, then the slowest and fastest shard.
Two things keep a test's setup in milliseconds (#2038). `bunfig.toml`
preloads `test/helpers/preload.ts`, which hashes passwords at argon2id's
floor (8 KiB, one pass) instead of Bun's default 64 MiB, two passes:
making an account and signing it in was ~700 ms of a typical `beforeAll`
and is now ~15 ms; the forge itself never loads it. And `openDb` keeps
the empty database each migration list makes: the second fresh database
in a process is a copy of it rather than ninety-odd migrations again
(`createApp` ~100 ms → ~6 ms). No test file runs one subject long
enough to set the gate's floor alone: the studio's and the apps
adversarial suites are split by subject into `test/studio*.test.ts` and
`test/apps-adversarial*.test.ts`.
The check's first step is the gate-list audit (`bun scripts/gate.ts`), so a
test file listed in neither `GATE` nor `EXCLUDED` fails in under a second,
before install-heavy work. `tsc` then runs `--incremental` with a 2 GB heap,
@@ -2,3 +2,6 @@
# where a running forge keeps the crew's clones, each with its own tests.
[test]
root = "test"
# Argon2 at its cheapest under test: most of a typical beforeAll was
# hashing passwords (#2038). Production never loads it.
preload = ["./test/helpers/preload.ts"]
@@ -156,6 +156,11 @@
export const GATE: readonly string[] = [
  "test/autonomy.test.ts",
  "test/autonomy_sweep.test.ts",
  "test/studio.test.ts",
  "test/studio-changes.test.ts",
  "test/studio-door.test.ts",
  "test/studio-runs.test.ts",
  "test/studio-shipping.test.ts",
  "test/studio-search.test.ts",
  "test/studio-words.test.ts",
  "test/converge-settled.test.ts",
  "test/following.test.ts",
@@ -179,6 +184,10 @@
export const GATE: readonly string[] = [
  "test/apps-slow-test.test.ts",
  "test/apps-tests-clause.test.ts",
  "test/apps-adversarial.test.ts",
  "test/apps-adversarial-teardown.test.ts",
  "test/apps-adversarial-test-step.test.ts",
  "test/apps-adversarial-grants.test.ts",
  "test/apps-adversarial-rules.test.ts",
  "test/apps-busy.test.ts",
  "test/apps-token.test.ts",
  "test/contain.test.ts",
@@ -7,22 +7,41 @@
 * is disjoint and covering, and that one red shard makes the run red.
 */
/** No more than this many `bun test` processes at once, whatever the host. */
export const SHARDS_MAX = 8;
/**
 * No more than this many `bun test` processes at once, whatever the host:
 * a ceiling for a big shared machine, not the check cell's number. The cell
 * (16 CPUs, 8 GiB) is bounded by its CPUs and its memory (#2038); the
 * old ceiling of 8 left half its CPUs idle.
 */
export const SHARDS_MAX = 32;
/**
 * How many shards: one per CPU the process may use, capped at
 * Memory one `bun test` process is given room for: the heaviest suite peaks
 * near 260 MiB of its own (test/studio.test.ts, measured with
 * `resourceUsage().maxRSS`), and an apps suite's deploys add children of
 * their own, so twice that. Fewer workers than CPUs on a cell whose memory
 * would not hold one per CPU, rather than an OOM kill mid-gate (#386).
 */
export const WORKER_MEMORY_BYTES = 512 * 1024 * 1024;
/**
 * How many shards: one per CPU the process may use, no more than its
 * memory holds at {@link WORKER_MEMORY_BYTES} each, capped at
 * {@link SHARDS_MAX} and at the number of files, at least one. One per CPU,
 * not fewer: most of a forge test's time is spent waiting on git children
 * and timers, not computing. `FORGE_CHECK_SHARDS` overrides it (still
 * capped at the file count) so a small or busy host can turn it down.
 * and timers, not computing. `memory` absent is not a bound.
 * `FORGE_CHECK_SHARDS` overrides it (still capped at the file count) so a
 * small or busy host can turn it down.
 */
export function shardCount(
  cpus: number,
  files: number,
  override?: string,
  memory?: number,
): { ok: true; value: number } | { ok: false; error: string } {
  let n = Math.min(SHARDS_MAX, Math.floor(cpus));
  if (memory !== undefined && Number.isFinite(memory) && memory > 0)
    n = Math.min(n, Math.floor(memory / WORKER_MEMORY_BYTES));
  if (override !== undefined && override.trim() !== "") {
    if (!/^[1-9][0-9]{0,2}$/.test(override.trim()))
      return {
@@ -34,6 +53,26 @@
export function shardCount(
  return { ok: true, value: Math.max(1, Math.min(n, files)) };
}
/**
 * The memory a process may use: the least of the machine's and each
 * cgroup limit it can read (`memory.max` under v2, `memory.limit_in_bytes`
 * under v1). "max", a v1 "no limit" (a page-rounded 2^63), an unreadable
 * file (`undefined`) or anything not a whole number is no limit.
 */
export function memoryLimit(
  total: number,
  limits: readonly (string | undefined)[],
): number {
  let least = total;
  for (const text of limits) {
    const value = text?.trim() ?? "";
    if (!/^[0-9]{1,19}$/.test(value)) continue;
    const bytes = Number(value);
    if (bytes > 0 && bytes < least) least = bytes;
  }
  return least;
}
/**
 * Splits `files` into at most `n` disjoint, non-empty slices that together
 * hold every file once. `weight` is how long a file is expected to take
@@ -38,12 +38,13 @@
 * table is rewritten from those times when every file is green.
 */
import { availableParallelism, tmpdir } from "node:os";
import { availableParallelism, tmpdir, totalmem } from "node:os";
import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
import { join } from "node:path";
import {
  formatTimes,
  heaviestFirst,
  memoryLimit,
  overlayTimes,
  refreshTimes,
  parseShardSpec,
@@ -326,10 +327,21 @@
if (new Set(files).size !== files.length) {
  process.exit(2);
}
const readLimit = (path: string): string | undefined => {
  try {
    return readFileSync(path, "utf8");
  } catch {
    return undefined;
  }
};
const count = shardCount(
  availableParallelism(),
  files.length,
  process.env["FORGE_CHECK_SHARDS"],
  memoryLimit(totalmem(), [
    readLimit("/sys/fs/cgroup/memory.max"),
    readLimit("/sys/fs/cgroup/memory/memory.limit_in_bytes"),
  ]),
);
if (!count.ok) {
  console.error(`test-shards: ${count.error}`);
@@ -1,5 +1,9 @@
{
  "test/apps-adversarial.test.ts": 145.9,
  "test/apps-adversarial-grants.test.ts": 28.3,
  "test/apps-adversarial-rules.test.ts": 29.7,
  "test/apps-adversarial-teardown.test.ts": 36.4,
  "test/apps-adversarial-test-step.test.ts": 33.5,
  "test/apps-adversarial.test.ts": 18,
  "test/apps-busy.test.ts": 26.4,
  "test/apps-crew.test.ts": 3.8,
  "test/apps-identity.test.ts": 3.2,
@@ -45,8 +49,13 @@
  "test/spawn.test.ts": 11.1,
  "test/standing.test.ts": 2.8,
  "test/steer.test.ts": 16.2,
  "test/studio-changes.test.ts": 31.8,
  "test/studio-door.test.ts": 34.2,
  "test/studio-runs.test.ts": 29.3,
  "test/studio-search.test.ts": 30.7,
  "test/studio-shipping.test.ts": 35.6,
  "test/studio-words.test.ts": 17,
  "test/studio.test.ts": 196.9,
  "test/studio.test.ts": 35.3,
  "test/usage.test.ts": 17.5,
  "test/vitals.test.ts": 7.1,
  "test/web-apps.test.ts": 18.7,
@@ -6,6 +6,7 @@
 */
import { Database } from "bun:sqlite";
import { existsSync, writeFileSync } from "node:fs";
import { migrate } from "./migrate.ts";
/**
@@ -34,12 +35,48 @@
const CACHE_KIB = 64 * 1024;
const MMAP_BYTES = 512 * 1024 * 1024;
export function openDb(path: string, migrations: readonly string[]): Database {
  const db = new Database(path, { create: true, strict: true });
  const memory = path === ":memory:";
  const fresh = memory || !existsSync(path);
  const image = fresh ? migratedEmpty.get(migrations) : undefined;
  let db: Database;
  if (image !== undefined && memory) {
    db = Database.deserialize(rollbackJournal(image), { strict: true });
  } else {
    if (image !== undefined) writeFileSync(path, image, { flag: "wx" });
    db = new Database(path, { create: true, strict: true });
  }
  applyPragmas(db);
  // On a copy every migration is already recorded, so this is a no-op —
  // and a list that grew since the copy was taken still runs what is new.
  migrate(db, migrations);
  if (fresh && image === undefined) migratedEmpty.set(migrations, db.serialize());
  return db;
}
/**
 * The empty database each migration list makes, kept by this process after
 * it makes it once: a fresh database after the first is a copy of it, not
 * ninety-odd migrations again. A forge opens one fresh database in its life,
 * so this is the test suite's saving — about 90 ms of every `createApp` — and
 * production never reads a copy. Keyed by the list itself, so a test's own
 * list is never confused with the schema. An empty database is the same
 * bytes however it was made: the migrations that draw randomness only
 * rewrite rows an empty database does not have.
 */
const migratedEmpty = new WeakMap<readonly string[], Uint8Array>();
/**
 * The image with its header saying "rollback journal" (bytes 18 and 19 of a
 * SQLite file are the read and write versions: 2 is WAL, 1 legacy), which
 * an in-memory database needs — memory has no write-ahead log to open.
 */
function rollbackJournal(image: Uint8Array): Uint8Array {
  const copy = image.slice();
  copy[18] = 1;
  copy[19] = 1;
  return copy;
}
/**
 * The pragmas, in one place and applied before anything else touches the
 * handle. `journal_mode` and `foreign_keys` are correctness; the rest are
@@ -0,0 +1,281 @@
/**
 * Adversarial coverage for apps (docs/APPS.md), through a live apps
 * runtime: the private-preview grant and the proxy. Split from apps-
 * adversarial.test.ts so no one file sets the gate's floor (#2038); each
 * file of the split boots its own forge and runtime.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { AppsRuntime } from "../src/apps/runtime.ts";
import { parseAppHost, signGrant, verifyGrant } from "../src/apps/proxy.ts";
import { newApp, updateAppSettings } from "../src/actions/apps.ts";
import { listRuns, type Run } from "../src/core/runs.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
const DOMAIN = "apps.test";
describe("apps adversarial: grants and the proxy", () => {
  let dataDir: string;
  let work: string;
  let app: App;
  let servers: Servers;
  let runtime: AppsRuntime;
  let alice: User;
  const viaHost = (host: string, path = "/", init: RequestInit = {}) =>
    fetch(`${servers.url}${path}`, {
      ...init,
      headers: { ...(init.headers as Record<string, string>), host },
      redirect: "manual",
    });
  async function settled(
    repoId: string,
    where: (run: Run) => boolean,
    timeoutMs = 60_000,
  ): Promise<Run> {
    const deadline = Date.now() + timeoutMs;
    while (Date.now() < deadline) {
      const run = listRuns(app.db, repoId, { kind: "deploy", limit: 50 }).find(
        where,
      );
      if (
        run &&
        (run.state === "ok" ||
          run.state === "failed" ||
          run.state === "cancelled")
      )
        return run;
      await Bun.sleep(50);
    }
    throw new Error("run did not settle in time");
  }
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-adv-"));
    work = await mkdtemp(join(tmpdir(), "forge-adv-work-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    runtime = new AppsRuntime(app, {
      domain: DOMAIN,
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 2,
    });
    await runtime.start();
    const created = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!created.ok) throw new Error(created.error);
    alice = created.value;
  }, 30_000);
  afterAll(async () => {
    await runtime.stop();
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
    await rm(work, { recursive: true, force: true });
  });
  test("private grant: forged, tampered, expired, wrong-env, and open-redirect are all refused; cookie is HttpOnly/SameSite", async () => {
    const made = await newApp(app, alice, {
      name: "grants",
      visibility: "private",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    const record = made.value.app;
    await settled(repo.id, (r) => r.env === "production");
    const target = { app: record, env: "production" as const };
    const good = signGrant(dataDir, target, 60_000);
    expect(verifyGrant(dataDir, good, target)).toBe(true);
    // Wrong environment: a grant for production names none for a preview.
    expect(verifyGrant(dataDir, good, { app: record, env: "pull-1" })).toBe(
      false,
    );
    // Expired: signed in the past with a short ttl.
    const expired = signGrant(dataDir, target, 1_000, Date.now() - 10_000);
    expect(verifyGrant(dataDir, expired, target)).toBe(false);
    // Tampered signature: the payload is untouched, but the MAC no longer
    // matches it — this is the actual HMAC check, not just a field mismatch.
    const parts = good.split(".");
    const payload = parts.slice(0, -1).join(".");
    const sig = parts.at(-1)!;
    const flipped = sig.at(-1) === "A" ? "B" : "A";
    const tampered = `${payload}.${sig.slice(0, -1)}${flipped}`;
    expect(verifyGrant(dataDir, tampered, target)).toBe(false);
    // Tampered payload: flip a character in the app id segment — the
    // signature is now for a different message entirely.
    const idTampered = `x${payload.slice(1)}.${sig}`;
    expect(verifyGrant(dataDir, idTampered, target)).toBe(false);
    // Forged: right shape, made-up signature.
    const forged = `${record.id}.production.${Date.now() + 60_000}.notarealsignature`;
    expect(verifyGrant(dataDir, forged, target)).toBe(false);
    // Hitting the grant endpoint on a *public* app: it still answers (it
    // is not access-gated by itself), but the token must still verify
    // correctly against that public app's own target.
    const publicMade = await newApp(app, alice, {
      name: "grantpublic",
      visibility: "public",
    });
    expect(publicMade.ok).toBe(true);
    if (publicMade.ok) {
      await settled(publicMade.value.repo.id, (r) => r.env === "production");
      const pubGrantUrl = `http://grantpublic.${DOMAIN}/__forge/grant?t=${encodeURIComponent(good)}&to=/`;
      // A production-app grant token does not verify for a different app's
      // target, so this must be refused (404) even though the destination
      // app is public.
      const url = new URL(pubGrantUrl);
      const crossApp = await viaHost(url.host, `${url.pathname}${url.search}`);
      expect(crossApp.status).toBe(404);
    }
    // Open redirect: `to=//evil` and `to=http://evil` must both collapse to `/`.
    const okToken = signGrant(dataDir, target, 60_000);
    for (const to of [
      "//evil.example",
      "http://evil.example",
      "https://evil.example/x",
    ]) {
      const resp = await viaHost(
        `grants.${DOMAIN}`,
        `/__forge/grant?t=${encodeURIComponent(okToken)}&to=${encodeURIComponent(to)}`,
      );
      expect(resp.status).toBe(303);
      expect(resp.headers.get("location")).toBe("/");
    }
    // The cookie itself: HttpOnly and SameSite=Lax.
    const grantResp = await viaHost(
      `grants.${DOMAIN}`,
      `/__forge/grant?t=${encodeURIComponent(okToken)}&to=/`,
    );
    const cookie = grantResp.headers.get("set-cookie") ?? "";
    expect(cookie.toLowerCase()).toContain("httponly");
    expect(cookie).toContain("SameSite=Lax");
    // Invariant 9: a private *repository* never distinguishes "you're
    // anonymous" from "you're signed in but still can't see it" — both
    // must read `not_found`, or an anonymous prober could tell the two
    // apart and learn something about a repo they cannot see.
    const strangerCreated = await createUser(app.db, { trusted: true,
      username: "stranger",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    expect(strangerCreated.ok).toBe(true);
    if (!strangerCreated.ok) return;
    const { openEnvUrl } = await import("../src/actions/apps.ts");
    const anonOnPrivateRepo = openEnvUrl(app, undefined, repo, "production");
    expect(anonOnPrivateRepo.ok).toBe(false);
    if (!anonOnPrivateRepo.ok)
      expect(anonOnPrivateRepo.error).toBe("not_found");
    const strangerOnPrivateRepo = openEnvUrl(
      app,
      strangerCreated.value,
      repo,
      "production",
    );
    expect(strangerOnPrivateRepo.ok).toBe(false);
    if (!strangerOnPrivateRepo.ok)
      expect(strangerOnPrivateRepo.error).toBe("not_found");
    // `unauthorized` is reachable only through the other combination: a
    // *public* repository (so `canRead` already passes for anyone) whose
    // app access is explicitly overridden to "private". There, an
    // anonymous visitor has nothing to be vouched with, and a signed-in
    // stranger who can read the public code is still not let in: a private
    // app answers to its writers and crew only (#620).
    const overrideMade = await newApp(app, alice, {
      name: "publicwithprivateapp",
      visibility: "public",
    });
    expect(overrideMade.ok).toBe(true);
    if (!overrideMade.ok) return;
    await settled(overrideMade.value.repo.id, (r) => r.env === "production");
    updateAppSettings(app, alice, overrideMade.value.repo, {
      access: "private",
    });
    const anonOnPublicRepo = openEnvUrl(
      app,
      undefined,
      overrideMade.value.repo,
      "production",
    );
    expect(anonOnPublicRepo.ok).toBe(false);
    if (!anonOnPublicRepo.ok)
      expect(anonOnPublicRepo.error).toBe("unauthorized");
    const strangerOnPublicRepo = openEnvUrl(
      app,
      strangerCreated.value,
      overrideMade.value.repo,
      "production",
    );
    expect(strangerOnPublicRepo.ok).toBe(false);
    if (!strangerOnPublicRepo.ok)
      expect(strangerOnPublicRepo.error).toBe("not_found");
  }, 60_000);
  test("the proxy: hop-by-hop headers are stripped, an upstream that dies mid-request yields a clean error, a claimed upgrade is a request", async () => {
    const made = await newApp(app, alice, {
      name: "proxytest",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    await settled(repo.id, (r) => r.env === "production");
    const page = await viaHost(`proxytest.${DOMAIN}`);
    expect(page.status).toBe(200);
    // Hop-by-hop response headers never reach the client from the proxy
    // path (the app itself doesn't set them, but the proxy must strip them
    // if it ever did — assert the contract on the response we did get).
    for (const h of ["connection", "transfer-encoding", "keep-alive"]) {
      expect(page.headers.has(h)).toBe(false);
    }
    // The slug is case-insensitive end to end, through the database too —
    // not just in `parseAppHost`'s own lowercasing.
    const upperCase = await viaHost(`PROXYTEST.${DOMAIN}`);
    expect(upperCase.status).toBe(200);
    expect(await upperCase.text()).toBe(await page.text());
    // A request that says `Upgrade: websocket` without a handshake key is
    // not a handshake: it is fetched as a request, the hop-by-hop headers
    // stripped, and the app answers it as one. Real sockets are
    // test/apps-ws.test.ts.
    const ws = await viaHost(`proxytest.${DOMAIN}`, "/", {
      headers: { upgrade: "websocket", connection: "Upgrade" },
    });
    expect(ws.status).toBe(200);
    // Stop the live process out from under the proxy (simulating a crash
    // mid-request) and confirm the *next* request gets the forge's own
    // "not running" page, never a raw connection-refused/502 from Bun.
    const { stopEnv } = await import("../src/actions/apps.ts");
    await stopEnv(app, alice, repo, "production");
    const afterStop = await viaHost(`proxytest.${DOMAIN}`);
    expect(afterStop.status).toBe(502);
    expect(await afterStop.text()).toContain("not running");
  }, 60_000);
});
@@ -0,0 +1,557 @@
/**
 * Adversarial coverage for apps (docs/APPS.md), through a live apps
 * runtime: environment names, preview data, and rules 1 and 4. Split from
 * apps-adversarial.test.ts so no one file sets the gate's floor (#2038);
 * each file of the split boots its own forge and runtime.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { AppsRuntime } from "../src/apps/runtime.ts";
import { newApp, updateAppSettings } from "../src/actions/apps.ts";
import { addToCrew, createAgent } from "../src/actions/crew.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import {
  commitToBranch,
  createRepo,
  forkRepo,
  updateRepoSettings,
} from "../src/actions/repos.ts";
import { getPull } from "../src/core/pulls.ts";
import { getRepoById } from "../src/core/repos.ts";
import { resolveOid } from "../src/git/merge.ts";
import { repoDir } from "../src/git/repos.ts";
import {
  cancelRun,
  claimRun,
  createRun,
  finishRun,
  listRuns,
  type Run,
} from "../src/core/runs.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { grantedCookie } from "./helpers/identity.ts";
import { gitClientEnv } from "./helpers/git-client.ts";
const DOMAIN = "apps.test";
const clientEnv = gitClientEnv({
  GIT_AUTHOR_NAME: "Agent",
  GIT_AUTHOR_EMAIL: "[email protected]",
  GIT_COMMITTER_NAME: "Agent",
  GIT_COMMITTER_EMAIL: "[email protected]",
});
async function sh(args: string[], cwd: string) {
  const proc = Bun.spawn(args, {
    cwd,
    env: clientEnv,
    stdout: "pipe",
    stderr: "pipe",
  });
  const [out, err, code] = await Promise.all([
    new Response(proc.stdout).text(),
    new Response(proc.stderr).text(),
    proc.exited,
  ]);
  return { code, out: out.trim(), err: err.trim() };
}
describe("apps adversarial: env names, preview data, and rules 1/4", () => {
  let dataDir: string;
  let work: string;
  let app: App;
  let servers: Servers;
  let runtime: AppsRuntime;
  let alice: User;
  const viaHost = (host: string, path = "/", init: RequestInit = {}) =>
    fetch(`${servers.url}${path}`, {
      ...init,
      headers: { ...(init.headers as Record<string, string>), host },
      redirect: "manual",
    });
  async function settled(
    repoId: string,
    where: (run: Run) => boolean,
    timeoutMs = 60_000,
  ): Promise<Run> {
    const deadline = Date.now() + timeoutMs;
    while (Date.now() < deadline) {
      const run = listRuns(app.db, repoId, { kind: "deploy", limit: 50 }).find(
        where,
      );
      if (
        run &&
        (run.state === "ok" ||
          run.state === "failed" ||
          run.state === "cancelled")
      )
        return run;
      await Bun.sleep(50);
    }
    throw new Error("run did not settle in time");
  }
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-adv-"));
    work = await mkdtemp(join(tmpdir(), "forge-adv-work-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    runtime = new AppsRuntime(app, {
      domain: DOMAIN,
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 2,
    });
    await runtime.start();
    const created = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!created.ok) throw new Error(created.error);
    alice = created.value;
  }, 30_000);
  afterAll(async () => {
    await runtime.stop();
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
    await rm(work, { recursive: true, force: true });
  });
  test("the API never lets an env parameter shaped like a path reach the filesystem", async () => {
    const made = await newApp(app, alice, {
      name: "envtraversal",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    await settled(made.value.repo.id, (r) => r.env === "production");
    const adminToken = createToken(
      app.db,
      alice.id,
      "traversal-test",
      "admin",
    ).token;
    const api = (path: string, init: RequestInit = {}) =>
      fetch(`${servers.url}${path}`, {
        ...init,
        headers: { authorization: `Bearer ${adminToken}` },
      });
    const owner = made.value.repo.ownerName;
    const name = made.value.repo.name;
    // A bare ".." segment is collapsed by `URL`/`fetch` before the request
    // ever leaves the client (RFC 3986 dot-segment removal), so it can only
    // be used to probe the *server's* handling when percent-encoded — a raw
    // ".." never reaches the router at all, which is the stronger property
    // and not what this test is isolating.
    for (const hostile of [
      "..%2F..%2F..%2Fetc",
      "production%2F..%2F..",
      "pull--1",
    ]) {
      const redeploy = await api(
        `/api/v1/repos/${owner}/${name}/app/${hostile}/redeploy`,
        { method: "POST" },
      );
      if (redeploy.status !== 422) {
        throw new Error(
          `redeploy env=${hostile} returned ${redeploy.status}, expected 422`,
        );
      }
      const body = (await redeploy.json()) as { error: string };
      expect(body.error).toBe("no_such_env");
      const stop = await api(
        `/api/v1/repos/${owner}/${name}/app/${hostile}/stop`,
        { method: "POST" },
      );
      if (stop.status !== 422) {
        throw new Error(
          `stop env=${hostile} returned ${stop.status}, expected 422`,
        );
      }
      const open = await api(
        `/api/v1/repos/${owner}/${name}/app/${hostile}/open`,
      );
      expect(open.status).toBe(422);
    }
  }, 60_000);
  test('preview_data: "empty" starts a preview with no copy of production\'s data', async () => {
    const made = await newApp(app, alice, {
      name: "emptypolicy",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    await settled(repo.id, (r) => r.env === "production");
    updateAppSettings(app, alice, repo, { previewData: "empty" });
    const form = new FormData();
    form.set("body", "production-only note");
    await viaHost(`emptypolicy.${DOMAIN}`, "/notes", {
      method: "POST",
      body: form,
      headers: {
        cookie: await grantedCookie(app, servers.url, alice, made.value.app),
      },
    });
    expect(await (await viaHost(`emptypolicy.${DOMAIN}`)).text()).toContain(
      "production-only note",
    );
    const committed = await commitToBranch(app, alice, repo, {
      branch: "empty-preview",
      base: repo.defaultBranch,
      message: "trigger a preview",
      files: [{ path: "EMPTY.md", content: "hi\n" }],
    });
    expect(committed.ok).toBe(true);
    const opened = await openPull(app, alice, repo, {
      title: "Empty preview",
      baseBranch: repo.defaultBranch,
      headBranch: "empty-preview",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    await settled(repo.id, (r) => r.env === `pull-${opened.value.number}`);
    const previewHtml = await (
      await viaHost(`emptypolicy--${opened.value.number}.${DOMAIN}`)
    ).text();
    expect(previewHtml).not.toContain("production-only note");
  }, 60_000);
  test("rule 1: the repository takes no push from the crew; the agent's fork takes branches but never its default branch, protected or not, renamed or not", async () => {
    const madeRepo = await createRepo(app, alice, { name: "rule1-repo" });
    expect(madeRepo.ok).toBe(true);
    if (!madeRepo.ok) return;
    const repo = madeRepo.value;
    await commitToBranch(app, alice, repo, {
      message: "seed",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    const madeAgent = await createAgent(app, alice, {
      username: "rule1bot",
      model: "",
      brief: "",
    });
    expect(madeAgent.ok).toBe(true);
    if (!madeAgent.ok) return;
    const bot = madeAgent.value.user;
    addToCrew(app, alice, repo, "rule1bot");
    const token = createToken(app.db, bot.id, "t", "rw");
    const remote = `${servers.url.replace("://", `://rule1bot:${token.token}@`)}/${repo.ownerName}/${repo.name}.git`;
    const clone = join(work, "rule1-clone");
    expect(
      (await sh(["git", "clone", "--quiet", remote, clone], work)).code,
    ).toBe(0);
    await Bun.write(join(clone, "A.md"), "a\n");
    await sh(["git", "add", "A.md"], clone);
    await sh(["git", "commit", "-qm", "a"], clone);
    // The repository itself: crew membership is read. Neither the default
    // branch nor any other takes a push, and the refusal hides nothing it
    // would not hide from any non-writer.
    const toDefault = await sh(
      ["git", "push", "-q", "origin", `HEAD:${repo.defaultBranch}`],
      clone,
    );
    expect(toDefault.code).not.toBe(0);
    const toOther = await sh(
      ["git", "push", "-q", "origin", "HEAD:refs/heads/some-branch"],
      clone,
    );
    expect(toOther.code).not.toBe(0);
    expect(
      await resolveOid(
        repoDir(app.reposRoot, repo.ownerName, repo.name),
        "refs/heads/some-branch",
      ),
    ).toBeUndefined();
    // The agent's fork takes its branches…
    const forked = await forkRepo(app, bot, repo);
    expect(forked.ok).toBe(true);
    if (!forked.ok) return;
    let fork = forked.value;
    const forkRemote = `${servers.url.replace("://", `://rule1bot:${token.token}@`)}/${fork.ownerName}/${fork.name}.git`;
    const otherOk = await sh(
      ["git", "push", "-q", forkRemote, "HEAD:refs/heads/some-branch"],
      clone,
    );
    expect(otherOk.code).toBe(0);
    // …but never its default branch: rule 1 is unconditional, protectDefault
    // off or on — an agent can't even fast-forward it.
    const refusedOff = await sh(
      ["git", "push", "-q", forkRemote, `HEAD:${fork.defaultBranch}`],
      clone,
    );
    expect(refusedOff.code).not.toBe(0);
    expect(refusedOff.err).toContain("agents propose through pulls");
    await updateRepoSettings(app, alice, fork, { protectDefault: true });
    const refusedOn = await sh(
      ["git", "push", "-q", forkRemote, `HEAD:${fork.defaultBranch}`],
      clone,
    );
    expect(refusedOn.code).not.toBe(0);
    expect(refusedOn.err).toContain("agents propose through pulls");
    // Rename the fork's default branch, then confirm a push to the NEW name
    // is still refused (the hook must read the live default branch, not a
    // cached name).
    await sh(["git", "checkout", "-q", "-b", "renamed-main"], clone);
    await sh(["git", "push", "-q", forkRemote, "renamed-main"], clone);
    const renamed = await updateRepoSettings(app, alice, fork, {
      defaultBranch: "renamed-main",
    });
    expect(renamed.ok).toBe(true);
    fork = getRepoById(app.db, fork.id)!;
    expect(fork.defaultBranch).toBe("renamed-main");
    await Bun.write(join(clone, "B.md"), "b\n");
    await sh(["git", "add", "B.md"], clone);
    await sh(["git", "commit", "-qm", "b"], clone);
    const refusedRenamed = await sh(
      ["git", "push", "-q", forkRemote, "HEAD:renamed-main"],
      clone,
    );
    expect(refusedRenamed.code).not.toBe(0);
    expect(refusedRenamed.err).toContain("agents propose through pulls");
  }, 60_000);
  test("rule 1: an agent's rw token cannot reach settings, app enable, crew, tokens, or agent creation over the API", async () => {
    const madeRepo = await createRepo(app, alice, { name: "rule1-api-repo" });
    expect(madeRepo.ok).toBe(true);
    if (!madeRepo.ok) return;
    const repo = madeRepo.value;
    await commitToBranch(app, alice, repo, {
      message: "seed",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    const madeAgent = await createAgent(app, alice, {
      username: "rule1apibot",
      model: "",
      brief: "",
    });
    expect(madeAgent.ok).toBe(true);
    if (!madeAgent.ok) return;
    addToCrew(app, alice, repo, "rule1apibot");
    const bot = madeAgent.value.user;
    const token = createToken(app.db, bot.id, "t", "rw").token;
    const api = (path: string, init: RequestInit = {}) =>
      fetch(`${servers.url}${path}`, {
        ...init,
        headers: {
          ...(init.headers as Record<string, string>),
          authorization: `Bearer ${token}`,
          "content-type": "application/json",
        },
      });
    const settingsResp = await api(
      `/api/v1/repos/${repo.ownerName}/${repo.name}`,
      { method: "PATCH", body: JSON.stringify({ visibility: "public" }) },
    );
    expect(settingsResp.status).toBe(403);
    const enableResp = await api(
      `/api/v1/repos/${repo.ownerName}/${repo.name}/app`,
      { method: "POST", body: JSON.stringify({}) },
    );
    expect(enableResp.status).toBe(403);
    const crewResp = await api(
      `/api/v1/repos/${repo.ownerName}/${repo.name}/crew/rule1apibot`,
      { method: "PUT" },
    );
    expect(crewResp.status).toBe(403);
    const tokenResp = await api("/api/v1/tokens", {
      method: "POST",
      body: JSON.stringify({ adminConfirm: true, name: "x", scope: "admin" }),
    });
    // Neither via-session nor via-password: falls through to bad credentials.
    expect(tokenResp.status).toBe(401);
    const agentResp = await api("/api/v1/agents", {
      method: "POST",
      body: JSON.stringify({ username: "another-bot" }),
    });
    expect(agentResp.status).toBe(403);
  }, 30_000);
  test("rule 4: require_checks cannot be satisfied by a stale head, a foreign pull's run, a cancelled run, or a queued one; a push re-locks it", async () => {
    const madeRepo = await createRepo(app, alice, { name: "rule4-repo" });
    expect(madeRepo.ok).toBe(true);
    if (!madeRepo.ok) return;
    let repo = madeRepo.value;
    await commitToBranch(app, alice, repo, {
      message: "seed",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    repo = (await updateRepoSettings(app, alice, repo, { requireChecks: true }))
      .ok
      ? getRepoById(app.db, repo.id)!
      : repo;
    const committed1 = await commitToBranch(app, alice, repo, {
      branch: "feature",
      base: repo.defaultBranch,
      message: "feature commit 1",
      files: [{ path: "F.md", content: "1\n" }],
    });
    expect(committed1.ok).toBe(true);
    if (!committed1.ok) return;
    const oid1 = committed1.value.commitOid;
    const opened = await openPull(app, alice, repo, {
      title: "Feature",
      baseBranch: repo.defaultBranch,
      headBranch: "feature",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    const pull = opened.value;
    // A second branch, pointing at the exact same commit, opened as a
    // second pull — so a run tagged with its issue id shares the commit
    // oid but must never satisfy the first pull's gate.
    await sh(
      ["git", "branch", "feature2", oid1],
      repoDir(app.reposRoot, repo.ownerName, repo.name),
    );
    const opened2 = await openPull(app, alice, repo, {
      title: "Feature 2",
      baseBranch: repo.defaultBranch,
      headBranch: "feature2",
    });
    expect(opened2.ok).toBe(true);
    if (!opened2.ok) return;
    const mkRun = (issueId: string, oid: string) =>
      createRun(app.db, {
        repoId: repo.id,
        kind: "deploy",
        issueId,
        commitOid: oid,
        env: "pull-x",
        reason: "push",
      });
    // Queued: never satisfies.
    mkRun(pull.id, oid1);
    let refused = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(refused.ok).toBe(false);
    if (!refused.ok) expect(refused.error).toBe("checks_required");
    // Cancelled: never satisfies.
    const toCancel = mkRun(pull.id, oid1);
    cancelRun(app.db, toCancel.id, "test cancel");
    refused = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(refused.ok).toBe(false);
    if (!refused.ok) expect(refused.error).toBe("checks_required");
    // A green run for a DIFFERENT pull at the same commit: never satisfies
    // pull 1.
    const foreignRun = mkRun(opened2.value.id, oid1);
    claimRun(app.db, foreignRun.id);
    finishRun(app.db, foreignRun.id, { state: "ok", summary: "green" });
    refused = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(refused.ok).toBe(false);
    if (!refused.ok) expect(refused.error).toBe("checks_required");
    // Now a genuinely green run for pull 1 at its actual head: merge works.
    const goodRun = mkRun(pull.id, oid1);
    claimRun(app.db, goodRun.id);
    finishRun(app.db, goodRun.id, { state: "ok", summary: "green" });
    const merged = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(merged.ok).toBe(true);
  }, 60_000);
  test("rule 4: a push after a green check re-locks the pull until the new head is green", async () => {
    const madeRepo = await createRepo(app, alice, { name: "rule4-relock" });
    expect(madeRepo.ok).toBe(true);
    if (!madeRepo.ok) return;
    let repo = madeRepo.value;
    await commitToBranch(app, alice, repo, {
      message: "seed",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    repo = (await updateRepoSettings(app, alice, repo, { requireChecks: true }))
      .ok
      ? getRepoById(app.db, repo.id)!
      : repo;
    const c1 = await commitToBranch(app, alice, repo, {
      branch: "relock",
      base: repo.defaultBranch,
      message: "c1",
      files: [{ path: "R.md", content: "1\n" }],
    });
    if (!c1.ok) throw new Error("setup failed");
    const opened = await openPull(app, alice, repo, {
      title: "Relock",
      baseBranch: repo.defaultBranch,
      headBranch: "relock",
    });
    if (!opened.ok) throw new Error("setup failed");
    const pull = opened.value;
    const green1 = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      issueId: pull.id,
      commitOid: c1.value.commitOid,
      env: "pull-x",
      reason: "push",
    });
    claimRun(app.db, green1.id);
    finishRun(app.db, green1.id, { state: "ok", summary: "green" });
    expect(
      (
        await mergePull(
          app,
          alice,
          repo,
          getPull(app.db, repo.id, pull.number)!,
          "merge",
        )
      ).ok,
    ).toBe(true);
  }, 30_000);
});
@@ -0,0 +1,219 @@
/**
 * Adversarial coverage for apps (docs/APPS.md), through a live apps
 * runtime: closing a preview or a pull while it is live or mid-deploy.
 * Split from apps-adversarial.test.ts so no one file sets the gate's floor
 * (#2038); each file of the split boots its own forge and runtime.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { existsSync } from "node:fs";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { AppsRuntime } from "../src/apps/runtime.ts";
import { envDir } from "../src/apps/data.ts";
import { newApp } from "../src/actions/apps.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import { commitToBranch } from "../src/actions/repos.ts";
import { getPull } from "../src/core/pulls.ts";
import { listRuns, type Run } from "../src/core/runs.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
const DOMAIN = "apps.test";
describe("apps adversarial: teardown races", () => {
  let dataDir: string;
  let work: string;
  let app: App;
  let servers: Servers;
  let runtime: AppsRuntime;
  let alice: User;
  const viaHost = (host: string, path = "/", init: RequestInit = {}) =>
    fetch(`${servers.url}${path}`, {
      ...init,
      headers: { ...(init.headers as Record<string, string>), host },
      redirect: "manual",
    });
  async function settled(
    repoId: string,
    where: (run: Run) => boolean,
    timeoutMs = 60_000,
  ): Promise<Run> {
    const deadline = Date.now() + timeoutMs;
    while (Date.now() < deadline) {
      const run = listRuns(app.db, repoId, { kind: "deploy", limit: 50 }).find(
        where,
      );
      if (
        run &&
        (run.state === "ok" ||
          run.state === "failed" ||
          run.state === "cancelled")
      )
        return run;
      await Bun.sleep(50);
    }
    throw new Error("run did not settle in time");
  }
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-adv-"));
    work = await mkdtemp(join(tmpdir(), "forge-adv-work-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    runtime = new AppsRuntime(app, {
      domain: DOMAIN,
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 2,
    });
    await runtime.start();
    const created = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!created.ok) throw new Error(created.error);
    alice = created.value;
  }, 30_000);
  afterAll(async () => {
    await runtime.stop();
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
    await rm(work, { recursive: true, force: true });
  });
  test("closing an already-live preview does not resurrect it a few seconds later", async () => {
    const made = await newApp(app, alice, {
      name: "resurrect",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    const record = made.value.app;
    await settled(repo.id, (r) => r.env === "production");
    const committed = await commitToBranch(app, alice, repo, {
      branch: "preview-branch",
      base: repo.defaultBranch,
      message: "preview change",
      files: [{ path: "PREVIEW.md", content: "hi\n" }],
    });
    expect(committed.ok).toBe(true);
    const opened = await openPull(app, alice, repo, {
      title: "Preview",
      baseBranch: repo.defaultBranch,
      headBranch: "preview-branch",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    const pull = opened.value;
    // Wait for the preview to actually come up (live, not just queued).
    await settled(repo.id, (r) => r.env === `pull-${pull.number}`);
    expect((await viaHost(`resurrect--${pull.number}.${DOMAIN}`)).status).toBe(
      200,
    );
    const closed = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(closed.ok).toBe(true);
    // The teardown itself must remove the directory promptly.
    const goneDeadline = Date.now() + 10_000;
    while (
      existsSync(envDir(dataDir, record.id, `pull-${pull.number}`)) &&
      Date.now() < goneDeadline
    )
      await Bun.sleep(50);
    expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
      false,
    );
    // The bug: `watch()`'s exit handler mistook the deliberate stop for a
    // crash and scheduled a restart ~2s later (RESTART_BACKOFF_MS[0]). Wait
    // well past that window and confirm nothing came back — no directory,
    // no live process answering the preview's host, no new "restart" run.
    await Bun.sleep(3_500);
    expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
      false,
    );
    const stillGone = await viaHost(`resurrect--${pull.number}.${DOMAIN}`);
    expect(stillGone.status).toBe(404);
    expect(await stillGone.text()).toContain("is gone");
    const resurrectionRuns = listRuns(app.db, repo.id, {
      env: `pull-${pull.number}`,
    }).filter((r) => r.reason === "restart");
    expect(resurrectionRuns.length).toBe(0);
  }, 60_000);
  test("closing a pull mid-deploy still leaves no directory and no process", async () => {
    const made = await newApp(app, alice, {
      name: "midclose",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    const record = made.value.app;
    await settled(repo.id, (r) => r.env === "production");
    const committed = await commitToBranch(app, alice, repo, {
      branch: "slow-branch",
      base: repo.defaultBranch,
      message: "a change",
      files: [{ path: "SLOW.md", content: "hi\n" }],
    });
    expect(committed.ok).toBe(true);
    const opened = await openPull(app, alice, repo, {
      title: "Slow",
      baseBranch: repo.defaultBranch,
      headBranch: "slow-branch",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    const pull = opened.value;
    // Close it immediately — almost certainly while the deploy is still
    // installing/testing/starting, never having reached `live`.
    const closedQuickly = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(closedQuickly.ok).toBe(true);
    const deadline = Date.now() + 15_000;
    while (
      existsSync(envDir(dataDir, record.id, `pull-${pull.number}`)) &&
      Date.now() < deadline
    )
      await Bun.sleep(50);
    expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
      false,
    );
    await Bun.sleep(3_500);
    expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
      false,
    );
    expect((await viaHost(`midclose--${pull.number}.${DOMAIN}`)).status).toBe(
      404,
    );
  }, 60_000);
});
@@ -0,0 +1,230 @@
/**
 * Adversarial coverage for apps (docs/APPS.md), through a live apps
 * runtime: what a failing install and a closed pull's test step leave
 * behind. Split from apps-adversarial.test.ts so no one file sets the
 * gate's floor (#2038); each file of the split boots its own forge and
 * runtime.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { existsSync } from "node:fs";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { AppsRuntime } from "../src/apps/runtime.ts";
import { newApp } from "../src/actions/apps.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import { commitToBranch } from "../src/actions/repos.ts";
import { getPull } from "../src/core/pulls.ts";
import { listRuns, type Run } from "../src/core/runs.ts";
import { createUser, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
const DOMAIN = "apps.test";
describe("apps adversarial: the install and test steps", () => {
  let dataDir: string;
  let work: string;
  let app: App;
  let servers: Servers;
  let runtime: AppsRuntime;
  let alice: User;
  const viaHost = (host: string, path = "/", init: RequestInit = {}) =>
    fetch(`${servers.url}${path}`, {
      ...init,
      headers: { ...(init.headers as Record<string, string>), host },
      redirect: "manual",
    });
  async function settled(
    repoId: string,
    where: (run: Run) => boolean,
    timeoutMs = 60_000,
  ): Promise<Run> {
    const deadline = Date.now() + timeoutMs;
    while (Date.now() < deadline) {
      const run = listRuns(app.db, repoId, { kind: "deploy", limit: 50 }).find(
        where,
      );
      if (
        run &&
        (run.state === "ok" ||
          run.state === "failed" ||
          run.state === "cancelled")
      )
        return run;
      await Bun.sleep(50);
    }
    throw new Error("run did not settle in time");
  }
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-adv-"));
    work = await mkdtemp(join(tmpdir(), "forge-adv-work-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    runtime = new AppsRuntime(app, {
      domain: DOMAIN,
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 2,
    });
    await runtime.start();
    const created = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!created.ok) throw new Error(created.error);
    alice = created.value;
  }, 30_000);
  afterAll(async () => {
    await runtime.stop();
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
    await rm(work, { recursive: true, force: true });
  });
  test("install failing fails before test or start ever run — nothing from a half-installed tree", async () => {
    const made = await newApp(app, alice, {
      name: "badinstall",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    await settled(repo.id, (r) => r.env === "production");
    const testMarker = join(work, `install-test-marker-${Date.now()}`);
    const runMarker = join(work, `install-run-marker-${Date.now()}`);
    const committed = await commitToBranch(app, alice, repo, {
      branch: "bad-install",
      base: repo.defaultBranch,
      message: "install fails",
      files: [
        {
          path: "forge.json",
          content: `${JSON.stringify(
            {
              app: {
                install: "exit 1",
                run: `touch ${runMarker} && bun run src/server.ts`,
                test: `touch ${testMarker} && bun test`,
              },
            },
            null,
            2,
          )}\n`,
        },
      ],
    });
    expect(committed.ok).toBe(true);
    if (!committed.ok) return;
    const opened = await openPull(app, alice, repo, {
      title: "Bad install",
      baseBranch: repo.defaultBranch,
      headBranch: "bad-install",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    const failed = await settled(
      repo.id,
      (r) =>
        r.env === `pull-${opened.value.number}` &&
        r.commitOid === committed.value.commitOid,
    );
    expect(failed.state).toBe("failed");
    expect(failed.summary).toContain("install");
    // Neither `test` nor `run` ever executed.
    expect(existsSync(testMarker)).toBe(false);
    expect(existsSync(runMarker)).toBe(false);
    expect(
      (await viaHost(`badinstall--${opened.value.number}.${DOMAIN}`)).status,
    ).toBe(502);
  }, 60_000);
  test("closing a pull whose deploy already answered kills its still-running test step — no orphan `bun test`", async () => {
    const made = await newApp(app, alice, {
      name: "slowtest",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    await settled(repo.id, (r) => r.env === "production");
    // A merge lands this same forge.json on the default branch and
    // production redeploys it too, running this same test step to
    // completion (nothing aborts a deploy that was never in flight when the
    // pull closed) — a marker keyed by $FORGE_APP_ENV keeps that legitimate
    // production run from being mistaken for the preview's orphan.
    const marker = join(work, `slowtest-marker-${Date.now()}`);
    const committed = await commitToBranch(app, alice, repo, {
      branch: "slow-test",
      base: repo.defaultBranch,
      message: "slow test",
      files: [
        {
          path: "forge.json",
          content: `${JSON.stringify(
            {
              app: {
                run: "bun run src/server.ts",
                test: `sleep 5 && touch ${marker}-$FORGE_APP_ENV`,
              },
            },
            null,
            2,
          )}\n`,
        },
      ],
    });
    expect(committed.ok).toBe(true);
    if (!committed.ok) return;
    const opened = await openPull(app, alice, repo, {
      title: "Slow test",
      baseBranch: repo.defaultBranch,
      headBranch: "slow-test",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    // Wait for the app to answer — well before the test step's sleep ends.
    const upDeadline = Date.now() + 10_000;
    let up = false;
    while (Date.now() < upDeadline) {
      if (
        (await viaHost(`slowtest--${opened.value.number}.${DOMAIN}`))
          .status === 200
      ) {
        up = true;
        break;
      }
      await Bun.sleep(50);
    }
    expect(up).toBe(true);
    // Close it while the test step is still sleeping.
    const closed = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, opened.value.number)!,
      "merge",
    );
    expect(closed.ok).toBe(true);
    // Wait well past the sleep the test step was doing, and confirm it
    // never finished: the preview's own marker is not there (production's,
    // from its own unrelated redeploy of the same merged commit, may be).
    await Bun.sleep(6_500);
    expect(existsSync(`${marker}-preview`)).toBe(false);
  }, 60_000);
});
@@ -5,6 +5,11 @@
 * the schema. Where the existing suites (apps.test.ts, apps-api.test.ts,
 * crew.test.ts) already drive a rule end to end, this file goes for the
 * edges: stale state, races, forged input, and the boundary of a bound.
 *
 * The teardown races, the grants and the proxy, and rules 1 and 4 driven
 * through a live apps runtime are their own files
 * (apps-adversarial-{teardown,test-step,grants,rules}.test.ts), one
 * runtime each, so no one file sets the gate's floor (#2038).
