Files
msd-core/tests/commit-files-deletion.test.cjs
Jakub Zych a9a7a328e6 refactor: hard-fork GSD -> MSD (Make Software Done)
Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD
across contents and paths, upstream package/repo coordinates -> @golem15/msd-core
and golem15com/msd-core. Deep links into upstream history, sibling upstream
packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is.

Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line,
package/plugin identity, regenerated lockfile, install-tree fixtures, derived
registries and benchmark baseline; migration checksum baseline re-locked
(MSD keeps its own install state, so no install had applied the old sums);
sort-order and regex-escaped expectations in tests adjusted.
2026-10-06 01:47:40 +02:00

1311 lines
68 KiB
JavaScript

/**
* Regression test for #2014: msd-tools commit --files silently deletes
* planning files when a filename passed via --files does not exist on disk.
*
* Prior to this fix, when --files STATE.md was passed and STATE.md did not
* exist on disk, the code called `git rm --cached --ignore-unmatch STATE.md`
* which staged and committed a deletion. The caller passed explicit --files
* expecting only those specific files to be staged -- missing files should
* be skipped, not deleted.
*/
const { describe, test, beforeEach, afterEach } = require('node:test');
const assert = require('node:assert/strict');
const fs = require('fs');
const os = require('os');
const path = require('path');
const { execFileSync } = require('child_process');
const { createTempGitProject, cleanup, runMsdTools } = require('./helpers.cjs');
const fc = require('fast-check');
const { collectListFlagValues, COMMIT_LIST_FLAGS } = require('../msd-core/bin/msd-tools.cjs');
const { gitOrThrow } = require('./helpers/git-fixture.cjs');
// #3145: class-norm timeout, not a per-suite value — see helpers/timeouts.cjs.
const { GIT_TIMEOUT_MS } = require('./helpers/timeouts.cjs');
describe('commit --files: missing files must not stage deletions (#2014)', () => {
let tmpDir;
beforeEach(() => {
tmpDir = createTempGitProject();
// Commit STATE.md so it exists in git history
fs.writeFileSync(path.join(tmpDir, '.planning', 'STATE.md'), '# State\n\nInitial state.\n');
gitOrThrow(['add', '.planning/STATE.md'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
gitOrThrow(['commit', '-m', 'add STATE.md'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
// Delete STATE.md from disk -- now missing but tracked in git
fs.unlinkSync(path.join(tmpDir, '.planning', 'STATE.md'));
});
afterEach(() => {
cleanup(tmpDir);
});
test('passing --files for a missing tracked file does not commit a deletion', () => {
// STATE.md is tracked in git but deleted from disk.
// commit --files .planning/STATE.md should skip it (no deletion committed).
runMsdTools(
['commit', 'test commit', '--files', '.planning/STATE.md'],
tmpDir
);
// Check git log: the new commit (HEAD) must NOT have deleted STATE.md.
// git diff HEAD~1 HEAD --name-status shows what changed between commits.
let diffOutput = '';
try {
diffOutput = gitOrThrow(['diff', 'HEAD~1', 'HEAD', '--name-status'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
} catch (e) {
// If nothing to commit, there is no HEAD~1 -- that's also acceptable
return;
}
assert.ok(
!diffOutput.includes('D\t.planning/STATE.md'),
'commit --files must not commit a deletion of a missing file, diff was:\n' + diffOutput
);
});
test('passing --files for a file that exists stages and commits it normally', () => {
// Create ROADMAP.md -- this file exists, should be staged normally
fs.writeFileSync(path.join(tmpDir, '.planning', 'ROADMAP.md'), '# Roadmap\n\nPhase 01.\n');
const result = runMsdTools(
['commit', 'add roadmap', '--files', '.planning/ROADMAP.md'],
tmpDir
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, true, 'should have committed when file exists');
// Verify ROADMAP.md was added in the commit
const diffOutput = gitOrThrow(['diff', 'HEAD~1', 'HEAD', '--name-status'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
assert.ok(
diffOutput.includes('A\t.planning/ROADMAP.md'),
'ROADMAP.md should appear as added in the commit'
);
});
test('--files with mix of existing and missing files only stages the existing ones', () => {
// ROADMAP.md exists on disk, STATE.md does not
fs.writeFileSync(path.join(tmpDir, '.planning', 'ROADMAP.md'), '# Roadmap\n');
runMsdTools(
['commit', 'partial files', '--files', '.planning/ROADMAP.md', '.planning/STATE.md'],
tmpDir
);
// The commit must not include a deletion of STATE.md
let diffOutput = '';
try {
diffOutput = gitOrThrow(['diff', 'HEAD~1', 'HEAD', '--name-status'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
} catch (e) {
return; // nothing committed is fine
}
assert.ok(
!diffOutput.includes('D\t.planning/STATE.md'),
'missing file in --files list must not be committed as a deletion'
);
});
});
/**
* Regression tests for #4208: `commit --files` could not record a file move.
*
* The #2014 guard above skips a missing `--files` entry, so the only form that
* recorded a move was a DIRECTORY entry — which also committed any unrelated
* file sitting in that directory (a concurrent session's in-flight todo, in
* the execute-phase sweep). `--files-removed` is the caller-declared deletion
* intent that lets a move be recorded at file granularity, with the #2014
* skip-if-missing contract on `--files` left untouched.
*/
describe('commit --files-removed: caller-declared deletions record a move (#4208)', () => {
let tmpDir;
const PENDING = path.join('.planning', 'todos', 'pending');
const COMPLETED = path.join('.planning', 'todos', 'completed');
function nameStatus() {
// `--no-renames`: a clean move would otherwise collapse to one `R100` row
// and hide whether the old path's deletion was actually recorded.
return gitOrThrow(['diff', '--no-renames', 'HEAD~1', 'HEAD', '--name-status'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS })
.trim().split('\n').filter(Boolean).sort();
}
function status() {
// `-uall`: once the move empties pending/ of tracked files, plain
// `--porcelain` collapses its untracked contents to the bare directory.
return gitOrThrow(['status', '--porcelain', '-uall'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim();
}
beforeEach(() => {
tmpDir = createTempGitProject();
fs.mkdirSync(path.join(tmpDir, PENDING), { recursive: true });
fs.mkdirSync(path.join(tmpDir, COMPLETED), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, 'mine.md'), '---\nresolves_phase: 5\n---\nmine\n');
fs.writeFileSync(path.join(tmpDir, '.planning', 'STATE.md'), '# State\n');
gitOrThrow(['add', '.planning/'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
gitOrThrow(['commit', '-m', 'seed todo'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
// The move this phase performs, plus a peer's unrelated in-flight todo.
fs.renameSync(path.join(tmpDir, PENDING, 'mine.md'), path.join(tmpDir, COMPLETED, 'mine.md'));
fs.writeFileSync(path.join(tmpDir, PENDING, 'peer-inflight.md'), '---\nresolves_phase: 99\n---\npeer\n');
fs.writeFileSync(path.join(tmpDir, '.planning', 'STATE.md'), '# State\n\nphase 5 closed\n');
});
afterEach(() => {
cleanup(tmpDir);
});
test('records the move at file granularity and leaves the peer file alone', () => {
const result = runMsdTools(
['commit', 'docs(phase-5): close 1 resolved todo(s)',
'--files', '.planning/todos/completed/mine.md', '.planning/STATE.md',
'--files-removed', '.planning/todos/pending/mine.md'],
tmpDir,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, true, 'move commit must succeed: ' + result.output);
assert.deepStrictEqual(
nameStatus(),
['A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md', 'M\t.planning/STATE.md'],
'commit must contain exactly the move and STATE.md',
);
// The peer's file is untouched: still untracked, never committed — and
// nothing about the moved todo is left dangling.
const st = status();
assert.ok(st.includes('?? .planning/todos/pending/peer-inflight.md'), 'peer file must stay untracked: ' + st);
assert.ok(!st.includes('mine.md'), 'no dangling state for the moved todo: ' + st);
// No dual-tracking: the todo is tracked at the new path only.
const tracked = gitOrThrow(['ls-files', '--', '.planning/todos'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim();
assert.strictEqual(tracked, '.planning/todos/completed/mine.md');
});
test('a directory entry stages only the tracked files that are absent from disk', () => {
// A second tracked todo that stays put must NOT be touched by the
// directory form, and the untracked peer file must stay invisible to it.
