diff --git a/.omp-plugin/marketplace.json b/.omp-plugin/marketplace.json index e337b8e..f6db0f2 100644 --- a/.omp-plugin/marketplace.json +++ b/.omp-plugin/marketplace.json @@ -5,13 +5,13 @@ }, "metadata": { "description": "pstack, poteto's engineering methodology for Cursor, ported to oh-my-pi. Model and provider agnostic.", - "version": "0.15.25" + "version": "0.15.30" }, "plugins": [ { "name": "pstack", - "description": "56 skills, 23 playbooks, 24 principles, the poteto-mode pin, and two agents. Upstream cursor/plugins pstack at e5136d8.", - "version": "0.15.25", + "description": "59 skills, 23 playbooks, 24 principles, the poteto-mode pin, and two agents. Upstream cursor/plugins pstack at eb4db2b.", + "version": "0.15.30", "category": "development", "license": "MIT", "source": "./plugins/pstack" diff --git a/README.md b/README.md index e016fcd..ffd614e 100644 --- a/README.md +++ b/README.md @@ -3,7 +3,7 @@ An omp marketplace carrying one plugin. `pstack` is Lauren Tan's engineering methodology for Cursor, ported to oh-my-pi and made -model and provider agnostic, 56 skills with 23 playbooks and 24 principle leaves. +model and provider agnostic, 59 skills with 23 playbooks and 24 principle leaves. Wide parallel runs are a `swarm` dispatch, not a separate plugin. ``` diff --git a/omp-port/UPSTREAM b/omp-port/UPSTREAM index f277c07..a5d6977 100644 --- a/omp-port/UPSTREAM +++ b/omp-port/UPSTREAM @@ -1 +1 @@ -e5136d82418d2db3165ea1050d17577cd618cc05 +eb4db2b55b2b7dec3d9282754cddf0a56bf4ff10 diff --git a/omp-port/patches/zzz-make-bot-ui-omp.patch b/omp-port/patches/zzz-make-bot-ui-omp.patch index c1551a2..fb627fc 100644 --- a/omp-port/patches/zzz-make-bot-ui-omp.patch +++ b/omp-port/patches/zzz-make-bot-ui-omp.patch @@ -2,12 +2,6 @@ diff --git a/skills/make-bot-ui/SKILL.md b/skills/make-bot-ui/SKILL.md index 285df75..1c71684 100644 --- a/skills/make-bot-ui/SKILL.md +++ b/skills/make-bot-ui/SKILL.md -@@ -1,4 +1,4 @@ - --- --name: Make Bot UI -+name: make-bot-ui - description: >- - Use when building a custom UI (page, dashboard, buttons) that should wake a @@ -9,4 +9,11 @@ disable-model-invocation: true # How to make a bot UI diff --git a/omp-port/rules.sed b/omp-port/rules.sed index cb3ed36..abc9e17 100644 --- a/omp-port/rules.sed +++ b/omp-port/rules.sed @@ -77,13 +77,13 @@ s#^\| Tooling \| `reflect tooling` \| `[^`]+` \| `references/tooling-reviewer\.m s#^\| Divergent \| `reflect judgment, divergent, synthesizer` \| `[^`]+` \| `references/divergent-reviewer\.md` \|$#| Divergent | discovered divergent agent | `references/divergent-reviewer.md` |# s#The synthesizer returns a structured Accepted / Rejected / Backlog list\.#Pass this explicit `outputSchema` when the live task schema exposes it:\n\n```json\n{"type":"object","required":["Accepted","Rejected","Backlog"],"properties":{"Accepted":{"type":"array","items":{"type":"object","required":["Problem","Proposal","Routing"],"properties":{"Problem":{"type":"string"},"Proposal":{"type":"string"},"Routing":{"type":"string"}}}},"Rejected":{"type":"array","items":{"type":"object","required":["Principle","Reason"],"properties":{"Principle":{"type":"string"},"Reason":{"type":"string"}}}},"Backlog":{"type":"array","items":{"type":"object","required":["Pattern","Hit","Mechanism"],"properties":{"Pattern":{"type":"string"},"Hit":{"type":"string"},"Mechanism":{"type":"string"}}}}}}\n```# # These model-map sentences must match raw upstream before slug and path token rewrites. -s#^Take the runners from the `architect runners` line in the `pstack-models\.mdc` rule, in place of the `arena runners` line\. If the rule or that line is missing, use `claude-opus-[^`]+`, `gpt-[^`]+`, `grok-[^`]+`\. Alias and rejected entries follow the runner rules in the \*\*arena\*\* skill's Phase A\.$#Use the same exact discovered runner agents as Arena, with the architect role in each brief. Each agent's frontmatter or `task.agentModelOverrides[]` selects its model; the task item has no `model` field.# -s#^3\. Pick the runners\. Use the `arena runners` line in `~/\.cursor/rules/pstack-models\.mdc`\. If the rule or that line is missing, default to one each on `claude-opus-[^`]+`, `gpt-[^`]+`, `grok-[^`]+`\. An `auto` or `inherit-parent` entry in this line or the cross-judge line means the parent model, so omit `model` for it\. If the Task tool rejects a configured entry, run that seat on its family's default and say so\. Families go by prefix: `claude-\*`, `gpt-\*`, and `grok-\*`\. With no family match, use `claude-opus-[^`]+`\. If it rejects a default, use the closest valid slug of the same family from its error message\.#3. Pick the runners. Resolve exact discovered agent names and inspect each agent's frontmatter or `task.agentModelOverrides[]`. Prefer distinct configured model families when the roster supplies them; otherwise keep the independent contexts and report weaker model diversity. A model override cannot create an agent.# -s#After all Phase B candidates complete, choose one model from the `arena cross-judge pool` line in `~/.cursor/rules/pstack-models\.mdc`\. If the rule or that line is missing, choose from `claude-opus-[^`]+`, `gpt-[^`]+`, `grok-[^`]+`\. Prefer a different model family from the parent's\.#After all Phase B candidates complete, choose an exact discovered judge agent whose configured model differs from the parent's when the roster provides one.# +s#^Take the runners from the `architect runners` line in the `pstack-models\.mdc` rule, in place of the `arena runners` line\. If the rule or that line is missing, use `claude-opus-[^`]+` and `grok-[^`]+`\. Alias and rejected entries follow the runner rules in the \*\*arena\*\* skill's Phase A\.$#Use the same exact discovered runner agents as Arena, with the architect role in each brief. Each agent's frontmatter or `task.agentModelOverrides[]` selects its model; the task item has no `model` field.# +s#^3\. Pick the runners\. Use the `arena runners` line in `~/\.cursor/rules/pstack-models\.mdc`\. If the rule or that line is missing, default to one each on `claude-opus-[^`]+` and `grok-[^`]+`\. An `auto` or `inherit-parent` entry in this line or the cross-judge line means the parent model, so omit `model` for it\. If the Task tool rejects a configured entry, run that seat on its family's default and say so\. Families go by prefix: `claude-\*`, and `grok-\*` with `cursor-grok-\*` and `composer-\*`\. A refused `composer-\*` entry runs on `grok-[^`]+`\. With no family match, use `claude-opus-[^`]+`\. If it rejects a default, use the closest valid slug of the same family from its error message\.#3. Pick the runners. Resolve exact discovered agent names and inspect each agent's frontmatter or `task.agentModelOverrides[]`. Prefer distinct configured model families when the roster supplies them; otherwise keep the independent contexts and report weaker model diversity. A model override cannot create an agent.# +s#After all Phase B candidates complete, choose one model from the `arena cross-judge pool` line in `~/.cursor/rules/pstack-models\.mdc`\. If the rule or that line is missing, choose from `claude-opus-[^`]+` and `grok-[^`]+`\. Prefer a different model family from the parent's\.#After all Phase B candidates complete, choose an exact discovered judge agent whose configured model differs from the parent's when the roster provides one.# # The judge is one task item, with posture in its brief rather than a task field. s#After all Phase B candidates complete, choose an exact discovered judge agent whose configured model differs from the parent's when the roster provides one\. Spawn one readonly judge subagent on that model\.#After all Phase B candidates complete, choose an exact discovered judge agent. Start the judge in one `task` call with one item in `tasks[]`, the required shared `context`, and that exact agent name. Its frontmatter or `task.agentModelOverrides[]` selects the model; the task item has no `model` field. The brief carries read-only posture, grants only the tools that discovered agent actually has, forbids writes, and has no task `readonly` field. Prefer a different configured model family when the operator's model policy and roster supply one; otherwise keep the exact agent and report weaker model diversity.# s#^- `model`: the configured `interrogate reviewers` entry, or the table default with no configured line\. For an `auto` or `inherit-parent` entry, omit `model` so that reviewer runs on the parent model\.$#- `agent`: an exact discovered reviewer agent name. Its frontmatter or `task.agentModelOverrides[]` selects the model; the task item has no `model` field# -s#If the Task tool rejects a configured entry, run that reviewer on the table default of its family and say so\. Families go by prefix: `claude-\*`, `gpt-\*`, and `grok-\*`\. With no family match, use Reviewer A's default\. If it rejects a table default, check the valid slugs in the Task tool's error message, pick the closest equivalent \(prefer the highest-reasoning tier of the same family\), spawn with it, and open a separate PR to update the default table\. Do not block the review on the slug issue\. Never treat an alias entry as a rejected slug or apply either fallback to it\.#If the requested exact reviewer is absent, use another discovered reviewer with the same brief and report the missing model diversity. A model override cannot create an agent.# +s#If the Task tool rejects a configured entry, run that reviewer on its family's table default and say so\. Families go by prefix: `claude-\*`, and `grok-\*` with `cursor-grok-\*` and `composer-\*`\. A refused `composer-\*` entry runs on Reviewer B's default\. With no family match, use Reviewer A's default\. If it rejects a table default, spawn with the closest equivalent from the valid slugs in its error message \(prefer the same family and reasoning tier\), and open a separate PR to update the default table\. Do not block the review on the slug issue\. Never treat an alias entry as a rejected slug or apply either fallback to it\.#If the requested exact reviewer is absent, use another discovered reviewer with the same brief and report the missing model diversity. A model override cannot create an agent.# s#^4\. Pick the worker model from the `swarm workers` line in `~/\.cursor/rules/pstack-models\.mdc`\. If the rule or that line is missing, use `grok-[^`]+`\. For `auto` or `inherit-parent`, omit `model` so the workers run on the parent model\. If the Task tool rejects a slug, use the default and say so\. If it rejects the default, use the closest valid slug of the same family from its error message\. For a model race, name each arm's model up front\.#4. Pick exact discovered agent names. Inspect each agent's frontmatter or `task.agentModelOverrides[]` for its model. A model race needs one loaded agent file and one exact override entry per arm; overrides cannot create agents.# # The Cursor wire fields, as tokens rather than as sentences. The sentence rules above carry the # meaning; this net is what keeps a Cursor field out of the tree when upstream rewords the @@ -163,8 +163,6 @@ s#Substituting `generalPurpose` skips that read and drifts\.#Substituting `task` # so an unpinned read of skill://poteto-mode or a spawned poteto-agent still finds it. s|^## Non-negotiables$|## Non-negotiables\n\n**Read `skill://omp-mechanics` and `skill://pstack-omp` right after this file.** `pstack-omp` is the sole live task, vibe, eval, and runtime contract. `omp-mechanics` keeps only pstack-specific OMP deltas.| s#Reads the `poteto-mode` skill's `SKILL.md` in full before any work, including its inline Principles index\.#Reads the `poteto-mode` skill's `SKILL.md` in full before any work, including its inline Principles index, then `skill://omp-mechanics`.# -# Cursor derives a mode skill's registry name from a display title; omp uses the slug. -s#name: Poteto Mode#name: poteto-mode# ## 4. Cloud agents. Cursor runs them on its own VMs; omp runs isolated subagents on this machine. @@ -369,12 +367,14 @@ s#Subagents inherit it\. Multiple `Task` calls on the same branch each get their # forgot: upstream added eighteen skills after it was written and every one of them shipped a bare # /name the gate could not accept. Adding a skill upstream now means adding its name to the # alternation, once. -s#`/(teach|recall|reflect|tdd|swarm|arena|interrogate|correct|setup-pstack|automate-me|figure-it-out|show-me-your-work|benchmark-checklist|blast-radius|ketchup|bro|make-bot-ui|poteto-help|no-comments|unslop|create-verification-skill|maintain-verification-skill|architect|why|how|technical-writing|sharpen|in-your-own-words|typescript-best-practices|poteto-mode|principle-[a-z-]+)`#`/skill:\1`#g +s#`/(teach|recall|reflect|tdd|swarm|arena|interrogate|correct|setup-pstack|automate-me|figure-it-out|show-me-your-work|benchmark-checklist|blast-radius|ketchup|bro|make-bot-ui|poteto-help|no-comments|unslop|create-verification-skill|maintain-verification-skill|create-formal-verification-skill|maintain-formal-verification-skill|statechart|architect|why|how|technical-writing|sharpen|in-your-own-words|typescript-best-practices|poteto-mode|principle-[a-z-]+)`#`/skill:\1`#g # One verdict vocabulary. pstack-omp and swarm both name PASS/ISSUES/BLOCKED; shipping named a # different three, and its landing rule tested for a different set, so a verifier told by one file # and checked by another could not satisfy both. -s#Each returns `PASS`, `PASS\+NOTES` or `FAIL` and posts that verdict on its own PR\.#Each returns `PASS`, `ISSUES` or `BLOCKED`, the three verdicts `skill://pstack-omp` and **swarm** use, and posts that verdict on its own PR. Notes ride on a `PASS` rather than forming a fourth verdict, so a passing run with observations is still a pass.# -s#stop at the first one without a passing verdict, where both `PASS` and `PASS\+NOTES` pass\.#stop at the first one whose verdict is not `PASS`.# +s#posts `PASS`, `PASS\+NOTES`, or `FAIL` on that PR\.#posts `PASS`, `ISSUES`, or `BLOCKED`, the three verdicts `skill://pstack-omp` and **swarm** use, on that PR. Notes ride on a `PASS` rather than forming a fourth verdict, so a passing run with observations is still a pass.# +s#stop at the first one without `PASS` or `PASS\+NOTES`\.#stop at the first one whose verdict is not `PASS`.# +# Cursor's help names another harness's install commands and an adapter the port does not ship. +s#^pstack is built for Cursor, and it also installs in Claude Code with .*a one-line note\.$#pstack installs in omp with `/marketplace add negoro26/pstack-omp`, then `/marketplace install pstack@pstack-omp`. Invoke skills as `/skill:`, such as `/skill:poteto-mode`. Read `skill://pstack-omp` for the live task and runtime contract and `skill://omp-mechanics` for pstack-specific OMP differences.# ## 10. Irreversible actions, and what the runtime actually enforces. Every replacement below ## exists because the original either contradicted another sentence in the same tree, named a @@ -471,6 +471,7 @@ s#Use for /swarm,#Use for /skill:swarm,# s#Use for /architect,#Use for /skill:architect,# s#Use for /figure-it-out,#Use for /skill:figure-it-out,# s#Use for /show-me-your-work,#Use for /skill:show-me-your-work,# +s#Use for /(create-formal-verification-skill|maintain-formal-verification-skill|statechart),#Use for /skill:\1,# s#"/architect with checkpoint,"#"/skill:architect with checkpoint,"# # `cursor location` is a Cursor composer affordance: the editor injects the caret position. omp is diff --git a/omp-port/stale-exempt.tsv b/omp-port/stale-exempt.tsv index 21546f0..f736bef 100644 --- a/omp-port/stale-exempt.tsv +++ b/omp-port/stale-exempt.tsv @@ -36,12 +36,8 @@ The synthesizer's quality check includes spot-verifying ci superseded: upstream there is no task `readonly` field\. Use forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. there is no task `readonly` field\.[[:space:]]*$ forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. The synthesizer returns a structured Accepted / Rejected / superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. -^Take the runners from the `architect runners` line in the forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. -^3\. Pick the runners\. Use the `arena runners` line in `~ forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. -After all Phase B candidates complete, choose one model fr forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. After all Phase B candidates complete, choose an exact dis forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. ^- `model`: the configured `interrogate reviewers` entry, forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. -If the Task tool rejects a configured entry, run that revi forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. `subagent_type`: `([^`]+)` forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. `subagent_type`: `([^`]+)` forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. agent mode \(`readonly: false`\) forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. @@ -58,6 +54,8 @@ One subagent per PR, not batched, each a Cursor cloud agen superseded: upstream `(claude|gpt|grok|gemini|opus)-[a-z0-9.]+-[a-z0-9.-]+` forward-compat net: the left side is a Cursor wire token or path that upstream does not emit today. The rule earns its place by not firing, because it is the only thing standing between that text and a Cursor API in the tree. One Cursor cloud agent superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. Cloud-agent PR tools default to draft, so set `draft: fals superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. +Fan out N parallel cloud workers\. upstream removed Swarm's standalone overview at eb4db2b; retain the cloud-worker translation if that sentence returns. +N is total workers, not the cloud concurrency limit\. upstream removed Swarm's Set N step at eb4db2b; retain the omp concurrency setting if that step returns. Restacks run in cloud\. A local restack at this scale take superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. Cloud agents cannot read the local store, so their briefs superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. A local root arms each tick as a real terminal `/loop`\. T superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. @@ -88,8 +86,6 @@ Re-read the execution playbook from trunk and the armed /g superseded: upstream - `Task` prompts that name a skill path superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. Tool calls \(Shell, Grep, MCP, etc\.\) superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. Use Glob to find directories and files, Grep to find key s superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. -Each returns `PASS`, `PASS\+NOTES` or `FAIL` and posts tha superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. -stop at the first one without a passing verdict, where bot superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. If the bottom PR is mergeable now, squash it with superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. push with `--force-with-lease` only after an `ls-remote` c superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. 4\. \*\*Prepare only the bottom PR\.\*\* Fetch current tru superseded: upstream reworded this sentence and a different rule now covers the current phrasing. Kept because the reword is cheap for upstream to undo. diff --git a/plugins/pstack/README.md b/plugins/pstack/README.md index 1ae5f40..bd934dd 100644 --- a/plugins/pstack/README.md +++ b/plugins/pstack/README.md @@ -1,8 +1,8 @@ # pstack for oh-my-pi -Lauren Tan's pstack methodology, ported to omp. 56 skills, 23 playbooks, 24 principle +Lauren Tan's pstack methodology, ported to omp. 59 skills, 23 playbooks, 24 principle leaves, the `poteto-mode` pin, and the `poteto-agent` and `comment-sicko` agents. -53 skills are built from upstream. `omp-mechanics`, `pstack-omp`, and `setup-pstack` are port-owned. +56 skills are built from upstream. `omp-mechanics`, `pstack-omp`, and `setup-pstack` are port-owned. ## Install @@ -11,7 +11,7 @@ leaves, the `poteto-mode` pin, and the `poteto-agent` and `comment-sicko` agents /marketplace install pstack@pstack-omp ``` -That loads the 56 skills and both extensions, `potetomode` and `pstackpolicy`. The two agents are optional. +That loads the 59 skills and both extensions, `potetomode` and `pstackpolicy`. The two agents are optional. On omp 18.1.13 a marketplace plugin's `agents/` directory is scanned only through the `claude-plugins` discovery provider, and enabling that provider also loads every Claude Code plugin cached under `~/.claude/plugins`. Link the agents into omp's native root instead: diff --git a/plugins/pstack/package.json b/plugins/pstack/package.json index 515fb5a..465cf41 100644 --- a/plugins/pstack/package.json +++ b/plugins/pstack/package.json @@ -1,6 +1,6 @@ { "name": "pstack", - "version": "0.15.25", + "version": "0.15.30", "license": "MIT", "omp": { "extensions": [ diff --git a/plugins/pstack/plugin.json b/plugins/pstack/plugin.json index 199469f..4c39185 100644 --- a/plugins/pstack/plugin.json +++ b/plugins/pstack/plugin.json @@ -1,7 +1,7 @@ { "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json", "name": "pstack", - "version": "0.15.25", + "version": "0.15.30", "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.", "author": { "name": "Lauren Tan" diff --git a/plugins/pstack/skills/architect/SKILL.md b/plugins/pstack/skills/architect/SKILL.md index b02c108..fd95ff9 100644 --- a/plugins/pstack/skills/architect/SKILL.md +++ b/plugins/pstack/skills/architect/SKILL.md @@ -28,7 +28,7 @@ Skip Phase A only when the work is genuinely greenfield with no surrounding syst Run the **arena** skill with the design-sketch task and the Phase A grounding artifacts. Pass `references/runner-prompt.md` as each runner's prompt. -Take the runners from the exact discovered runner agents.. If the rule or that line is missing, use your strongest judgment model and your fast code model. Alias and rejected entries follow the runner rules in the **arena** skill's Phase A. +Use the same exact discovered runner agents as Arena, with the architect role in each brief. Each agent's frontmatter or `task.agentModelOverrides[]` selects its model; the task item has no `model` field. Design it twice. Require at least two structurally distinct candidates before synthesis, even when the first looks sufficient. This is the **exhaust-the-design-space** principle skill made concrete. Whole-shape alternatives, not point fixes inside one shape. diff --git a/plugins/pstack/skills/arena/SKILL.md b/plugins/pstack/skills/arena/SKILL.md index 6f7707e..53a9aa2 100644 --- a/plugins/pstack/skills/arena/SKILL.md +++ b/plugins/pstack/skills/arena/SKILL.md @@ -14,7 +14,7 @@ Every candidate gets the same prompt, so the prompt is the contract. 1. State the artifact each candidate is producing. 2. Derive the rubric, 3-6 concrete gradeable criteria for what success looks like on *this* task. It is the picker's tool in Phase D. Candidates only see the task. -3. Pick the runners. Use the exact discovered runner agents in `~/.omp/agent/config.yml`. If the rule or that line is missing, default to one each on your strongest judgment model and your fast code model. An `auto` or `inherit-parent` entry in this line or the cross-judge line means the parent model, so omit `model` for it. If the Task tool rejects a configured entry, run that seat on its family's default and say so. Families go by prefix: `claude-*`, and `grok-*` with `cursor-grok-*` and `composer-*`. A refused `composer-*` entry runs on your fast code model. With no family match, use your strongest judgment model. If it rejects a default, use the closest valid slug of the same family from its error message. Spawn more runners when the arena covers multiple design directions. Use the same model N times when the work is generation-bound rather than judgment-sensitive. Pick each subagent's reasoning level and fast or standard speed for the job, per the Subagents section of the **poteto-mode** skill. +3. Pick the runners. Resolve exact discovered agent names and inspect each agent's frontmatter or `task.agentModelOverrides[]`. Prefer distinct configured model families when the roster supplies them; otherwise keep the independent contexts and report weaker model diversity. A model override cannot create an agent. Spawn more runners when the arena covers multiple design directions. Use the same model N times when the work is generation-bound rather than judgment-sensitive. Pick each subagent's reasoning level and fast or standard speed for the job, per the Subagents section of the **poteto-mode** skill. 4. Give each candidate its own output location (a git worktree where possible, otherwise `/tmp/arena-/candidate-/`), per the **separate-before-serializing-shared-state** principle skill. ## Phase B: Fan out @@ -25,7 +25,7 @@ If a candidate produces no output, proceed with N-1 and note the dropout. ## Phase C: Cross-judge -After all Phase B candidates complete, choose one model from an exact discovered judge agent whose configured model differs from the parent's when the roster provides one, in `~/.omp/agent/config.yml`. If the rule or that line is missing, choose from your strongest judgment model and your fast code model. Prefer a different model family from the parent's. Start one judge in one `task` call with one item in `tasks[]`, the required shared `context`, and a brief that grants read tools only. It sees the rubric and the candidates by path label, scores each criterion, and recommends a base with rationale. It runs in parallel with your reading in Phase D. Don't spawn it while candidates are still writing. +After all Phase B candidates complete, choose an exact discovered judge agent. Start the judge in one `task` call with one item in `tasks[]`, the required shared `context`, and that exact agent name. Its frontmatter or `task.agentModelOverrides[]` selects the model; the task item has no `model` field. The brief carries read-only posture, grants only the tools that discovered agent actually has, forbids writes, and has no task `readonly` field. Prefer a different configured model family when the operator's model policy and roster supply one; otherwise keep the exact agent and report weaker model diversity. It sees the rubric and the candidates by path label, scores each criterion, and recommends a base with rationale. It runs in parallel with your reading in Phase D. Don't spawn it while candidates are still writing. ## Phase D: Pick a base diff --git a/plugins/pstack/skills/create-formal-verification-skill/SKILL.md b/plugins/pstack/skills/create-formal-verification-skill/SKILL.md new file mode 100644 index 0000000..17aae2e --- /dev/null +++ b/plugins/pstack/skills/create-formal-verification-skill/SKILL.md @@ -0,0 +1,41 @@ +--- +name: create-formal-verification-skill +description: "Generate a project-local skill that formally verifies the code where a bug costs the most and tests reach the least, in any language, with whichever verification tool fits. Use for /skill:create-formal-verification-skill, \"model-check this race\", \"prove this invariant\", or when concurrency, retries, state machines, parsers, or unsafe code need more than tests." +disable-model-invocation: true +--- + +# Create a formal verification skill + +A test checks the cases that someone thought to write. Formal verification checks every case in a stated scope: every order of steps in a model, every input up to a bound, or every input. This skill finds the part of the repo where that matters most, verifies one property of it, and leaves a project-local skill that lets the next agent check a change against that property. Write that skill for an agent who reads it cold, mid-change, and has never seen your work. The user must be able to trust the result and act on it without learning the verification language. + +## Choose the target from the code + +Answer from the codebase, and ask the user only what you cannot observe. If the user named an area or a bug, start there. + +A good target is a promise the code makes, where a break harms users and tests rarely reach the case that breaks it. Choose the strongest such target in the repo, not the one that is easiest to verify. + +## Let the question choose the tool + +Pick the tool that answers the question at the lowest cost: a model checker, a proof assistant, an SMT-backed verifier, or another tool. Whether events can happen in a bad order usually suits a model checker over a small model of the design, and TLA+ is the default for that in any language. Whether the code itself behaves for every input, as with memory safety, overflow, or a data-structure invariant, usually suits a verifier that runs on the code. If no verifier runs on this language, say so, and test the real code with generated inputs, not a hand model of the function. A property that must hold at every size, where a bound is not enough, can need a proof. Prefer a tool that the repo's developers can install and run, and tell the user why you chose it. + +## What makes it good + +- **True to the code.