 */
import {
@@ -22,27 +27,15 @@
import { createApp, type App } from "../src/app.ts";
import { AppsRuntime } from "../src/apps/runtime.ts";
import { cloneDir, envDir, isEnvName, type EnvName } from "../src/apps/data.ts";
import { appEnv, childEnv } from "../src/apps/process.ts";
import {
  parseAppHost,
  resolveAppHost,
  signGrant,
  verifyGrant,
} from "../src/apps/proxy.ts";
import { parseAppHost, resolveAppHost } from "../src/apps/proxy.ts";
import { parseManifest } from "../src/apps/manifest.ts";
import { newApp, updateAppSettings } from "../src/actions/apps.ts";
import { newApp } from "../src/actions/apps.ts";
import { addToCrew, createAgent } from "../src/actions/crew.ts";
import { addComment, assignIssue, openIssue } from "../src/actions/issues.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import {
  commitToBranch,
  createRepo,
  forkRepo,
  updateRepoSettings,
} from "../src/actions/repos.ts";
import { getPull, type Pull } from "../src/core/pulls.ts";
import { getRepoById, type Repo } from "../src/core/repos.ts";
import { resolveOid } from "../src/git/merge.ts";
import { repoDir } from "../src/git/repos.ts";
import { openPull } from "../src/actions/pulls.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import type { Pull } from "../src/core/pulls.ts";
import type { Repo } from "../src/core/repos.ts";
import {
  activeRunFor,
  automaticRunsSince,
@@ -67,14 +60,11 @@
import {
  runLogListenerCount,
  subscribeRunLog,
} from "../src/runs/log.ts";
import { grantedCookie } from "./helpers/identity.ts";
import { gitClientEnv } from "./helpers/git-client.ts";
import { portInsteadOfSocket } from "../src/git/hook-address.ts";
const testBySocket = portInsteadOfSocket() ? test.skip : test;
const DOMAIN = "apps.test";
const clientEnv = gitClientEnv({
  GIT_AUTHOR_NAME: "Agent",
  GIT_AUTHOR_EMAIL: "[email protected]",
@@ -1060,954 +1050,6 @@
describe("migration 14 on an existing database", () => {
// proxy, and the mechanical rules that only show themselves under load.
// ---------------------------------------------------------------------------
describe("apps adversarial: teardown races, grants, the proxy, and rule 1/4", () => {
  let dataDir: string;
  let work: string;
  let app: App;
  let servers: Servers;
  let runtime: AppsRuntime;
  let alice: User;
  const viaHost = (host: string, path = "/", init: RequestInit = {}) =>
    fetch(`${servers.url}${path}`, {
      ...init,
      headers: { ...(init.headers as Record<string, string>), host },
      redirect: "manual",
    });
  async function settled(
    repoId: string,
    where: (run: Run) => boolean,
    timeoutMs = 60_000,
  ): Promise<Run> {
    const deadline = Date.now() + timeoutMs;
    while (Date.now() < deadline) {
      const run = listRuns(app.db, repoId, { kind: "deploy", limit: 50 }).find(
        where,
      );
      if (
        run &&
        (run.state === "ok" ||
          run.state === "failed" ||
          run.state === "cancelled")
      )
        return run;
      await Bun.sleep(50);
    }
    throw new Error("run did not settle in time");
  }
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-adv-"));
    work = await mkdtemp(join(tmpdir(), "forge-adv-work-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    runtime = new AppsRuntime(app, {
      domain: DOMAIN,
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 2,
    });
    await runtime.start();
    const created = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!created.ok) throw new Error(created.error);
    alice = created.value;
  }, 30_000);
  afterAll(async () => {
    await runtime.stop();
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
    await rm(work, { recursive: true, force: true });
  });
  test("closing an already-live preview does not resurrect it a few seconds later", async () => {
    const made = await newApp(app, alice, {
      name: "resurrect",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    const record = made.value.app;
    await settled(repo.id, (r) => r.env === "production");
    const committed = await commitToBranch(app, alice, repo, {
      branch: "preview-branch",
      base: repo.defaultBranch,
      message: "preview change",
      files: [{ path: "PREVIEW.md", content: "hi\n" }],
    });
    expect(committed.ok).toBe(true);
    const opened = await openPull(app, alice, repo, {
      title: "Preview",
      baseBranch: repo.defaultBranch,
      headBranch: "preview-branch",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    const pull = opened.value;
    // Wait for the preview to actually come up (live, not just queued).
    await settled(repo.id, (r) => r.env === `pull-${pull.number}`);
    expect((await viaHost(`resurrect--${pull.number}.${DOMAIN}`)).status).toBe(
      200,
    );
    const closed = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(closed.ok).toBe(true);
    // The teardown itself must remove the directory promptly.
    const goneDeadline = Date.now() + 10_000;
    while (
      existsSync(envDir(dataDir, record.id, `pull-${pull.number}`)) &&
      Date.now() < goneDeadline
    )
      await Bun.sleep(50);
    expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
      false,
    );
    // The bug: `watch()`'s exit handler mistook the deliberate stop for a
    // crash and scheduled a restart ~2s later (RESTART_BACKOFF_MS[0]). Wait
    // well past that window and confirm nothing came back — no directory,
    // no live process answering the preview's host, no new "restart" run.
    await Bun.sleep(3_500);
    expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
      false,
    );
    const stillGone = await viaHost(`resurrect--${pull.number}.${DOMAIN}`);
    expect(stillGone.status).toBe(404);
    expect(await stillGone.text()).toContain("is gone");
    const resurrectionRuns = listRuns(app.db, repo.id, {
      env: `pull-${pull.number}`,
    }).filter((r) => r.reason === "restart");
    expect(resurrectionRuns.length).toBe(0);
  }, 60_000);
  test("closing a pull mid-deploy still leaves no directory and no process", async () => {
    const made = await newApp(app, alice, {
      name: "midclose",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    const record = made.value.app;
    await settled(repo.id, (r) => r.env === "production");
    const committed = await commitToBranch(app, alice, repo, {
      branch: "slow-branch",
      base: repo.defaultBranch,
      message: "a change",
      files: [{ path: "SLOW.md", content: "hi\n" }],
    });
    expect(committed.ok).toBe(true);
    const opened = await openPull(app, alice, repo, {
      title: "Slow",
      baseBranch: repo.defaultBranch,
      headBranch: "slow-branch",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    const pull = opened.value;
    // Close it immediately — almost certainly while the deploy is still
    // installing/testing/starting, never having reached `live`.
    const closedQuickly = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(closedQuickly.ok).toBe(true);
    const deadline = Date.now() + 15_000;
    while (
      existsSync(envDir(dataDir, record.id, `pull-${pull.number}`)) &&
      Date.now() < deadline
    )
      await Bun.sleep(50);
    expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
      false,
    );
    await Bun.sleep(3_500);
    expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
      false,
    );
    expect((await viaHost(`midclose--${pull.number}.${DOMAIN}`)).status).toBe(
      404,
    );
  }, 60_000);
  test("install failing fails before test or start ever run — nothing from a half-installed tree", async () => {
    const made = await newApp(app, alice, {
      name: "badinstall",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    await settled(repo.id, (r) => r.env === "production");
    const testMarker = join(work, `install-test-marker-${Date.now()}`);
    const runMarker = join(work, `install-run-marker-${Date.now()}`);
    const committed = await commitToBranch(app, alice, repo, {
      branch: "bad-install",
      base: repo.defaultBranch,
      message: "install fails",
      files: [
        {
          path: "forge.json",
          content: `${JSON.stringify(
            {
              app: {
                install: "exit 1",
                run: `touch ${runMarker} && bun run src/server.ts`,
                test: `touch ${testMarker} && bun test`,
              },
            },
            null,
            2,
          )}\n`,
        },
      ],
    });
    expect(committed.ok).toBe(true);
    if (!committed.ok) return;
    const opened = await openPull(app, alice, repo, {
      title: "Bad install",
      baseBranch: repo.defaultBranch,
      headBranch: "bad-install",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    const failed = await settled(
      repo.id,
      (r) =>
        r.env === `pull-${opened.value.number}` &&
        r.commitOid === committed.value.commitOid,
    );
    expect(failed.state).toBe("failed");
    expect(failed.summary).toContain("install");
    // Neither `test` nor `run` ever executed.
    expect(existsSync(testMarker)).toBe(false);
    expect(existsSync(runMarker)).toBe(false);
    expect(
      (await viaHost(`badinstall--${opened.value.number}.${DOMAIN}`)).status,
    ).toBe(502);
  }, 60_000);
  test("closing a pull whose deploy already answered kills its still-running test step — no orphan `bun test`", async () => {
    const made = await newApp(app, alice, {
      name: "slowtest",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    await settled(repo.id, (r) => r.env === "production");
    // A merge lands this same forge.json on the default branch and
    // production redeploys it too, running this same test step to
    // completion (nothing aborts a deploy that was never in flight when the
    // pull closed) — a marker keyed by $FORGE_APP_ENV keeps that legitimate
    // production run from being mistaken for the preview's orphan.
    const marker = join(work, `slowtest-marker-${Date.now()}`);
    const committed = await commitToBranch(app, alice, repo, {
      branch: "slow-test",
      base: repo.defaultBranch,
      message: "slow test",
      files: [
        {
          path: "forge.json",
          content: `${JSON.stringify(
            {
              app: {
                run: "bun run src/server.ts",
                test: `sleep 5 && touch ${marker}-$FORGE_APP_ENV`,
              },
            },
            null,
            2,
          )}\n`,
        },
      ],
    });
    expect(committed.ok).toBe(true);
    if (!committed.ok) return;
    const opened = await openPull(app, alice, repo, {
      title: "Slow test",
      baseBranch: repo.defaultBranch,
      headBranch: "slow-test",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    // Wait for the app to answer — well before the test step's sleep ends.
    const upDeadline = Date.now() + 10_000;
    let up = false;
    while (Date.now() < upDeadline) {
      if (
        (await viaHost(`slowtest--${opened.value.number}.${DOMAIN}`))
          .status === 200
      ) {
        up = true;
        break;
      }
      await Bun.sleep(50);
    }
    expect(up).toBe(true);
    // Close it while the test step is still sleeping.
    const closed = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, opened.value.number)!,
      "merge",
    );
    expect(closed.ok).toBe(true);
    // Wait well past the sleep the test step was doing, and confirm it
    // never finished: the preview's own marker is not there (production's,
    // from its own unrelated redeploy of the same merged commit, may be).
    await Bun.sleep(6_500);
    expect(existsSync(`${marker}-preview`)).toBe(false);
  }, 60_000);
  test("private grant: forged, tampered, expired, wrong-env, and open-redirect are all refused; cookie is HttpOnly/SameSite", async () => {
    const made = await newApp(app, alice, {
      name: "grants",
      visibility: "private",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    const record = made.value.app;
    await settled(repo.id, (r) => r.env === "production");
    const target = { app: record, env: "production" as const };
    const good = signGrant(dataDir, target, 60_000);
    expect(verifyGrant(dataDir, good, target)).toBe(true);
    // Wrong environment: a grant for production names none for a preview.
    expect(verifyGrant(dataDir, good, { app: record, env: "pull-1" })).toBe(
      false,
    );
    // Expired: signed in the past with a short ttl.
    const expired = signGrant(dataDir, target, 1_000, Date.now() - 10_000);
    expect(verifyGrant(dataDir, expired, target)).toBe(false);
    // Tampered signature: the payload is untouched, but the MAC no longer
    // matches it — this is the actual HMAC check, not just a field mismatch.
    const parts = good.split(".");
    const payload = parts.slice(0, -1).join(".");
    const sig = parts.at(-1)!;
    const flipped = sig.at(-1) === "A" ? "B" : "A";
    const tampered = `${payload}.${sig.slice(0, -1)}${flipped}`;
    expect(verifyGrant(dataDir, tampered, target)).toBe(false);
    // Tampered payload: flip a character in the app id segment — the
    // signature is now for a different message entirely.
    const idTampered = `x${payload.slice(1)}.${sig}`;
    expect(verifyGrant(dataDir, idTampered, target)).toBe(false);
    // Forged: right shape, made-up signature.
    const forged = `${record.id}.production.${Date.now() + 60_000}.notarealsignature`;
    expect(verifyGrant(dataDir, forged, target)).toBe(false);
    // Hitting the grant endpoint on a *public* app: it still answers (it
    // is not access-gated by itself), but the token must still verify
    // correctly against that public app's own target.
    const publicMade = await newApp(app, alice, {
      name: "grantpublic",
      visibility: "public",
    });
    expect(publicMade.ok).toBe(true);
    if (publicMade.ok) {
      await settled(publicMade.value.repo.id, (r) => r.env === "production");
      const pubGrantUrl = `http://grantpublic.${DOMAIN}/__forge/grant?t=${encodeURIComponent(good)}&to=/`;
      // A production-app grant token does not verify for a different app's
      // target, so this must be refused (404) even though the destination
      // app is public.
      const url = new URL(pubGrantUrl);
      const crossApp = await viaHost(url.host, `${url.pathname}${url.search}`);
      expect(crossApp.status).toBe(404);
    }
    // Open redirect: `to=//evil` and `to=http://evil` must both collapse to `/`.
    const okToken = signGrant(dataDir, target, 60_000);
    for (const to of [
      "//evil.example",
      "http://evil.example",
      "https://evil.example/x",
    ]) {
      const resp = await viaHost(
        `grants.${DOMAIN}`,
        `/__forge/grant?t=${encodeURIComponent(okToken)}&to=${encodeURIComponent(to)}`,
      );
      expect(resp.status).toBe(303);
      expect(resp.headers.get("location")).toBe("/");
    }
    // The cookie itself: HttpOnly and SameSite=Lax.
    const grantResp = await viaHost(
      `grants.${DOMAIN}`,
      `/__forge/grant?t=${encodeURIComponent(okToken)}&to=/`,
    );
    const cookie = grantResp.headers.get("set-cookie") ?? "";
    expect(cookie.toLowerCase()).toContain("httponly");
    expect(cookie).toContain("SameSite=Lax");
    // Invariant 9: a private *repository* never distinguishes "you're
    // anonymous" from "you're signed in but still can't see it" — both
    // must read `not_found`, or an anonymous prober could tell the two
    // apart and learn something about a repo they cannot see.
    const strangerCreated = await createUser(app.db, { trusted: true,
      username: "stranger",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    expect(strangerCreated.ok).toBe(true);
    if (!strangerCreated.ok) return;
    const { openEnvUrl } = await import("../src/actions/apps.ts");
    const anonOnPrivateRepo = openEnvUrl(app, undefined, repo, "production");
    expect(anonOnPrivateRepo.ok).toBe(false);
    if (!anonOnPrivateRepo.ok)
      expect(anonOnPrivateRepo.error).toBe("not_found");
    const strangerOnPrivateRepo = openEnvUrl(
      app,
      strangerCreated.value,
      repo,
      "production",
    );
    expect(strangerOnPrivateRepo.ok).toBe(false);
    if (!strangerOnPrivateRepo.ok)
      expect(strangerOnPrivateRepo.error).toBe("not_found");
    // `unauthorized` is reachable only through the other combination: a
    // *public* repository (so `canRead` already passes for anyone) whose
    // app access is explicitly overridden to "private". There, an
    // anonymous visitor has nothing to be vouched with, and a signed-in
    // stranger who can read the public code is still not let in: a private
    // app answers to its writers and crew only (#620).
    const overrideMade = await newApp(app, alice, {
      name: "publicwithprivateapp",
      visibility: "public",
    });
    expect(overrideMade.ok).toBe(true);
    if (!overrideMade.ok) return;
    await settled(overrideMade.value.repo.id, (r) => r.env === "production");
    updateAppSettings(app, alice, overrideMade.value.repo, {
      access: "private",
    });
    const anonOnPublicRepo = openEnvUrl(
      app,
      undefined,
      overrideMade.value.repo,
      "production",
    );
    expect(anonOnPublicRepo.ok).toBe(false);
    if (!anonOnPublicRepo.ok)
      expect(anonOnPublicRepo.error).toBe("unauthorized");
    const strangerOnPublicRepo = openEnvUrl(
      app,
      strangerCreated.value,
      overrideMade.value.repo,
      "production",
    );
    expect(strangerOnPublicRepo.ok).toBe(false);
    if (!strangerOnPublicRepo.ok)
      expect(strangerOnPublicRepo.error).toBe("not_found");
  }, 60_000);
  test("the proxy: hop-by-hop headers are stripped, an upstream that dies mid-request yields a clean error, a claimed upgrade is a request", async () => {
    const made = await newApp(app, alice, {
      name: "proxytest",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    await settled(repo.id, (r) => r.env === "production");
    const page = await viaHost(`proxytest.${DOMAIN}`);
    expect(page.status).toBe(200);
    // Hop-by-hop response headers never reach the client from the proxy
    // path (the app itself doesn't set them, but the proxy must strip them
    // if it ever did — assert the contract on the response we did get).
    for (const h of ["connection", "transfer-encoding", "keep-alive"]) {
      expect(page.headers.has(h)).toBe(false);
    }
    // The slug is case-insensitive end to end, through the database too —
    // not just in `parseAppHost`'s own lowercasing.
    const upperCase = await viaHost(`PROXYTEST.${DOMAIN}`);
    expect(upperCase.status).toBe(200);
    expect(await upperCase.text()).toBe(await page.text());
    // A request that says `Upgrade: websocket` without a handshake key is
    // not a handshake: it is fetched as a request, the hop-by-hop headers
    // stripped, and the app answers it as one. Real sockets are
    // test/apps-ws.test.ts.
    const ws = await viaHost(`proxytest.${DOMAIN}`, "/", {
      headers: { upgrade: "websocket", connection: "Upgrade" },
    });
    expect(ws.status).toBe(200);
    // Stop the live process out from under the proxy (simulating a crash
    // mid-request) and confirm the *next* request gets the forge's own
    // "not running" page, never a raw connection-refused/502 from Bun.
    const { stopEnv } = await import("../src/actions/apps.ts");
    await stopEnv(app, alice, repo, "production");
    const afterStop = await viaHost(`proxytest.${DOMAIN}`);
    expect(afterStop.status).toBe(502);
    expect(await afterStop.text()).toContain("not running");
  }, 60_000);
  test("the API never lets an env parameter shaped like a path reach the filesystem", async () => {
    const made = await newApp(app, alice, {
      name: "envtraversal",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    await settled(made.value.repo.id, (r) => r.env === "production");
    const adminToken = createToken(
      app.db,
      alice.id,
      "traversal-test",
      "admin",
    ).token;
    const api = (path: string, init: RequestInit = {}) =>
      fetch(`${servers.url}${path}`, {
        ...init,
        headers: { authorization: `Bearer ${adminToken}` },
      });
    const owner = made.value.repo.ownerName;
    const name = made.value.repo.name;
    // A bare ".." segment is collapsed by `URL`/`fetch` before the request
    // ever leaves the client (RFC 3986 dot-segment removal), so it can only
    // be used to probe the *server's* handling when percent-encoded — a raw
    // ".." never reaches the router at all, which is the stronger property
    // and not what this test is isolating.
    for (const hostile of [
      "..%2F..%2F..%2Fetc",
      "production%2F..%2F..",
      "pull--1",
    ]) {
      const redeploy = await api(
        `/api/v1/repos/${owner}/${name}/app/${hostile}/redeploy`,
        { method: "POST" },
      );
      if (redeploy.status !== 422) {
        throw new Error(
          `redeploy env=${hostile} returned ${redeploy.status}, expected 422`,
        );
      }
      const body = (await redeploy.json()) as { error: string };
      expect(body.error).toBe("no_such_env");
      const stop = await api(
        `/api/v1/repos/${owner}/${name}/app/${hostile}/stop`,
        { method: "POST" },
      );
      if (stop.status !== 422) {
        throw new Error(
          `stop env=${hostile} returned ${stop.status}, expected 422`,
        );
      }
      const open = await api(
        `/api/v1/repos/${owner}/${name}/app/${hostile}/open`,
      );
      expect(open.status).toBe(422);
    }
  }, 60_000);
  test('preview_data: "empty" starts a preview with no copy of production\'s data', async () => {
    const made = await newApp(app, alice, {
      name: "emptypolicy",
      visibility: "public",
    });
    expect(made.ok).toBe(true);
    if (!made.ok) return;
    const repo = made.value.repo;
    await settled(repo.id, (r) => r.env === "production");
    updateAppSettings(app, alice, repo, { previewData: "empty" });
    const form = new FormData();
    form.set("body", "production-only note");
    await viaHost(`emptypolicy.${DOMAIN}`, "/notes", {
      method: "POST",
      body: form,
      headers: {
        cookie: await grantedCookie(app, servers.url, alice, made.value.app),
      },
    });
    expect(await (await viaHost(`emptypolicy.${DOMAIN}`)).text()).toContain(
      "production-only note",
    );
    const committed = await commitToBranch(app, alice, repo, {
      branch: "empty-preview",
      base: repo.defaultBranch,
      message: "trigger a preview",
      files: [{ path: "EMPTY.md", content: "hi\n" }],
    });
    expect(committed.ok).toBe(true);
    const opened = await openPull(app, alice, repo, {
      title: "Empty preview",
      baseBranch: repo.defaultBranch,
      headBranch: "empty-preview",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    await settled(repo.id, (r) => r.env === `pull-${opened.value.number}`);
    const previewHtml = await (
      await viaHost(`emptypolicy--${opened.value.number}.${DOMAIN}`)
    ).text();
    expect(previewHtml).not.toContain("production-only note");
  }, 60_000);
  test("rule 1: the repository takes no push from the crew; the agent's fork takes branches but never its default branch, protected or not, renamed or not", async () => {
    const madeRepo = await createRepo(app, alice, { name: "rule1-repo" });
    expect(madeRepo.ok).toBe(true);
    if (!madeRepo.ok) return;
    const repo = madeRepo.value;
    await commitToBranch(app, alice, repo, {
      message: "seed",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    const madeAgent = await createAgent(app, alice, {
      username: "rule1bot",
      model: "",
      brief: "",
    });
    expect(madeAgent.ok).toBe(true);
    if (!madeAgent.ok) return;
    const bot = madeAgent.value.user;
    addToCrew(app, alice, repo, "rule1bot");
    const token = createToken(app.db, bot.id, "t", "rw");
    const remote = `${servers.url.replace("://", `://rule1bot:${token.token}@`)}/${repo.ownerName}/${repo.name}.git`;
    const clone = join(work, "rule1-clone");
    expect(
      (await sh(["git", "clone", "--quiet", remote, clone], work)).code,
    ).toBe(0);
    await Bun.write(join(clone, "A.md"), "a\n");
    await sh(["git", "add", "A.md"], clone);
    await sh(["git", "commit", "-qm", "a"], clone);
    // The repository itself: crew membership is read. Neither the default
    // branch nor any other takes a push, and the refusal hides nothing it
    // would not hide from any non-writer.
    const toDefault = await sh(
      ["git", "push", "-q", "origin", `HEAD:${repo.defaultBranch}`],
      clone,
    );
    expect(toDefault.code).not.toBe(0);
    const toOther = await sh(
      ["git", "push", "-q", "origin", "HEAD:refs/heads/some-branch"],
      clone,
    );
    expect(toOther.code).not.toBe(0);
    expect(
      await resolveOid(
        repoDir(app.reposRoot, repo.ownerName, repo.name),
        "refs/heads/some-branch",
      ),
    ).toBeUndefined();
    // The agent's fork takes its branches…
    const forked = await forkRepo(app, bot, repo);
    expect(forked.ok).toBe(true);
    if (!forked.ok) return;
    let fork = forked.value;
    const forkRemote = `${servers.url.replace("://", `://rule1bot:${token.token}@`)}/${fork.ownerName}/${fork.name}.git`;
    const otherOk = await sh(
      ["git", "push", "-q", forkRemote, "HEAD:refs/heads/some-branch"],
      clone,
    );
    expect(otherOk.code).toBe(0);
    // …but never its default branch: rule 1 is unconditional, protectDefault
    // off or on — an agent can't even fast-forward it.
    const refusedOff = await sh(
      ["git", "push", "-q", forkRemote, `HEAD:${fork.defaultBranch}`],
      clone,
    );
    expect(refusedOff.code).not.toBe(0);
    expect(refusedOff.err).toContain("agents propose through pulls");
    await updateRepoSettings(app, alice, fork, { protectDefault: true });
    const refusedOn = await sh(
      ["git", "push", "-q", forkRemote, `HEAD:${fork.defaultBranch}`],
      clone,
    );
    expect(refusedOn.code).not.toBe(0);
    expect(refusedOn.err).toContain("agents propose through pulls");
    // Rename the fork's default branch, then confirm a push to the NEW name
    // is still refused (the hook must read the live default branch, not a
    // cached name).
    await sh(["git", "checkout", "-q", "-b", "renamed-main"], clone);
    await sh(["git", "push", "-q", forkRemote, "renamed-main"], clone);
    const renamed = await updateRepoSettings(app, alice, fork, {
      defaultBranch: "renamed-main",
    });
    expect(renamed.ok).toBe(true);
    fork = getRepoById(app.db, fork.id)!;
    expect(fork.defaultBranch).toBe("renamed-main");
    await Bun.write(join(clone, "B.md"), "b\n");
    await sh(["git", "add", "B.md"], clone);
    await sh(["git", "commit", "-qm", "b"], clone);
    const refusedRenamed = await sh(
      ["git", "push", "-q", forkRemote, "HEAD:renamed-main"],
      clone,
    );
    expect(refusedRenamed.code).not.toBe(0);
    expect(refusedRenamed.err).toContain("agents propose through pulls");
  }, 60_000);
  test("rule 1: an agent's rw token cannot reach settings, app enable, crew, tokens, or agent creation over the API", async () => {
    const madeRepo = await createRepo(app, alice, { name: "rule1-api-repo" });
    expect(madeRepo.ok).toBe(true);
    if (!madeRepo.ok) return;
    const repo = madeRepo.value;
    await commitToBranch(app, alice, repo, {
      message: "seed",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    const madeAgent = await createAgent(app, alice, {
      username: "rule1apibot",
      model: "",
      brief: "",
    });
    expect(madeAgent.ok).toBe(true);
    if (!madeAgent.ok) return;
    addToCrew(app, alice, repo, "rule1apibot");
    const bot = madeAgent.value.user;
    const token = createToken(app.db, bot.id, "t", "rw").token;
    const api = (path: string, init: RequestInit = {}) =>
      fetch(`${servers.url}${path}`, {
        ...init,
        headers: {
          ...(init.headers as Record<string, string>),
          authorization: `Bearer ${token}`,
          "content-type": "application/json",
        },
      });
    const settingsResp = await api(
      `/api/v1/repos/${repo.ownerName}/${repo.name}`,
      { method: "PATCH", body: JSON.stringify({ visibility: "public" }) },
    );
    expect(settingsResp.status).toBe(403);
    const enableResp = await api(
      `/api/v1/repos/${repo.ownerName}/${repo.name}/app`,
      { method: "POST", body: JSON.stringify({}) },
    );
    expect(enableResp.status).toBe(403);
    const crewResp = await api(
      `/api/v1/repos/${repo.ownerName}/${repo.name}/crew/rule1apibot`,
      { method: "PUT" },
    );
    expect(crewResp.status).toBe(403);
    const tokenResp = await api("/api/v1/tokens", {
      method: "POST",
      body: JSON.stringify({ adminConfirm: true, name: "x", scope: "admin" }),
    });
    // Neither via-session nor via-password: falls through to bad credentials.
    expect(tokenResp.status).toBe(401);
    const agentResp = await api("/api/v1/agents", {
      method: "POST",
      body: JSON.stringify({ username: "another-bot" }),
    });
    expect(agentResp.status).toBe(403);
  }, 30_000);
  test("rule 4: require_checks cannot be satisfied by a stale head, a foreign pull's run, a cancelled run, or a queued one; a push re-locks it", async () => {
    const madeRepo = await createRepo(app, alice, { name: "rule4-repo" });
    expect(madeRepo.ok).toBe(true);
    if (!madeRepo.ok) return;
    let repo = madeRepo.value;
    await commitToBranch(app, alice, repo, {
      message: "seed",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    repo = (await updateRepoSettings(app, alice, repo, { requireChecks: true }))
      .ok
      ? getRepoById(app.db, repo.id)!
      : repo;
    const committed1 = await commitToBranch(app, alice, repo, {
      branch: "feature",
      base: repo.defaultBranch,
      message: "feature commit 1",
      files: [{ path: "F.md", content: "1\n" }],
    });
    expect(committed1.ok).toBe(true);
    if (!committed1.ok) return;
    const oid1 = committed1.value.commitOid;
    const opened = await openPull(app, alice, repo, {
      title: "Feature",
      baseBranch: repo.defaultBranch,
      headBranch: "feature",
    });
    expect(opened.ok).toBe(true);
    if (!opened.ok) return;
    const pull = opened.value;
    // A second branch, pointing at the exact same commit, opened as a
    // second pull — so a run tagged with its issue id shares the commit
    // oid but must never satisfy the first pull's gate.
    await sh(
      ["git", "branch", "feature2", oid1],
      repoDir(app.reposRoot, repo.ownerName, repo.name),
    );
    const opened2 = await openPull(app, alice, repo, {
      title: "Feature 2",
      baseBranch: repo.defaultBranch,
      headBranch: "feature2",
    });
    expect(opened2.ok).toBe(true);
    if (!opened2.ok) return;
    const mkRun = (issueId: string, oid: string) =>
      createRun(app.db, {
        repoId: repo.id,
        kind: "deploy",
        issueId,
        commitOid: oid,
        env: "pull-x",
        reason: "push",
      });
    // Queued: never satisfies.
    mkRun(pull.id, oid1);
    let refused = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(refused.ok).toBe(false);
    if (!refused.ok) expect(refused.error).toBe("checks_required");
    // Cancelled: never satisfies.
    const toCancel = mkRun(pull.id, oid1);
    cancelRun(app.db, toCancel.id, "test cancel");
    refused = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(refused.ok).toBe(false);
    if (!refused.ok) expect(refused.error).toBe("checks_required");
    // A green run for a DIFFERENT pull at the same commit: never satisfies
    // pull 1.
    const foreignRun = mkRun(opened2.value.id, oid1);
    claimRun(app.db, foreignRun.id);
    finishRun(app.db, foreignRun.id, { state: "ok", summary: "green" });
    refused = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(refused.ok).toBe(false);
    if (!refused.ok) expect(refused.error).toBe("checks_required");
    // Now a genuinely green run for pull 1 at its actual head: merge works.
    const goodRun = mkRun(pull.id, oid1);
    claimRun(app.db, goodRun.id);
    finishRun(app.db, goodRun.id, { state: "ok", summary: "green" });
    const merged = await mergePull(
      app,
      alice,
      repo,
      getPull(app.db, repo.id, pull.number)!,
      "merge",
    );
    expect(merged.ok).toBe(true);
  }, 60_000);
  test("rule 4: a push after a green check re-locks the pull until the new head is green", async () => {
    const madeRepo = await createRepo(app, alice, { name: "rule4-relock" });
    expect(madeRepo.ok).toBe(true);
    if (!madeRepo.ok) return;
    let repo = madeRepo.value;
    await commitToBranch(app, alice, repo, {
      message: "seed",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    repo = (await updateRepoSettings(app, alice, repo, { requireChecks: true }))
      .ok
      ? getRepoById(app.db, repo.id)!
      : repo;
    const c1 = await commitToBranch(app, alice, repo, {
      branch: "relock",
      base: repo.defaultBranch,
      message: "c1",
      files: [{ path: "R.md", content: "1\n" }],
    });
    if (!c1.ok) throw new Error("setup failed");
    const opened = await openPull(app, alice, repo, {
      title: "Relock",
      baseBranch: repo.defaultBranch,
      headBranch: "relock",
    });
    if (!opened.ok) throw new Error("setup failed");
    const pull = opened.value;
    const green1 = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      issueId: pull.id,
      commitOid: c1.value.commitOid,
      env: "pull-x",
      reason: "push",
    });
    claimRun(app.db, green1.id);
    finishRun(app.db, green1.id, { state: "ok", summary: "green" });
    expect(
      (
        await mergePull(
          app,
          alice,
          repo,
          getPull(app.db, repo.id, pull.number)!,
          "merge",
        )
      ).ok,
    ).toBe(true);
  }, 30_000);
});
describe("boot: a forge addressed by IP hands every app a host that works (issue #269)", () => {
  let dataDir: string;
  let work: string;
@@ -28,6 +28,8 @@
describe("a git client's environment under test", () => {
    expect(env["GIT_CONFIG_PARAMETERS"]).toBeUndefined();
    expect(env["GIT_CONFIG_GLOBAL"]).toBe("/dev/null");
    expect(env["GIT_CONFIG_SYSTEM"]).toBe("/dev/null");
    expect(env["GIT_CONFIG_NOSYSTEM"]).toBe("1");
    expect(env["GIT_OPTIONAL_LOCKS"]).toBe("0");
    expect(env["GIT_TERMINAL_PROMPT"]).toBe("0");
    expect(env["PATH"]).toBe(process.env["PATH"] ?? "/usr/bin:/bin");
    // The test's own additions win.
@@ -0,0 +1,35 @@
/**
 * Argon2 at its cheapest, for tests: `test/helpers/preload.ts` installs it
 * before every test file (`bunfig.toml`).
 *
 * A forge hashes a password with `Bun.password.hash(password, "argon2id")`,
 * Bun's default cost — 64 MiB and two passes, about 150 ms on a quiet
 * machine and several times that with sixteen files hashing side by side.
 * The suite makes an account and signs it in about four hundred times, so
 * that cost was most of a typical `beforeAll` and most of the gate's floor
 * (#2038). Here the default becomes argon2id's minimum (8 KiB, one pass);
 * `Bun.password.verify` reads the cost back from the hash, so signing in is
 * as cheap. Production never loads this file, and a test that names its own
 * cost (`test/signin-throttle.test.ts`) keeps it.
 *
 * `realHash` is the runtime's own, for the test that proves this is only a
 * test's saving.
 */
export const realHash = Bun.password.hash.bind(Bun.password);
/** argon2id's floor: the cheapest hash a verify still accepts as argon2id. */
export const CHEAP = { algorithm: "argon2id", memoryCost: 8, timeCost: 1 } as const;
type Algorithm = Parameters<typeof Bun.password.hash>[1];
/** The cost a test hash is made at: the floor, unless the caller named one. */
export function cheapened(algorithm: Algorithm): Algorithm {
  if (algorithm === undefined || algorithm === "argon2id") return CHEAP;
  return algorithm;
}
/** Every `Bun.password.hash` in this process from now on, at the floor. */
export function installCheapHash(): void {
  Bun.password.hash = (password, algorithm) => realHash(password, cheapened(algorithm));
}
@@ -30,7 +30,8 @@
const IDENTITY = {
/**
 * A deterministic environment for a git client under test: `PATH` and
 * nothing else from the host, no global or system config, no prompt, and a
 * fixed identity. `extra` is the test's own additions — a clone URL's
 * fixed identity. No optional locks either: a `git status` in a test never
 * rewrites the index it only reads (#2038). `extra` is the test's own additions — a clone URL's
 * askpass, `GIT_SSH_COMMAND`, a different author — and wins.
 */
export function gitClientEnv(
@@ -41,6 +42,8 @@
export function gitClientEnv(
    HOME: "/dev/null",
    GIT_CONFIG_GLOBAL: "/dev/null",
    GIT_CONFIG_SYSTEM: "/dev/null",
    GIT_CONFIG_NOSYSTEM: "1",
    GIT_OPTIONAL_LOCKS: "0",
    GIT_TERMINAL_PROMPT: "0",
    LC_ALL: "C",
    ...IDENTITY,
@@ -0,0 +1,8 @@
/**
 * Loaded before every test file (`bunfig.toml` `[test] preload`), never by
 * the forge. Only what the whole suite must agree on belongs here.
 */
import { installCheapHash } from "./cheap-hash.ts";
installCheapHash();
@@ -0,0 +1,50 @@
/**
 * What the studio test files share (#2038 split one file into several):
 * a picture to drop where a look would sit, and an app runtime that
 * answers "running" without starting anything.
 */
import { spyOn } from "bun:test";
import type { App } from "../../src/app.ts";
import { AppsRuntime, type EnvState, type EnvStatus } from "../../src/apps/runtime.ts";
import type { AppRecord } from "../../src/core/apps.ts";
import { looksForEnv } from "../../src/core/looks.ts";
import type { Servers } from "../../src/http/server.ts";
/** One transparent pixel, dropped where a look would sit. */
export const PNG = Buffer.from(
  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==",
  "base64",
);
/**
 * A runtime registered for `app`, never started, answering every app's
 * production with `stateOf` (running unless told) — the door shows only
 * what is up or wakes. The returned function takes it away again.
 */
export async function serving(
  app: App,
  servers: Servers,
  stateOf: (record: AppRecord) => EnvState = () => "running",
): Promise<() => Promise<void>> {
  const runtime = new AppsRuntime(app, {
    domain: "studio-door.test",
    scheme: "http",
    publicPort: servers.port,
    forgeUrl: servers.url,
  });
  const status = spyOn(AppsRuntime.prototype, "status").mockImplementation(
    (record: AppRecord): EnvStatus[] => [
      {
        env: "production",
        state: stateOf(record),
        // Serving the commit its newest picture is of.
        commitOid: looksForEnv(app.db, record.id, "production")[0]?.commitOid ?? "",
      } as EnvStatus,
    ],
  );
  return async () => {
    status.mockRestore();
    await runtime.stop();
  };
}
@@ -3,6 +3,9 @@
import { mkdtempSync, rmSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { openDb } from "../src/kernel/db.ts";
import { createUser, verifyPassword } from "../src/core/users.ts";
import { migrations } from "../src/core/schema.ts";
import { CHEAP, cheapened, realHash } from "./helpers/cheap-hash.ts";
import { ForgeError, defect } from "../src/kernel/error.ts";
import { id, secret } from "../src/kernel/id.ts";
import {
@@ -148,6 +151,47 @@
describe("db", () => {
    }
  });
  test("a fresh database after the first is a copy of the migrated empty one (#2038)", () => {
    const dir = mkdtempSync(join(tmpdir(), "forge-kernel-"));
    try {
      // random() tells a copy from a second run of the migrations.
      const list = [
        "CREATE TABLE seed (n INTEGER); INSERT INTO seed (n) VALUES (random())",
        "CREATE TABLE parent (id INTEGER PRIMARY KEY); CREATE TABLE child (pid INTEGER REFERENCES parent(id))",
      ];
      const seed = (db: ReturnType<typeof openDb>) =>
        db.query<{ n: number }, []>("SELECT n FROM seed").all();
      const first = openDb(join(dir, "a.db"), list);
      // Written after the image was taken: never part of a later copy.
      first.exec("INSERT INTO parent (id) VALUES (1)");
      const second = openDb(join(dir, "b.db"), list);
      const memory = openDb(":memory:", list);
      for (const copy of [second, memory]) {
        expect(seed(copy)).toEqual(seed(first));
        expect(copy.query("SELECT id FROM parent").all()).toEqual([]);
        expect(() => copy.exec("INSERT INTO child (pid) VALUES (99)")).toThrow();
        expect(copy.query("SELECT $n AS n").get({ n: 3 })).toEqual({ n: 3 });
        expect(
          copy.query<{ user_version: number }, []>("PRAGMA user_version").get()?.user_version,
        ).toBe(2);
      }
      expect(
        second.query<{ journal_mode: string }, []>("PRAGMA journal_mode").get()?.journal_mode,
      ).toBe("wal");
      // A list that grew since the copy was taken still runs what is new.
      list.push("CREATE TABLE later (z INTEGER)");
      const third = openDb(join(dir, "c.db"), list);
      expect(seed(third)).toEqual(seed(first));
      third.exec("INSERT INTO later (z) VALUES (1)");
      // A different list is never handed this one's copy.
      const other = openDb(join(dir, "d.db"), [list[0]!]);
      expect(seed(other)).not.toEqual(seed(first));
      for (const db of [first, second, memory, third, other]) db.close();
    } finally {
      rmSync(dir, { recursive: true, force: true });
    }
  });
  test("foreign keys are enforced", () => {
    const db = openDb(":memory:", [
      "CREATE TABLE parent (id INTEGER PRIMARY KEY); CREATE TABLE child (pid INTEGER REFERENCES parent(id))",
@@ -155,3 +199,35 @@
describe("db", () => {
    expect(() => db.exec("INSERT INTO child (pid) VALUES (99)")).toThrow();
  });
});
describe("passwords under test are hashed at argon2id's floor (#2038)", () => {
  test("bunfig preloads it: an account made in a test stores the cheapest argon2id", async () => {
    const db = openDb(":memory:", migrations);
    const made = await createUser(db, {
      trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!made.ok) throw new Error(made.error);
    const row = db
      .query<{ password_hash: string }, []>("SELECT password_hash FROM user")
      .get();
    expect(row?.password_hash.startsWith("$argon2id$v=19$m=8,t=1,p=1$")).toBe(true);
    expect((await verifyPassword(db, "alice", "a-good-passphrase")).ok).toBe(true);
    expect((await verifyPassword(db, "alice", "a-bad-passphrase")).ok).toBe(false);
    db.close();
  });
  test("only the default is cheapened; a named cost and the runtime's own are kept", async () => {
    expect(cheapened(undefined)).toEqual(CHEAP);
    expect(cheapened("argon2id")).toEqual(CHEAP);
    const named = { algorithm: "argon2id", memoryCost: 16, timeCost: 2 } as const;
    expect(cheapened(named)).toBe(named);
    expect(cheapened("bcrypt")).toBe("bcrypt");
    // What production stores still verifies: the cost lives in the hash.
    const real = await realHash("a-good-passphrase", "argon2id");
    expect(real.startsWith("$argon2id$v=19$m=65536,t=2,p=1$")).toBe(true);
    expect(await Bun.password.verify("a-good-passphrase", real)).toBe(true);
  });
});
@@ -10,8 +10,10 @@
import { join } from "node:path";
import {
  SECONDS_PER_BYTE_DEFAULT,
  SHARDS_MAX,
  WORKER_MEMORY_BYTES,
  formatTimes,
  heaviestFirst,
  memoryLimit,
  overlayTimes,
  parseTimes,
  refreshTimes,
@@ -213,12 +215,35 @@
describe("parseTimes", () => {
describe("shardCount", () => {
  test("one per CPU, capped, at least one, never more than files", () => {
    expect(shardCount(80, 22)).toEqual({ ok: true, value: SHARDS_MAX });
    expect(shardCount(80, 400)).toEqual({ ok: true, value: SHARDS_MAX });
    expect(shardCount(4, 22)).toEqual({ ok: true, value: 4 });
    expect(shardCount(1, 22)).toEqual({ ok: true, value: 1 });
    expect(shardCount(80, 3)).toEqual({ ok: true, value: 3 });
  });
  test("the check cell's 16 CPUs and 8 GiB run 16 at once; less memory runs fewer (#2038)", () => {
    const GiB = 1024 * 1024 * 1024;
    expect(SHARDS_MAX).toBeGreaterThanOrEqual(16);
    expect(shardCount(16, 400, undefined, 8 * GiB)).toEqual({ ok: true, value: 16 });
    expect(shardCount(16, 400, undefined, 4 * GiB)).toEqual({ ok: true, value: 8 });
    expect(shardCount(16, 400, undefined, 6 * GiB + 100)).toEqual({ ok: true, value: 12 });
    // Less than one worker's room still runs one.
    expect(shardCount(16, 400, undefined, WORKER_MEMORY_BYTES - 1)).toEqual({ ok: true, value: 1 });
    // Memory never raises the count past the CPUs, and the override wins.
    expect(shardCount(4, 400, undefined, 64 * GiB)).toEqual({ ok: true, value: 4 });
    expect(shardCount(16, 400, "20", 4 * GiB)).toEqual({ ok: true, value: 20 });
  });
  test("memoryLimit: the least of the machine and each cgroup limit it can read", () => {
    const GiB = 1024 * 1024 * 1024;
    expect(memoryLimit(256 * GiB, [`${8 * GiB}\n`, undefined])).toBe(8 * GiB);
    expect(memoryLimit(256 * GiB, ["max\n", undefined])).toBe(256 * GiB);
    // cgroup v1's "no limit" is a page-rounded 2^63: bigger than the machine.
    expect(memoryLimit(4 * GiB, [undefined, "9223372036854771712\n"])).toBe(4 * GiB);
    expect(memoryLimit(4 * GiB, ["", "-1", "1e9", "0"])).toBe(4 * GiB);
    expect(memoryLimit(64 * GiB, [`${16 * GiB}`, `${8 * GiB}`])).toBe(8 * GiB);
  });
  test("FORGE_CHECK_SHARDS turns it up or down; nonsense is refused", () => {
    expect(shardCount(80, 22, "2")).toEqual({ ok: true, value: 2 });
    expect(shardCount(4, 22, "12")).toEqual({ ok: true, value: 12 });
@@ -0,0 +1,1292 @@
/**
 * The studio: one signed-in owner's lists and change pages, tells and
 * doors. One of the files the studio's suite was split into so no one file
 * sets the gate's floor (#2038); the rest are test/studio*.test.ts.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdirSync, writeFileSync } from "node:fs";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { dirname, join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { enableApp } from "../src/actions/apps.ts";
import { getAppByRepo } from "../src/core/apps.ts";
import { addToCrew, createAgent } from "../src/actions/crew.ts";
import {
  assignIssue,
  openIssue,
  setIssueLabels,
  setIssueState,
} from "../src/actions/issues.ts";
import { openPull } from "../src/actions/pulls.ts";
import {
  commitToBranch,
  createLabel,
  createRepo,
} from "../src/actions/repos.ts";
import { recordLook } from "../src/core/looks.ts";
import { setDirectionIssue, type Repo } from "../src/core/repos.ts";
import { claimRun, createRun, finishRun } from "../src/core/runs.ts";
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { PNG, serving } from "./helpers/studio.ts";
describe("the studio, continued", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let repo: Repo;
  let cookie: string;
  const get = (path: string, extra: Record<string, string> = {}) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio`, ...extra },
      redirect: "manual",
    });
  const post = (path: string, body: Record<string, string>, extra = "") =>
    fetch(`${base}${path}`, {
      method: "POST",
      headers: { cookie: `${cookie}${extra}`, origin: base },
      body: new URLSearchParams(body),
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "notes",
      visibility: "private",
      description: "a place for notes",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content: '{"name":"notes","scripts":{"start":"bun run server.ts"}}\n',
        },
        {
          path: "server.ts",
          content:
            "Bun.serve({ port: Number(process.env.PORT), fetch: () => new Response('ok') });\n",
        },
      ],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "notes" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const scout = await createAgent(app, alice, { username: "scout" });
    if (!scout.ok) throw new Error(String(scout.error));
    expect(addToCrew(app, alice, repo, "scout").ok).toBe(true);
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a reader of a public tell sees its Details but none of the forms that change it", async () => {
    const open = await createRepo(app, alice, {
      name: "publictell",
      visibility: "public",
      description: "",
    });
    if (!open.ok) throw new Error(String(open.error));
    const told = openIssue(app, alice, open.value, { title: "Anyone may read" });
    if (!told.ok) throw new Error(String(told.error));
    const at = `/alice/publictell/issues/${told.value.number}`;
    const anon = await (await fetch(`${base}${at}`)).text();
    expect(anon).toContain("Anyone may read");
    expect(anon).toContain('<details class="quiet-details mt">');
    for (const verb of ["assignee", "labels", "dependencies", "state", "comments"])
      expect(anon, verb).not.toContain(`action="${at}/${verb}"`);
  });
  test("the repository's direction never reads as waiting forever", async () => {
    const direction = openIssue(app, alice, repo, {
      title: "Direction",
      body: "Ship faster.",
    });
    if (!direction.ok) throw new Error(String(direction.error));
    setDirectionIssue(app.db, repo.id, direction.value.id);
    const studio = await (
      await get(`/alice/notes/issues/${direction.value.number}`)
    ).text();
    expect(studio).toContain("standing direction");
    expect(studio).not.toContain('data-word="told"');
    // The direction keeps its own sentence; nobody was assigned, so the
    // assignee line does not add a second, contradicting one (#214).
    expect(studio).not.toContain("nobody has it yet");
    // Leave the repository as the other tests in this suite found it.