fs.writeFileSync(path.join(tmpDir, PENDING, 'stays.md'), 'stays\n');
gitOrThrow(['add', path.join(PENDING, 'stays.md')], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
gitOrThrow(['commit', '-m', 'seed a todo that stays'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
fs.appendFileSync(path.join(tmpDir, PENDING, 'stays.md'), 'edited by a peer, uncommitted\n');
const result = runMsdTools(
['commit', 'docs(phase-5): close 1 resolved todo(s)',
'--files', '.planning/todos/completed/mine.md',
'--files-removed', '.planning/todos/pending/'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
assert.deepStrictEqual(
nameStatus(),
['A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md'],
);
const st = status();
assert.ok(st.includes(' M .planning/todos/pending/stays.md'), 'present tracked file must stay uncommitted: ' + st);
assert.ok(st.includes('?? .planning/todos/pending/peer-inflight.md'), 'untracked peer file must stay untracked: ' + st);
});
test('a --files-removed file entry that is still on disk fails closed and rolls back', () => {
// The declaration is wrong: pending/mine.md was put back.
fs.copyFileSync(path.join(tmpDir, COMPLETED, 'mine.md'), path.join(tmpDir, PENDING, 'mine.md'));
const head = gitOrThrow(['rev-parse', 'HEAD'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim();
const result = runMsdTools(
['commit', 'docs(phase-5): bad declaration',
'--files', '.planning/todos/completed/mine.md',
'--files-removed', '.planning/todos/pending/mine.md'],
tmpDir,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, false);
assert.strictEqual(parsed.reason, 'staging_failed');
assert.strictEqual(parsed.file, '.planning/todos/pending/mine.md');
assert.strictEqual(
gitOrThrow(['rev-parse', 'HEAD'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim(),
head,
'nothing may be committed on a refused declaration',
);
// Rollback: the addition this call staged is unstaged again.
assert.strictEqual(
gitOrThrow(['diff', '--cached', '--name-only'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim(),
'',
);
});
test('a --files-removed path git never tracked is a no-op, not an error', () => {
const result = runMsdTools(
['commit', 'docs(phase-5): close 1 resolved todo(s)',
'--files', '.planning/todos/completed/mine.md',
'--files-removed', '.planning/todos/pending/mine.md', '.planning/todos/pending/never-tracked.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
assert.deepStrictEqual(
nameStatus(),
['A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md'],
);
});
test('--files-removed alone is a declared scope, not the unscoped .planning/ sweep', () => {
const result = runMsdTools(
['commit', 'docs: drop a todo', '--files-removed', '.planning/todos/pending/mine.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
// Only the deletion — not completed/mine.md, STATE.md, or the peer file.
assert.deepStrictEqual(nameStatus(), ['D\t.planning/todos/pending/mine.md']);
});
test('--files keeps its #2014 skip-if-missing contract when --files-removed is also given', () => {
// A tracked file that is temporarily absent (NOT moved) named via --files
// must still be skipped, even though the same call declares a removal.
fs.unlinkSync(path.join(tmpDir, '.planning', 'STATE.md'));
const result = runMsdTools(
['commit', 'docs(phase-5): close 1 resolved todo(s)',
'--files', '.planning/todos/completed/mine.md', '.planning/STATE.md',
'--files-removed', '.planning/todos/pending/mine.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
assert.deepStrictEqual(
nameStatus(),
['A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md'],
'the temporarily-absent STATE.md must not be committed as a deletion',
);
});
test('a tracked symlink whose target is gone is present, not a removal', () => {
// `stat`/`existsSync` follow the link and read it as absent; `lstat` does
// not. Declaring it removed while it still sits in the worktree must fail
// closed like any other present entry, with nothing left staged.
const link = path.join(PENDING, 'dangling');
fs.symlinkSync('target-that-will-vanish.md', path.join(tmpDir, link));
gitOrThrow(['add', link], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
gitOrThrow(['commit', '-m', 'seed a symlink'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
const head = gitOrThrow(['rev-parse', 'HEAD'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim();
const result = runMsdTools(
['commit', 'docs: bad declaration',
'--files', '.planning/todos/completed/mine.md',
'--files-removed', '.planning/todos/pending/dangling'],
tmpDir,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, false, result.output);
assert.strictEqual(parsed.reason, 'staging_failed');
assert.strictEqual(parsed.file, '.planning/todos/pending/dangling');
assert.strictEqual(gitOrThrow(['rev-parse', 'HEAD'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim(), head);
assert.strictEqual(gitOrThrow(['diff', '--cached', '--name-only'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim(), '');
});
test('a deletion the caller already staged is committed, not reported as nothing to commit', () => {
// `git rm` before the call empties the index entry; `ls-files` alone would
// never list it, so the path would miss the pathspec.
gitOrThrow(['rm', '-q', '--cached', path.join(PENDING, 'mine.md')], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
const result = runMsdTools(
['commit', 'docs: drop a todo', '--files-removed', '.planning/todos/pending/mine.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
assert.deepStrictEqual(nameStatus(), ['D\t.planning/todos/pending/mine.md']);
});
test('a deletion staged by this call is rolled back when a later entry fails', () => {
// Ordering: the good removal is processed first, then the contradicted one.
fs.copyFileSync(path.join(tmpDir, COMPLETED, 'mine.md'), path.join(tmpDir, PENDING, 'stays-put.md'));
gitOrThrow(['add', path.join(PENDING, 'stays-put.md')], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
gitOrThrow(['commit', '-m', 'seed a second todo'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
const head = gitOrThrow(['rev-parse', 'HEAD'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim();
const result = runMsdTools(
['commit', 'docs: bad declaration',
'--files-removed', '.planning/todos/pending/mine.md', '.planning/todos/pending/stays-put.md'],
tmpDir,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.reason, 'staging_failed', result.output);
assert.strictEqual(parsed.file, '.planning/todos/pending/stays-put.md');
assert.strictEqual(gitOrThrow(['rev-parse', 'HEAD'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim(), head);
// The staged deletion of mine.md was restored to the index by the rollback.
assert.strictEqual(gitOrThrow(['diff', '--cached', '--name-only'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim(), '');
assert.ok(
gitOrThrow(['ls-files', '--', PENDING], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).includes('mine.md'),
'mine.md must be back in the index after rollback',
);
});
test('a caller-pre-staged deletion with a non-ASCII name survives the rollback', () => {
// `diff --cached --name-only` without -z quotes `café.md` as
// `"caf\303\251.md"`, which never matched the raw path, so the rollback
// treated the caller's own staged deletion as this call's and undid it.
const cafe = path.join(PENDING, 'café.md');
fs.writeFileSync(path.join(tmpDir, cafe), 'accent\n');
gitOrThrow(['add', cafe], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
gitOrThrow(['commit', '-m', 'seed café'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
gitOrThrow(['rm', '-q', cafe], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }); // caller-staged deletion
fs.copyFileSync(path.join(tmpDir, COMPLETED, 'mine.md'), path.join(tmpDir, PENDING, 'mine.md')); // contradiction
const result = runMsdTools(
['commit', 'docs: bad declaration',
'--files-removed', '.planning/todos/pending/café.md', '.planning/todos/pending/mine.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).reason, 'staging_failed', result.output);
const cached = gitOrThrow(['diff', '--cached', '--name-only', '-z'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).split('\0').filter(Boolean);
assert.deepStrictEqual(cached, ['.planning/todos/pending/café.md'], 'the caller\'s own staged deletion must survive');
});
test('on an unborn HEAD an absent index-only path is unstaged, never a pathspec entry', (t) => {
// A root commit has no parent to delete from; naming the path would make
// `git commit` refuse with "pathspec did not match".
const fresh = createTempGitProject();
t.after(() => cleanup(fresh));
// The fixture may seed commits; make an unborn branch explicitly.