** Every part of the model or proof points to code that a reviewer can open. What the verification treats as one indivisible step is one indivisible step in the code. Names come from this repo. +- **Able to fail.** A check that you have never seen fail proves nothing. Show each property failing on a broken variant of the code it guards, such as a removed check or a reordered step. +- **Findings stay findings.** When the current code breaks the property, report it with the counterexample in the code's terms. Do not weaken the property or the model until it passes, and do not change product code unless the user asks. +- **Honest about scope.** Say what is verified, under which bounds and assumptions, and what is left out. A pass covers the model or the bound, not the whole system. +- **Readable without the tool.** State the property and the harm in one plain sentence each. Tell a counterexample as a short sequence of steps in the code's words. +- **Cheap to rerun.** One command, a reproducible tool version, and a run short enough that the next agent will use it on every relevant change. +- **Kept in step with the code.** Record which files and functions each check covers, and the commit at which you last confirmed that the verification describes them. When the covered code changes after that commit, the next agent can see that the verification needs another look. + +## Generate the verify skill + +Write a project-local skill with frontmatter that names the area and says when to use it. Without frontmatter, the skill never registers. From the skill alone, the next agent must be able to tell whether a change touches the verified code, run the check, tell a real bug from a modeling error, and update the verification when a change is intended. Put the coverage record and the sync commit in the skill, and tell the next agent to move the sync commit forward only after it confirms that the verification describes the code at the new commit. Use this repo's real commands, paths, and nouns, and leave no placeholders. + +## Prove it before you hand off + +Follow the generated skill once, as the next agent would, on a scratch change that breaks the property in the real code. It must catch the break. Then drop the scratch change and confirm that the check is back where it started: passing, or failing only on the findings you will report. A verify skill that was never run is a draft. If the skill misses the break or a step does not run, fix the skill or the verification, not the scratch change. + +## Hand off + +Tell the user what you verified, which tool you used and why, the bounds, what the check found in plain words, how to run it, and what it does not cover. Suggest a second target only if you found a close one. Point the user at `/skill:maintain-formal-verification-skill` for bringing the verification back in line after changes that did not recheck it. diff --git a/plugins/pstack/skills/interrogate/SKILL.md b/plugins/pstack/skills/interrogate/SKILL.md index a84d008..ac1cb54 100644 --- a/plugins/pstack/skills/interrogate/SKILL.md +++ b/plugins/pstack/skills/interrogate/SKILL.md @@ -33,7 +33,7 @@ Launch all reviewers in a single message with the Task tool, one per configured Each reviewer gets `agent: generalPurpose`, read-only posture carried in the brief, and `model` set to its configured entry, or its table default when there is no configured line. Omit `model` for an `auto` or `inherit-parent` entry, so that reviewer runs on the parent model. -If the Task tool rejects a configured entry, run that reviewer on its family's table default and say so. Families go by prefix: `claude-*`, and `grok-*` with `cursor-grok-*` and `composer-*`. A refused `composer-*` entry runs on Reviewer B's default. With no family match, use Reviewer A's default. If it rejects a table default, spawn with the closest equivalent from the valid slugs in its error message (prefer the same family and reasoning tier), and open a separate PR to update the default table. Do not block the review on the slug issue. Never treat an alias entry as a rejected slug or apply either fallback to it. +If the requested exact reviewer is absent, use another discovered reviewer with the same brief and report the missing model diversity. A model override cannot create an agent. Read `references/reviewer-prompt.md` and fill in the same template for every reviewer with the stated intent, the diff or file contents, the rubric from `references/rubric.md`, and the code-quality lens from `references/code-quality-review.md`. Pick each subagent's reasoning level and fast or standard speed for the job, per the Subagents section of the **poteto-mode** skill. diff --git a/plugins/pstack/skills/interrogate/references/lead-judgment.md b/plugins/pstack/skills/interrogate/references/lead-judgment.md index 5ce5260..3b41346 100644 --- a/plugins/pstack/skills/interrogate/references/lead-judgment.md +++ b/plugins/pstack/skills/interrogate/references/lead-judgment.md @@ -1,18 +1,5 @@ # Lead Judgment Framework -You are the lead reviewer. The configured reviewers have produced their findings. Apply pragmatic engineering judgment. Don't aggregate. Filter, contextualize, and decide. - -## Why This Step Matters - -Adversarial reviewers are useful because they're aggressive. But aggression without context produces noise. The reviewers only saw a slice of the codebase and a one-paragraph intent statement. They don't know: - -- What was already tried and rejected -- What constraints exist outside the code (timeline, dependencies, migration plans) -- Which parts of the code are temporary scaffolding vs. permanent architecture -- What the next PR in the stack will address - -You have the full conversation context. Use it. - ## Filtering Principles ### Nitpick Gravity @@ -50,9 +37,3 @@ Don't dismiss findings just because they're uncomfortable. The whole point of ad - You read the finding and think "...yeah, actually" Be especially careful about dismissing security findings and correctness bugs. These deserve more scrutiny even when they come from a single model. - -## Verdict Calibration - -A good verdict is useful, not comprehensive. The user should be able to read the "Act On" section, fix those issues, and ship with confidence. If your "Act On" list has more than 5 items, you're probably not filtering hard enough. - -The "Dismissed" section is not busywork. It's a trust mechanism. Showing the user what you rejected and why lets them override your judgment where they disagree. This is more valuable than hiding the rejected findings. diff --git a/plugins/pstack/skills/ketchup/SKILL.md b/plugins/pstack/skills/ketchup/SKILL.md index f4f407a..41fc192 100644 --- a/plugins/pstack/skills/ketchup/SKILL.md +++ b/plugins/pstack/skills/ketchup/SKILL.md @@ -1,12 +1,12 @@ --- name: ketchup -description: "Catch the user up on what changed in this chat since their last message, in a few plain sentences and small visuals. Give each action item just enough context to make the call. Use for /ketchup." +description: "Catch the user up on what changed in this chat since their last message, in plain words and small visuals. List every item waiting on them with what they need to decide it from the reply alone. Use for /ketchup." disable-model-invocation: true --- # Ketchup -Catch the user up on what changed in this chat since the last message they wrote before `/skill:ketchup`, and help them understand each change, not only where it stands. Notifications and subagent results are not their messages. Assume the user remembers their last message and nothing after it. +Catch the user up on what changed in this chat since the last message they wrote before `/skill:ketchup`, and help them understand each change, not only where it stands. Then lay out every call waiting on them so they can make it from your reply alone. Notifications and subagent results are not their messages. Assume the user remembers their last message and nothing after it. Use [`/skill:bro`](../bro/SKILL.md)'s voice, not its task: plain words, short sentences, no jargon, like one person catching up another. Say what changed for the user, not how you did it. Say "the tests pass", not "CI is green". Leave out hashes, file paths, commands, build numbers, and test counts unless the user needs one to act. Call each PR, branch, or agent by a name the user would know, not by a label you invented. If a fact needs context to make sense, give the context or leave the fact out. @@ -14,24 +14,30 @@ Use [`/skill:bro`](../bro/SKILL.md)'s voice, not its task: plain words, short se Keep this turn read-only. Make visuals only from what you already have: do not change code, start an app or a job, or post anything. Collect your own work since that message, reports from subagents, and messages from anyone else in this chat. Check the current state of each PR, CI run, or agent this chat touched. Check each number you will show against the facts it comes from, and say so when you correct one. -An action item is a decision or step only the user can take, such as a product choice, an approval, an irreversible action, or access you lack. Include any still waiting on the user, even one raised before their last message. Work you can still do yourself is not an action item. Never make up a call to fill the reply. A step the user did not ask for and the work does not need is not an action item, unless it is irreversible and waiting on the user: give it one action line, no visual, and skip what happens if the user does not answer. +An action item is a call or step only the user can take, such as a product choice, an approval, an irreversible action, or access you lack. Include any still waiting on the user, even one raised before their last message. Work you can still do yourself is not an action item. Never make up a call to fill the reply. A step the user did not ask for and the work does not need is not an action item, unless it is irreversible and waiting on the user: give it one line and no visual. + +One call can cover many items, such as each PR in a set awaiting merge. For each item, collect its link, what it changes for users, the evidence behind your pick, its risk, and your pick. Write "unknown" for a fact the call needs that you do not know. Leave out a link you do not have. ## Write the reply -Keep the whole reply well under 150 words, not counting visuals. When something is easier to grasp as a picture than as sentences, draw it: how a design or system works, a PR stack or dependency chain with each PR's state, a before and after of a fix, or options side by side. Never draw a status list or boxes with nothing connecting them. Never give a fact twice, in text or across visuals. Leave out work that changed nothing for the user. When words run short, cut from what happened before you cut from the action items. +Spend words on the calls, not on the story. Keep what happened under 100 words, not counting pictures, and shorter when less happened. Leave out work that changed nothing for the user. Give each item about 30 words. The reply grows with the number of items: two items need well under 150 words in all, not counting pictures, and thirty need far more. Never cut items or shrink them to stay under a word count: no count in place of a list, and no link in place of an item. A link can add depth, but the reply alone must be enough to decide. -Open with one sentence that says how many things need the user, or that nothing does. If nothing happened and nothing waits on the user, say so and stop. +Open with one short sentence that names what waits on the user, or says nothing does. The action items give the detail. If nothing happened and nothing waits on the user, say so and stop. Then show what happened, pictures first. Embed inline the screenshots and videos the work produced, then any diagram that explains a change. Then sum up in one short bullet per thing the user asked for: what came of it, and whether it is done, still running, failed, or not checked. Write each line the way you would say it out loud: "Search was slow from a missing index", not "Search review: done" or "Slow search: missing index". Name any bug found and fixed on the way. Each line must stay true when read alone. Never mark something done that still waits on the user, and leave out anything the action items say. Under the summary, give at most three short lines that change what the user knows or must do. Then name in one line any work left that you can do yourself. -Then list the action items as plain bullets, never as a diagram or box. Give each two lines, or one for an unasked irreversible step: the decision with your recommendation and why, then what happens if the user does not answer. Ask the call the user owns, such as merge, approve, or pick. A step you would take first goes in your recommendation. So does anything that must happen first, and anything that cannot be undone. Write "unknown" for a part you do not know. Link to the detail. +Then list the action items. Ask the call the user owns, such as merge, approve, or pick, and give your pick. A step you would take first goes in your pick. So does anything that must happen first, and anything that cannot be undone. Give the number or link of each PR, issue, or agent a call is about, also in a call between options. + +Fit the shape to the call. A call about one item is one bullet: the call, your pick, what it changes for users, the evidence behind your pick, and its risk, with the item named once. When items share a call, write the call and your pick once, then give each item its own bullet, riskiest first: its link and name, what it changes for users, the evidence behind your pick, and its risk. Name an item's pick only where it differs from the call's. Give each item's risk even when it is low, such as "Low risk: only the colors change." Say what waiting costs only when it is more than a delay, such as a deadline or lost data. -Show a choice after the list. If the screenshots above already show its options, write each option's gain and cost under its screenshot instead of drawing a new visual; otherwise, compare the options side by side, with the current state when there is one. Give every option the work weighed, each with what it gets the user and what it costs. Keep them out of the rest of the text. +For a call between options, give every option the work weighed, each with what it gets the user and what it costs, and the current state when there is one. Those costs are the call's risk, so add no separate risk line. When the screenshots above show the options, write each option's gain and cost under its screenshot. ## Visuals A visual is a picture: a screenshot, a video, a Mermaid diagram, a chart or diagram from `/visualize`, or a generated image. A Markdown table is not a visual, even with before and after columns. +When something is easier to grasp as a picture than as sentences, draw it: how a design or system works, a PR stack or dependency chain with each PR's state, a before and after of a fix, or options side by side. Never draw a status list, a list of action items, or boxes with nothing connecting them. Never give a fact twice, in text or across visuals. + Keep each visual small enough to read at a glance: at most six boxes, with at most eight words in each. Write labels as plain words a person would say, not tags like "Tests: pass". A fact that needs a sentence belongs in the text, or nowhere. Embed screenshots and videos inline when the change is visible, not only as links. If a visible change has none, mark its summary line "No screenshot yet," and say there what changed on screen. Draw diagrams and charts from facts you have: a Mermaid diagram for how things connect and a `/visualize` chart for numbers. Never invent a number, and never draw or generate a picture of a screen you did not capture. Link only artifacts that exist. diff --git a/plugins/pstack/skills/maintain-formal-verification-skill/SKILL.md b/plugins/pstack/skills/maintain-formal-verification-skill/SKILL.md new file mode 100644 index 0000000..8fb5e05 --- /dev/null +++ b/plugins/pstack/skills/maintain-formal-verification-skill/SKILL.md @@ -0,0 +1,58 @@ +--- +name: maintain-formal-verification-skill +description: "Bring a project's formal verification back in line with the code after the code changes: find the commits that touched verified code, update the model, harness, or properties to describe the code as it is now, rerun, and say whether each failure is drift in the verification or a bug in the code. Use for /skill:maintain-formal-verification-skill, \"is the model still true to the code\", or after merges and refactors that touched verified code without rechecking it." +disable-model-invocation: true +--- + +# Maintain a formal verification skill + +A formal check proves a property of what it describes. When the code changes and the verification does not, the check can keep passing while it describes code that no longer exists. That pass is the dangerous case, because it looks like a proof. This skill is the upkeep loop for a verify skill that `/skill:create-formal-verification-skill` generated, or for any project-local skill that runs a model checker, prover, or code-level verifier against named code. The project-local skill handles a change that an agent makes while it uses that skill. This skill handles the changes that skipped it: merges, edits made without the skill, and drift that builds up across many commits. + +## Outcomes + +Give each check one outcome, and say which: + +- **in sync**: no change since the last sync alters what the check describes, and the check passes. +- **updated**: the code changed, the verification now describes the new code, and the check passes. +- **bug**: the verification describes the current code, and the code breaks the property. This is a finding about the code. It is not drift. +- **blocked**: the check could not be brought back in line or could not run. Say exactly why. + +A check can be both updated and bug: the update makes the verification describe the code again, and then the property fails on it. + +## Edit scope + +Edit only the verification: models, harnesses, property files, and the verify skill itself. Never edit product code during a run, unless the user asks you to. When a property fails on the current code, do not weaken the property or the model to make it pass. Report the failure. + +## Pass + +1. **Find the checks.** A verify skill has no fixed name, so find it by what it does: a project skill that runs a model checker, a prover, or another verifier against named code. Read each one you find, or the one the user named. For each check, collect the property, the code it covers, the bounds and assumptions, the command that runs it, and the commit where it was last confirmed to describe the code. If no verify skill exists, stop and point at `/skill:create-formal-verification-skill`. If the skill does not record a sync commit, use the last commit that changed the verification files, and say that you did. + +2. **Run it as it is.** Run each check once before you change anything, and record the result. A pass here does not tell you that the code is correct. It tells you that the old description still holds. A failure here can be drift or a bug. Do not decide which until step 5. + +3. **Read every change to covered code.** Diff the covered files from the sync commit to the current commit, and read each commit message. Also look for code that moved: a covered function that is renamed, split, or moved to another file is still covered code. Also look for new code that touches the state that a check guards, such as a new function that writes the same fields. For each change, decide which of these it is: + - **No effect.** The change does not alter anything the verification describes, such as formatting, comments, or code paths that the verification does not cover. Check this against the model or harness, not against the commit message. + - **The verification no longer describes the code.** A step that was one indivisible action is now two, a branch was added or removed, a check moved, a new path reaches the guarded state, or a value now has a different range. The model or harness must change. + - **The promise changed on purpose.** The change alters what the code promises, and evidence in the change says that this is intended: the doc comment, the tests, the changelog, or the commit message. The property must change, and you must cite that evidence. + - **The promise may be broken.** The code changed, and no evidence says that the promise changed. Treat a failure that follows as a bug candidate. + +4. **Update from the code, not from the result.** Change the model or harness so that each changed part again points to code that a reviewer can open, and keep one indivisible step in the code as one step in the verification. Write the update from the code before you rerun, and do not shape it by what makes the check pass. Change a property only for a promise that changed on purpose. Write down the old wording, the new wording, and the evidence. Keep the bounds unless the change makes them wrong. If you must reduce a bound, say so in the report. + +5. **Rerun and judge each result.** + - **Pass:** the check can now pass on a description that has lost the ability to fail. Break the new code the way the property guards against, such as removing a new check or reordering a new step, and confirm that the check catches it. Then drop the break. + - **Fail:** replay the counterexample against the real code, step by step. If a step cannot happen in the code, the verification is wrong. Fix the verification, and say what was wrong. If every step can happen, it is a bug. Name the commit that introduced it, tell the counterexample as a sequence of steps in the code's own words, and state the harm in one sentence. If a cheap test or reproduction against the real code shows the bug, add it to the report as evidence. Do not commit it to the product code. + +6. **Update the verify skill.** Update the code that each check covers, the commands, the bounds, the assumptions, and the sync commit. Set the sync commit to the commit that you checked. Do not move the sync commit for a blocked check, and say so in the report. Then follow the verify skill once as the next agent would, so that you know its steps still run. + +## Report + +Tell the user, for each check: + +- the outcome, and the commits that you read; +- what changed in the verification and why, with a short reason for each change: the code changed shape, or the promise changed on purpose (with the evidence); +- the rerun result, and the break that you used to show the updated check can still fail; +- each bug, in plain words: the counterexample as steps in the code's words, the harm, and the commit that introduced it; +- what the verification still does not cover, including new code that it should cover and does not. + +Say outright which failures were drift in the verification and which were bugs in the code. For a check that passed before you updated it and fails after, say that the old pass was on a stale description. + +Put the verification updates in a change of their own, separate from any product fix. diff --git a/plugins/pstack/skills/poteto-help/SKILL.md b/plugins/pstack/skills/poteto-help/SKILL.md index a832b0a..8844afa 100644 --- a/plugins/pstack/skills/poteto-help/SKILL.md +++ b/plugins/pstack/skills/poteto-help/SKILL.md @@ -26,6 +26,7 @@ Check the state that changes the answer, and mention it only when it does: - No `task.agentModelOverrides` in `~/.omp/agent/config.yml` means `/skill:setup-pstack` hasn't run for this user, so every role uses its default model. - No `verify-*` skill or other app harness in the project means agents have no scripted way to drive the app. Mention `/skill:create-verification-skill` when the question is about proving a change works. +- No formal verification skill in the project means no property is checked past what tests reach. Mention `/skill:create-formal-verification-skill` when the question is about a race, an invariant, or another case tests rarely hit. When one exists and the code it covers changed after the commit it records as last in sync, mention `/skill:maintain-formal-verification-skill` if the question touches that code. When the model rule is missing and it matters, ask whether the user wants to pick a model for each role and a reasoning budget now. It matters when the user is new, the question is about setup or cost, or the answer depends on which models run. Ask at most once per chat. If the need is also unclear, ask both questions together. Offer two choices: @@ -35,14 +36,16 @@ When the model rule is missing and it matters, ask whether the user wants to pic ## Get set up 1. Install with `/add-plugin pstack` in chat, or from Customize in the sidebar. -2. Run [`/skill:setup-pstack`](../setup-pstack/SKILL.md). It asks for a reasoning budget, maps a model to each role, and writes a rule. The rule applies to new chats. +2. Run [`/skill:setup-pstack`](../setup-pstack/SKILL.md). It asks for a reasoning budget, maps a model to each role, and writes a rule. The rule applies to new chats. Then it offers once each to generate a verification skill and a formal verification skill for the project, unless the project already has one. 3. Start a real task with `/skill:poteto-mode`, a goal, and a check that can pass or fail. Installing changes nothing until the user invokes a skill. Only `/skill:setup-pstack` loads from the user's words. The [README](../../README.md) and [guide page 1](../../docs/guide/01-setup.md) have the details. Offer to word their first prompt with them, per [`references/prompting.md`](references/prompting.md). If cost is the worry, say where the tokens go and how to spend fewer. pstack spends extra tokens on subagents and review panels. Rerun `/skill:setup-pstack` and pick a smaller budget or cheaper models. A role set to `auto` or `inherit-parent` runs on the chat's model, which saves tokens when the chat runs on Auto or a cheaper model. A shorter panel list runs fewer subagents, one for each entry. Save `/skill:poteto-mode` for work that needs rigor. -pstack is built for Cursor. Its skills use the Agent Skills format, so other tools can read them. But most workflow skills, including `/skill:poteto-mode`, `/skill:how`, `/skill:why`, and `/skill:teach`, spawn Cursor subagents with per-role models, and Custom Modes and `/loop` are Cursor features, so those parts may not work there. +pstack installs in omp with `/marketplace add negoro26/pstack-omp`, then `/marketplace install pstack@pstack-omp`. Invoke skills as `/skill:`, such as `/skill:poteto-mode`. Read `skill://pstack-omp` for the live task and runtime contract and `skill://omp-mechanics` for pstack-specific OMP differences. + +Other tools can read the skills, because they use the Agent Skills format. But most workflow skills, including `/skill:poteto-mode`, `/skill:how`, `/skill:why`, and `/skill:teach`, spawn Cursor subagents with per-role models, and Custom Modes and `/loop` are Cursor features, so those parts may not work there. ## Start a task with `/skill:poteto-mode` @@ -64,12 +67,12 @@ The default answer is `/skill:poteto-mode`, which runs most of the others when i |---|---| | Do any non-trivial task with rigor | [`/skill:poteto-mode`](../poteto-mode/SKILL.md) | | Check that the agent understood their goal and the problem before it starts | [`/skill:in-your-own-words`](../in-your-own-words/SKILL.md) | -| Aim a task higher before starting: more expert, more outcome-focused, not overspecified | [`/skill:sharpen`](../sharpen/SKILL.md) | +| Get a prompt rewritten deeper, not bigger, before sending it: what a top professional would add, their raw material and methods, and an outside check. It returns the prompt and doesn't do the task | [`/skill:sharpen`](../sharpen/SKILL.md) | | Know how code works now, or where new code should live | [`/skill:how`](../how/SKILL.md) | | Know why code is shaped this way, or where a number came from | [`/skill:why`](../why/SKILL.md) | | Understand a change or subsystem, explained plainly | [`/skill:teach`](../teach/SKILL.md) | | Catch up on their own recent work on a topic | [`/skill:recall`](../recall/SKILL.md) | -| Catch up on what changed in this chat since their last message, in a few plain sentences and small visuals, with enough context to decide each action item | [`/skill:ketchup`](../ketchup/SKILL.md) | +| Catch up on what changed in this chat since their last message, in plain words and small visuals, with every item waiting on them listed and decidable from the reply alone | [`/skill:ketchup`](../ketchup/SKILL.md) | | Know what a small diff could break outside itself | [`/skill:blast-radius`](../blast-radius/SKILL.md) | | Settle types and module shape before code that crosses a function boundary | [`/skill:architect`](../architect/SKILL.md) | | Get several attempts at one brief, merged into the best one | [`/skill:arena`](../arena/SKILL.md) | @@ -83,6 +86,9 @@ The default answer is `/skill:poteto-mode`, which runs most of the others when i | Hear the last reply again in plain words | [`/skill:bro`](../bro/SKILL.md) | | Give agents a scripted way to drive the app and prove behavior | [`/skill:create-verification-skill`](../create-verification-skill/SKILL.md) | | Bring a verification skill and its feature map back in line with the app | [`/skill:maintain-verification-skill`](../maintain-verification-skill/SKILL.md) | +| Formally verify a race, invariant, or other property that tests rarely reach | [`/skill:create-formal-verification-skill`](../create-formal-verification-skill/SKILL.md) | +| Bring a formal verification back in line after the code it covers changed, and learn whether a failure is drift or a bug | [`/skill:maintain-formal-verification-skill`](../maintain-formal-verification-skill/SKILL.md) | +| Show a PM or designer what the user sees as a chart checked by a model, with each bug drawn as a numbered path, turn an agreed chart into a TLA+ skeleton, or audit the code against its TLA+ spec | [`/skill:statechart`](../statechart/SKILL.md) | | Vet a performance number before reporting or acting on it | [`/skill:benchmark-checklist`](../benchmark-checklist/SKILL.md) | | Run a large or cross-cutting change, or one to review after stepping away | [`/skill:figure-it-out`](../figure-it-out/SKILL.md) | | Keep a decision log during a run, and review it afterward | [`/skill:show-me-your-work`](../show-me-your-work/SKILL.md) | diff --git a/plugins/pstack/skills/poteto-help/references/recipes.md b/plugins/pstack/skills/poteto-help/references/recipes.md index c05f57c..b78a7c1 100644 --- a/plugins/pstack/skills/poteto-help/references/recipes.md +++ b/plugins/pstack/skills/poteto-help/references/recipes.md @@ -6,7 +6,7 @@ Swap in the real paths, skills, and done checks. Informal wording works. - `/poteto-mode read . restate the underlying issue in your own words, in plain english.` - `/in-your-own-words ` -- `/sharpen ` +- `/sharpen ` - `/poteto-mode investigate why . give me what we know, what data you used, and your best hypotheses. don't change any code yet.` - `use /how to understand . then use /why to find out why it broke recently.` - `/recall my work on from last week, then read .` @@ -34,6 +34,7 @@ Swap in the real paths, skills, and done checks. Informal wording works. ## Review and ship - `/interrogate the whole branch, but skeptically. don't change anything yet. no nitpicks unless it's a real bug or regression.` Read the dismissals too. +- `/create-formal-verification-skill prove holds in , even when interleave or retry.` After merges or refactors in that code: `/skill:maintain-formal-verification-skill`. - `/swarm check every package under against its check script. one worker per package. one report.` - `/poteto-mode open the pr. small ordered commits, evidence in the description.` - `/poteto-mode babysit this pr. get it green.` For status only: `/poteto-mode check on pr . anything outstanding?` @@ -43,6 +44,7 @@ Swap in the real paths, skills, and done checks. Informal wording works. - `/poteto-mode im going to bed. in a fresh worktree off . done means . keep a decision log. don't ask me before committing. /loop until done. if you're truly stuck after a few hours, stop and write up why.` - `/show-me-your-work catch me up on what you did last night.` Read its Attention section first. +- `/skill:ketchup` catches you up on this chat since your last message and lists every call that waits on you. - `/poteto-mode full autopilot on this queue. each item is independent.` - `/poteto-mode autopilot these changes but stack them, don't ship. i'll land the stack.` - `/reflect capture what we learned so the next run doesn't repeat it.` Approve only edits that change a future decision. diff --git a/plugins/pstack/skills/poteto-mode/playbooks/shipping.md b/plugins/pstack/skills/poteto-mode/playbooks/shipping.md index d6d64a7..7f1153c 100644 --- a/plugins/pstack/skills/poteto-mode/playbooks/shipping.md +++ b/plugins/pstack/skills/poteto-mode/playbooks/shipping.md @@ -2,8 +2,8 @@ **You own what lands. Verify each PR independently, land only the verified run from the root, then keep your hands off the stack.** -1. **Resolve the forge, then verify each PR independently before it lands.** GitHub CLI (`gh`) is the default. If `command -v origin` succeeds and Origin can resolve the repository, use `origin pr` for every PR operation. Otherwise stay on `gh` and record the fallback. Never require Graphite (`gt`). One verifier per PR, an isolated subagent (`isolated: true`), runs the change the way a user would with the matching control skill (such as the `browser` eval prelude or bash with a unique `name`, a `ready` check, and `proc://` state from omp's built-in tools), parent against head, and posts `PASS`, `PASS+NOTES`, or `FAIL` on that PR. Only a verdict from an agent that did not write the code counts, because an author checks what it meant to build. Green CI and an approving bot review are not verdicts, because neither runs the change as a user would. -2. **Land only the contiguous verified run rooted at the bottom.** Walk up from the lowest unmerged PR and stop at the first one without `PASS` or `PASS+NOTES`. The PRs below it are the run, and the top one is the ceiling. A verified PR above an unverified one waits, because it cannot land without the code below it. One whose branch neither holds nor needs that code can move onto trunk and land on its own. It needs a fresh verdict first, because its old one ran with that code beneath it and trunk does not have it. +1. **Resolve the forge, then verify each PR independently before it lands.** GitHub CLI (`gh`) is the default. If `command -v origin` succeeds and Origin can resolve the repository, use `origin pr` for every PR operation. Otherwise stay on `gh` and record the fallback. Never require Graphite (`gt`). One verifier per PR, an isolated subagent (`isolated: true`), runs the change the way a user would with the matching control skill (such as the `browser` eval prelude or bash with a unique `name`, a `ready` check, and `proc://` state from omp's built-in tools), parent against head, and posts `PASS`, `ISSUES`, or `BLOCKED`, the three verdicts `skill://pstack-omp` and **swarm** use, on that PR. Notes ride on a `PASS` rather than forming a fourth verdict, so a passing run with observations is still a pass. Only a verdict from an agent that did not write the code counts, because an author checks what it meant to build. Green CI and an approving bot review are not verdicts, because neither runs the change as a user would. +2. **Land only the contiguous verified run rooted at the bottom.** Walk up from the lowest unmerged PR and stop at the first one whose verdict is not `PASS`. The PRs below it are the run, and the top one is the ceiling. A verified PR above an unverified one waits, because it cannot land without the code below it. One whose branch neither holds nor needs that code can move onto trunk and land on its own. It needs a fresh verdict first, because its old one ran with that code beneath it and trunk does not have it. 3. **Re-check that the verdicts still describe the code.** A verdict covers a patch, and a chain rebase moves every PR above it to a new SHA without failing any check. Compare `git patch-id` at the verdict SHA with the current head before trusting an older verdict. When the patches differ only in tests, docs, or lint config, a lane's result stands if what it ran builds the same at both SHAs apart from noise. Noise is a difference that also shows up between two builds of the verdict SHA, or an embedded commit SHA. Report each kind of noise with its files, so a reader can check the call. The change itself still gets fresh checks and a review, because the old verdict never saw it. A lane with no build output, such as a dev server, cannot show this, so rerun it, and re-verify anything else that drifted. 4. **Land bottom-up, one PR at a time.** Always merge the run's lowest unmerged PR, with `origin pr merge ` or `gh pr merge --squash`. On Origin the plain command also merges every PR below the one you name, and on GitHub a PR whose base is still its parent's branch merges into that branch, not trunk. Read the PR back for the result (`origin pr view ` or `gh pr view --json state,mergedAt,baseRefName`), because a merge command can report success when a merge queue only queued the PR, and a requested auto-merge is not a merge. A landed PR reads merged with trunk as its base, not its parent's branch. Arm `--auto` (Origin merge-when-ready or GitHub auto-merge) only on a PR whose verdict covers its current head, because it lands whatever head is ready. After a merge lands, retarget the PR whose base was the merged branch to trunk (`origin pr edit --base ` or `gh pr edit --base `), move its patch onto the merge result, and push with `--force-with-lease`. The verdict covers the patch, not its commits, so step 3's patch-id rule decides whether the verdict survives. Merge it once its checks pass and its verdict survives. 5. **Leave the stack alone while it lands.** Step 4's move of the next PR is the only change to a branch or base, because a merge lands whatever its branch and base hold at that moment, verdict or not. On GitHub, watch the run with the queued watcher from `playbooks/babysit.md` (`scripts/watch-pr/watch-pr --queued-stack --stack-prs `) under `/loop` until it reports `COMPLETE` at the ceiling. On Origin, re-read the current PR with `origin pr view --checks` each time `origin pr checks --watch` returns, until the ceiling reads merged. A base that moves to trunk when its parent merges is expected, not damage to repair. If a merge stalls, find out why before you change anything. diff --git a/plugins/pstack/skills/principle-migrate-callers-then-delete-legacy-apis/SKILL.md b/plugins/pstack/skills/principle-migrate-callers-then-delete-legacy-apis/SKILL.md index 06c7cfd..57ddd7b 100644 --- a/plugins/pstack/skills/principle-migrate-callers-then-delete-legacy-apis/SKILL.md +++ b/plugins/pstack/skills/principle-migrate-callers-then-delete-legacy-apis/SKILL.md @@ -6,17 +6,9 @@ disable-model-invocation: true # Migrate Callers Then Delete Legacy APIs -When we decide a new API is the right design, migrate callers and remove the old API in the same refactor wave instead of preserving compatibility layers. - -**Rule:** -- Do not keep legacy API paths only because internal callers still exist -- Inventory callers, migrate them, and delete the old API immediately -- Treat temporary adapters as exceptional and time-boxed, not default architecture - Update tests to assert the new contract, and delete tests that only protect pre-refactor implementation details **When this applies:** - No external users depend on backward compatibility - The project can absorb coordinated breaking changes - The new API is part of a simplification or refactor initiative - -Keeping both old and new APIs creates dual-path complexity, slows cleanup, and makes the codebase feel append-only. diff --git a/plugins/pstack/skills/principle-type-system-discipline/SKILL.md b/plugins/pstack/skills/principle-type-system-discipline/SKILL.md index 4321b83..9fa08b0 100644 --- a/plugins/pstack/skills/principle-type-system-discipline/SKILL.md +++ b/plugins/pstack/skills/principle-type-system-discipline/SKILL.md @@ -1,6 +1,6 @@ --- name: principle-type-system-discipline -description: "Apply when designing types, reviewing a function signature, or writing code in any statically-typed language. Make illegal states unrepresentable, brand semantic primitives, parse external data at boundaries, refuse to lie to the compiler, exhaust variants, derive from authoritative schemas." +description: "Apply when designing types, reviewing a function signature, or writing code in any statically-typed language. Make illegal states unrepresentable, brand semantic primitives, parse external data at boundaries, exhaust variants, derive from authoritative schemas." disable-model-invocation: true --- @@ -8,11 +8,6 @@ disable-model-invocation: true Make the compiler reject impossible states, mismatched primitives, and unhandled variants. Prefer defining errors and special cases out of existence over proliferating handlers. For TypeScript syntax, see the `typescript-best-practices` skill. -- **Make illegal states unrepresentable.** Model variants as sum types (discriminated unions, enums with payloads, sealed classes), not as a bag of optional fields where contradictory combinations compile. `{ completed: boolean; completedAt?: Date }` admits `completed: true` with no date. Derive the boolean from `completedAt`, or model `{ kind: 'open' } | { kind: 'done'; at: Date }`. If you can write a comment explaining when a combination of fields is valid, split it into a sum type. -- **Types are constructions, not restrictions.** Build the type up from the values you want instead of carving them out of a looser type with checks. A non-empty list is a head plus a rest. A valid time range is a start plus a duration. Choose the shape that cannot build the illegal value and expose the interface callers need on top. - **Brand semantic primitives.** `UserId` and `OrderId` are strings underneath but should not be interchangeable. Give each its own type, such as a branded intersection in TypeScript or a newtype elsewhere. Validate once at creation, trust the type downstream. If two arguments share a primitive type but mean different things, brand them. - **External data is untyped until parsed.** RPC payloads, JSON, IPC messages, CLI args, config files, environment variables, database rows. Have a parse function at every boundary that turns unstructured input into the typed model. The **boundary-discipline** principle skill says where to put validation. -- **Don't lie to the type system.** Casts, unsafe coercions, and assertion functions that bypass the compiler are latent runtime crashes. If the compiler can't prove a fact, prove it (validate, narrow, refine the model) or accept that the cast is a hazard. Trace each `any`, `as`, or `assertNotNull` to the boundary and validate there. -- **Exhaustive matching is the compiler's job.** A match on a sum type must fail compilation when a new variant is added without handling, so the compiler tells the next agent where to add a case. Use your language's idiom: a `never`-typed binding in TypeScript, an unannotated `match` in Rust, `-Wincomplete-patterns` in Haskell, sealed-class match exhaustiveness in Kotlin. - **Derive types from authoritative schemas.** When a protocol buffer, OpenAPI spec, GraphQL schema, database migration, design-token file, or another file owns a shape, derive from it instead of hand-rolling a parallel type. See the **encode-lessons-in-structure** principle skill. -- **Strengthen a type only where partiality appears.** A runtime assertion, null check, or "this should never happen" throw marks the place a type is too weak. Push that check up into the type. Then stop. The type system's job is to track the cases each use site must handle, not to describe the data as precisely as possible. Prefer total functions. `sum` of an empty list is 0, so it takes the plain list. `head` of an empty list has no answer, so it demands the non-empty one. If nothing would otherwise panic, keep the plain type. diff --git a/plugins/pstack/skills/sharpen/SKILL.md b/plugins/pstack/skills/sharpen/SKILL.md index 4f9bb4a..5b4a7b1 100644 --- a/plugins/pstack/skills/sharpen/SKILL.md +++ b/plugins/pstack/skills/sharpen/SKILL.md @@ -1,7 +1,16 @@ --- name: sharpen -description: "Sharpen a task before starting: the expert approach, what the user is really after, and the right level of specification. Use for /sharpen." +description: "Make a task deeper, not bigger, then rewrite the prompt. Use for /sharpen." disable-model-invocation: true --- -Before starting, ask how a top expert would approach this task (their raw sources, their real methods, an outside check that the result is right), what the user is really after, and whether the task is over- or underspecified. Loosen constraints that don't serve the goal as readily as you add ones that do, and leave choices that are the user's to make open instead of deciding them. Fold in only what makes the work better, not bigger, but always keep one outside check that the result is right, without narrating the framing, then do the work. Don't hand back a rewritten prompt. +I want a deeper version of this task, not a bigger one. Before rewriting it, do four things: + +1. Say what a top professional in this field would do here that I'm not asking for. +2. Name the rawest material they would start from instead of what has already been digested for me. +3. Name the specific methods and tools they would use. +4. Say what, other than you or me, would show the result is right. + +Then rewrite my prompt to ask for exactly that. + +Leave choices that are mine to make open instead of deciding them. diff --git a/plugins/pstack/skills/statechart/SKILL.md b/plugins/pstack/skills/statechart/SKILL.md new file mode 100644 index 0000000..3cbeca9 --- /dev/null +++ b/plugins/pstack/skills/statechart/SKILL.md @@ -0,0 +1,36 @@ +--- +name: statechart +description: "Draw what an app's user sees as a Mermaid statechart from a TLA+ model. States are gray if they work, red if still wrong, and green if fixed. Each bug TLC finds is a numbered path. Use for /skill:statechart, \"show the PM the bug\", or to turn an agreed chart into a TLA+ skeleton." +disable-model-invocation: true +--- + +# Statechart + +The chart shows what an app's user sees. A PM reads it to decide whether that behavior is right. Label each state with what is on the screen, such as "Paying". Label each step with what the user does or sees happen, such as "tap Pay" or "the charge goes through". Keep variable and action names out of labels. The scripts call this user the reader, as in `readerActions` and reader steps. + +Run `node /scripts/statechart.mjs --help` for the commands and for how to read a chart. Work in a scratch folder outside the repo. The command writes its files next to its input. + +## Pick the direction + +Use `from-spec` when a TLA+ model exists or the code is concrete enough to model. Use `from-chart` when there is no model and the PM should agree on the behavior before anyone writes or changes the code. + +If the code already has a TLA+ spec, start from a copy of that spec. Add the variables the user sees, and keep the spec's existing invariants. To audit the code against that spec, make the copy model what the code does, and pass the spec unchanged as `--against`. In a new spec, tie every variable and action to code that a reviewer can open, and take its name from that code. Make each action one indivisible step in the code. + +## Spec to chart + +1. Choose the chart's states. When the PM cares about something the screen does not show, such as a second charge while the screen still says "Paying", name the state "Paying, charged twice". Start with few states, and split a state only when the split separates two bugs. +2. Write each rule the PM agrees to as one invariant, with the PM's sentence as its comment. For a rule that applies once everything settles, define `Settled == ~ENABLED System`, where `System` is the disjunction of the actions the user does not take. Report each broken rule as a bug. Never weaken a rule to make the chart pass. +3. Run `from-spec`, then fill in the mapping file it writes. Put the labels in `state` and `step`, and list the user's actions in `readerActions` by action name. When two bugs end on the same screen through different code paths, add `cause` and make it name the code path. To color the states by what the PM cares about, such as "Toast shown", return that group from `group`. The legend names the groups, and states that break a rule still get a red border. +4. If there is an open fix, model it from the code and pass that model as `--fixed`. +5. Render each chart with `--png` and look at every PNG. Check that each numbered path reads in order. If a label reads like code, fix `state` or `step` and run the command again. +6. Replay each bug's story against the real code, as a test or a live repro, one step per model action. If a bug does not reproduce, assume the model is wrong until you show otherwise. Fix the model, not the rule. + +## Chart to spec + +1. Draw the chart the PM agrees to. Use one region for each thing that changes independently, such as the connection and the sync badge. Add one `%% never` line per rule, with the PM's sentence. Draw "the app closes" as an edge to the state the user sees next. +2. Run `from-chart`. If a rule breaks, the agreed chart has a design bug. Take the bug to the PM. +3. Add the real code's guards and variables to the spec that `from-chart` wrote, and run `from-chart` again. For each difference it prints, ask the PM whether the code is wrong or the chart needs a correction. + +## Hand off + +Give the PM the PNG and the Mermaid source of each chart. Add one line per bug with the rule it breaks, its steps as the chart numbers them, whether it reproduced, and whether the open fix fixes it. Take every count you quote from `summary.json`. Attach `stories.md` and the command that regenerates everything. Say what the model leaves out. diff --git a/plugins/pstack/skills/statechart/scripts/chart-to-tla.mjs b/plugins/pstack/skills/statechart/scripts/chart-to-tla.mjs new file mode 100644 index 0000000..7dfa337 --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/chart-to-tla.mjs @@ -0,0 +1,236 @@ +#!/usr/bin/env node +import fs from "node:fs"; +import path from "node:path"; +import process from "node:process"; +import { parseMermaid } from "./lib.mjs"; + +const USAGE = "Usage: node chart-to-tla.mjs CHART.mmd --module NAME [--dir OUT]"; +const HELP = `${USAGE} + +Writes a TLA+ spec, a TLC config, and a reader mapping from a Mermaid stateDiagram-v2. +statechart.mjs from-chart runs it, then checks each INVARIANT in NAME.cfg alone. + +Each region becomes one variable whose values are the region's states. Each transition label +becomes one action. Regions that share a label move together: every region that can take it does, +and the others stay. A "%% when" line after a transition is its guard: the region can take that +transition only while the other regions are in, or with "not" are not in, the states it names. An +unlabeled transition is its own action. Each +"%% never NAME: A & B -- sentence" line becomes the invariant NAME == ~(A /\\ B). A name in a +never line is a state, or a composite that stands for every state inside it. + + --module NAME The TLA+ module name. Required. + --dir OUT The folder for the files. Default: the chart's folder. + -h, --help Print this help, and exit 0. + +Writes NAME.tla, NAME.cfg, and NAME.map.mjs into OUT, and replaces files with those names. +NAME.cfg has SPECIFICATION Spec, INVARIANT TypeOK, and one INVARIANT per never line. +NAME.map.mjs gives tlc-to-chart.mjs the reader's words: the region states joined by " | ". + +Exit codes + 0 It wrote the files. + 1 It cannot read the chart. The error says why. + 2 A bad argument.`; +const more = "Run node chart-to-tla.mjs --help for the flags."; + +const args = {}; +for (let i = 2; i < process.argv.length; i++) { + const a = process.argv[i]; + if (a === "-h" || a === "--help") { + console.log(HELP); + process.exit(0); + } else if (a === "--module") args.module = process.argv[++i]; + else if (a === "--dir") args.dir = process.argv[++i]; + else if (!a.startsWith("-") && !args.chart) args.chart = a; + else { + console.error(`unknown argument ${a}. ${more}`); + process.exit(2); + } +} +if (!args.chart || !/^[A-Za-z][A-Za-z0-9_]*$/.test(args.module ?? "")) { + console.error(`${USAGE}\n${more}`); + process.exit(2); +} +const dir = args.dir ?? path.dirname(args.chart); +const { regions, nevers } = parseMermaid(fs.readFileSync(args.chart, "utf8")); + +const RESERVED = new Set(["vars", "Init", "Next", "Spec", "TypeOK", "Settled"]); +const taken = new Set(RESERVED); +function ident(words, lower) { + const parts = words + .normalize("NFKD") + .replace(/[^A-Za-z0-9]+/g, " ") + .trim() + .split(" ") + .filter(Boolean); + let id = + parts + .map((p, i) => (lower && i === 0 ? p[0].toLowerCase() : p[0].toUpperCase()) + p.slice(1)) + .join("") || "Step"; + if (/^[0-9]/.test(id)) id = `${lower ? "r" : "S"}${id}`; + let unique = id; + for (let n = 2; taken.has(unique); n++) unique = `${id}${n}`; + taken.add(unique); + return unique; +} +const str = (s) => `"${s.