    setDirectionIssue(app.db, repo.id, null);
  });
  test("a tell on a repository that is not an app renders exactly what it renders today, even in studio mode", async () => {
    const plain = await createRepo(app, alice, {
      name: "plaintell",
      visibility: "private",
      description: "no app here",
    });
    if (!plain.ok) throw new Error(String(plain.error));
    const told = openIssue(app, alice, plain.value, {
      title: "Plain issue",
      body: "Nothing special.",
    });
    if (!told.ok) throw new Error(String(told.error));
    const studioCookie = await (
      await get(`/alice/plaintell/issues/${told.value.number}`)
    ).text();
    expect(studioCookie).toContain("<h2>Labels</h2>");
    expect(studioCookie).toContain("<h2>Assignee</h2>");
    expect(studioCookie).toContain("<h2>Depends on</h2>");
  });
  test("everything told is the one issue list, in the studio's own words; the word filter narrows it, and ?mode=dev changes nothing", async () => {
    const told = openIssue(app, alice, repo, {
      title: "List test: not picked up yet",
      body: "waits for the crew",
    });
    if (!told.ok) throw new Error(String(told.error));
    const page = await (await get("/alice/notes/issues")).text();
    expect(page).toContain("List test: not picked up yet");
    expect(page).toContain('data-word="told"');
    expect(page).not.toContain("Clear filters");
    expect(page).not.toContain('name="label"');
    expect(page).not.toContain(`>#${told.value.number} opened`);
    expect(page).toContain(`href="/alice/notes/issues?word=told"`);
    const filtered = await (await get("/alice/notes/issues?word=told")).text();
    expect(filtered).toContain("List test: not picked up yet");
    const other = await (await get("/alice/notes/issues?word=shipped")).text();
    expect(other).not.toContain("List test: not picked up yet");
    // There is no second list behind the mode: the cookie and the escape
    // hatch both answer the same rows in the same words.
    for (const dev of [
      await get("/alice/notes/issues", { cookie: `${cookie}; forge_mode=dev` }),
      await get("/alice/notes/issues"),
    ]) {
      expect(dev.status).toBe(200);
      const text = await dev.text();
      expect(text).toContain("List test: not picked up yet");
      expect(text).toContain('data-word="told"');
      expect(text).not.toContain(`>#${told.value.number} opened`);
      expect(text).not.toContain("See dev's list");
    }
  });
  test("every change is the one pull list, in the studio's own words; the word filter narrows it, and ?mode=dev changes nothing", async () => {
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/list-change",
      base: "main",
      message: "List change",
      files: [{ path: "LIST_CHANGE.md", content: "a change\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "List test: a green change",
      body: "",
      baseBranch: "main",
      headBranch: "feature/list-change",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const check = createRun(app.db, {
      repoId: repo.id,
      kind: "check",
      issueId: pull.id,
      env: `pull-${pull.number}`,
      commitOid: pull.headOid,
      reason: "pull",
    });
    claimRun(app.db, check.id);
    finishRun(app.db, check.id, { state: "ok", summary: "check passed" });
    const page = await (await get("/alice/notes/pulls")).text();
    expect(page).toContain("List test: a green change");
    expect(page).toContain('data-word="look"');
    expect(page).not.toContain(`${pull.headBranch} &rarr; ${pull.baseBranch}`);
    expect(page).not.toContain(`${pull.headBranch}`);
    const filtered = await (await get("/alice/notes/pulls?word=look")).text();
    expect(filtered).toContain("List test: a green change");
    const other = await (await get("/alice/notes/pulls?word=shipped")).text();
    expect(other).not.toContain("List test: a green change");
    for (const dev of [
      await get("/alice/notes/pulls", { cookie: `${cookie}; forge_mode=dev` }),
      await get("/alice/notes/pulls"),
    ]) {
      expect(dev.status).toBe(200);
      const text = await dev.text();
      expect(text).toContain("List test: a green change");
      expect(text).toContain('data-word="look"');
      expect(text).not.toContain(pull.headBranch);
      expect(text).not.toContain("See dev's list");
    }
    // A green pull left open now asks the front door too (#208) — close it
    // so it does not linger into a later test's own count of asks.
    expect(setIssueState(app, alice, repo, pull, "closed").ok).toBe(true);
  });
  test("every run is the run list in the studio's own words; the word filter narrows it, and ?mode=dev renders today's list", async () => {
    const scout = getUserByName(app.db, "scout")!;
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      actorId: scout.id,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    const page = await (await get("/alice/notes/runs")).text();
    expect(page).toContain('data-word="working"');
    expect(page).toContain(`href="/alice/notes/runs/${run.id}"`);
    const filtered = await (await get("/alice/notes/runs?word=working")).text();
    expect(filtered).toContain(`href="/alice/notes/runs/${run.id}"`);
    const other = await (await get("/alice/notes/runs?word=shipped")).text();
    expect(other).not.toContain(`href="/alice/notes/runs/${run.id}"`);
    // One list (#629): the cookie and the query both answer it.
    finishRun(app.db, run.id, { state: "failed", summary: "boom" });
    for (const dev of [
      await get("/alice/notes/runs?word=stopped", {
        cookie: `${cookie}; forge_mode=dev`,
      }),
      await get("/alice/notes/runs?word=stopped"),
    ]) {
      const text = await dev.text();
      expect(text).toContain('data-word="stopped"');
      expect(text).toContain(`href="/alice/notes/runs/${run.id}"`);
      expect(text).not.toContain("See dev's list");
    }
    // Deploys and checks are one quiet link away, and `?kind=` keeps the
    // meaning a link to dev's list gave it.
    expect(page).toContain('href="/alice/notes/runs?kind=deploy"');
    expect(page).toContain('href="/alice/notes/runs?kind=check"');
    const deploys = await (await get("/alice/notes/runs?kind=deploy")).text();
    expect(deploys).not.toContain(`href="/alice/notes/runs/${run.id}"`);
    expect(deploys).toContain('href="/alice/notes/runs?kind=deploy&amp;word=told"');
  });
  test("issues, pulls and runs on a repository that is not an app are the same one list", async () => {
    const plain = await createRepo(app, alice, {
      name: "plainlists",
      visibility: "private",
      description: "no app here",
    });
    if (!plain.ok) throw new Error(String(plain.error));
    const told = openIssue(app, alice, plain.value, {
      title: "Plain list: an issue",
      body: "",
    });
    if (!told.ok) throw new Error(String(told.error));
    for (const mode of ["studio", "dev"]) {
      const viewer = `${cookie}; forge_mode=${mode}`;
      const issues = await (
        await get("/alice/plainlists/issues", { cookie: viewer })
      ).text();
      expect(issues).toContain("Plain list: an issue");
      // A plain repository speaks of issues: an untouched one reads "open",
      // and neither Told nor Look is a filter there (#683 follow-up).
      expect(issues).toMatch(/data-word="told"\s*>open</);
      expect(issues).toContain(`href="/alice/plainlists/issues?word=working"`);
      expect(issues).not.toContain(`href="/alice/plainlists/issues?word=told"`);
      expect(issues).not.toContain(`href="/alice/plainlists/issues?word=look"`);
      expect(issues).toContain(
        `href="/alice/plainlists/tells/${told.value.number}"`,
      );
      expect(issues).not.toContain("See dev's list");
      const pulls = await (
        await get("/alice/plainlists/pulls", { cookie: viewer })
      ).text();
      expect(pulls).toContain(`href="/alice/plainlists/pulls?word=working"`);
      expect(pulls).not.toContain(`href="/alice/plainlists/pulls?word=look"`);
      expect(pulls).not.toContain("See dev's list");
    }
    const runs = await (await get("/alice/plainlists/runs")).text();
    expect(runs).toContain(`href="/alice/plainlists/runs?word=working"`);
    expect(runs).not.toContain("See dev's list");
  });
  test("/tells and /changes are the studio's own doors onto the same lists /issues and /pulls reach — same words, same filter, same paging", async () => {
    const told = openIssue(app, alice, repo, {
      title: "Door test: a tell",
      body: "reached through /tells too",
    });
    if (!told.ok) throw new Error(String(told.error));
    const viaIssues = await (await get("/alice/notes/issues")).text();
    const viaTells = await (await get("/alice/notes/tells")).text();
    expect(viaTells).toContain("Door test: a tell");
    expect(viaTells).toContain('data-word="told"');
    // Self-links (the word filter, paging) follow whichever door was used,
    // so a dev URL asked for in studio mode still answers exactly as it
    // does today.
    expect(viaTells).toContain(`href="/alice/notes/tells?word=told"`);
    expect(viaIssues).toContain(`href="/alice/notes/issues?word=told"`);
    const filtered = await (await get("/alice/notes/tells?word=told")).text();
    expect(filtered).toContain("Door test: a tell");
    const other = await (await get("/alice/notes/tells?word=shipped")).text();
    expect(other).not.toContain("Door test: a tell");
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/door-test",
      base: "main",
      message: "Door test change",
      files: [{ path: "DOOR_TEST.md", content: "a change\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Door test: a change",
      body: "",
      baseBranch: "main",
      headBranch: "feature/door-test",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const doorPull = opened.value;
    const doorCheck = createRun(app.db, {
      repoId: repo.id,
      kind: "check",
      issueId: doorPull.id,
      env: `pull-${doorPull.number}`,
      commitOid: doorPull.headOid,
      reason: "pull",
    });
    claimRun(app.db, doorCheck.id);
    finishRun(app.db, doorCheck.id, { state: "ok", summary: "check passed" });
    const viaPulls = await (await get("/alice/notes/pulls")).text();
    const viaChanges = await (await get("/alice/notes/changes")).text();
    expect(viaChanges).toContain("Door test: a change");
    expect(viaChanges).toContain('data-word="look"');
    expect(viaChanges).toContain(`href="/alice/notes/changes?word=look"`);
    expect(viaPulls).toContain(`href="/alice/notes/pulls?word=look"`);
    const changeFiltered = await (
      await get("/alice/notes/changes?word=look")
    ).text();
    expect(changeFiltered).toContain("Door test: a change");
    const changeOther = await (
      await get("/alice/notes/changes?word=shipped")
    ).text();
    expect(changeOther).not.toContain("Door test: a change");
    // A green pull left open now asks the front door too (#208) — close it
    // so it does not linger into a later test's own count of asks.
    expect(setIssueState(app, alice, repo, doorPull, "closed").ok).toBe(true);
  });
  test("/tells and /changes answer a dev-mode viewer, ?mode=dev, and a repository that is not an app with the same list, never a bounce", async () => {
    const plain = await createRepo(app, alice, {
      name: "doorlists",
      visibility: "private",
      description: "no app here",
    });
    if (!plain.ok) throw new Error(String(plain.error));
    for (const [path, viewer] of [
      ["/alice/notes/tells", `${cookie}; forge_mode=dev`],
      ["/alice/notes/changes", `${cookie}; forge_mode=dev`],
      ["/alice/notes/tells", `${cookie}; forge_mode=studio`],
      ["/alice/doorlists/tells", cookie],
      ["/alice/doorlists/changes", cookie],
    ] as const) {
      const res = await get(path, { cookie: viewer });
      expect(res.status).toBe(200);
      const text = await res.text();
      expect(text).toContain(`href="${path.split("?")[0]}?word=`);
    }
  });
  test("the one list keeps what dev's list could narrow by: labels as chips, and who has it, who opened it, a piece of the title, and the older ?state= address", async () => {
    const shelf = await createRepo(app, alice, {
      name: "facetlists",
      visibility: "private",
      description: "labels and narrowings",
    });
    if (!shelf.ok) throw new Error(String(shelf.error));
    const r = shelf.value;
    const bug = createLabel(app, alice, r, "bug", "d73a4a");
    if (!bug.ok) throw new Error(String(bug.error));
    const a = openIssue(app, alice, r, { title: "Facet: a broken thing", body: "" });
    const b = openIssue(app, alice, r, { title: "Facet: a wish", body: "" });
    const c = openIssue(app, alice, r, { title: "Facet: long done", body: "" });
    if (!a.ok || !b.ok || !c.ok) throw new Error("open failed");
    expect(setIssueLabels(app, alice, r, a.value, ["bug"]).ok).toBe(true);
    expect(assignIssue(app, alice, r, b.value, alice).ok).toBe(true);
    expect(setIssueState(app, alice, r, c.value, "closed").ok).toBe(true);
    const list = await (await get("/alice/facetlists/issues")).text();
    // The row wears its label, and the repository's labels narrow the list.
    expect(list).toContain('class="label lc-d73a4a">bug</span>');
    expect(list).toContain(`href="/alice/facetlists/issues?label=bug"`);
    expect(list).toContain(".lc-d73a4a{--label:#d73a4a}");
    expect(list).not.toContain("Facet: long done");
    const labelled = await (await get("/alice/facetlists/issues?label=bug")).text();
    expect(labelled).toContain("Facet: a broken thing");
    expect(labelled).not.toContain("Facet: a wish");
    // The chip in force clears itself, and a word keeps the label.
    expect(labelled).toMatch(
      /href="\/alice\/facetlists\/issues"\s+aria-current="true"/,
    );
    expect(labelled).toContain(`href="/alice/facetlists/issues?word=working&amp;label=bug"`);
    const mine = await (await get("/alice/facetlists/issues?assignee=alice")).text();
    expect(mine).toContain("Facet: a wish");
    expect(mine).not.toContain("Facet: a broken thing");
    expect(mine).toContain("alice has it ✕");
    const titled = await (await get("/alice/facetlists/issues?q=wish")).text();
    expect(titled).toContain("Facet: a wish");
    expect(titled).not.toContain("Facet: a broken thing");
    expect(titled).toContain("wish in the title ✕");
    const bySomeone = await (await get("/alice/facetlists/issues?author=nobody")).text();
    expect(bySomeone).not.toContain("Facet: a wish");
    expect(bySomeone).toContain("nobody opened it ✕");
    // `?state=closed` from an older link still means what it said.
    const closed = await (await get("/alice/facetlists/issues?state=closed")).text();
    expect(closed).toContain("Facet: long done");
    expect(closed).not.toContain("Facet: a wish");
    // The older address's narrowing is shown, and clears itself.
    expect(closed).toContain("closed ✕");
    expect(closed).toMatch(/href="\/alice\/facetlists\/issues"\s+aria-current="true"/);
    expect(
      await (await get("/alice/facetlists/issues?state=all")).text(),
    ).toContain("open and closed ✕");
    // Closed with nothing merged is not dropped from the list: it reads
    // done, under shipped, where whoever closed it would look.
    const shipped = await (await get("/alice/facetlists/issues?word=shipped")).text();
    expect(shipped).toContain("Facet: long done");
    expect(shipped).toContain('data-word="done"');
    const all = await (await get("/alice/facetlists/issues?state=all")).text();
    expect(all).toContain("Facet: long done");
    expect(all).toContain("Facet: a wish");
  });
  test("a plain repository's pages promise no deploy and say issue: an open change waits on a person, an issue closes as an issue, and only its author or a writer may close it", async () => {
    const plain = await createRepo(app, alice, {
      name: "plainwords",
      visibility: "public",
      description: "",
    });
    if (!plain.ok) throw new Error(String(plain.error));
    const seeded = await commitToBranch(app, alice, plain.value, {
      message: "Start",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const branch = await commitToBranch(app, alice, plain.value, {
      branch: "plain-change",
      base: "main",
      message: "Plain change",
      files: [{ path: "PLAIN.md", content: "x\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, plain.value, {
      title: "A plain change",
      body: "",
      baseBranch: "main",
      headBranch: "plain-change",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const changes = await (await get("/alice/plainwords/pulls")).text();
    expect(changes).toContain("open — waiting on a person");
    expect(changes).not.toContain("no deploy of this head yet");
    const told = openIssue(app, alice, plain.value, { title: "A plain issue" });
    if (!told.ok) throw new Error(String(told.error));
    const at = `/alice/plainwords/issues/${told.value.number}`;
    const own = await (await get(at)).text();
    expect(own).toContain("Close issue");
    expect(own).not.toContain("Close tell");
    expect(own).toContain(`action="${at}/state"`);
    // A signed-in stranger may comment on a public issue, never close it.
    const stranger = await createUser(app.db, { trusted: true,
      username: "plainstranger",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!stranger.ok) throw new Error(stranger.error);
    const strangerCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "plainstranger",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const seen = await (
      await fetch(`${base}${at}`, { headers: { cookie: strangerCookie } })
    ).text();
    expect(seen).toContain('id="comment-body"');
    expect(seen).not.toContain(`action="${at}/state"`);
    expect(seen).not.toContain("Close issue");
    // Signed out on a public repository: the way in is offered.
    const anon = await (
      await fetch(`${base}/alice/plainwords/issues`, { redirect: "manual" })
    ).text();
    expect(anon).toContain("Sign in to open an issue");
    expect(anon).toContain("Report a problem</a");
  });
  test("the list's one verb besides opening a row is compose, for a signed-in person only, in the repository's own words", async () => {
    const plain = await createRepo(app, alice, {
      name: "composelists",
      visibility: "public",
      description: "no app here",
    });
    if (!plain.ok) throw new Error(String(plain.error));
    const signedIn = await (await get("/alice/composelists/issues")).text();
    expect(signedIn).toContain('href="/alice/composelists/issues/new"');
    expect(signedIn).toContain("New issue");
    const app_ = await (await get("/alice/notes/issues")).text();
    expect(app_).toContain('href="/alice/notes/issues/new"');
    expect(app_).toContain("Tell the crew");
    const anon = await (
      await fetch(`${base}/alice/composelists/issues`, { redirect: "manual" })
    ).text();
    expect(anon).not.toContain('href="/alice/composelists/issues/new"');
    // A stranger on a public repository can still report a problem.
    expect(anon).toContain('href="/alice/composelists/report"');
    // Someone signed in composes instead: no visible report link (the page's
    // head still names the report path for agents that read it).
    expect(signedIn).not.toMatch(
      /<a\b[^>]*href="\/alice\/composelists\/report"/,
    );
    // The pull list has no compose of its own: a change starts from a branch.
    const pulls = await (await get("/alice/composelists/pulls")).text();
    expect(pulls).not.toContain('href="/alice/composelists/pulls/new"');
  });
  test("a reader without access gets the forge's not-found on /tells and /changes, exactly as /issues and /pulls", async () => {
    const anonTells = await fetch(`${base}/alice/notes/tells`, {
      headers: { cookie: "forge_mode=studio" },
      redirect: "manual",
    });
    expect(anonTells.status).toBe(404);
    const anonChanges = await fetch(`${base}/alice/notes/changes`, {
      headers: { cookie: "forge_mode=studio" },
      redirect: "manual",
    });
    expect(anonChanges.status).toBe(404);
  });
  test("/tells/:number and /changes/:number reach the same pages /issues/:number and /pulls/:number reach — one page, the same anchors, and forms that still post to dev's own address", async () => {
    const told = openIssue(app, alice, repo, {
      title: "Door test: one tell",
      body: "reached through /tells/:number too",
    });
    if (!told.ok) throw new Error(String(told.error));
    const n = told.value.number;
    const viaTell = await get(`/alice/notes/tells/${n}`);
    expect(viaTell.status).toBe(200);
    const tellHtml = await viaTell.text();
    const viaIssue = await (await get(`/alice/notes/issues/${n}`)).text();
    // The same page, never a second copy of the markup.
    expect(tellHtml).toContain("Door test: one tell");
    expect(tellHtml).toContain('data-word="told"');
    // Still waiting, nobody assigned: the one case the line is true (#214).
    expect(tellHtml).toContain("nobody has it yet");
    expect(viaIssue).toContain('data-word="told"');
    // The write surface does not move with the noun: the reply, the close
    // and every Details form still point at /issues/:number.
    expect(tellHtml).toContain(`action="/alice/notes/issues/${n}/comments"`);
    expect(tellHtml).toContain(`action="/alice/notes/issues/${n}/assignee"`);
    // An anchor into the conversation still lands — the composer is on the
    // page either door was used.
    expect(tellHtml).toContain('id="comment-body"');
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/one-change-door",
      base: "main",
      message: "One change door",
      files: [{ path: "ONE_DOOR.md", content: "a change\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Door test: one change",
      body: "",
      baseBranch: "main",
      headBranch: "feature/one-change-door",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const p = opened.value.number;
    const viaChange = await get(`/alice/notes/changes/${p}`);
    expect(viaChange.status).toBe(200);
    const changeHtml = await viaChange.text();
    expect(changeHtml).toContain("Door test: one change");
    // The studio's change, not dev's diff.
    expect(changeHtml).not.toContain("diff-table");
    expect(changeHtml).toContain(`action="/alice/notes/pulls/${p}/comments"`);
    expect(changeHtml).toContain(`href="/alice/notes/pulls/${p}/files"`);
    expect(changeHtml).toContain('id="comment-body"');
    // Dev's own addresses answer the studio's pages where they stand — a
    // link already written to one is never bounced anywhere.
    const stillIssue = await get(`/alice/notes/issues/${n}`);
    expect(stillIssue.status).toBe(200);
    const stillPull = await get(`/alice/notes/pulls/${p}`);
    expect(stillPull.status).toBe(200);
    // The three lists, the app page and the search box all hand out the
    // studio's noun, so a person is never given two addresses for one thing.
    const tells = await (await get("/alice/notes/tells")).text();
    expect(tells).toContain(`href="/alice/notes/tells/${n}"`);
    const changes = await (await get("/alice/notes/changes")).text();
    expect(changes).toContain(`href="/alice/notes/changes/${p}"`);
    const appPage = await (await get("/alice/notes")).text();
    expect(appPage).toContain(`href="/alice/notes/changes/${p}"`);
    const search = await (await get("/search?q=Door+test")).text();
    expect(search).toContain(`/alice/notes/tells/${n}`);
    expect(search).toContain(`/alice/notes/changes/${p}`);
    // The palette's remote rows are folded in the browser; the index tells
    // the script which mode it is in, so it folds the same nouns.
    expect(appPage).toContain('"studio":true');
  });
  test("/tells/:number answers a dev-mode viewer, ?mode=dev, and a repository that is not an app with the same page, never a bounce", async () => {
    const told = openIssue(app, alice, repo, { title: "Door test: dev's way" });
    if (!told.ok) throw new Error(String(told.error));
    const n = told.value.number;
    for (const res of [
      await get(`/alice/notes/tells/${n}`, {
        cookie: `${cookie}; forge_mode=dev`,
      }),
      await get(`/alice/notes/tells/${n}`),
    ]) {
      expect(res.status).toBe(200);
      expect(await res.text()).toContain("Door test: dev");
    }
    const plain = await createRepo(app, alice, {
      name: "doorpages",
      visibility: "private",
      description: "no app here",
    });
    if (!plain.ok) throw new Error(String(plain.error));
    const plainTold = openIssue(app, alice, plain.value, {
      title: "Not an app",
    });
    if (!plainTold.ok) throw new Error(String(plainTold.error));
    const plainTell = await get(
      `/alice/doorpages/tells/${plainTold.value.number}`,
    );
    expect(plainTell.status).toBe(200);
    expect(await plainTell.text()).toContain("Not an app");
  });
  test("a reader without access gets the forge's not-found on /tells/:number and /changes/:number, exactly as /issues/:number and /pulls/:number", async () => {
    const told = openIssue(app, alice, repo, { title: "Door test: private" });
    if (!told.ok) throw new Error(String(told.error));
    const n = told.value.number;
    const anonTell = await fetch(`${base}/alice/notes/tells/${n}`, {
      headers: { cookie: "forge_mode=studio" },
      redirect: "manual",
    });
    expect(anonTell.status).toBe(404);
    const anonIssue = await fetch(`${base}/alice/notes/issues/${n}`, {
      headers: { cookie: "forge_mode=studio" },
      redirect: "manual",
    });
    expect(anonIssue.status).toBe(anonTell.status);
    // A number that is not a tell is not a tell at either address, and a
    // change's number is not one under the tell's own noun.
    const missing = await get("/alice/notes/tells/99999");
    expect(missing.status).toBe(404);
    const anonChange = await fetch(`${base}/alice/notes/changes/1`, {
      headers: { cookie: "forge_mode=studio" },
      redirect: "manual",
    });
    expect(anonChange.status).toBe(404);
  });
  test("a reader without access gets the forge's not-found on a tell, exactly as dev", async () => {
    const told = openIssue(app, alice, repo, { title: "Private work" });
    if (!told.ok) throw new Error(String(told.error));
    const anon = await fetch(
      `${base}/alice/notes/issues/${told.value.number}`,
      { headers: { cookie: "forge_mode=studio" }, redirect: "manual" },
    );
    expect(anon.status).toBe(404);
  });
  test("/apps in the studio is the shelf, not dev's table: an app the viewer can land, never one they cannot, and no dev table markup; ?mode=dev is unchanged", async () => {
    const bob = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!bob.ok) throw new Error(bob.error);
    const hidden = await createRepo(app, bob.value, {
      name: "hidden",
      visibility: "private",
      description: "bob's own, not alice's crew",
    });
    if (!hidden.ok) throw new Error(String(hidden.error));
    const seededHidden = await commitToBranch(app, bob.value, hidden.value, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content:
            '{"name":"hidden","scripts":{"start":"bun run server.ts"}}\n',
        },
        {
          path: "server.ts",
          content:
            "Bun.serve({ port: Number(process.env.PORT), fetch: () => new Response('ok') });\n",
        },
      ],
    });
    if (!seededHidden.ok) throw new Error(JSON.stringify(seededHidden.error));
    const enabledHidden = await enableApp(app, bob.value, hidden.value, {
      slug: "hidden",
    });
    if (!enabledHidden.ok) throw new Error(String(enabledHidden.error));
    const bobCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "bob",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const bobGet = (path: string, extra: Record<string, string> = {}) =>
      fetch(`${base}${path}`, {
        headers: { cookie: `${bobCookie}; forge_mode=studio`, ...extra },
        redirect: "manual",
      });
    // Bob can land his own app, but alice never crewed him onto "notes" —
    // private and none of his — so the shelf omits it.
    const studio = await (await bobGet("/apps")).text();
    expect(studio).toContain('href="/bob/hidden"');
    expect(studio).not.toContain('href="/alice/notes"');
    expect(studio).not.toContain("not serving");
    expect(studio).toContain('href="/apps?live=1"');
    // One list (#630): dev's table is gone, and the cookie and the query
    // both answer the shelf.
    for (const dev of [
      await bobGet("/apps", { cookie: `${bobCookie}; forge_mode=dev` }),
      await bobGet("/apps"),
    ]) {
      const text = await dev.text();
      expect(text).toContain('href="/apps?live=1"');
      expect(text).not.toContain('href="/alice/notes"');
      expect(text).not.toContain("Repositories that run.");
    }
  });
  test("clicking your own name lands on /:owner, which leads with your apps on the shelf and New app as the primary action, in every mode; a stranger never sees a private one", async () => {
    const studio = await (await get("/alice")).text();
    expect(studio).toContain("<h2>Apps</h2>");
    expect(studio).toContain('href="/alice/notes"');
    expect(studio).toContain("not running");
    expect(studio).toContain('href="/apps/new?owner=alice"');
    // The repository list stays reachable, filter and all — nothing disappears.
    expect(studio).toContain("data-search-input");
    expect(studio).toContain("notes");
    const dev = await (
      await get("/alice", { cookie: `${cookie}; forge_mode=dev` })
    ).text();
    // One owner page (#633): the cookie changes nothing.
    expect(dev).toContain("<h2>Apps</h2>");
    expect(dev).toContain('href="/apps/new?owner=alice"');
    expect(dev).toContain("not running");
    const carol = await createUser(app.db, { trusted: true,
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!carol.ok) throw new Error(carol.error);
    const carolCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "carol",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const stranger = await (
      await fetch(`${base}/alice`, {
        headers: { cookie: `${carolCookie}; forge_mode=studio` },
        redirect: "manual",
      })
    ).text();
    expect(stranger).not.toContain('href="/alice/notes"');
    // Nothing to see is shown as nothing: no empty apps card for a visitor.
    expect(stranger).not.toContain("No apps yet");
    expect(stranger).not.toContain('href="/apps/new?owner=alice"');
  });
  test("signed out in studio, / leads with the public apps that are serving — their look, not a private one's", async () => {
    // A second app, public, with a picture of its production. "notes" stays
    // private, so its presence (or absence) is the negative case below.
    const madePublic = await createRepo(app, alice, {
      name: "beacon",
      visibility: "public",
      description: "a lighthouse in the fog",
    });
    if (!madePublic.ok) throw new Error(String(madePublic.error));
    const beacon = madePublic.value;
    const seededPublic = await commitToBranch(app, alice, beacon, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content:
            '{"name":"beacon","scripts":{"start":"bun run server.ts"}}\n',
        },
        {
          path: "server.ts",
          content:
            "Bun.serve({ port: Number(process.env.PORT), fetch: () => new Response('ok') });\n",
        },
      ],
    });
    if (!seededPublic.ok) throw new Error(JSON.stringify(seededPublic.error));
    const enabledPublic = await enableApp(app, alice, beacon, {
      slug: "beacon",
    });
    if (!enabledPublic.ok) throw new Error(String(enabledPublic.error));
    // A look for each app's production, so the picture route has something
    // real to answer for and refuse.
    const dropLook = (appId: string, env: "production", commit: string) => {
      const rel = join("looks", appId, `${env}-thumb.png`);
      const abs = join(app.config.dataDir, rel);
      mkdirSync(dirname(abs), { recursive: true });
      writeFileSync(abs, PNG);
      return recordLook(app.db, {
        appId,
        env,
        commitOid: commit,
        kind: "thumb",
        path: rel,
      });
    };
    const beaconApp = getAppByRepo(app.db, beacon.id)!;
    const notesApp = getAppByRepo(app.db, repo.id)!;
    dropLook(beaconApp.id, "production", seededPublic.value.commitOid);
    dropLook(notesApp.id, "production", "0".repeat(40));
    // Signed out, with the studio cookie: the public app's name, its look,
    // and Sign in / Create an account — never the private one.
    const done = await serving(app, servers);
    const anon = await (
      await fetch(`${base}/`, { headers: { cookie: "forge_mode=studio" } })
    ).text();
    expect(anon).toContain("beacon");
    expect(anon).toContain("a lighthouse in the fog");
    expect(anon).toContain(
      `/looks/production/${seededPublic.value.commitOid}/thumb.png`,
    );
    expect(anon).toContain('href="/signin"');
    expect(anon).toContain('href="/signup"');
    expect(anon).not.toContain(">notes<");
    expect(anon).not.toContain("<h1>Your code, your machine.</h1>");
    // The private app's picture 404s for a stranger — asserted, not assumed.
    const privateLook = await fetch(
      `${base}/alice/notes/looks/production/${"0".repeat(40)}/thumb.png`,
      { headers: { cookie: "forge_mode=studio" } },
    );
    expect(privateLook.status).toBe(404);
    // The public one's does not.
    const publicLook = await fetch(
      `${base}/alice/beacon/looks/production/${seededPublic.value.commitOid}/thumb.png`,
      { headers: { cookie: "forge_mode=studio" } },
    );
    expect(publicLook.status).toBe(200);
    // `?mode=dev` answers a stranger with the same door: the dev landing
    // folded into it (#396).
    const dev = await (
      await fetch(`${base}/?mode=dev`, {
        headers: { cookie: "forge_mode=studio" },
      })
    ).text();
    expect(dev).toContain("<h1>Apps, live.</h1>");
    expect(dev).toContain("a lighthouse in the fog");
    expect(dev).not.toContain("<h1>Your code, your machine.</h1>");
    await done();
  });
  test("the front door's tile is the thumb, not the full desktop picture, when both exist (#287)", async () => {
    const created = await createRepo(app, alice, {
      name: "tinytile",
      visibility: "public",
      description: "picked its own thumb",
    });
    if (!created.ok) throw new Error(String(created.error));
    const seeded = await commitToBranch(app, alice, created.value, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content:
            '{"name":"tinytile","scripts":{"start":"bun run server.ts"}}\n',
        },
        {
          path: "server.ts",
          content:
            "Bun.serve({ port: Number(process.env.PORT), fetch: () => new Response('ok') });\n",
        },
      ],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, created.value, {
      slug: "tinytile",
    });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const record = getAppByRepo(app.db, created.value.id)!;
    const commit = seeded.value.commitOid;
    const drop = (kind: "desktop" | "thumb") => {
      const rel = join("looks", record.id, `production-${kind}.png`);
      const abs = join(app.config.dataDir, rel);
      mkdirSync(dirname(abs), { recursive: true });
      writeFileSync(abs, PNG);
      recordLook(app.db, {
        appId: record.id,
        env: "production",
        commitOid: commit,
        kind,
        path: rel,
      });
    };
    drop("desktop");
    drop("thumb");
    const done = await serving(app, servers);
    const anon = await (
      await fetch(`${base}/`, { headers: { cookie: "forge_mode=studio" } })
    ).text();
    await done();
    const tile = anon
      .split("<img")
      .find((chunk) =>
        chunk.includes(
          `/${created.value.ownerName}/${created.value.name}/looks/`,
        ),
      );
    expect(tile).toBeDefined();
    expect(tile).toContain(`/looks/production/${commit}/thumb.png`);
    expect(tile).toContain('width="640"');
    expect(tile).toContain('height="400"');
  });
  test("the front door leads with apps the viewer can write, never a stranger's public one — but /apps still lists it, owner named", async () => {
    // A public app of alice's own, distinct from "notes" (private) and
    // "beacon" (made public by an earlier test) — self-contained so this
    // test does not lean on another test's state.
    const madePublic = await createRepo(app, alice, {
      name: "lighthouse",
      visibility: "public",
      description: "everybody can see this one",
    });
    if (!madePublic.ok) throw new Error(String(madePublic.error));
    const seeded = await commitToBranch(app, alice, madePublic.value, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content:
            '{"name":"lighthouse","scripts":{"start":"bun run server.ts"}}\n',
        },
        {
          path: "server.ts",
          content:
            "Bun.serve({ port: Number(process.env.PORT), fetch: () => new Response('ok') });\n",
        },
      ],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, madePublic.value, {
      slug: "lighthouse",
    });
    if (!enabled.ok) throw new Error(String(enabled.error));
    // Erin just signed up: no apps of her own, but the forge already has a
    // public one.
    const erin = await createUser(app.db, { trusted: true,
      username: "erin",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!erin.ok) throw new Error(erin.error);
    const erinCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "erin",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const erinGet = (path: string) =>
      fetch(`${base}${path}`, {
        headers: { cookie: `${erinCookie}; forge_mode=studio` },
        redirect: "manual",
      });
    // Erin's front door: the empty state and New app, never alice's public
    // app — #69's case, finally reachable.
    const erinHome = await (await erinGet("/")).text();
    expect(erinHome).toContain("No apps yet");
    expect(erinHome).toContain('href="/apps/new"');
    expect(erinHome).toContain('href="/erin"');
    expect(erinHome).not.toContain("/?mode=dev");
    expect(erinHome).not.toContain('href="/alice/lighthouse"');
    expect(erinHome).not.toContain("tell the crew something");
    // Alice's own front door still leads with it.
    const aliceHome = await (await get("/")).text();
    expect(aliceHome).toContain('href="/alice/lighthouse"');
    // /apps hides nothing: both see it, and it names its owner since neither
    // request is alice's own view of her own row — erin's outright, and
    // even alice's own listing spells it the same way for every row beside
    // her own.
    const erinApps = await (await erinGet("/apps")).text();
    expect(erinApps).toContain('href="/alice/lighthouse"');
    expect(erinApps).toContain('<span class="muted">alice/</span>lighthouse');
    const aliceApps = await (await get("/apps")).text();
    expect(aliceApps).toContain('href="/alice/lighthouse"');
  });
  test("a forge with no public apps opens on the studio's door with an empty shelf, never dev's git pitch — at every old landing URL (#396)", async () => {
    const dataDir2 = await mkdtemp(join(tmpdir(), "forge-studio-empty-"));
    const app2 = createApp({ dataDir: dataDir2, port: 0 });
    const servers2 = await serve(app2);
    try {
      // A public repository that is not an app is not on the shelf.
      const owner = await createUser(app2.db, { trusted: true,
        username: "olga",
        email: "[email protected]",
        password: "a-good-passphrase",
      });
      if (!owner.ok) throw new Error(owner.error);
      const plain = await createRepo(app2, owner.value, {
        name: "just-code",
        visibility: "public",
      });
      if (!plain.ok) throw new Error(String(plain.error));
      // The landing's old addresses: the default, each mode's cookie, and
      // the `?mode=dev` escape hatch.
      for (const [path, cookie] of [
        ["/", ""],
        ["/", "forge_mode=studio"],
        ["/", "forge_mode=dev"],
        ["/", ""],
        ["/", "forge_mode=dev"],
      ] as const) {
        const response = await fetch(`${servers2.url}${path}`, {
          headers: { cookie },
          redirect: "manual",
        });
        expect(response.status).toBe(200);
        const body = await response.text();
        expect(body).toContain("<h1>Apps, live.</h1>");
        expect(body).toContain("Nothing public is up yet");
        expect(body).toContain('href="/signup"');
        expect(body).toContain('href="/signin"');
        expect(body).not.toContain("<h1>Your code, your machine.</h1>");
        expect(body).not.toContain("Public repositories");
        expect(body).not.toContain(`href="/olga/just-code"`);
      }
    } finally {
      servers2.stop();
      app2.close();
      await rm(dataDir2, { recursive: true, force: true });
    }
  });
  test("the door reads public apps, not a window of the newest repositories, and shows only the live ones (#288, #686)", async () => {
    const dataDir2 = await mkdtemp(join(tmpdir(), "forge-studio-door-"));
    const app2 = createApp({ dataDir: dataDir2, port: 0 });
    const servers2 = await serve(app2);
    try {
      const made = await createUser(app2.db, { trusted: true,
        username: "pia",
        email: "[email protected]",
        password: "a-good-passphrase",
      });
      if (!made.ok) throw new Error(made.error);
      const pia = made.value;
      const appOf = async (name: string) => {
        const created = await createRepo(app2, pia, {
          name,
          visibility: "public",
        });
        if (!created.ok) throw new Error(String(created.error));
        const enabled = await enableApp(app2, pia, created.value, {
          slug: name,
        });
        if (!enabled.ok) throw new Error(String(enabled.error));
        return getAppByRepo(app2.db, created.value.id)!;
      };
      const older = await appOf("older");
      const quiet = await appOf("quiet");
      // More public plain repositories than the old window held, all newer
      // than the apps.
      for (let n = 0; n < 25; n++) {
        const r = await createRepo(app2, pia, {
          name: `plain-${n}`,
          visibility: "public",
        });
        if (!r.ok) throw new Error(String(r.error));
      }
      // Each with a picture, so only liveness decides.
      for (const record of [older, quiet]) {
        mkdirSync(join(dataDir2, "looks", record.id), { recursive: true });
        writeFileSync(join(dataDir2, "looks", record.id, "thumb.png"), PNG);
        recordLook(app2.db, {
          appId: record.id,
          env: "production",
          commitOid: "0".repeat(40),
          kind: "thumb",
          path: `looks/${record.id}/thumb.png`,
        });
      }
      // `older` is serving, `quiet` is stopped: a stranger is shown what is
      // up, never what is down.
      const done = await serving(app2, servers2, (record) =>
        record.id === older.id ? "running" : "stopped",
      );
      try {
        const body = await (await fetch(`${servers2.url}/`)).text();
        expect(body).toContain('href="/pia/older"');
        expect(body).not.toContain('href="/pia/quiet"');
        expect(body).not.toContain('href="/pia/plain-0"');
      } finally {
        await done();
      }
    } finally {
      servers2.stop();
      app2.close();
      await rm(dataDir2, { recursive: true, force: true });
    }
  });
  test("a change on <crew>/<number>-<slug> links the tell it answers, and says so when that tell is closed; other branches show no tell", async () => {
    const told = openIssue(app, alice, repo, {
      title: "Answered tell",
      body: "",
    });
    if (!told.ok) throw new Error(String(told.error));
    const n = told.value.number;
    const open = async (branch: string, title: string) => {
      const c = await commitToBranch(app, alice, repo, {
        branch,
        base: "main",
        message: title,
        files: [{ path: `${branch.replace(/\//g, "_")}.md`, content: "x\n" }],
      });
      if (!c.ok) throw new Error(JSON.stringify(c.error));
      const o = await openPull(app, alice, repo, {
        title,
        body: "",
        baseBranch: "main",
        headBranch: branch,
      });
      if (!o.ok) throw new Error(String(o.error));
      return o.value;
    };
    const answering = await open(`scout/${n}-answer-it`, "Answers the tell");
    const stray = await open("scout/99999-nothing", "Answers nothing");
    const own = await open("revert-22", "A person's branch");
    const list = await (await get("/alice/notes/changes")).text();
    const rowOf = (title: string) => {
      const at = list.indexOf(title);
      return list.slice(at, list.indexOf("</a>", at + 400) + 4);
    };
    expect(rowOf("Answers the tell")).toContain(`href="/alice/notes/tells/${n}"`);
    expect(rowOf("Answers the tell")).not.toContain("already done");
    expect(rowOf("Answers nothing")).not.toContain("for tell");
    expect(rowOf("A person's branch")).not.toContain("for tell");
    setIssueState(app, alice, repo, told.value, "closed");
    const closedList = await (await get("/alice/notes/changes")).text();
    expect(closedList).toContain("its tell is already done");
    const page = await (
      await get(`/alice/notes/changes/${answering.number}`)
    ).text();
    expect(page).toContain(`href="/alice/notes/tells/${n}"`);
    expect(page).toContain("its tell is already done");
    for (const p of [stray, own]) {
      const res = await get(`/alice/notes/changes/${p.number}`);
      expect(res.status).toBe(200);
      expect(await res.text()).not.toContain("for tell");
    }
  });
});
@@ -0,0 +1,1778 @@
/**
 * The studio: the owner's page, every preview, the home that keeps itself
 * current, the head, the terminal and the live fragment. One of the files
 * the studio's suite was split into so no one file sets the gate's floor
 * (#2038); the rest are test/studio*.test.ts.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { enableApp } from "../src/actions/apps.ts";
import { previewEnv, type EnvName } from "../src/apps/data.ts";
import { AppsRuntime, type EnvState } from "../src/apps/runtime.ts";
import { getAppByRepo, type AppRecord } from "../src/core/apps.ts";
import { addToCrew, createAgent } from "../src/actions/crew.ts";
import { createOrg } from "../src/actions/orgs.ts";
import {
  assignIssue,
  openIssue,
  setIssueState,
} from "../src/actions/issues.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import { commitToBranch, createRepo } from "../src/actions/repos.ts";
import { KIND_CHIPS, setChip } from "../src/core/feed_chips.ts";
import type { Issue } from "../src/core/issues.ts";
import type { Pull } from "../src/core/pulls.ts";
import type { Repo } from "../src/core/repos.ts";
import {
  claimRun,
  createRun,
  finishRun,
  getRun,
  isTerminal,
  listRuns,
  markServing,
} from "../src/core/runs.ts";
import { liveClientJs } from "../src/web/live.ts";
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { serving } from "./helpers/studio.ts";
describe("an owner's page lists an app once, not once in each vocabulary (#221)", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-owner-once-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const signIn = async (username: string, password: string) =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({ username, password }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const occurrences = (haystack: string, needle: string): number =>
    haystack.split(needle).length - 1;
  test("a person with one app and one plain repository renders each once, in every mode; one with no app shows a visitor no apps card at all", async () => {
    const dan = await createUser(app.db, { trusted: true,
      username: "dan",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!dan.ok) throw new Error(dan.error);
    const cookie = await signIn("dan", "a-good-passphrase");
    const madeApp = await createRepo(app, dan.value, {
      name: "beacon",
      visibility: "public",
      description: "a lighthouse",
    });
    if (!madeApp.ok) throw new Error(String(madeApp.error));
    const appSeeded = await commitToBranch(app, dan.value, madeApp.value, {
      message: "Start",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    if (!appSeeded.ok) throw new Error(JSON.stringify(appSeeded.error));
    const enabled = await enableApp(app, dan.value, madeApp.value, {
      slug: "beacon",
    });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const madePlain = await createRepo(app, dan.value, {
      name: "scratch",
      visibility: "public",
      description: "not an app",
    });
    if (!madePlain.ok) throw new Error(String(madePlain.error));
    const plainSeeded = await commitToBranch(app, dan.value, madePlain.value, {
      message: "Start",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    if (!plainSeeded.ok) throw new Error(JSON.stringify(plainSeeded.error));
    const studio = await (
      await fetch(`${base}/dan`, {
        headers: { cookie: `${cookie}; forge_mode=studio` },
        redirect: "manual",
      })
    ).text();
    expect(occurrences(studio, 'href="/dan/beacon"')).toBe(1);
    expect(occurrences(studio, 'href="/dan/scratch"')).toBe(1);
    expect(studio).toContain("<h2>Other repositories</h2>");
    const dev = await (
      await fetch(`${base}/dan`, {
        headers: { cookie: `${cookie}; forge_mode=dev` },
        redirect: "manual",
      })
    ).text();
    expect(occurrences(dev, 'href="/dan/beacon"')).toBe(1);
    expect(occurrences(dev, 'href="/dan/scratch"')).toBe(1);
    expect(dev).toContain("<h2>Apps</h2>");
    expect(dev).toContain("<h2>Other repositories</h2>");
    // Someone with repositories and no app: a visitor is not shown an empty
    // apps card, and the list is simply their repositories.
    const gus = await createUser(app.db, { trusted: true,
      username: "gus",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!gus.ok) throw new Error(gus.error);
    const plainOnly = await createRepo(app, gus.value, {
      name: "notebook",
      visibility: "public",
      description: "",
    });
    if (!plainOnly.ok) throw new Error(String(plainOnly.error));
    const visit = await (
      await fetch(`${base}/gus`, {
        headers: { cookie: `${cookie}; forge_mode=studio` },
        redirect: "manual",
      })
    ).text();
    expect(visit).not.toContain("No apps yet");
    expect(visit).toContain("<h2>Repositories</h2>");
    expect(visit).toContain('href="/gus/notebook"');
  });
  test("an owner whose only repository is an app reads the empty list below as no other repositories, not as a bug", async () => {
    const eve = await createUser(app.db, { trusted: true,
      username: "eve",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!eve.ok) throw new Error(eve.error);
    const cookie = await signIn("eve", "a-good-passphrase");
    const madeApp = await createRepo(app, eve.value, {
      name: "lighthouse",
      visibility: "public",
    });
    if (!madeApp.ok) throw new Error(String(madeApp.error));
    const seeded = await commitToBranch(app, eve.value, madeApp.value, {
      message: "Start",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, eve.value, madeApp.value, {
      slug: "lighthouse",
    });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const studio = await (
      await fetch(`${base}/eve`, {
        headers: { cookie: `${cookie}; forge_mode=studio` },
        redirect: "manual",
      })
    ).text();
    expect(occurrences(studio, 'href="/eve/lighthouse"')).toBe(1);
    expect(studio).toContain("No other repositories");
    expect(studio).not.toContain("<h2>Other repositories</h2>");
  });
  test("a private app on a public repository shows its state only to its writers: a visitor gets a plain row", async () => {
    const hal = await createUser(app.db, { trusted: true,
      username: "hal",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!hal.ok) throw new Error(hal.error);
    const ownerCookie = await signIn("hal", "a-good-passphrase");
    const made = await createRepo(app, hal.value, {
      name: "ledger",
      visibility: "public",
      description: "the books",
    });
    if (!made.ok) throw new Error(String(made.error));
    const seeded = await commitToBranch(app, hal.value, made.value, {
      message: "Start",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, hal.value, made.value, {
      slug: "hal-ledger",
      access: "private",
    });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const ivy = await createUser(app.db, { trusted: true,
      username: "ivy",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!ivy.ok) throw new Error(ivy.error);
    const strangerCookie = await signIn("ivy", "a-good-passphrase");
    const visit = (cookie?: string) =>
      fetch(`${base}/hal`, {
        headers: cookie === undefined ? {} : { cookie },
        redirect: "manual",
      }).then((r) => r.text());
    for (const page of [await visit(), await visit(strangerCookie)]) {
      // The repository is public, so it is listed — once, plainly.
      expect(occurrences(page, 'href="/hal/ledger"')).toBe(1);
      expect(page).toContain("the books");
      expect(page).not.toContain("not running");
      expect(page).not.toContain("quiet");
      expect(page).not.toContain('class="studio-word"');
    }
    const own = await visit(ownerCookie);
    expect(own).toContain("not running");
  });
  test("an org's page draws the same way: its app once, its plain repository once, and Members/Teams unmoved", async () => {
    const fay = await createUser(app.db, { trusted: true,
      username: "fay",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!fay.ok) throw new Error(fay.error);
    const cookie = await signIn("fay", "a-good-passphrase");
    const org = await createOrg(app, fay.value, "vega");
    if (!org.ok) throw new Error(org.error);
    const madeApp = await createRepo(app, fay.value, {
      name: "anvil",
      owner: "vega",
      visibility: "public",
    });
    if (!madeApp.ok) throw new Error(String(madeApp.error));
    const appSeeded = await commitToBranch(app, fay.value, madeApp.value, {
      message: "Start",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    if (!appSeeded.ok) throw new Error(JSON.stringify(appSeeded.error));
    const enabled = await enableApp(app, fay.value, madeApp.value, {
      slug: "anvil",
    });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const madePlain = await createRepo(app, fay.value, {
      name: "ledger",
      owner: "vega",
      visibility: "public",
    });
    if (!madePlain.ok) throw new Error(String(madePlain.error));
    const plainSeeded = await commitToBranch(app, fay.value, madePlain.value, {
      message: "Start",
      files: [{ path: "README.md", content: "hi\n" }],
    });
    if (!plainSeeded.ok) throw new Error(JSON.stringify(plainSeeded.error));
    const studio = await (
      await fetch(`${base}/vega`, {
        headers: { cookie: `${cookie}; forge_mode=studio` },
        redirect: "manual",
      })
    ).text();
    expect(occurrences(studio, 'href="/vega/anvil"')).toBe(1);
    expect(occurrences(studio, 'href="/vega/ledger"')).toBe(1);
    expect(studio).toContain('<h2 class="mt">Members</h2>');
    expect(studio).toContain('<h2 class="mt" id="teams">Teams</h2>');
    const dev = await (
      await fetch(`${base}/vega`, {
        headers: { cookie: `${cookie}; forge_mode=dev` },
        redirect: "manual",
      })
    ).text();
    expect(occurrences(dev, 'href="/vega/anvil"')).toBe(1);
    expect(occurrences(dev, 'href="/vega/ledger"')).toBe(1);
  });
});
describe("every open pull's preview on the studio page", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let runtime: AppsRuntime;
  let base: string;
  let cookie: string;
  let repo: Repo;
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  const WAIT_MS = 60_000;
  /** The deploys this repo has not finished, as "env:state" words. */
  const unfinished = () =>
    listRuns(app.db, repo.id, { kind: "deploy", limit: 50 })
      .filter((r) => !isTerminal(r.state))
      .map((r) => `${r.env}:${r.state}`);
  /** Wait until the runtime has no deploy open or queued, so the next case
   * does not queue behind this one's (concurrency is 1). */
  async function deploysIdle(): Promise<void> {
    const deadline = Date.now() + WAIT_MS;
    while (unfinished().length > 0) {
      if (Date.now() > deadline)
        throw new Error(`deploys still open: ${unfinished().join(", ")}`);
      await Bun.sleep(50);
    }
  }
  /** Wait for `env` to serve; fail naming the state it reached. */
  async function previewServes(record: AppRecord, env: EnvName): Promise<void> {
    const deadline = Date.now() + WAIT_MS;
    while (runtime.envStatus(record, env)?.state !== "running") {
      if (Date.now() > deadline) {
        const status = runtime.envStatus(record, env);
        throw new Error(
          `${env} did not serve within ${WAIT_MS} ms: state ${status?.state ?? "absent"}` +
            (status?.error ? ` (${status.error})` : "") +
            `; open deploys: ${unfinished().join(", ") || "none"}`,
        );
      }
      await Bun.sleep(50);
    }
  }
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-previews-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    runtime = new AppsRuntime(app, {
      domain: "studio-previews.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    await runtime.start();
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, a.value, {
      name: "widget",
      visibility: "public",
      description: "",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content:
            '{"name":"widget","scripts":{"start":"bun run server.ts"}}\n',
        },
        {
          path: "server.ts",
          content:
            "Bun.serve({ port: Number(process.env.PORT), fetch: () => new Response('ok') });\n",
        },
      ],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "widget" });
    if (!enabled.ok) throw new Error(String(enabled.error));
  }, 30_000);
  afterAll(async () => {
    await runtime.stop();
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("an open pull's preview host and open link render; none do once nothing is open", async () => {
    const alice = getUserByName(app.db, "alice")!;
    const before = await (await get("/alice/widget")).text();
    expect(before).not.toContain("<h2>Previews</h2>");
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/x",
      base: repo.defaultBranch,
      message: "Add X",
      files: [{ path: "X.md", content: "x\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Add X",
      body: "",
      baseBranch: repo.defaultBranch,
      headBranch: "feature/x",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const page = await (await get("/alice/widget")).text();
    expect(page).toContain("<h2>Previews</h2>");
    expect(page).toContain(`href="/alice/widget/app/pull-${pull.number}/open"`);
    expect(page).toContain(`#${pull.number} Add X`);
    const merged = await mergePull(app, alice, repo, pull, "squash");
    expect(merged.ok).toBe(true);
    const after = await (await get("/alice/widget")).text();
    expect(after).not.toContain("<h2>Previews</h2>");
    expect(after).not.toContain(`pull-${pull.number}/open`);
    // The merge queues production's deploy and the pull's was cut short;
    // leave the single deploy slot free for the next case.
    await deploysIdle();
  }, 120_000);
  test("a change's page names its preview's data as its own copy and gives the moment it was taken; production's card does not", async () => {
    const alice = getUserByName(app.db, "alice")!;
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/y",
      base: repo.defaultBranch,
      message: "Add Y",
      files: [{ path: "Y.md", content: "y\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Add Y",
      body: "",
      baseBranch: repo.defaultBranch,
      headBranch: "feature/y",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const record = getAppByRepo(app.db, repo.id)!;
    const env = `pull-${pull.number}` as const;
    await previewServes(record, env);
    expect(runtime.envStatus(record, env)?.state).toBe("running");
    const note = "its own copy of production's data, taken";
    const appPage = await (await get("/alice/widget")).text();
    expect(appPage).toContain(note);
    // Production's own card, above the previews list, never says it.
    const production = appPage.slice(0, appPage.indexOf("<h2>Previews</h2>"));
    expect(production).not.toContain(note);
    const changePage = await (
      await get(`/alice/widget/changes/${pull.number}`)
    ).text();
    expect(changePage).toContain("<h2>Preview</h2>");
    expect(changePage).toContain(note);
  }, 120_000);
});
/**
 * The studio home keeps itself current: Asks you, Your apps and On you are
 * each a live region — no second fragment endpoint, the same `studioHome`
 * render as the first paint, fetched again on a matching event and swapped
 * in place by `liveRegionsJs` (`src/web/client.ts`).