gitOrThrow(['checkout', '-q', '--orphan', 'unborn'], { cwd: fresh, timeoutMs: GIT_TIMEOUT_MS });
gitOrThrow(['rm', '-rfq', '--cached', '.'], { cwd: fresh, timeoutMs: GIT_TIMEOUT_MS });
fs.mkdirSync(path.join(fresh, PENDING), { recursive: true });
fs.writeFileSync(path.join(fresh, PENDING, 'a.md'), 'a\n');
fs.writeFileSync(path.join(fresh, PENDING, 'gone.md'), 'gone\n');
gitOrThrow(['add', PENDING], { cwd: fresh, timeoutMs: GIT_TIMEOUT_MS });
fs.unlinkSync(path.join(fresh, PENDING, 'gone.md'));
const result = runMsdTools(
['commit', 'docs: root commit',
'--files', '.planning/todos/pending/a.md',
'--files-removed', '.planning/todos/pending/gone.md'],
fresh,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
const tree = gitOrThrow(['ls-tree', '-r', '--name-only', 'HEAD'], { cwd: fresh, timeoutMs: GIT_TIMEOUT_MS }).trim().split('\n');
assert.ok(tree.includes('.planning/todos/pending/a.md'), tree.join(','));
assert.ok(!tree.includes('.planning/todos/pending/gone.md'), tree.join(','));
assert.strictEqual(gitOrThrow(['diff', '--cached', '--name-only'], { cwd: fresh, timeoutMs: GIT_TIMEOUT_MS }).trim(), '');
});
test('a boolean flag inside a list does not end it: the positional after it stays in that list', () => {
// `--files a --no-verify b --files-removed c`: before #4208 the single
// slice-to-end list swept `b` into --files; a list that stops at ANY
// `--` token silently drops it instead (review of #4253). A list runs to
// the next LIST flag and skips boolean flags on the way.
const result = runMsdTools(
['commit', 'docs(phase-5): close 1 resolved todo(s)',
'--files', '.planning/todos/completed/mine.md', '--no-verify', '.planning/STATE.md',
'--files-removed', '.planning/todos/pending/mine.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
assert.deepStrictEqual(
nameStatus(),
['A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md', 'M\t.planning/STATE.md'],
'STATE.md, wedged between --no-verify and --files-removed, must still be in the --files list',
);
});
test('a repeated list flag merges its runs, as the old parser did', () => {
// `--files a --files b`: the pre-#4208 slice-to-end parse yielded [a, b];
// a parser that stops at the next list flag — including a repeat of the
// same one — silently dropped b (found by the round's comment audit).
fs.writeFileSync(path.join(tmpDir, '.planning', 'ROADMAP.md'), '# Roadmap\n');
const result = runMsdTools(
['commit', 'docs(phase-5): close 1 resolved todo(s)',
'--files', '.planning/todos/completed/mine.md', '--files', '.planning/ROADMAP.md',
'--files-removed', '.planning/todos/pending/mine.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
assert.deepStrictEqual(
nameStatus(),
['A\t.planning/ROADMAP.md', 'A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md'],
'both --files runs must reach the commit',
);
});
test('--files-removed before --files parses both lists and the message', () => {
const result = runMsdTools(
['commit', 'docs(phase-5): close 1 resolved todo(s)',
'--files-removed', '.planning/todos/pending/mine.md',
'--files', '.planning/todos/completed/mine.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
assert.deepStrictEqual(
nameStatus(),
['A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md'],
);
const subject = gitOrThrow(['log', '-1', '--format=%s'], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }).trim();
assert.strictEqual(subject, 'docs(phase-5): close 1 resolved todo(s)');
});
});
/**
* #4253 review: absence from the worktree is not removal. Some index entries
* are absent BY DESIGN — a submodule gitlink whose directory was deleted by
* hand, a skip-worktree path a sparse checkout never materialised, an
* assume-unchanged path — and `lstat` cannot tell them from a moved-away file.
* Under a directory entry they are left alone, exactly like a present file;
* named directly they contradict the declaration and fail closed. And a
* staging failure restores every index entry this call removed EXACTLY,
* including on an unborn HEAD, where `git reset` has nothing to restore from.
*/
describe('commit --files-removed: index states absent by design are never removals (#4208 review)', () => {
let tmpDir;
let stray;
const PENDING = path.join('.planning', 'todos', 'pending');
const COMPLETED = path.join('.planning', 'todos', 'completed');
function git(args, cwd = tmpDir) {
return gitOrThrow(args, { cwd, timeoutMs: GIT_TIMEOUT_MS }).trim();
}
function nameStatus() {
return git(['diff', '--no-renames', 'HEAD~1', 'HEAD', '--name-status']).split('\n').filter(Boolean).sort();
}
// Untrimmed: porcelain's leading column is significant (` D` = unstaged deletion).
function porcelain(...pathspec) {
return gitOrThrow(['status', '--porcelain', '--', ...pathspec], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
}
// Seed the standard move: pending/mine.md -> completed/mine.md, committed at pending/.
function seedMove() {
fs.mkdirSync(path.join(tmpDir, PENDING), { recursive: true });
fs.mkdirSync(path.join(tmpDir, COMPLETED), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, 'mine.md'), 'mine\n');
git(['add', '.planning/']);
git(['commit', '-q', '-m', 'seed todo']);
fs.renameSync(path.join(tmpDir, PENDING, 'mine.md'), path.join(tmpDir, COMPLETED, 'mine.md'));
}
// A submodule at pending/sub whose directory is then deleted by hand — the
// one gitlink shape that reads as absent (an uninitialised submodule leaves
// an empty directory behind, which lstat sees as present).
function addSubmoduleThenDeleteDir() {
const subSrc = path.join(tmpDir, '..', path.basename(tmpDir) + '-sub');
stray = subSrc;
fs.mkdirSync(subSrc, { recursive: true });
git(['init', '-q', '.'], subSrc);
git(['config', 'user.email', 't@t'], subSrc);
git(['config', 'user.name', 't'], subSrc);
fs.writeFileSync(path.join(subSrc, 'f.txt'), 'v1\n');
git(['add', 'f.txt'], subSrc);
git(['commit', '-q', '-m', 'v1'], subSrc);
git(['-c', 'protocol.file.allow=always', 'submodule', 'add', '-q', subSrc, '.planning/todos/pending/sub']);
git(['commit', '-q', '-m', 'add submodule']);
cleanup(path.join(tmpDir, PENDING, 'sub'));
assert.match(porcelain(PENDING), /^ D \.planning\/todos\/pending\/sub$/m, 'git itself reads the gitlink as deleted');
}
beforeEach(() => { tmpDir = createTempGitProject(); stray = null; });
afterEach(() => { cleanup(tmpDir); if (stray) cleanup(stray); });
// Deterministic, privilege-independent restore-failure injection.
// `chmod a-w` on the git dir (as this file's other restore-failure tests
// used to) relies on the OS enforcing the *owner's own* permission bits
// against itself -- which root, a routine identity inside a Docker-based
// CI bench, does not: every DAC check short-circuits true for uid 0, so the
// write the chmod meant to block SUCCEEDS, the restore silently comes back
// clean, and the disclosure this test exists to pin never fires. That is
// this repo's own named anti-pattern for I/O-failure injection (see
// CLAUDE.md "Cross-platform test IO-failure injection") -- and it was the
// actual root cause here: the two tests below failed under a real remote
// `msd-test` run against unmodified `next` (root inside the bench
// container) while passing on an unprivileged workstation, and every OTHER
// fault-injection test in this file that does NOT depend on a permission
// check (the timeout hook two tests down that just sleeps; the mode-flip
// hook after it that runs a real `update-index`) passed in that same run.