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`; +const set = (xs) => `{${[...xs].map(str).join(", ")}}`; + +const vars = Object.entries(regions).map(([name, r]) => { + if (r.states.size === 0) throw new Error(`region ${name} has no states`); + if (r.initial.size === 0) throw new Error(`region ${name} has no [*] --> start`); + return { name, v: ident(name, true), ...r }; +}); + +function guardOf(g) { + if (!g) return null; + const parts = Object.entries(g.states).map(([name, states]) => { + const { v } = vars.find((x) => x.name === name); + return states.length === 1 ? `${v} = ${str(states[0])}` : `${v} \\in ${set(states)}`; + }); + return g.not ? `~(${parts.join(" \\/ ")})` : parts.join(" /\\ "); +} + +const actions = []; +const byLabel = new Map(); +for (const [ri, r] of vars.entries()) { + for (const t of r.transitions) { + let a = t.label ? byLabel.get(t.label) : null; + if (!a) { + a = { label: t.label, moves: new Map() }; + actions.push(a); + if (t.label) byLabel.set(t.label, a); + } + if (!a.moves.has(ri)) a.moves.set(ri, []); + const moves = a.moves.get(ri); + const when = guardOf(t.guard); + if (!moves.some((m) => m.from === t.from && m.to === t.to && m.when === when)) + moves.push({ from: t.from, to: t.to, when }); + } +} +for (const a of actions) { + const only = a.label ? null : [...a.moves.values()][0][0]; + a.name = ident(a.label || `${only.from} to ${only.to}`, false); +} + +const out = []; +const conjuncts = (lines) => lines.map((l) => ` /\\ ${l}`); +out.push(`---- MODULE ${args.module} ----`); +out.push(`\\* Generated by chart-to-tla.mjs from ${path.basename(args.chart)}.`); +out.push("\\* Each region is one variable and each transition label is one action."); +out.push("\\* Once you add guards and variables from the real code, this file is the source."); +out.push( + `\\* statechart.mjs from-chart ${path.basename(args.chart)} keeps it, checks it, and compares it with the chart.`, +); +out.push(""); +out.push(`VARIABLES ${vars.map((x) => x.v).join(", ")}`); +out.push(`vars == <<${vars.map((x) => x.v).join(", ")}>>`); +out.push(""); +for (const x of vars) + out.push(`\\* Region ${x.name}`, `${x.v}States == ${set([...x.states].sort())}`); +out.push(""); +out.push("TypeOK ==", ...conjuncts(vars.map((x) => `${x.v} \\in ${x.v}States`))); +out.push(""); +out.push( + "Init ==", + ...conjuncts( + vars.map((x) => + x.initial.size === 1 ? `${x.v} = ${str([...x.initial][0])}` : `${x.v} \\in ${set(x.initial)}`, + ), + ), +); +const enabled = (v, m) => `${v} = ${str(m.from)}${m.when ? ` /\\ ${m.when}` : ""}`; +function whetherTakes(a, ri) { + const { v } = vars[ri]; + const moves = a.moves.get(ri); + if (moves.every((m) => !m.when)) { + const from = set(new Set(moves.map((m) => m.from))); + return { can: `${v} \\in ${from}`, cannot: `${v} \\notin ${from}` }; + } + const any = moves.map((m) => `(${enabled(v, m)})`).join(" \\/ "); + return { can: any, cannot: `~(${any})` }; +} +for (const a of actions) { + out.push(""); + if (a.label) out.push(`\\* ${a.label}`); + out.push(`${a.name} ==`); + const moving = [...a.moves.keys()]; + const shared = moving.length > 1; + if (shared) out.push(` /\\ (${moving.map((ri) => whetherTakes(a, ri).can).join(" \\/ ")})`); + for (const ri of moving) { + const { v } = vars[ri]; + const ds = a.moves.get(ri).map((m) => `(${enabled(v, m)} /\\ ${v}' = ${str(m.to)})`); + if (shared) ds.push(`(${whetherTakes(a, ri).cannot} /\\ UNCHANGED ${v})`); + out.push(` /\\ \\/ ${ds[0]}`); + for (const d of ds.slice(1)) out.push(` \\/ ${d}`); + } + const still = vars.filter((_, ri) => !a.moves.has(ri)).map((x) => x.v); + if (still.length) out.push(` /\\ UNCHANGED <<${still.join(", ")}>>`); +} +out.push(""); +out.push( + actions.length ? `Next == ${actions.map((a) => a.name).join(" \\/ ")}` : "Next == UNCHANGED vars", +); +out.push(""); +out.push("Spec == Init /\\ [][Next]_vars"); + +function resolve(item) { + const hits = []; + for (const [ri, x] of vars.entries()) { + const inside = x.states.has(item) + ? [item] + : [...x.states].filter((s) => s.startsWith(`${item}.`)); + if (inside.length) hits.push({ ri, inside }); + } + if (hits.length === 0) + throw new Error(`never line names "${item}", which is not a state in the chart`); + if (hits.length > 1) + throw new Error( + `never line names "${item}", which is a state in regions ${hits.map((h) => vars[h.ri].name).join(" and ")}; rename one`, + ); + return hits[0]; +} +const invariants = []; +for (const n of nevers) { + if (taken.has(n.name)) throw new Error(`never name ${n.name} is already used in the spec`); + taken.add(n.name); + const parts = n.states.map(resolve); + const regionsUsed = new Set(parts.map((p) => p.ri)); + if (regionsUsed.size !== parts.length) + throw new Error( + `never ${n.name} names two states of one region; one region is in one state at a time`, + ); + const cond = parts.map((p) => + p.inside.length === 1 + ? `${vars[p.ri].v} = ${str(p.inside[0])}` + : `${vars[p.ri].v} \\in ${set(p.inside)}`, + ); + out.push(""); + if (n.sentence) out.push(`\\* ${n.sentence}`); + out.push(`${n.name} == ~(${cond.join(" /\\ ")})`); + invariants.push(n.name); +} +out.push("", "====", ""); + +const rules = ["TypeOK", ...invariants]; +const cfg = ["SPECIFICATION Spec", ...rules.map((r) => `INVARIANT ${r}`), ""]; + +const labels = Object.fromEntries(actions.map((a) => [a.name, a.label])); +const map = [ + `// Generated by chart-to-tla.mjs from ${path.basename(args.chart)}. Reader states are the chart's own states.`, + `export const regions = ${JSON.stringify(vars.map((x) => x.v))};`, + `const LABELS = ${JSON.stringify(labels, null, "\t")};`, + "", + "// The actions the reader takes. facts.settled needs them. Add cause() and detail() as the spec grows.", + "export const readerActions = [];", + 'export const state = (v) => regions.map((r) => v[r]).join(" | ");', + "export const step = (action) => LABELS[action] ?? action;", + "", +]; + +fs.mkdirSync(dir, { recursive: true }); +fs.writeFileSync(path.join(dir, `${args.module}.tla`), out.join("\n")); +fs.writeFileSync(path.join(dir, `${args.module}.cfg`), cfg.join("\n")); +fs.writeFileSync(path.join(dir, `${args.module}.map.mjs`), map.join("\n")); +console.error( + `${args.module}: ${vars.length} region variable(s), ${actions.length} action(s), rules ${rules.join(" ")} -> ${path.join(dir, args.module)}.{tla,cfg,map.mjs}`, +); diff --git a/plugins/pstack/skills/statechart/scripts/compare-charts.mjs b/plugins/pstack/skills/statechart/scripts/compare-charts.mjs new file mode 100644 index 0000000..587125a --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/compare-charts.mjs @@ -0,0 +1,104 @@ +#!/usr/bin/env node +import fs from "node:fs"; +import process from "node:process"; +import { FULL_LABELS, LEGEND_ID, compareCharts, parseMermaid } from "./lib.mjs"; + +const USAGE = "Usage: node compare-charts.mjs EXPECTED.mmd ACTUAL.mmd"; +const HELP = `${USAGE} + +Compares two Mermaid stateDiagram-v2 charts: reachable states, start states, and labeled +transitions. statechart.mjs from-chart runs it to check that the spec still draws the chart that +the reader agreed to. + +EXPECTED is the agreed chart. ACTUAL is what tlc-to-chart.mjs drew from the spec in the customer +view with --highlight 0 --full-labels --flat, without --cover, --fixed-dot, or --against-dot. Each +chart compares as the +machine that its steps reach from its start states. A chart with parallel regions compares as its +combined machine, so a guard that blocks a step in only some combinations of regions shows as a +difference. A "%% when ID, ID" or "%% when not ID, ID" line right after a transition is its guard: +the step happens only while another region is in, or not in, one of those states. The label ends +with the guard's words in [ ], which are not part of the label. A combined state is the region +states joined by " | " in region order, which is what chart-to-tla.mjs's mapping writes. A step that does not change the state is not compared, because +tlc-to-chart.mjs does not draw it. An edge label "a or b" counts as two labels. An unlabeled edge +counts only when no labeled edge joins the same two states, because tlc-to-chart.mjs draws only +the labels. + + -h, --help Print this help, and exit 0. + +Prints each difference and then "N difference(s)", or prints "same". Writes no file. + +Exit codes + 0 The charts are the same. + 1 The charts differ. + 2 A bad argument, a chart that it cannot read, or an ACTUAL chart that is not drawn for + comparison.`; +const more = "Run node compare-charts.mjs --help for the flags."; + +const files = []; +for (const a of process.argv.slice(2)) { + if (a === "-h" || a === "--help") { + console.log(HELP); + process.exit(0); + } else if (a.startsWith("-") || files.length === 2) { + console.error(`unknown argument ${a}. ${more}`); + process.exit(2); + } else files.push(a); +} +if (files.length < 2) { + console.error(`${USAGE}\n${more}`); + process.exit(2); +} +const [expectedFile, actualFile] = files; + +const orExit = (file, f) => { + try { + return f(); + } catch (e) { + console.error(`${file}: ${e.message}`); + process.exit(2); + } +}; +const [expectedText, actualText] = files.map((f) => orExit(f, () => fs.readFileSync(f, "utf8"))); +const has = (re) => re.test(actualText); +const textRefusals = [ + [ + has(/^\s*%% second model/m), + "it has a second model; draw ACTUAL without --fixed-dot or --against-dot", + ], + [ + has(new RegExp(`^\\s*state\\s+"[^"]*"\\s+as\\s+(?!${LEGEND_ID}\\b)\\w+\\s*\\{`, "m")), + "it has boxes; draw ACTUAL with --flat", + ], + [ + has(new RegExp(`^\\s*state\\s+"[^"]*"\\s+as\\s+${LEGEND_ID}\\s*\\{`, "m")) && + !actualText.includes(FULL_LABELS), + "edge labels write shared words once; draw ACTUAL with --full-labels", + ], +]; +for (const [bad, why] of textRefusals) { + if (bad) { + console.error(`${actualFile}: ${why}`); + process.exit(2); + } +} +const expectedRegions = orExit(expectedFile, () => parseMermaid(expectedText).regions); +const actualRegions = orExit(actualFile, () => parseMermaid(actualText).regions); +const numbered = Object.values(actualRegions) + .flatMap((r) => r.transitions) + .some((t) => /^\d+(, \d+)*\. /.test(t.label)); +if (numbered) { + console.error( + `${actualFile}: an edge label is a numbered path step; draw ACTUAL with --highlight 0`, + ); + process.exit(2); +} + +const rows = compareCharts(expectedRegions, actualRegions); +let differences = 0; +for (const [title, xs] of rows) { + console.log(`${title}:`); + for (const x of xs) console.log(` ${x}`); + differences += xs.length; +} +console.log(differences === 0 ? "same" : `${differences} difference(s)`); +process.exit(differences === 0 ? 0 : 1); diff --git a/plugins/pstack/skills/statechart/scripts/lib.mjs b/plugins/pstack/skills/statechart/scripts/lib.mjs new file mode 100644 index 0000000..cf72d5c --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/lib.mjs @@ -0,0 +1,723 @@ +import fs from "node:fs"; +import process from "node:process"; + +export function findTlc() { + const { TLA2TOOLS, JAVA } = process.env; + if (!TLA2TOOLS) + throw new Error( + "Cannot find TLC. Download tla2tools.jar from a TLA+ release:\n https://github.com/tlaplus/tlaplus/releases\nThen set TLA2TOOLS to the path of tla2tools.jar, and JAVA to a java binary (Java 11 or later).", + ); + if (!fs.existsSync(TLA2TOOLS)) throw new Error(`TLA2TOOLS is ${TLA2TOOLS}, which does not exist.`); + return { jar: TLA2TOOLS, java: JAVA || "java" }; +} + +export function parseValue(text) { + const src = text.trim(); + let i = 0; + const ws = () => { + while (i < src.length && /\s/.test(src[i])) i++; + }; + const peek = (s) => src.startsWith(s, i); + const eat = (s) => { + ws(); + if (!peek(s)) throw new Error(`expected ${s} at ${i} in ${src}`); + i += s.length; + }; + const list = (close, item) => { + const out = []; + ws(); + if (peek(close)) { + i += close.length; + return out; + } + for (;;) { + out.push(item()); + ws(); + if (peek(",")) { + i++; + continue; + } + eat(close); + return out; + } + }; + const value = () => { + ws(); + if (peek("<<")) { + i += 2; + return list(">>", value); + } + if (peek("{")) { + i++; + return list("}", value); + } + if (peek("[")) { + i++; + const pairs = list("]", () => { + ws(); + const m = /^[A-Za-z_][A-Za-z0-9_]*/.exec(src.slice(i)); + if (!m) throw new Error(`bad record field at ${i}`); + i += m[0].length; + eat("|->"); + return [m[0], value()]; + }); + return Object.fromEntries(pairs); + } + if (peek("(")) { + i++; + const fn = {}; + for (;;) { + const k = value(); + eat(":>"); + fn[typeof k === "string" ? k : JSON.stringify(k)] = value(); + ws(); + if (peek("@@")) { + i += 2; + continue; + } + eat(")"); + return fn; + } + } + if (peek('"')) { + i++; + let s = ""; + while (i < src.length && src[i] !== '"') { + if (src[i] === "\\") i++; + s += src[i++]; + } + i++; + return s; + } + const m = /^-?\d+|^[A-Za-z_][A-Za-z0-9_]*/.exec(src.slice(i)); + if (!m) throw new Error(`bad value at ${i} in ${src}`); + i += m[0].length; + if (m[0] === "TRUE") return true; + if (m[0] === "FALSE") return false; + return /^-?\d+$/.test(m[0]) ? Number(m[0]) : m[0]; + }; + try { + const v = value(); + ws(); + return i === src.length ? v : src; + } catch { + return src; + } +} + +// One state as TLC prints it: "/\ x = 1" lines, or "x = 1" for one variable. +function parseState(text) { + const lines = text.split("\n").filter((l) => l.trim() !== ""); + const conjuncts = []; + for (const line of lines) { + if (/^\s*\/\\ /.test(line) || conjuncts.length === 0) + conjuncts.push(line.replace(/^\s*\/\\ /, "")); + else conjuncts[conjuncts.length - 1] += ` ${line.trim()}`; + } + const vars = {}; + for (const c of conjuncts) { + const eq = c.indexOf(" = "); + if (eq < 0) continue; + vars[c.slice(0, eq).trim()] = parseValue(c.slice(eq + 3)); + } + return vars; +} + +export const isRecord = (v) => v !== null && typeof v === "object" && !Array.isArray(v); +const canon = (v) => + Array.isArray(v) + ? v.map(canon) + : isRecord(v) + ? Object.fromEntries( + Object.keys(v) + .sort() + .map((k) => [k, canon(v[k])]), + ) + : v; +export const stateKey = (vars) => JSON.stringify(canon(vars)); + +export function ruleSentences(tla) { + const out = new Map(); + const lines = tla.split("\n"); + lines.forEach((line, i) => { + const name = /^([A-Za-z_]\w*)\s*==/.exec(line)?.[1]; + if (!name) return; + const said = []; + for (let j = i - 1; j >= 0 && /^\s*\\\*/.test(lines[j]); j--) + said.unshift(lines[j].replace(/^\s*\\\*\s?/, "").trim()); + const sentence = said.filter(Boolean).join(" "); + if (sentence) out.set(name, sentence); + }); + return out; +} + +function unescapeDot(s) { + let out = ""; + for (let i = 0; i < s.length; i++) { + if (s[i] === "\\" && i + 1 < s.length) { + const n = s[++i]; + out += n === "n" ? "\n" : n; + } else out += s[i]; + } + return out; +} + +export function parseDot(text) { + const nodes = new Map(); + const edges = []; + const loops = []; + const seen = new Set(); + const LABEL = '"((?:[^"\\\\]|\\\\.)*)"'; + const nodeRe = new RegExp(`^(-?\\d+) \\[label=${LABEL}(.*)\\];?\\s*$`); + const edgeRe = new RegExp(`^(-?\\d+) -> (-?\\d+)(?: \\[label=${LABEL})?`); + for (const line of text.split("\n")) { + let m = edgeRe.exec(line); + if (m) { + const e = { from: m[1], to: m[2], action: m[3] ? unescapeDot(m[3]) : "" }; + const id = `${e.from} ${e.to} ${e.action}`; + if (seen.has(id)) continue; + seen.add(id); + (e.from === e.to ? loops : edges).push(e); + continue; + } + m = nodeRe.exec(line); + if (m) + nodes.set(m[1], { + id: m[1], + vars: parseState(unescapeDot(m[2])), + init: /style\s*=\s*filled/.test(m[3]), + }); + } + if (nodes.size === 0) + throw new Error("no states found; dump the graph with TLC -dump dot,actionlabels "); + const missing = [...edges, ...loops].find((e) => !nodes.has(e.from) || !nodes.has(e.to)); + if (missing) + throw new Error( + `transition ${missing.from} -> ${missing.to} names a state the file does not define`, + ); + if (edges.length > 0 && [...edges, ...loops].every((e) => !e.action)) + throw new Error( + "the graph has no action names; dump it with TLC -dump dot,actionlabels ", + ); + return { nodes, edges, loops }; +} + +export function parseTraces(text) { + const traces = []; + let invariant = null; + let current = null; + const lines = text.split("\n"); + const stateAt = (i) => { + const body = []; + while (i + 1 < lines.length && lines[i + 1].trim() !== "") body.push(lines[++i]); + return [parseState(body.join("\n")), i]; + }; + for (let i = 0; i < lines.length; i++) { + const line = lines[i]; + const inv = /^Error: Invariant (\S+) is violated( by the initial state:)?/.exec(line); + if (inv) { + invariant = inv[1]; + if (inv[2]) { + const [vars, end] = stateAt(i); + traces.push({ invariant, steps: [{ action: null, vars }] }); + i = end; + } + continue; + } + if (line.startsWith("Error: ") && !line.startsWith("Error: The behavior up to this point is")) + invariant = null; + const head = /^State (\d+): <([^\s>(]+)/.exec(line); + if (!head) continue; + const [vars, end] = stateAt(i); + i = end; + if (head[1] === "1") { + current = { invariant, steps: [] }; + traces.push(current); + } + current?.steps.push({ action: head[2] === "Initial" ? null : head[2], vars }); + } + return traces; +} + +// With -continue, TLC prints "Model checking completed" even after broken invariants, and not +// when it stopped early. +export function checkTlcOutput(text, file) { + const other = text + .split("\n") + .find( + (l) => + l.startsWith("Error: ") && + !/^Error: (Invariant \S+ is violated|The behavior up to this point is)/.test(l), + ); + if (other) + throw new Error( + `${file}: TLC stopped on an error that is not a broken rule: ${other.slice(7)}`, + ); + if (!/^Model checking completed\./m.test(text)) + throw new Error( + `${file}: TLC did not finish, so its counterexamples are not all there; read the file`, + ); +} + +export function wrap(text, width = 26) { + const words = String(text).split(/\s+/); + const rows = []; + let row = ""; + for (const w of words) { + if (row && (row + " " + w).length > width) { + rows.push(row); + row = w; + } else row = row ? `${row} ${w}` : w; + } + if (row) rows.push(row); + return rows.join("
"); +} + +const OPENS_A_PHRASE = new Set( + "a an the your my our their its this that to of in on at for with from by and or".split(" "), +); +export function joinLabels(labels) { + if (labels.length < 2) return labels.join(" or "); + const words = labels.map((l) => String(l).split(" ")); + let n = 0; + while (words.every((w) => n < w.length - 1 && w[n] === words[0][n])) n++; + while (n > 0 && OPENS_A_PHRASE.has(words[0][n - 1])) n--; + if (n < 2) return labels.join(" or "); + const rest = words.map((w) => w.slice(n).join(" ")); + const list = + rest.length === 2 ? rest.join(" or ") : `${rest.slice(0, -1).join(", ")}, or ${rest.at(-1)}`; + return `${words[0].slice(0, n).join(" ")} ${list}`; +} + +const unwrap = (s) => + s + .replace(/|#160;/g, " ") + .replace(/#(quot|34);/g, '"') + .replace(/\s+/g, " ") + .trim(); + +// Mermaid ends a quoted state caption at the first ", so a caption writes " as #quot;. +export const quote = (s) => String(s).replaceAll('"', "#quot;"); + +export const LEGEND_ID = "legend"; +export const FULL_LABELS = "%% labels in full"; + +export function parseMermaid(text) { + const names = new Map(); + const nevers = []; + let last = null; + const newPart = () => ({ children: [], transitions: [] }); + const root = { name: "", parts: [newPart()] }; + const stack = [root]; + const part = () => stack[stack.length - 1].parts.at(-1); + const display = (id) => names.get(id) ?? id; + const implicit = new Map(); + const declare = (id) => { + const prev = implicit.get(id); + if (prev) + prev.children.splice( + prev.children.findIndex((c) => c.name === id), + 1, + ); + implicit.set(id, null); + }; + const mention = (id) => { + if (id === "[*]" || implicit.has(id)) return; + part().children.push({ name: id, leaf: true }); + implicit.set(id, part()); + }; + const body = text.replace(/^\s*---[ \t]*\r?\n[^]*?\r?\n---[ \t]*(\r?\n|$)/, ""); + for (const raw of body.split("\n")) { + const line = raw.trim().replace(/(\[\*\]|[A-Za-z_]\w*):::[\w-]+/g, "$1"); + const when = /^%%\s*when\s+(not\s+)?(.+)$/.exec(line); + if (when) { + if (!last) throw new Error(`a %% when line must come right after a transition: ${line}`); + if (!last.words) + throw new Error( + `the guarded step "${last.label}" must end its label with the guard's words in [ ]`, + ); + last.when = { not: Boolean(when[1]), ids: when[2].split(",").map((s) => s.trim()) }; + last = null; + continue; + } + last = null; + const never = /^%%\s*never\s+([A-Za-z_][A-Za-z0-9_]*)\s*:\s*(.+?)(?:\s+--\s+(.*))?$/.exec(line); + if (never) { + nevers.push({ + name: never[1], + states: never[2].split("&").map((s) => s.trim()), + sentence: never[3] ?? "", + }); + continue; + } + if ( + !line || + line.startsWith("%%") || + /^(stateDiagram|direction|classDef|class |note)/.test(line) + ) + continue; + let m = /^state\s+"([^"]*)"\s+as\s+([A-Za-z_]\w*)\s*(\{)?\s*$/.exec(line); + if (!m) { + const plain = /^state\s+([A-Za-z_]\w*)\s*(\{)?\s*$/.exec(line); + if (plain) m = [line, null, plain[1], plain[2]]; + } + if (m) { + if (m[1] !== null && !names.has(m[2])) names.set(m[2], unwrap(m[1])); + declare(m[2]); + if (m[3]) { + const node = { name: m[2], parts: [newPart()] }; + part().children.push(node); + stack.push(node); + } else part().children.push({ name: m[2], leaf: true }); + continue; + } + if (line === "}") { + if (stack.length === 1) throw new Error("unmatched } in the chart"); + stack.pop(); + continue; + } + if (line === "--") { + stack[stack.length - 1].parts.push(newPart()); + continue; + } + m = /^(\[\*\]|[A-Za-z_]\w*)\s*-->\s*(\[\*\]|[A-Za-z_]\w*)(?:\s*:\s*(.*))?$/.exec(line); + if (m) { + if (m[2] === "[*]" && m[1] !== "[*]") + throw new Error( + `cannot read final state in "${line}"; draw the step to the state the reader sees next`, + ); + mention(m[1]); + mention(m[2]); + const said = m[3] ? unwrap(m[3]) : ""; + const label = said.replace(/\s*\[[^\]]*\]/g, ""); + last = { from: m[1], to: m[2], label, words: label !== said }; + part().transitions.push(last); + continue; + } + m = /^([A-Za-z_]\w*)\s*:\s*(.*)$/.exec(line); + if (m) { + if (!names.has(m[1])) names.set(m[1], unwrap(m[2])); + if (implicit.get(m[1]) === null) continue; + declare(m[1]); + part().children.push({ name: m[1], leaf: true }); + continue; + } + throw new Error(`cannot read chart line: ${line}`); + } + if (stack.length !== 1) throw new Error("the chart has an unclosed {"); + if (root.parts.length > 1) + throw new Error( + "the chart has -- outside a composite; to make parallel regions, split one top-level composite with --", + ); + + // Ids are global, as in Mermaid: a transition may name a state declared inside another composite. + function region(p) { + const out = { states: new Set(), initial: new Set(), transitions: [] }; + const info = new Map(); + const declared = new Set(); + (function collect(q) { + for (const c of q.children) { + if (c.name === LEGEND_ID) continue; + declared.add(c.name); + if (!c.leaf) for (const sub of c.parts) collect(sub); + } + })(p); + const transitions = []; + const lookup = (id) => { + const found = info.get(id); + if (!found) throw new Error(`transition names ${id}, which is not in this region`); + return found; + }; + function states(q, prefix, depth) { + const local = q.children.filter((c) => c.name !== LEGEND_ID); + for (const t of q.transitions) { + for (const end of [t.from, t.to]) { + if (end === "[*]" || declared.has(end)) continue; + declared.add(end); + local.push({ name: end, leaf: true }); + } + } + const all = []; + for (const c of local) { + if (info.has(c.name)) { + if (local.indexOf(c) !== local.findIndex((x) => x.name === c.name)) continue; + throw new Error(`state id ${c.name} is declared in two places`); + } + const full = `${prefix}${display(c.name)}`; + if (c.leaf) { + if (out.states.has(full)) + throw new Error(`two states have the caption "${full}"; give each its own caption`); + out.states.add(full); + info.set(c.name, { all: [full], initial: [full], depth }); + all.push(full); + continue; + } + if (c.parts.length > 1) + throw new Error( + `${display(c.name)} splits into regions below the top level; make each region a top-level region`, + ); + const inner = states(c.parts[0], `${full}.`, depth + 1); + const initial = c.parts[0].transitions + .filter((t) => t.from === "[*]") + .flatMap((t) => lookup(t.to).initial); + if (initial.length === 0) + throw new Error( + `${display(c.name)} has no [*] --> start, so a transition into it has nowhere to land`, + ); + info.set(c.name, { all: inner, initial, depth }); + all.push(...inner); + } + for (const t of q.transitions) if (t.from !== "[*]" && t.to !== "[*]") transitions.push(t); + return all; + } + states(p, "", 0); + for (const t of p.transitions) + if (t.from === "[*]") for (const s of lookup(t.to).initial) out.initial.add(s); + transitions.sort((a, b) => lookup(b.from).depth - lookup(a.from).depth); + const handled = new Set(); + let pending = []; + let depth = null; + for (const t of transitions) { + const from = lookup(t.from); + if (from.depth !== depth) { + for (const h of pending) handled.add(h); + pending = []; + depth = from.depth; + } + for (const f of from.all) { + const key = `${f}\u0000${t.label}`; + if (t.label && handled.has(key)) continue; + for (const to of lookup(t.to).initial) + out.transitions.push({ + from: f, + to, + label: t.label, + ...(t.when ? { when: t.when } : {}), + }); + if (t.label) pending.push(key); + } + } + return [out, info]; + } + + const owners = new Map(); + const regions = {}; + const top = root.parts[0]; + const machine = top.children.filter((c) => c.name !== LEGEND_ID); + const parallel = + machine.length === 1 && + !machine[0].leaf && + machine[0].parts.length > 1 && + top.transitions.every((t) => t.from === "[*]"); + if (parallel) { + for (const p of machine[0].parts) { + const [only] = p.children; + const holder = + p.children.length === 1 && + !only.leaf && + p.transitions.every((t) => t.from === "[*]" && t.to === only.name) + ? only + : null; + if (holder && holder.parts.length > 1) + throw new Error(`${display(holder.name)} splits into regions below the top level`); + const name = holder ? display(holder.name) : `Region${Object.keys(regions).length + 1}`; + const [r, ids] = region(holder ? holder.parts[0] : p); + regions[name] = r; + for (const [id, { all }] of ids) owners.set(id, { name, all }); + } + } else { + const [r, ids] = region(top); + regions.Main = r; + for (const [id, { all }] of ids) owners.set(id, { name: "Main", all }); + } + for (const [name, r] of Object.entries(regions)) + for (const t of r.transitions) { + if (!t.when) continue; + if (!parallel) + throw new Error("a %% when line guards a step on other regions, and the chart has none"); + const states = {}; + for (const id of t.when.ids) { + const at = owners.get(id); + if (!at) + throw new Error(`a %% when line names ${id}, which is not a state id in the chart`); + if (at.name === name) + throw new Error( + `a %% when line names ${display(id)}, which is in the step's own region; a guard reads other regions`, + ); + states[at.name] = [...new Set([...(states[at.name] ?? []), ...at.all])].sort(); + } + t.guard = { not: t.when.not, states }; + delete t.when; + } + return { regions, nevers }; +} + +function guardHolds(guard, at) { + if (!guard) return true; + const hits = Object.entries(guard.states).map(([r, states]) => states.includes(at[r])); + return guard.not ? !hits.some(Boolean) : hits.every(Boolean); +} + +export function productOf(regions) { + const names = Object.keys(regions); + const rs = Object.values(regions); + const join = (parts) => parts.join(" | "); + const byLabel = new Map(); + const unlabeled = []; + rs.forEach((r, ri) => { + for (const t of r.transitions) { + if (!t.label) { + unlabeled.push({ ri, from: t.from, to: t.to, guard: t.guard }); + continue; + } + if (!byLabel.has(t.label)) + byLabel.set( + t.label, + rs.map(() => new Map()), + ); + const moves = byLabel.get(t.label)[ri]; + if (!moves.has(t.from)) moves.set(t.from, []); + moves.get(t.from).push({ to: t.to, guard: t.guard }); + } + }); + let starts = [[]]; + for (const r of rs) starts = starts.flatMap((p) => [...r.initial].map((s) => [...p, s])); + const out = { states: new Set(), initial: new Set(starts.map(join)), transitions: [] }; + const seen = new Set(starts.map(join)); + const queue = [...starts]; + const step = (from, to, label) => { + const [a, b] = [join(from), join(to)]; + if (a === b) return; + out.transitions.push({ from: a, to: b, label }); + if (!seen.has(b)) { + seen.add(b); + queue.push(to); + } + }; + while (queue.length) { + const cur = queue.shift(); + out.states.add(join(cur)); + const at = Object.fromEntries(names.map((n, ri) => [n, cur[ri]])); + for (const u of unlabeled) { + if (cur[u.ri] !