 */
describe("the studio home keeps itself current", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let repo: Repo;
  let cookie: string;
  let pull: Pull;
  let readme: Issue;
  const get = (extraCookie = "") =>
    fetch(`${base}/`, {
      headers: {
        cookie: `${cookie}${extraCookie}; forge_mode=studio`,
      },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-live-home-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "signals",
      visibility: "private",
      description: "",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "s\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "signals" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const scout = await createAgent(app, alice, { username: "scout" });
    if (!scout.ok) throw new Error(String(scout.error));
    expect(addToCrew(app, alice, repo, "scout").ok).toBe(true);
    const scoutUser = getUserByName(app.db, "scout")!;
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/x",
      base: "main",
      message: "Add x",
      files: [{ path: "x.md", content: "x\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, scoutUser, repo, {
      title: "Add x",
      body: "",
      baseBranch: "main",
      headBranch: "feature/x",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    pull = opened.value;
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "check",
      issueId: pull.id,
      env: `pull-${pull.number}`,
      commitOid: pull.headOid,
      reason: "pull",
    });
    claimRun(app.db, run.id);
    finishRun(app.db, run.id, { state: "ok", summary: "check passed" });
    const asked = openIssue(app, alice, repo, { title: "Write the README" });
    if (!asked.ok) throw new Error(String(asked.error));
    readme = asked.value;
    expect(assignIssue(app, alice, repo, readme, alice).ok).toBe(true);
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("Your apps and On you are each a live region, with the security floor's headers", async () => {
    const res = await get();
    expect(res.status).toBe(200);
    expect(res.headers.get("x-content-type-options")).toBe("nosniff");
    expect(res.headers.get("referrer-policy")).toBe("same-origin");
    const home = await res.text();
    expect(home).toMatch(/id="live-apps"\s*\n?\s*data-live="/);
    expect(home).toMatch(/id="live-on-you"\s*\n?\s*data-live="/);
    expect(home).toContain("new EventSource('/events')");
    expect(home).toContain("Write the README");
  });
  test("chips do not touch Your apps: it lists apps, not feed items", async () => {
    for (const kind of KIND_CHIPS) setChip(app.db, alice.id, { kind: "kind", value: kind }, true);
    const res = await fetch(`${base}/live/apps`, { headers: { cookie: `${cookie}; forge_mode=studio` } });
    expect(await res.text()).toContain(`${repo.name}`);
    for (const kind of KIND_CHIPS) setChip(app.db, alice.id, { kind: "kind", value: kind }, false);
  });
  test("each region on the home has an address of its own, answering with that region alone and 304 when it has not changed", async () => {
    const page = await (await get()).text();
    expect(page).toContain('data-live-src="/live/apps"');
    expect(page).toContain('data-live-src="/live/on-you"');
    const headers = { cookie: `${cookie}; forge_mode=studio` };
    const apps = await fetch(`${base}/live/apps`, { headers });
    expect(apps.status).toBe(200);
    const appsText = await apps.text();
    expect(appsText).toContain('id="live-apps"');
    expect(appsText).toContain(`${repo.name}`);
    expect(appsText).not.toContain("<html");
    const tag = apps.headers.get("etag");
    expect(tag).toMatch(/^"[0-9a-f]{16}"$/);
    const unchanged = await fetch(`${base}/live/apps`, {
      headers: { ...headers, "if-none-match": tag! },
    });
    expect(unchanged.status).toBe(304);
    const onYou = await fetch(`${base}/live/on-you`, { headers });
    expect(onYou.status).toBe(200);
    expect(await onYou.text()).toContain('id="live-on-you"');
    // Signed out, the regions are nobody's.
    expect((await fetch(`${base}/live/apps`)).status).toBe(404);
    expect((await fetch(`${base}/live/on-you`)).status).toBe(404);
  });
  test("a signed-out request gets a signed-out home: no per-viewer live regions, nothing of alice's", async () => {
    const res = await fetch(`${base}/`, {
      headers: { cookie: "forge_mode=studio" },
      redirect: "manual",
    });
    expect(res.status).toBe(200);
    const home = await res.text();
    expect(home).not.toContain('id="live-asks"');
    expect(home).not.toContain('id="live-on-you"');
    expect(home).not.toContain("Add x");
    expect(home).not.toContain("Write the README");
  });
  test("a card leaves On you once its issue closes", async () => {
    // The On you region alone: the timeline still tells of the issue, as a
    // post does after it is done (#599).
    const onYou = () =>
      fetch(`${base}/live/on-you`, {
        headers: { cookie: `${cookie}; forge_mode=studio` },
      }).then((r) => r.text());
    const before = await onYou();
    expect(before).toContain("Write the README");
    const merged = await mergePull(app, alice, repo, pull, "squash");
    expect(merged.ok).toBe(true);
    expect(setIssueState(app, alice, repo, readme, "closed").ok).toBe(true);
    const after = await onYou();
    expect(after).not.toContain("Write the README");
  });
});
/**
 * The studio head of an app that is not up: the same facts the App page
 * shows — why, the deploy that says the rest, and the way to try again.
 */
describe("the studio head says why the app is not up", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let record: AppRecord;
  let runtime: AppsRuntime;
  let deploy: string;
  let writer: string;
  let reader: string;
  const head = (cookie: string) =>
    fetch(`${base}/alice/notes`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    }).then((r) => r.text());
  /** The home's own shelf row for this app — the badge issue #201 is about. */
  // The shelf's rows are `/apps` (#599: home is the feed).
  const shelfBadge = async (cookie: string): Promise<string> => {
    const home = await (
      await fetch(`${base}/apps`, {
        headers: { cookie: `${cookie}; forge_mode=studio` },
        redirect: "manual",
      })
    ).text();
    const at = home.indexOf('href="/alice/notes"');
    expect(at).toBeGreaterThan(-1);
    const start = home.lastIndexOf("<li>", at);
    const row = home.slice(start, home.indexOf("</li>", at) + 5);
    return row.match(/<span class="badge"[^>]*>([\s\S]*?)<\/span>/)?.[1] ?? "";
  };
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  /**
   * An environment as the runtime holds it, without running a deploy: the
   * page reads `runtime.status(record)`, and a real failure would mean a
   * real install and a real health timeout for a rendering test.
   */
  interface Slot {
    readonly app: AppRecord;
    readonly env: EnvName;
    readonly chain: Promise<void>;
    readonly restarts: number[];
    readonly live?: unknown;
    readonly deploying?: unknown;
    readonly lastError?: string;
    readonly lastRunId?: string;
    readonly lastErrorCommitOid?: string;
  }
  const put = (
    slot: Omit<Slot, "app" | "env" | "chain" | "restarts">,
  ): void => {
    (runtime as unknown as { envs: Map<string, Slot> }).envs.set(
      `${record.id}/production`,
      {
        app: record,
        env: "production",
        chain: Promise.resolve(),
        restarts: [],
        ...slot,
      },
    );
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-notup-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    runtime = new AppsRuntime(app, {
      domain: "apps.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    const b = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!b.ok) throw new Error(b.error);
    writer = await signIn("alice");
    reader = await signIn("bob");
    const made = await createRepo(app, a.value, {
      name: "notes",
      visibility: "public",
      description: "a place for notes",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "notes\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "notes" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    record = getAppByRepo(app.db, repo.id)!;
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: seeded.value.commitOid,
      reason: "push",
    });
    claimRun(app.db, run.id);
    finishRun(app.db, run.id, {
      state: "failed",
      summary: "the deploy failed",
    });
    deploy = run.id;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a failed production says what failed, links its deploy, and offers Redeploy to a writer only — and offers no live link to the host", async () => {
    put({
      lastError: "the deploy failed: <install> exited 1",
      lastRunId: deploy,
    });
    const mine = await head(writer);
    expect(mine).toContain("not up");
    // The error is the app's own output: shown, and escaped.
    expect(mine).toContain("the deploy failed: &lt;install&gt; exited 1");
    expect(mine).not.toContain("<install>");
    expect(mine).toContain(`href="/alice/notes/runs/${deploy}"`);
    expect(mine).toContain('action="/alice/notes/app/production/redeploy"');
    expect(mine).toContain('action="/alice/notes/app/production/stop"');
    expect(mine).not.toContain('href="/alice/notes/app/production/open"');
    expect(mine).toContain('title="The last deploy failed"');
    const theirs = await head(reader);
    expect(theirs).toContain("not up");
    expect(theirs).toContain("the deploy failed: &lt;install&gt; exited 1");
    expect(theirs).toContain(`href="/alice/notes/runs/${deploy}"`);
    expect(theirs).not.toContain("/app/production/redeploy");
    expect(theirs).not.toContain("/app/production/stop");
    expect(theirs).not.toContain('href="/alice/notes/app/production/open"');
  });
  // Issue #201: the shelf used to print the runtime's raw `EnvState` for a
  // failed or deploying production, disagreeing with the app's own head
  // above — which has always spoken the studio's five-ish words.
  test("a failed production reads 'not up' on the home shelf too, never the runtime's own word 'failed'", async () => {
    put({
      lastError: "the deploy failed: <install> exited 1",
      lastRunId: deploy,
    });
    expect(await shelfBadge(writer)).toBe("not up");
  });
  test("a stopped production says it is not running and offers Redeploy, not Stop — and no live link to the host", async () => {
    put({ lastRunId: deploy });
    const mine = await head(writer);
    expect(mine).toContain("not running");
    expect(mine).toContain('action="/alice/notes/app/production/redeploy"');
    expect(mine).not.toContain('action="/alice/notes/app/production/stop"');
    expect(mine).not.toContain('href="/alice/notes/app/production/open"');
    expect(mine).toContain('title="Not running"');
    expect(await shelfBadge(writer)).toBe("not running");
  });
  test("a deploying production says so where the button was, not a link to a host nothing is serving yet", async () => {
    put({
      deploying: { run: { id: deploy, commitOid: "0".repeat(40) } },
    });
    const mine = await head(writer);
    expect(mine).toContain("starting");
    expect(mine).not.toContain('href="/alice/notes/app/production/open"');
    expect(mine).toContain('title="Still deploying"');
    // The runtime's own word for this state is "deploying" — the shelf
    // says "starting" instead, same as the head above.
    expect(await shelfBadge(writer)).toBe("starting");
  });
  test("a serving app with red tests still reads as serving, with the failure in its own words, and is still open-able", async () => {
    put({
      live: {
        commitOid: "0".repeat(40),
        handle: { port: 4321 },
        runId: deploy,
        since: new Date(Date.now() - 60_000).toISOString(),
        testsFailed: "1 of 3 tests failed",
        manifest: { tty: null },
      },
    });
    const mine = await head(writer);
    expect(mine).toContain("serving · tests failed");
    expect(mine).not.toContain("not up");
    expect(mine).toContain("serving · tests failed: 1 of 3 tests failed");
    expect(mine).toContain('href="/alice/notes/app/production/open"');
    expect(await shelfBadge(writer)).toBe("serving · tests failed");
  });
  test("a newer push that failed to come up while an older deploy keeps serving: live, not plain green, both commits named, its run linked", async () => {
    const failed = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "2".repeat(40),
      reason: "push",
    });
    claimRun(app.db, failed.id);
    finishRun(app.db, failed.id, {
      state: "failed",
      summary: "forge.json: JSON Parse error: Unexpected token '}'",
    });
    put({
      live: {
        commitOid: "1".repeat(40),
        handle: { port: 4321 },
        runId: deploy,
        since: new Date(Date.now() - 60_000).toISOString(),
        manifest: { tty: null },
      },
      lastError: "forge.json: JSON Parse error: Unexpected token '}'",
      lastRunId: failed.id,
      lastErrorCommitOid: "2".repeat(40),
    });
    const mine = await head(writer);
    // It answers — still "live", never "not up" — but not untroubled green.
    expect(mine).toContain("live");
    expect(mine).not.toContain("not up");
    expect(mine).toContain('href="/alice/notes/app/production/open"');
    // Both commits, named.
    expect(mine).toContain("1111111");
    expect(mine).toContain("2222222");
    expect(mine).toContain("did not come up");
    expect(mine).toContain(
      "forge.json: JSON Parse error: Unexpected token &#39;}&#39;",
    );
    // The failed run's log, one click away.
    expect(mine).toContain(`href="/alice/notes/runs/${failed.id}"`);
  });
  test("a clean deploy with no failure behind it is unchanged: plain live, no failed-run link", async () => {
    put({
      live: {
        commitOid: "1".repeat(40),
        handle: { port: 4321 },
        runId: deploy,
        since: new Date(Date.now() - 60_000).toISOString(),
        manifest: { tty: null },
      },
    });
    const mine = await head(writer);
    expect(mine).toContain("live");
    expect(mine).not.toContain("did not come up");
  });
});
/**
 * The studio app page's Terminal — the one door an operator has into what
 * is running. `terminalFor` (`src/actions/apps.ts`) is the single fact both
 * this page and the dev App page read; this only checks it is drawn (or
 * withheld) correctly, not recomputed.
 */
describe("the studio app page's terminal", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let record: AppRecord;
  let runtime: AppsRuntime;
  let writer: string;
  let reader: string;
  interface Slot {
    readonly app: AppRecord;
    readonly env: EnvName;
    readonly chain: Promise<void>;
    readonly restarts: number[];
    readonly live?: unknown;
  }
  const putLive = (tty: string | null): void => {
    (runtime as unknown as { envs: Map<string, Slot> }).envs.set(
      `${record.id}/production`,
      {
        app: record,
        env: "production",
        chain: Promise.resolve(),
        restarts: [],
        live: {
          commitOid: "a".repeat(40),
          handle: { port: 4321 },
          runId: "fake",
          since: new Date().toISOString(),
          manifest: { tty },
        },
      },
    );
  };
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const appPage = (cookie: string) =>
    fetch(`${base}/alice/beacon`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    }).then((r) => r.text());
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-terminal-"));
    app = createApp({ dataDir, port: 0, host: "forge.example" });
    app.config.sshPort = 2222;
    app.config.sshHostKey =
      "SHA256:abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG";
    servers = await serve(app);
    base = servers.url;
    runtime = new AppsRuntime(app, {
      domain: "apps.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    const b = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!b.ok) throw new Error(b.error);
    writer = await signIn("alice");
    reader = await signIn("bob");
    const made = await createRepo(app, a.value, {
      name: "beacon",
      visibility: "public",
      description: "a light that stays on",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "beacon\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "beacon" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    record = getAppByRepo(app.db, repo.id)!;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a writer sees the exact command and the host key; a reader sees neither", async () => {
    putLive("bun run src/tty.ts");
    const mine = await appPage(writer);
    expect(mine).toContain("ssh -p 2222 [email protected]");
    expect(mine).toContain("host key SHA256:abcdefghijklmnopqrstuvwxyz");
    // Wrapped in the marker an email-scanning edge honours, so the
    // login@host in the command is never rewritten into a mailto: link —
    // and the command itself sits between the markers unchanged.
    expect(mine).toContain(
      "<!--email_off-->ssh -p 2222 [email protected]<!--/email_off-->",
    );
    const theirs = await appPage(reader);
    expect(theirs).not.toContain("ssh -p 2222 [email protected]");
    expect(theirs).not.toContain("The terminal is off");
  });
  test("an app with no tty says the terminal is off, to a writer only", async () => {
    putLive(null);
    const mine = await appPage(writer);
    expect(mine).toContain("The terminal is off");
    expect(mine).not.toContain("ssh -p 2222 [email protected]");
    const theirs = await appPage(reader);
    expect(theirs).not.toContain("The terminal is off");
  });
  // Issue #283: a hosted forge (an app of another forge) defaults
  // FORGE_SSH_PORT to 0, so serve() never opens a listener — every app on
  // it declares a tty but has nothing to connect it to. The generic "The
  // terminal is off." leaves a reader with no idea why or what to do; this
  // asserts the line names FORGE_SSH_PORT instead, composed from the same
  // sshPort field the other tests here already pin (#77's ground) rather
  // than by shutting a real listener down.
  test("a hosted forge with no SSH listener says why, and names FORGE_SSH_PORT", async () => {
    putLive("bun run src/tty.ts");
    app.config.sshPort = 0;
    try {
      const mine = await appPage(writer);
      expect(mine).toContain("FORGE_SSH_PORT");
      expect(mine).not.toContain("ssh -p 2222 [email protected]");
      expect(mine).not.toContain("The terminal is off.</p>");
    } finally {
      app.config.sshPort = 2222;
    }
  });
});
/**
 * GET /:owner/:name/app/state — the fragment the studio page's live client
 * fetches on a deploy run event, and swaps into `#app-head`/`#app-previews`
 * in place of a reload. It is authorized exactly as the studio page, and
 * renders from the same `appPanels` function the page's first paint does.
 */
describe("the app's live fragment: /:owner/:name/app/state", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let runtime: AppsRuntime;
  let repo: Repo;
  let record: AppRecord;
  let owner: string;
  let stranger: string;
  interface PreviewSlot {
    readonly app: AppRecord;
    readonly env: EnvName;
    readonly chain: Promise<void>;
    readonly restarts: number[];
    deploying?: unknown;
    live?: unknown;
    lastError?: string;
    lastRunId?: string;
  }
  const putEnv = (
    env: EnvName,
    slot: Omit<PreviewSlot, "app" | "env" | "chain" | "restarts">,
  ): void => {
    (runtime as unknown as { envs: Map<string, PreviewSlot> }).envs.set(
      `${record.id}/${env}`,
      { app: record, env, chain: Promise.resolve(), restarts: [], ...slot },
    );
  };
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-state-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    runtime = new AppsRuntime(app, {
      domain: "state.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    const c = await createUser(app.db, { trusted: true,
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!c.ok) throw new Error(c.error);
    owner = await signIn("alice");
    stranger = await signIn("carol");
    const made = await createRepo(app, a.value, {
      name: "vault",
      visibility: "private",
      description: "",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "v\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "vault" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    record = getAppByRepo(app.db, repo.id)!;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("renders the head card for a viewer who may see it, with the security floor's headers; refuses one who may not, same as the page", async () => {
    const fragment = await get("/alice/vault/app/state", owner);
    expect(fragment.status).toBe(200);
    expect(fragment.headers.get("x-content-type-options")).toBe("nosniff");
    expect(fragment.headers.get("referrer-policy")).toBe("same-origin");
    const text = await fragment.text();
    expect(text).toContain('id="app-head"');
    expect(text).toContain('id="app-previews"');
    expect(text).toContain("not running");
    const page = await (await get("/alice/vault", owner)).text();
    expect(page).toContain("not running");
    const refusedFragment = await get("/alice/vault/app/state", stranger);
    expect(refusedFragment.status).toBe(404);
    const refusedPage = await get("/alice/vault", stranger);
    expect(refusedPage.status).toBe(404);
  });
  test("a change's page has a state fragment of its own: its current word, drawn by the page's own function, refused to whoever the page refuses, and named by the client script (#1094)", async () => {
    const branch = await commitToBranch(app, getUserByName(app.db, "alice")!, repo, {
      branch: "feature/ship-it",
      base: "main",
      message: "Ship it",
      files: [{ path: "SHIP.md", content: "ship\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, getUserByName(app.db, "alice")!, repo, {
      title: "Ship it",
      body: "",
      baseBranch: "main",
      headBranch: "feature/ship-it",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const n = opened.value.number;
    const fragment = await get(`/alice/vault/pulls/${n}/state`, owner);
    expect(fragment.status).toBe(200);
    expect(fragment.headers.get("x-content-type-options")).toBe("nosniff");
    expect(fragment.headers.get("referrer-policy")).toBe("same-origin");
    const text = await fragment.text();
    expect(text).toContain('id="pull-check"');
    expect(text).toContain('id="pull-preview"');
    expect(text).toContain("studio-pull-check");
    // The page's first paint carries the very same check line.
    const pageText = await (await get(`/alice/vault/pulls/${n}`, owner)).text();
    const line = (t: string) =>
      t.match(/<p[^>]*studio-pull-check[^>]*>[\s\S]*?<\/p>/)?.[0];
    expect(line(text)).toBeDefined();
    expect(line(pageText)).toBe(line(text));
    expect(pageText).toContain('id="pull-check"');
    expect(pageText).toContain('data-head="');
    expect((await get(`/alice/vault/pulls/${n}/state`, stranger)).status).toBe(404);
    expect((await get(`/alice/vault/pulls/999/state`, owner)).status).toBe(404);
    const merged = await mergePull(app, getUserByName(app.db, "alice")!, repo, opened.value, "squash");
    if (!merged.ok) throw new Error(String(merged.error));
    const after = await (await get(`/alice/vault/pulls/${n}/state`, owner)).text();
    expect(line(after)).not.toBe(line(text));
    // The squash lands a new commit; the fragment names it, so a page that
    // saw the merge live can match production's serving against it.
    const headOf = (t: string) => t.match(/data-head="([0-9a-f]{40})"/)?.[1];
    expect(headOf(text)).toBeDefined();
    expect(headOf(after)).toBeDefined();
    expect(headOf(after)).not.toBe(headOf(text));
    expect(liveClientJs).toContain("#pull-check [data-head]");
    expect(liveClientJs).toContain("'/pulls/' + number + '/state'");
    expect(liveClientJs).toContain("'pull.merged'");
    expect(liveClientJs).toContain("'app.serving'");
  });
  test("Now has an address of its own: the page's region names it, the fragment answers with the same region, and unchanged bytes come back 304", async () => {
    const page = await (await get("/alice/vault", owner)).text();
    expect(page).toContain('id="live-now"');
    expect(page).toContain('data-live-src="/alice/vault/app/now"');
    const first = await get("/alice/vault/app/now", owner);
    expect(first.status).toBe(200);
    expect(first.headers.get("x-content-type-options")).toBe("nosniff");
    expect(first.headers.get("cache-control")).toBe("no-store");
    const etag = first.headers.get("etag");
    expect(etag).toMatch(/^"[0-9a-f]{16}"$/);
    const text = await first.text();
    // The tag rides in the markup as well, for a proxy that drops the header.
    expect(text).toMatch(/^\s*<div data-etag="[0-9a-f]{16}"/);
    expect(`"${/data-etag="([0-9a-f]{16})"/.exec(text)![1]}"`).toBe(etag!);
    expect(text).toContain('id="live-now"');
    expect(text).toContain('data-live="run.*,pull.*,issue.*"');
    expect(text).toContain('data-live-src="/alice/vault/app/now"');
    expect(text).toContain("<h2>Now</h2>");
    // The same bytes again: nothing to paint, and nothing sent to paint.
    const again = await fetch(`${base}/alice/vault/app/now`, {
      headers: {
        cookie: `${owner}; forge_mode=studio`,
        "if-none-match": etag!,
      },
    });
    expect(again.status).toBe(304);
    expect(again.headers.get("etag")).toBe(etag);
    expect(await again.text()).toBe("");
    // A stale tag is answered in full.
    const stale = await fetch(`${base}/alice/vault/app/now`, {
      headers: { cookie: `${owner}; forge_mode=studio`, "if-none-match": '"0"' },
    });
    expect(stale.status).toBe(200);
    expect(await stale.text()).toContain("<h2>Now</h2>");
    expect((await get("/alice/vault/app/now", stranger)).status).toBe(404);
    expect((await fetch(`${base}/alice/vault/app/now`)).status).toBe(404);
  });
  test("a preview flips from deploying to live between two calls, and the link stays correct", async () => {
    const alice = getUserByName(app.db, "alice")!;
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/x",
      base: repo.defaultBranch,
      message: "Add X",
      files: [{ path: "X.md", content: "x\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Add X",
      body: "",
      baseBranch: repo.defaultBranch,
      headBranch: "feature/x",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const env = previewEnv(pull.number);
    const link = `href="/alice/vault/app/${env}/open"`;
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env,
      commitOid: pull.headOid,
      reason: "pull",
    });
    claimRun(app.db, deployRun.id);
    putEnv(env, {
      deploying: {
        run: { id: deployRun.id, commitOid: pull.headOid },
        abort: new AbortController(),
      },
    });
    const starting = await (await get("/alice/vault/app/state", owner)).text();
    expect(starting).toContain("starting");
    expect(starting).not.toContain(">live<");
    expect(starting).toContain(link);
    finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" });
    putEnv(env, {
      live: {
        commitOid: pull.headOid,
        handle: { port: 4321 },
        runId: deployRun.id,
        since: new Date().toISOString(),
        manifest: { tty: null },
      },
    });
    const live = await (await get("/alice/vault/app/state", owner)).text();
    expect(live).not.toContain("starting");
    expect(live).toContain(">live<");
    expect(live).toContain(link);
  });
  test("the fragment's markup is what the live client's status announcement reads: the head's word in a badge, a preview row's word beside its `#N title`", async () => {
    // `live.ts`'s `announceSwap` finds the head's word at `.studio-head
    // .badge` and, for a preview row, the pull's label at the start of
    // `.row-meta` beside its word at `.row-trail .badge`. If this markup
    // ever moves, the announcement goes silent without a test failing here.
    const text = await (await get("/alice/vault/app/state", owner)).text();
    expect(text).toContain("studio-head");
    expect(text).toMatch(/studio-head[\s\S]*?class="badge"[^>]*>not running</);
    const alice = getUserByName(app.db, "alice")!;
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/announce",
      base: repo.defaultBranch,
      message: "Add Y",
      files: [{ path: "Y.md", content: "y\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Add Y",
      body: "",
      baseBranch: repo.defaultBranch,
      headBranch: "feature/announce",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const env = previewEnv(pull.number);
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env,
      commitOid: pull.headOid,
      reason: "pull",
    });
    claimRun(app.db, deployRun.id);
    finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" });
    putEnv(env, {
      live: {
        commitOid: pull.headOid,
        handle: { port: 4323 },
        runId: deployRun.id,
        since: new Date().toISOString(),
        manifest: { tty: null },
      },
    });
    const withPreview = await (
      await get("/alice/vault/app/state", owner)
    ).text();
    const label = `#${pull.number} Add Y`;
    expect(withPreview).toContain(`class="row-meta"`);
    expect(withPreview).toContain(`class="row-trail"`);
    expect(withPreview).toContain(label);
    expect(
      new RegExp(`${label}[\\s\\S]*?class="row-trail"[\\s\\S]*?>live<`).test(
        withPreview,
      ),
    ).toBe(true);
  });
  test("the head measures from the push, not from the permit it waited for: a deploy queued 5s reads 6.0s after the push and names the wait", async () => {
    const createdAt = new Date(Date.now() - 20_000).toISOString();
    const deployStartedAt = new Date(
      Date.parse(createdAt) + 5_000,
    ).toISOString();
    const servingAt = new Date(
      Date.parse(deployStartedAt) + 1_000,
    ).toISOString();
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "cafebabe",
      reason: "push",
    });
    claimRun(app.db, deployRun.id);
    finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" });
    putEnv("production", {
      live: {
        commitOid: "cafebabe",
        handle: { port: 4322 },
        runId: deployRun.id,
        since: servingAt,
        servingAt,
        createdAt,
        deployStartedAt,
        manifest: { tty: null },
      },
    });
    const head = await (await get("/alice/vault/app/state", owner)).text();
    expect(head).toContain("live 6.0s after the push · 5.0s queued");
    expect(head).not.toContain("1.0s after the push");
    // The same deployment with no wait for a permit says only the one
    // number, exactly as it always has.
    putEnv("production", {
      live: {
        commitOid: "cafebabe",
        handle: { port: 4322 },
        runId: deployRun.id,
        since: servingAt,
        servingAt,
        createdAt: deployStartedAt,
        deployStartedAt,
        manifest: { tty: null },
      },
    });
    const prompt = await (await get("/alice/vault/app/state", owner)).text();
    expect(prompt).toContain("live 1.0s after the push");
    expect(prompt).not.toContain("queued");
    // A deploy no push asked for — a redeploy someone pressed — carries no
    // push instant, and its words never claim one.
    putEnv("production", {
      live: {
        commitOid: "cafebabe",
        handle: { port: 4322 },
        runId: deployRun.id,
        since: servingAt,
        servingAt,
        deployStartedAt,
        manifest: { tty: null },
      },
    });
    const pressed = await (await get("/alice/vault/app/state", owner)).text();
    expect(pressed).toContain("live 1.0s after the deploy started");
    expect(pressed).not.toContain("after the push");
  });
  test("app.serving reaches the repo's stream with the shape the live client keys on, the instant the swap-in happens — before its run has finished", async () => {
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "deadbeef",
      reason: "push",
    });
    claimRun(app.db, deployRun.id);
    const served = markServing(app.db, deployRun.id);
    expect(served?.servingAt).toBeDefined();
    const stream = await fetch(`${base}/alice/vault/stream`, {
      headers: { cookie: owner },
    });
    await Bun.sleep(50);
    // The exact append `AppsRuntime` makes at the swap-in (runtime.ts),
    // republished here so the test does not have to spin up a real deploy.
    app.bus.append({
      kind: "app.serving",
      repoId: repo.id,
      payload: {
        app: record.slug,
        env: "production",
        commitOid: deployRun.commitOid,
        servingAt: served!.servingAt,
        testsRunning: true,
      },
    });
    const reader = stream.body!.getReader();
    const decoder = new TextDecoder();
    let buffer = "";
    let event: Record<string, unknown> | undefined;
    const deadline = Date.now() + 5_000;
    while (!event && Date.now() < deadline) {
      const { done, value } = await reader.read();
      if (done) break;
      buffer += decoder.decode(value);
      const frames = buffer.split("\n\n");
      buffer = frames.pop() ?? "";
      for (const frame of frames) {
        if (!/^event: app\.serving$/m.test(frame)) continue;
        const data = /^data: (.*)$/m.exec(frame)?.[1];
        if (data !== undefined) event = JSON.parse(data);
      }
    }
    await reader.cancel().catch(() => {});
    expect(event).toBeDefined();
    expect(event?.["kind"]).toBe("app.serving");
    const payload = event?.["payload"] as Record<string, unknown>;
    expect(payload["app"]).toBe(record.slug);
    expect(payload["env"]).toBe("production");
    expect(payload["commitOid"]).toBe(deployRun.commitOid);
    expect(payload["servingAt"]).toBe(served!.servingAt);
    expect(payload["testsRunning"]).toBe(true);
    // finishRun never ran: run.finished has not fired, yet app.serving
    // already has. That gap is the whole point of the issue.
    expect(getRun(app.db, deployRun.id)?.state).toBe("running");
  });
  test("production's Open the app link appears only once it is serving, and the fragment after a swap flips it", async () => {
    const link = 'href="/alice/vault/app/production/open"';
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "cafed00d",
      reason: "push",
    });
    claimRun(app.db, deployRun.id);
    putEnv("production", {
      deploying: {
        run: { id: deployRun.id, commitOid: "cafed00d" },
        abort: new AbortController(),
      },
    });
    const deploying = await (await get("/alice/vault/app/state", owner)).text();
    expect(deploying).toContain("starting");
    expect(deploying).not.toContain(link);
    finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" });
    putEnv("production", {
      live: {
        commitOid: "cafed00d",
        handle: { port: 4325 },
        runId: deployRun.id,
        since: new Date().toISOString(),
        manifest: { tty: null },
      },
    });
    const serving = await (await get("/alice/vault/app/state", owner)).text();
    expect(serving).toContain(">live<");
    expect(serving).toContain(link);
  });
  test("a preview row says how fast it got there in envFacts' own words, links its deploy run, and keeps its link and sentence while deploying or after its tests failed", async () => {
    const alice = getUserByName(app.db, "alice")!;
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/fast",
      base: repo.defaultBranch,
      message: "Add F",
      files: [{ path: "F.md", content: "f\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Add F",
      body: "",
      baseBranch: repo.defaultBranch,
      headBranch: "feature/fast",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const env = previewEnv(pull.number);
    const open = `href="/alice/vault/app/${env}/open"`;
    const label = `#${pull.number} Add F`;
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env,
      commitOid: pull.headOid,
      reason: "pull",
    });
    const runLink = `href="/alice/vault/runs/${deployRun.id}"`;
    // This pull's own row out of the previews panel, so nothing the head
    // card or another pull's row says can pass for it.
    const rowOf = (text: string): string => {
      const panel = text.slice(text.indexOf('id="app-previews"'));
      const at = panel.indexOf(label);
      expect(at).toBeGreaterThan(-1);
      return panel.slice(panel.lastIndexOf("<li>", at), panel.indexOf("</li>", at));
    };
    claimRun(app.db, deployRun.id);
    putEnv(env, {
      deploying: {
        run: { id: deployRun.id, commitOid: pull.headOid },
        abort: new AbortController(),
      },
    });
    const deploying = rowOf(
      await (await get("/alice/vault/app/state", owner)).text(),
    );
    expect(deploying).toContain(open);
    expect(deploying).toContain(runLink);
    expect(deploying).toContain("deploy in progress");
    expect(deploying).not.toContain("after the push");
    expect(deploying).not.toContain("0.0s");
    finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" });
    const createdAt = new Date(Date.now() - 60_000).toISOString();
    const servingAt = new Date(Date.parse(createdAt) + 3_400).toISOString();
    putEnv(env, {
      live: {
        commitOid: pull.headOid,
        handle: { port: 4324 },
        runId: deployRun.id,
        since: servingAt,
        servingAt,
        createdAt,
        deployStartedAt: createdAt,
        manifest: { tty: null },
      },
    });
    const live = rowOf(await (await get("/alice/vault/app/state", owner)).text());
    expect(live).toContain(open);
    expect(live).toContain("live 3.4s after the push");
    expect(live).toContain(pull.headOid.slice(0, 7));
    expect(live).toContain(runLink);
    expect(live).toContain(">live<");
    // The live client keys its announcement on the meta line's first words.
    expect(live).toMatch(new RegExp(`class="row-meta">#${pull.number} Add F ·`));
    // The page's first paint draws the same row.
    expect(await (await get("/alice/vault", owner)).text()).toContain(
      "live 3.4s after the push",
    );
    putEnv(env, {
      live: {
        commitOid: pull.headOid,
        handle: { port: 4324 },
        runId: deployRun.id,
        since: servingAt,
        servingAt,
        createdAt,
        deployStartedAt: createdAt,
        testsFailed: "2 failing",
        manifest: { tty: null },
      },
    });
    const red = rowOf(await (await get("/alice/vault/app/state", owner)).text());
    expect(red).toContain(open);
    expect(red).toContain(runLink);
    expect(red).toContain("serving · tests failed: 2 failing");
    expect(red).toContain("live 3.4s after the push");
    // One badge, not green, and the row still links to the preview.
    expect(red).toMatch(/data-variant="attn"[^]*?serving · tests failed<\/span/);
    expect(red).not.toContain('data-variant="success"');
    expect(red).not.toContain(">live<");
    putEnv(env, {
      deploying: {
        run: { id: deployRun.id, commitOid: pull.headOid },
        abort: new AbortController(),
      },
      live: {
        commitOid: pull.headOid,
        handle: { port: 4324 },
        runId: deployRun.id,
        since: servingAt,
        servingAt,
        createdAt,
        deployStartedAt: createdAt,
        manifest: { tty: null },
      },
    });
    const verifying = rowOf(
      await (await get("/alice/vault/app/state", owner)).text(),
    );
    expect(verifying).toContain(open);
    expect(verifying).toContain("serving · verifying</span");
    expect(verifying).not.toContain('data-variant="success"');
    expect(verifying).not.toContain('data-variant="attn"');
    putEnv(env, {
      live: {
        commitOid: pull.headOid,
        handle: { port: 4324 },
        runId: deployRun.id,
        since: servingAt,
        manifest: { tty: null },
      },
    });
    const unmeasured = rowOf(
      await (await get("/alice/vault/app/state", owner)).text(),
    );
    expect(unmeasured).toContain(open);
    expect(unmeasured).not.toContain("after the");
    expect(unmeasured).not.toContain("0.0s");
  });
});
/**
 * On its own: the slots line counts what the loop counts — the builders —
 * while Now still shows every run in flight, review and plan included.
 */
@@ -0,0 +1,1953 @@
/**
 * The studio: slot counts, words from facts, a run's page, the tails, and
 * what the front door calls news. One of the files the studio's suite was
 * split into so no one file sets the gate's floor (#2038); the rest are
 * test/studio*.test.ts.
 */
import { afterAll, beforeAll, describe, expect, spyOn, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { enableApp } from "../src/actions/apps.ts";
import type { EnvName } from "../src/apps/data.ts";
import { AppsRuntime } from "../src/apps/runtime.ts";
import { getAppByRepo, type AppRecord } from "../src/core/apps.ts";
import { addToCrew, createAgent } from "../src/actions/crew.ts";
import { assignIssue, openIssue } from "../src/actions/issues.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import {
  commitToBranch,
  createRepo,
  updateRepoSettings,
} from "../src/actions/repos.ts";
import { setCrewRole } from "../src/core/agents.ts";
import type { Issue } from "../src/core/issues.ts";
import { getPull, type Pull } from "../src/core/pulls.ts";
import type { Repo } from "../src/core/repos.ts";
import {
  claimRun,
  createRun,
  finishRun,
  getRun,
  markServing,
  noteRunProgress,
  type Run,
} from "../src/core/runs.ts";
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import {
  pullWord,
  runWord,
  servingHistory,
  type WordCtx,
} from "../src/web/studio/words.ts";
import { repoDir } from "../src/git/repos.ts";
import { appendRunLog } from "../src/runs/log.ts";
import { serving } from "./helpers/studio.ts";
describe("the studio's slot count", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let cookie: string;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-slots-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    const alice = a.value;
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "loom",
      visibility: "private",
      description: "a place for cloth",
    });
    if (!made.ok) throw new Error(String(made.error));
    const repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "# loom\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "loom" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    for (const name of ["brick", "quill", "chart"]) {
      const agent = await createAgent(app, alice, { username: name });
      if (!agent.ok) throw new Error(String(agent.error));
      expect(addToCrew(app, alice, repo, name).ok).toBe(true);
    }
    const reviewer = getUserByName(app.db, "quill")!;
    const planner = getUserByName(app.db, "chart")!;
    setCrewRole(app.db, repo.id, reviewer.id, "reviewer");
    setCrewRole(app.db, repo.id, planner.id, "planner");
    const on = await updateRepoSettings(app, alice, repo, {
      autonomy: "autonomous",
      autonomyDirection: "",
      autonomyCeilingUsd: 10,
      autonomySlots: 2,
      autonomyBy: alice.id,
    });
    expect(on.ok).toBe(true);
    // One builder building, one reviewer reviewing, one planner planning.
    const inFlight: [string, User, string][] = [
      ["Warp the loom", getUserByName(app.db, "brick")!, "assigned"],
      ["Look at the shuttle", reviewer, "review"],
      ["Plan the next cloth", planner, "assigned"],
    ];
    for (const [title, actor, reason] of inFlight) {
      const issue = openIssue(app, alice, repo, { title });
      if (!issue.ok) throw new Error(String(issue.error));
      const run = createRun(app.db, {
        repoId: repo.id,
        kind: "agent",
        issueId: issue.value.id,
        actorId: actor.id,
        reason,
      });
      claimRun(app.db, run.id);
    }
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("reads 1 of 2 in use with three runs in flight, and Now still lists all three", async () => {
    const page = await (
      await fetch(`${base}/alice/loom`, {
        headers: { cookie: `${cookie}; forge_mode=studio` },
        redirect: "manual",
      })
    ).text();
    expect(page).toContain("1 of 2 in use");
    expect(page).not.toContain("3 of 2");
    expect(page).not.toContain("2 of 2");
    // The runs that take no slot are not hidden: Now has all of them.
    expect(page).toContain("Warp the loom");
    expect(page).toContain("Look at the shuttle");
    expect(page).toContain("Plan the next cloth");
  });
});
describe("words come from facts, not from run.summary", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let runtime: AppsRuntime;
  let repo: Repo;
  let record: AppRecord;
  let alice: User;
  let wordCtx: WordCtx;
  let seededCommit: string;
  const put = (live?: { commitOid: string; state?: "failed" }): void => {
    const envs = (runtime as unknown as { envs: Map<string, unknown> }).envs;
    envs.set(`${record.id}/production`, {
      app: record,
      env: "production",
      chain: Promise.resolve(),
      restarts: [],
      ...(live?.state === "failed"
        ? { lastError: "the deploy failed" }
        : live
          ? {
              live: {
                commitOid: live.commitOid,
                handle: { port: 4321 },
                runId: "fake",
                since: new Date().toISOString(),
                manifest: { tty: null },
              },
            }
          : {}),
    });
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-words-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    runtime = new AppsRuntime(app, {
      domain: "words.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    const made = await createRepo(app, alice, {
      name: "wordsapp",
      visibility: "private",
      description: "",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "start\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    seededCommit = seeded.value.commitOid;
    const enabled = await enableApp(app, alice, repo, { slug: "wordsapp" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    record = getAppByRepo(app.db, repo.id)!;
    wordCtx = {
      db: app.db,
      dir: repoDir(app.reposRoot, repo.ownerName, repo.name),
      runtime,
      record,
      history: servingHistory(),
      // The owner reads it: production's facts are theirs to see.
      viewer: alice,
    };
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a merged pull whose production deploy has not yet served does not say shipped, and says so once it has", async () => {
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/word",
      base: "main",
      message: "Add a word",
      files: [{ path: "WORD.md", content: "word\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Add a word",
      body: "",
      baseBranch: "main",
      headBranch: "feature/word",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const merged = await mergePull(app, alice, repo, opened.value, "squash");
    if (!merged.ok) throw new Error(String(merged.error));
    const pull = getPull(app.db, repo.id, opened.value.number)!;
    expect(pull.mergedOid).not.toBeNull();
    // Production is still on the commit before the merge: not shipped.
    put({ commitOid: seededCommit });
    const notYet = await pullWord(wordCtx, pull);
    expect(notYet.word).not.toBe("shipped");
    // Production has caught up to the merge commit: shipped, live.
    put({ commitOid: pull.mergedOid! });
    const now = await pullWord(wordCtx, pull);
    expect(now.word).toBe("shipped");
  });
  test("a page of merged pulls asks git about production once, however many rows (#285)", async () => {
    const pulls: Pull[] = [];
    for (let i = 0; i < 5; i++) {
      const branch = await commitToBranch(app, alice, repo, {
        branch: `feature/many-${i}`,
        base: "main",
        message: `Many ${i}`,
        files: [{ path: `MANY-${i}.md`, content: `${i}\n` }],
      });
      if (!branch.ok) throw new Error(JSON.stringify(branch.error));
      const opened = await openPull(app, alice, repo, {
        title: `Many ${i}`,
        body: "",
        baseBranch: "main",
        headBranch: `feature/many-${i}`,
      });
      if (!opened.ok) throw new Error(String(opened.error));
      const merged = await mergePull(app, alice, repo, opened.value, "squash");
      if (!merged.ok) throw new Error(String(merged.error));
      pulls.push(getPull(app.db, repo.id, opened.value.number)!);
    }
    // Every git process spawned while one page's words are decided.
    const spawned: string[] = [];
    const original = Bun.spawn.bind(Bun);
    const spy = spyOn(Bun, "spawn").mockImplementation(((
      cmd: string[],
      options: never,
    ) => {
      if (cmd[0] === "git") spawned.push(cmd.slice(1).join(" "));
      return original(cmd, options);
    }) as unknown as typeof Bun.spawn);
    const wordsOfOnePage = async (): Promise<string[]> => {
      const page: WordCtx = { ...wordCtx, history: servingHistory() };
      const words = await Promise.all(pulls.map((p) => pullWord(page, p)));
      return words.map((w) => w.word);
    };
    try {
      // Production at the second merge: that one and the one before it are
      // shipped (ancestry, not equality), the three after it are not.
      put({ commitOid: pulls[1]!.mergedOid! });
      expect(await wordsOfOnePage()).toEqual([
        "shipped",
        "shipped",
        "waiting",
        "waiting",
        "waiting",
      ]);
      expect(spawned).toHaveLength(1);
      // A new page is a new question: the deploy that just landed is seen.
      spawned.length = 0;
      put({ commitOid: pulls[4]!.mergedOid! });
      expect(new Set(await wordsOfOnePage())).toEqual(new Set(["shipped"]));
      expect(spawned).toHaveLength(1);
    } finally {
      spy.mockRestore();
    }
  });
  test("an agent run that opened no pull and pushed nothing is not shipped", async () => {
    const told = await openIssue(app, alice, repo, {
      title: "Write a plan",
      body: "",
    });
    if (!told.ok) throw new Error(String(told.error));
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: told.value.id,
      branch: "scout/999-a-branch-nothing-used",
      actorId: alice.id,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    const finished = finishRun(app.db, run.id, {
      state: "ok",
      summary: "wrote docs/PLAN.md",
    });
    const word = await runWord(wordCtx, finished!);
    expect(word.word).not.toBe("shipped");
    expect(word.word).toBe("planned");
    expect(word.note).toBe("wrote docs/PLAN.md");
  });
  test("a deploy serving with failed tests is not shipped", async () => {
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/preview",
      base: "main",
      message: "Preview",
      files: [{ path: "PREVIEW.md", content: "preview\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Preview",
      body: "",
      baseBranch: "main",
      headBranch: "feature/preview",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const deploy = createRun(app.db, {
      repoId: repo.id,
      kind: "check",
      issueId: pull.id,
      env: `pull-${pull.number}`,
      commitOid: pull.headOid,
      reason: "pull",
    });
    claimRun(app.db, deploy.id);
    markServing(app.db, deploy.id);
    finishRun(app.db, deploy.id, {
      state: "failed",
      summary: "test: 1 of 3 tests failed",
    });
    const word = await pullWord(
      wordCtx,
      getPull(app.db, repo.id, pull.number)!,
    );
    expect(word.word).not.toBe("shipped");
    expect(word.note).toBe("serving, but the check failed");
  });
});
/**
 * Working, on its own page: `/:owner/:name/runs/:id` in the studio names
 * the tell, the cost, and offers the steer box — same routes and checks as
 * dev's transcript, one click away at `?mode=dev`.