// The fix here targets the CALL, not a permission bit: a fake `git` ahead
// of the real one on PATH turns `update-index --add --cacheinfo` — the one
// and only call the restore path makes — into a hard failure unconditionally,
// in any process regardless of uid. Every other invocation execs straight
// through to the real binary, so the rest of the commit (the `rm --cached`,
// the verification `ls-files`, etc.) behaves exactly as it does today.
function findRealGit() {
return execFileSync('command', ['-v', 'git'], { shell: '/bin/sh', timeout: GIT_TIMEOUT_MS }).toString().trim();
}
function installCacheinfoRestoreFailureShim() {
const realGit = findRealGit();
const shimDir = fs.mkdtempSync(path.join(os.tmpdir(), 'msd-fake-git-'));
fs.writeFileSync(path.join(shimDir, 'git'), [
'#!/bin/sh',
'has_cacheinfo=0',
'for arg in "$@"; do',
' if [ "$arg" = "--cacheinfo" ]; then has_cacheinfo=1; fi',
'done',
'if [ "$1" = "update-index" ] && [ "$has_cacheinfo" = "1" ]; then',
' echo "fake-git: forced update-index --cacheinfo failure for test" >&2',
' exit 1',
'fi',
`exec "${realGit}" "$@"`,
'',
].join('\n'), { mode: 0o755 });
return { shimDir, path: `${shimDir}${path.delimiter}${process.env.PATH}` };
}
test('a directory entry leaves a hand-deleted submodule gitlink in the index and records only the file move', () => {
seedMove();
addSubmoduleThenDeleteDir();
const result = runMsdTools(
['commit', 'docs: close a todo', '--files', '.planning/todos/completed/mine.md', '--files-removed', '.planning/todos/pending/'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
assert.deepStrictEqual(nameStatus(), ['A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md']);
// The gitlink is still tracked, at mode 160000, and git still reports the
// hand-deletion as the caller's unstaged business — not this call's.
assert.match(git(['ls-files', '-s', '--', PENDING]), /^160000 [0-9a-f]+ 0\t\.planning\/todos\/pending\/sub$/m);
assert.match(porcelain(PENDING), /^ D \.planning\/todos\/pending\/sub$/m);
});
test('a submodule gitlink named directly under --files-removed fails closed, naming the state', () => {
seedMove();
addSubmoduleThenDeleteDir();
const head = git(['rev-parse', 'HEAD']);
const result = runMsdTools(
['commit', 'docs: bad declaration', '--files', '.planning/todos/completed/mine.md', '--files-removed', '.planning/todos/pending/sub'],
tmpDir,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, false, result.output);
assert.strictEqual(parsed.reason, 'staging_failed');
assert.strictEqual(parsed.file, '.planning/todos/pending/sub');
assert.match(parsed.error, /submodule gitlink/);
assert.strictEqual(git(['rev-parse', 'HEAD']), head);
assert.strictEqual(git(['diff', '--cached', '--name-only']), '', 'the addition this call staged is rolled back');
assert.match(git(['ls-files', '-s', '--', PENDING]), /^160000 /m, 'the gitlink is untouched');
});
test('a skip-worktree path is absent by checkout, not removed: skipped under a directory entry, refused when named', () => {
seedMove();
// A second tracked todo that a sparse checkout would not materialise.
fs.writeFileSync(path.join(tmpDir, PENDING, 'sparse.md'), 'sparse\n');
git(['add', path.join(PENDING, 'sparse.md')]);
git(['commit', '-q', '-m', 'seed sparse']);
git(['update-index', '--skip-worktree', '--', '.planning/todos/pending/sparse.md']);
fs.unlinkSync(path.join(tmpDir, PENDING, 'sparse.md'));
assert.strictEqual(porcelain(path.join(PENDING, 'sparse.md')), '', 'git itself does not report a skip-worktree path as deleted');
const dirForm = runMsdTools(
['commit', 'docs: close a todo', '--files', '.planning/todos/completed/mine.md', '--files-removed', '.planning/todos/pending/'],
tmpDir,
);
assert.strictEqual(JSON.parse(dirForm.output).committed, true, dirForm.output);
assert.deepStrictEqual(nameStatus(), ['A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md']);
assert.match(git(['ls-files', '-v', '--', PENDING]), /^S \.planning\/todos\/pending\/sparse\.md$/m, 'the sparse entry stays in the index, still skip-worktree');
const head = git(['rev-parse', 'HEAD']);
const named = runMsdTools(['commit', 'docs: bad declaration', '--files-removed', '.planning/todos/pending/sparse.md'], tmpDir);
const parsed = JSON.parse(named.output);
assert.strictEqual(parsed.reason, 'staging_failed', named.output);
assert.strictEqual(parsed.file, '.planning/todos/pending/sparse.md');
assert.match(parsed.error, /skip-worktree/);
assert.strictEqual(git(['rev-parse', 'HEAD']), head);
assert.match(git(['ls-files', '-v', '--', PENDING]), /^S \.planning\/todos\/pending\/sparse\.md$/m);
});
test('a directly named path is recognised by any spelling that resolves to it (absolute path)', () => {
// The direct-vs-directory decision is made on resolved paths. A string
// compare against git's cwd-relative output silently took the directory
// polarity for an absolute path, so a named gitlink SKIPPED instead of
// refusing (found by review, driven).
seedMove();
addSubmoduleThenDeleteDir();
const head = git(['rev-parse', 'HEAD']);
const result = runMsdTools(
['commit', 'docs: bad declaration', '--files', '.planning/todos/completed/mine.md', '--files-removed', path.join(tmpDir, PENDING, 'sub')],
tmpDir,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.reason, 'staging_failed', result.output);
assert.match(parsed.error, /submodule gitlink/);
assert.strictEqual(git(['rev-parse', 'HEAD']), head);
assert.match(git(['ls-files', '-s', '--', PENDING]), /^160000 /m, 'the gitlink is untouched');
// And through a SYMLINKED spelling of the same directory — the macOS
// `/var` → `/private/var` shape, where `process.cwd()` is the real path
// and the caller's absolute path is not (CI, first push of this round).
const alias = tmpDir + '-alias';
fs.symlinkSync(tmpDir, alias, 'dir');
try {
const viaLink = runMsdTools(
['commit', 'docs: bad declaration', '--files', '.planning/todos/completed/mine.md', '--files-removed', path.join(alias, PENDING, 'sub')],
tmpDir,
);
const p2 = JSON.parse(viaLink.output);
assert.strictEqual(p2.reason, 'staging_failed', viaLink.output);
assert.match(p2.error, /submodule gitlink/);
assert.strictEqual(git(['rev-parse', 'HEAD']), head);
} finally {
fs.unlinkSync(alias);
}
});
test('an intent-to-add entry is not tracked content: skipped under a directory entry, refused when named', () => {
// `git add -N` renders as a plain `H 100644 <empty blob>` entry, yet there
// is nothing committed to remove and a cacheinfo rollback cannot restore
// the flag (found by review, driven).
seedMove();
fs.writeFileSync(path.join(tmpDir, PENDING, 'planned.md'), 'planned\n');
git(['add', '-N', path.join(PENDING, 'planned.md')]);
fs.unlinkSync(path.join(tmpDir, PENDING, 'planned.md'));
const before = git(['ls-files', '-s', '--', path.join(PENDING, 'planned.md')]);
assert.match(before, /^100644 e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 0/, 'fixture: intent-to-add entry present');
const dirForm = runMsdTools(
['commit', 'docs: close a todo', '--files', '.planning/todos/completed/mine.md', '--files-removed', '.planning/todos/pending/'],
tmpDir,
);
assert.strictEqual(JSON.parse(dirForm.output).committed, true, dirForm.output);
assert.deepStrictEqual(nameStatus(), ['A\t.planning/todos/completed/mine.md', 'D\t.planning/todos/pending/mine.md']);
assert.strictEqual(git(['ls-files', '-s', '--', path.join(PENDING, 'planned.md')]), before, 'the intent-to-add entry is left alone');
const named = runMsdTools(['commit', 'docs: bad declaration', '--files-removed', '.planning/todos/pending/planned.md'], tmpDir);
const parsed = JSON.parse(named.output);
assert.strictEqual(parsed.reason, 'staging_failed', named.output);
assert.match(parsed.error, /intent-to-add/);
assert.strictEqual(git(['ls-files', '-s', '--', path.join(PENDING, 'planned.md')]), before);
});
test('an assume-unchanged path named directly fails closed and stays in the index', () => {
seedMove();
git(['update-index', '--assume-unchanged', '--', '.planning/todos/pending/mine.md']);
const result = runMsdTools(['commit', 'docs: drop a todo', '--files-removed', '.planning/todos/pending/mine.md'], tmpDir);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.reason, 'staging_failed', result.output);
assert.match(parsed.error, /assume-unchanged/);
assert.match(git(['ls-files', '-v', '--', PENDING]), /^h \.planning\/todos\/pending\/mine\.md$/m);
});
test('on an unborn HEAD a removal staged by this call is restored when a later entry fails', (t) => {
// The rollback cannot `git reset` to a HEAD that does not exist; the
// entry is put back from the record this call kept of it.