== u.from || !guardHolds(u.guard, at)) continue; + const next = [...cur]; + next[u.ri] = u.to; + step(cur, next, ""); + } + for (const [label, perRegion] of byLabel) { + const open = perRegion.map((moves, ri) => + (moves.get(cur[ri]) ?? []).filter((m) => guardHolds(m.guard, at)).map((m) => m.to), + ); + if (open.every((tos) => tos.length === 0)) continue; + let nexts = [[]]; + open.forEach((tos, ri) => { + const options = tos.length ? [...new Set(tos)] : [cur[ri]]; + nexts = nexts.flatMap((p) => options.map((s) => [...p, s])); + }); + for (const next of nexts) step(cur, next, label); + } + } + return out; +} + +export function compareCharts(expectedRegions, actualRegions) { + const expected = productOf(expectedRegions); + const actual = productOf(actualRegions); + const edgeSet = (m) => { + const labeled = new Set(); + const out = new Set(); + for (const t of m.transitions) { + if (!t.label) continue; + labeled.add(`${t.from} --> ${t.to}`); + for (const l of t.label.split(" or ")) out.add(`${t.from} --> ${t.to} : ${l}`); + } + for (const t of m.transitions) + if (!t.label && !labeled.has(`${t.from} --> ${t.to}`)) out.add(`${t.from} --> ${t.to}`); + return out; + }; + const minus = (a, b) => [...a].filter((x) => !b.has(x)).sort(); + const unreached = []; + const regionEntries = Object.entries(expectedRegions); + if (regionEntries.length === 1) { + for (const s of regionEntries[0][1].states) if (!expected.states.has(s)) unreached.push(s); + } else { + regionEntries.forEach(([name, r], ri) => { + const seen = new Set([...expected.states].map((s) => s.split(" | ")[ri])); + for (const s of r.states) if (!seen.has(s)) unreached.push(`${name}: ${s}`); + }); + } + return [ + ["states the agreed chart's own steps never reach", unreached.sort()], + [ + "states only in EXPECTED (no path from the start reaches them in the spec, or the spec renamed them)", + minus(expected.states, actual.states), + ], + ["states only in ACTUAL", minus(actual.states, expected.states)], + ["start states only in EXPECTED", minus(expected.initial, actual.initial)], + ["start states only in ACTUAL", minus(actual.initial, expected.initial)], + [ + "transitions only in EXPECTED (a guard in the spec blocks them, or the spec renamed the step)", + minus(edgeSet(expected), edgeSet(actual)), + ], + ["transitions only in ACTUAL", minus(edgeSet(actual), edgeSet(expected))], + ].filter(([, xs]) => xs.length > 0); +} + +export const STATUS_CLASSES = [ + "classDef works fill:#f4f6f7,stroke:#566573,color:#1b2631", + "classDef wrong fill:#fdedec,stroke:#c0392b,color:#7b241c", + "classDef fixed fill:#e9f7ef,stroke:#1e8449,color:#145a32", + "classDef worksPath fill:#f4f6f7,stroke:#1f3a93,stroke-width:4px,color:#1b2631", + "classDef wrongPath fill:#fdedec,stroke:#1f3a93,stroke-width:4px,color:#7b241c", + "classDef fixedPath fill:#e9f7ef,stroke:#1f3a93,stroke-width:4px,color:#145a32", +]; + +export const GROUP_PALETTE = [ + "#d6eaf8", + "#fdebd0", + "#e8daef", + "#fcf3cf", + "#d1f2eb", + "#ede0d4", + "#f6e0ef", +]; +export const PLAIN_FILL = "#f4f6f7"; + +const rgb = (hex) => { + const h = hex.length === 4 ? [...hex.slice(1)].map((c) => c + c).join("") : hex.slice(1); + return [0, 2, 4].map((i) => parseInt(h.slice(i, i + 2), 16)); +}; +// WCAG relative luminance: 0 for black, 1 for white. +function luminance(hex) { + const [r, g, b] = rgb(hex).map((c) => { + const s = c / 255; + return s <= 0.03928 ? s / 12.92 : ((s + 0.055) / 1.055) ** 2.4; + }); + return 0.2126 * r + 0.7152 * g + 0.0722 * b; +} +export function groupColorProblem(color) { + if (typeof color !== "string" || !/^#([0-9a-f]{3}|[0-9a-f]{6})$/i.test(color)) + return 'is not "#rgb" or "#rrggbb"'; + if (luminance(color) < 0.5) return "is too dark for the status borders to show on it"; + return null; +} + +const BORDERS = { + Wrong: ["stroke:#c0392b,stroke-width:4px", "#7b241c"], + Fixed: ["stroke:#1e8449,stroke-width:4px", "#145a32"], + Path: ["stroke:#1f3a93,stroke-width:4px", "#1b2631"], +}; +export function groupClassDef(base, fill, border) { + const darker = `#${rgb(fill) + .map((c) => + Math.round(c / 2) + .toString(16) + .padStart(2, "0"), + ) + .join("")}`; + const [stroke, color] = BORDERS[border] ?? [ + `stroke:${fill === PLAIN_FILL ? "#566573" : darker}`, + "#1b2631", + ]; + return `classDef ${base}${border} fill:${fill},${stroke},color:${color}`; +} diff --git a/plugins/pstack/skills/statechart/scripts/model/OutputFolder.cfg b/plugins/pstack/skills/statechart/scripts/model/OutputFolder.cfg new file mode 100644 index 0000000..68fd715 --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/model/OutputFolder.cfg @@ -0,0 +1,6 @@ +SPECIFICATION Spec +INVARIANT ChartsOneSpec +INVARIANT KeepsYourFiles +INVARIANT NeverLosesChart +INVARIANT ExitTwoLeavesFolder +INVARIANT OverlapNeverRefuses diff --git a/plugins/pstack/skills/statechart/scripts/model/OutputFolder.map.mjs b/plugins/pstack/skills/statechart/scripts/model/OutputFolder.map.mjs new file mode 100644 index 0000000..9618338 --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/model/OutputFolder.map.mjs @@ -0,0 +1,106 @@ +const QUIET = ["idle", "exited", "stopped", "orphanTlc"]; +const going = (v) => v.pc.filter((p) => !QUIET.includes(p)).length; +const changed = (before, after) => + after.pc.findIndex( + (p, i) => p !== before.pc[i] || after.aside[i].exists !== before.aside[i].exists, + ) + 1; + +export const readerActions = ["Start", "Edit", "Note", "Stop", "KillNode"]; + +function context(v) { + if (v.pc.every((p) => p === "idle")) return "Before any run"; + if (going(v) === 2) return "Two runs going"; + return going(v) === 1 ? "One run going" : "Done"; +} + +const SPECS = { 1: "the spec", 2: "the edited spec", "1,2": "both specs" }; + +function contents(v) { + const kept = v.aside.filter((a) => a.exists); + const aside = kept.some((a) => a.notes) + ? ", your notes moved aside" + : kept.some((a) => a.by) + ? ", the old chart moved aside" + : ""; + const parts = [ + v.out.by && `chart of ${SPECS[v.out.read.join()]}`, + v.out.notes && "your notes", + ].filter(Boolean); + if (!v.out.exists) return `no folder${aside}`; + return `${parts.join(" and ") || "empty folder"}${aside}`; +} + +export function state(v) { + return `${context(v)}: ${contents(v)}`; +} + +export function group(v) { + if (v.pc.every((p) => p === "idle")) return "Not started"; + return going(v) ? "Running" : "Finished"; +} + +export function step(action, before, after) { + const r = changed(before, after); + switch (action) { + case "Start": { + const where = going(before) ? " in a second shell" : ""; + const how = after.inputOk[r - 1] ? "" : " with a typo"; + return `you start run ${r}${where}${how}`; + } + case "Refuse": + return before.inputOk[r - 1] + ? `run ${r} says the folder has a file that it did not write` + : `run ${r} says the input is wrong`; + case "Tlc": + return `run ${r}'s TLC reads the spec`; + case "Draw": + return `run ${r} draws the chart in its own folder`; + case "Stale": + return `run ${r} says the spec changed while it read it`; + case "Foreign": + return `run ${r} says the folder has a file that it did not write`; + case "Swap": + case "Checked": + return ""; + case "MoveIn": + return `run ${r} moves its folder into place`; + case "MoveAside": + return `run ${r} moves the old folder aside`; + case "Restore": + return `run ${r} puts the folder with your notes back and stops`; + case "Supersede": + return `run ${r} finds another run's folder in place and deletes the old folder`; + case "KeepAside": + return `run ${r} keeps the folder with your notes aside and says where`; + case "RenameFails": + if (after.aside[r - 1].exists) + return `run ${r} cannot rename a folder and says where the old folder is`; + return after.out.exists && !before.out.exists + ? `run ${r} cannot rename a folder, puts the old folder back, and stops` + : `run ${r} cannot rename a folder and stops`; + case "Clean": + return `run ${r} deletes the old folder and finishes`; + case "Edit": + return "you edit the spec"; + case "Note": + return "you save notes in the folder"; + case "Stop": + return `you stop run ${r} with Ctrl-C`; + case "KillNode": + return `you kill run ${r}'s Node, and its TLC keeps running`; + case "OrphanEnd": + return `run ${r}'s orphaned TLC finishes`; + default: + return action; + } +} + +export function cause(v, facts, invariant) { + return { + ChartsOneSpec: "the run read the spec before and after an edit, and still wrote its chart", + KeepsYourFiles: "a run deleted a folder that had your notes in it", + NeverLosesChart: "a run deleted the last chart before another chart was in place", + ExitTwoLeavesFolder: "a run wrote the folder and then said it could not finish", + OverlapNeverRefuses: "a run stopped only because another run overlapped it", + }[invariant]; +} diff --git a/plugins/pstack/skills/statechart/scripts/model/OutputFolder.tla b/plugins/pstack/skills/statechart/scripts/model/OutputFolder.tla new file mode 100644 index 0000000..7765bab --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/model/OutputFolder.tla @@ -0,0 +1,176 @@ +---- MODULE OutputFolder ---- +EXTENDS Naturals + +Runs == {1, 2} +NoRun == 0 +NoFolder == [exists |-> FALSE, by |-> NoRun, read |-> {}, notes |-> FALSE] + +VARIABLES pc, inputOk, snap, read, out, aside, spec, noted, wrote, broke, exitCode + +vars == <> + +Init == + /\ pc = [r \in Runs |-> "idle"] + /\ inputOk = [r \in Runs |-> TRUE] + /\ snap = [r \in Runs |-> 0] + /\ read = [r \in Runs |-> {}] + /\ out = NoFolder + /\ aside = [r \in Runs |-> NoFolder] + /\ spec = 1 + /\ noted = FALSE + /\ wrote = [r \in Runs |-> FALSE] + /\ broke = [r \in Runs |-> FALSE] + /\ exitCode = [r \in Runs |-> "none"] + +Set(f, r, v) == [f EXCEPT ![r] = v] +Going(r) == pc[r] \notin {"idle", "exited", "stopped", "orphanTlc"} +Go(r, to) == pc' = Set(pc, r, to) +Exit(r, code) == pc' = Set(pc, r, "exited") /\ exitCode' = Set(exitCode, r, code) + +Start(r) == + /\ pc[r] = "idle" + /\ r = 2 => pc[1] # "idle" + /\ \E ok \in BOOLEAN : inputOk' = Set(inputOk, r, ok) + /\ snap' = Set(snap, r, spec) + /\ Go(r, "check") + /\ UNCHANGED <> + +Refuse(r) == + /\ pc[r] = "check" + /\ ~inputOk[r] \/ out.notes + /\ Exit(r, "2") + /\ UNCHANGED <> + +Tlc(r) == + /\ \/ pc[r] = "check" /\ inputOk[r] /\ ~out.notes + \/ pc[r] = "tlc" + /\ read' = Set(read, r, read[r] \cup {spec}) + /\ Go(r, IF pc[r] = "check" THEN "tlc" ELSE "draw") + /\ UNCHANGED <> + +Draw(r) == + /\ pc[r] = "draw" + /\ Go(r, "publish") + /\ UNCHANGED <> + +Stale(r) == + /\ pc[r] = "publish" /\ spec # snap[r] + /\ Exit(r, "2") + /\ UNCHANGED <> + +Foreign(r) == + /\ pc[r] = "publish" /\ spec = snap[r] /\ out.notes + /\ Exit(r, "2") + /\ UNCHANGED <> + +Swap(r) == + /\ pc[r] = "publish" /\ spec = snap[r] /\ ~out.notes + /\ Go(r, "swap") + /\ UNCHANGED <> + +MoveIn(r) == + /\ pc[r] = "swap" /\ ~out.exists + /\ out' = [exists |-> TRUE, by |-> r, read |-> read[r], notes |-> FALSE] + /\ wrote' = Set(wrote, r, TRUE) + /\ Go(r, "clean") + /\ UNCHANGED <> + +MoveAside(r) == + /\ pc[r] = "swap" /\ out.exists /\ ~aside[r].exists + /\ aside' = Set(aside, r, out) + /\ out' = NoFolder + /\ Go(r, "aside") + /\ UNCHANGED <> + +Checked(r) == + /\ pc[r] = "aside" /\ ~aside[r].notes + /\ Go(r, "swap") + /\ UNCHANGED <> + +Supersede(r) == + /\ pc[r] = "swap" /\ out.exists /\ aside[r].exists /\ ~out.notes + /\ aside' = Set(aside, r, NoFolder) + /\ UNCHANGED <> + +Restore(r) == + /\ pc[r] = "aside" /\ aside[r].notes /\ ~out.exists + /\ out' = aside[r] + /\ aside' = Set(aside, r, NoFolder) + /\ Exit(r, "2") + /\ UNCHANGED <> + +KeepAside(r) == + /\ \/ pc[r] = "aside" /\ aside[r].notes /\ out.exists + \/ pc[r] = "swap" /\ aside[r].exists /\ out.notes + /\ Exit(r, "2") + /\ UNCHANGED <> + +RenameFails(r) == + /\ pc[r] \in {"swap", "aside"} + /\ \/ /\ aside[r].exists /\ ~out.exists + /\ out' = aside[r] + /\ aside' = Set(aside, r, NoFolder) + \/ UNCHANGED <> + /\ broke' = Set(broke, r, TRUE) + /\ Exit(r, "2") + /\ UNCHANGED <> + +Clean(r) == + /\ pc[r] = "clean" + /\ aside' = Set(aside, r, NoFolder) + /\ Exit(r, "0") + /\ UNCHANGED <> + +Stop(r) == + /\ Going(r) + /\ Go(r, "stopped") + /\ UNCHANGED <> + +KillNode(r) == + /\ pc[r] = "tlc" + /\ Go(r, "orphanTlc") + /\ UNCHANGED <> + +OrphanEnd(r) == + /\ pc[r] = "orphanTlc" + /\ Go(r, "stopped") + /\ UNCHANGED <> + +Edit == + /\ spec = 1 + /\ spec' = 2 + /\ UNCHANGED <> + +Note == + /\ ~noted + /\ noted' = TRUE + /\ out' = [out EXCEPT !.exists = TRUE, !.notes = TRUE] + /\ UNCHANGED <> + +Next == + \/ Edit \/ Note + \/ \E r \in Runs : + Start(r) \/ Refuse(r) \/ Tlc(r) \/ Draw(r) \/ Stale(r) \/ Foreign(r) \/ Swap(r) + \/ MoveIn(r) \/ MoveAside(r) \/ Checked(r) \/ Supersede(r) \/ Restore(r) + \/ KeepAside(r) \/ RenameFails(r) \/ Clean(r) \/ Stop(r) \/ KillNode(r) \/ OrphanEnd(r) + +Spec == Init /\ [][Next]_vars + +\* The folder never holds a chart drawn from two versions of the spec. +ChartsOneSpec == out.read \in {{}, {1}, {2}} + +\* A file that you put in the folder is never deleted. +KeepsYourFiles == noted => out.notes \/ \E r \in Runs : aside[r].notes + +\* Once a run writes a chart, the folder or a folder that a run moved aside always holds one. +NeverLosesChart == + (\E r \in Runs : wrote[r]) => out.by # NoRun \/ \E r \in Runs : aside[r].by # NoRun + +\* A run that exits 2 did not write the folder. +ExitTwoLeavesFolder == \A r \in Runs : exitCode[r] = "2" => ~wrote[r] + +\* A run exits 2 only for a wrong input, an edited spec, a file that it did not write, or a failed +\* rename, never because another run overlaps it. +OverlapNeverRefuses == + \A r \in Runs : exitCode[r] = "2" => ~inputOk[r] \/ spec # snap[r] \/ noted \/ broke[r] +==== diff --git a/plugins/pstack/skills/statechart/scripts/statechart.mjs b/plugins/pstack/skills/statechart/scripts/statechart.mjs new file mode 100644 index 0000000..6e2ebfc --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/statechart.mjs @@ -0,0 +1,749 @@ +#!/usr/bin/env node +import { spawnSync } from "node:child_process"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; +import process from "node:process"; +import { fileURLToPath, pathToFileURL } from "node:url"; +import { checkTlcOutput, findTlc, parseDot } from "./lib.mjs"; + +const here = path.dirname(fileURLToPath(import.meta.url)); + +const USAGE = { + "from-spec": + "node statechart.mjs from-spec SPEC.tla [--fixed FIXED.tla | --against AGREED.tla] [--label TEXT] [--map FILE] [--expect-broken RULE]... [--title TEXT] [--out DIR] [--png]", + "from-chart": + "node statechart.mjs from-chart CHART.mmd [--module NAME] [--expect-broken RULE]... [--title TEXT] [--out DIR] [--png]", +}; +const usage = (lines) => `Usage: ${lines.join("\n ")}`; + +const FROM_SPEC = `from-spec SPEC.tla + Checks each INVARIANT in SPEC.cfg in a separate TLC run. TLC stops at the first rule that a state + breaks, and the separate runs find the rest. Each run also has the rule as a CONSTRAINT, so TLC + stops each path at its first state that breaks the rule, and a rule that stays broken reports + only the step that broke it. SPEC.cfg sits next to the spec and has SPECIFICATION and one + INVARIANT line per rule. One more run dumps the state graph, and then the command draws the + charts. TLC names each step after the innermost named action that takes it, so give each kind of + step its own named action. The command warns when steps carry the name of the whole next-state + action. + + --fixed FIXED.tla The model of the open fix. It is a copy of the spec with its own file and + module name, such as SpecFixed.tla with MODULE SpecFixed. The command checks + it the same way, with FIXED.cfg, or with SPEC.cfg when there is no FIXED.cfg. + The charts then mark each bad state fixed or still wrong. + --against AGREED.tla + The spec that SPEC.tla must follow, when SPEC.tla models the code. It needs + its own file and module name. The command checks it with AGREED.cfg, or with + SPEC.cfg when there is no AGREED.cfg. SPEC.tla may add variables, record + fields, and actions that AGREED.tla does not have. The comparison leaves them + out. Do not use it with --fixed. + --label TEXT The name of the --fixed or --against model in the charts and the stories. + Default: "the fix", or "the spec". + --map FILE The labels for each model state and step. Default: SPEC.map.mjs next to the + spec. When the file does not exist, the command writes one to fill in and + exits 2. Its comments say what each function gets.`; + +const FROM_CHART = `from-chart CHART.mmd + Writes NAME.tla, NAME.cfg, and NAME.map.mjs next to the chart. When NAME.tla already exists, it + writes none of them. Then it checks the spec as from-spec does, and compares the chart that the + spec draws with CHART.mmd. + + --module NAME The TLA+ module name. Default: the chart's file name in CamelCase, such as + NotesApp for notes-app.mmd. + + The chart is a Mermaid stateDiagram-v2. Each transition label is one action. For parallel + regions, split one top-level composite with --, and put each part in a named composite, such as + state Connection { ... }. Each region is one variable. A step moves every region whose current + state has a transition with the step's label, and the other regions stay where they are. Each + rule is one comment line: + %% never NAME: A & B -- the rule in one sentence + Each name after the colon is a state caption or a composite, and each comes from a different + region. A composite stands for every state in it. The command refuses final, choice, fork, and + history states, and regions below the top level.`; + +const COMMON = `Both commands + --expect-broken RULE + A rule that is known to break. Repeat it, or list rules with commas, as in + A,B. The command then exits 0 when exactly these rules break, and the --fixed + or --against model breaks no other rule. + --title TEXT The chart title. Each bug chart adds ", bug N". + --out DIR The output folder. Default: NAME-statechart next to the input. A run writes its + files in a temporary folder, and then replaces the whole output folder with + it. When runs overlap, the output folder has the files of the run that + finished last. The command does not use an output folder that has files that + it did not write. + --png Also render each chart to PNG with npx @mermaid-js/mermaid-cli. + -h, --help Print this help, and exit 0. + +Output + The command prints whether each rule holds, the chart's counts, and one story per bug. + from-chart also prints the comparison. The command writes these files in the output folder: + chart.mmd The overview. + bug-N.mmd Only the steps of bug N, numbered. Bugs are numbered by fewest reader steps, + then fewest model steps, then rule name, then cause. Bugs that only the + --fixed or --against model has come last. + bug-N-developer.mmd, bug-N-layered.mmd + The path of bug N through the developer's states, when the mapping exports + detail(). + stories.md One entry per bug: the rule, why it breaks, the shortest path in reader + steps, and what the --fixed or --against model does instead. + summary.json The counts behind the chart. + tlc/ The config and the TLC output of each run. When the overview has regions, + from-spec also writes tlc/regions-all.mmd, the regions with every arrow, and + tlc/regions-proof.mmd, every state and step of TLC's graph in one region. + compare-charts.mjs tlc/regions-all.mmd tlc/regions-proof.mmd repeats the + proof. + *.png Each chart as a PNG, with --png. A run without --png deletes them. + +Reading a chart + from-spec draws the overview as two parallel regions when every state reads "context: progress": + the contexts on one side, the progress on the other, both at the same time. It does so only when + that has fewer states, and when the regions combine back into exactly every state and step of + TLC's graph. Otherwise it puts the states of one context in a box named context, and prints why. + Regions draw only the arrows of the shortest way to each state, of each bug path, and of the + nearest step with each label. The script checks that these arrows make no step that TLC's graph + does not have. + An arrow from a box's border leaves from every state in the box. + In regions, a step leaves every region that has it. "[when A]" or "[unless A]" says which states + of the other region the step needs. A loop says the region may also stay. + Other words in [ ] come from the mapping's guard(), and "after N s" from its timer(). TLC does + not check them, and has no clock, so a reviewer checks them against the code. + Gray states work. Red states break a rule. With --fixed, red states stay wrong with the fix, and + green states are fixed by it or exist only with it. With --against, red states break a rule in + either model, and green states exist only in the spec. + When the mapping exports group(), the fill is the state's group, which the legend names, and the + status is a thick red or green border on top. tlc-to-chart.mjs --help tells more. + A state is bad when it breaks a rule, or when every path from the start to it passes a state + that breaks one. TLC stops each path at the first state that breaks the rule, so a rule that + stays broken colors only the states where it first breaks and the states after them that no + path without a bug reaches. + A thick blue border and numbered labels mark the bug. Mermaid state diagrams cannot color an + edge. + A label "with the fix, STEP" or "in the spec, STEP" is a step that only the other model takes. On + a bug's path it leaves the state before the first step that the other model shows the reader + differently, and ends where that model goes instead. "with the fix, STEP cannot happen" or "in + the spec, STEP cannot happen" loops on the state where that model stops the step. Outside + regions, two states have at most one arrow between them. Its lines are the numbered steps, then + SPEC.tla's steps, then the other model's steps, with a blank line between each group. + An edge lists every step that takes it, most common first. Words that the steps share at the + start are written once, as in "you tap Pay or Back". + +Regenerate + With --expect-broken, one script rebuilds every chart and stops on any change: + set -e + node statechart.mjs from-spec Code.tla --against Agreed.tla --expect-broken NoLostUpload --png + +TLC + TLA2TOOLS is the path to tla2tools.jar, and JAVA is the java binary (default: java, Java 11 or + later). Download tla2tools.jar from https://github.com/tlaplus/tlaplus/releases. When TLA2TOOLS + is not set, the command says where to get TLC and exits 2. + +Exit codes + 0 Every rule holds, or exactly the --expect-broken rules break. from-chart also draws CHART.mmd + back unchanged. + 1 Another rule is broken, an expected rule holds, or the chart that the spec draws is not + CHART.mmd. The output says which. + 2 The command cannot finish: a bad argument, a missing file, a chart or TLC output that it + cannot read, no TLC, a helper script that cannot start, an output folder with files that the + command did not write, an input file that changed during the run, a new mapping to fill in, + or a chart that --png cannot render. When a chart does not render, the command keeps the + files it wrote and exits 2, whatever the rules give. Otherwise, exit 2 does not change the + output folder, unless the command moved it aside and cannot put it back. Then the message + names the folder's new path. When TLC stops on an error, the message names TLC's output, in a + temporary folder that the command keeps.`; + +const HELP = { + "": `${usage([...Object.values(USAGE), "node statechart.mjs [from-spec|from-chart] --help"])} + +Draws a Mermaid statechart of what an app's user sees, from TLC's state graph of a TLA+ spec. The +help calls that user the reader. + +${FROM_SPEC} + +${FROM_CHART} + +${COMMON}`, + "from-spec": `${usage([USAGE["from-spec"]])}\n\n${FROM_SPEC}\n\n${COMMON}`, + "from-chart": `${usage([USAGE["from-chart"]])}\n\n${FROM_CHART}\n\n${COMMON}`, +}; + +const more = (cmd) => + `Run node statechart.mjs ${cmd ? `${cmd} ` : ""}--help for the flags, the output, and the exit codes.`; + +class CannotFinish extends Error {} +class TlcStopped extends CannotFinish {} + +const COMMANDS = { + "from-spec": { + flags: ["--map", "--fixed", "--against", "--label", "--expect-broken", "--title", "--out"], + run: fromSpec, + }, + "from-chart": { flags: ["--module", "--expect-broken", "--title", "--out"], run: fromChart }, +}; + +function parseArgs([command, ...rest]) { + if (command === "-h" || command === "--help") return { help: HELP[""] }; + if (!Object.hasOwn(COMMANDS, command)) + throw new CannotFinish(`${usage(Object.values(USAGE))}\n${more()}`); + const flags = { "expect-broken": new Set() }; + let input; + for (let i = 0; i < rest.length; i++) { + const a = rest[i]; + if (a === "-h" || a === "--help") return { help: HELP[command] }; + if (a === "--png") flags.png = true; + else if (COMMANDS[command].flags.includes(a)) { + if (i + 1 === rest.length) throw new CannotFinish(`${a} needs a value. ${more(command)}`); + const name = a.slice(2); + if (flags[name] instanceof Set) for (const v of rest[++i].split(",")) flags[name].add(v); + else flags[name] = rest[++i]; + } else if (!a.startsWith("-") && input === undefined) input = a; + else throw new CannotFinish(`unknown argument ${a}. ${more(command)}`); + } + if (input === undefined) throw new CannotFinish(`${usage([USAGE[command]])}\n${more(command)}`); + return { command, input, flags }; +} + +const rel = (file) => path.relative(process.cwd(), file) || "."; +const cfgOf = (spec) => spec.replace(/\.tla$/, ".cfg"); + +function findTools() { + try { + return findTlc(); + } catch (e) { + throw new CannotFinish(e.message); + } +} + +function script(name, scriptArgs, about, { okExits = [0] } = {}) { + const r = spawnSync(process.execPath, [path.join(here, name), ...scriptArgs], { + encoding: "utf8", + }); + if (r.error) throw new CannotFinish(`cannot run ${name}: ${r.error.message}`); + if (okExits.includes(r.status)) return r; + const thrown = r.stderr.match(/^Error: (.*)$/m)?.[1]; + throw new CannotFinish(thrown ? `${rel(about)}: ${thrown}` : r.stderr.trim()); +} + +const KEYWORD = + /^(SPECIFICATION|INIT|NEXT|CONSTANTS?|INVARIANTS?|PROPERTY|PROPERTIES|SYMMETRY|VIEW|CONSTRAINTS?|ACTION_CONSTRAINTS?|CHECK_DEADLOCK|POSTCONDITION|ALIAS)$/; + +function splitRules(cfg) { + const words = cfg + .replace(/\(\*[^]*?\*\)/g, " ") + .replace(/\\\*.*/g, " ") + .split(/\s+/) + .filter(Boolean); + const kept = []; + const rules = []; + let section = ""; + for (const w of words) { + if (KEYWORD.test(w)) section = w; + if (!/^INVARIANTS?$/.test(section)) kept.push(KEYWORD.test(w) && kept.length ? `\n${w}` : w); + else if (w !== section && !rules.includes(w)) rules.push(w); + } + return { cfgWithoutRules: `${kept.join(" ")}\n`, rules }; +} + +function tlc(tools, spec, cfg, base, dump) { + fs.writeFileSync(`${base}.cfg`, cfg); + const metadir = fs.mkdtempSync(path.join(os.tmpdir(), "tlc-")); + // TLC writes the standard modules, such as Naturals.tla, to java.io.tmpdir under fixed names, + // so runs that share that folder can read a module while another run rewrites it. + const javaTmp = path.join(metadir, "tmp"); + fs.mkdirSync(javaTmp); + // -deadlock: a UI at rest has nothing left to do, which TLC would report as a deadlock. + const r = spawnSync( + tools.java, + [ + `-Djava.io.tmpdir=${javaTmp}`, + "-cp", + tools.jar, + "tlc2.TLC", + "-metadir", + metadir, + "-deadlock", + "-continue", + ...