 */
describe("working: a run's own page in the studio", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let alice: User;
  let scoutId: string;
  let writerCookie: string;
  let readerCookie: string;
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-run-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    const b = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!b.ok) throw new Error(b.error);
    writerCookie = await signIn("alice");
    readerCookie = await signIn("bob");
    const made = await createRepo(app, a.value, {
      name: "engine",
      visibility: "private",
      description: "an app that builds",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "engine\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "engine" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const scout = await createAgent(app, a.value, { username: "scout" });
    if (!scout.ok) throw new Error(String(scout.error));
    scoutId = scout.value.user.id;
    expect(addToCrew(app, a.value, repo, "scout").ok).toBe(true);
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("the studio transcript names the tell, the cost, and the steer box", async () => {
    const tell = openIssue(app, alice, repo, {
      title: "Fix the flicker on load",
      body: "It flashes white before the page renders.",
    });
    if (!tell.ok) throw new Error(String(tell.error));
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: tell.value.id,
      actorId: scoutId,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    noteRunProgress(app.db, run.id, { costUsd: 0.42 });
    const page = await (
      await get(`/alice/engine/runs/${run.id}`, writerCookie)
    ).text();
    expect(page).toContain("Fix the flicker on load");
    // The tell it came from, in the studio's own noun (#158).
    expect(page).toContain(`href="/alice/engine/tells/${tell.value.number}"`);
    expect(page).toContain("$0.42 spent");
    expect(page).toContain('data-word="working"');
    // An agent's own run still speaks in the agent's name (#195).
    expect(page).toContain('data-who="scout"');
    expect(page).toContain('id="run-steer"');
    expect(page).toContain("Steer scout");
    expect(page).toContain('id="run-stop"');
    // The transcript is on the page, and there is no second reading of it.
    expect(page).toContain('id="run-log"');
    expect(page).not.toContain("?mode=dev");
  });
  test("a long transcript holds its last window, and the whole of it is one step deeper at ?all=1", async () => {
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      actorId: scoutId,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    for (let n = 0; n < 450; n++)
      appendRunLog(app.config.dataDir, run.id, `line number ${n}`);
    finishRun(app.db, run.id, { state: "ok", summary: "done" });
    const page = await (
      await get(`/alice/engine/runs/${run.id}`, writerCookie)
    ).text();
    expect(page).not.toContain("line number 0<");
    expect(page).toContain("line number 449");
    expect(page).toContain(`href="/alice/engine/runs/${run.id}?all=1"`);
    const all = await (
      await get(`/alice/engine/runs/${run.id}?all=1`, writerCookie)
    ).text();
    expect(all).toContain("line number 0<");
    expect(all).toContain("line number 449");
    // The depth step is refused exactly as the run is.
    const anon = await fetch(`${base}/alice/engine/runs/${run.id}?all=1`, {
      redirect: "manual",
    });
    expect(anon.status).toBe(404);
  });
  test("a reader without access gets the forge's not-found, exactly as dev", async () => {
    const tell = openIssue(app, alice, repo, { title: "Private work" });
    if (!tell.ok) throw new Error(String(tell.error));
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: tell.value.id,
      actorId: scoutId,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    const asReader = await get(`/alice/engine/runs/${run.id}`, readerCookie);
    expect(asReader.status).toBe(404);
  });
  test("a finished run renders in the studio's own word, with no Stop", async () => {
    const tell = openIssue(app, alice, repo, { title: "Tidy the footer" });
    if (!tell.ok) throw new Error(String(tell.error));
    const branch = await commitToBranch(app, alice, repo, {
      branch: "scout/tidy-the-footer",
      base: "main",
      message: "Tidy the footer",
      files: [{ path: "FOOTER.md", content: "tidy\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Tidy the footer",
      body: `Closes #${tell.value.number}`,
      baseBranch: "main",
      headBranch: "scout/tidy-the-footer",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    // The word comes from the pull this run actually produced (found by
    // its branch), not from parsing the summary below.
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: tell.value.id,
      branch: "scout/tidy-the-footer",
      actorId: scoutId,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    finishRun(app.db, run.id, {
      state: "ok",
      summary: `opened pull #${opened.value.number}`,
      costUsd: 0.1,
      turns: 4,
    });
    const page = await (
      await get(`/alice/engine/runs/${run.id}`, writerCookie)
    ).text();
    // The badge itself, not a stylesheet that happens to mention the word:
    // this read `data-word="look"` until the studio's rules moved out of the
    // page, and matched `.studio-list li[data-word="look"]` in the inline
    // <style>, never the badge. The pull has no deploy of this head, so its
    // word is `waiting` — and the point stands either way: the word came
    // from the pull found by branch, not from the summary (`planned` is what
    // a run with nothing to show would say).
    expect(page).toMatch(/data-word="waiting"\s+id="run-word"/);
    expect(page).not.toContain('data-word="planned"');
    expect(page).not.toContain('id="run-stop"');
    expect(page).not.toContain(">Stop<");
    expect(page).not.toContain(">Cancel run<");
  });
  test("a deploy's own run page speaks as the deploy, reads as done rather than planned, and prints a tenth for a sub-second run (#195)", async () => {
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "c740479",
      reason: "boot",
    });
    claimRun(app.db, run.id);
    appendRunLog(app.config.dataDir, run.id, "$ bun test");
    appendRunLog(app.config.dataDir, run.id, "bun test v1.3.14 (0d9b296a)");
    appendRunLog(
      app.config.dataDir,
      run.id,
      "(pass) the page knows who you are and offers the right door [3.61ms]",
    );
    finishRun(app.db, run.id, { state: "ok", summary: "deploy" });
    // A run that took 300ms — today's whole-second rounding reads "took 0s".
    app.db
      .query("UPDATE run SET started_at = ?2, finished_at = ?3 WHERE id = ?1")
      .run(run.id, "2024-01-01T00:00:00.000Z", "2024-01-01T00:00:00.300Z");
    const page = await (
      await get(`/alice/engine/runs/${run.id}`, writerCookie)
    ).text();
    // The deploy speaks for itself: the box, and every line in it — never
    // "an agent", which is nobody that was actually there.
    expect(page).toContain('data-who="the deploy"');
    expect(page).toContain('class="who">the deploy<');
    expect(page).not.toContain("an agent");
    // A deploy that finished with nothing else to show reads as done, not
    // as a run that has not started yet.
    expect(page).toContain('data-word="done"');
    expect(page).not.toContain('data-word="planned"');
    // Sub-second, in tenths — not rounded away to "took 0s".
    expect(page).toContain(">took 0.3s<");
  });
});
/**
 * Issue #88: the app's page tails the crew's log while it works — the last
 * handful of lines beside the running row, live, bounded, and with a
 * no-script fallback that behaves like the run page's own. Its own repo and
 * app, so no other test's still-running run ever counts as "the active run"
 * here.
 */
describe("the app's page tails the crew's log while it works", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let alice: User;
  let scoutId: string;
  let writerCookie: string;
  let readerCookie: string;
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-tail-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    const b = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!b.ok) throw new Error(b.error);
    writerCookie = await signIn("alice");
    readerCookie = await signIn("bob");
    const made = await createRepo(app, a.value, {
      name: "engine",
      visibility: "private",
      description: "an app that builds",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "engine\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "engine" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const scout = await createAgent(app, a.value, { username: "scout" });
    if (!scout.ok) throw new Error(String(scout.error));
    scoutId = scout.value.user.id;
    expect(addToCrew(app, a.value, repo, "scout").ok).toBe(true);
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("the app's page carries the tail of the active run's log, bounded, and refreshes without a script", async () => {
    const tell = openIssue(app, alice, repo, { title: "Speed up boot" });
    if (!tell.ok) throw new Error(String(tell.error));
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: tell.value.id,
      actorId: scoutId,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    for (let i = 0; i < 9; i++)
      appendRunLog(app.config.dataDir, run.id, `line ${i}`);
    const page = await (await get("/alice/engine", writerCookie)).text();
    expect(page).toContain('id="app-run-tail"');
    expect(page).toContain(
      `data-stream="/api/v1/repos/alice/engine/runs/${run.id}/log?follow=1"`,
    );
    // Bounded on the first paint too: only the last handful made it, and
    // the box says so.
    expect(page).not.toContain(">line 0<");
    expect(page).toContain(">line 8<");
    expect(page).toContain("Holding the last 6 lines here");
    // No script, no problem: the page keeps refreshing while the run goes.
    expect(page).toContain('http-equiv="refresh"');
    const stream = await get(
      `/api/v1/repos/alice/engine/runs/${run.id}/log?follow=1`,
      writerCookie,
    );
    expect(stream.status).toBe(200);
    finishRun(app.db, run.id, { state: "ok", summary: "planned" });
    const settled = await (await get("/alice/engine", writerCookie)).text();
    expect(settled).not.toContain('id="app-run-tail"');
  });
  test("a log far larger than the tail's cap still ends the page at its true last line", async () => {
    const tell = openIssue(app, alice, repo, { title: "Long-running build" });
    if (!tell.ok) throw new Error(String(tell.error));
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: tell.value.id,
      actorId: scoutId,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    // Far past a byte cap sized for a handful of lines (old default: 512KB).
    for (let i = 0; i < 2000; i++)
      appendRunLog(app.config.dataDir, run.id, `line ${i}`);
    const page = await (await get("/alice/engine", writerCookie)).text();
    expect(page).not.toContain(">line 1993<");
    expect(page).toContain(">line 1999<");
    expect(page).toContain("Holding the last 6 lines here");
    finishRun(app.db, run.id, { state: "ok", summary: "planned" });
  });
  test("a reader without access gets the forge's not-found from the page and from the tail's own stream", async () => {
    const tell = openIssue(app, alice, repo, { title: "Private boot work" });
    if (!tell.ok) throw new Error(String(tell.error));
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: tell.value.id,
      actorId: scoutId,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    appendRunLog(app.config.dataDir, run.id, "line 0");
    const page = await get("/alice/engine", readerCookie);
    expect(page.status).toBe(404);
    const stream = await get(
      `/api/v1/repos/alice/engine/runs/${run.id}/log?follow=1`,
      readerCookie,
    );
    expect(stream.status).toBe(404);
    finishRun(app.db, run.id, { state: "ok", summary: "planned" });
  });
});
/**
 * Issue #145: the run a brand-new app is waiting on is its first deploy, not
 * an agent's — the head card tails production's own deploy the same way a
 * running row is tailed, and yields to an agent run's own tail when one is
 * also going, so the page never opens two streams for one repo.
 */
describe("the app's page tails the deploy that is bringing it alive", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let runtime: AppsRuntime;
  let repo: Repo;
  let record: AppRecord;
  let owner: string;
  let scoutId: string;
  interface PreviewSlot {
    readonly app: AppRecord;
    readonly env: EnvName;
    readonly chain: Promise<void>;
    readonly restarts: number[];
    deploying?: unknown;
    live?: unknown;
    lastError?: string;
    lastRunId?: string;
  }
  const putEnv = (
    env: EnvName,
    slot: Omit<PreviewSlot, "app" | "env" | "chain" | "restarts">,
  ): void => {
    (runtime as unknown as { envs: Map<string, PreviewSlot> }).envs.set(
      `${record.id}/${env}`,
      { app: record, env, chain: Promise.resolve(), restarts: [], ...slot },
    );
  };
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-deploy-tail-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    runtime = new AppsRuntime(app, {
      domain: "deploytail.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    owner = await signIn("alice");
    const made = await createRepo(app, a.value, {
      name: "kindling",
      visibility: "private",
      description: "a new app",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "kindling\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "kindling" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    record = getAppByRepo(app.db, repo.id)!;
    const scout = await createAgent(app, a.value, { username: "scout" });
    if (!scout.ok) throw new Error(String(scout.error));
    scoutId = scout.value.user.id;
    expect(addToCrew(app, a.value, repo, "scout").ok).toBe(true);
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a production deploy under way, with no agent run going, is tailed in the head card and named as the deploy's own stream", async () => {
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "f00dcafe",
      reason: "boot",
    });
    claimRun(app.db, deployRun.id);
    appendRunLog(app.config.dataDir, deployRun.id, "checking out f00dcafe");
    appendRunLog(app.config.dataDir, deployRun.id, "install …");
    putEnv("production", {
      deploying: {
        run: { id: deployRun.id, commitOid: "f00dcafe" },
        abort: new AbortController(),
      },
    });
    const page = await (await get("/alice/kindling", owner)).text();
    expect(page).toContain('id="app-run-tail"');
    expect(page).toContain('data-who="the deploy"');
    expect(page).toContain(
      `data-stream="/api/v1/repos/alice/kindling/runs/${deployRun.id}/log?follow=1"`,
    );
    expect(page).toContain("install …");
    // No script, no problem: the page keeps refreshing while the deploy
    // goes — the actual meta tag, not just the script's own selector text.
    expect(page).toMatch(/<meta\s+http-equiv="refresh"/);
    // Issue #163: the deploy is plainly going, in the head card above — "Now"
    // does not also claim nothing is happening, and it does not open a
    // second stream of the same lines to say so.
    expect(page).not.toContain("Nothing yet");
    expect(page).toContain("Production is coming up");
    expect(page.match(/id="app-run-tail"/g)?.length).toBe(1);
    finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" });
  });
  test("an agent run at work outranks a background deploy: the page follows the crew, never both", async () => {
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "d0d0d0d0",
      reason: "push",
    });
    claimRun(app.db, deployRun.id);
    appendRunLog(app.config.dataDir, deployRun.id, "deploying d0d0d0d0");
    putEnv("production", {
      deploying: {
        run: { id: deployRun.id, commitOid: "d0d0d0d0" },
        abort: new AbortController(),
      },
    });
    const tell = openIssue(app, getUserByName(app.db, "alice")!, repo, {
      title: "Add a footer",
    });
    if (!tell.ok) throw new Error(String(tell.error));
    const agentRun = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: tell.value.id,
      actorId: scoutId,
      reason: "assigned",
    });
    claimRun(app.db, agentRun.id);
    appendRunLog(app.config.dataDir, agentRun.id, "scout is on it");
    const page = await (await get("/alice/kindling", owner)).text();
    // Exactly one tail, and it is the crew's own run — never the deploy's.
    expect(page.match(/id="app-run-tail"/g)?.length).toBe(1);
    expect(page).not.toContain('data-who="the deploy"');
    expect(page).toContain(
      `data-stream="/api/v1/repos/alice/kindling/runs/${agentRun.id}/log?follow=1"`,
    );
    finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" });
    finishRun(app.db, agentRun.id, { state: "ok", summary: "planned" });
  });
  // Issue #284: production stays "live" long after its deploy finishes, and
  // a fresh live process that has written nothing to its log yet is not an
  // empty black box — the card says so in a line instead.
  test("with no agent run going and production live but silent, the head card says so in a line, not an empty box", async () => {
    putEnv("production", {
      live: {
        commitOid: "d0d0d0d0",
        handle: { port: 4501 },
        runId: "irrelevant",
        since: new Date().toISOString(),
        manifest: { tty: null },
      },
    });
    const page = await (await get("/alice/kindling", owner)).text();
    expect(page).toContain('id="app-run-tail"');
    expect(page).not.toContain('class="run-log');
    expect(page).toContain("Production is quiet");
    // Still nothing to fetch — the page keeps polling in case that changes.
    expect(page).toMatch(/<meta\s+http-equiv="refresh"/);
  });
});
/**
 * Issue #284: production keeps writing to the same run's log for as long as
 * its process runs, long after the deploy that produced it is finished —
 * the head card's tail follows that, not just a deploy in flight.
 */
describe("the app's page tails production's own output while it runs (#284)", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let runtime: AppsRuntime;
  let repo: Repo;
  let record: AppRecord;
  let owner: string;
  let strangerCookie: string;
  let scoutId: string;
  interface PreviewSlot {
    readonly app: AppRecord;
    readonly env: EnvName;
    readonly chain: Promise<void>;
    readonly restarts: number[];
    deploying?: unknown;
    live?: unknown;
    lastError?: string;
    lastRunId?: string;
  }
  const putEnv = (
    env: EnvName,
    slot: Omit<PreviewSlot, "app" | "env" | "chain" | "restarts">,
  ): void => {
    (runtime as unknown as { envs: Map<string, PreviewSlot> }).envs.set(
      `${record.id}/${env}`,
      { app: record, env, chain: Promise.resolve(), restarts: [], ...slot },
    );
  };
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-live-tail-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    runtime = new AppsRuntime(app, {
      domain: "livetail.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    const c = await createUser(app.db, { trusted: true,
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!c.ok) throw new Error(c.error);
    owner = await signIn("alice");
    strangerCookie = await signIn("carol");
    const made = await createRepo(app, a.value, {
      name: "furnace",
      visibility: "public",
      description: "an app that keeps a fire going",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "furnace\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "furnace" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    record = getAppByRepo(app.db, repo.id)!;
    const scout = await createAgent(app, a.value, { username: "scout" });
    if (!scout.ok) throw new Error(String(scout.error));
    scoutId = scout.value.user.id;
    expect(addToCrew(app, a.value, repo, "scout").ok).toBe(true);
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("production running with lines in its log carries the tail, named as the app's own", async () => {
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "b16b00b5",
      reason: "push",
    });
    claimRun(app.db, deployRun.id);
    for (let i = 0; i < 9; i++)
      appendRunLog(app.config.dataDir, deployRun.id, `serving request ${i}`);
    finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" });
    putEnv("production", {
      live: {
        commitOid: "b16b00b5",
        handle: { port: 4503 },
        runId: deployRun.id,
        since: new Date().toISOString(),
        manifest: { tty: null },
      },
    });
    const page = await (await get("/alice/furnace", owner)).text();
    expect(page).toContain('id="app-run-tail"');
    expect(page).toContain('data-who="the app"');
    expect(page).toContain(
      `data-stream="/api/v1/repos/alice/furnace/runs/${deployRun.id}/log?follow=1"`,
    );
    expect(page).not.toContain(">serving request 0<");
    expect(page).toContain(">serving request 8<");
    expect(page).toContain("Holding the last 6 lines here");
    expect(page).toMatch(/<meta\s+http-equiv="refresh"/);
    // Issue #284's own point: the run this reads from is long finished —
    // the tail follows the env that points at it, not the run's own state.
    expect(getRun(app.db, deployRun.id)?.state).toBe("ok");
  });
  test("a viewer who cannot see the owner's facts gets no output at all", async () => {
    const response = await get("/alice/furnace", strangerCookie);
    expect(response.status).toBe(200);
    const page = await response.text();
    expect(page).not.toContain('id="app-run-tail"');
    expect(page).not.toContain("serving request");
  });
  test("an agent run at work still outranks production's own tail", async () => {
    const tell = openIssue(app, getUserByName(app.db, "alice")!, repo, {
      title: "Add a chimney",
    });
    if (!tell.ok) throw new Error(String(tell.error));
    const agentRun = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: tell.value.id,
      actorId: scoutId,
      reason: "assigned",
    });
    claimRun(app.db, agentRun.id);
    appendRunLog(app.config.dataDir, agentRun.id, "scout is on it");
    const page = await (await get("/alice/furnace", owner)).text();
    expect(page.match(/id="app-run-tail"/g)?.length).toBe(1);
    expect(page).not.toContain('data-who="the app"');
    expect(page).toContain(
      `data-stream="/api/v1/repos/alice/furnace/runs/${agentRun.id}/log?follow=1"`,
    );
    finishRun(app.db, agentRun.id, { state: "ok", summary: "planned" });
  });
});
/**
 * Issue #163: "Now" is built from agent runs alone, so a fresh app with a
 * deploy going and nothing else read as if nothing were happening — right
 * beside the head card tailing that very deploy. "Now"'s empty state now
 * says otherwise when the head card is tailing a deploy, and keeps its
 * ordinary wording when nothing at all is going.
 */
describe(`"Now" while production is coming up and nothing else is`, () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let runtime: AppsRuntime;
  let repo: Repo;
  let record: AppRecord;
  let owner: string;
  interface PreviewSlot {
    readonly app: AppRecord;
    readonly env: EnvName;
    readonly chain: Promise<void>;
    readonly restarts: number[];
    deploying?: unknown;
    live?: unknown;
    lastError?: string;
    lastRunId?: string;
  }
  const putEnv = (
    env: EnvName,
    slot: Omit<PreviewSlot, "app" | "env" | "chain" | "restarts">,
  ): void => {
    (runtime as unknown as { envs: Map<string, PreviewSlot> }).envs.set(
      `${record.id}/${env}`,
      { app: record, env, chain: Promise.resolve(), restarts: [], ...slot },
    );
  };
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-now-empty-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    runtime = new AppsRuntime(app, {
      domain: "nowempty.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    owner = await signIn("alice");
    const made = await createRepo(app, a.value, {
      name: "ember",
      visibility: "private",
      description: "a new app",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "ember\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "ember" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    record = getAppByRepo(app.db, repo.id)!;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test('a running deploy and no agent run: "Now" does not say nothing is happening, and opens no second tail', async () => {
    const deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "eae580a",
      reason: "boot",
    });
    claimRun(app.db, deployRun.id);
    appendRunLog(app.config.dataDir, deployRun.id, "deploy in progress");
    putEnv("production", {
      deploying: {
        run: { id: deployRun.id, commitOid: "eae580a" },
        abort: new AbortController(),
      },
    });
    const page = await (await get("/alice/ember", owner)).text();
    expect(page).not.toContain("Nothing yet");
    expect(page).toContain("Production is coming up");
    // Exactly one tail on the page — the head card's, not a second one in
    // "Now".
    expect(page.match(/id="app-run-tail"/g)?.length).toBe(1);
    finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" });
  });
  test('with nothing going at all, "Now" reads exactly as it does today — production live and silent says its own quiet line above, not through "Now"', async () => {
    putEnv("production", {
      live: {
        commitOid: "eae580a",
        handle: { port: 4502 },
        runId: "irrelevant",
        since: new Date().toISOString(),
        manifest: { tty: null },
      },
    });
    const page = await (await get("/alice/ember", owner)).text();
    expect(page).toContain("Nothing yet. Tell the crew something.");
    // The head card's own quiet line (#284) is not the deploy-in-progress
    // wording "Now" uses — production here is live, not coming up.
    expect(page).not.toContain("Production is coming up");
    expect(page).toContain("Production is quiet");
  });
});
/**
 * Issue #183: `tell` cannot route a tell to anyone with nobody on the
 * crew — the issue it opens stays unassigned forever, not merely
 * unpicked-up like an agent-held tell. Both surfaces that used to call this
 * "quiet" or "nothing yet" must say the honest reason instead, and both
 * failed before this change.
 */
describe('a tell nobody on the crew can take is not "quiet"', () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let alice: User;
  let cookie: string;
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  const post = (path: string, body: Record<string, string>) =>
    fetch(`${base}${path}`, {
      method: "POST",
      headers: { cookie, origin: base },
      body: new URLSearchParams(body),
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-untaken-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "pad",
      visibility: "private",
      description: "a pad for notes",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "pad\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "pad" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    // No crew at all — the exact state `tell` cannot route out of.
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test('a crewless tell renders a "Now" row, not the empty state, and links to where a crew member is added', async () => {
    const told = await post("/alice/pad/tell", {
      text: "Add a dark mode toggle.",
    });
    expect(told.status).toBe(303);
    const page = await (await get("/alice/pad")).text();
    expect(page).not.toContain("Nothing yet. Tell the crew something.");
    expect(page).toContain("Add a dark mode toggle.");
    expect(page).toContain("nobody on the crew to take it");
    expect(page).toContain(`href="/alice/pad/settings"`);
  });
  test('the shelf row for that app is not "quiet"', async () => {
    const home = await (await get("/apps")).text();
    const at = home.indexOf('href="/alice/pad"');
    expect(at).toBeGreaterThan(-1);
    const start = home.lastIndexOf("<li>", at);
    const shelfRow = home.slice(start, home.indexOf("</li>", at) + 5);
    expect(shelfRow).not.toContain("quiet — tell the crew something");
    expect(shelfRow).toContain("nobody on the crew to take it");
  });
  test("a reader of the public app sees the fact, not the owner's invitation or a link to settings", async () => {
    app.db.run("UPDATE repo SET visibility = 'public' WHERE id = ?", [
      repo.id,
    ]);
    const b = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!b.ok) throw new Error(b.error);
    const bobCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "bob",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const read = await (
      await fetch(`${base}/alice/pad`, {
        headers: { cookie: `${bobCookie}; forge_mode=studio` },
      })
    ).text();
    expect(read).toContain("Add a dark mode toggle.");
    expect(read).toContain("nobody on the crew to take it");
    expect(read).not.toContain("add someone");
    expect(read).not.toContain(`href="/alice/pad/settings"`);
    // The writer still gets the invitation, link included.
    const write = await (await get("/alice/pad")).text();
    expect(write).toContain("add someone");
    expect(write).toContain(`href="/alice/pad/settings"`);
  });
});
/**
 * Issue #226: taking a tell yourself — assigning it to a person, not an
 * agent — used to drop it clean off "Now": the panel's filter only ever
 * let an agent-held or unassigned tell through, so a person holding it
 * counted as nobody. `tellWord`'s own fallback said "not picked up yet"
 * regardless, so the tell's own page agreed with nothing true either.
 * Both failed before this change.
 */
describe("a tell held by a person still shows on the front door (#226)", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let alice: User;
  let cookie: string;
  let tell: Issue;
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-person-held-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "pad",
      visibility: "private",
      description: "a pad for notes",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "pad\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "pad" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const scout = await createAgent(app, alice, { username: "scout" });
    if (!scout.ok) throw new Error(String(scout.error));
    expect(addToCrew(app, alice, repo, "scout").ok).toBe(true);
    const told = openIssue(app, alice, repo, {
      title: "Give the header a subtitle",
    });
    if (!told.ok) throw new Error(String(told.error));
    tell = told.value;
    // Taken by a person — the owner herself — not routed to the crew.
    expect(assignIssue(app, alice, repo, tell, alice).ok).toBe(true);
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test('"Now" names the person who holds it, not "Nothing yet"', async () => {
    const page = await (await get("/alice/pad")).text();
    expect(page).not.toContain("Nothing yet. Tell the crew something.");
    expect(page).toContain("Give the header a subtitle");
    expect(page).toContain("alice");
    expect(page).not.toContain("not picked up yet");
  });
  test("the tell's own page agrees with the panel: held, not unpicked", async () => {
    const page = await (await get(`/alice/pad/issues/${tell.number}`)).text();
    expect(page).not.toContain("not picked up yet");
    expect(page).toContain(">alice</a>");
    expect(page).toContain("has it");
  });
});
/**
 * Issue #191: `appShelf`/`shelfRows` used to derive a row from agent runs
 * alone, so a change a person opened by hand — no run anywhere near it —
 * fell to "quiet — tell the crew something" even while it sat green and
 * ready for a look, and "Happening now" said nobody was working while that
 * same change waited. Both read from `openPullsForRepos` now, grouped once
 * for the whole shelf, so a person's own change counts exactly as an
 * agent's does. Failed before this change.
 */
describe("an open change is never quiet on the front door", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let alice: User;
  let cookie: string;
  let pull: Pull;
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-open-change-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "pad",
      visibility: "private",
      description: "a pad for notes",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "pad\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "pad" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    // Alice opens the change herself, through the editor — no agent run
    // anywhere near it, the exact case `latestAgentRunsForRepos` misses.
    const branch = await commitToBranch(app, alice, repo, {
      branch: "note",
      base: "main",
      message: "A note",
      files: [{ path: "NOTE.md", content: "note\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "A note",
      body: "",
      baseBranch: "main",
      headBranch: "note",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    pull = opened.value;
    const check = createRun(app.db, {
      repoId: repo.id,
      kind: "check",
      issueId: pull.id,
      env: `pull-${pull.number}`,
      commitOid: pull.headOid,
      reason: "pull",
    });
    claimRun(app.db, check.id);
    finishRun(app.db, check.id, { state: "ok", summary: "check passed in 1s" });
    // A second app, otherwise identical, with nothing open at all — the
    // control that must keep reading "quiet".
    const madeQuiet = await createRepo(app, alice, {
      name: "quiet",
      visibility: "private",
      description: "says nothing",
    });
    if (!madeQuiet.ok) throw new Error(String(madeQuiet.error));
    const seededQuiet = await commitToBranch(app, alice, madeQuiet.value, {
      message: "Start",
      files: [{ path: "README.md", content: "quiet\n" }],
    });
    if (!seededQuiet.ok) throw new Error(JSON.stringify(seededQuiet.error));
    const enabledQuiet = await enableApp(app, alice, madeQuiet.value, {
      slug: "quiet",
    });
    if (!enabledQuiet.ok) throw new Error(String(enabledQuiet.error));
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("the shelf row carries the change's own word, its badge and dot kept", async () => {
    const home = await (await get("/apps")).text();
    const at = home.indexOf('href="/alice/pad"');
    expect(at).toBeGreaterThan(-1);
    const start = home.lastIndexOf("<li>", at);
    const shelfRow = home.slice(start, home.indexOf("</li>", at) + 5);
    expect(shelfRow).not.toContain("quiet — tell the crew something");
    expect(shelfRow).toContain('data-word="look"');
    expect(shelfRow).toContain('class="dot"');
    expect(shelfRow).toContain('class="badge"');
  });
  test("an app with nothing open still reads quiet", async () => {
    const home = await (await get("/apps")).text();
    const at = home.indexOf('href="/alice/quiet"');
    expect(at).toBeGreaterThan(-1);
    const start = home.lastIndexOf("<li>", at);
    const shelfRow = home.slice(start, home.indexOf("</li>", at) + 5);
    expect(shelfRow).toContain("quiet — tell the crew something");
  });
});
/**
 * Issue #215: once a merged change closes, it drops out of
 * `openPullsForRepos`, and before this the shelf and the rail had nothing
 * left to say about it but "quiet" — the row's *happening* half spoke only
 * for an agent run, never a deploy. `productionFact` (`words.ts`) reads
 * production's own status for the fact a merge or a push leaves behind:
 * the deploy that landed, or one that failed behind what still serves.
 */
describe("a deploy that just landed is news on the front door", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let runtime: AppsRuntime;
  let repo: Repo;
  let record: AppRecord;
  let quietRepo: Repo;
  let alice: User;
  let cookie: string;
  let deployRun: Run;
  interface PreviewSlot {
    readonly app: AppRecord;
    readonly env: EnvName;
    readonly chain: Promise<void>;
    readonly restarts: number[];
    deploying?: unknown;
    live?: unknown;
    lastError?: string;
    lastRunId?: string;
  }
  const putEnv = (
    appRecord: AppRecord,
    env: EnvName,
    slot: Omit<PreviewSlot, "app" | "env" | "chain" | "restarts">,
  ): void => {
    (runtime as unknown as { envs: Map<string, PreviewSlot> }).envs.set(
      `${appRecord.id}/${env}`,
      { app: appRecord, env, chain: Promise.resolve(), restarts: [], ...slot },
    );
  };
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  const shelfRowFor = (home: string, href: string): string => {
    const at = home.indexOf(`href="${href}"`);
    expect(at).toBeGreaterThan(-1);
    const start = home.lastIndexOf("<li>", at);
    return home.slice(start, home.indexOf("</li>", at) + 5);
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-shipped-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    // Uncalled `.start()`: this runtime never subscribes to the bus, so
    // nothing here spins a real process — its `envs` are only ever what
    // `putEnv` puts there, the same fiction the live-fragment tests use.
    runtime = new AppsRuntime(app, {
      domain: "shipped.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "sap",
      visibility: "private",
      description: "a sap for notes",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "sap\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "sap" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    record = getAppByRepo(app.db, repo.id)!;
    deployRun = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      commitOid: "6c99218",
      reason: "merge",
      actorId: alice.id,
    });
    claimRun(app.db, deployRun.id);
    deployRun =
      finishRun(app.db, deployRun.id, { state: "ok", summary: "deploy" }) ??
      deployRun;
    const servingAt = new Date().toISOString();
    putEnv(record, "production", {
      live: {
        commitOid: "6c99218",
        handle: { port: 4321 },
        runId: deployRun.id,
        since: servingAt,
        servingAt,
        createdAt: servingAt,
        manifest: { tty: null },
      },
    });
    // A second app, otherwise identical, that never shipped — the control
    // that must keep reading quiet.
    const madeQuiet = await createRepo(app, alice, {
      name: "quiet2",
      visibility: "private",
      description: "says nothing",
    });
    if (!madeQuiet.ok) throw new Error(String(madeQuiet.error));
    const seededQuiet = await commitToBranch(app, alice, madeQuiet.value, {
      message: "Start",
      files: [{ path: "README.md", content: "quiet\n" }],
    });
    if (!seededQuiet.ok) throw new Error(JSON.stringify(seededQuiet.error));
    const enabledQuiet = await enableApp(app, alice, madeQuiet.value, {
      slug: "quiet2",
    });
    if (!enabledQuiet.ok) throw new Error(String(enabledQuiet.error));
    quietRepo = madeQuiet.value;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("the shelf row reads shipped, with who and when, not quiet", async () => {
    const home = await (await get("/apps")).text();
    const shelfRow = shelfRowFor(home, "/alice/sap");
    expect(shelfRow).not.toContain("quiet — tell the crew something");
    expect(shelfRow).toContain('data-word="shipped"');
    expect(shelfRow).toContain("alice");
  });
  test("an app with no recent deploy still reads quiet", async () => {
    const home = await (await get("/apps")).text();
    const shelfRow = shelfRowFor(home, `/alice/${quietRepo.name}`);
    expect(shelfRow).toContain("quiet — tell the crew something");
  });
  test("a deploy no push asked for is not news: a redeploy or the boot reconcile does not read shipped", async () => {
    const restartedAt = new Date().toISOString();
    putEnv(record, "production", {
      live: {
        commitOid: "6c99218",
        handle: { port: 4321 },
        runId: deployRun.id,
        since: restartedAt,
        servingAt: restartedAt,
        // No `createdAt`: nothing asked a push for this one — a redeploy
        // someone pressed, or the boot reconcile every restart runs.
        manifest: { tty: null },
      },
    });
    const home = await (await get("/apps")).text();
    const shelfRow = shelfRowFor(home, "/alice/sap");
    expect(shelfRow).not.toContain('data-word="shipped"');
    expect(shelfRow).toContain("quiet — tell the crew something");
  });
  test("a deploy older than the news window reads quiet again, not shipped forever", async () => {
    const old = new Date(Date.now() - 25 * 60 * 60_000).toISOString();
    putEnv(record, "production", {
      live: {
        commitOid: "6c99218",
        handle: { port: 4321 },
        runId: deployRun.id,
        since: old,
        servingAt: old,
        createdAt: old,
        manifest: { tty: null },
      },
    });
    const home = await (await get("/apps")).text();
    const shelfRow = shelfRowFor(home, "/alice/sap");
    expect(shelfRow).not.toContain('data-word="shipped"');
    expect(shelfRow).toContain("quiet — tell the crew something");
  });
});
/**
 * Issue #65: a public app's studio page is the app, not the owner's books.
 * `canSeeOwnerFacts` (`src/core/repos.ts`) is the one predicate — the same
 * as `canWrite` today — that every surface carrying money, the crew or the
 * decision ledger must ask before it computes or renders one of those.
 */
@@ -0,0 +1,1419 @@
/**
 * The studio: search, today's cost, the outline, Stop and Redeploy, names,
 * empty lists, the app's own words, and a run's transcript. One of the
 * files the studio's suite was split into so no one file sets the gate's
 * floor (#2038); the rest are test/studio*.test.ts.
 */
import { logBox } from "../src/web/studio/log.ts";
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { enableApp } from "../src/actions/apps.ts";
import { previewEnv } from "../src/apps/data.ts";
import { AppsRuntime } from "../src/apps/runtime.ts";
import { getAppByRepo } from "../src/core/apps.ts";
import { addToCrew, createAgent } from "../src/actions/crew.ts";
import { assignIssue, openIssue } from "../src/actions/issues.ts";
import { openPull } from "../src/actions/pulls.ts";
import {
  commitToBranch,
  createRepo,
  updateRepoSettings,
} from "../src/actions/repos.ts";
import { getIssue, type Issue } from "../src/core/issues.ts";
import type { Pull } from "../src/core/pulls.ts";
import { getRepoById, type Repo } from "../src/core/repos.ts";
import {
  claimRun,
  createRun,
  finishRun,
  listRuns,
  noteRunProgress,
  type Run,
} from "../src/core/runs.ts";
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { serving } from "./helpers/studio.ts";
describe("finding things in the studio: /search", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let aliceCookie: string;
  let widgets: Repo;
  let tellNumber: number;
  let changeNumber: number;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-search-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    aliceCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "widgets",
      visibility: "public",
      description: "Sell handmade wooden chess sets",
    });
    if (!made.ok) throw new Error(String(made.error));
    widgets = made.value;
    const seeded = await commitToBranch(app, alice, widgets, {
      message: "Start",
      files: [{ path: "README.md", content: "start\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, widgets, { slug: "widgets" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const told = openIssue(app, alice, widgets, {
      title: "Add a chess clock timer",
      body: "Players want a clock.",
    });
    if (!told.ok) throw new Error(String(told.error));
    tellNumber = told.value.number;
    const branchMade = await commitToBranch(app, alice, widgets, {
      branch: "chess-clock",
      base: widgets.defaultBranch,
      message: "Add clock",
      files: [{ path: "clock.ts", content: "export {};\n" }],
    });
    if (!branchMade.ok) throw new Error(JSON.stringify(branchMade.error));
    const opened = await openPull(app, alice, widgets, {
      title: "Wire up the chess clock",
      body: "",
      baseBranch: widgets.defaultBranch,
      headBranch: "chess-clock",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    changeNumber = opened.value.number;
    // A private app, another owner's — never in alice's or a stranger's
    // results, however much its description matches.
    const bob = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!bob.ok) throw new Error(bob.error);
    const secret = await createRepo(app, bob.value, {
      name: "secret",
      visibility: "private",
      description: "A private chess engine",
    });
    if (!secret.ok) throw new Error(String(secret.error));
    const secretSeeded = await commitToBranch(app, bob.value, secret.value, {
      message: "Start",
      files: [{ path: "README.md", content: "start\n" }],
    });
    if (!secretSeeded.ok) throw new Error(JSON.stringify(secretSeeded.error));
    const secretEnabled = await enableApp(app, bob.value, secret.value, {
      slug: "secret",
    });
    if (!secretEnabled.ok) throw new Error(String(secretEnabled.error));
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const asAlice = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${aliceCookie}; forge_mode=studio` },
      redirect: "manual",
    });
  const anonymous = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: "forge_mode=studio" },
      redirect: "manual",
    });
  // The topbar carries the palette's own list of apps on every page, so an
  // assertion about the *results* reads the main content, not the whole
  // document.
  const mainOf = (html: string): string =>
    html.match(/<main[^>]*id="main"[\s\S]*?<\/main>/)?.[0] ?? html;
  test("an app is found by a word from its own description", async () => {
    const res = await asAlice("/search?q=chess");
    expect(res.status).toBe(200);
    const html = await res.text();
    expect(html).toContain("widgets");
    expect(html).toContain("chess sets");
    // Bob's private app matches the same word but is never the viewer's to see.
    expect(html).not.toContain("secret");
  });
  test("a change and a tell are found too, each saying which app they belong to", async () => {
    const html = await (await asAlice("/search?q=chess")).text();
    expect(html).toContain("Add a chess clock timer");
    expect(html).toContain(`/alice/widgets/tells/${tellNumber}`);
    expect(html).toContain("Wire up the chess clock");
    expect(html).toContain(`/alice/widgets/changes/${changeNumber}`);
    expect(html).toContain("alice/widgets");
  });
  test("an empty query is an empty result, not an error page", async () => {
    const res = await asAlice("/search");
    expect(res.status).toBe(200);
    const html = await res.text();
    expect(mainOf(html)).not.toContain("widgets");
  });
  test("an overlong query is bounded, not a crash", async () => {
    const res = await asAlice(`/search?q=${"chess ".repeat(100)}`);
    expect(res.status).toBe(200);
  });
  test("signed out, the same public visibility as dev's own search", async () => {
    const html = await (await anonymous("/search?q=chess")).text();
    expect(html).toContain("widgets");
    expect(html).not.toContain("secret");
  });
  test("?mode=dev on the same route answers the same one page", async () => {
    for (const html of [
      await (await asAlice("/search?q=chess")).text(),
      await (
        await fetch(`${base}/search?q=chess`, {
          headers: { cookie: `${aliceCookie}; forge_mode=dev` },
        })
      ).text(),
    ]) {
      expect(html).toContain("Apps and repositories");
      expect(html).toContain("Tells and changes");
      expect(html).toContain(`/alice/widgets/tells/${tellNumber}`);
      expect(mainOf(html)).not.toContain('name="mode"');
    }
  });
  // #397, carrying #241's rule: the one search finds every repository the
  // viewer can see, not only apps — and a tell on it links where it lives.
  test("a repository that is not an app is found by its name and its description, and stays its owner's alone", async () => {
    const plain = await createRepo(app, alice, {
      name: "project-notes",
      visibility: "private",
      description: "notes about a project",
    });
    if (!plain.ok) throw new Error(String(plain.error));
    const told = openIssue(app, alice, plain.value, {
      title: "Sort the project notes",
      body: "",
    });
    if (!told.ok) throw new Error(String(told.error));
    const byName = mainOf(await (await asAlice("/search?q=notes")).text());
    expect(byName).toContain('href="/alice/project-notes"');
    expect(byName).toContain(
      `href="/alice/project-notes/issues/${told.value.number}"`,
    );
    expect(byName).not.toContain("Nothing matched");
    const byDescription = mainOf(
      await (await asAlice("/search?q=about+a+project")).text(),
    );
    expect(byDescription).toContain('href="/alice/project-notes"');
    const stranger = mainOf(await (await anonymous("/search?q=notes")).text());
    expect(stranger).not.toContain("project-notes");
  });
  test("a private app on a public repository: its state reaches only its writers, and anyone else sees a plain repository row", async () => {
    const made = await createRepo(app, alice, {
      name: "abacus",
      visibility: "public",
      description: "an abacus for chess clocks",
    });
    if (!made.ok) throw new Error(String(made.error));
    const seeded = await commitToBranch(app, alice, made.value, {
      message: "Start",
      files: [{ path: "README.md", content: "start\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, made.value, {
      slug: "abacus",
      access: "private",
    });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const carol = await createUser(app.db, { trusted: true,
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!carol.ok) throw new Error(carol.error);
    const carolCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "carol",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const rowOf = (html: string): string => {
      const at = html.indexOf('href="/alice/abacus"');
      return at === -1 ? "" : html.slice(at, html.indexOf("</a>", at));
    };
    for (const cookie of ["", `${carolCookie}; forge_mode=studio`]) {
      const html = mainOf(
        await (
          await fetch(`${base}/search?q=abacus`, {
            headers: cookie === "" ? {} : { cookie },
          })
        ).text(),
      );
      const row = rowOf(html);
      expect(row).not.toBe("");
      expect(row).not.toContain("not running");
      expect(row).not.toContain('class="dot"');
    }
    expect(rowOf(mainOf(await (await asAlice("/search?q=abacus")).text()))).toContain(
      "not running",
    );
  });
  test("code is a section of the same page, and narrowing to it is a chip, never a mode", async () => {
    const all = mainOf(await (await asAlice("/search?q=chess")).text());
    expect(all).toContain('id="repos"');
    expect(all).toContain('id="issues"');
    expect(all).toContain('id="code"');
    expect(all).toContain("/search?q=chess&amp;kind=code");
    expect(all).not.toContain("mode=dev");
    expect(all).not.toContain("Search the code");
    const code = mainOf(await (await asAlice("/search?q=chess&kind=code")).text());
    expect(code).toContain('id="code"');
    expect(code).not.toContain('id="repos"');
  });
});
/**
 * The studio home's own answer to "what is this costing me today?" (#94):
 * one line, the sum of today's agent spend across the apps the viewer can
 * write, and how many of those sit paused at their ceiling right now.