const fresh = createTempGitProject();
t.after(() => cleanup(fresh));
git(['checkout', '-q', '--orphan', 'unborn'], fresh);
git(['rm', '-rfq', '--cached', '.'], fresh);
fs.mkdirSync(path.join(fresh, PENDING), { recursive: true });
fs.writeFileSync(path.join(fresh, PENDING, 'gone.md'), 'gone\n');
fs.writeFileSync(path.join(fresh, PENDING, 'stays.md'), 'stays\n');
git(['add', PENDING], fresh);
const before = git(['ls-files', '-s', '--', PENDING], fresh);
fs.unlinkSync(path.join(fresh, PENDING, 'gone.md'));
const result = runMsdTools(
['commit', 'docs: root commit', '--files-removed', '.planning/todos/pending/gone.md', '.planning/todos/pending/stays.md'],
fresh,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.reason, 'staging_failed', result.output);
assert.strictEqual(parsed.file, '.planning/todos/pending/stays.md');
assert.throws(() => git(['rev-parse', '-q', '--verify', 'HEAD'], fresh), 'nothing may be committed');
assert.strictEqual(git(['ls-files', '-s', '--', PENDING], fresh), before, 'gone.md is back in the index, same mode and blob');
});
test('on an unborn HEAD a removal-only call that stages nothing else leaves no removal behind', (t) => {
// The rollback above fires only on a staging FAILURE. On an unborn HEAD a
// removal never joins `stagedPaths` (there is no parent to delete from), so
// a removal-only call that SUCCEEDS reaches the nothing-to-commit guard with
// an empty pathspec -- and `nothing_to_commit` tells the caller no state
// changed while `rm --cached` has already mutated the index. The removal
// would then ride along on the caller's next commit.
const fresh = createTempGitProject();
t.after(() => cleanup(fresh));
git(['checkout', '-q', '--orphan', 'unborn'], fresh);
git(['rm', '-rfq', '--cached', '.'], fresh);
fs.mkdirSync(path.join(fresh, PENDING), { recursive: true });
fs.writeFileSync(path.join(fresh, PENDING, 'gone.md'), 'gone\n');
git(['add', PENDING], fresh);
const before = git(['ls-files', '-s', '--', PENDING], fresh);
fs.unlinkSync(path.join(fresh, PENDING, 'gone.md'));
const result = runMsdTools(
['commit', 'docs: root commit', '--files-removed', '.planning/todos/pending/gone.md'],
fresh,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, false, result.output);
assert.throws(() => git(['rev-parse', '-q', '--verify', 'HEAD'], fresh), 'nothing may be committed');
assert.strictEqual(
git(['ls-files', '-s', '--', PENDING], fresh), before,
'a call reporting no commit must leave the index as it found it',
);
});
test('a removal of an index-only path leaves no removal behind when nothing is recorded', () => {
// The same defect with a real HEAD, so the fix cannot key on `headExists`.
// gone.md was `git add`ed and never committed, then deleted from disk: the
// removal DOES join the pathspec here, but `diff HEAD -- gone.md` reads
// clean because the path is absent from the worktree and from HEAD alike,
// so the guard reports nothing_to_commit over a staged removal.
fs.mkdirSync(path.join(tmpDir, PENDING), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, 'seed.md'), 'seed\n');
git(['add', '.planning/']);
git(['commit', '-q', '-m', 'seed todo']);
fs.writeFileSync(path.join(tmpDir, PENDING, 'gone.md'), 'gone\n');
git(['add', path.join(PENDING, 'gone.md')]);
const before = git(['ls-files', '-s', '--', PENDING]);
const head = git(['rev-parse', 'HEAD']);
fs.unlinkSync(path.join(tmpDir, PENDING, 'gone.md'));
const result = runMsdTools(
['commit', 'docs: remove an uncommitted path', '--files-removed', '.planning/todos/pending/gone.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, false, result.output);
assert.strictEqual(git(['rev-parse', 'HEAD']), head, 'nothing may be committed');
assert.strictEqual(
git(['ls-files', '-s', '--', PENDING]), before,
'a call reporting no commit must leave the index as it found it',
);
});
test('a removal the call cannot put back is reported, never as nothing_to_commit',
{ skip: process.platform === 'win32' ? 'the fault-injection shim is a #!/bin/sh script resolved via PATH; Windows git resolution needs a .exe/.cmd shim, a separate fixture' : false },
(t) => {
// The restore is best-effort, so it can FAIL -- and reporting
// nothing_to_commit over a removal we tried and could not undo is the same
// false "no state changed" the restore exists to prevent, one level down.
// Driven with a fake `git` ahead of the real one on PATH that fails the
// one call the restore makes (`update-index --add --cacheinfo`) — see
// installCacheinfoRestoreFailureShim's header for why this replaced a
// chmod-based hook.
fs.mkdirSync(path.join(tmpDir, PENDING), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, 'seed.md'), 'seed\n');
git(['add', '.planning/']);
git(['commit', '-q', '-m', 'seed todo']);
fs.writeFileSync(path.join(tmpDir, PENDING, 'gone.md'), 'gone\n');
git(['add', path.join(PENDING, 'gone.md')]);
fs.unlinkSync(path.join(tmpDir, PENDING, 'gone.md'));
const shim = installCacheinfoRestoreFailureShim();
t.after(() => cleanup(shim.shimDir));
const result = runMsdTools(
['commit', 'docs: remove an uncommitted path', '--files-removed', '.planning/todos/pending/gone.md'],
tmpDir,
{ PATH: shim.path },
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, false, result.output);
assert.notStrictEqual(parsed.reason, 'nothing_to_commit', 'a removal left staged must never be reported as no state change');
assert.strictEqual(parsed.reason, 'staging_failed', result.output);
assert.match(parsed.error, /could not be restored/);
assert.match(parsed.error, /gone\.md/);
});
test('a rollback that cannot restore a removal discloses it, even when the reported failure is another entry',
{ skip: process.platform === 'win32' ? 'the fault-injection shim is a #!/bin/sh script resolved via PATH; Windows git resolution needs a .exe/.cmd shim, a separate fixture' : false },
(t) => {
// The rollback exit reports the failure that CAUSED it -- here a
// contradictory declaration about a path still on disk -- so a caller
// reading `failures` would learn nothing about the removal this call had
// already staged and then could not put back. Both must be disclosed.
// Driven with the same fake-`git` restore-failure shim as the test above
// (see installCacheinfoRestoreFailureShim's header).
seedMove();
fs.writeFileSync(path.join(tmpDir, PENDING, 'stays.md'), 'stays\n');
git(['add', path.join(PENDING, 'stays.md')]);
git(['commit', '-q', '-m', 'seed a present todo']);
const shim = installCacheinfoRestoreFailureShim();
t.after(() => cleanup(shim.shimDir));
// mine.md was moved away (a real removal); stays.md is still on disk, so
// declaring it removed contradicts the declaration and fails the call.
const result = runMsdTools(
['commit', 'docs: bad declaration',
'--files-removed', '.planning/todos/pending/mine.md', '.planning/todos/pending/stays.md'],
tmpDir,
{ PATH: shim.path },
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.reason, 'staging_failed', result.output);
assert.strictEqual(parsed.file, '.planning/todos/pending/stays.md', 'the REPORTED failure is still the contradictory declaration');
const disclosed = parsed.failures.filter(f => /could NOT be restored/.test(f.error));
assert.ok(
disclosed.length > 0,
`a removal left staged by a failed rollback must be disclosed; failures were ${JSON.stringify(parsed.failures)}`,
);
assert.ok(
disclosed.some(f => f.file === '.planning/todos/pending/mine.md'),
`the disclosure must name the un-restored path; got ${JSON.stringify(disclosed)}`,
);
});
test('a removal whose own rm failed is not disclosed as still staged', () => {
// The mirror of the disclosure above. `removedEntries` is the set this call
// claims to have STAGED, so an entry recorded before a `rm --cached` that
// then FAILED would be reported as "still staged in the index" when nothing
// was staged at all. Driven with a pre-existing index.lock, which fails the
// rm and the restore alike.