(dump ? ["-dump", "dot,actionlabels", path.resolve(dump)] : []), + "-config", + path.resolve(`${base}.cfg`), + path.basename(spec), + ], + { cwd: path.dirname(path.resolve(spec)), encoding: "utf8", maxBuffer: 1 << 30 }, + ); + fs.rmSync(metadir, { recursive: true, force: true }); + if (r.error) throw new CannotFinish(`cannot run TLC: ${r.error.message}`); + fs.writeFileSync(`${base}.out`, r.stdout); + try { + checkTlcOutput(r.stdout, `${base}.out`); + } catch (e) { + throw new TlcStopped(e.message); + } + return r.stdout; +} + +function warnUnnamedSteps(spec, cfg, dot) { + const text = fs + .readFileSync(spec, "utf8") + .replace(/\(\*[^]*?\*\)/g, " ") + .replace(/\\\*.*/g, " "); + const specName = /^SPECIFICATION\s+(\w+)/m.exec(cfg)?.[1]; + const specBody = specName && new RegExp(`^${specName}\\s*==(.*(\\n[ \\t]+.*)*)`, "m").exec(text); + const next = + /^NEXT\s+(\w+)/m.exec(cfg)?.[1] ?? /\[\]\s*\[\s*(\w+)\s*\]_/.exec(specBody?.[1] ?? text)?.[1]; + const graph = parseDot(fs.readFileSync(dot, "utf8")); + const unnamed = [...graph.edges, ...graph.loops].filter((e) => e.action === next).length; + if (unnamed > 0) + console.error( + `${rel(spec)}: ${unnamed} ${unnamed === 1 ? "step has" : "steps have"} the name ${next}, the whole next-state action, because TLC names a step after the innermost named action that takes it. If the reader must tell these steps apart, give each part of ${next} its own name, as in Pay == ... and ${next} == Pay \\/ Charge.`, + ); +} + +function readModel(spec, cfgFile) { + if (!fs.existsSync(spec)) throw new CannotFinish(`${rel(spec)} does not exist`); + if (!fs.existsSync(cfgFile)) + throw new CannotFinish( + `${rel(cfgFile)} does not exist. It needs SPECIFICATION and one INVARIANT line per rule.`, + ); + return { spec, cfgFile, ...splitRules(fs.readFileSync(cfgFile, "utf8")) }; +} + +function readInput(spec, expected) { + const model = readModel(spec, cfgOf(spec)); + const unknown = [...expected].filter((r) => !model.rules.includes(r)); + if (unknown.length) + throw new CannotFinish( + `--expect-broken ${unknown.join(", ")}: not a rule in ${rel(model.cfgFile)}, whose rules are ${model.rules.join(", ") || "none"}.`, + ); + return model; +} + +function check(tools, { spec, cfgFile, cfgWithoutRules, rules }, work, expected) { + const name = path.basename(spec, ".tla"); + const tlcDir = path.join(work, "tlc"); + const dot = path.join(tlcDir, `${name}.dot`); + tlc(tools, spec, cfgWithoutRules, path.join(tlcDir, name), dot); + warnUnnamedSteps(spec, cfgWithoutRules, dot); + console.log(`TLC on ${path.basename(spec)}:`); + if (rules.length === 0) + console.log(` ${path.basename(cfgFile)} has no INVARIANT, so no rule is checked.`); + // With -continue TLC reports every bad state. The CONSTRAINT stops each path at its first bad + // state, so a rule that stays broken reports only the step that broke it, not every later state. + const traces = rules.map((rule) => { + const file = path.join(tlcDir, `${name}-${rule}`); + const cfg = `${cfgWithoutRules}INVARIANT ${rule}\nCONSTRAINT ${rule}\n`; + const broken = /^Error: Invariant /m.test(tlc(tools, spec, cfg, file)); + console.log( + ` ${rule} ${broken ? (expected.has(rule) ? "is broken (expected)" : "is broken") : "holds"}.`, + ); + return { file: `${file}.out`, rule, broken }; + }); + return { spec, dot, traces, broken: traces.some((t) => t.broken) }; +} + +function rulesAsExpected(now, other, expected) { + const brokenIn = (m) => (m?.traces ?? []).filter((t) => t.broken).map((t) => t.rule); + if (expected.size === 0) return !now.broken && !other?.broken; + const unexpected = [...new Set([...brokenIn(now), ...brokenIn(other)])].filter( + (r) => !expected.has(r), + ); + const holds = [...expected].filter((r) => !brokenIn(now).includes(r)); + if (unexpected.length) console.log(`\nBroken but not expected: ${unexpected.join(", ")}.`); + if (holds.length) console.log(`\nExpected to break but holds: ${holds.join(", ")}.`); + if (!unexpected.length && !holds.length) + console.log(`\nBroken as expected: ${[...expected].join(", ")}.`); + return !unexpected.length && !holds.length; +} + +const SCAFFOLD = (name, graph) => { + const vars = Object.keys([...graph.nodes.values()][0]?.vars ?? {}); + const actions = [...new Set([...graph.edges, ...graph.loops].map((e) => e.action))].sort(); + return `// Chart labels for ${name}, for statechart.mjs. Write labels in plain words, not variable or action names. +// v, before, and after map each variable to its value. Strings, numbers, and booleans keep their kind. +// Sequences, tuples, and sets become arrays, indexed from 0. Records and functions become objects. +// Variables: ${vars.join(", ")}. + +// The actions the reader takes. facts.settled is true when only these are enabled, and the overview +// keeps the shortest path to each settled state, plus every bug path. +export const readerActions = []; + +// The label for one model state. facts.enabled is the set of actions the state enables, +// including steps that change no variable. Write it as "context: progress", such as +// "Offline: upload queued": the chart puts the states of one context in one box. +// Do not claim a result that a pending step can still change, such as "upload failed" while a +// retry is still queued. +export function state(v, facts) { + return JSON.stringify(v); +} + +// The names of the two parallel regions, when the overview draws them: contexts, then progress. +// export const regionNames = ["Network", "What happened to the file"]; + +// The group of one model state, in words the reader sees, such as "Upload done". The chart fills +// the states of one group with one color, and the legend names the groups. TLC still decides +// which states break a rule, and draws them with a thick red border on top of the group color. +// groupColors gives a group a light color. Groups without one take a palette color. +// export function group(v, facts) {} +// export const groupColors = { "Upload done": "#d1f2eb" }; + +// The label for one step. A step that leaves the reader in the same state is not drawn, +// unless the reader takes it on a bug path. "" draws no label, and a numbered bug step shows the action. +const STEPS = { +${actions.map((a) => `\t${a}: ${JSON.stringify(a)},`).join("\n")} +}; +export function step(action, before, after) { + return STEPS[action] ?? action; +} + +// When the step can happen, in plain words, such as "offline or disk full". The chart shows +// "step [words]". "" adds nothing. +// export function guard(action, before, after) {} + +// For a timer step, how many seconds the code waits, from the constant in the code. The chart +// shows "after N s, step". Return nothing for other steps. +// export function timer(action, before, after) {} + +// Why a bad state is bad, in words a product manager reads, such as "the laptop went offline, and +// the app drops an upload it cannot send". No variable, function, or event names. +// Counterexamples that break one rule with one cause are one bug, so two bugs that end on the +// same screen stay apart only if their causes differ. Return null to group by the end state. +// export function cause(v, facts, invariant) {} + +// The developer's words for one model state. With it, each bug is also drawn through these states. +// export function detail(v, facts) {} + +// The legend's words for each status, in place of the defaults. Group entries keep their names. +// export const legend = { works: "Works on main", wrong: "Wrong on main", fixed: "Fixed in the open PR" }; +`; +}; + +async function draw({ now, other, map, work, out, title, comparing }) { + const shown = published(work, out); + const mapping = await import(pathToFileURL(path.resolve(map)).href); + const from = ["--dot", now.dot, "--map", map, "--spec", now.spec]; + from.push(...now.traces.flatMap((t) => ["--traces", t.file])); + if (other) { + from.push(`--${other.role}-dot`, other.dot, "--spec", other.spec); + from.push(...other.traces.flatMap((t) => [`--${other.role}-traces`, t.file])); + if (other.label !== undefined) from.push("--label", other.label); + } + if (comparing) from.push("--full-labels", "--flat"); + else if (mapping.readerActions?.length) from.push("--cover"); + const titled = (suffix) => (title ? ["--title", `${title}${suffix}`] : []); + + const files = { + overview: path.join(work, "chart.mmd"), + stories: path.join(work, "stories.md"), + summary: path.join(work, "summary.json"), + }; + const proof = path.join(work, "tlc", "regions-proof.mmd"); + const everyArrow = path.join(work, "tlc", "regions-all.mmd"); + script( + "tlc-to-chart.mjs", + [ + ...from, + ...(comparing ? [] : ["--regions", "--proof", proof, "--regions-all", everyArrow]), + ...titled(""), + "--highlight", + "0", + "--out", + files.overview, + "--story", + files.stories, + "--summary", + files.summary, + ], + map, + ); + const summary = JSON.parse(fs.readFileSync(files.summary, "utf8")); + const charts = [files.overview]; + for (const c of summary.classes) { + const views = typeof mapping.detail === "function" ? ["", "-developer", "-layered"] : [""]; + for (const view of views) { + const file = path.join(work, `bug-${c.n}${view}.mmd`); + const shape = [...(view ? ["--view", view.slice(1)] : []), "--path-only"]; + script( + "tlc-to-chart.mjs", + [...from, ...shape, ...titled(`, bug ${c.n}`), "--highlight", String(c.n), "--out", file], + map, + ); + charts.push(file); + } + } + + const { works, wrong, fixed: fixedCount } = summary.chartStatus; + const L = summary.second?.label; + console.log( + `\nChart: ${summary.chartStates} states and ${summary.chartTransitions} transitions from ${summary.modelStates} model states.`, + ); + const r = summary.regions; + if (r?.drawn) + console.log( + `It has 2 parallel regions, of ${r.states[0]} and ${r.states[1]} states. Proof: their ${r.all} arrows together make exactly the ${r.flat.states} states and ${r.flat.transitions} labeled steps of ${shown(proof)}, and the ${r.transitions} drawn arrows make only steps among them. ${shown(everyArrow)} has all ${r.all} arrows.`, + ); + else if (r) console.log(`It has no parallel regions, because ${r.why}.`); + const breaks = `${wrong} ${wrong === 1 ? "breaks" : "break"} a rule`; + console.log( + other?.role === "fixed" + ? `${works} work today, ${wrong} still wrong with ${L}, ${fixedCount} fixed or new with ${L}.\n` + : other?.role === "against" + ? `${works} work, ${breaks}, ${fixedCount} only in ${L}.\n` + : `${works} work, ${breaks}.\n`, + ); + if (summary.codeLike.length) + console.log( + `These labels or causes read like code. Write them in the reader's words in ${rel(map)}:\n${summary.codeLike.map((t) => ` ${t}`).join("\n")}\n`, + ); + console.log( + summary.classes.length + ? fs.readFileSync(files.stories, "utf8").trimEnd() + : "No rule is broken.", + ); + return { files, charts }; +} + +function render(charts, shown) { + const pngs = []; + for (const chart of charts) { + const png = chart.replace(/\.mmd$/, ".png"); + const r = spawnSync( + "npx", + ["-y", "@mermaid-js/mermaid-cli", "-i", chart, "-o", png, "-s", "2"], + { + encoding: "utf8", + }, + ); + if (r.status === 0) pngs.push(png); + else + console.error( + `could not render ${shown(chart)}: ${(r.stderr || r.error?.message || "").trim()}`, + ); + } + return pngs; +} + +function finish({ work, out, inputs }, { files, charts }, ok, png) { + const pngs = png ? render(charts, published(work, out)) : []; + publish(work, out, inputs); + const written = [...charts, ...pngs, files.stories, files.summary] + .map((f) => path.basename(f)) + .join(", "); + console.log(`\nWrote ${written} in ${rel(out)}.`); + if (png && pngs.length < charts.length) return 2; + return ok ? 0 : 1; +} + +const published = (work, out) => (file) => rel(path.join(out, path.relative(work, file))); + +const OWN = + /^((chart|bug-\d+(-developer|-layered)?)\.(mmd|png)|stories\.md|summary\.json|tlc|\.DS_Store)$/; + +function foreign(dir) { + try { + return fs + .readdirSync(dir) + .filter((f) => !OWN.test(f)) + .sort(); + } catch (e) { + if (e.code === "ENOENT") return []; + throw new CannotFinish(`cannot use ${rel(dir)} as the output folder: ${e.message}`); + } +} + +function refuseForeign(out, files = foreign(out)) { + const [first, ...others] = files; + if (first) + throw new CannotFinish( + `${rel(out)} has ${others.length ? `${others.length + 1} files that this command did not write, such as ${first}` : `a file that this command did not write: ${first}`}. A run puts its files in place of the whole output folder, so pass --out with a new folder.`, + ); +} + +function outDir(flagged, input, name) { + const out = flagged ?? path.join(path.dirname(input), `${name}-statechart`); + refuseForeign(out); + return out; +} + +const fingerprint = (file) => { + try { + const { ino, ctimeNs } = fs.statSync(file, { bigint: true }); + return `${ino} ${ctimeNs} ${fs.readFileSync(file, "base64")}`; + } catch { + return null; + } +}; + +function snapshot(files, inputs = new Map()) { + for (const f of files) if (f && !inputs.has(f)) inputs.set(f, fingerprint(f)); + return inputs; +} + +async function inWorkFolder(body) { + const work = fs.mkdtempSync(path.join(os.tmpdir(), "statechart-")); + fs.mkdirSync(path.join(work, "tlc")); + let keep = false; + try { + return await body(work); + } catch (e) { + keep = e instanceof TlcStopped; + throw e; + } finally { + if (!keep) fs.rmSync(work, { recursive: true, force: true }); + } +} + +const moved = (from, to, ...missed) => { + try { + fs.renameSync(from, to); + return true; + } catch (e) { + if (missed.includes(e.code)) return false; + throw e; + } +}; + +function publish(work, out, inputs) { + const parent = path.dirname(path.resolve(out)); + fs.mkdirSync(parent, { recursive: true }); + const next = fs.mkdtempSync(path.join(parent, `.${path.basename(out)}-`)); + const old = `${next}-old`; + let aside = false; + try { + fs.cpSync(work, next, { recursive: true }); + const changed = [...inputs].find(([f, was]) => fingerprint(f) !== was)?.[0]; + if (changed) + throw new CannotFinish( + `${rel(changed)} changed while this run read it, so the run left ${rel(out)} as it was. Run the command again.`, + ); + refuseForeign(out); + while (!moved(next, out, "ENOTEMPTY", "EEXIST")) { + if (aside) { + refuseForeign(out); + fs.rmSync(old, { recursive: true, force: true }); + aside = false; + } + aside = moved(out, old, "ENOENT"); + if (aside) refuseForeign(out, foreign(old)); + } + } catch (e) { + const back = !aside || putBack(old, out); + fs.rmSync(next, { recursive: true, force: true }); + const why = e instanceof CannotFinish ? e.message : `cannot replace ${rel(out)}: ${e.message}.`; + if (!back) + throw new CannotFinish( + `${why} This run moved the previous ${rel(out)} to ${rel(old)} and could not put it back.`, + ); + throw e instanceof CannotFinish + ? e + : new CannotFinish(`${why} The run left ${rel(out)} as it was.`); + } + if (aside) fs.rmSync(old, { recursive: true, force: true }); +} + +function putBack(old, out) { + try { + return moved(old, out, "ENOTEMPTY", "EEXIST"); + } catch { + return false; + } +} + +function secondModel(input, { fixed, against, label }) { + if (fixed && against) + throw new CannotFinish(`use --fixed or --against, not both. ${more("from-spec")}`); + if (!fixed && !against) { + if (label === undefined) return null; + throw new CannotFinish( + `--label names the --fixed or --against model; it needs one of them. ${more("from-spec")}`, + ); + } + const [role, spec] = fixed ? ["fixed", fixed] : ["against", against]; + const name = path.basename(input, ".tla"); + // TLC's output files are named after the spec, so a second model with the same name overwrites them. + if (path.basename(spec, ".tla") === name) + throw new CannotFinish( + `${rel(spec)} needs its own file and module name, such as ${name}${fixed ? "Fixed" : "Agreed"}.tla.`, + ); + const cfg = fs.existsSync(cfgOf(spec)) ? cfgOf(spec) : cfgOf(input); + return { role, label, model: readModel(spec, cfg) }; +} + +async function fromSpec(input, { "expect-broken": expected, ...flags }) { + const name = path.basename(input, ".tla"); + const map = flags.map ?? path.join(path.dirname(input), `${name}.map.mjs`); + const secondSpec = flags.fixed ?? flags.against; + const inputs = snapshot([input, cfgOf(input), map, secondSpec, secondSpec && cfgOf(secondSpec)]); + const second = secondModel(input, flags); + const tools = findTools(); + const model = readInput(input, expected); + const out = outDir(flags.out, input, name); + return inWorkFolder(async (work) => { + const now = check(tools, model, work, expected); + if (!fs.existsSync(map)) { + fs.writeFileSync(map, SCAFFOLD(name, parseDot(fs.readFileSync(now.dot, "utf8")))); + throw new CannotFinish( + `\nWrote ${rel(map)}. Fill in its labels, then run this command again.`, + ); + } + const other = second && { + role: second.role, + label: second.label, + ...check(tools, second.model, work, expected), + }; + const drawn = await draw({ now, other, map, work, out, title: flags.title }); + return finish({ work, out, inputs }, drawn, rulesAsExpected(now, other, expected), flags.png); + }); +} + +async function fromChart(input, { "expect-broken": expected, ...flags }) { + const name = + flags.module ?? + path + .basename(input, path.extname(input)) + .replace(/(^|[^A-Za-z0-9]+)([A-Za-z0-9])/g, (_, __, c) => c.toUpperCase()); + if (!/^[A-Za-z][A-Za-z0-9_]*$/.test(name)) + throw new CannotFinish(`cannot make a TLA+ module name from ${input}; add --module NAME`); + const spec = path.join(path.dirname(input), `${name}.tla`); + const map = spec.replace(/\.tla$/, ".map.mjs"); + const inputs = snapshot([input]); + if (fs.existsSync(spec)) { + console.log(`Kept ${rel(spec)}. Delete it to write the spec again from ${rel(input)}.`); + } else { + script("chart-to-tla.mjs", [input, "--module", name], input); + console.log(`Wrote ${name}.tla, ${name}.cfg, and ${name}.map.mjs from ${rel(input)}.`); + } + snapshot([spec, cfgOf(spec), map], inputs); + const tools = findTools(); + const model = readInput(spec, expected); + const out = outDir(flags.out, input, name); + return inWorkFolder(async (work) => { + const now = check(tools, model, work, expected); + const drawn = await draw({ now, map, work, out, title: flags.title, comparing: true }); + const compared = script("compare-charts.mjs", [input, drawn.files.overview], input, { + okExits: [0, 1], + }); + if (compared.status === 0) console.log(`\nThe spec draws ${rel(input)} back unchanged.`); + else + console.log( + `\nThe spec does not draw ${rel(input)}:\n${compared.stdout.trimEnd().replace(/^/gm, " ")}`, + ); + return finish( + { work, out, inputs }, + drawn, + rulesAsExpected(now, null, expected) && compared.status === 0, + flags.png, + ); + }); +} + +try { + const { help, command, input, flags } = parseArgs(process.argv.slice(2)); + if (help) { + console.log(help); + process.exit(0); + } + process.exit(await COMMANDS[command].run(input, flags)); +} catch (e) { + if (!(e instanceof CannotFinish)) throw e; + console.error(e.message); + process.exit(2); +} diff --git a/plugins/pstack/skills/statechart/scripts/test/statechart.test.mjs b/plugins/pstack/skills/statechart/scripts/test/statechart.test.mjs new file mode 100644 index 0000000..a90c7e4 --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/test/statechart.test.mjs @@ -0,0 +1,2790 @@ +import assert from "node:assert/strict"; +import { spawn, spawnSync } from "node:child_process"; +import { + existsSync, + mkdirSync, + mkdtempSync, + readdirSync, + readFileSync, + rmSync, + writeFileSync, +} from "node:fs"; +import { tmpdir } from "node:os"; +import { delimiter, dirname, join } from "node:path"; +import { test } from "node:test"; +import { setTimeout as sleep } from "node:timers/promises"; +import { fileURLToPath } from "node:url"; +import { + checkTlcOutput, + findTlc, + parseDot, + parseMermaid, + parseTraces, + parseValue, + ruleSentences, + stateKey, +} from "../lib.mjs"; + +const here = dirname(fileURLToPath(import.meta.url)); +const scripts = dirname(here); +const fixture = (name) => readFileSync(join(here, name), "utf8"); +const edges = (r) => r.transitions.map((t) => `${t.from} -> ${t.to} : ${t.label}`).sort(); +const node = (script, args, cwd, env = {}) => + spawnSync(process.execPath, [join(scripts, script), ...args], { + cwd, + encoding: "utf8", + env: { ...process.env, ...env }, + timeout: 120_000, + }); + +test("a transition on a composite leaves from every state inside it", () => { + const { regions } = parseMermaid(fixture("upload.mmd")); + const main = regions.Main; + assert.deepEqual([...main.states].sort(), [ + "Nothing chosen", + "Upload failed", + "Uploaded", + "Uploading.Checking the file", + "Uploading.Sending the file", + ]); + assert.deepEqual([...main.initial], ["Nothing chosen"]); + assert.deepEqual(edges(main), [ + "Nothing chosen -> Uploading.Sending the file : you choose a file", + "Upload failed -> Uploading.Sending the file : you retry", + "Uploading.Checking the file -> Nothing chosen : you cancel", + "Uploading.Checking the file -> Upload failed : the network drops", + "Uploading.Checking the file -> Uploaded : the check passes", + "Uploading.Sending the file -> Nothing chosen : you cancel", + "Uploading.Sending the file -> Upload failed : the network drops", + "Uploading.Sending the file -> Uploading.Checking the file : the last byte arrives", + ]); +}); + +test("the deepest source wins when a composite and a state inside it share a label", () => { + const { regions } = parseMermaid(`stateDiagram-v2 + state Form { + [*] --> Typing + Typing --> Confirm : you press Escape + state Confirm + } + [*] --> Form + Form --> Closed : you press Escape + Confirm --> Closed : you press Escape`); + assert.deepEqual(edges(regions.Main), [ + "Form.Confirm -> Closed : you press Escape", + "Form.Typing -> Form.Confirm : you press Escape", + ]); +}); + +test("a top-level composite split by -- makes one region per part", () => { + const { regions, nevers } = parseMermaid(fixture("sync.mmd")); + assert.deepEqual(Object.keys(regions), ["Connection", "Sync badge"]); + assert.deepEqual(edges(regions["Sync badge"]), [ + "Synced -> Waiting to sync : the network drops", + "Synced -> Waiting to sync : you edit a note", + "Waiting to sync -> Synced : the server confirms", + ]); + assert.deepEqual(nevers, [ + { + name: "NeverSyncedWhileOffline", + states: ["Offline", "Synced"], + sentence: 'You never see "Synced" while you are offline.', + }, + ]); +}); + +test("a rule's sentence is the comment lines right above it, and a state key ignores field order", () => { + const sentences = ruleSentences(`---- MODULE M ---- +\\* Not about a rule. + +\\* You never see "Saved" +\\* while the note is a draft. +NoFalseSaved == TRUE +Bare == TRUE +====`); + assert.deepEqual( + [...sentences], + [["NoFalseSaved", 'You never see "Saved" while the note is a draft.']], + ); + assert.equal(stateKey({ b: 1, a: { d: 2, c: [3] } }), stateKey({ a: { c: [3], d: 2 }, b: 1 })); +}); + +test("the legend is not part of the machine", () => { + const { regions } = parseMermaid(`stateDiagram-v2 + state "Legend" as legend { + state "Works today" as legendWorks + } + [*] --> A + A --> B : go`); + assert.deepEqual([...regions.Main.states].sort(), ["A", "B"]); +}); + +test("the parser refuses charts it cannot read", () => { + assert.throws(() => parseMermaid("stateDiagram-v2\n state A {\n [*] --> B"), /unclosed/); + assert.throws(() => parseMermaid("stateDiagram-v2\n A ==> B"), /cannot read chart line/); + assert.throws( + () => parseMermaid("stateDiagram-v2\n state A {\n B --> C : go\n }\n [*] --> A"), + /no \[\*\] --> start/, + ); + assert.throws( + () => + parseMermaid( + "stateDiagram-v2\n state A {\n state B {\n [*] --> C\n --\n [*] --> D\n }\n [*] --> B\n }\n [*] --> A", + ), + /below the top level/, + ); + assert.throws( + () => parseMermaid("stateDiagram-v2\n [*] --> A\n A --> [*] : you close the app"), + /final state/, + ); + assert.throws( + () => + parseMermaid( + 'stateDiagram-v2\n state "Something went wrong" as UploadError\n state "Something went wrong" as SyncError\n [*] --> UploadError\n UploadError --> SyncError : go', + ), + /two states have the caption "Something went wrong"/, + ); +}); + +test("the parser reads class shorthand, repeated descriptions, and states first named inside a composite", () => { + const { regions } = parseMermaid(`stateDiagram-v2 + classDef wrong fill:#fdd + N : Nothing chosen + N : press Upload to start + [*] --> N + N:::wrong --> Done : you finish + Done --> Moving:::wrong + state A { + [*] --> X + X --> Y : go + } + Moving --> A : start + Y --> Z : next + A --> N : cancel`); + assert.deepEqual([...regions.Main.states].sort(), [ + "A.X", + "A.Y", + "Done", + "Moving", + "Nothing chosen", + "Z", + ]); + assert.deepEqual(edges(regions.Main), [ + "A.X -> A.Y : go", + "A.X -> Nothing chosen : cancel", + "A.Y -> Nothing chosen : cancel", + "A.Y -> Z : next", + "Done -> Moving : ", + "Moving -> A.X : start", + "Nothing chosen -> Done : you finish", + ]); +}); + +test("TLC values, states, graphs, and traces parse", () => { + assert.deepEqual(parseValue('[a |-> <<1, "x">>, b |-> {TRUE}]'), { a: [1, "x"], b: [true] }); + assert.deepEqual(parseValue('("p" :> 1 @@ "q" :> 2)'), { p: 1, q: 2 }); + const graph = parseDot(`strict digraph DiskGraph { +1 [label="/\\\\ x = 0",style = filled] +2 [label="/\\\\ x = 1"] +1 -> 2 [label="Inc",color="black",fontcolor="black"]; +1 -> 2 [label="Inc",color="black",fontcolor="black"]; +2 -> 2 [label="Stay"]; +}`); + assert.equal(graph.nodes.get("1").init, true); + assert.deepEqual(graph.nodes.get("2").vars, { x: 1 }); + assert.deepEqual(graph.edges, [{ from: "1", to: "2", action: "Inc" }]); + assert.deepEqual(graph.loops, [{ from: "2", to: "2", action: "Stay" }]); + assert.throws( + () => + parseDot( + 'strict digraph DiskGraph {\n1 [label="/\\\\ x = 0",style = filled]\n2 [label="/\\\\ x = 1"]\n1 -> 2;\n}', + ), + /no action names/, + ); + const [trace] = parseTraces(`Error: Invariant Small is violated. +Error: The behavior up to this point is: +State 1: +x = 0 + +State 2: +x = 1 +`); + assert.equal(trace.invariant, "Small"); + assert.deepEqual(trace.steps, [ + { action: null, vars: { x: 0 } }, + { action: "Inc", vars: { x: 1 } }, + ]); +}); + +const done = "Model checking completed. No error has been found.\n"; +const evaluationError = `Error: Invariant NoLost is violated. +Error: The behavior up to this point is: +State 1: +s = "Idle" + +State 2: +s = "Lost" + +Error: TLC threw an unexpected exception. +This was probably caused by an error in the spec or model. + +Error: The behavior up to this point is: +State 1: +s = "Idle" + +State 2: +s = "Saving" + +3 states generated, 3 distinct states found, 0 states left on queue. +`; + +test("a rule broken by a start state is a counterexample of one state", () => { + const text = `Error: Invariant NeverSyncedWhileOffline is violated by the initial state: +/\\ badge = "Synced" +/\\ conn = "Offline" + +${done}`; + assert.doesNotThrow(() => checkTlcOutput(text, "tlc.out")); + assert.deepEqual(parseTraces(text), [ + { + invariant: "NeverSyncedWhileOffline", + steps: [{ action: null, vars: { badge: "Synced", conn: "Offline" } }], + }, + ]); +}); + +test("TLC output from a run that failed or stopped early is refused", () => { + assert.doesNotThrow(() => + checkTlcOutput( + `Error: Invariant Small is violated.\nError: The behavior up to this point is:\nState 1: \nx = 0\n\n${done}`, + "ok.out", + ), + ); + assert.throws( + () => + checkTlcOutput( + "Error: The invariant Nope specified in the configuration file\nis not defined in the specification.