 */
describe("the studio home says what the crew cost you today", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let aliceCookie: string;
  let carolCookie: string;
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  // The cost line is the apps list's (#599: home is the feed).
  const home = (cookie: string) =>
    fetch(`${base}/apps`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    }).then((r) => r.text());
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-cost-today-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    const c = await createUser(app.db, { trusted: true,
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!c.ok) throw new Error(c.error);
    aliceCookie = await signIn("alice");
    carolCookie = await signIn("carol");
    // "beacon": on its own, over its $5 ceiling today — paused.
    const beaconMade = await createRepo(app, alice, {
      name: "beacon",
      visibility: "public",
      description: "a light that stays on",
    });
    if (!beaconMade.ok) throw new Error(String(beaconMade.error));
    const beacon = beaconMade.value;
    const beaconSeeded = await commitToBranch(app, alice, beacon, {
      message: "Start",
      files: [{ path: "README.md", content: "beacon\n" }],
    });
    if (!beaconSeeded.ok) throw new Error(JSON.stringify(beaconSeeded.error));
    const beaconEnabled = await enableApp(app, alice, beacon, {
      slug: "beacon",
    });
    if (!beaconEnabled.ok) throw new Error(String(beaconEnabled.error));
    const keeper = await createAgent(app, alice, { username: "keeper" });
    if (!keeper.ok) throw new Error(String(keeper.error));
    expect(addToCrew(app, alice, beacon, "keeper").ok).toBe(true);
    const on = await updateRepoSettings(app, alice, beacon, {
      autonomy: "assisted",
      autonomyDirection: "",
      autonomyCeilingUsd: 5,
      autonomySlots: 2,
      autonomyBy: alice.id,
    });
    expect(on.ok).toBe(true);
    const keeperId = getUserByName(app.db, "keeper")!.id;
    const beaconRun = createRun(app.db, {
      repoId: beacon.id,
      kind: "agent",
      actorId: keeperId,
      reason: "assigned",
    });
    claimRun(app.db, beaconRun.id);
    noteRunProgress(app.db, beaconRun.id, { costUsd: 6 });
    // "loom": no autonomy at all, a cheaper run today — never paused.
    const loomMade = await createRepo(app, alice, {
      name: "loom",
      visibility: "public",
      description: "a place for cloth",
    });
    if (!loomMade.ok) throw new Error(String(loomMade.error));
    const loom = loomMade.value;
    const loomSeeded = await commitToBranch(app, alice, loom, {
      message: "Start",
      files: [{ path: "README.md", content: "loom\n" }],
    });
    if (!loomSeeded.ok) throw new Error(JSON.stringify(loomSeeded.error));
    const loomEnabled = await enableApp(app, alice, loom, { slug: "loom" });
    if (!loomEnabled.ok) throw new Error(String(loomEnabled.error));
    const weaver = await createAgent(app, alice, { username: "weaver" });
    if (!weaver.ok) throw new Error(String(weaver.error));
    expect(addToCrew(app, alice, loom, "weaver").ok).toBe(true);
    const weaverId = getUserByName(app.db, "weaver")!.id;
    const loomRun = createRun(app.db, {
      repoId: loom.id,
      kind: "agent",
      actorId: weaverId,
      reason: "assigned",
    });
    claimRun(app.db, loomRun.id);
    noteRunProgress(app.db, loomRun.id, { costUsd: 2 });
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("the owner sees the day's total across both apps, and the one that is paused at its ceiling", async () => {
    const html = await home(aliceCookie);
    expect(html).toContain("$8.00 spent today across 2 apps you can write");
    expect(html).toContain("1 paused at");
    expect(html).toMatch(/<a href="\/map">their ceiling<\/a>/);
  });
  test("a viewer who can only read sees no figure at all", async () => {
    const html = await home(carolCookie);
    expect(html).not.toContain("spent today");
    expect(html).not.toContain("$8.00");
    expect(html).not.toContain("$6");
    expect(html).not.toContain("$2");
  });
});
describe("every studio page's headings form one outline", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let repo: Repo;
  let cookie: string;
  let issueNumber: number;
  let pullNumber: number;
  let runId: string;
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  /** Every `<hN>` tag in document order, and whether the outline it forms
   * is one a heading-jumping reader can follow: exactly one `<h1>`, and
   * never a level deeper than one past the deepest seen so far. */
  function headingOutline(html: string): { levels: number[]; ok: boolean } {
    const levels = [...html.matchAll(/<h([1-6])(?:[ >])/g)].map((m) =>
      Number(m[1]),
    );
    const h1s = levels.filter((l) => l === 1).length;
    let deepest = 0;
    let skipped = false;
    for (const level of levels) {
      if (level > deepest + 1) skipped = true;
      deepest = Math.max(deepest, level);
    }
    return { levels, ok: h1s === 1 && !skipped };
  }
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-outline-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "outline",
      visibility: "private",
      description: "for the outline",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content:
            '{"name":"outline","scripts":{"start":"bun run server.ts"}}\n',
        },
        {
          path: "server.ts",
          content:
            "Bun.serve({ port: Number(process.env.PORT), fetch: () => new Response('ok') });\n",
        },
      ],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "outline" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const told = openIssue(app, alice, repo, {
      title: "Outline test tell",
      body: "for the heading walk",
    });
    if (!told.ok) throw new Error(String(told.error));
    issueNumber = told.value.number;
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/outline",
      base: "main",
      message: "Outline change",
      files: [{ path: "OUTLINE.md", content: "outline\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Outline test change",
      body: "",
      baseBranch: "main",
      headBranch: "feature/outline",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    pullNumber = opened.value.number;
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      actorId: alice.id,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    finishRun(app.db, run.id, { state: "ok", summary: "done" });
    runId = run.id;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("the studio home has exactly one h1, said in the studio's own words, and no skipped heading level", async () => {
    const html = await (await get("/")).text();
    const outline = headingOutline(html);
    expect(outline.levels.filter((l) => l === 1).length).toBe(1);
    expect(outline.ok).toBe(true);
    expect(html).toMatch(/<h1 class="sr-only">Home<\/h1>/);
  });
  test("the app page, the three lists, a tell, a change and a run each have one outline with no skipped level", async () => {
    const pages: Record<string, string> = {
      "the app page": "/alice/outline",
      "everything told": "/alice/outline/tells",
      "every change": "/alice/outline/changes",
      "every run": "/alice/outline/runs",
      "a tell": `/alice/outline/issues/${issueNumber}`,
      "a change": `/alice/outline/pulls/${pullNumber}`,
      "a run": `/alice/outline/runs/${runId}`,
      settings: "/alice/outline/settings",
    };
    for (const [name, path] of Object.entries(pages)) {
      const html = await (await get(path)).text();
      const outline = headingOutline(html);
      if (
        outline.levels[0] !== 1 ||
        outline.levels.filter((l) => l === 1).length !== 1 ||
        !outline.ok
      )
        throw new Error(`${name} (${path}): ${JSON.stringify(outline)}`);
    }
  });
});
/**
 * Issue #205: the studio's head card has three buttons, and two of them used
 * to leave the studio — Stop for dev's App page, Redeploy for the deploy's
 * run page. Both now come back to the page the form was pressed on, because
 * the card refreshes itself on the deploy event and staying put shows the
 * result. Dev mode's Redeploy still hands over to the run, and the page is
 * taken from the referer only when it is this forge's own (`safeBack`),
 * never from the form.
 */
describe("the studio's Stop and Redeploy come back to the page they were pressed on", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let runtime: AppsRuntime;
  let cookie: string;
  /** A form the head card draws, submitted from `from` in one of the modes. */
  const press = (
    what: "stop" | "redeploy",
    mode: "studio" | "dev",
    from: string | undefined,
  ): Promise<Response> => {
    const headers: Record<string, string> = {
      cookie: `${cookie}; forge_mode=${mode}`,
      origin: base,
    };
    if (from !== undefined) headers["referer"] = from;
    return fetch(`${base}/alice/notes/app/production/${what}`, {
      method: "POST",
      headers,
      body: new URLSearchParams({}),
      redirect: "manual",
    });
  };
  /** The flash a redirect carries, decoded from its cookie. */
  const flashOf = (response: Response): string =>
    decodeURIComponent(response.headers.get("set-cookie") ?? "");
  const studioPage = (): Promise<string> =>
    fetch(`${base}/alice/notes`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    }).then((r) => r.text());
  /**
   * Production serving, as the runtime holds it, without running a real
   * deploy — the pages read `runtime.status(record)`, and `stopEnv` only
   * asks the handle to stop. Same shape the "not up" head's `put` uses.
   */
  const putLive = (): void => {
    (
      runtime as unknown as { envs: Map<string, Record<string, unknown>> }
    ).envs.set(`${getAppByRepo(app.db, repo.id)!.id}/production`, {
      app: getAppByRepo(app.db, repo.id)!,
      env: "production",
      chain: Promise.resolve(),
      restarts: [],
      live: {
        commitOid: "a".repeat(40),
        handle: { port: 4321, stop: async () => {} },
        runId: "fake",
        since: new Date().toISOString(),
        manifest: { tty: null },
      },
    });
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-envback-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    runtime = new AppsRuntime(app, {
      domain: "apps.test",
      scheme: "http",
      publicPort: servers.port,
      forgeUrl: servers.url,
      concurrency: 1,
    });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, a.value, {
      name: "notes",
      visibility: "public",
      description: "a place for notes",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, a.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "notes\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const branched = await commitToBranch(app, a.value, repo, {
      branch: "spelling",
      message: "Fix a word",
      files: [{ path: "README.md", content: "notes.\n" }],
    });
    if (!branched.ok) throw new Error(JSON.stringify(branched.error));
    const pull = await openPull(app, a.value, repo, {
      title: "Fix a word",
      body: "",
      headBranch: "spelling",
      baseBranch: repo.defaultBranch,
    });
    if (!pull.ok) throw new Error(String(pull.error));
    const enabled = await enableApp(app, a.value, repo, { slug: "notes" });
    if (!enabled.ok) throw new Error(String(enabled.error));
  });
  afterAll(async () => {
    await runtime.stop();
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("Stop returns to the app's studio page with its flash, not to dev's App page", async () => {
    const stopped = await press("stop", "studio", `${base}/alice/notes`);
    expect(stopped.status).toBe(303);
    expect(stopped.headers.get("location")).toBe("/alice/notes");
    expect(flashOf(stopped)).toContain(
      "Stopped production. Its data is kept; Redeploy brings it back.",
    );
    // And the flash really lands on that page, in front of the person.
    const flash = (stopped.headers.get("set-cookie") ?? "").split(";")[0]!;
    const landed = await fetch(`${base}/alice/notes`, {
      headers: { cookie: `${cookie}; forge_mode=studio; ${flash}` },
      redirect: "manual",
    });
    expect(landed.status).toBe(200);
    expect((await landed.text()).replace(/\s+/g, " ")).toContain(
      "Stopped production. Its data is kept; Redeploy brings it back.",
    );
  });
  test("the head card shows the new state where it stands: the live fragment, no second navigation", async () => {
    putLive();
    const serving = await studioPage();
    expect(serving).toContain("serving");
    expect(serving).toContain('action="/alice/notes/app/production/stop"');
    // The page a person stays on is the one that refreshes itself: its live
    // mount asks for the app's state on a deploy event.
    expect(serving).toContain('data-app="1"');
    const stopped = await press("stop", "studio", `${base}/alice/notes`);
    expect(stopped.headers.get("location")).toBe("/alice/notes");
    // What the live client fetches, with no navigation in between: the same
    // head card, now saying the app is down and offering Redeploy instead.
    const fragment = await fetch(`${base}/alice/notes/app/state`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
    expect(fragment.status).toBe(200);
    const html = (await fragment.text()).replace(/\s+/g, " ");
    expect(html).toContain('id="app-head"');
    expect(html).toContain("not running");
    expect(html).toContain('action="/alice/notes/app/production/redeploy"');
    expect(html).not.toContain('action="/alice/notes/app/production/stop"');
  });
  test("pressed on a change's page, Stop comes back to that change", async () => {
    const stopped = await press(
      "stop",
      "studio",
      `${base}/alice/notes/changes/1`,
    );
    expect(stopped.status).toBe(303);
    expect(stopped.headers.get("location")).toBe("/alice/notes/changes/1");
  });
  test("no referer, or one from somewhere else, falls back to the app's studio page — never the raw /app", async () => {
    for (const from of [undefined, "https://evil.example/alice/notes"]) {
      const stopped = await press("stop", "studio", from);
      expect(stopped.status).toBe(303);
      expect(stopped.headers.get("location")).toBe("/alice/notes");
    }
  });
  test("Redeploy stays on the page too, instead of leaving for the deploy's run page", async () => {
    const queued = await press("redeploy", "studio", `${base}/alice/notes`);
    expect(queued.status).toBe(303);
    expect(queued.headers.get("location")).toBe("/alice/notes");
    expect(queued.headers.get("location")).not.toContain("/runs/");
    expect(flashOf(queued)).toContain("Redeploying production.");
    // A run was really queued: the studio only chose not to navigate to it.
    expect(
      listRuns(app.db, repo.id, { kind: "deploy", limit: 5 }).length,
    ).toBeGreaterThan(0);
  });
  test("dev mode is the same: Stop and Redeploy both come back to the page they were pressed on", async () => {
    const stopped = await press("stop", "dev", `${base}/alice/notes/pulls/1`);
    expect(stopped.status).toBe(303);
    expect(stopped.headers.get("location")).toBe("/alice/notes/pulls/1");
    expect(flashOf(stopped)).toContain("Stopped production.");
    const queued = await press("redeploy", "dev", `${base}/alice/notes`);
    expect(queued.status).toBe(303);
    expect(queued.headers.get("location")).toBe("/alice/notes");
    expect(flashOf(queued)).toContain("Redeploying production.");
  });
  // Issue #395: dev's App page folded into this one. Its URL keeps
  // answering — a redirect to the studio app page — and the environment
  // controls it carried (each preview's Redeploy and Stop, the way to the
  // environment settings) are drawn here instead.
  test("GET /:owner/:name/app redirects to the app page, for a dev browser too", async () => {
    const asStudio = await fetch(`${base}/alice/notes/app`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
    expect(asStudio.status).toBe(302);
    expect(asStudio.headers.get("location")).toBe("/alice/notes");
    const asDev = await fetch(`${base}/alice/notes/app`, {
      headers: { cookie: `${cookie}; forge_mode=dev` },
      redirect: "manual",
    });
    expect(asDev.status).toBe(302);
    expect(asDev.headers.get("location")).toBe("/alice/notes");
    const landed = await fetch(`${base}/alice/notes`, {
      headers: { cookie: `${cookie}; forge_mode=dev` },
      redirect: "manual",
    });
    expect(landed.status).toBe(200);
    expect(await landed.text()).toContain('id="app-head"');
    // A public app's page is anyone's; the redirect is too.
    const anonymous = await fetch(`${base}/alice/notes/app`, {
      redirect: "manual",
    });
    expect(anonymous.status).toBe(302);
    expect(anonymous.headers.get("location")).toBe("/alice/notes");
  });
  test("GET /:owner/:name/app is still not found for a repository that is not an app, or not there", async () => {
    const alice = getUserByName(app.db, "alice")!;
    const plain = await createRepo(app, alice, {
      name: "plain-notes",
      visibility: "public",
    });
    if (!plain.ok) throw new Error(String(plain.error));
    for (const path of ["/alice/plain-notes/app", "/alice/nowhere/app"]) {
      const response = await fetch(`${base}${path}`, {
        headers: { cookie: `${cookie}; forge_mode=studio` },
        redirect: "manual",
      });
      expect(`${path} → ${response.status}`).toBe(`${path} → 404`);
    }
  });
  test("the studio app page carries each preview's Redeploy and Stop, and the environment settings, for a writer only", async () => {
    const record = getAppByRepo(app.db, repo.id)!;
    const env = previewEnv(1);
    (
      runtime as unknown as { envs: Map<string, Record<string, unknown>> }
    ).envs.set(`${record.id}/${env}`, {
      app: record,
      env,
      chain: Promise.resolve(),
      restarts: [],
      live: {
        commitOid: "b".repeat(40),
        handle: { port: 4322, stop: async () => {} },
        runId: "fake-preview",
        since: new Date().toISOString(),
        manifest: { tty: null },
      },
    });
    const owner = await studioPage();
    expect(owner).toContain(`action="/alice/notes/app/${env}/redeploy"`);
    expect(owner).toContain(`action="/alice/notes/app/${env}/stop"`);
    expect(owner).toContain(`href="/alice/notes/app/${env}/open"`);
    expect(owner).toContain('href="/alice/notes/settings/app"');
    const stranger = await (
      await fetch(`${base}/alice/notes`, { redirect: "manual" })
    ).text();
    expect(stranger).toContain(`href="/alice/notes/app/${env}/open"`);
    expect(stranger).not.toContain("/redeploy");
    expect(stranger).not.toContain("/stop");
    expect(stranger).not.toContain('href="/alice/notes/settings/app"');
  });
});
/**
 * Issue #206: one public app, one open change, one anonymous visitor, three
 * studio pages — and they must name the same author. Who signs a row is
 * `voiceFor` (`src/web/studio/voice.ts`): a person is named to anyone who
 * can see the row at all, and only the crew's own work reads as the app's
 * own story for a viewer who cannot see the roster.
 */
describe("the studio names a person on the app's page, and the crew only for the crew's own work", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let alice: User;
  let ownerCookie: string;
  let personPull: Pull;
  let agentPull: Pull;
  let agentRun: Run;
  let waitingTell: Issue;
  let heldTell: Issue;
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  /** Signed out, in studio mode: the visitor the issue walked as. */
  const anon = async (path: string): Promise<string> =>
    (
      await fetch(`${base}${path}`, {
        headers: { cookie: "forge_mode=studio" },
        redirect: "manual",
      })
    ).text();
  const owner = async (path: string): Promise<string> =>
    (
      await fetch(`${base}${path}`, {
        headers: { cookie: `${ownerCookie}; forge_mode=studio` },
        redirect: "manual",
      })
    ).text();
  /** The one `<li>` a link sits in — one row, not the whole page. */
  const rowWith = (page: string, needle: string): string => {
    const at = page.indexOf(needle);
    expect(at).toBeGreaterThan(-1);
    const start = page.lastIndexOf("<li", at);
    const end = page.indexOf("</li>", at);
    return page.slice(start, end);
  };
  /** What the avatar beside a name says, so initials can be held to it. */
  const initialsIn = (row: string): string =>
    row.match(/class="avatar"[\s\S]*?>([^<]*)<\/span/)?.[1]?.trim() ?? "";
  const branchAndPull = async (
    who: User,
    name: string,
    title: string,
  ): Promise<Pull> => {
    const branch = await commitToBranch(app, alice, repo, {
      branch: name,
      base: "main",
      message: title,
      files: [{ path: `${name.replace(/\//g, "-")}.md`, content: `${name}\n` }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, who, repo, {
      title,
      body: "",
      baseBranch: "main",
      headBranch: name,
    });
    if (!opened.ok) throw new Error(String(opened.error));
    return opened.value;
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-voice-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "ivy",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    ownerCookie = await signIn("ivy");
    const made = await createRepo(app, alice, {
      name: "pub",
      visibility: "public",
      description: "a public house",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "pub\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "pub" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const quill = await createAgent(app, alice, { username: "quill" });
    if (!quill.ok) throw new Error(String(quill.error));
    expect(addToCrew(app, alice, repo, "quill").ok).toBe(true);
    const quillUser = getUserByName(app.db, "quill")!;
    const quillId = quillUser.id;
    // The change ivy opened herself, through the web editor.
    personPull = await branchAndPull(alice, "ivy/subtitle", "Add a subtitle");
    // One the crew opened, so the masking that was meant has something to
    // mask on the very same page.
    agentPull = await branchAndPull(quillUser, "quill/lamp", "Hang a lamp");
    // A run of the crew's, on a tell of its own so it keeps its own row.
    const told = openIssue(app, alice, repo, { title: "Sweep the step" });
    if (!told.ok) throw new Error(String(told.error));
    agentRun = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: told.value.id,
      actorId: quillId,
      reason: "assigned",
    });
    claimRun(app.db, agentRun.id);
    agentRun =
      finishRun(app.db, agentRun.id, {
        state: "ok",
        summary: "swept",
        costUsd: 3.5,
        turns: 2,
      }) ?? agentRun;
    // And one nobody has picked up yet: a waiting row, the crew's to take.
    const waiting = openIssue(app, alice, repo, { title: "Wipe the bar" });
    if (!waiting.ok) throw new Error(String(waiting.error));
    expect(assignIssue(app, alice, repo, waiting.value, quillUser).ok).toBe(
      true,
    );
    waitingTell = getIssue(app.db, repo.id, waiting.value.number)!;
    // And one ivy took herself — a person holds it (#226's own row on the
    // panel), so the panel owes her name to whoever can see the row.
    const held = openIssue(app, alice, repo, { title: "Polish the sign" });
    if (!held.ok) throw new Error(String(held.error));
    expect(assignIssue(app, alice, repo, held.value, alice).ok).toBe(true);
    heldTell = getIssue(app.db, repo.id, held.value.number)!;
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("an anonymous visitor reads one author for one change on all three pages, avatar included", async () => {
    const appPage = await anon("/ivy/pub");
    const changes = await anon("/ivy/pub/changes");
    const change = await anon(`/ivy/pub/changes/${personPull.number}`);
    const onApp = rowWith(appPage, `/changes/${personPull.number}`);
    const onList = rowWith(changes, `/changes/${personPull.number}`);
    expect(onApp).toContain("ivy");
    expect(onApp).not.toContain("the crew");
    // The same name the list gives, and the same initials beside it.
    expect(initialsIn(onApp)).toBe(initialsIn(onList));
    expect(initialsIn(onApp)).toBe("i");
    expect(change).toContain("ivy");
    // A tell she took herself is hers on the same panel, by the same rule.
    const held = rowWith(appPage, `/tells/${heldTell.number}`);
    expect(held).toContain("ivy");
    expect(held).not.toContain("the crew");
    expect(initialsIn(held)).toBe("i");
  });
  test("the crew's own change and the crew's own run still read as the crew's to that visitor", async () => {
    const appPage = await anon("/ivy/pub");
    const onApp = rowWith(appPage, `/changes/${agentPull.number}`);
    expect(onApp).toContain("the crew");
    expect(onApp).not.toContain("quill");
    expect(initialsIn(onApp)).toBe("tc");
    const runRow = rowWith(appPage, `/runs/${agentRun.id}`);
    expect(runRow).toContain("the crew");
    expect(runRow).not.toContain("quill");
    const tellRow = rowWith(appPage, `/tells/${waitingTell.number}`);
    expect(tellRow).toContain("the crew");
    expect(tellRow).not.toContain("quill");
    // Nothing the owner keeps to herself came along with the name.
    expect(appPage).not.toContain("quill");
    expect(appPage).not.toMatch(/\$\d/);
    expect(appPage).not.toContain(">Crew<");
  });
  test("the owner still reads the crew by name, and her own change as her own", async () => {
    const appPage = await owner("/ivy/pub");
    expect(rowWith(appPage, `/changes/${agentPull.number}`)).toContain("quill");
    expect(rowWith(appPage, `/runs/${agentRun.id}`)).toContain("quill");
    expect(rowWith(appPage, `/changes/${personPull.number}`)).toContain("ivy");
  });
});
describe("the studio's empty lists", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let cookie: string;
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    }).then((r) => r.text());
  const setup = async (name: string) => {
    const made = await createRepo(app, alice, {
      name,
      visibility: "private",
      description: "",
    });
    if (!made.ok) throw new Error(String(made.error));
    const seeded = await commitToBranch(app, alice, made.value, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content: '{"name":"x","scripts":{"start":"bun run server.ts"}}\n',
        },
        { path: "server.ts", content: "export {};\n" },
      ],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, made.value, { slug: name });
    if (!enabled.ok) throw new Error(String(enabled.error));
    return made.value;
  };
  let alice: User;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-empty-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    cookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  });
  afterAll(async () => {
    servers.stop();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a repository with nothing in it says what to do, and blames no filter", async () => {
    await setup("blank");
    for (const [path, words] of [
      ["issues", "Tell the crew what you want"],
      ["pulls", "A change is the crew"],
      ["runs", "A run is one go"],
    ] as const) {
      const page = await get(`/alice/blank/${path}`);
      expect(page).toContain("Nothing here");
      expect(page).toContain(words);
      expect(page).not.toContain("this filter");
    }
  });
  test("a filter that hides every row is named", async () => {
    const repo = await setup("busy");
    const told = openIssue(app, alice, repo, { title: "Add a tab", body: "" });
    if (!told.ok) throw new Error(String(told.error));
    const issues = await get("/alice/busy/issues?word=shipped");
    expect(issues).toContain("Nothing told is shipped yet.");
    expect(issues).not.toContain("Tell the crew what you want");
    const pulls = await get("/alice/busy/pulls?word=look");
    expect(pulls).toContain("No change is look yet.");
    const runs = await get("/alice/busy/runs?word=stopped");
    expect(runs).toContain("No run is stopped yet.");
  });
});
/**
 * Issue #230: the studio's settings page can change the two facts it
 * prints most about an app — description and visibility — by posting to
 * the very same `/:owner/:name/settings` route dev's General page uses.
 */
describe("the studio can change what an app says it is (#230)", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let ownerCookie: string;
  let readerCookie: string;
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie?: string) =>
    fetch(`${base}${path}`, {
      headers: {
        cookie:
          cookie === undefined
            ? "forge_mode=studio"
            : `${cookie}; forge_mode=studio`,
      },
      redirect: "manual",
    });
  const post = (path: string, body: Record<string, string>, cookie: string) =>
    fetch(`${base}${path}`, {
      method: "POST",
      headers: {
        cookie: `${cookie}; forge_mode=studio`,
        origin: base,
      },
      body: new URLSearchParams(body),
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-about-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const alice = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!alice.ok) throw new Error(alice.error);
    const carol = await createUser(app.db, { trusted: true,
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!carol.ok) throw new Error(carol.error);
    ownerCookie = await signIn("alice");
    readerCookie = await signIn("carol");
    const made = await createRepo(app, alice.value, {
      name: "lamp",
      visibility: "public",
      description: "lights the hallway",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice.value, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "lamp\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    // Branch protection is on and unexposed by the studio's form — proof
    // that saving from here does not silently turn it off.
    const protectedOn = await updateRepoSettings(app, alice.value, repo, {
      protectDefault: true,
      requireReview: true,
      requireChecks: true,
    });
    if (!protectedOn.ok) throw new Error(String(protectedOn.error));
    repo = protectedOn.value;
    const enabled = await enableApp(app, alice.value, repo, { slug: "lamp" });
    if (!enabled.ok) throw new Error(String(enabled.error));
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a writer changes the description and visibility from the studio, and the app's page and the shelf row show it", async () => {
    // The About card names itself (`card=about`), so a real submit of it —
    // exactly what's posted here — changes its own fields and cannot touch
    // the branch protection it never shows.
    const before = await (
      await get("/alice/lamp/settings", ownerCookie)
    ).text();
    expect(before).toContain('<input type="hidden" name="card" value="about"');
    const saved = await post(
      "/alice/lamp/settings",
      {
        card: "about",
        description: "a lamp that stays lit all night",
        visibility: "private",
      },
      ownerCookie,
    );
    expect(saved.status).toBe(303);
    expect(saved.headers.get("location")).toBe("/alice/lamp/settings");
    const ownPage = await (
      await get("/alice/lamp", ownerCookie)
    ).text();
    expect(ownPage).toContain("a lamp that stays lit all night");
    expect(ownPage).toContain("Private");
    // `/app` has been a redirect to the studio app page since the dev app
    // page was folded into it (#433): the head to read is that page's.
    const moved = await get("/alice/lamp/app", ownerCookie);
    expect(moved.status).toBe(302);
    expect(moved.headers.get("location")).toBe("/alice/lamp");
    const appHead = await (await get("/alice/lamp", ownerCookie)).text();
    expect(appHead).toContain("Private");
    const shelf = await (await get("/apps", ownerCookie)).text();
    expect(shelf).toContain("a lamp that stays lit all night");
    const list = await (await get("/apps", ownerCookie)).text();
    expect(list).toContain("a lamp that stays lit all night");
    // Branch protection, never shown on this form, is exactly as it was.
    const dbRepo = getRepoById(app.db, repo.id);
    expect(dbRepo?.protectDefault).toBe(true);
    expect(dbRepo?.requireReview).toBe(true);
    expect(dbRepo?.requireChecks).toBe(true);
  });
  test("a reader gets neither control: no form on the settings page, and the post is refused", async () => {
    const settings = await (
      await get("/alice/lamp/settings", readerCookie)
    ).text();
    expect(settings).not.toContain('action="/alice/lamp/settings"');
    expect(settings).not.toContain("<textarea");
    const refused = await post(
      "/alice/lamp/settings",
      { description: "carol was here", visibility: "public" },
      readerCookie,
    );
    expect(refused.status).toBe(404);
    const dbRepo = getRepoById(app.db, repo.id);
    expect(dbRepo?.description).not.toBe("carol was here");
  });
});
describe("a run's transcript window", () => {
  test("a log already cut to its tail offers the last N, never all of the run", () => {
    const lines = ["one", "two", "three"];
    const cut = logBox({ id: "log", who: "scout", cap: 2, lines, allHref: "/x?all=1", truncated: true }).text;
    expect(cut).toContain("read the last");
    expect(cut).not.toContain("read all");
    const whole = logBox({ id: "log", who: "scout", cap: 2, lines, allHref: "/x?all=1" }).text;
    expect(whole).toContain("read all");
  });
});
@@ -0,0 +1,2103 @@
/**
 * The studio: what a stranger sees, shipping and taking back a change, the
 * crew panel, and the week's counts. One of the files the studio's suite
 * was split into so no one file sets the gate's floor (#2038); the rest are
 * test/studio*.test.ts.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { enableApp } from "../src/actions/apps.ts";
import type { EnvStatus } from "../src/apps/runtime.ts";
import { addToCrew, createAgent } from "../src/actions/crew.ts";
import { addTeamMember, createOrg, createTeam } from "../src/actions/orgs.ts";
import { openIssue } from "../src/actions/issues.ts";
import { mergePull, openPull } from "../src/actions/pulls.ts";
import {
  commitToBranch,
  createRepo,
  updateRepoSettings,
} from "../src/actions/repos.ts";
import { recordDecision } from "../src/core/decisions.ts";
import type { Issue } from "../src/core/issues.ts";
import { getPull, mergedPullCount, type Pull } from "../src/core/pulls.ts";
import { getRepo, type Repo } from "../src/core/repos.ts";
import {
  agentRunTotals,
  claimRun,
  createRun,
  finishRun,
  listRuns,
  markServing,
  previewLatency,
  STOPPED_SUMMARY,
  type Run,
} from "../src/core/runs.ts";
import { createUser, getUserByName, type User } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { NOBODY_ON_CREW } from "../src/web/studio/words.ts";
import { servedPhrase } from "../src/web/ui.ts";
import { serving } from "./helpers/studio.ts";
describe("a stranger sees the app, not the owner's books", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let repo: Repo;
  let alice: User;
  let ownerCookie: string;
  let strangerCookie: string;
  let run: Run;
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie?: string) =>
    fetch(`${base}${path}`, {
      headers: {
        cookie:
          cookie === undefined
            ? "forge_mode=studio"
            : `${cookie}; forge_mode=studio`,
      },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-public-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    const c = await createUser(app.db, { trusted: true,
      username: "carol",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!c.ok) throw new Error(c.error);
    ownerCookie = await signIn("alice");
    strangerCookie = await signIn("carol");
    const made = await createRepo(app, alice, {
      name: "beacon",
      visibility: "public",
      description: "a light that stays on",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "beacon\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "beacon" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const scout = await createAgent(app, alice, { username: "keeper" });
    if (!scout.ok) throw new Error(String(scout.error));
    expect(addToCrew(app, alice, repo, "keeper").ok).toBe(true);
    const on = await updateRepoSettings(app, alice, repo, {
      autonomy: "assisted",
      autonomyDirection: "",
      autonomyCeilingUsd: 25,
      autonomySlots: 2,
      autonomyBy: alice.id,
    });
    expect(on.ok).toBe(true);
    const tell = openIssue(app, alice, repo, { title: "Trim the wick" });
    if (!tell.ok) throw new Error(String(tell.error));
    const branch = await commitToBranch(app, alice, repo, {
      branch: "keeper/trim-the-wick",
      base: "main",
      message: "Trim the wick",
      files: [{ path: "WICK.md", content: "trim\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Trim the wick",
      body: `Closes #${tell.value.number}`,
      baseBranch: "main",
      headBranch: "keeper/trim-the-wick",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const keeperId = getUserByName(app.db, "keeper")!.id;
    run = createRun(app.db, {
      repoId: repo.id,
      kind: "agent",
      issueId: tell.value.id,
      branch: "keeper/trim-the-wick",
      actorId: keeperId,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    run =
      finishRun(app.db, run.id, {
        state: "ok",
        summary: `opened pull #${opened.value.number}`,
        costUsd: 42.5,
        turns: 7,
      }) ?? run;
    const merged = await mergePull(app, alice, repo, opened.value, "squash");
    if (!merged.ok) throw new Error(String(merged.error));
    recordDecision(app.db, {
      kind: "land",
      repoId: repo.id,
      issueId: tell.value.id,
      state: { card: "ask", head: opened.value.headOid },
      answer: "ship",
      p: 0.9,
      by: "rule",
      ms: 3,
    });
    // Three served deploys this week, median 4.0s, and a fourth that never
    // answered — excluded, not a zero that would drag the median down.
    const now = Date.now();
    for (const [offsetMs, durationMs] of [
      [0, 2_000],
      [1_000, 4_000],
      [2_000, 6_000],
      [3_000, null],
    ] as const) {
      const deploy = createRun(app.db, {
        repoId: repo.id,
        kind: "deploy",
        env: "production",
        commitOid: "cafefeed",
        reason: "push",
      });
      app.db
        .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
        .run(deploy.id, new Date(now + offsetMs).toISOString());
      if (durationMs !== null) {
        app.db
          .query("UPDATE run SET serving_at = ?2 WHERE id = ?1")
          .run(deploy.id, new Date(now + offsetMs + durationMs).toISOString());
      }
    }
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("anonymous and read-only visitors get the app, not the owner's numbers; the owner still gets everything", async () => {
    const anon = await (await get("/alice/beacon")).text();
    const stranger = await (await get("/alice/beacon", strangerCookie)).text();
    const owner = await (await get("/alice/beacon", ownerCookie)).text();
    for (const page of [anon, stranger]) {
      expect(page).not.toMatch(/\$\d/);
      expect(page).not.toContain("keeper");
      expect(page).not.toContain(">Decided<");
      expect(page).not.toContain(">On its own<");
      expect(page).not.toContain(">Slots<");
      expect(page).not.toContain("Nobody yet");
      // The app itself is still there: what it is, that it shipped, a way in.
      expect(page).toContain("a light that stays on");
      expect(page).toContain(">Shipped<");
      expect(page).toContain("1 change");
      expect(page).toContain("Open the app");
      // The direction's own number is the same owner's-books fact as spend
      // and the ledger: a stranger and an anonymous visitor see neither.
      expect(page).not.toContain(">Preview<");
      expect(page).not.toContain("reaches its preview");
    }
    expect(owner).toContain("$42.50");
    expect(owner).toContain("keeper");
    expect(owner).toContain(">On its own<");
    expect(owner).toContain(">Decided<");
    // Three served deploys this week — 2.0s, 4.0s and 6.0s — median 4.0s;
    // the fourth, never served, does not drag it toward zero.
    expect(owner).toContain("reaches its preview in 4.0s");
    expect(owner).toContain("· 3 deploys");
  });
  test("the app's live fragment carries no owner fact either", async () => {
    const fragment = await (await get("/alice/beacon/app/state")).text();
    expect(fragment).not.toMatch(/\$\d/);
    expect(fragment).not.toContain("keeper");
  });
  test("a run's own page hides cost, turns and the crew's name from a stranger and from an anonymous reader; the JSON API redacts the run the same way", async () => {
    const anonPage = await (await get(`/alice/beacon/runs/${run.id}`)).text();
    const strangerPage = await (
      await get(`/alice/beacon/runs/${run.id}`, strangerCookie)
    ).text();
    for (const page of [anonPage, strangerPage]) {
      expect(page).not.toContain("$42.50");
      expect(page).not.toContain("7 turns");
      expect(page).not.toContain("keeper");
      // The log box, which carried data-who, is not drawn for them (#1075).
      expect(page).toContain("<title>the crew on #");
      expect(page).not.toContain('id="run-log"');
    }
    const ownerPage = await (
      await get(`/alice/beacon/runs/${run.id}`, ownerCookie)
    ).text();
    expect(ownerPage).toContain("$42.50");
    expect(ownerPage).toContain("7 turns");
    expect(ownerPage).toContain('data-who="keeper"');
    const asStranger = (await (
      await get(`/api/v1/repos/alice/beacon/runs/${run.id}`, strangerCookie)
    ).json()) as { costUsd: number; turns: number };
    expect(asStranger.costUsd).toBe(0);
    expect(asStranger.turns).toBe(0);
    const asOwner = (await (
      await get(`/api/v1/repos/alice/beacon/runs/${run.id}`, ownerCookie)
    ).json()) as { costUsd: number; turns: number };
    expect(asOwner.costUsd).toBe(42.5);
    expect(asOwner.turns).toBe(7);
    const listAsStranger = (await (
      await get(`/api/v1/repos/alice/beacon/runs`, strangerCookie)
    ).json()) as { items: { costUsd: number }[] };
    expect(listAsStranger.items.every((r) => r.costUsd === 0)).toBe(true);
    // The log is the writers' and crew's (#1075): a stranger's tail is
    // refused, and carries neither the cost nor the transcript.
    const tailAsStranger = await get(
      `/api/v1/repos/alice/beacon/runs/${run.id}/log?follow=1`,
      strangerCookie,
    );
    expect(tailAsStranger.status).toBe(404);
    expect(await tailAsStranger.text()).not.toContain("42.5");
    const tailAsOwner = await (
      await get(
        `/api/v1/repos/alice/beacon/runs/${run.id}/log?follow=1`,
        ownerCookie,
      )
    ).text();
    expect(tailAsOwner).toContain("42.5");
  });
  test("the studio home names the crew for the owner, but only 'the crew' for a signed-in reader of the same public app", async () => {
    const asStranger = await (await get("/apps", strangerCookie)).text();
    expect(asStranger).not.toContain("keeper");
    expect(asStranger).toContain("beacon");
    const asOwner = await (await get("/apps", ownerCookie)).text();
    expect(asOwner).toContain("keeper");
    expect(asOwner).toContain("beacon");
  });
  const post = (path: string, body: Record<string, string>, cookie: string) =>
    fetch(`${base}${path}`, {
      method: "POST",
      headers: {
        cookie: `${cookie}; forge_mode=studio`,
        origin: base,
      },
      body: new URLSearchParams(body),
      redirect: "manual",
    });
  test("an autonomous app with nobody on its crew says so beside the mode, and stops saying it once a builder joins", async () => {
    const made = await createRepo(app, alice, { name: "lamp", visibility: "public" });
    if (!made.ok) throw new Error(String(made.error));
    const lamp = made.value;
    const seeded = await commitToBranch(app, alice, lamp, {
      message: "Start",
      files: [{ path: "README.md", content: "lamp\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, lamp, { slug: "lamp" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    const on = await updateRepoSettings(app, alice, lamp, {
      autonomy: "autonomous",
      autonomyDirection: "",
      autonomyCeilingUsd: 5,
      autonomySlots: 1,
      autonomyBy: alice.id,
    });
    expect(on.ok).toBe(true);
    const empty = await (await get("/alice/lamp", ownerCookie)).text();
    expect(empty).toContain("Autonomous");
    expect(empty).toContain("nobody on the crew");
    expect(empty).toContain('href="/alice/lamp/settings">Put someone on the crew');
    // The shelf's stuck word and this card share one phrase.
    expect(NOBODY_ON_CREW).toBe("nobody on the crew");
    const crewed = await (await get("/alice/beacon", ownerCookie)).text();
    expect(crewed).not.toContain("nobody on the crew");
    const agent = await createAgent(app, alice, { username: "wick" });
    if (!agent.ok) throw new Error(String(agent.error));
    expect(addToCrew(app, alice, lamp, "wick").ok).toBe(true);
    const joined = await (await get("/alice/lamp", ownerCookie)).text();
    expect(joined).not.toContain("nobody on the crew");
  });
  test("the studio's settings page renders the crew and the ceiling for a writer, with the same numbers the app page shows", async () => {
    const owner = await (
      await get("/alice/beacon/settings", ownerCookie)
    ).text();
    expect(owner).toContain("keeper");
    expect(owner).toContain(">Crew<");
    expect(owner).toContain(">On its own<");
    expect(owner).toMatch(/\$42\.50\s+of\s+\$25/);
    expect(owner).toContain("Remove");
    expect(owner).toContain("Save");
    // The rest is beneath, on the same page and in the same frame.
    expect(owner).toContain("<h2>Branch and gates</h2>");
    expect(owner.indexOf(">On its own<")).toBeLessThan(
      owner.indexOf("<h2>Branch and gates</h2>"),
    );
    expect(owner).toContain('href="/alice/beacon/settings/labels"');
    expect(owner).not.toContain("?mode=dev");
  });
  test("a reader without write sees no crew and no controls on the settings page; one who cannot read gets not-found", async () => {
    const stranger = await (
      await get("/alice/beacon/settings", strangerCookie)
    ).text();
    expect(stranger).not.toContain("keeper");
    expect(stranger).not.toMatch(/\$\d/);
    expect(stranger).not.toContain("Add to crew");
    expect(stranger).not.toContain("<select");
    const anon = await get("/alice/beacon/settings");
    expect(anon.status).toBe(200);
    const anonText = await anon.text();
    expect(anonText).not.toContain("keeper");
    const noSuchRepo = await get("/alice/no-such-app/settings", strangerCookie);
    expect(noSuchRepo.status).toBe(404);
  });
  test("a reader's post to the crew action is refused, exactly as dev's page refuses it", async () => {
    const refused = await post(
      "/alice/beacon/settings/crew",
      { agent: "keeper" },
      strangerCookie,
    );
    expect(refused.status).toBe(404);
  });
  test("each settings card saves only its own fields: About never turns a gate or the outsiders switch off, and Branch and gates never touches the words", async () => {
    const before = getRepo(app.db, "alice", "beacon")!;
    const on = await post(
      "/alice/beacon/settings",
      {
        card: "gates",
        defaultBranch: before.defaultBranch,
        protect: "on",
        requireReview: "on",
        // The settings page sends this marker beside the switch; without it a
        // save leaves the switch as it is (#822).
        crewOutsidersShown: "1",
        crewOutsiders: "on",
      },
      ownerCookie,
    );
    expect(on.status).toBe(303);
    let now = getRepo(app.db, "alice", "beacon")!;
    expect(now.crewOutsiders).toBe(true);
    expect(now.description).toBe(before.description);
    const about = await post(
      "/alice/beacon/settings",
      { card: "about", description: "a lamp", visibility: now.visibility },
      ownerCookie,
    );
    expect(about.status).toBe(303);
    now = getRepo(app.db, "alice", "beacon")!;
    expect(now.description).toBe("a lamp");
    expect(now.crewOutsiders).toBe(true);
    expect(now.protectDefault).toBe(true);
    expect(now.requireReview).toBe(true);
    // Put it back for the tests that follow.
    await post(
      "/alice/beacon/settings",
      {
        card: "gates",
        defaultBranch: before.defaultBranch,
        crewOutsidersShown: "1",
      },
      ownerCookie,
    );
    await post(
      "/alice/beacon/settings",
      { card: "about", description: before.description, visibility: before.visibility },
      ownerCookie,
    );
  });
  test("a role change made from the studio settings page lands exactly as dev's page does", async () => {
    const roleChange = await post(
      "/alice/beacon/settings/crew/keeper/role",
      { role: "reviewer" },
      ownerCookie,
    );
    expect(roleChange.status).toBe(303);
    expect(roleChange.headers.get("location")).toBe(
      "/alice/beacon/settings#crew",
    );
    const after = await (
      await get("/alice/beacon/settings", ownerCookie)
    ).text();
    expect(after).toContain("reviews");
  });
  test("?mode=dev on the settings route is the same one page; dev's Crew and Autonomy addresses land on its cards", async () => {
    const dev = await (
      await get("/alice/beacon/settings", ownerCookie)
    ).text();
    expect(dev).toContain(">General<");
    expect(dev).toContain(">Crew<");
    expect(dev).toContain("Description");
    expect(dev).toContain("<h2>Branch and gates</h2>");
    expect(dev).toContain('id="f-direction"');
    for (const [old, to] of [
      ["/alice/beacon/settings/crew", "/alice/beacon/settings#crew"],
      ["/alice/beacon/settings/autonomy", "/alice/beacon/settings#autonomy"],
    ]) {
      const res = await get(old!, ownerCookie);
      expect(res.status).toBe(303);
      expect(res.headers.get("location")).toBe(to!);
    }
    // A reader who cannot see the repository gets not-found, not a hint.
    const hidden = await get("/alice/no-such-app/settings/crew", ownerCookie);
    expect(hidden.status).toBe(404);
  });
});
/**
 * Issue #211: the studio's own Decide card ships a person's own change too,
 * not only the crew's — the same `/ship` route, the same conflict wording
 * (`change.ts:145-157` before this), offered to a writer, whoever opened it.