seedMove();
fs.writeFileSync(path.join(tmpDir, PENDING, 'stays.md'), 'stays\n');
git(['add', path.join(PENDING, 'stays.md')]);
git(['commit', '-q', '-m', 'seed a present todo']);
const before = git(['ls-files', '-s', '--', PENDING]);
fs.writeFileSync(path.join(tmpDir, '.git', 'index.lock'), '');
const result = runMsdTools(
['commit', 'docs: bad declaration',
'--files-removed', '.planning/todos/pending/mine.md', '.planning/todos/pending/stays.md'],
tmpDir,
);
fs.unlinkSync(path.join(tmpDir, '.git', 'index.lock'));
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.reason, 'staging_failed', result.output);
assert.strictEqual(
parsed.failures.filter(f => /could NOT be restored/.test(f.error)).length, 0,
`nothing was staged, so nothing may be disclosed as left staged; failures were ${JSON.stringify(parsed.failures)}`,
);
assert.strictEqual(git(['ls-files', '-s', '--', PENDING]), before, 'the index is untouched');
});
test('a timed-out removal does not produce a false could-not-restore disclosure', () => {
// The exit code answers "did the command succeed", never "did the index
// change": execGit collapses a spawn timeout to a non-zero exit, and a
// killed git can already have written the index. This pins the RESTORE
// side of that -- a restore whose update-index was killed after its write
// landed must not report "could NOT be restored" over an index it did in
// fact restore. Forcing the restore verdict back onto the exit code fails
// this test.
//
// NAMED RESIDUAL: the RECORD side of the same rule -- a timed-out `rm`
// whose write DID land must still be recorded and undone -- is NOT pinned
// here. Whether that write survives the in-process kill is not
// deterministic (driven: it lands under a shell `timeout`, and did not
// under execGit's spawnSync bound), so an assertion on it would read as
// coverage and never run. It is driven by hand instead.
seedMove();
const before = git(['ls-files', '-s', '--', PENDING]);
const hooksDir = path.join(tmpDir, '.git', 'hooks');
fs.mkdirSync(hooksDir, { recursive: true });
fs.writeFileSync(path.join(hooksDir, 'post-index-change'), '#!/bin/sh\nsleep 12\n', { mode: 0o755 });
const emptyConfig = path.join(tmpDir, 'empty.gitconfig');
fs.writeFileSync(emptyConfig, '');
const result = runMsdTools(
['commit', 'docs: close a todo', '--files-removed', '.planning/todos/pending/mine.md'],
tmpDir,
{ GIT_CONFIG_GLOBAL: emptyConfig, GIT_CONFIG_NOSYSTEM: '1' },
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, false, result.output);
// Consistency only, NOT the control: whichever way the killed write went,
// the call must leave the index coherent. See the residual note above.
assert.strictEqual(git(['ls-files', '-s', '--', PENDING]), before, 'the index must be coherent after a timed-out removal');
// THE CONTROL: the restore succeeded, so nothing may claim otherwise.
assert.strictEqual(
(parsed.failures || []).filter(f => /could NOT be restored/.test(f.error)).length, 0,
`the index was restored, so no disclosure may fire; failures were ${JSON.stringify(parsed.failures)}`,
);
});
test('a restored non-ASCII path is recognised as restored, not reported as a failure', () => {
// The restore verification reads the index back, so it must read it with
// `-z`: core.quotePath renders café.md as "caf\\303\\251.md", which never
// equals the raw path, and an EXACTLY restored entry then read as not
// restored -- the same quoting defect this PR already fixed for preStaged.
fs.mkdirSync(path.join(tmpDir, PENDING), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, 'seed.md'), 'seed\n');
git(['add', '.planning/']);
git(['commit', '-q', '-m', 'seed todo']);
// Index-only and absent from disk: the call stages the removal, records
// nothing, and must restore -- the path the verification runs on.
fs.writeFileSync(path.join(tmpDir, PENDING, 'café.md'), 'cafe\n');
git(['add', path.join(PENDING, 'café.md')]);
const before = gitOrThrow(['ls-files', '-s', '-z', '--', PENDING], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS });
fs.unlinkSync(path.join(tmpDir, PENDING, 'café.md'));
const result = runMsdTools(
['commit', 'docs: remove an uncommitted path', '--files-removed', '.planning/todos/pending/café.md'],
tmpDir,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.reason, 'nothing_to_commit', result.output);
assert.strictEqual(
gitOrThrow(['ls-files', '-s', '-z', '--', PENDING], { cwd: tmpDir, timeoutMs: GIT_TIMEOUT_MS }), before,
'the entry is restored exactly',
);
});
test('a path restored at a different mode is not accepted as restored', () => {
// --cacheinfo restores mode, blob and stage, so a path-only membership test
// would accept an entry that came back as something else. Driven with a
// post-index-change hook that rewrites the restored entry's mode.
fs.mkdirSync(path.join(tmpDir, PENDING), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, 'seed.md'), 'seed\n');
git(['add', '.planning/']);
git(['commit', '-q', '-m', 'seed todo']);
fs.writeFileSync(path.join(tmpDir, PENDING, 'gone.md'), 'gone\n');
git(['add', path.join(PENDING, 'gone.md')]);
// git's `:<path>` index syntax takes a FORWARD-slash path; `path.join`
// yields backslashes on Windows and git rejects them as an ambiguous
// argument. The hook below already uses the slash form for the same reason.
const GONE = '.planning/todos/pending/gone.md';
const blob = git(['rev-parse', ':' + GONE]);
fs.unlinkSync(path.join(tmpDir, PENDING, 'gone.md'));
const hooksDir = path.join(tmpDir, '.git', 'hooks');
fs.mkdirSync(hooksDir, { recursive: true });
// Fires after the restore's index write; flips the mode so the entry that
// comes back is not the entry that was removed.
fs.writeFileSync(path.join(hooksDir, 'post-index-change'),
'#!/bin/sh\n'
+ 'git ls-files -s -- .planning/todos/pending/gone.md | grep -q "^100644" '
+ '&& git update-index --add --cacheinfo 100755,' + blob + ',.planning/todos/pending/gone.md\n',
{ mode: 0o755 });
const emptyConfig = path.join(tmpDir, 'empty.gitconfig');
fs.writeFileSync(emptyConfig, '');
const result = runMsdTools(
['commit', 'docs: remove an uncommitted path', '--files-removed', '.planning/todos/pending/gone.md'],
tmpDir,
{ GIT_CONFIG_GLOBAL: emptyConfig, GIT_CONFIG_NOSYSTEM: '1' },
);
const parsed = JSON.parse(result.output);
assert.notStrictEqual(
parsed.reason, 'nothing_to_commit',
`the entry came back at a different mode, so the restore is not clean: ${result.output}`,
);
});
test('a tracked filename containing a glob removes only itself, never its neighbours',
{ skip: process.platform === 'win32' ? 'a filename containing `*` cannot exist on Windows (driven: IOException)' : false },
() => {
// An index path handed back to git is parsed as a PATHSPEC. A tracked file
// literally named `*.md` therefore GLOBS: `rm --cached` on it also removed
// the peers, only the declared entry was recorded, and the rollback then
// restored one of three -- leaving the others staged as undisclosed
// deletions. :(literal) is what makes the operand mean the file it names.
fs.mkdirSync(path.join(tmpDir, PENDING), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, '*.md'), 'wildcard\n');
fs.writeFileSync(path.join(tmpDir, PENDING, 'peer.md'), 'peer\n');
fs.writeFileSync(path.join(tmpDir, PENDING, 'stays.md'), 'stays\n');
git(['add', '.planning/']);
git(['commit', '-q', '-m', 'seed a wildcard-named todo']);
fs.unlinkSync(path.join(tmpDir, PENDING, '*.md'));
const before = git(['ls-files', '-s', '--', PENDING]);
// stays.md is still present, so the call fails and rolls back. Whatever the
// rollback restores, the peers must never have been touched at all.