\n", + "cfg.out", + ), + /cfg\.out: TLC stopped on an error that is not a broken rule/, + ); + assert.throws( + () => checkTlcOutput("Error: Parsing or semantic analysis failed.\n", "parse.out"), + /not a broken rule/, + ); + assert.throws( + () => checkTlcOutput(evaluationError, "eval.out"), + /TLC threw an unexpected exception/, + ); + assert.throws( + () => + checkTlcOutput( + "Error: Invariant Small is violated.\nError: The behavior up to this point is:\nState 1: \nx = 0\n", + "stopped.out", + ), + /did not finish/, + ); + assert.deepEqual( + parseTraces(evaluationError).map((t) => t.invariant), + ["NoLost", null], + ); +}); + +test("a step that changes nothing keeps a state unsettled, and a quote in a reader label survives the chart", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "save.dot"), + `strict digraph DiskGraph { +1 [label="/\\\\ s = \\"Idle\\"",style = filled] +2 [label="/\\\\ s = \\"Saving\\""] +1 -> 2 [label="Tap"]; +2 -> 2 [label="Retry"]; +}`, + ); + writeFileSync( + join(dir, "save.map.mjs"), + `export const readerActions = ["Tap"]; +export const state = (v, facts) => (v.s === "Idle" ? 'Badge says "Synced"' : facts.settled ? "Saved" : "Saving"); +export const step = (action) => ({ Tap: "you tap Save" })[action] ?? ""; +`, + ); + const r = node( + "tlc-to-chart.mjs", + ["--dot", "save.dot", "--map", "save.map.mjs", "--highlight", "0", "--out", "chart.mmd"], + dir, + ); + assert.equal(r.status, 0, r.stderr); + assert.deepEqual(edges(parseMermaid(readFileSync(join(dir, "chart.mmd"), "utf8")).regions.Main), [ + 'Badge says "Synced" -> Saving : you tap Save', + ]); +}); + +test("chart-to-tla writes one action per label and one invariant per never line", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "sync.mmd"), fixture("sync.mmd")); + const r = node("chart-to-tla.mjs", ["sync.mmd", "--module", "Sync"], dir); + assert.equal(r.status, 0, r.stderr); + const spec = readFileSync(join(dir, "Sync.tla"), "utf8"); + assert.match(spec, /^VARIABLES connection, syncBadge$/m); + assert.match( + spec, + /^TheNetworkDrops ==\n {4}\/\\ \(connection \\in \{"Online"\} \\\/ syncBadge \\in \{"Synced"\}\)$/m, + ); + assert.match( + spec, + /^NeverSyncedWhileOffline == ~\(connection = "Offline" \/\\ syncBadge = "Synced"\)$/m, + ); + assert.equal( + readFileSync(join(dir, "Sync.cfg"), "utf8"), + "SPECIFICATION Spec\nINVARIANT TypeOK\nINVARIANT NeverSyncedWhileOffline\n", + ); + assert.match(r.stderr, /rules TypeOK NeverSyncedWhileOffline/); +}); + +test("chart-to-tla refuses a never line that names no state", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "c.mmd"), + "stateDiagram-v2\n [*] --> A\n A --> B : go\n %% never Bad: C -- never C\n", + ); + const r = node("chart-to-tla.mjs", ["c.mmd", "--module", "C"], dir); + assert.notEqual(r.status, 0); + assert.match(r.stderr, /names "C", which is not a state/); +}); + +test("a never line names a state exactly, or every state inside a composite", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "c.mmd"), + `stateDiagram-v2 + state "Saving" as S + state "Saving..." as S2 + state Busy { + [*] --> Checking + Checking --> Sending : the check passes + } + [*] --> S + S --> S2 : you wait + S2 --> Busy : you send + Busy --> S : you cancel + %% never NoSaving: Saving -- You never see Saving. + %% never NoBusy: Busy -- You are never busy. +`, + ); + const r = node("chart-to-tla.mjs", ["c.mmd", "--module", "C"], dir); + assert.equal(r.status, 0, r.stderr); + const spec = readFileSync(join(dir, "C.tla"), "utf8"); + assert.match(spec, /^NoSaving == ~\(main = "Saving"\)$/m); + assert.match(spec, /^NoBusy == ~\(main \\in \{"Busy\.Checking", "Busy\.Sending"\}\)$/m); + assert.match( + readFileSync(join(dir, "C.map.mjs"), "utf8"), + /^export const readerActions = \[\];$/m, + ); +}); + +const door = `stateDiagram-v2 + state Door { + [*] --> Locked + Locked --> Unlocked : tap unlock + Unlocked --> Locked : tap lock + -- + [*] --> Closed + Closed --> Open : open the door + Open --> Closed : close the door + } + [*] --> Door`; +const flatDoor = (extra = []) => + [ + "stateDiagram-v2", + ' state "Locked | Closed" as L_C', + ' state "Locked | Open" as L_O', + ' state "Unlocked | Closed" as U_C', + ' state "Unlocked | Open" as U_O', + " [*] --> L_C", + " L_C --> U_C : tap unlock", + " U_C --> L_C : tap lock", + " L_O --> U_O : tap unlock", + " L_C --> L_O : open the door", + " L_O --> L_C : close the door", + " U_C --> U_O : open the door", + " U_O --> U_C : close the door", + ...extra, + ].join("\n"); + +test("compare reads parallel regions as one machine, so a guard across regions shows", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "agreed.mmd"), door); + writeFileSync(join(dir, "guarded.mmd"), flatDoor()); + writeFileSync(join(dir, "free.mmd"), flatDoor([" U_O --> L_O : tap lock"])); + const differ = node("compare-charts.mjs", ["agreed.mmd", "guarded.mmd"], dir); + assert.equal(differ.status, 1); + assert.match( + differ.stdout, + /transitions only in EXPECTED[^\n]*:\n {2}Unlocked \| Open --> Locked \| Open : tap lock\n1 difference\(s\)/, + ); + const same = node("compare-charts.mjs", ["agreed.mmd", "free.mmd"], dir); + assert.equal(same.stdout.trim(), "same", same.stdout); +}); + +const lamp = `stateDiagram-v2 + state "Lamp" as lamp { + state "Power" as power { + [*] --> Off + Off --> On : flip the switch + On --> Off : flip the switch + } + -- + state "Bulb" as bulb { + [*] --> Dark + Dark --> Lit : warm up [when the
power is on] + %% when On + Lit --> Dark : cool down [when the power is off] + %% when not On + } + } + %% never LitWhileOff: Off & Lit -- The bulb is never lit while the power is off. +`; + +test("a %% when line guards a step on the other region's states, and [words] are only its text", () => { + const { regions } = parseMermaid(lamp); + assert.deepEqual(regions.Bulb.transitions, [ + { from: "Dark", to: "Lit", label: "warm up", guard: { not: false, states: { Power: ["On"] } } }, + { + from: "Lit", + to: "Dark", + label: "cool down", + guard: { not: true, states: { Power: ["On"] } }, + }, + ]); + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "lamp.mmd"), lamp); + writeFileSync( + join(dir, "flat.mmd"), + [ + "stateDiagram-v2", + " [*] --> OD", + ' state "Off | Dark" as OD', + ' state "On | Dark" as ND', + ' state "On | Lit" as NL', + ' state "Off | Lit" as OL', + " OD --> ND : flip the switch", + " ND --> OD : flip the switch", + " ND --> NL : warm up", + " NL --> OL : flip the switch", + " OL --> NL : flip the switch", + " OL --> OD : cool down", + ].join("\n"), + ); + const same = node("compare-charts.mjs", ["lamp.mmd", "flat.mmd"], dir); + assert.equal(same.stdout, "same\n", same.stderr); + const tla = node("chart-to-tla.mjs", ["lamp.mmd", "--module", "Lamp"], dir); + assert.equal(tla.status, 0, tla.stderr); + const spec = readFileSync(join(dir, "Lamp.tla"), "utf8"); + assert.match(spec, /\(bulb = "Dark" \/\\ power = "On" \/\\ bulb' = "Lit"\)/); + assert.match(spec, /\(bulb = "Lit" \/\\ ~\(power = "On"\) \/\\ bulb' = "Dark"\)/); + + for (const [from, to, why] of [ + [ + " %% when On\n", + " state Glow\n %% when On\n", + /must come right after a transition/, + ], + [ + "warm up [when the
power is on]", + "warm up", + /must end its label with the guard's words in \[ \]/, + ], + [" %% when On\n", " %% when Nope\n", /names Nope, which is not a state id/], + [" %% when On\n", " %% when Lit\n", /names Lit, which is in the step's own region/], + ]) + assert.throws(() => parseMermaid(lamp.replace(from, to)), why); + assert.throws( + () => + parseMermaid( + "stateDiagram-v2\n [*] --> A\n A --> B : go [when C]\n %% when C\n B --> C : on\n", + ), + /the chart has none/, + ); + assert.deepEqual( + edges(parseMermaid("stateDiagram-v2\n [*] --> A\n A --> B : go [user away]\n").regions.Main), + ["A -> B : go"], + ); +}); + +const switchLamp = `stateDiagram-v2 + state "Lamp" as lamp { + state "Power" as power { + [*] --> Off + Off --> On : flip the switch + On --> Off : flip the switch + } + -- + state "Bulb" as bulb { + [*] --> Dark + Dark --> Lit : flip the switch [when the power is off] + %% when Off + Lit --> Dark : flip the switch + } + } +`; + +test("a label with a guarded and an unguarded move in one region writes both moves", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "switch.mmd"), switchLamp); + const r = node("chart-to-tla.mjs", ["switch.mmd", "--module", "Switch"], dir); + assert.equal(r.status, 0, r.stderr); + const spec = readFileSync(join(dir, "Switch.tla"), "utf8"); + assert.equal( + spec.slice(spec.indexOf("\\* flip the switch"), spec.indexOf("\nNext ==")), + `\\* flip the switch +FlipTheSwitch == + /\\ (power \\in {"Off", "On"} \\/ (bulb = "Dark" /\\ power = "Off") \\/ (bulb = "Lit")) + /\\ \\/ (power = "Off" /\\ power' = "On") + \\/ (power = "On" /\\ power' = "Off") + \\/ (power \\notin {"Off", "On"} /\\ UNCHANGED power) + /\\ \\/ (bulb = "Dark" /\\ power = "Off" /\\ bulb' = "Lit") + \\/ (bulb = "Lit" /\\ bulb' = "Dark") + \\/ (~((bulb = "Dark" /\\ power = "Off") \\/ (bulb = "Lit")) /\\ UNCHANGED bulb) +`, + ); +}); + +test("compare reads a one-region chart as the machine its steps reach, without steps that change nothing", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const drawn = + "stateDiagram-v2\n [*] --> Idle\n Idle --> Busy : start\n Busy --> Idle : finish\n"; + writeFileSync(join(dir, "drawn.mmd"), drawn); + writeFileSync(join(dir, "loop.mmd"), `${drawn} Idle --> Idle : refresh\n`); + writeFileSync(join(dir, "orphan.mmd"), `${drawn} Lost --> Idle : come back\n`); + const same = node("compare-charts.mjs", ["loop.mmd", "drawn.mmd"], dir); + assert.equal(same.status, 0); + assert.equal(same.stdout, "same\n"); + const orphan = node("compare-charts.mjs", ["orphan.mmd", "drawn.mmd"], dir); + assert.equal(orphan.status, 1); + assert.equal( + orphan.stdout, + "states the agreed chart's own steps never reach:\n Lost\n1 difference(s)\n", + ); +}); + +test("a -- outside a composite is refused, not read as one region", () => { + const split = + "stateDiagram-v2\n [*] --> Online\n Online --> Offline : the network drops\n --\n [*] --> Synced\n Synced --> Pending : you edit a note\n"; + assert.throws(() => parseMermaid(split), /-- outside a composite/); + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "split.mmd"), split); + writeFileSync(join(dir, "door.mmd"), door); + const tla = node("chart-to-tla.mjs", ["split.mmd", "--module", "Split"], dir); + assert.notEqual(tla.status, 0); + assert.match(tla.stderr, /-- outside a composite/); + for (const pair of [ + ["split.mmd", "split.mmd"], + ["door.mmd", "split.mmd"], + ["split.mmd", "door.mmd"], + ]) { + const r = node("compare-charts.mjs", pair, dir); + assert.equal(r.status, 2, pair.join(" ")); + assert.match(r.stderr, /^split\.mmd: the chart has -- outside a composite/); + } +}); + +test("compare refuses a chart it cannot read, or an ACTUAL chart that is not drawn for comparison", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "agreed.mmd"), door); + for (const pair of [ + ["agreed.mmd", "missing.mmd"], + ["missing.mmd", "agreed.mmd"], + ]) { + const r = node("compare-charts.mjs", pair, dir); + assert.equal(r.status, 2, pair.join(" ")); + assert.match(r.stderr, /^missing\.mmd: ENOENT/); + } + for (const [extra, why] of [ + [" U_O --> L_O : 1. tap lock", /--highlight 0/], + [ + " %% second model (against): the spec", + "actual.mmd: it has a second model; draw ACTUAL without --fixed-dot or --against-dot\n", + ], + [ + ' state "Locked" as g1 {\n state "Closed" as L_C2\n }', + "actual.mmd: it has boxes; draw ACTUAL with --flat\n", + ], + ]) { + writeFileSync(join(dir, "actual.mmd"), flatDoor([extra])); + const r = node("compare-charts.mjs", ["agreed.mmd", "actual.mmd"], dir); + assert.equal(r.status, 2, extra); + if (typeof why === "string") assert.equal(r.stderr, why); + else assert.match(r.stderr, why); + } +}); + +test("an edge lists every step, writes shared leading words once, and the chart renders at its natural width", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const nodes = [ + ["Home", 1], + ["Home", 2], + ["Home", 3], + ["Away", 1], + ["Away", 2], + ["Done", 1], + ].map( + ([s, n], i) => + `${i + 1} [label="/\\\\ s = \\"${s}\\"\\n/\\\\ n = ${n}"${i ? "" : ",style = filled"}]`, + ); + const steps = [ + "1 -> 4 TapPay", + "2 -> 5 TapBack", + "3 -> 4 TapHome", + "4 -> 1 OpenThread", + "5 -> 2 OpenApp", + "4 -> 6 Finish", + ]; + writeFileSync( + join(dir, "nav.dot"), + `strict digraph DiskGraph {\n${nodes.join("\n")}\n${steps.map((e) => e.replace(/ (\w+)$/, ' [label="$1"];')).join("\n")}\n}\n`, + ); + writeFileSync( + join(dir, "nav.map.mjs"), + `export const state = (v) => v.s; +export const step = (a) => ({ TapPay: "you tap Pay", TapBack: "you tap Back", TapHome: "you tap Home", OpenThread: "you open the thread", OpenApp: "you open the phone app", Finish: "" })[a]; +`, + ); + writeFileSync( + join(dir, "agreed.mmd"), + `stateDiagram-v2 + [*] --> Home + Home --> Away : you tap Pay + Home --> Away : you tap Back + Home --> Away : you tap Home + Away --> Home : you open the thread + Away --> Home : you open the phone app + Away --> Done +`, + ); + const draw = (...extra) => { + const r = node( + "tlc-to-chart.mjs", + [ + "--dot", + "nav.dot", + "--map", + "nav.map.mjs", + "--highlight", + "0", + "--out", + "chart.mmd", + ...extra, + ], + dir, + ); + assert.equal(r.status, 0, r.stderr); + return readFileSync(join(dir, "chart.mmd"), "utf8"); + }; + const chart = draw(); + assert.ok( + chart.startsWith( + "---\nconfig:\n markdownAutoWrap: false\n state:\n useMaxWidth: false\n---\nstateDiagram-v2\n", + ), + chart, + ); + const shortened = [ + "Away -> Done : ", + "Away -> Home : you open the thread or the phone app", + "Home -> Away : you tap Pay, Back, or Home", + ]; + assert.deepEqual(edges(parseMermaid(chart).regions.Main), shortened); + const crlf = chart.replace("---\n", "--- \n").replaceAll("\n", "\r\n"); + assert.deepEqual(edges(parseMermaid(crlf).regions.Main), shortened); + const refused = node("compare-charts.mjs", ["agreed.mmd", "chart.mmd"], dir); + assert.equal(refused.status, 2); + assert.match(refused.stderr, /draw ACTUAL with --full-labels/); + const full = draw("--full-labels"); + assert.match(full, /^stateDiagram-v2\n {2}%% labels in full\n/m); + assert.deepEqual(edges(parseMermaid(full).regions.Main), [ + "Away -> Done : ", + "Away -> Home : you open the thread or you open the phone app", + "Home -> Away : you tap Pay or you tap Back or you tap Home", + ]); + assert.equal(node("compare-charts.mjs", ["agreed.mmd", "chart.mmd"], dir).stdout, "same\n"); +}); + +const NO_TLC = `Cannot find TLC. Download tla2tools.jar from a TLA+ release: + https://github.com/tlaplus/tlaplus/releases +Then set TLA2TOOLS to the path of tla2tools.jar, and JAVA to a java binary (Java 11 or later). +`; +const FROM_SPEC_USAGE = + "node statechart.mjs from-spec SPEC.tla [--fixed FIXED.tla | --against AGREED.tla] [--label TEXT] [--map FILE] [--expect-broken RULE]... [--title TEXT] [--out DIR] [--png]"; +const FROM_CHART_USAGE = + "node statechart.mjs from-chart CHART.mmd [--module NAME] [--expect-broken RULE]... [--title TEXT] [--out DIR] [--png]"; +const noTlc = { TLA2TOOLS: "", JAVA: "" }; + +test("statechart.mjs writes the spec next to the chart, keeps it on the next run, and stops without TLC", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "notes-app.mmd"), fixture("sync.mmd")); + const first = node("statechart.mjs", ["from-chart", "notes-app.mmd"], dir, noTlc); + assert.equal(first.status, 2); + assert.equal( + first.stdout, + "Wrote NotesApp.tla, NotesApp.cfg, and NotesApp.map.mjs from notes-app.mmd.\n", + ); + assert.equal(first.stderr, NO_TLC); + assert.equal( + readFileSync(join(dir, "NotesApp.cfg"), "utf8"), + "SPECIFICATION Spec\nINVARIANT TypeOK\nINVARIANT NeverSyncedWhileOffline\n", + ); + const again = node("statechart.mjs", ["from-chart", "notes-app.mmd"], dir, noTlc); + assert.equal( + again.stdout, + "Kept NotesApp.tla. Delete it to write the spec again from notes-app.mmd.\n", + ); + const spec = node("statechart.mjs", ["from-spec", "NotesApp.tla"], dir, noTlc); + assert.equal(spec.status, 2); + assert.equal(spec.stderr, NO_TLC); + const missingJar = node("statechart.mjs", ["from-spec", "NotesApp.tla"], dir, { + TLA2TOOLS: "/nonexistent/tla2tools.jar", + }); + assert.equal(missingJar.status, 2); + assert.equal( + missingJar.stderr, + "TLA2TOOLS is /nonexistent/tla2tools.jar, which does not exist.\n", + ); +}); + +test("statechart.mjs writes no output folder when it refuses the input", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "tla2tools.jar"), ""); + writeFileSync(join(dir, "Pay.tla"), "---- MODULE Pay ----\n====\n"); + writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT Paid\n"); + writeFileSync(join(dir, "cart.mmd"), "stateDiagram-v2\n [*] --> Cart\n Cart --> Paid : pay\n"); + for (const args of [ + ["from-spec", "Pya.tla"], + ["from-spec", "Pay.tla", "--expect-broken", "Unpaid"], + ["from-spec", "Pay.tla", "--fixed", "PayFixd.tla"], + ["from-chart", "cart.mmd", "--expect-broken", "Unpaid"], + ]) { + const r = node("statechart.mjs", args, dir, { TLA2TOOLS: join(dir, "tla2tools.jar") }); + assert.equal(r.status, 2, r.stderr); + } + assert.deepEqual( + readdirSync(dir).filter((f) => f.endsWith("-statechart")), + [], + ); +}); + +test("statechart.mjs does not use an output folder that has files that it did not write", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "tla2tools.jar"), ""); + writeFileSync(join(dir, "Pay.tla"), "---- MODULE Pay ----\n====\n"); + writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\n"); + const env = { TLA2TOOLS: join(dir, "tla2tools.jar") }; + const cwd = node("statechart.mjs", ["from-spec", "Pay.tla", "--out", "."], dir, env); + assert.equal(cwd.status, 2); + assert.equal( + cwd.stderr, + ". has 3 files that this command did not write, such as Pay.cfg. A run puts its files in place of the whole output folder, so pass --out with a new folder.\n", + ); + const out = join(dir, "Pay-statechart"); + mkdirSync(join(out, "tlc"), { recursive: true }); + writeFileSync(join(out, "chart.mmd"), "kept\n"); + writeFileSync(join(out, ".DS_Store"), ""); + writeFileSync(join(out, "notes.md"), "mine\n"); + const notes = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, env); + assert.equal(notes.status, 2); + assert.equal( + notes.stderr, + "Pay-statechart has a file that this command did not write: notes.md. A run puts its files in place of the whole output folder, so pass --out with a new folder.\n", + ); + assert.deepEqual(readdirSync(dir).sort(), [ + "Pay-statechart", + "Pay.cfg", + "Pay.tla", + "tla2tools.jar", + ]); + assert.deepEqual(readdirSync(out).sort(), [".DS_Store", "chart.mmd", "notes.md", "tlc"]); + assert.equal(readFileSync(join(out, "chart.mmd"), "utf8"), "kept\n"); +}); + +test("statechart.mjs exits 2 and names a helper script that cannot start", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "notes-app.mmd"), fixture("sync.mmd")); + writeFileSync(join(dir, "no-node.cjs"), 'process.execPath = "/nonexistent/node";\n'); + const r = node("statechart.mjs", ["from-chart", "notes-app.mmd"], dir, { + NODE_OPTIONS: `--require ${join(dir, "no-node.cjs")}`, + }); + assert.equal(r.status, 2, r.stderr); + assert.match(r.stderr, /chart-to-tla\.mjs/); +}); + +test("statechart.mjs names the chart it refuses and the argument it does not know", () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "c.mmd"), + "stateDiagram-v2\n [*] --> A\n A --> B : go\n %% never Bad: C -- never C\n", + ); + const refused = node("statechart.mjs", ["from-chart", "c.mmd"], dir); + assert.equal(refused.status, 2); + assert.equal(refused.stdout, ""); + assert.equal(refused.stderr, 'c.mmd: never line names "C", which is not a state in the chart\n'); + const unknown = node("statechart.mjs", ["from-chart", "c.mmd", "--fixed", "CFixed.tla"], dir); + assert.equal(unknown.status, 2); + assert.equal( + unknown.stderr, + "unknown argument --fixed. Run node statechart.mjs from-chart --help for the flags, the output, and the exit codes.\n", + ); + const sameName = node("statechart.mjs", ["from-spec", "C.tla", "--fixed", "fix/C.tla"], dir); + assert.equal(sameName.status, 2); + assert.equal( + sameName.stderr, + "fix/C.tla needs its own file and module name, such as CFixed.tla.\n", + ); + const sameAgreed = node("statechart.mjs", ["from-spec", "C.tla", "--against", "a/C.tla"], dir); + assert.equal( + sameAgreed.stderr, + "a/C.tla needs its own file and module name, such as CAgreed.tla.\n", + ); + for (const [extra, stderr] of [ + [ + ["--fixed", "F.tla", "--against", "A.tla"], + "use --fixed or --against, not both. Run node statechart.mjs from-spec --help for the flags, the output, and the exit codes.\n", + ], + [ + ["--label", "the new build"], + "--label names the --fixed or --against model; it needs one of them. Run node statechart.mjs from-spec --help for the flags, the output, and the exit codes.\n", + ], + ]) { + const r = node("statechart.mjs", ["from-spec", "C.tla", ...extra], dir); + assert.equal(r.status, 2, extra.join(" ")); + assert.equal(r.stderr, stderr); + } + const valueless = node("statechart.mjs", ["from-chart", "c.mmd", "--out"], dir); + assert.equal(valueless.status, 2); + assert.equal( + valueless.stderr, + "--out needs a value. Run node statechart.mjs from-chart --help for the flags, the output, and the exit codes.\n", + ); + const bare = node("statechart.mjs", [], dir); + assert.equal(bare.status, 2); + assert.equal( + bare.stderr, + `Usage: ${FROM_SPEC_USAGE} + ${FROM_CHART_USAGE} +Run node statechart.mjs --help for the flags, the output, and the exit codes. +`, + ); +}); + +test("every script prints its help with -h or --help, and points at it for an argument it does not know", () => { + const help = { + "statechart.mjs": [[], `Usage: ${FROM_SPEC_USAGE}`], + "statechart.mjs from-spec": [["from-spec"], `Usage: ${FROM_SPEC_USAGE}`], + "statechart.mjs from-chart": [["from-chart", "notes-app.mmd"], `Usage: ${FROM_CHART_USAGE}`], + "chart-to-tla.mjs": [[], "Usage: node chart-to-tla.mjs CHART.mmd --module NAME [--dir OUT]"], + "tlc-to-chart.mjs": [[], "Usage: node tlc-to-chart.mjs --dot FILE --map FILE [options]"], + "compare-charts.mjs": [[], "Usage: node compare-charts.mjs EXPECTED.mmd ACTUAL.mmd"], + }; + for (const [name, [before, usage]] of Object.entries(help)) { + const script = name.split(" ")[0]; + for (const flag of ["-h", "--help"]) { + const r = node(script, [...before, flag], here); + assert.equal(r.status, 0, `${name} ${flag}`); + assert.equal(r.stderr, ""); + assert.equal(r.stdout.split("\n")[0], usage); + assert.match(r.stdout, /\nExit codes\n {2}0 .*\n(.*\n)* {2}1 .*\n(.*\n)* {2}2 /); + } + } + const top = node("statechart.mjs", ["--help"], here).stdout.split("\n"); + assert.equal(top[1], ` ${FROM_CHART_USAGE}`); + assert.equal(top[2], " node statechart.mjs [from-spec|from-chart] --help"); + for (const flag of [ + "--fixed FIXED.tla", + "--label TEXT", + "--map FILE", + "--module NAME", + "--title TEXT", + "--out DIR", + "--png", + "-h, --help", + ]) + assert.ok( + top.some((l) => l.startsWith(` ${flag} `)), + flag, + ); + for (const [script, args, stderr] of [ + [ + "statechart.mjs", + ["from-spec", "--nope"], + "unknown argument --nope. Run node statechart.mjs from-spec --help for the flags, the output, and the exit codes.\n", + ], + [ + "chart-to-tla.mjs", + ["--nope"], + "unknown argument --nope. Run node chart-to-tla.mjs --help for the flags.\n", + ], + [ + "tlc-to-chart.mjs", + ["--nope"], + "unknown argument --nope. Run node tlc-to-chart.mjs --help for the flags.\n", + ], + [ + "tlc-to-chart.mjs", + ["--dot", "a.dot", "--map", "a.map.mjs", "--regions"], + "--regions draws the whole customer chart: use --highlight 0, without --flat or --path-only. Run node tlc-to-chart.mjs --help for the flags.\n", + ], + [ + "tlc-to-chart.mjs", + ["--dot", "a.dot", "--map", "a.map.mjs", "--proof", "p.mmd"], + "--proof writes the regions proof; it needs --regions. Run node tlc-to-chart.mjs --help for the flags.\n", + ], + [ + "compare-charts.mjs", + ["--nope"], + "unknown argument --nope. Run node compare-charts.mjs --help for the flags.\n", + ], + ]) { + const r = node(script, args, here); + assert.equal(r.status, 2, script); + assert.equal(r.stdout, ""); + assert.equal(r.stderr, stderr); + } +}); + +const tools = (() => { + try { + return findTlc(); + } catch { + return null; + } +})(); +const needsTlc = { skip: tools ? false : "cannot find TLC" }; + +function tlc(dir, name) { + const r = spawnSync( + tools.java, + [ + "-cp", + tools.jar, + "tlc2.TLC", + "-metadir", + mkdtempSync(join(tmpdir(), "tlc-")), + "-deadlock", + "-continue", + "-dump", + "dot,actionlabels", + `${name}.dot`, + "-config", + `${name}.cfg`, + `${name}.tla`, + ], + { cwd: dir, encoding: "utf8" }, + ); + writeFileSync(join(dir, `${name}.out`), r.stdout); + return r; +} + +test("from-chart checks the agreed chart and draws it back unchanged", needsTlc, () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "upload.mmd"), fixture("upload.mmd")); + const r = node("statechart.mjs", ["from-chart", "upload.mmd"], dir); + assert.equal(r.status, 0, r.stderr); + assert.equal( + r.stdout, + `Wrote Upload.tla, Upload.cfg, and Upload.map.mjs from upload.mmd. +TLC on Upload.tla: + TypeOK holds. + +Chart: 5 states and 8 transitions from 5 model states. +5 work, 0 break a rule. + +No rule is broken. + +The spec draws upload.mmd back unchanged. + +Wrote chart.mmd, stories.md, summary.json in Upload-statechart. +`, + ); + assert.equal(r.stderr, ""); +}); + +test("TLC reads a label with a guarded and an unguarded move in one region", needsTlc, () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "switch.mmd"), switchLamp); + const r = node("statechart.mjs", ["from-chart", "switch.mmd"], dir); + assert.equal(r.status, 0, r.stdout + r.stderr); + assert.match(r.stdout, /\nThe spec draws switch\.mmd back unchanged\.