 */
describe("a person's own change ships from its own studio page", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let repo: Repo;
  let ownerCookie: string;
  let readerCookie: string;
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  const post = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      method: "POST",
      headers: { cookie, origin: base },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-own-ship-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    const r = await createUser(app.db, { trusted: true,
      username: "eve",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!r.ok) throw new Error(r.error);
    ownerCookie = await signIn("alice");
    readerCookie = await signIn("eve");
    const made = await createRepo(app, alice, {
      name: "garden",
      visibility: "public",
      description: "grown by hand, not by the crew",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content:
            '{"name":"garden","scripts":{"start":"bun run server.ts"}}\n',
        },
        {
          path: "server.ts",
          content:
            "Bun.serve({ port: Number(process.env.PORT), fetch: () => new Response('ok') });\n",
        },
      ],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "garden" });
    if (!enabled.ok) throw new Error(String(enabled.error));
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a green change alice opened herself offers Ship to a writer, and nothing to a reader; shipping lands it and the page reads shipped", async () => {
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/bench",
      base: "main",
      message: "Add a bench",
      files: [{ path: "BENCH.md", content: "a place to sit\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Add a bench",
      body: "For sitting.",
      baseBranch: "main",
      headBranch: "feature/bench",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "check",
      issueId: pull.id,
      env: `pull-${pull.number}`,
      commitOid: pull.headOid,
      reason: "pull",
    });
    claimRun(app.db, run.id);
    finishRun(app.db, run.id, { state: "ok", summary: "check passed in 1s" });
    const readerPage = await (
      await get(`/alice/garden/pulls/${pull.number}`, readerCookie)
    ).text();
    expect(readerPage).toContain('data-word="look"');
    expect(readerPage).not.toContain("<h2>Decide</h2>");
    expect(readerPage).not.toContain("Ship");
    const ownerPage = await (
      await get(`/alice/garden/pulls/${pull.number}`, ownerCookie)
    ).text();
    expect(ownerPage).toContain("<h2>Decide</h2>");
    expect(ownerPage).toContain("Ship");
    // The words a person's own green change is offered in are `asks.ts`'s
    // (#224: a green change asks to be looked at whoever opened it, and the
    // card says so without pretending somebody finished it for them). The
    // `own` fallback in `studio/change.ts` — "The check is green." — is what
    // an autonomous repository's own pull still gets, where the asks panel
    // offers nothing.
    expect(ownerPage).toContain(
      "is green — ready for a look. Ship it, or say what is off.",
    );
    const shipped = await post(
      `/alice/garden/pulls/${pull.number}/ship`,
      ownerCookie,
    );
    expect(shipped.status).toBe(303);
    expect(getPull(app.db, repo.id, pull.number)?.mergedAt).not.toBeNull();
    const after = await (
      await get(`/alice/garden/pulls/${pull.number}`, ownerCookie)
    ).text();
    expect(after).toContain('data-word="shipped"');
  });
  test("a conflicted change alice opened herself offers the bring-up-to-date wording, never a Ship that would be refused", async () => {
    const base1 = await commitToBranch(app, alice, repo, {
      message: "Add a file two branches will fight over",
      files: [{ path: "CONFLICT.md", content: "base\n" }],
    });
    if (!base1.ok) throw new Error(JSON.stringify(base1.error));
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/own-conflict",
      base: "main",
      message: "Alice's edit",
      files: [{ path: "CONFLICT.md", content: "base\nalice\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const onMain = await commitToBranch(app, alice, repo, {
      message: "Main's edit",
      files: [{ path: "CONFLICT.md", content: "base\nmain\n" }],
    });
    if (!onMain.ok) throw new Error(JSON.stringify(onMain.error));
    const opened = await openPull(app, alice, repo, {
      title: "Alice's conflicting change",
      body: "This will not merge cleanly.",
      baseBranch: "main",
      headBranch: "feature/own-conflict",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const run = createRun(app.db, {
      repoId: repo.id,
      kind: "check",
      issueId: pull.id,
      env: `pull-${pull.number}`,
      commitOid: pull.headOid,
      reason: "pull",
    });
    claimRun(app.db, run.id);
    finishRun(app.db, run.id, { state: "ok", summary: "check passed in 1s" });
    const studio = await (
      await get(`/alice/garden/pulls/${pull.number}`, ownerCookie)
    ).text();
    expect(studio).toContain("<h2>Decide</h2>");
    expect(studio).toContain("conflicts with main");
    expect(studio).toContain("bring the branch up to date");
    expect(studio).toContain("Bring up to date");
    expect(studio).not.toContain("Ship");
  });
});
/**
 * Issue #190: a shipped change's studio page offers Take it back to a
 * writer, behind the studio's existing confirm, and pressing it opens a new
 * change that undoes it.
 */
describe("take it back: the studio's verb on a shipped change", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let repo: Repo;
  let ownerCookie: string;
  let readerCookie: string;
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  const post = (path: string, cookie: string, origin = base) =>
    fetch(`${base}${path}`, {
      method: "POST",
      headers: { cookie, origin },
      redirect: "manual",
    });
  const shipChange = async (
    branch: string,
    title: string,
    content: string,
  ): Promise<Pull> => {
    const committed = await commitToBranch(app, alice, repo, {
      branch,
      base: "main",
      message: title,
      files: [{ path: "code.txt", content }],
    });
    if (!committed.ok) throw new Error(JSON.stringify(committed.error));
    const opened = await openPull(app, alice, repo, {
      title,
      baseBranch: "main",
      headBranch: branch,
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const merged = await mergePull(app, alice, repo, opened.value, "squash");
    if (!merged.ok) throw new Error(JSON.stringify(merged.error));
    return getPull(app.db, repo.id, opened.value.number)!;
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-take-back-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    const r = await createUser(app.db, { trusted: true,
      username: "eve",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!r.ok) throw new Error(r.error);
    ownerCookie = await signIn("alice");
    readerCookie = await signIn("eve");
    const made = await createRepo(app, alice, {
      name: "orchard",
      visibility: "public",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [
        {
          path: "package.json",
          content:
            '{"name":"orchard","scripts":{"start":"bun run server.ts"}}\n',
        },
        {
          path: "server.ts",
          content:
            "Bun.serve({ port: Number(process.env.PORT), fetch: () => new Response('ok') });\n",
        },
        { path: "code.txt", content: "alpha\n" },
      ],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "orchard" });
    if (!enabled.ok) throw new Error(String(enabled.error));
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a shipped change offers Take it back to a writer, not to a reader, and not while it is still open", async () => {
    const branch = await commitToBranch(app, alice, repo, {
      branch: "feature/loud",
      base: "main",
      message: "Make it loud",
      files: [{ path: "code.txt", content: "alpha\nBETA\n" }],
    });
    if (!branch.ok) throw new Error(JSON.stringify(branch.error));
    const opened = await openPull(app, alice, repo, {
      title: "Make it loud",
      baseBranch: "main",
      headBranch: "feature/loud",
    });
    if (!opened.ok) throw new Error(String(opened.error));
    const pull = opened.value;
    const whileOpen = await (
      await get(`/alice/orchard/pulls/${pull.number}`, ownerCookie)
    ).text();
    expect(whileOpen).not.toContain("Take it back");
    const merged = await mergePull(app, alice, repo, pull, "squash");
    if (!merged.ok) throw new Error(JSON.stringify(merged.error));
    const ownerPage = await (
      await get(`/alice/orchard/pulls/${pull.number}`, ownerCookie)
    ).text();
    expect(ownerPage).toContain("Take it back");
    expect(ownerPage).toContain(
      `/-/confirm?to=%2Falice%2Forchard%2Fpulls%2F${pull.number}%2Ftake-back`,
    );
    const readerPage = await (
      await get(`/alice/orchard/pulls/${pull.number}`, readerCookie)
    ).text();
    expect(readerPage).not.toContain("Take it back");
    const confirm = await (
      await get(
        `/-/confirm?to=${encodeURIComponent(`/alice/orchard/pulls/${pull.number}/take-back`)}`,
        ownerCookie,
      )
    ).text();
    expect(confirm).toContain("Take back");
    expect(confirm).toContain("Make it loud");
    expect(confirm).toContain(
      "opens a new change that undoes exactly what it shipped",
    );
  });
  test("pressing Take it back opens a new change and lands on its studio page", async () => {
    const shipped = await shipChange(
      "feature/gamma",
      "Add gamma",
      "alpha\nGAMMA\n",
    );
    const taken = await post(
      `/alice/orchard/pulls/${shipped.number}/take-back`,
      ownerCookie,
    );
    expect(taken.status).toBe(303);
    const location = taken.headers.get("location")!;
    expect(location).toBe(`/alice/orchard/pulls/${shipped.number + 1}`);
    const revertPage = await (await get(location, ownerCookie)).text();
    expect(revertPage).toContain(`Revert &quot;Add gamma&quot;`);
  });
  test("the POST is refused from another origin, and nothing is created", async () => {
    const shipped = await shipChange(
      "feature/delta",
      "Add delta",
      "alpha\nDELTA\n",
    );
    const forged = await post(
      `/alice/orchard/pulls/${shipped.number}/take-back`,
      ownerCookie,
      "https://evil.example",
    );
    expect(forged.status).toBe(403);
    expect(getPull(app.db, repo.id, shipped.number + 1)).toBeUndefined();
  });
  test("a refusal is said in the studio's own words, and takes nothing back twice", async () => {
    const shipped = await shipChange(
      "feature/epsilon",
      "Add epsilon",
      "alpha\nEPSILON\n",
    );
    const first = await post(
      `/alice/orchard/pulls/${shipped.number}/take-back`,
      ownerCookie,
    );
    expect(first.status).toBe(303);
    const again = await post(
      `/alice/orchard/pulls/${shipped.number}/take-back`,
      ownerCookie,
    );
    expect(again.status).toBe(303);
    const location = again.headers.get("location")!;
    expect(location).toBe(`/alice/orchard/pulls/${shipped.number}`);
    const flash = decodeURIComponent(again.headers.get("set-cookie") ?? "");
    expect(flash).toContain("already been taken back");
    // Only one revert pull exists — the second attempt created nothing.
    expect(getPull(app.db, repo.id, shipped.number + 1)?.title).toBe(
      'Revert "Add epsilon"',
    );
    expect(getPull(app.db, repo.id, shipped.number + 2)).toBeUndefined();
  });
});
describe("the studio's crew panel on a forge with no agents yet", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let ownerCookie: string;
  let teamAdminCookie: string;
  const signIn = async (username: string): Promise<string> =>
    (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username,
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
  const get = (path: string, cookie: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${cookie}; forge_mode=studio` },
      redirect: "manual",
    });
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-studio-no-agents-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    const alice = a.value;
    const b = await createUser(app.db, { trusted: true,
      username: "bob",
      email: "[email protected]",
      password: "a-good-passphrase",
    });
    if (!b.ok) throw new Error(b.error);
    ownerCookie = await signIn("alice");
    teamAdminCookie = await signIn("bob");
    // alice's own app: she is both the repo's admin and the forge's.
    const pad = await createRepo(app, alice, {
      name: "pad",
      visibility: "public",
    });
    if (!pad.ok) throw new Error(String(pad.error));
    const padSeeded = await commitToBranch(app, alice, pad.value, {
      message: "Start",
      files: [{ path: "README.md", content: "pad\n" }],
    });
    if (!padSeeded.ok) throw new Error(JSON.stringify(padSeeded.error));
    const padEnabled = await enableApp(app, alice, pad.value, { slug: "pad" });
    if (!padEnabled.ok) throw new Error(String(padEnabled.error));
    // an org app whose team admin, bob, is not a forge admin.
    const org = await createOrg(app, alice, "acme");
    if (!org.ok) throw new Error(org.error);
    const team = await createTeam(app, alice, org.value, "leads", "admin");
    if (!team.ok) throw new Error(String(team.error));
    const added = await addTeamMember(app, alice, org.value, team.value, "bob");
    if (!added.ok) throw new Error(String(added.error));
    const vault = await createRepo(app, alice, {
      name: "vault",
      owner: "acme",
      visibility: "public",
    });
    if (!vault.ok) throw new Error(String(vault.error));
    const vaultSeeded = await commitToBranch(app, alice, vault.value, {
      message: "Start",
      files: [{ path: "README.md", content: "vault\n" }],
    });
    if (!vaultSeeded.ok) throw new Error(JSON.stringify(vaultSeeded.error));
    const vaultEnabled = await enableApp(app, alice, vault.value, {
      slug: "vault",
    });
    if (!vaultEnabled.ok) throw new Error(String(vaultEnabled.error));
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  test("a forge admin sees the crew panel name the door an agent is made through, and reaches it in one click without leaving studio mode", async () => {
    const settings = await (
      await get("/alice/pad/settings", ownerCookie)
    ).text();
    expect(settings).toContain("No agents exist on this forge yet.");
    expect(settings).not.toContain("Add an agent below");
    expect(settings).toContain('href="/settings/crew"');
    const doorResponse = await get("/settings/crew", ownerCookie);
    expect(doorResponse.status).toBe(200);
    const crewPage = await doorResponse.text();
    expect(crewPage).toContain("New agent");
    expect(crewPage).toContain('action="/settings/crew"');
  });
  test("a repository admin who is not a forge admin is told who can add an agent, not sent to a page that refuses them", async () => {
    const settings = await (
      await get("/acme/vault/settings", teamAdminCookie)
    ).text();
    expect(settings).toContain(
      "No agents exist on this forge yet. An admin can add one.",
    );
    expect(settings).not.toContain('href="/settings/crew"');
    const refused = await get("/settings/crew", teamAdminCookie);
    expect(refused.status).toBe(404);
  });
  test("the app page's 'Add someone' leads unbroken to the door an agent is made through, with nothing dev-only in the way", async () => {
    const appPage = await (await get("/alice/pad", ownerCookie)).text();
    expect(appPage).toContain("Nobody yet");
    expect(appPage).toContain('href="/alice/pad/settings">Add someone.');
    const settings = await (
      await get("/alice/pad/settings", ownerCookie)
    ).text();
    expect(settings).toContain('href="/settings/crew"');
    const door = await get("/settings/crew", ownerCookie);
    expect(door.status).toBe(200);
    const doorBody = await door.text();
    expect(doorBody).toContain("New agent");
  });
});
/**
 * The one function every page words a deployment's speed with. The pages
 * above prove it reaches the studio; these prove what it says at the edges,
 * where a real deploy is awkward to arrange.
 */
describe("servedPhrase", () => {
  const env = (extra: Partial<EnvStatus>): EnvStatus => ({
    env: "production",
    state: "running",
    commitOid: "cafebabe",
    url: "http://vault.apps.test",
    ...extra,
  });
  test("says nothing at all until the deployment serves", () => {
    expect(
      servedPhrase(
        env({
          createdAt: "2026-01-01T00:00:00.000Z",
          deployStartedAt: "2026-01-01T00:00:02.000Z",
        }),
      ),
    ).toBeUndefined();
  });
  test("clocks that disagree clamp to zero rather than printing a negative", () => {
    expect(
      servedPhrase(
        env({
          createdAt: "2026-01-01T00:00:00.300Z",
          deployStartedAt: "2026-01-01T00:00:00.300Z",
          servingAt: "2026-01-01T00:00:00.000Z",
        }),
      ),
    ).toBe("0.0s after the push");
    // A start before the push it answers is skew too: no negative wait.
    expect(
      servedPhrase(
        env({
          createdAt: "2026-01-01T00:00:05.000Z",
          deployStartedAt: "2026-01-01T00:00:00.000Z",
          servingAt: "2026-01-01T00:00:06.000Z",
        }),
      ),
    ).toBe("1.0s after the push");
  });
  test("a wait under a second is noise: the phrase reads as it always has", () => {
    expect(
      servedPhrase(
        env({
          createdAt: "2026-01-01T00:00:00.000Z",
          deployStartedAt: "2026-01-01T00:00:00.900Z",
          servingAt: "2026-01-01T00:00:04.300Z",
        }),
      ),
    ).toBe("4.3s after the push");
  });
  test("a push with no start recorded is still measured from the push", () => {
    expect(
      servedPhrase(
        env({
          createdAt: "2026-01-01T00:00:00.000Z",
          servingAt: "2026-01-01T00:00:02.500Z",
        }),
      ),
    ).toBe("2.5s after the push");
  });
  test("a deployment with neither instant, and an unreadable one, say nothing", () => {
    expect(
      servedPhrase(env({ servingAt: "2026-01-01T00:00:02.500Z" })),
    ).toBeUndefined();
    expect(
      servedPhrase(
        env({ createdAt: "not a time", servingAt: "2026-01-01T00:00:02.500Z" }),
      ),
    ).toBeUndefined();
  });
});
describe("previewLatency: the median seconds from push to serving", () => {
  let dataDir: string;
  let app: App;
  let alice: User;
  let repo: Repo;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-preview-latency-"));
    app = createApp({ dataDir, port: 0 });
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    const made = await createRepo(app, alice, {
      name: "latency",
      visibility: "private",
      description: "",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
  });
  afterAll(async () => {
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  /** A deploy run stamped with a known push instant and, unless null, known started/serving instants. */
  const seedDeploy = (
    createdAt: string,
    startedAt: string | null,
    servingAt: string | null,
  ): void => {
    const deploy = createRun(app.db, { repoId: repo.id, kind: "deploy" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(deploy.id, createdAt);
    if (startedAt !== null) {
      app.db
        .query("UPDATE run SET started_at = ?2 WHERE id = ?1")
        .run(deploy.id, startedAt);
    }
    if (servingAt !== null) {
      app.db
        .query("UPDATE run SET serving_at = ?2 WHERE id = ?1")
        .run(deploy.id, servingAt);
    }
  };
  test("no deploys, a never-served one, and the median of a growing set — all against one window", () => {
    const now = Date.now();
    const since = new Date(now - 60_000).toISOString();
    // Nothing seeded yet: undefined, never a zero.
    expect(previewLatency(app.db, repo.id, since)).toBeUndefined();
    // Before the window: a very slow deploy that must not pull the median up.
    seedDeploy(
      new Date(now - 10 * 24 * 60 * 60_000).toISOString(),
      null,
      new Date(now - 10 * 24 * 60 * 60_000 + 600_000).toISOString(),
    );
    expect(previewLatency(app.db, repo.id, since)).toBeUndefined();
    // A deploy that never served is left out, not counted as a zero.
    seedDeploy(new Date(now).toISOString(), null, null);
    expect(previewLatency(app.db, repo.id, since)).toBeUndefined();
    // Three served deploys, seeded out of order: an odd-count median.
    const durations = [2, 6, 4]; // seconds
    durations.forEach((d, i) => {
      const createdAt = new Date(now + i * 1_000).toISOString();
      seedDeploy(
        createdAt,
        null,
        new Date(Date.parse(createdAt) + d * 1_000).toISOString(),
      );
    });
    const odd = previewLatency(app.db, repo.id, since)!;
    expect(odd.n).toBe(3);
    expect(odd.medianSeconds).toBeCloseTo(4, 2);
    // A fourth deploy, 10s: the even-count median is the mean of the middle two.
    const createdAt = new Date(now + 3_000).toISOString();
    seedDeploy(
      createdAt,
      null,
      new Date(Date.parse(createdAt) + 10_000).toISOString(),
    );
    const even = previewLatency(app.db, repo.id, since)!;
    expect(even.n).toBe(4);
    expect(even.medianSeconds).toBeCloseTo(5, 2);
    // None of the above carried a `started_at`: the split has nothing to say.
    expect(even.queueMedianSeconds).toBeUndefined();
    expect(even.bootMedianSeconds).toBeUndefined();
    expect(even.splitN).toBe(0);
  });
  test("the split between waiting to be picked up and coming up, seeded beside a total", () => {
    const now = Date.now() + 10_000_000; // clear of the previous test's window
    const since = new Date(now - 60_000).toISOString();
    // Three deploys with known queue and boot segments: (queue, boot) in seconds.
    const segments: readonly (readonly [number, number])[] = [
      [1, 3],
      [2, 6],
      [3, 9],
    ];
    segments.forEach(([queue, boot], i) => {
      const createdAt = now + i * 1_000;
      const startedAt = createdAt + queue * 1_000;
      const servingAt = startedAt + boot * 1_000;
      seedDeploy(
        new Date(createdAt).toISOString(),
        new Date(startedAt).toISOString(),
        new Date(servingAt).toISOString(),
      );
    });
    const full = previewLatency(app.db, repo.id, since)!;
    expect(full.n).toBe(3);
    expect(full.splitN).toBe(3);
    expect(full.queueMedianSeconds).toBeCloseTo(2, 2);
    expect(full.bootMedianSeconds).toBeCloseTo(6, 2);
    // A fourth, served deploy with no `started_at`: it feeds the total but
    // is left out of the split, never counted as a zero-length queue or boot.
    const createdAt = now + 3_000;
    seedDeploy(
      new Date(createdAt).toISOString(),
      null,
      new Date(createdAt + 100_000).toISOString(),
    );
    const withGap = previewLatency(app.db, repo.id, since)!;
    expect(withGap.n).toBe(4);
    expect(withGap.splitN).toBe(3);
    expect(withGap.queueMedianSeconds).toBeCloseTo(2, 2);
    expect(withGap.bootMedianSeconds).toBeCloseTo(6, 2);
  });
  test("a deploy that finished without ever serving is counted apart, never in the median; one still running is counted as neither", () => {
    const now = Date.now() + 20_000_000; // clear of the earlier tests' windows
    const since = new Date(now - 60_000).toISOString();
    // Two served deploys, 4s and 6s.
    [4, 6].forEach((d, i) => {
      const createdAt = new Date(now + i * 1_000).toISOString();
      seedDeploy(
        createdAt,
        null,
        new Date(Date.parse(createdAt) + d * 1_000).toISOString(),
      );
    });
    const clean = previewLatency(app.db, repo.id, since)!;
    expect(clean.n).toBe(2);
    expect(clean.failedN).toBe(0);
    expect(clean.medianSeconds).toBeCloseTo(5, 2);
    // A deploy still queued: neither served nor finished. Moves neither number.
    const inFlight = createRun(app.db, { repoId: repo.id, kind: "deploy" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(inFlight.id, new Date(now + 2_000).toISOString());
    const withInFlight = previewLatency(app.db, repo.id, since)!;
    expect(withInFlight.n).toBe(2);
    expect(withInFlight.failedN).toBe(0);
    expect(withInFlight.medianSeconds).toBeCloseTo(5, 2);
    // A deploy that finished but never served — counted as failed, never a
    // zero-second deploy pulling the median down.
    const failed = createRun(app.db, { repoId: repo.id, kind: "deploy" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(failed.id, new Date(now + 3_000).toISOString());
    claimRun(app.db, failed.id);
    finishRun(app.db, failed.id, { state: "failed", summary: "build failed" });
    const withFailed = previewLatency(app.db, repo.id, since)!;
    expect(withFailed.n).toBe(2);
    expect(withFailed.failedN).toBe(1);
    expect(withFailed.medianSeconds).toBeCloseTo(5, 2);
    // A cancelled deploy that never served also counts as failed.
    const cancelled = createRun(app.db, { repoId: repo.id, kind: "deploy" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(cancelled.id, new Date(now + 4_000).toISOString());
    claimRun(app.db, cancelled.id);
    app.db
      .query(
        "UPDATE run SET state = 'cancelled', finished_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?1",
      )
      .run(cancelled.id);
    const withCancelled = previewLatency(app.db, repo.id, since)!;
    expect(withCancelled.n).toBe(2);
    expect(withCancelled.failedN).toBe(2);
    expect(withCancelled.medianSeconds).toBeCloseTo(5, 2);
  });
  test("a week with only never-served deploys still reports the failed count, with no median to give", () => {
    const now = Date.now() + 30_000_000;
    const since = new Date(now - 60_000).toISOString();
    const failed = createRun(app.db, { repoId: repo.id, kind: "deploy" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(failed.id, new Date(now).toISOString());
    claimRun(app.db, failed.id);
    finishRun(app.db, failed.id, { state: "failed", summary: "build failed" });
    const latency = previewLatency(app.db, repo.id, since)!;
    expect(latency).toBeDefined();
    expect(latency.n).toBe(0);
    expect(latency.failedN).toBe(1);
    expect(latency.medianSeconds).toBeUndefined();
  });
  test("a deploy the forge's own restart cancelled is never counted as failed, nor in the total it is 'of' (#255, #274)", () => {
    const now = Date.now() + 40_000_000;
    const since = new Date(now - 60_000).toISOString();
    // A real failure: counted.
    const failed = createRun(app.db, { repoId: repo.id, kind: "deploy" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(failed.id, new Date(now).toISOString());
    claimRun(app.db, failed.id);
    finishRun(app.db, failed.id, { state: "failed", summary: "build failed" });
    // A deploy the forge's own restart cancelled: not this commit's fault,
    // and not counted at all — neither as a failure nor in the total.
    const stopped = createRun(app.db, { repoId: repo.id, kind: "deploy" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(stopped.id, new Date(now + 1_000).toISOString());
    claimRun(app.db, stopped.id);
    app.db
      .query(
        "UPDATE run SET state = 'cancelled', summary = ?2, finished_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?1",
      )
      .run(stopped.id, STOPPED_SUMMARY);
    const latency = previewLatency(app.db, repo.id, since)!;
    expect(latency.n).toBe(0);
    expect(latency.failedN).toBe(1);
    // A person's own Cancel, carrying a different summary, still counts —
    // only the forge's own reason is left out.
    const byPerson = createRun(app.db, { repoId: repo.id, kind: "deploy" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(byPerson.id, new Date(now + 2_000).toISOString());
    claimRun(app.db, byPerson.id);
    app.db
      .query(
        "UPDATE run SET state = 'cancelled', summary = 'cancelled by alice', finished_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?1",
      )
      .run(byPerson.id);
    const withPerson = previewLatency(app.db, repo.id, since)!;
    expect(withPerson.failedN).toBe(2);
  });
});
describe("the studio's own words for how fast a change reaches its preview", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let repo: Repo;
  let ownerCookie: string;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-preview-latency-page-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    ownerCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "trickle",
      visibility: "private",
      description: "",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "start\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "trickle" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    // Enough history behind it that these tests exercise the preview
    // wording, not the day-one line (#274) — a finished agent run from
    // well outside this week's own window.
    const seedRun = createRun(app.db, { repoId: repo.id, kind: "agent" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(
        seedRun.id,
        new Date(Date.now() - 30 * 24 * 60 * 60_000).toISOString(),
      );
    claimRun(app.db, seedRun.id);
    finishRun(app.db, seedRun.id, { state: "ok", summary: "seed" });
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${ownerCookie}; forge_mode=studio` },
      redirect: "manual",
    });
  test("fewer than three served deploys this week says so plainly rather than a median of one", async () => {
    const before = await (await get("/alice/trickle")).text();
    expect(before).toContain("not enough deploys this week to say");
    expect(before).not.toContain("reaches its preview in");
    const deploy = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      reason: "push",
    });
    markServing(app.db, deploy.id);
    const one = await (await get("/alice/trickle")).text();
    expect(one).toContain("not enough deploys this week to say");
    expect(one).not.toContain("reaches its preview in");
  });
  test("the split reads as the total's explanation, and says when it is drawn from fewer deploys", async () => {
    const seedDeploy = (
      createdAt: string,
      startedAt: string | null,
      servingAt: string,
    ): void => {
      const deploy = createRun(app.db, { repoId: repo.id, kind: "deploy" });
      app.db
        .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
        .run(deploy.id, createdAt);
      if (startedAt !== null) {
        app.db
          .query("UPDATE run SET started_at = ?2 WHERE id = ?1")
          .run(deploy.id, startedAt);
      }
      app.db
        .query("UPDATE run SET serving_at = ?2 WHERE id = ?1")
        .run(deploy.id, servingAt);
    };
    // Three deploys with a known queue and boot each.
    const now = Date.now();
    const segments: readonly (readonly [number, number])[] = [
      [1, 3],
      [2, 6],
      [3, 9],
    ];
    segments.forEach(([queue, boot], i) => {
      const createdAt = now + i * 1_000;
      const startedAt = createdAt + queue * 1_000;
      const servingAt = startedAt + boot * 1_000;
      seedDeploy(
        new Date(createdAt).toISOString(),
        new Date(startedAt).toISOString(),
        new Date(servingAt).toISOString(),
      );
    });
    // A fourth, served deploy with no `started_at`: it feeds the total but
    // is left out of the split.
    seedDeploy(
      new Date(now + 3_000).toISOString(),
      null,
      new Date(now + 100_000).toISOString(),
    );
    const page = await (await get("/alice/trickle")).text();
    expect(page).toContain("4 deploys");
    expect(page).toContain("2.0s waiting");
    // Only 3 of the 4 served deploys carried a `started_at`: the split says so.
    expect(page).toContain("6.0s coming up (3 of 4)");
    // A clean week — every deploy served — reads exactly as it always has:
    // no mention of failures, no empty clause left dangling.
    expect(page).not.toContain("never reached a preview");
    expect(page).not.toContain("0 failed");
  });
  test("a deploy that finished without ever serving is counted and worded, and links to the runs list", async () => {
    const before = await (await get("/alice/trickle")).text();
    const failed = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      reason: "push",
    });
    claimRun(app.db, failed.id);
    finishRun(app.db, failed.id, { state: "failed", summary: "build failed" });
    const after = await (await get("/alice/trickle")).text();
    expect(after).toContain("1 of 5 never reached a preview");
    expect(after).toContain(`href="/alice/trickle/runs?kind=deploy"`);
    // A deploy still running moves neither the served count nor the failed
    // count: it is neither served nor finished.
    const inFlight = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      reason: "push",
    });
    claimRun(app.db, inFlight.id);
    const withInFlight = await (await get("/alice/trickle")).text();
    expect(withInFlight).toContain("1 of 5 never reached a preview");
    expect(withInFlight).not.toBe(before);
  });
});
describe("a low deploy count never reads as a failure ratio (#274)", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let repo: Repo;
  let ownerCookie: string;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-low-count-ratio-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    ownerCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "tworuns",
      visibility: "private",
      description: "",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "start\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "tworuns" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    // History behind it, so the full panel renders — but only two deploys
    // this week, both never served, neither the forge's own doing.
    const seedRun = createRun(app.db, { repoId: repo.id, kind: "agent" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(
        seedRun.id,
        new Date(Date.now() - 30 * 24 * 60 * 60_000).toISOString(),
      );
    claimRun(app.db, seedRun.id);
    finishRun(app.db, seedRun.id, { state: "ok", summary: "seed" });
    for (let i = 0; i < 2; i++) {
      const failed = createRun(app.db, {
        repoId: repo.id,
        kind: "deploy",
        env: "production",
        reason: "push",
      });
      claimRun(app.db, failed.id);
      finishRun(app.db, failed.id, {
        state: "failed",
        summary: "build failed",
      });
    }
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${ownerCookie}; forge_mode=studio` },
      redirect: "manual",
    });
  test("2 of 2 never reads as a ratio — a handful of deploys needs to be behind it first", async () => {
    const page = await (await get("/alice/tworuns")).text();
    expect(page).toContain("not enough deploys this week to say");
    expect(page).not.toContain("never reached a preview");
  });
});
describe("this week's runs and spend are counted by the database, not read off a page of runs", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let busy: Repo;
  let quiet: Repo;
  let ownerCookie: string;
  /** How many agent runs this week — more than `listRuns` would ever hand back. */
  const RUNS = 250;
  /** What each of them cost, in the float dollars the column holds. */
  const COST = 0.13;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-week-totals-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    ownerCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    for (const name of ["busy", "quiet"] as const) {
      const made = await createRepo(app, alice, {
        name,
        visibility: "private",
        description: "",
      });
      if (!made.ok) throw new Error(String(made.error));
      const seeded = await commitToBranch(app, alice, made.value, {
        message: "Start",
        files: [{ path: "README.md", content: "start\n" }],
      });
      if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
      const enabled = await enableApp(app, alice, made.value, { slug: name });
      if (!enabled.ok) throw new Error(String(enabled.error));
      if (name === "busy") busy = made.value;
      if (name === "quiet") quiet = made.value;
    }
    // A real week behind "quiet", just not this one — an old finished run,
    // so a week with nothing in it still reads as a quiet week (#274), not
    // as an app with no history at all.
    const oldQuiet = createRun(app.db, { repoId: quiet.id, kind: "agent" });
    claimRun(app.db, oldQuiet.id);
    finishRun(app.db, oldQuiet.id, { state: "ok", summary: "long ago" });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(
        oldQuiet.id,
        new Date(Date.now() - 30 * 24 * 60 * 60_000).toISOString(),
      );
    const keeper = await createAgent(app, alice, { username: "keeper" });
    if (!keeper.ok) throw new Error(String(keeper.error));
    expect(addToCrew(app, alice, busy, "keeper").ok).toBe(true);
    const keeperId = getUserByName(app.db, "keeper")!.id;
    // 250 agent runs inside the week — past the 200 `listRuns` will return —
    // and one fat run ten days back that the window must leave out.
    for (let i = 0; i < RUNS; i++) {
      const r = createRun(app.db, {
        repoId: busy.id,
        kind: "agent",
        actorId: keeperId,
        reason: "assigned",
      });
      claimRun(app.db, r.id);
      finishRun(app.db, r.id, {
        state: "ok",
        summary: "did a thing",
        costUsd: COST,
      });
    }
    const old = createRun(app.db, {
      repoId: busy.id,
      kind: "agent",
      actorId: keeperId,
      reason: "assigned",
    });
    claimRun(app.db, old.id);
    finishRun(app.db, old.id, {
      state: "ok",
      summary: "last month",
      costUsd: 99,
    });
    app.db
      .query("UPDATE run SET created_at = ?2 WHERE id = ?1")
      .run(old.id, new Date(Date.now() - 10 * 24 * 60 * 60_000).toISOString());
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${ownerCookie}; forge_mode=studio` },
      redirect: "manual",
    });
  test("the aggregate counts every run in the window, skips the one outside it, and is 0 for a week with none", () => {
    const week = new Date(Date.now() - 7 * 24 * 60 * 60_000).toISOString();
    const totals = agentRunTotals(app.db, busy.id, week);
    expect(totals.runs).toBe(RUNS);
    expect(totals.spentUsd).toBeCloseTo(RUNS * COST, 6);
    // The whole ledger, window opened wide: the old run is there after all.
    const ever = agentRunTotals(app.db, busy.id, "2000-01-01T00:00:00.000Z");
    expect(ever.runs).toBe(RUNS + 1);
    expect(ever.spentUsd).toBeCloseTo(RUNS * COST + 99, 6);
    // SUM over no rows is NULL; a repository with no runs reads zero.
    const none = agentRunTotals(app.db, "no-such-repo", week);
    expect(none).toEqual({ runs: 0, spentUsd: 0 });
  });
  test("the app page says 250 runs and the sum of all 250, not the last 200", async () => {
    const page = await (await get("/alice/busy")).text();
    expect(page).toMatch(/Runs<\/dt>\s*<dd>250<\/dd>/);
    expect(page).toContain(`$${(RUNS * COST).toFixed(2)}`);
    // What the 200-row read would have said, and the run outside the window.
    expect(page).not.toContain(`$${(200 * COST).toFixed(2)}`);
    expect(page).not.toContain("$99.00");
  });
  test("an app with real history but no runs this week reads 0 and $0.00, never blank", async () => {
    const page = await (await get("/alice/quiet")).text();
    expect(page).toMatch(/Runs<\/dt>\s*<dd>0<\/dd>/);
    expect(page).toContain("$0.00");
  });
});
describe("this week's shipping is counted by the database, not read off a page of closed pulls", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let busy: Repo;
  let quiet: Repo;
  let ownerCookie: string;
  /** How many changes landed this week — past the page of closed pulls the
   * count used to be filtered out of. */
  const SHIPPED = 150;
  /** One agent run's cost, so the page prints a cost per shipped change. */
  const SPENT = 30;
  /** A pull row on a closed issue: `mergedAt` null is closed without a merge. */
  const seedPull = (repo: Repo, title: string, mergedAt: string | null) => {
    const opened = openIssue(app, alice, repo, { title });
    if (!opened.ok) throw new Error(String(opened.error));
    app.db
      .query(
        `INSERT INTO pull (issue_id, base_branch, head_branch, base_oid, head_oid, merged_at)
         VALUES (?1, 'main', ?2, 'a', 'b', ?3)`,
      )
      .run(opened.value.id, `f${opened.value.number}`, mergedAt);
    app.db
      .query("UPDATE issue SET kind = 'pull', state = 'closed' WHERE id = ?1")
      .run(opened.value.id);
  };
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-week-shipped-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    ownerCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    for (const name of ["busy", "quiet"] as const) {
      const made = await createRepo(app, alice, {
        name,
        visibility: "private",
        description: "",
      });
      if (!made.ok) throw new Error(String(made.error));
      const seeded = await commitToBranch(app, alice, made.value, {
        message: "Start",
        files: [{ path: "README.md", content: "start\n" }],
      });
      if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
      const enabled = await enableApp(app, alice, made.value, { slug: name });
      if (!enabled.ok) throw new Error(String(enabled.error));
      if (name === "busy") busy = made.value;
      if (name === "quiet") quiet = made.value;
    }
    // 150 changes landed inside the week — past the hundred closed pulls the
    // page used to read — plus two that must not count: one closed without a
    // merge, and one merged ten days back.
    const now = Date.now();
    for (let i = 0; i < SHIPPED; i++)
      seedPull(busy, `landed ${i}`, new Date(now - i * 60_000).toISOString());
    seedPull(busy, "abandoned", null);
    seedPull(
      busy,
      "landed last week",
      new Date(now - 10 * 24 * 60 * 60_000).toISOString(),
    );
    // A real week behind "quiet", just not this one — a change shipped a
    // month back, so a week with nothing new still reads as a quiet week
    // (#274), not as an app with no history at all.
    seedPull(
      quiet,
      "shipped a month ago",
      new Date(now - 30 * 24 * 60 * 60_000).toISOString(),
    );
    const keeper = await createAgent(app, alice, { username: "keeper" });
    if (!keeper.ok) throw new Error(String(keeper.error));
    expect(addToCrew(app, alice, busy, "keeper").ok).toBe(true);
    const run = createRun(app.db, {
      repoId: busy.id,
      kind: "agent",
      actorId: getUserByName(app.db, "keeper")!.id,
      reason: "assigned",
    });
    claimRun(app.db, run.id);
    finishRun(app.db, run.id, {
      state: "ok",
      summary: "a week of work",
      costUsd: SPENT,
    });
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${ownerCookie}; forge_mode=studio` },
      redirect: "manual",
    });
  test("the aggregate counts the merged pulls in the window and nothing else", () => {
    const week = new Date(Date.now() - 7 * 24 * 60 * 60_000).toISOString();
    expect(mergedPullCount(app.db, busy.id, week)).toBe(SHIPPED);
    // Window opened wide: the older merge is there after all, the pull closed
    // without a merge still is not.
    expect(mergedPullCount(app.db, busy.id, "2000-01-01T00:00:00.000Z")).toBe(
      SHIPPED + 1,
    );
    // COUNT over no rows is 0, and another repo's merges are never this one's.
    expect(mergedPullCount(app.db, "no-such-repo", week)).toBe(0);
  });
  test("the app page says 150 changes shipped, not the 100 a page of closed pulls holds", async () => {
    const page = await (await get("/alice/busy")).text();
    expect(page).toMatch(/Shipped<\/dt>\s*<dd>150 changes<\/dd>/);
    expect(page).not.toContain("100 changes");
    // And the cost of a shipped change divides by all 150.
    expect(page).toContain(
      `$${(SPENT / SHIPPED).toFixed(2)} per shipped change`,
    );
  });
  test("an app with real history but nothing shipped this week reads 0 changes and no cost per change", async () => {
    const page = await (await get("/alice/quiet")).text();
    expect(page).toMatch(/Shipped<\/dt>\s*<dd>0 changes<\/dd>/);
    expect(page).not.toContain("per shipped change");
  });
});
describe("a one-minute-old app's front door does not lead with a week of zeros (#274)", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let base: string;
  let alice: User;
  let repo: Repo;
  let ownerCookie: string;
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-day-one-"));
    app = createApp({ dataDir, port: 0 });
    servers = await serve(app);
    base = servers.url;
    const a = await createUser(app.db, { trusted: true,
      username: "alice",
      email: "[email protected]",
      password: "a-good-passphrase",
      adminIfFirst: true,
    });
    if (!a.ok) throw new Error(a.error);
    alice = a.value;
    ownerCookie = (
      (
        await fetch(`${base}/signin`, {
          method: "POST",
          body: new URLSearchParams({
            username: "alice",
            password: "a-good-passphrase",
          }),
          redirect: "manual",
        })
      ).headers.get("set-cookie") ?? ""
    ).split(";")[0]!;
    const made = await createRepo(app, alice, {
      name: "newborn",
      visibility: "public",
      description: "",
    });
    if (!made.ok) throw new Error(String(made.error));
    repo = made.value;
    const seeded = await commitToBranch(app, alice, repo, {
      message: "Start",
      files: [{ path: "README.md", content: "start\n" }],
    });
    if (!seeded.ok) throw new Error(JSON.stringify(seeded.error));
    const enabled = await enableApp(app, alice, repo, { slug: "newborn" });
    if (!enabled.ok) throw new Error(String(enabled.error));
    // Exactly the shape of a one-minute-old app: its own first two
    // production deploys, one of which the forge's own restart cancelled —
    // never a shipped change, never an agent run.
    const cancelledByForge = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      reason: "boot",
    });
    claimRun(app.db, cancelledByForge.id);
    app.db
      .query(
        "UPDATE run SET state = 'cancelled', summary = ?2, finished_at = strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id = ?1",
      )
      .run(cancelledByForge.id, STOPPED_SUMMARY);
    const secondBoot = createRun(app.db, {
      repoId: repo.id,
      kind: "deploy",
      env: "production",
      reason: "push",
    });
    claimRun(app.db, secondBoot.id);
  });
  afterAll(async () => {
    servers.stop();
    app.close();
    await rm(dataDir, { recursive: true, force: true });
  });
  const get = (path: string) =>
    fetch(`${base}${path}`, {
      headers: { cookie: `${ownerCookie}; forge_mode=studio` },
      redirect: "manual",
    });
  test("the day-one page a person lands on from New app says one true line, not a week of zeros", async () => {
    const page = await (await get("/alice/newborn")).text();
    expect(page).toContain("This week");
    expect(page).toContain("Nothing to show yet");
    // Not a single zero from the old panel, and not the scary ratio: the
    // forge's own cancelled boot is never counted, and two deploys is well
    // under the threshold a ratio needs anyway.
    expect(page).not.toMatch(/Runs<\/dt>/);
    expect(page).not.toMatch(/Spent<\/dt>/);
    expect(page).not.toContain("never reached a preview");
    expect(page).not.toContain("$0.00");
  });
  test("a stranger sees the same quiet line, not the owner's zeros", async () => {
    const page = await (await fetch(`${base}/alice/newborn`)).text();
    expect(page).toContain("Nothing to show yet");
    expect(page).not.toMatch(/Shipped<\/dt>\s*<dd>0 changes<\/dd>/);
  });
});
		@@ -738,12 +738,26 @@ bun run check:record # the same, and rewrites scripts/test-times.json
738	738	`bun run check` is the gate: the same command `forge.json` declares, so what
739	739	it says here is what the deploy will say. It type-checks once, then runs the
740	740	test files `scripts/gate.ts` lists in `GATE` as parallel `bun test` shards
741		(`scripts/test-shards.ts`): one per CPU the process may use, at most eight,
742		and `FORGE_CHECK_SHARDS=2` turns that down on a small or busy host. Each
	741	(`scripts/test-shards.ts`): one per CPU the process may use, no more than
	742	one per 512 MiB of the memory its cgroup allows (16 on the 16-CPU, 8 GiB
	743	check cell; the old ceiling of eight left half of it idle, #2038), and
	744	`FORGE_CHECK_SHARDS=2` turns that down on a small or busy host. Each
743	745	shard's output is written whole as it finishes; the log ends with every
744	746	failing test from every shard, or on green with one line — how many tests,
745	747	across how many files, in how long, then the slowest and fastest shard.
746	748
	749	Two things keep a test's setup in milliseconds (#2038). `bunfig.toml`
	750	preloads `test/helpers/preload.ts`, which hashes passwords at argon2id's
	751	floor (8 KiB, one pass) instead of Bun's default 64 MiB, two passes:
	752	making an account and signing it in was ~700 ms of a typical `beforeAll`
	753	and is now ~15 ms; the forge itself never loads it. And `openDb` keeps
	754	the empty database each migration list makes: the second fresh database
	755	in a process is a copy of it rather than ninety-odd migrations again
	756	(`createApp` ~100 ms → ~6 ms). No test file runs one subject long
	757	enough to set the gate's floor alone: the studio's and the apps
	758	adversarial suites are split by subject into `test/studio*.test.ts` and
	759	`test/apps-adversarial*.test.ts`.
	760
747	761	The check's first step is the gate-list audit (`bun scripts/gate.ts`), so a
748	762	test file listed in neither `GATE` nor `EXCLUDED` fails in under a second,
749	763	before install-heavy work. `tsc` then runs `--incremental` with a 2 GB heap,
		@@ -2,3 +2,6 @@
2	2	# where a running forge keeps the crew's clones, each with its own tests.
3	3	[test]
4	4	root = "test"
	5	# Argon2 at its cheapest under test: most of a typical beforeAll was
	6	# hashing passwords (#2038). Production never loads it.
	7	preload = ["./test/helpers/preload.ts"]
		@@ -156,6 +156,11 @@ export const GATE: readonly string[] = [
156	156	"test/autonomy.test.ts",
157	157	"test/autonomy_sweep.test.ts",
158	158	"test/studio.test.ts",
	159	"test/studio-changes.test.ts",
	160	"test/studio-door.test.ts",
	161	"test/studio-runs.test.ts",
	162	"test/studio-shipping.test.ts",
	163	"test/studio-search.test.ts",
159	164	"test/studio-words.test.ts",
160	165	"test/converge-settled.test.ts",
161	166	"test/following.test.ts",
		@@ -179,6 +184,10 @@ export const GATE: readonly string[] = [
179	184	"test/apps-slow-test.test.ts",
180	185	"test/apps-tests-clause.test.ts",
181	186	"test/apps-adversarial.test.ts",
	187	"test/apps-adversarial-teardown.test.ts",
	188	"test/apps-adversarial-test-step.test.ts",
	189	"test/apps-adversarial-grants.test.ts",
	190	"test/apps-adversarial-rules.test.ts",
182	191	"test/apps-busy.test.ts",
183	192	"test/apps-token.test.ts",
184	193	"test/contain.test.ts",
		@@ -7,22 +7,41 @@
7	7	* is disjoint and covering, and that one red shard makes the run red.
8	8	*/
9	9
10		/** No more than this many `bun test` processes at once, whatever the host. */
11		export const SHARDS_MAX = 8;
	10	/**
	11	* No more than this many `bun test` processes at once, whatever the host:
	12	* a ceiling for a big shared machine, not the check cell's number. The cell
	13	* (16 CPUs, 8 GiB) is bounded by its CPUs and its memory (#2038); the
	14	* old ceiling of 8 left half its CPUs idle.
	15	*/
	16	export const SHARDS_MAX = 32;
12	17
13	18	/**
14		* How many shards: one per CPU the process may use, capped at
	19	* Memory one `bun test` process is given room for: the heaviest suite peaks
	20	* near 260 MiB of its own (test/studio.test.ts, measured with
	21	* `resourceUsage().maxRSS`), and an apps suite's deploys add children of
	22	* their own, so twice that. Fewer workers than CPUs on a cell whose memory
	23	* would not hold one per CPU, rather than an OOM kill mid-gate (#386).
	24	*/
	25	export const WORKER_MEMORY_BYTES = 512 * 1024 * 1024;
	26
	27	/**
	28	* How many shards: one per CPU the process may use, no more than its
	29	* memory holds at {@link WORKER_MEMORY_BYTES} each, capped at
15	30	* {@link SHARDS_MAX} and at the number of files, at least one. One per CPU,
16	31	* not fewer: most of a forge test's time is spent waiting on git children
17		* and timers, not computing. `FORGE_CHECK_SHARDS` overrides it (still
18		* capped at the file count) so a small or busy host can turn it down.
	32	* and timers, not computing. `memory` absent is not a bound.
	33	* `FORGE_CHECK_SHARDS` overrides it (still capped at the file count) so a
	34	* small or busy host can turn it down.
19	35	*/
20	36	export function shardCount(
21	37	cpus: number,
22	38	files: number,
23	39	override?: string,
	40	memory?: number,
24	41	): { ok: true; value: number } \| { ok: false; error: string } {
25	42	let n = Math.min(SHARDS_MAX, Math.floor(cpus));
	43	if (memory !== undefined && Number.isFinite(memory) && memory > 0)
	44	n = Math.min(n, Math.floor(memory / WORKER_MEMORY_BYTES));
26	45	if (override !== undefined && override.trim() !== "") {
27	46	if (!/^[1-9][0-9]{0,2}$/.test(override.trim()))
28	47	return {
		@@ -34,6 +53,26 @@ export function shardCount(
34	53	return { ok: true, value: Math.max(1, Math.min(n, files)) };
35	54	}
36	55
	56	/**
	57	* The memory a process may use: the least of the machine's and each
	58	* cgroup limit it can read (`memory.max` under v2, `memory.limit_in_bytes`
	59	* under v1). "max", a v1 "no limit" (a page-rounded 2^63), an unreadable
	60	* file (`undefined`) or anything not a whole number is no limit.