const result = runMsdTools(
['commit', 'docs: bad declaration',
'--files-removed', '.planning/todos/pending/', '.planning/todos/pending/stays.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).reason, 'staging_failed', result.output);
assert.strictEqual(
git(['diff', '--cached', '--name-status']), '',
'no unrelated deletion may be left staged by a globbing pathspec',
);
assert.strictEqual(git(['ls-files', '-s', '--', PENDING]), before, 'the index is exactly as it was');
});
test('a tracked filename containing pathspec magic is removed, and commits nothing else',
{ skip: process.platform === 'win32' ? 'a filename containing `:` cannot exist on Windows (driven: FileNotFoundException)' : false },
() => {
// The quieter half of the same defect: pathspec magic binds at the START of
// the operand, so a file named `:(literal)mine` at the repo ROOT has its
// prefix PARSED -- the rm matched nothing, exited 0, and the entry survived
// a removal this call went on to report as done. A path under a directory
// never starts with `:`, so the fixture must be top-level to reach it.
const odd = ':(literal)mine';
fs.writeFileSync(path.join(tmpDir, odd), 'mine\n');
git(['add', '--', ':(literal)' + odd]);
git(['commit', '-q', '-m', 'seed a magic-named file']);
assert.strictEqual(git(['ls-files', '--', ':(literal)' + odd]), odd, 'fixture: the odd name is tracked');
fs.unlinkSync(path.join(tmpDir, odd));
// A peer that is MODIFIED but never declared: the commit's own pathspec is
// where an unliteralised name sweeps it in.
fs.writeFileSync(path.join(tmpDir, 'peer.md'), 'peer\n');
git(['add', 'peer.md']);
git(['commit', '-q', '-m', 'seed a peer']);
fs.writeFileSync(path.join(tmpDir, 'peer.md'), 'peer, modified\n');
const result = runMsdTools(
['commit', 'docs: close a todo', '--files-removed', odd],
tmpDir,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, true, result.output);
assert.strictEqual(
git(['ls-files', '--', ':(literal)' + odd]), '',
'the entry the caller named must actually be gone from the index',
);
// The commit must contain the declared removal and NOTHING else -- an
// undeclared `M peer.md` is the sweep this flag exists to remove.
assert.strictEqual(
git(['diff', '--no-renames', 'HEAD~1', 'HEAD', '--name-status']), 'D\t' + odd,
'only the declared removal may be committed',
);
});
test('a glob-named removal commits only itself, never an undeclared peer edit',
{ skip: process.platform === 'win32' ? 'a filename containing `*` cannot exist on Windows (driven: IOException)' : false },
() => {
// Literalising the STAGING is not enough: `git commit -- <paths>` takes the
// same paths as a pathspec, so a tracked file named `*.md` swept a MODIFIED
// peer into the commit the caller never declared -- the sweep this flag
// exists to remove, arriving one step after staging.
fs.mkdirSync(path.join(tmpDir, PENDING), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, '*.md'), 'wildcard\n');
fs.writeFileSync(path.join(tmpDir, PENDING, 'peer.md'), 'peer\n');
git(['add', '.planning/']);
git(['commit', '-q', '-m', 'seed a wildcard-named todo']);
fs.unlinkSync(path.join(tmpDir, PENDING, '*.md'));
fs.writeFileSync(path.join(tmpDir, PENDING, 'peer.md'), 'peer, modified\n');
const result = runMsdTools(
['commit', 'docs: close a todo', '--files-removed', '.planning/todos/pending/'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).committed, true, result.output);
assert.strictEqual(
git(['diff', '--no-renames', 'HEAD~1', 'HEAD', '--name-status']),
'D\t' + path.join(PENDING, '*.md'),
'only the declared removal may be committed',
);
assert.match(porcelain(PENDING), /^ M \.planning\/todos\/pending\/peer\.md$/m, "the peer's edit stays uncommitted");
});
test('an intent-to-add entry with a glob name keeps its intent flag',
{ skip: process.platform === 'win32' ? 'a filename containing `*` cannot exist on Windows (driven: IOException)' : false },
() => {
// The intent-to-add probe is a `diff --cached` over the path, so an
// unliteralised glob name matched a STAGED PEER instead of itself, the
// entry was misclassified as ordinary content, removed, and then restored
// by --cacheinfo -- which cannot restore the intent flag. It came back as a
// real staged addition.
fs.mkdirSync(path.join(tmpDir, PENDING), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, 'peer.md'), 'peer\n');
git(['add', path.join(PENDING, 'peer.md')]); // a STAGED peer for the glob to find
fs.writeFileSync(path.join(tmpDir, PENDING, '*.md'), 'wildcard\n');
git(['add', '-N', '--', ':(literal)' + path.join(PENDING, '*.md')]);
fs.unlinkSync(path.join(tmpDir, PENDING, '*.md'));
// OBSERVE THE FLAG, not the entry. `ls-files -v` renders an intent-to-add
// exactly like an ordinary cached entry, so comparing it cannot see the
// flag at all -- an earlier cut of this test did that and passed with the
// fix reverted. An intent-to-add is absent from `diff --cached`; losing the
// flag turns it into a real staged addition, which is what to assert on.
assert.doesNotMatch(
git(['diff', '--cached', '--name-status']), /^A\t.*\*\.md$/m,
'fixture: the intent-to-add entry is not a staged addition yet',
);
// A directory entry: the intent-to-add path must be SKIPPED, not removed.
const result = runMsdTools(
['commit', 'docs: close a todo', '--files-removed', '.planning/todos/pending/'],
tmpDir,
);
assert.ok(result.output, 'the tool produced output');
assert.doesNotMatch(
git(['diff', '--cached', '--name-status']), /^A\t.*\*\.md$/m,
'the intent-to-add entry must keep its flag -- a --cacheinfo restore turns it into a real staged addition',
);
assert.match(
git(['ls-files', '--', ':(literal)' + path.join(PENDING, '*.md')]), /\*\.md/,
'and it must still be in the index at all',
);
});
test("a nested project's rollback leaves the caller's own staged work alone", (t) => {
// `diff --cached` prints REPO-relative paths whatever the cwd, while
// stagedPaths holds the caller's cwd-relative names. In a project nested
// inside its repo the two name spaces never intersect, so `preStaged`
// matched NOTHING and the rollback unstaged everything -- including work
// the caller had staged themselves, which is precisely what preStaged
// exists to protect. Pre-existing: it governs the --files side too.
const repo = createTempGitProject();
t.after(() => cleanup(repo));
const proj = path.join(repo, 'sub');
const pending = path.join(proj, PENDING);
fs.mkdirSync(pending, { recursive: true });
fs.writeFileSync(path.join(pending, 'mine.md'), 'mine\n');
fs.writeFileSync(path.join(pending, 'peer.md'), 'peer\n');
fs.writeFileSync(path.join(pending, 'stays.md'), 'stays\n');
const g = (args) => gitOrThrow(args, { cwd: repo, timeoutMs: GIT_TIMEOUT_MS }).trim();
g(['add', 'sub']);
g(['commit', '-q', '-m', 'seed a nested project']);
// The caller stages their OWN work: a deletion and a modification.
fs.unlinkSync(path.join(pending, 'mine.md'));
g(['add', '-A', '--', 'sub/.planning/todos/pending/mine.md']);
fs.writeFileSync(path.join(pending, 'peer.md'), 'peer, modified\n');
g(['add', 'sub/.planning/todos/pending/peer.md']);
const before = g(['diff', '--cached', '--name-status']);
// stays.md is present, so the declaration is contradictory and the call
// rolls back. The rollback must not touch what the caller staged.
const result = runMsdTools(
['commit', 'docs: bad declaration',
'--files-removed', '.planning/todos/pending/', '.planning/todos/pending/stays.md'],
proj,
);
assert.strictEqual(JSON.parse(result.output).reason, 'staging_failed', result.output);
assert.strictEqual(
g(['diff', '--cached', '--name-status']), before,
"the caller's own staged deletion and modification must survive the rollback",
);
});
test('a file that reappears between the absence check and the rm is refused, and the rollback restores its entry', () => {
// The window this PR's own headline scenario names: a concurrent session
// recreates the path after this call judged it absent. Driven
// deterministically with a post-index-change hook, which git fires the
// moment `rm --cached` writes the index -- the hook puts the file back
// exactly then, so the re-check after the mutation must catch it.
seedMove();
const hooksDir = path.join(tmpDir, '.git', 'hooks');
fs.mkdirSync(hooksDir, { recursive: true });
fs.writeFileSync(
path.join(hooksDir, 'post-index-change'),
'#!/bin/sh\n'
+ 'git ls-files --error-unmatch -- .planning/todos/pending/mine.md >/dev/null 2>&1 '
+ '|| cp .planning/todos/completed/mine.md .planning/todos/pending/mine.md\n',
{ mode: 0o755 },
);
// Pin the hook location against a host core.hooksPath (#3901 shape).
const emptyConfig = path.join(tmpDir, 'empty.gitconfig');
fs.writeFileSync(emptyConfig, '');
const head = git(['rev-parse', 'HEAD']);
const result = runMsdTools(
['commit', 'docs: close a todo', '--files', '.planning/todos/completed/mine.md', '--files-removed', '.planning/todos/pending/mine.md'],
tmpDir,
{ GIT_CONFIG_GLOBAL: emptyConfig, GIT_CONFIG_NOSYSTEM: '1' },
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.committed, false, result.output);
assert.strictEqual(parsed.reason, 'staging_failed');
assert.strictEqual(parsed.file, '.planning/todos/pending/mine.md');
assert.match(parsed.error, /reappeared on disk/);
assert.strictEqual(git(['rev-parse', 'HEAD']), head, 'nothing may be committed under a message that declared the path removed');
assert.strictEqual(git(['diff', '--cached', '--name-only']), '', 'the addition is unstaged and the removed entry is back');
assert.ok(fs.existsSync(path.join(tmpDir, PENDING, 'mine.md')), 'the hook did put the file back (the window was exercised)');
assert.match(git(['ls-files', '--', PENDING]), /mine\.md/, 'the index entry this call removed is restored');
});
test('the rollback restores a caller-pre-staged blob at a removed path exactly, not HEAD\'s version', () => {
seedMove();
fs.writeFileSync(path.join(tmpDir, PENDING, 'present.md'), 'present\n');
git(['add', path.join(PENDING, 'present.md')]);
git(['commit', '-q', '-m', 'seed a present todo']);
// The caller staged an edit to mine.md at its OLD path (index only, HEAD
// still holds the seed blob), then moved the file and declared the old
// path removed; a `git reset` rollback would put HEAD's blob back,
// silently discarding the staged edit.
fs.writeFileSync(path.join(tmpDir, PENDING, 'mine.md'), 'mine, edited and staged\n');
git(['add', path.join(PENDING, 'mine.md')]);
const staged = git(['ls-files', '-s', '--', path.join(PENDING, 'mine.md')]);
assert.notEqual(staged, git(['ls-tree', 'HEAD', '--', path.join(PENDING, 'mine.md')]).replace(/\t/, ' '), 'fixture: the staged blob must differ from HEAD');
fs.unlinkSync(path.join(tmpDir, PENDING, 'mine.md'));
const result = runMsdTools(
['commit', 'docs: bad declaration', '--files-removed', '.planning/todos/pending/mine.md', '.planning/todos/pending/present.md'],
tmpDir,
);
assert.strictEqual(JSON.parse(result.output).reason, 'staging_failed', result.output);
assert.strictEqual(git(['ls-files', '-s', '--', path.join(PENDING, 'mine.md')]), staged, 'the pre-staged blob survives the rollback');
});
test('a symlink to a directory is one tracked path, not a directory entry', () => {
// Review of #4253 read the `lstatSync(...).isDirectory()` test as a defect
// because it does not follow symlinks. It is deliberate, and following the
// link would be the bug: git tracks a symlink as a single blob (mode
// 120000) and does NOT traverse it, so the tracked paths "under" it live
// at the REAL directory and were never named by the caller. Treating the
// link as a directory entry would stage those -- the directory sweep
// #4208 exists to remove -- while the entry the caller DID name still sat
// present on disk, contradicting its own declaration.
fs.mkdirSync(path.join(tmpDir, PENDING, 'real'), { recursive: true });
fs.writeFileSync(path.join(tmpDir, PENDING, 'real', 'a.md'), 'a\n');
fs.symlinkSync('real', path.join(tmpDir, PENDING, 'link'));
git(['add', '.planning/']);
git(['commit', '-q', '-m', 'seed a symlinked dir']);
// The premise, driven rather than asserted: one path, and git does not
// traverse it.
assert.match(git(['ls-files', '-s', '--', path.join(PENDING, 'link')]), /^120000 /, 'git tracks the symlink itself');
assert.strictEqual(git(['ls-files', '--', path.join(PENDING, 'link') + '/']), '', 'git does not traverse the symlink');
const head = git(['rev-parse', 'HEAD']);
const result = runMsdTools(
['commit', 'docs: remove a symlinked dir', '--files-removed', '.planning/todos/pending/link'],
tmpDir,
);
const parsed = JSON.parse(result.output);
assert.strictEqual(parsed.reason, 'staging_failed', result.output);
assert.match(parsed.error, /still present on disk/);
assert.strictEqual(git(['rev-parse', 'HEAD']), head, 'nothing may be committed');
assert.match(git(['ls-files', '--', PENDING]), /real\/a\.md/, 'the path behind the link is untouched -- the caller never named it');
});
});
// RULESET.TESTS.property-based-testing: the two-list commit parser is a real
// parser (split argv into two lists by boundary flags, skip embedded boolean
// flags, merge repeated occurrences), and its edge cases were already the
// subject of a review round. The example cases above pin the shapes that broke;
// this pins the invariant they are instances of, over interleavings nobody
// enumerated.
describe('commit --files/--files-removed: the two-list parser upholds its partition invariant (#4208 review)', () => {
const LIST = [...COMMIT_LIST_FLAGS];
// The alphabet a real invocation draws from: positionals, both list flags,
// and the boolean flags that may sit inside a run without ending it.
const token = fc.oneof(
fc.constantFrom('a', 'b', 'c', 'd'),
fc.constantFrom(...LIST),
fc.constantFrom('--amend', '--no-verify', '--raw'),
);
const argv = fc.array(token, { minLength: 0, maxLength: 10 })
.map(rest => ['commit', ...rest]);
// The invariant, stated independently of the implementation: walking argv
// left to right, a list flag opens a run that every later positional joins
// until the next list flag; a boolean flag is transparent; a positional
// before any list flag belongs to the message, not to a list.
function partition(args) {
const out = Object.fromEntries(LIST.map(f => [f, []]));
let open = null;
for (const t of args.slice(1)) {
if (COMMIT_LIST_FLAGS.has(t)) { open = t; continue; }
if (t.startsWith('--')) continue;
if (open !== null) out[open].push(t);
}
return out;
}
test('every positional lands in exactly the run that is open at it, whatever the flag order or count', () => {
fc.assert(fc.property(argv, (args) => {
const expected = partition(args);
for (const flag of LIST) {
assert.deepStrictEqual(collectListFlagValues(args, flag), expected[flag]);
}
return true;
}), { numRuns: 500 });
});
test('no positional after the first list flag is dropped, and none is claimed by both lists', () => {
fc.assert(fc.property(argv, (args) => {
const first = args.findIndex((a, i) => i > 0 && COMMIT_LIST_FLAGS.has(a));
if (first === -1) return true;
const afterFirst = args.slice(first + 1).filter(a => !a.startsWith('--'));
const collected = LIST.flatMap(f => collectListFlagValues(args, f));
// Multiset equality: every such positional is collected exactly once.
assert.deepStrictEqual([...collected].sort(), [...afterFirst].sort());
return true;
}), { numRuns: 500 });
});
test('with --files-removed absent the parse is the pre-#4208 slice-to-end parse', () => {
// The compatibility half: the only intended change to an invocation that
// never names the second list is that a second list flag now exists.
const legacy = fc.array(
fc.oneof(fc.constantFrom('a', 'b', 'c', 'd'), fc.constantFrom('--files'), fc.constantFrom('--amend', '--no-verify')),
{ minLength: 0, maxLength: 8 },
).map(rest => ['commit', ...rest]);
fc.assert(fc.property(legacy, (args) => {
const i = args.indexOf('--files');
const old = i === -1 ? [] : args.slice(i + 1).filter(a => !a.startsWith('--'));
assert.deepStrictEqual(collectListFlagValues(args, '--files'), old);
return true;
}), { numRuns: 500 });
});
});