	61	*/
	62	export function memoryLimit(
	63	total: number,
	64	limits: readonly (string \| undefined)[],
	65	): number {
	66	let least = total;
	67	for (const text of limits) {
	68	const value = text?.trim() ?? "";
	69	if (!/^[0-9]{1,19}$/.test(value)) continue;
	70	const bytes = Number(value);
	71	if (bytes > 0 && bytes < least) least = bytes;
	72	}
	73	return least;
	74	}
	75
37	76	/**
38	77	* Splits `files` into at most `n` disjoint, non-empty slices that together
39	78	* hold every file once. `weight` is how long a file is expected to take
		@@ -38,12 +38,13 @@
38	38	* table is rewritten from those times when every file is green.
39	39	*/
40	40
41		import { availableParallelism, tmpdir } from "node:os";
	41	import { availableParallelism, tmpdir, totalmem } from "node:os";
42	42	import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
43	43	import { join } from "node:path";
44	44	import {
45	45	formatTimes,
46	46	heaviestFirst,
	47	memoryLimit,
47	48	overlayTimes,
48	49	refreshTimes,
49	50	parseShardSpec,
		@@ -326,10 +327,21 @@ if (new Set(files).size !== files.length) {
326	327	process.exit(2);
327	328	}
328	329
	330	const readLimit = (path: string): string \| undefined => {
	331	try {
	332	return readFileSync(path, "utf8");
	333	} catch {
	334	return undefined;
	335	}
	336	};
329	337	const count = shardCount(
330	338	availableParallelism(),
331	339	files.length,
332	340	process.env["FORGE_CHECK_SHARDS"],
	341	memoryLimit(totalmem(), [
	342	readLimit("/sys/fs/cgroup/memory.max"),
	343	readLimit("/sys/fs/cgroup/memory/memory.limit_in_bytes"),
	344	]),
333	345	);
334	346	if (!count.ok) {
335	347	console.error(`test-shards: ${count.error}`);
		@@ -1,5 +1,9 @@
1	1	{
2		"test/apps-adversarial.test.ts": 145.9,
	2	"test/apps-adversarial-grants.test.ts": 28.3,
	3	"test/apps-adversarial-rules.test.ts": 29.7,
	4	"test/apps-adversarial-teardown.test.ts": 36.4,
	5	"test/apps-adversarial-test-step.test.ts": 33.5,
	6	"test/apps-adversarial.test.ts": 18,
3	7	"test/apps-busy.test.ts": 26.4,
4	8	"test/apps-crew.test.ts": 3.8,
5	9	"test/apps-identity.test.ts": 3.2,
		@@ -45,8 +49,13 @@
45	49	"test/spawn.test.ts": 11.1,
46	50	"test/standing.test.ts": 2.8,
47	51	"test/steer.test.ts": 16.2,
	52	"test/studio-changes.test.ts": 31.8,
	53	"test/studio-door.test.ts": 34.2,
	54	"test/studio-runs.test.ts": 29.3,
	55	"test/studio-search.test.ts": 30.7,
	56	"test/studio-shipping.test.ts": 35.6,
48	57	"test/studio-words.test.ts": 17,
49		"test/studio.test.ts": 196.9,
	58	"test/studio.test.ts": 35.3,
50	59	"test/usage.test.ts": 17.5,
51	60	"test/vitals.test.ts": 7.1,
52	61	"test/web-apps.test.ts": 18.7,
		@@ -6,6 +6,7 @@
6	6	*/
7	7
8	8	import { Database } from "bun:sqlite";
	9	import { existsSync, writeFileSync } from "node:fs";
9	10	import { migrate } from "./migrate.ts";
10	11
11	12	/**
		@@ -34,12 +35,48 @@ const CACHE_KIB = 64 * 1024;
34	35	const MMAP_BYTES = 512 * 1024 * 1024;
35	36
36	37	export function openDb(path: string, migrations: readonly string[]): Database {
37		const db = new Database(path, { create: true, strict: true });
	38	const memory = path === ":memory:";
	39	const fresh = memory \|\| !existsSync(path);
	40	const image = fresh ? migratedEmpty.get(migrations) : undefined;
	41	let db: Database;
	42	if (image !== undefined && memory) {
	43	db = Database.deserialize(rollbackJournal(image), { strict: true });
	44	} else {
	45	if (image !== undefined) writeFileSync(path, image, { flag: "wx" });
	46	db = new Database(path, { create: true, strict: true });
	47	}
38	48	applyPragmas(db);
	49	// On a copy every migration is already recorded, so this is a no-op —
	50	// and a list that grew since the copy was taken still runs what is new.
39	51	migrate(db, migrations);
	52	if (fresh && image === undefined) migratedEmpty.set(migrations, db.serialize());
40	53	return db;
41	54	}
42	55
	56	/**
	57	* The empty database each migration list makes, kept by this process after
	58	* it makes it once: a fresh database after the first is a copy of it, not
	59	* ninety-odd migrations again. A forge opens one fresh database in its life,
	60	* so this is the test suite's saving — about 90 ms of every `createApp` — and
	61	* production never reads a copy. Keyed by the list itself, so a test's own
	62	* list is never confused with the schema. An empty database is the same
	63	* bytes however it was made: the migrations that draw randomness only
	64	* rewrite rows an empty database does not have.
	65	*/
	66	const migratedEmpty = new WeakMap<readonly string[], Uint8Array>();
	67
	68	/**
	69	* The image with its header saying "rollback journal" (bytes 18 and 19 of a
	70	* SQLite file are the read and write versions: 2 is WAL, 1 legacy), which
	71	* an in-memory database needs — memory has no write-ahead log to open.
	72	*/
	73	function rollbackJournal(image: Uint8Array): Uint8Array {
	74	const copy = image.slice();
	75	copy[18] = 1;
	76	copy[19] = 1;
	77	return copy;
	78	}
	79
43	80	/**
44	81	* The pragmas, in one place and applied before anything else touches the
45	82	* handle. `journal_mode` and `foreign_keys` are correctness; the rest are
		@@ -0,0 +1,281 @@
	1	/**
	2	* Adversarial coverage for apps (docs/APPS.md), through a live apps
	3	* runtime: the private-preview grant and the proxy. Split from apps-
	4	* adversarial.test.ts so no one file sets the gate's floor (#2038); each
	5	* file of the split boots its own forge and runtime.
	6	*/
	7
	8	import { afterAll, beforeAll, describe, expect, test } from "bun:test";
	9	import { mkdtemp, rm } from "node:fs/promises";
	10	import { tmpdir } from "node:os";
	11	import { join } from "node:path";
	12	import { createApp, type App } from "../src/app.ts";
	13	import { AppsRuntime } from "../src/apps/runtime.ts";
	14	import { parseAppHost, signGrant, verifyGrant } from "../src/apps/proxy.ts";
	15	import { newApp, updateAppSettings } from "../src/actions/apps.ts";
	16	import { listRuns, type Run } from "../src/core/runs.ts";
	17	import { createUser, type User } from "../src/core/users.ts";
	18	import { serve, type Servers } from "../src/http/server.ts";
	19
	20	const DOMAIN = "apps.test";
	21
	22	describe("apps adversarial: grants and the proxy", () => {
	23	let dataDir: string;
	24	let work: string;
	25	let app: App;
	26	let servers: Servers;
	27	let runtime: AppsRuntime;
	28	let alice: User;
	29
	30	const viaHost = (host: string, path = "/", init: RequestInit = {}) =>
	31	fetch(`${servers.url}${path}`, {
	32	...init,
	33	headers: { ...(init.headers as Record<string, string>), host },
	34	redirect: "manual",
	35	});
	36
	37	async function settled(
	38	repoId: string,
	39	where: (run: Run) => boolean,
	40	timeoutMs = 60_000,
	41	): Promise<Run> {
	42	const deadline = Date.now() + timeoutMs;
	43	while (Date.now() < deadline) {
	44	const run = listRuns(app.db, repoId, { kind: "deploy", limit: 50 }).find(
	45	where,
	46	);
	47	if (
	48	run &&
	49	(run.state === "ok" \|\|
	50	run.state === "failed" \|\|
	51	run.state === "cancelled")
	52	)
	53	return run;
	54	await Bun.sleep(50);
	55	}
	56	throw new Error("run did not settle in time");
	57	}
	58
	59	beforeAll(async () => {
	60	dataDir = await mkdtemp(join(tmpdir(), "forge-adv-"));
	61	work = await mkdtemp(join(tmpdir(), "forge-adv-work-"));
	62	app = createApp({ dataDir, port: 0 });
	63	servers = await serve(app);
	64	runtime = new AppsRuntime(app, {
	65	domain: DOMAIN,
	66	scheme: "http",
	67	publicPort: servers.port,
	68	forgeUrl: servers.url,
	69	concurrency: 2,
	70	});
	71	await runtime.start();
	72	const created = await createUser(app.db, { trusted: true,
	73	username: "alice",
	74	email: "[email protected]",
	75	password: "a-good-passphrase",
	76	adminIfFirst: true,
	77	});
	78	if (!created.ok) throw new Error(created.error);
	79	alice = created.value;
	80	}, 30_000);
	81
	82	afterAll(async () => {
	83	await runtime.stop();
	84	servers.stop();
	85	app.close();
	86	await rm(dataDir, { recursive: true, force: true });
	87	await rm(work, { recursive: true, force: true });
	88	});
	89
	90	test("private grant: forged, tampered, expired, wrong-env, and open-redirect are all refused; cookie is HttpOnly/SameSite", async () => {
	91	const made = await newApp(app, alice, {
	92	name: "grants",
	93	visibility: "private",
	94	});
	95	expect(made.ok).toBe(true);
	96	if (!made.ok) return;
	97	const repo = made.value.repo;
	98	const record = made.value.app;
	99	await settled(repo.id, (r) => r.env === "production");
	100
	101	const target = { app: record, env: "production" as const };
	102	const good = signGrant(dataDir, target, 60_000);
	103	expect(verifyGrant(dataDir, good, target)).toBe(true);
	104
	105	// Wrong environment: a grant for production names none for a preview.
	106	expect(verifyGrant(dataDir, good, { app: record, env: "pull-1" })).toBe(
	107	false,
	108	);
	109
	110	// Expired: signed in the past with a short ttl.
	111	const expired = signGrant(dataDir, target, 1_000, Date.now() - 10_000);
	112	expect(verifyGrant(dataDir, expired, target)).toBe(false);
	113
	114	// Tampered signature: the payload is untouched, but the MAC no longer
	115	// matches it — this is the actual HMAC check, not just a field mismatch.
	116	const parts = good.split(".");
	117	const payload = parts.slice(0, -1).join(".");
	118	const sig = parts.at(-1)!;
	119	const flipped = sig.at(-1) === "A" ? "B" : "A";
	120	const tampered = `${payload}.${sig.slice(0, -1)}${flipped}`;
	121	expect(verifyGrant(dataDir, tampered, target)).toBe(false);
	122
	123	// Tampered payload: flip a character in the app id segment — the
	124	// signature is now for a different message entirely.
	125	const idTampered = `x${payload.slice(1)}.${sig}`;
	126	expect(verifyGrant(dataDir, idTampered, target)).toBe(false);
	127
	128	// Forged: right shape, made-up signature.
	129	const forged = `${record.id}.production.${Date.now() + 60_000}.notarealsignature`;
	130	expect(verifyGrant(dataDir, forged, target)).toBe(false);
	131
	132	// Hitting the grant endpoint on a public app: it still answers (it
	133	// is not access-gated by itself), but the token must still verify
	134	// correctly against that public app's own target.
	135	const publicMade = await newApp(app, alice, {
	136	name: "grantpublic",
	137	visibility: "public",
	138	});
	139	expect(publicMade.ok).toBe(true);
	140	if (publicMade.ok) {
	141	await settled(publicMade.value.repo.id, (r) => r.env === "production");
	142	const pubGrantUrl = `http://grantpublic.${DOMAIN}/__forge/grant?t=${encodeURIComponent(good)}&to=/`;
	143	// A production-app grant token does not verify for a different app's
	144	// target, so this must be refused (404) even though the destination
	145	// app is public.
	146	const url = new URL(pubGrantUrl);
	147	const crossApp = await viaHost(url.host, `${url.pathname}${url.search}`);
	148	expect(crossApp.status).toBe(404);
	149	}
	150
	151	// Open redirect: `to=//evil` and `to=http://evil` must both collapse to `/`.
	152	const okToken = signGrant(dataDir, target, 60_000);
	153	for (const to of [
	154	"//evil.example",
	155	"http://evil.example",
	156	"https://evil.example/x",
	157	]) {
	158	const resp = await viaHost(
	159	`grants.${DOMAIN}`,
	160	`/__forge/grant?t=${encodeURIComponent(okToken)}&to=${encodeURIComponent(to)}`,
	161	);
	162	expect(resp.status).toBe(303);
	163	expect(resp.headers.get("location")).toBe("/");
	164	}
	165
	166	// The cookie itself: HttpOnly and SameSite=Lax.
	167	const grantResp = await viaHost(
	168	`grants.${DOMAIN}`,
	169	`/__forge/grant?t=${encodeURIComponent(okToken)}&to=/`,
	170	);
	171	const cookie = grantResp.headers.get("set-cookie") ?? "";
	172	expect(cookie.toLowerCase()).toContain("httponly");
	173	expect(cookie).toContain("SameSite=Lax");
	174
	175	// Invariant 9: a private repository never distinguishes "you're
	176	// anonymous" from "you're signed in but still can't see it" — both
	177	// must read `not_found`, or an anonymous prober could tell the two
	178	// apart and learn something about a repo they cannot see.
	179	const strangerCreated = await createUser(app.db, { trusted: true,
	180	username: "stranger",
	181	email: "[email protected]",
	182	password: "a-good-passphrase",
	183	});
	184	expect(strangerCreated.ok).toBe(true);
	185	if (!strangerCreated.ok) return;
	186	const { openEnvUrl } = await import("../src/actions/apps.ts");
	187	const anonOnPrivateRepo = openEnvUrl(app, undefined, repo, "production");
	188	expect(anonOnPrivateRepo.ok).toBe(false);
	189	if (!anonOnPrivateRepo.ok)
	190	expect(anonOnPrivateRepo.error).toBe("not_found");
	191	const strangerOnPrivateRepo = openEnvUrl(
	192	app,
	193	strangerCreated.value,
	194	repo,
	195	"production",
	196	);
	197	expect(strangerOnPrivateRepo.ok).toBe(false);
	198	if (!strangerOnPrivateRepo.ok)
	199	expect(strangerOnPrivateRepo.error).toBe("not_found");
	200
	201	// `unauthorized` is reachable only through the other combination: a
	202	// public repository (so `canRead` already passes for anyone) whose
	203	// app access is explicitly overridden to "private". There, an
	204	// anonymous visitor has nothing to be vouched with, and a signed-in
	205	// stranger who can read the public code is still not let in: a private
	206	// app answers to its writers and crew only (#620).
	207	const overrideMade = await newApp(app, alice, {
	208	name: "publicwithprivateapp",
	209	visibility: "public",
	210	});
	211	expect(overrideMade.ok).toBe(true);
	212	if (!overrideMade.ok) return;
	213	await settled(overrideMade.value.repo.id, (r) => r.env === "production");
	214	updateAppSettings(app, alice, overrideMade.value.repo, {
	215	access: "private",
	216	});
	217	const anonOnPublicRepo = openEnvUrl(
	218	app,
	219	undefined,
	220	overrideMade.value.repo,
	221	"production",
	222	);
	223	expect(anonOnPublicRepo.ok).toBe(false);
	224	if (!anonOnPublicRepo.ok)
	225	expect(anonOnPublicRepo.error).toBe("unauthorized");
	226	const strangerOnPublicRepo = openEnvUrl(
	227	app,
	228	strangerCreated.value,
	229	overrideMade.value.repo,
	230	"production",
	231	);
	232	expect(strangerOnPublicRepo.ok).toBe(false);
	233	if (!strangerOnPublicRepo.ok)
	234	expect(strangerOnPublicRepo.error).toBe("not_found");
	235	}, 60_000);
	236
	237	test("the proxy: hop-by-hop headers are stripped, an upstream that dies mid-request yields a clean error, a claimed upgrade is a request", async () => {
	238	const made = await newApp(app, alice, {
	239	name: "proxytest",
	240	visibility: "public",
	241	});
	242	expect(made.ok).toBe(true);
	243	if (!made.ok) return;
	244	const repo = made.value.repo;
	245	await settled(repo.id, (r) => r.env === "production");
	246
	247	const page = await viaHost(`proxytest.${DOMAIN}`);
	248	expect(page.status).toBe(200);
	249	// Hop-by-hop response headers never reach the client from the proxy
	250	// path (the app itself doesn't set them, but the proxy must strip them
	251	// if it ever did — assert the contract on the response we did get).
	252	for (const h of ["connection", "transfer-encoding", "keep-alive"]) {
	253	expect(page.headers.has(h)).toBe(false);
	254	}
	255
	256	// The slug is case-insensitive end to end, through the database too —
	257	// not just in `parseAppHost`'s own lowercasing.
	258	const upperCase = await viaHost(`PROXYTEST.${DOMAIN}`);
	259	expect(upperCase.status).toBe(200);
	260	expect(await upperCase.text()).toBe(await page.text());
	261
	262	// A request that says `Upgrade: websocket` without a handshake key is
	263	// not a handshake: it is fetched as a request, the hop-by-hop headers
	264	// stripped, and the app answers it as one. Real sockets are
	265	// test/apps-ws.test.ts.
	266	const ws = await viaHost(`proxytest.${DOMAIN}`, "/", {
	267	headers: { upgrade: "websocket", connection: "Upgrade" },
	268	});
	269	expect(ws.status).toBe(200);
	270
	271	// Stop the live process out from under the proxy (simulating a crash
	272	// mid-request) and confirm the next request gets the forge's own
	273	// "not running" page, never a raw connection-refused/502 from Bun.
	274	const { stopEnv } = await import("../src/actions/apps.ts");
	275	await stopEnv(app, alice, repo, "production");
	276	const afterStop = await viaHost(`proxytest.${DOMAIN}`);
	277	expect(afterStop.status).toBe(502);
	278	expect(await afterStop.text()).toContain("not running");
	279	}, 60_000);
	280
	281	});
		@@ -0,0 +1,557 @@
	1	/**
	2	* Adversarial coverage for apps (docs/APPS.md), through a live apps
	3	* runtime: environment names, preview data, and rules 1 and 4. Split from
	4	* apps-adversarial.test.ts so no one file sets the gate's floor (#2038);
	5	* each file of the split boots its own forge and runtime.
	6	*/
	7
	8	import { afterAll, beforeAll, describe, expect, test } from "bun:test";
	9	import { mkdtemp, rm } from "node:fs/promises";
	10	import { tmpdir } from "node:os";
	11	import { join } from "node:path";
	12	import { createApp, type App } from "../src/app.ts";
	13	import { AppsRuntime } from "../src/apps/runtime.ts";
	14	import { newApp, updateAppSettings } from "../src/actions/apps.ts";
	15	import { addToCrew, createAgent } from "../src/actions/crew.ts";
	16	import { mergePull, openPull } from "../src/actions/pulls.ts";
	17	import {
	18	commitToBranch,
	19	createRepo,
	20	forkRepo,
	21	updateRepoSettings,
	22	} from "../src/actions/repos.ts";
	23	import { getPull } from "../src/core/pulls.ts";
	24	import { getRepoById } from "../src/core/repos.ts";
	25	import { resolveOid } from "../src/git/merge.ts";
	26	import { repoDir } from "../src/git/repos.ts";
	27	import {
	28	cancelRun,
	29	claimRun,
	30	createRun,
	31	finishRun,
	32	listRuns,
	33	type Run,
	34	} from "../src/core/runs.ts";
	35	import { createToken } from "../src/core/tokens.ts";
	36	import { createUser, type User } from "../src/core/users.ts";
	37	import { serve, type Servers } from "../src/http/server.ts";
	38	import { grantedCookie } from "./helpers/identity.ts";
	39	import { gitClientEnv } from "./helpers/git-client.ts";
	40
	41	const DOMAIN = "apps.test";
	42
	43	const clientEnv = gitClientEnv({
	44	GIT_AUTHOR_NAME: "Agent",
	45	GIT_AUTHOR_EMAIL: "[email protected]",
	46	GIT_COMMITTER_NAME: "Agent",
	47	GIT_COMMITTER_EMAIL: "[email protected]",
	48	});
	49
	50	async function sh(args: string[], cwd: string) {
	51	const proc = Bun.spawn(args, {
	52	cwd,
	53	env: clientEnv,
	54	stdout: "pipe",
	55	stderr: "pipe",
	56	});
	57	const [out, err, code] = await Promise.all([
	58	new Response(proc.stdout).text(),
	59	new Response(proc.stderr).text(),
	60	proc.exited,
	61	]);
	62	return { code, out: out.trim(), err: err.trim() };
	63	}
	64
	65	describe("apps adversarial: env names, preview data, and rules 1/4", () => {
	66	let dataDir: string;
	67	let work: string;
	68	let app: App;
	69	let servers: Servers;
	70	let runtime: AppsRuntime;
	71	let alice: User;
	72
	73	const viaHost = (host: string, path = "/", init: RequestInit = {}) =>
	74	fetch(`${servers.url}${path}`, {
	75	...init,
	76	headers: { ...(init.headers as Record<string, string>), host },
	77	redirect: "manual",
	78	});
	79
	80	async function settled(
	81	repoId: string,
	82	where: (run: Run) => boolean,
	83	timeoutMs = 60_000,
	84	): Promise<Run> {
	85	const deadline = Date.now() + timeoutMs;
	86	while (Date.now() < deadline) {
	87	const run = listRuns(app.db, repoId, { kind: "deploy", limit: 50 }).find(
	88	where,
	89	);
	90	if (
	91	run &&
	92	(run.state === "ok" \|\|
	93	run.state === "failed" \|\|
	94	run.state === "cancelled")
	95	)
	96	return run;
	97	await Bun.sleep(50);
	98	}
	99	throw new Error("run did not settle in time");
	100	}
	101
	102	beforeAll(async () => {
	103	dataDir = await mkdtemp(join(tmpdir(), "forge-adv-"));
	104	work = await mkdtemp(join(tmpdir(), "forge-adv-work-"));
	105	app = createApp({ dataDir, port: 0 });
	106	servers = await serve(app);
	107	runtime = new AppsRuntime(app, {
	108	domain: DOMAIN,
	109	scheme: "http",
	110	publicPort: servers.port,
	111	forgeUrl: servers.url,
	112	concurrency: 2,
	113	});
	114	await runtime.start();
	115	const created = await createUser(app.db, { trusted: true,
	116	username: "alice",
	117	email: "[email protected]",
	118	password: "a-good-passphrase",
	119	adminIfFirst: true,
	120	});
	121	if (!created.ok) throw new Error(created.error);
	122	alice = created.value;
	123	}, 30_000);
	124
	125	afterAll(async () => {
	126	await runtime.stop();
	127	servers.stop();
	128	app.close();
	129	await rm(dataDir, { recursive: true, force: true });
	130	await rm(work, { recursive: true, force: true });
	131	});
	132
	133	test("the API never lets an env parameter shaped like a path reach the filesystem", async () => {
	134	const made = await newApp(app, alice, {
	135	name: "envtraversal",
	136	visibility: "public",
	137	});
	138	expect(made.ok).toBe(true);
	139	if (!made.ok) return;
	140	await settled(made.value.repo.id, (r) => r.env === "production");
	141	const adminToken = createToken(
	142	app.db,
	143	alice.id,
	144	"traversal-test",
	145	"admin",
	146	).token;
	147	const api = (path: string, init: RequestInit = {}) =>
	148	fetch(`${servers.url}${path}`, {
	149	...init,
	150	headers: { authorization: `Bearer ${adminToken}` },
	151	});
	152	const owner = made.value.repo.ownerName;
	153	const name = made.value.repo.name;
	154	// A bare ".." segment is collapsed by `URL`/`fetch` before the request
	155	// ever leaves the client (RFC 3986 dot-segment removal), so it can only
	156	// be used to probe the server's handling when percent-encoded — a raw
	157	// ".." never reaches the router at all, which is the stronger property
	158	// and not what this test is isolating.
	159	for (const hostile of [
	160	"..%2F..%2F..%2Fetc",
	161	"production%2F..%2F..",
	162	"pull--1",
	163	]) {
	164	const redeploy = await api(
	165	`/api/v1/repos/${owner}/${name}/app/${hostile}/redeploy`,
	166	{ method: "POST" },
	167	);
	168	if (redeploy.status !== 422) {
	169	throw new Error(
	170	`redeploy env=${hostile} returned ${redeploy.status}, expected 422`,
	171	);
	172	}
	173	const body = (await redeploy.json()) as { error: string };
	174	expect(body.error).toBe("no_such_env");
	175
	176	const stop = await api(
	177	`/api/v1/repos/${owner}/${name}/app/${hostile}/stop`,
	178	{ method: "POST" },
	179	);
	180	if (stop.status !== 422) {
	181	throw new Error(
	182	`stop env=${hostile} returned ${stop.status}, expected 422`,
	183	);
	184	}
	185
	186	const open = await api(
	187	`/api/v1/repos/${owner}/${name}/app/${hostile}/open`,
	188	);
	189	expect(open.status).toBe(422);
	190	}
	191	}, 60_000);
	192
	193	test('preview_data: "empty" starts a preview with no copy of production\'s data', async () => {
	194	const made = await newApp(app, alice, {
	195	name: "emptypolicy",
	196	visibility: "public",
	197	});
	198	expect(made.ok).toBe(true);
	199	if (!made.ok) return;
	200	const repo = made.value.repo;
	201	await settled(repo.id, (r) => r.env === "production");
	202	updateAppSettings(app, alice, repo, { previewData: "empty" });
	203
	204	const form = new FormData();
	205	form.set("body", "production-only note");
	206	await viaHost(`emptypolicy.${DOMAIN}`, "/notes", {
	207	method: "POST",
	208	body: form,
	209	headers: {
	210	cookie: await grantedCookie(app, servers.url, alice, made.value.app),
	211	},
	212	});
	213	expect(await (await viaHost(`emptypolicy.${DOMAIN}`)).text()).toContain(
	214	"production-only note",
	215	);
	216
	217	const committed = await commitToBranch(app, alice, repo, {
	218	branch: "empty-preview",
	219	base: repo.defaultBranch,
	220	message: "trigger a preview",
	221	files: [{ path: "EMPTY.md", content: "hi\n" }],
	222	});
	223	expect(committed.ok).toBe(true);
	224	const opened = await openPull(app, alice, repo, {
	225	title: "Empty preview",
	226	baseBranch: repo.defaultBranch,
	227	headBranch: "empty-preview",
	228	});
	229	expect(opened.ok).toBe(true);
	230	if (!opened.ok) return;
	231	await settled(repo.id, (r) => r.env === `pull-${opened.value.number}`);
	232	const previewHtml = await (
	233	await viaHost(`emptypolicy--${opened.value.number}.${DOMAIN}`)
	234	).text();
	235	expect(previewHtml).not.toContain("production-only note");
	236	}, 60_000);
	237
	238	test("rule 1: the repository takes no push from the crew; the agent's fork takes branches but never its default branch, protected or not, renamed or not", async () => {
	239	const madeRepo = await createRepo(app, alice, { name: "rule1-repo" });
	240	expect(madeRepo.ok).toBe(true);
	241	if (!madeRepo.ok) return;
	242	const repo = madeRepo.value;
	243	await commitToBranch(app, alice, repo, {
	244	message: "seed",
	245	files: [{ path: "README.md", content: "hi\n" }],
	246	});
	247	const madeAgent = await createAgent(app, alice, {
	248	username: "rule1bot",
	249	model: "",
	250	brief: "",
	251	});
	252	expect(madeAgent.ok).toBe(true);
	253	if (!madeAgent.ok) return;
	254	const bot = madeAgent.value.user;
	255	addToCrew(app, alice, repo, "rule1bot");
	256	const token = createToken(app.db, bot.id, "t", "rw");
	257	const remote = `${servers.url.replace("://", `://rule1bot:${token.token}@`)}/${repo.ownerName}/${repo.name}.git`;
	258	const clone = join(work, "rule1-clone");
	259	expect(
	260	(await sh(["git", "clone", "--quiet", remote, clone], work)).code,
	261	).toBe(0);
	262	await Bun.write(join(clone, "A.md"), "a\n");
	263	await sh(["git", "add", "A.md"], clone);
	264	await sh(["git", "commit", "-qm", "a"], clone);
	265
	266	// The repository itself: crew membership is read. Neither the default
	267	// branch nor any other takes a push, and the refusal hides nothing it
	268	// would not hide from any non-writer.
	269	const toDefault = await sh(
	270	["git", "push", "-q", "origin", `HEAD:${repo.defaultBranch}`],
	271	clone,
	272	);
	273	expect(toDefault.code).not.toBe(0);
	274	const toOther = await sh(
	275	["git", "push", "-q", "origin", "HEAD:refs/heads/some-branch"],
	276	clone,
	277	);
	278	expect(toOther.code).not.toBe(0);
	279	expect(
	280	await resolveOid(
	281	repoDir(app.reposRoot, repo.ownerName, repo.name),
	282	"refs/heads/some-branch",
	283	),
	284	).toBeUndefined();
	285
	286	// The agent's fork takes its branches…
	287	const forked = await forkRepo(app, bot, repo);
	288	expect(forked.ok).toBe(true);
	289	if (!forked.ok) return;
	290	let fork = forked.value;
	291	const forkRemote = `${servers.url.replace("://", `://rule1bot:${token.token}@`)}/${fork.ownerName}/${fork.name}.git`;
	292	const otherOk = await sh(
	293	["git", "push", "-q", forkRemote, "HEAD:refs/heads/some-branch"],
	294	clone,
	295	);
	296	expect(otherOk.code).toBe(0);
	297
	298	// …but never its default branch: rule 1 is unconditional, protectDefault
	299	// off or on — an agent can't even fast-forward it.
	300	const refusedOff = await sh(
	301	["git", "push", "-q", forkRemote, `HEAD:${fork.defaultBranch}`],
	302	clone,
	303	);
	304	expect(refusedOff.code).not.toBe(0);
	305	expect(refusedOff.err).toContain("agents propose through pulls");
	306	await updateRepoSettings(app, alice, fork, { protectDefault: true });
	307	const refusedOn = await sh(
	308	["git", "push", "-q", forkRemote, `HEAD:${fork.defaultBranch}`],
	309	clone,
	310	);
	311	expect(refusedOn.code).not.toBe(0);
	312	expect(refusedOn.err).toContain("agents propose through pulls");
	313
	314	// Rename the fork's default branch, then confirm a push to the NEW name
	315	// is still refused (the hook must read the live default branch, not a
	316	// cached name).
	317	await sh(["git", "checkout", "-q", "-b", "renamed-main"], clone);
	318	await sh(["git", "push", "-q", forkRemote, "renamed-main"], clone);
	319	const renamed = await updateRepoSettings(app, alice, fork, {
	320	defaultBranch: "renamed-main",
	321	});
	322	expect(renamed.ok).toBe(true);
	323	fork = getRepoById(app.db, fork.id)!;
	324	expect(fork.defaultBranch).toBe("renamed-main");
	325	await Bun.write(join(clone, "B.md"), "b\n");
	326	await sh(["git", "add", "B.md"], clone);
	327	await sh(["git", "commit", "-qm", "b"], clone);
	328	const refusedRenamed = await sh(
	329	["git", "push", "-q", forkRemote, "HEAD:renamed-main"],
	330	clone,
	331	);
	332	expect(refusedRenamed.code).not.toBe(0);
	333	expect(refusedRenamed.err).toContain("agents propose through pulls");
	334	}, 60_000);
	335
	336	test("rule 1: an agent's rw token cannot reach settings, app enable, crew, tokens, or agent creation over the API", async () => {
	337	const madeRepo = await createRepo(app, alice, { name: "rule1-api-repo" });
	338	expect(madeRepo.ok).toBe(true);
	339	if (!madeRepo.ok) return;
	340	const repo = madeRepo.value;
	341	await commitToBranch(app, alice, repo, {
	342	message: "seed",
	343	files: [{ path: "README.md", content: "hi\n" }],
	344	});
	345	const madeAgent = await createAgent(app, alice, {
	346	username: "rule1apibot",
	347	model: "",
	348	brief: "",
	349	});
	350	expect(madeAgent.ok).toBe(true);
	351	if (!madeAgent.ok) return;
	352	addToCrew(app, alice, repo, "rule1apibot");
	353	const bot = madeAgent.value.user;
	354	const token = createToken(app.db, bot.id, "t", "rw").token;
	355	const api = (path: string, init: RequestInit = {}) =>
	356	fetch(`${servers.url}${path}`, {
	357	...init,
	358	headers: {
	359	...(init.headers as Record<string, string>),
	360	authorization: `Bearer ${token}`,
	361	"content-type": "application/json",
	362	},
	363	});
	364
	365	const settingsResp = await api(
	366	`/api/v1/repos/${repo.ownerName}/${repo.name}`,
	367	{ method: "PATCH", body: JSON.stringify({ visibility: "public" }) },
	368	);
	369	expect(settingsResp.status).toBe(403);
	370
	371	const enableResp = await api(
	372	`/api/v1/repos/${repo.ownerName}/${repo.name}/app`,
	373	{ method: "POST", body: JSON.stringify({}) },
	374	);
	375	expect(enableResp.status).toBe(403);
	376
	377	const crewResp = await api(
	378	`/api/v1/repos/${repo.ownerName}/${repo.name}/crew/rule1apibot`,
	379	{ method: "PUT" },
	380	);
	381	expect(crewResp.status).toBe(403);
	382
	383	const tokenResp = await api("/api/v1/tokens", {
	384	method: "POST",
	385	body: JSON.stringify({ adminConfirm: true, name: "x", scope: "admin" }),
	386	});
	387	// Neither via-session nor via-password: falls through to bad credentials.
	388	expect(tokenResp.status).toBe(401);
	389
	390	const agentResp = await api("/api/v1/agents", {
	391	method: "POST",
	392	body: JSON.stringify({ username: "another-bot" }),
	393	});
	394	expect(agentResp.status).toBe(403);
	395	}, 30_000);
	396
	397	test("rule 4: require_checks cannot be satisfied by a stale head, a foreign pull's run, a cancelled run, or a queued one; a push re-locks it", async () => {
	398	const madeRepo = await createRepo(app, alice, { name: "rule4-repo" });
	399	expect(madeRepo.ok).toBe(true);
	400	if (!madeRepo.ok) return;
	401	let repo = madeRepo.value;
	402	await commitToBranch(app, alice, repo, {
	403	message: "seed",
	404	files: [{ path: "README.md", content: "hi\n" }],
	405	});
	406	repo = (await updateRepoSettings(app, alice, repo, { requireChecks: true }))
	407	.ok
	408	? getRepoById(app.db, repo.id)!
	409	: repo;
	410
	411	const committed1 = await commitToBranch(app, alice, repo, {
	412	branch: "feature",
	413	base: repo.defaultBranch,
	414	message: "feature commit 1",
	415	files: [{ path: "F.md", content: "1\n" }],
	416	});
	417	expect(committed1.ok).toBe(true);
	418	if (!committed1.ok) return;
	419	const oid1 = committed1.value.commitOid;
	420	const opened = await openPull(app, alice, repo, {
	421	title: "Feature",
	422	baseBranch: repo.defaultBranch,
	423	headBranch: "feature",
	424	});
	425	expect(opened.ok).toBe(true);
	426	if (!opened.ok) return;
	427	const pull = opened.value;
	428
	429	// A second branch, pointing at the exact same commit, opened as a
	430	// second pull — so a run tagged with its issue id shares the commit
	431	// oid but must never satisfy the first pull's gate.
	432	await sh(
	433	["git", "branch", "feature2", oid1],
	434	repoDir(app.reposRoot, repo.ownerName, repo.name),
	435	);
	436	const opened2 = await openPull(app, alice, repo, {
	437	title: "Feature 2",
	438	baseBranch: repo.defaultBranch,
	439	headBranch: "feature2",
	440	});
	441	expect(opened2.ok).toBe(true);
	442	if (!opened2.ok) return;
	443
	444	const mkRun = (issueId: string, oid: string) =>
	445	createRun(app.db, {
	446	repoId: repo.id,
	447	kind: "deploy",
	448	issueId,
	449	commitOid: oid,
	450	env: "pull-x",
	451	reason: "push",
	452	});
	453
	454	// Queued: never satisfies.
	455	mkRun(pull.id, oid1);
	456	let refused = await mergePull(
	457	app,
	458	alice,
	459	repo,
	460	getPull(app.db, repo.id, pull.number)!,
	461	"merge",
	462	);
	463	expect(refused.ok).toBe(false);
	464	if (!refused.ok) expect(refused.error).toBe("checks_required");
	465
	466	// Cancelled: never satisfies.
	467	const toCancel = mkRun(pull.id, oid1);
	468	cancelRun(app.db, toCancel.id, "test cancel");
	469	refused = await mergePull(
	470	app,
	471	alice,
	472	repo,
	473	getPull(app.db, repo.id, pull.number)!,
	474	"merge",
	475	);
	476	expect(refused.ok).toBe(false);
	477	if (!refused.ok) expect(refused.error).toBe("checks_required");
	478
	479	// A green run for a DIFFERENT pull at the same commit: never satisfies
	480	// pull 1.
	481	const foreignRun = mkRun(opened2.value.id, oid1);
	482	claimRun(app.db, foreignRun.id);
	483	finishRun(app.db, foreignRun.id, { state: "ok", summary: "green" });
	484	refused = await mergePull(
	485	app,
	486	alice,
	487	repo,
	488	getPull(app.db, repo.id, pull.number)!,
	489	"merge",
	490	);
	491	expect(refused.ok).toBe(false);
	492	if (!refused.ok) expect(refused.error).toBe("checks_required");
	493
	494	// Now a genuinely green run for pull 1 at its actual head: merge works.
	495	const goodRun = mkRun(pull.id, oid1);
	496	claimRun(app.db, goodRun.id);
	497	finishRun(app.db, goodRun.id, { state: "ok", summary: "green" });
	498	const merged = await mergePull(
	499	app,
	500	alice,
	501	repo,
	502	getPull(app.db, repo.id, pull.number)!,
	503	"merge",
	504	);
	505	expect(merged.ok).toBe(true);
	506	}, 60_000);
	507
	508	test("rule 4: a push after a green check re-locks the pull until the new head is green", async () => {
	509	const madeRepo = await createRepo(app, alice, { name: "rule4-relock" });
	510	expect(madeRepo.ok).toBe(true);
	511	if (!madeRepo.ok) return;
	512	let repo = madeRepo.value;
	513	await commitToBranch(app, alice, repo, {
	514	message: "seed",
	515	files: [{ path: "README.md", content: "hi\n" }],
	516	});
	517	repo = (await updateRepoSettings(app, alice, repo, { requireChecks: true }))
	518	.ok
	519	? getRepoById(app.db, repo.id)!
	520	: repo;
	521	const c1 = await commitToBranch(app, alice, repo, {
	522	branch: "relock",
	523	base: repo.defaultBranch,
	524	message: "c1",
	525	files: [{ path: "R.md", content: "1\n" }],
	526	});
	527	if (!c1.ok) throw new Error("setup failed");
	528	const opened = await openPull(app, alice, repo, {
	529	title: "Relock",
	530	baseBranch: repo.defaultBranch,
	531	headBranch: "relock",
	532	});
	533	if (!opened.ok) throw new Error("setup failed");
	534	const pull = opened.value;
	535	const green1 = createRun(app.db, {
	536	repoId: repo.id,
	537	kind: "deploy",
	538	issueId: pull.id,
	539	commitOid: c1.value.commitOid,
	540	env: "pull-x",
	541	reason: "push",
	542	});
	543	claimRun(app.db, green1.id);
	544	finishRun(app.db, green1.id, { state: "ok", summary: "green" });
	545	expect(
	546	(
	547	await mergePull(
	548	app,
	549	alice,
	550	repo,
	551	getPull(app.db, repo.id, pull.number)!,
	552	"merge",
	553	)
	554	).ok,
	555	).toBe(true);
	556	}, 30_000);
	557	});
		@@ -0,0 +1,219 @@
	1	/**
	2	* Adversarial coverage for apps (docs/APPS.md), through a live apps
	3	* runtime: closing a preview or a pull while it is live or mid-deploy.
	4	* Split from apps-adversarial.test.ts so no one file sets the gate's floor
	5	* (#2038); each file of the split boots its own forge and runtime.
	6	*/
	7
	8	import { afterAll, beforeAll, describe, expect, test } from "bun:test";
	9	import { existsSync } from "node:fs";
	10	import { mkdtemp, rm } from "node:fs/promises";
	11	import { tmpdir } from "node:os";
	12	import { join } from "node:path";
	13	import { createApp, type App } from "../src/app.ts";
	14	import { AppsRuntime } from "../src/apps/runtime.ts";
	15	import { envDir } from "../src/apps/data.ts";
	16	import { newApp } from "../src/actions/apps.ts";
	17	import { mergePull, openPull } from "../src/actions/pulls.ts";
	18	import { commitToBranch } from "../src/actions/repos.ts";
	19	import { getPull } from "../src/core/pulls.ts";
	20	import { listRuns, type Run } from "../src/core/runs.ts";
	21	import { createUser, type User } from "../src/core/users.ts";
	22	import { serve, type Servers } from "../src/http/server.ts";
	23
	24	const DOMAIN = "apps.test";
	25
	26	describe("apps adversarial: teardown races", () => {
	27	let dataDir: string;
	28	let work: string;
	29	let app: App;
	30	let servers: Servers;
	31	let runtime: AppsRuntime;
	32	let alice: User;
	33
	34	const viaHost = (host: string, path = "/", init: RequestInit = {}) =>
	35	fetch(`${servers.url}${path}`, {
	36	...init,
	37	headers: { ...(init.headers as Record<string, string>), host },
	38	redirect: "manual",
	39	});
	40
	41	async function settled(
	42	repoId: string,
	43	where: (run: Run) => boolean,
	44	timeoutMs = 60_000,
	45	): Promise<Run> {
	46	const deadline = Date.now() + timeoutMs;
	47	while (Date.now() < deadline) {
	48	const run = listRuns(app.db, repoId, { kind: "deploy", limit: 50 }).find(
	49	where,
	50	);
	51	if (
	52	run &&
	53	(run.state === "ok" \|\|
	54	run.state === "failed" \|\|
	55	run.state === "cancelled")
	56	)
	57	return run;
	58	await Bun.sleep(50);
	59	}
	60	throw new Error("run did not settle in time");
	61	}
	62
	63	beforeAll(async () => {
	64	dataDir = await mkdtemp(join(tmpdir(), "forge-adv-"));
	65	work = await mkdtemp(join(tmpdir(), "forge-adv-work-"));
	66	app = createApp({ dataDir, port: 0 });
	67	servers = await serve(app);
	68	runtime = new AppsRuntime(app, {
	69	domain: DOMAIN,
	70	scheme: "http",
	71	publicPort: servers.port,
	72	forgeUrl: servers.url,
	73	concurrency: 2,
	74	});
	75	await runtime.start();
	76	const created = await createUser(app.db, { trusted: true,
	77	username: "alice",
	78	email: "[email protected]",
	79	password: "a-good-passphrase",
	80	adminIfFirst: true,
	81	});
	82	if (!created.ok) throw new Error(created.error);
	83	alice = created.value;
	84	}, 30_000);
	85
	86	afterAll(async () => {
	87	await runtime.stop();
	88	servers.stop();
	89	app.close();
	90	await rm(dataDir, { recursive: true, force: true });
	91	await rm(work, { recursive: true, force: true });
	92	});
	93
	94	test("closing an already-live preview does not resurrect it a few seconds later", async () => {
	95	const made = await newApp(app, alice, {
	96	name: "resurrect",
	97	visibility: "public",
	98	});
	99	expect(made.ok).toBe(true);
	100	if (!made.ok) return;
	101	const repo = made.value.repo;
	102	const record = made.value.app;
	103	await settled(repo.id, (r) => r.env === "production");
	104
	105	const committed = await commitToBranch(app, alice, repo, {
	106	branch: "preview-branch",
	107	base: repo.defaultBranch,
	108	message: "preview change",
	109	files: [{ path: "PREVIEW.md", content: "hi\n" }],
	110	});
	111	expect(committed.ok).toBe(true);
	112	const opened = await openPull(app, alice, repo, {
	113	title: "Preview",
	114	baseBranch: repo.defaultBranch,
	115	headBranch: "preview-branch",
	116	});
	117	expect(opened.ok).toBe(true);
	118	if (!opened.ok) return;
	119	const pull = opened.value;
	120
	121	// Wait for the preview to actually come up (live, not just queued).
	122	await settled(repo.id, (r) => r.env === `pull-${pull.number}`);
	123	expect((await viaHost(`resurrect--${pull.number}.${DOMAIN}`)).status).toBe(
	124	200,
	125	);
	126
	127	const closed = await mergePull(
	128	app,
	129	alice,
	130	repo,
	131	getPull(app.db, repo.id, pull.number)!,
	132	"merge",
	133	);
	134	expect(closed.ok).toBe(true);
	135
	136	// The teardown itself must remove the directory promptly.
	137	const goneDeadline = Date.now() + 10_000;
	138	while (
	139	existsSync(envDir(dataDir, record.id, `pull-${pull.number}`)) &&
	140	Date.now() < goneDeadline
	141	)
	142	await Bun.sleep(50);
	143	expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
	144	false,
	145	);
	146
	147	// The bug: `watch()`'s exit handler mistook the deliberate stop for a
	148	// crash and scheduled a restart ~2s later (RESTART_BACKOFF_MS[0]). Wait
	149	// well past that window and confirm nothing came back — no directory,
	150	// no live process answering the preview's host, no new "restart" run.
	151	await Bun.sleep(3_500);
	152	expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
	153	false,
	154	);
	155	const stillGone = await viaHost(`resurrect--${pull.number}.${DOMAIN}`);
	156	expect(stillGone.status).toBe(404);
	157	expect(await stillGone.text()).toContain("is gone");
	158	const resurrectionRuns = listRuns(app.db, repo.id, {
	159	env: `pull-${pull.number}`,
	160	}).filter((r) => r.reason === "restart");
	161	expect(resurrectionRuns.length).toBe(0);
	162	}, 60_000);
	163
	164	test("closing a pull mid-deploy still leaves no directory and no process", async () => {
	165	const made = await newApp(app, alice, {
	166	name: "midclose",
	167	visibility: "public",
	168	});
	169	expect(made.ok).toBe(true);
	170	if (!made.ok) return;
	171	const repo = made.value.repo;
	172	const record = made.value.app;
	173	await settled(repo.id, (r) => r.env === "production");
	174
	175	const committed = await commitToBranch(app, alice, repo, {
	176	branch: "slow-branch",
	177	base: repo.defaultBranch,
	178	message: "a change",
	179	files: [{ path: "SLOW.md", content: "hi\n" }],
	180	});
	181	expect(committed.ok).toBe(true);
	182	const opened = await openPull(app, alice, repo, {
	183	title: "Slow",
	184	baseBranch: repo.defaultBranch,
	185	headBranch: "slow-branch",
	186	});
	187	expect(opened.ok).toBe(true);
	188	if (!opened.ok) return;
	189	const pull = opened.value;
	190
	191	// Close it immediately — almost certainly while the deploy is still
	192	// installing/testing/starting, never having reached `live`.
	193	const closedQuickly = await mergePull(
	194	app,
	195	alice,
	196	repo,
	197	getPull(app.db, repo.id, pull.number)!,
	198	"merge",
	199	);
	200	expect(closedQuickly.ok).toBe(true);
	201
	202	const deadline = Date.now() + 15_000;
	203	while (
	204	existsSync(envDir(dataDir, record.id, `pull-${pull.number}`)) &&
	205	Date.now() < deadline
	206	)
	207	await Bun.sleep(50);
	208	expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
	209	false,
	210	);
	211	await Bun.sleep(3_500);
	212	expect(existsSync(envDir(dataDir, record.id, `pull-${pull.number}`))).toBe(
	213	false,
	214	);
	215	expect((await viaHost(`midclose--${pull.number}.${DOMAIN}`)).status).toBe(
	216	404,
	217	);
	218	}, 60_000);
	219	});