\n/); +}); + +const syncStory = `## 1. Offline | Synced + +Rule broken: You never see "Synced" while you are offline. +This is the only way to get here in the model. + +0. Start: Online | Synced +1. The network drops. Now: Offline | Waiting to sync +2. The server confirms. Now: Offline | Synced +`; + +test("from-chart finds the design bug, and from-spec with the fix marks it fixed", needsTlc, () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "sync.mmd"), fixture("sync.mmd")); + const today = node("statechart.mjs", ["from-chart", "sync.mmd"], dir); + assert.equal(today.status, 1, today.stderr); + assert.equal( + today.stdout, + `Wrote Sync.tla, Sync.cfg, and Sync.map.mjs from sync.mmd. +TLC on Sync.tla: + TypeOK holds. + NeverSyncedWhileOffline is broken. + +Chart: 4 states and 8 transitions from 4 model states. +3 work, 1 breaks a rule. + +${syncStory} +The spec draws sync.mmd back unchanged. + +Wrote chart.mmd, bug-1.mmd, stories.md, summary.json in Sync-statechart. +`, + ); + assert.match( + readFileSync(join(dir, "Sync-statechart", "bug-1.mmd"), "utf8"), + /: 2\. the server confirms\n/, + ); + + const spec = readFileSync(join(dir, "Sync.tla"), "utf8"); + const guarded = spec + .replace("TheServerConfirms ==\n", 'TheServerConfirms ==\n /\\ connection = "Online"\n') + .replace("MODULE Sync", "MODULE SyncFixed"); + assert.notEqual(guarded, spec); + writeFileSync(join(dir, "SyncFixed.tla"), guarded); + const fixed = node("statechart.mjs", ["from-spec", "Sync.tla", "--fixed", "SyncFixed.tla"], dir); + assert.equal(fixed.status, 1, fixed.stderr); + assert.equal( + fixed.stdout, + `TLC on Sync.tla: + TypeOK holds. + NeverSyncedWhileOffline is broken. +TLC on SyncFixed.tla: + TypeOK holds. + NeverSyncedWhileOffline holds. + +Chart: 4 states and 9 transitions from 4 model states. +3 work today, 0 still wrong with the fix, 1 fixed or new with the fix. + +${syncStory} +With the fix, step 2 (the server confirms) cannot happen, so you stay at: Offline | Waiting to sync. + +Wrote chart.mmd, bug-1.mmd, stories.md, summary.json in Sync-statechart. +`, + ); + const summary = JSON.parse(readFileSync(join(dir, "Sync-statechart", "summary.json"), "utf8")); + assert.deepEqual(summary.chartStatus, { works: 3, wrong: 0, fixed: 1 }); + assert.equal(summary.classes[0].fix, "Offline | Waiting to sync"); + + const map = readFileSync(join(dir, "Sync.map.mjs"), "utf8"); + writeFileSync(join(dir, "Sync.map.mjs"), `${map}export const group = () => "Your notes";\n`); + const grouped = node( + "statechart.mjs", + ["from-spec", "Sync.tla", "--fixed", "SyncFixed.tla"], + dir, + ); + assert.equal(grouped.status, 1, grouped.stderr); + const lines = readFileSync(join(dir, "Sync-statechart", "chart.mmd"), "utf8").split("\n"); + assert.deepEqual( + lines.filter((l) => /^ {2}(classDef|class) |legend/.test(l)), + [ + " classDef plainFixed fill:#f4f6f7,stroke:#1e8449,stroke-width:4px,color:#145a32", + " classDef group0 fill:#d6eaf8,stroke:#6b757c,color:#1b2631", + " classDef group0Fixed fill:#d6eaf8,stroke:#1e8449,stroke-width:4px,color:#145a32", + ' state "Legend" as legend {', + ' state "Your notes" as legendGroup0', + ' state "Fixed or new with the fix" as legendFixed', + " class legendGroup0 group0", + " class legendFixed plainFixed", + " class s0 group0Fixed", + " class s1 group0", + " class s2 group0", + " class s3 group0", + ], + ); + writeFileSync(join(dir, "Sync.map.mjs"), map); + + writeFileSync(join(dir, "Sync.tla"), guarded.replace("MODULE SyncFixed", "MODULE Sync")); + const coded = node("statechart.mjs", ["from-chart", "sync.mmd"], dir); + assert.equal(coded.status, 1, coded.stderr); + assert.equal( + coded.stdout, + `Kept Sync.tla. Delete it to write the spec again from sync.mmd. +TLC on Sync.tla: + TypeOK holds. + NeverSyncedWhileOffline holds. + +Chart: 3 states and 5 transitions from 3 model states. +3 work, 0 break a rule. + +No rule is broken. + +The spec does not draw sync.mmd: + states only in EXPECTED (no path from the start reaches them in the spec, or the spec renamed them): + Offline | Synced + transitions only in EXPECTED (a guard in the spec blocks them, or the spec renamed the step): + Offline | Synced --> Offline | Waiting to sync : the network drops + Offline | Synced --> Offline | Waiting to sync : you edit a note + Offline | Synced --> Online | Synced : the network returns + Offline | Waiting to sync --> Offline | Synced : the server confirms + 5 difference(s) + +Wrote chart.mmd, stories.md, summary.json in Sync-statechart. +`, + ); + assert.deepEqual(readdirSync(join(dir, "Sync-statechart")).sort(), [ + "chart.mmd", + "stories.md", + "summary.json", + "tlc", + ]); +}); + +test( + "--png exits 2 unless every chart renders, even with --expect-broken, and keeps the files it wrote", + needsTlc, + () => { + const args = ["from-chart", "sync.mmd", "--expect-broken", "NeverSyncedWhileOffline", "--png"]; + const bin = mkdtempSync(join(tmpdir(), "fake-npx-")); + const launch = "Error: Failed to launch the browser process!"; + writeFileSync( + join(bin, "npx"), + `#!/bin/sh +while [ $# -gt 0 ]; do + case "$1" in -i) chart=$2 ;; -o) png=$2 ;; esac + shift +done +for c in $UNRENDERED; do + case "$chart" in */$c.mmd) echo "${launch}" >&2; exit 1 ;; esac +done +echo png > "$png" +`, + { mode: 0o755 }, + ); + for (const [unrendered, status, written] of [ + ["chart bug-1", 2, ["chart.mmd", "bug-1.mmd"]], + ["bug-1", 2, ["chart.mmd", "bug-1.mmd", "chart.png"]], + ["", 0, ["chart.mmd", "bug-1.mmd", "chart.png", "bug-1.png"]], + ]) { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "sync.mmd"), fixture("sync.mmd")); + const r = node("statechart.mjs", args, dir, { + PATH: `${bin}${delimiter}${process.env.PATH}`, + UNRENDERED: unrendered, + }); + assert.equal(r.status, status, `${unrendered}: ${r.stdout}${r.stderr}`); + assert.equal( + r.stderr, + unrendered + .split(" ") + .filter(Boolean) + .map((c) => `could not render Sync-statechart/${c}.mmd: ${launch}\n`) + .join(""), + ); + assert.match(r.stdout, /\nBroken as expected: NeverSyncedWhileOffline\.\n/); + assert.equal( + r.stdout.split("\n").at(-2), + `Wrote ${[...written, "stories.md", "summary.json"].join(", ")} in Sync-statechart.`, + ); + assert.deepEqual( + readdirSync(join(dir, "Sync-statechart")).sort(), + [...written, "stories.md", "summary.json", "tlc"].sort(), + ); + } + }, +); + +const pay = (name, charge) => `---- MODULE ${name} ---- +EXTENDS Naturals +VARIABLES screen, charges +vars == <> +Init == screen = "Cart" /\\ charges = 0 +Pay == screen = "Cart" /\\ screen' = "Paying" /\\ UNCHANGED charges +Charge == ${charge} +Refund == charges = 2 /\\ charges' = 1 /\\ screen' = "Refunded" +Next == Pay \\/ Charge \\/ Refund +Spec == Init /\\ [][Next]_vars +NoDoubleCharge == charges <= 1 +==== +`; +const payMap = `export const readerActions = ["Pay"]; +export const state = (v) => v.screen + ["", ", charged", ", charged twice"][v.charges]; +export const step = (action) => ({ Pay: "you pay", Charge: "the bank charges you", Refund: "the bank refunds you" })[action] ?? ""; +export const cause = () => "each charge request charges again"; +`; + +test( + "a state reached only after a bug takes the bug's color, and the fix edge leaves the state before the changed step", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const cfg = "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n"; + writeFileSync( + join(dir, "Pay.tla"), + pay( + "Pay", + `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`, + ), + ); + writeFileSync( + join(dir, "PayFixed.tla"), + pay( + "PayFixed", + `screen = "Paying" /\\ charges < 2 /\\ IF charges = 0 THEN charges' = 1 /\\ UNCHANGED screen ELSE screen' = "Paid" /\\ UNCHANGED charges`, + ), + ); + writeFileSync(join(dir, "Pay.cfg"), cfg); + writeFileSync(join(dir, "PayFixed.cfg"), cfg); + writeFileSync(join(dir, "pay.map.mjs"), payMap); + assert.match(tlc(dir, "Pay").stdout, /Invariant NoDoubleCharge is violated/); + assert.doesNotMatch(tlc(dir, "PayFixed").stdout, /is violated/); + + const statusOf = (chart) => { + const names = new Map( + [...chart.matchAll(/^ {2}state "([^"]+)" as (s\d+)$/gm)].map((m) => [ + m[2], + m[1].replace(//g, " "), + ]), + ); + return Object.fromEntries( + [...chart.matchAll(/^ {2}class (s\d+) (\w+)$/gm)].map((m) => [names.get(m[1]), m[2]]), + ); + }; + const args = [ + "--dot", + "Pay.dot", + "--map", + "pay.map.mjs", + "--traces", + "Pay.out", + "--highlight", + "0", + "--out", + "chart.mmd", + ]; + assert.equal(node("tlc-to-chart.mjs", args, dir).status, 0); + assert.deepEqual(statusOf(readFileSync(join(dir, "chart.mmd"), "utf8")), { + Cart: "works", + Paying: "works", + "Paying, charged": "works", + "Paying, charged twice": "wrong", + "Refunded, charged": "wrong", + }); + + const withFix = [...args, "--fixed-dot", "PayFixed.dot", "--fixed-traces", "PayFixed.out"]; + assert.equal(node("tlc-to-chart.mjs", withFix, dir).status, 0); + const chart = readFileSync(join(dir, "chart.mmd"), "utf8"); + assert.deepEqual(statusOf(chart), { + Cart: "works", + "Paid, charged": "fixed", + Paying: "works", + "Paying, charged": "works", + "Paying, charged twice": "fixed", + "Refunded, charged": "fixed", + }); + assert.deepEqual( + [...chart.matchAll(/^ {4}state "([^"]+)" as legend\w+$/gm)].map((m) => m[1]), + ["Works today", "Fixed or new with the fix"], + ); + assert.match(chart, /^stateDiagram-v2\n {2}%% second model \(fix\): the fix\n/m); + const fixEdges = parseMermaid(chart).regions.Main.transitions.filter((t) => + t.label.startsWith("with the fix, "), + ); + assert.deepEqual( + fixEdges.map((t) => `${t.from} --> ${t.to} : ${t.label}`), + ["Paying, charged --> Paid, charged : with the fix, the bank charges you"], + ); + }, +); + +test( + "from-spec writes a mapping to fill in, then draws each bug in every view the mapping has", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "Pay.tla"), + pay( + "Pay", + `screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED screen`, + ), + ); + writeFileSync( + join(dir, "Pay.cfg"), + "SPECIFICATION Spec\n\\* The reader's rule.\nINVARIANTS\n NoDoubleCharge\n", + ); + const first = node("statechart.mjs", ["from-spec", "Pay.tla"], dir); + assert.equal(first.status, 2); + assert.equal(first.stdout, "TLC on Pay.tla:\n NoDoubleCharge is broken.\n"); + assert.equal( + first.stderr, + "\nWrote Pay.map.mjs. Fill in its labels, then run this command again.\n", + ); + const scaffold = readFileSync(join(dir, "Pay.map.mjs"), "utf8"); + assert.match(scaffold, /^\/\/ Variables: screen, charges\.$/m); + assert.match( + scaffold, + /^const STEPS = \{\n\tCharge: "Charge",\n\tPay: "Pay",\n\tRefund: "Refund",\n\};$/m, + ); + assert.equal(existsSync(join(dir, "Pay-statechart")), false); + + writeFileSync( + join(dir, "Pay.map.mjs"), + `${payMap}export const detail = (v) => \`charges = \${v.charges}\`;\n`, + ); + const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir); + assert.equal(r.status, 1, r.stderr); + assert.equal( + r.stdout, + `TLC on Pay.tla: + NoDoubleCharge is broken. + +Chart: 5 states and 4 transitions from 5 model states. +3 work, 2 break a rule. + +## 1. Paying, charged twice + +Rule broken: \`NoDoubleCharge\` +Why: each charge request charges again. +This is the only way to get here in the model. + +0. Start: Cart +1. You pay. Now: Paying +2. The bank charges you. Now: Paying, charged +3. The bank charges you. Now: Paying, charged twice + +Wrote chart.mmd, bug-1.mmd, bug-1-developer.mmd, bug-1-layered.mmd, stories.md, summary.json in Pay-statechart. +`, + ); + assert.match( + readFileSync(join(dir, "Pay-statechart", "bug-1-layered.mmd"), "utf8"), + /state "Paying, charged twice" as g\d \{\n {4}state "charges = 2" as s\d\n/, + ); + assert.deepEqual(readdirSync(join(dir, "Pay-statechart")).sort(), [ + "bug-1-developer.mmd", + "bug-1-layered.mmd", + "bug-1.mmd", + "chart.mmd", + "stories.md", + "summary.json", + "tlc", + ]); + assert.equal( + readFileSync(join(dir, "Pay-statechart", "tlc", "Pay.cfg"), "utf8"), + "SPECIFICATION Spec\n", + ); + assert.equal( + readFileSync(join(dir, "Pay-statechart", "tlc", "Pay-NoDoubleCharge.cfg"), "utf8"), + "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\nCONSTRAINT NoDoubleCharge\n", + ); + }, +); + +test("a rule broken by a start state marks that state wrong", needsTlc, () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "Start.tla"), + `---- MODULE Start ---- +VARIABLES conn, badge +vars == <> +Init == conn \\in {"Online", "Offline"} /\\ badge = "Synced" +Drop == conn = "Online" /\\ conn' = "Offline" /\\ badge' = "Waiting" +Next == Drop +Spec == Init /\\ [][Next]_vars +NeverSyncedWhileOffline == ~(conn = "Offline" /\\ badge = "Synced") +==== +`, + ); + writeFileSync(join(dir, "Start.cfg"), "SPECIFICATION Spec\nINVARIANT NeverSyncedWhileOffline\n"); + writeFileSync( + join(dir, "start.map.mjs"), + 'export const state = (v) => `${v.conn} | ${v.badge}`;\nexport const step = () => "the network drops";\n', + ); + assert.match(tlc(dir, "Start").stdout, /is violated by the initial state/); + const args = [ + "--dot", + "Start.dot", + "--map", + "start.map.mjs", + "--traces", + "Start.out", + "--summary", + "summary.json", + "--out", + "chart.mmd", + ]; + const r = node("tlc-to-chart.mjs", args, dir); + assert.equal(r.status, 0, r.stderr); + const summary = JSON.parse(readFileSync(join(dir, "summary.json"), "utf8")); + assert.deepEqual( + summary.classes.map((c) => [c.end, c.readerSteps]), + [["Offline | Synced", 0]], + ); + assert.deepEqual(summary.chartStatus, { works: 2, wrong: 1, fixed: 0 }); +}); + +const edit = (name, fixed) => `---- MODULE ${name} ---- +VARIABLES s, flashed +vars == <> +Init == s = "Idle" /\\ flashed = FALSE +Tap == s = "Idle" /\\ s' = "Saving" /\\ UNCHANGED flashed +Lose == s = "Saving" /\\ s' = "Lost edit" /\\ UNCHANGED flashed +Flash == s = "Saving" /\\ s' = "Flash" /\\ flashed' = ${fixed ? "TRUE" : "FALSE"} +Back == s \\in {"Lost edit", "Flash"} /\\ s' = "Idle" /\\ flashed' = FALSE +Next == Tap \\/ Flash \\/ Back${fixed ? "" : " \\/ Lose"} +Spec == Init /\\ [][Next]_vars +NoLostEdit == s # "Lost edit" /\\ ~(s = "Flash" /\\ flashed) +==== +`; + +test( + "a bug that only the fixed model has is numbered after the current bugs and drawn wrong", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const cfg = "SPECIFICATION Spec\nINVARIANT NoLostEdit\n"; + for (const [name, fixed] of [ + ["Edit", false], + ["EditFixed", true], + ]) { + writeFileSync(join(dir, `${name}.tla`), edit(name, fixed)); + writeFileSync(join(dir, `${name}.cfg`), cfg); + assert.match(tlc(dir, name).stdout, /Invariant NoLostEdit is violated/); + } + writeFileSync( + join(dir, "edit.map.mjs"), + 'export const readerActions = ["Tap"];\nexport const state = (v) => v.s;\nexport const step = (a) => ({ Tap: "you tap Save", Lose: "the save fails", Flash: "the screen flashes", Back: "you go back" })[a] ?? "";\n', + ); + const args = [ + "--dot", + "Edit.dot", + "--map", + "edit.map.mjs", + "--traces", + "Edit.out", + "--fixed-dot", + "EditFixed.dot", + "--fixed-traces", + "EditFixed.out", + ]; + const r = node( + "tlc-to-chart.mjs", + [ + ...args, + "--cover", + "--highlight", + "0", + "--story", + "story.md", + "--summary", + "summary.json", + "--out", + "chart.mmd", + ], + dir, + ); + assert.equal(r.status, 0, r.stderr); + assert.match(r.stderr, /1 bug\(s\), 1 new with the fix/); + const summary = JSON.parse(readFileSync(join(dir, "summary.json"), "utf8")); + assert.deepEqual( + summary.classes.map((c) => [c.n, c.end, c.fix]), + [ + [1, "Lost edit", "Saving"], + [2, "Flash", "new with the fix"], + ], + ); + assert.deepEqual(summary.chartStatus, { works: 2, wrong: 1, fixed: 1 }); + assert.match(readFileSync(join(dir, "story.md"), "utf8"), /^## 2\. New with the fix: Flash$/m); + const two = node( + "tlc-to-chart.mjs", + [...args, "--highlight", "2", "--path-only", "--out", "bug2.mmd"], + dir, + ); + assert.equal(two.status, 0, two.stderr); + assert.match(readFileSync(join(dir, "bug2.mmd"), "utf8"), /: 2\. the screen flashes\n/); + }, +); + +function flatEdges(mmd) { + const names = new Map(); + const members = new Map(); + let box = null; + for (const line of mmd.split("\n")) { + const opens = /^ {2}state "([^"]+)" as (g\d+) \{$/.exec(line); + const state = /^ +state "([^"]+)" as (s\d+)$/.exec(line); + const said = (s) => s.replaceAll("
", " "); + if (opens) { + box = { id: opens[2], name: said(opens[1]) }; + members.set(box.id, []); + } else if (line === " }") box = null; + else if (state) { + names.set(state[2], box ? `${box.name}: ${said(state[1])}` : said(state[1])); + if (box) members.get(box.id).push(state[2]); + } + } + return [...mmd.matchAll(/^ {2}([gs]\d+) --> (s\d+) : (.*)$/gm)] + .flatMap(([, from, to, label]) => + (members.get(from) ?? [from]).map((f) => `${names.get(f)} --> ${names.get(to)} : ${label}`), + ) + .sort(); +} + +test( + "states of one context sit in one box, and an arrow from the box's border stands for the same step from each", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "Window.tla"), + `---- MODULE Window ---- +VARIABLES where, reply +vars == <> +Init == where = "Starting" /\\ reply = "none" +Boot == where = "Starting" /\\ where' = "Chat open" /\\ UNCHANGED reply +Ask == where = "Chat open" /\\ reply = "none" /\\ reply' = "pending" /\\ UNCHANGED where +Answer == reply = "pending" /\\ reply' = "shown" /\\ UNCHANGED where +Close == where = "Chat open" /\\ where' = "Window closed" /\\ UNCHANGED reply +Open == where = "Window closed" /\\ where' = "Chat open" /\\ reply' = "none" +Next == Boot \\/ Ask \\/ Answer \\/ Close \\/ Open +Spec == Init /\\ [][Next]_vars +NoReplyWhileClosed == ~(where = "Window closed" /\\ reply = "shown") +==== +`, + ); + writeFileSync(join(dir, "Window.cfg"), "SPECIFICATION Spec\nINVARIANT NoReplyWhileClosed\n"); + writeFileSync( + join(dir, "window.map.mjs"), + `const R = { none: "no question", pending: "reply on its way", shown: "reply shown" }; +export const state = (v) => \`\${v.where}: \${v.where === "Starting" ? "loading" : R[v.reply]}\`; +export const step = (a) => ({ Boot: "the app starts", Ask: "you ask", Answer: "the reply arrives", Close: "you close the window", Open: "you open the window" })[a]; +`, + ); + assert.match(tlc(dir, "Window").stdout, /Invariant NoReplyWhileClosed is violated/); + const args = ["--dot", "Window.dot", "--map", "window.map.mjs", "--traces", "Window.out"]; + const draw = (extra, out) => { + const r = node("tlc-to-chart.mjs", [...args, ...extra, "--out", out], dir); + assert.equal(r.status, 0, r.stderr); + return readFileSync(join(dir, out), "utf8"); + }; + const boxed = draw([], "boxed.mmd"); + const flat = draw(["--flat"], "flat.mmd"); + + assert.match( + boxed, + /^ {2}state "Chat open" as g0 \{\n {4}state "no question" as s0\n {4}state "reply on its way" as s1\n {4}state "reply shown" as s2\n {2}\}\n {2}state "Window closed" as g1 \{\n {4}state "no question" as s3\n {4}state "reply on its way" as s4\n {4}state "reply shown" as s5\n {2}\}\n {2}state "Starting: loading" as s6\n/m, + ); + assert.deepEqual( + boxed.split("\n").filter((l) => /you open the window/.test(l)), + [" g1 --> s0 : you open the window"], + ); + assert.equal(flat.split("\n").filter((l) => /you open the window/.test(l)).length, 3); + assert.doesNotMatch(flat, /as g\d+ \{/); + assert.deepEqual(flatEdges(boxed), flatEdges(flat)); + assert.match(boxed, /^ {2}class s5 wrongPath$/m); + assert.match(boxed, /^ {2}s\d --> s5 : 4\. /m); + assert.match(boxed, /state "Breaks a rule" as legendWrong/); + }, +); + +const save = (name, code) => `---- MODULE ${name} ---- +VARIABLES screen, note${code ? ", retries" : ""} +vars == <> +Init == screen = "Editing" /\\ note = [text |-> "draft"${code ? `, rev |-> 0] /\\ retries = 0` : "]"} +Save == screen = "Editing" /\\ screen' = "Saving" /\\ UNCHANGED <> +Confirm == screen = "Saving" /\\ screen' = "Saved" /\\ note' = [text |-> "stored"${code ? `, rev |-> 1] /\\ UNCHANGED retries` : "]"} +Edit == screen = "Saved" /\\ screen' = "Editing" /\\ note' = [note EXCEPT !.text = "draft"]${code ? " /\\ retries' = 0" : ""} +${ + code + ? `Retry == screen = "Saving" /\\ retries = 0 /\\ retries' = 1 /\\ UNCHANGED <> +TimeOut == screen = "Saving" /\\ retries = 1 /\\ screen' = "Saved" /\\ UNCHANGED <> +Next == Save \\/ Retry \\/ Confirm \\/ TimeOut \\/ Edit` + : "Next == Save \\/ Confirm \\/ Edit" +} +Spec == Init /\\ [][Next]_vars +TypeOK == screen \\in {"Editing", "Saving", "Saved"} +\\* You never see "Saved" while the note is still a draft. +NoFalseSaved == ~(screen = "Saved" /\\ note.text = "draft") +==== +`; + +test( + "from-spec --against compares the code with the spec on the parts both have, and --expect-broken sets the exit code", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "SaveCode.tla"), save("SaveCode", true)); + writeFileSync(join(dir, "SaveAgreed.tla"), save("SaveAgreed", false)); + writeFileSync( + join(dir, "SaveCode.cfg"), + "SPECIFICATION Spec\nINVARIANT TypeOK\nINVARIANT NoFalseSaved\n", + ); + writeFileSync( + join(dir, "SaveCode.map.mjs"), + `export const readerActions = ["Save", "Edit"]; +export const state = (v) => \`\${v.screen}, \${v.note.text}\`; +export const step = (a) => ({ Save: "you press Save", Retry: "the app tries again", Confirm: "the server stores the note", TimeOut: "the save times out", Edit: "you edit the note" })[a] ?? ""; +export const cause = () => "the app stops after one retry and shows Saved anyway"; +`, + ); + const run = (...extra) => + node( + "statechart.mjs", + [ + "from-spec", + "SaveCode.tla", + "--against", + "SaveAgreed.tla", + "--label", + "the agreed chart", + ...extra, + ], + dir, + ); + + const unknown = run("--expect-broken", "NoLostNote"); + assert.equal(unknown.status, 2); + assert.equal( + unknown.stderr, + "--expect-broken NoLostNote: not a rule in SaveCode.cfg, whose rules are TypeOK, NoFalseSaved.\n", + ); + + const expected = run("--expect-broken", "NoFalseSaved"); + assert.equal(expected.status, 0, expected.stderr); + assert.equal( + expected.stdout, + `TLC on SaveCode.tla: + TypeOK holds. + NoFalseSaved is broken (expected). +TLC on SaveAgreed.tla: + TypeOK holds. + NoFalseSaved holds. + +Chart: 4 states and 4 transitions from 10 model states. +3 work, 1 breaks a rule, 0 only in the agreed chart. + +## 1. Saved, draft + +Rule broken: You never see "Saved" while the note is still a draft. +Why: the app stops after one retry and shows Saved anyway. +There are 2 ways to get here in the model. This is the shortest. + +0. Start: Editing, draft +1. You press Save. Now: Saving, draft +2. The save times out. Now: Saved, draft + +In the agreed chart, step 2 (the save times out) cannot happen, so you stay at: Saving, draft. + +Broken as expected: NoFalseSaved. + +Wrote chart.mmd, bug-1.mmd, stories.md, summary.json in SaveCode-statechart. +`, + ); + const out = join(dir, "SaveCode-statechart"); + const chart = readFileSync(join(out, "chart.mmd"), "utf8"); + assert.match(chart, /^stateDiagram-v2\n {2}%% second model \(against\): the agreed chart\n/m); + assert.deepEqual( + [...chart.matchAll(/^ {4}state "([^"]+)" as legend\w+$/gm)].map((m) => m[1]), + ["Works", "Breaks a rule"], + ); + assert.match( + chart, + /^ {2}s3 --> s3 : in the agreed chart, the savetimes out cannot happen$/m, + ); + const bug = readFileSync(join(out, "bug-1.mmd"), "utf8"); + assert.deepEqual([...bug.matchAll(/^ {2}state "([^"]+)" as s\d+$/gm)].map((m) => m[1]).sort(), [ + "Editing, draft", + "Saved, draft", + "Saving, draft", + ]); + const summary = JSON.parse(readFileSync(join(out, "summary.json"), "utf8")); + assert.deepEqual(summary.second.role, "against"); + assert.deepEqual(summary.second.lacks.sort(), ["note.rev", "retries"]); + assert.equal(summary.classes[0].against, "Saving, draft"); + assert.deepEqual(summary.codeLike, []); + + const unexpected = run(); + assert.equal(unexpected.status, 1, unexpected.stderr); + const holds = run("--expect-broken", "TypeOK"); + assert.equal(holds.status, 1, holds.stderr); + assert.match( + holds.stdout, + /\nBroken but not expected: NoFalseSaved\.\n\nExpected to break but holds: TypeOK\.\n/, + ); + const listed = run("--expect-broken", "NoFalseSaved,TypeOK"); + assert.equal(listed.status, 1, listed.stderr); + assert.match(listed.stdout, /\nExpected to break but holds: TypeOK\.\n/); + assert.doesNotMatch(listed.stdout, /Broken but not expected/); + + writeFileSync( + join(dir, "code.map.mjs"), + readFileSync(join(out, "../SaveCode.map.mjs"), "utf8").replace( + '"the app stops after one retry and shows Saved anyway"', + '"retryCount hit maxRetries"', + ), + ); + const coded = run("--map", "code.map.mjs", "--expect-broken", "NoFalseSaved"); + assert.equal(coded.status, 0, coded.stderr); + assert.match( + coded.stdout, + /These labels or causes read like code\. Write them in the reader's words in code\.map\.mjs:\n {2}retryCount hit maxRetries\n/, + ); + }, +); + +test( + "from-chart checks a chart whose regions guard each other, and draws it back unchanged", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "lamp.mmd"), lamp); + const r = node( + "statechart.mjs", + ["from-chart", "lamp.mmd", "--expect-broken", "LitWhileOff"], + dir, + ); + assert.equal(r.status, 0, r.stdout + r.stderr); + assert.match(r.stdout, /\nThe spec draws lamp\.mmd back unchanged\.\n/); + }, +); + +const doorSpec = `---- MODULE Door ---- +VARIABLES where, reply +vars == <> +Init == where = "Open" /\\ reply = "none" +Ask == reply = "none" /\\ reply' = "pending" /\\ UNCHANGED where +Answer == where = "Open" /\\ reply = "pending" /\\ reply' = "shown" /\\ UNCHANGED where +Drop == where = "Closed" /\\ reply = "pending" /\\ reply' = "lost" /\\ UNCHANGED where +Close == where = "Open" /\\ where' = "Closed" /\\ UNCHANGED reply +Reopen == where = "Closed" /\\ where' = "Open" /\\ (reply' = reply \\/ (reply = "pending" /\\ reply' = "shown")) +Next == Ask \\/ Answer \\/ Drop \\/ Close \\/ Reopen +Spec == Init /\\ [][Next]_vars +NoLostReply == reply # "lost" +NoShownWhileClosed == ~(where = "Closed" /\\ reply = "shown") +==== +`; + +const doorMap = `const W = { Open: "Window open", Closed: "Window closed" }; +const R = { none: "no question", pending: "reply on its way", shown: "reply shown", lost: "reply lost" }; +export const regionNames = ["Where you are", "Your reply"]; +export const state = (v) => \`\${W[v.where]}: \${R[v.reply]}\`; +export const step = (a) => ({ Ask: "you ask", Answer: "the reply arrives", Drop: "the app drops the reply", Close: "you close the window", Reopen: "you open the window" })[a]; +`; + +function runDoor(map) { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "Door.tla"), doorSpec); + writeFileSync(join(dir, "Door.map.mjs"), map); + const out = join(dir, "Door-statechart"); + const read = (f) => readFileSync(join(out, f), "utf8").replaceAll("
", " "); + return (rule) => { + writeFileSync(join(dir, "Door.cfg"), `SPECIFICATION Spec\nINVARIANT ${rule}\n`); + const r = node("statechart.mjs", ["from-spec", "Door.tla", "--expect-broken", rule], dir); + assert.equal(r.status, 0, r.stdout + r.stderr); + const every = join(out, "tlc", "regions-all.mmd"); + return { + stdout: r.stdout, + chart: read("chart.mmd"), + every: existsSync(every) ? read("tlc/regions-all.mmd") : null, + bug: read("bug-1.mmd"), + out, + }; + }; +} + +test( + "from-spec draws parallel regions only when they combine back into TLC's graph, and boxes otherwise", + needsTlc, + () => { + const run = runDoor(doorMap); + const proved = run("NoLostReply"); + assert.match( + proved.stdout, + /\nChart: 6 states and 5 transitions from 8 model states\.\nIt has 2 parallel regions, of 2 and 4 states\. Proof: their 7 arrows together make exactly the 8 states and 13 labeled steps of Door-statechart\/tlc\/regions-proof\.mmd, and the 5 drawn arrows make only steps among them\. Door-statechart\/tlc\/regions-all\.mmd has all 7 arrows\.\n5 work, 1 breaks a rule\.\n/, + ); + const lines = proved.chart.split("\n"); + assert.ok(lines.includes(' state "Where you are" as region0 {')); + assert.ok(lines.includes(" --")); + const guarded = lines.findIndex((l) => /: the reply arrives \[when Window open\]$/.test(l)); + assert.match(lines[guarded + 1], /^ {6}%% when r0s\d$/); + assert.doesNotMatch(proved.chart, /^ {6}r1s\d --> r1s\d : you open the window/m); + assert.equal( + proved.every + .split("\n") + .filter((l) => /^ {6}(r1s\d) --> \1 : you open the window \[when Window closed\]$/.test(l)) + .length, + 1, + ); + const again = node( + "compare-charts.mjs", + ["tlc/regions-all.mmd", "tlc/regions-proof.mmd"], + proved.out, + ); + assert.equal(again.stdout, "same\n", again.stderr); + + const boxed = run("NoShownWhileClosed"); + assert.equal(boxed.every, null); + assert.match( + boxed.stdout, + /\nIt has no parallel regions, because "Window closed: reply shown" is "Breaks a rule", and its two region states would show "Works"\.\n/, + ); + assert.doesNotMatch(boxed.chart, /^ +--$/m); + assert.match(boxed.chart, /^ {2}state "Window closed" as g\d \{$/m); + }, +); + +test( + "the mapping's guard words show on an arrow only when every model step behind it has them", + needsTlc, + () => { + const run = runDoor( + `${doorMap}export const guard = (a, before) => + ({ Answer: "window open", Drop: "window closed", Ask: before.where === "Open" ? "window open" : "" })[a] ?? ""; +`, + ); + const proved = run("NoLostReply"); + const lines = proved.chart.split("\n"); + for (const words of [ + /: the reply arrives \[window open\]$/, + /: the app drops the reply \[window closed\]$/, + ]) + assert.match(lines[lines.findIndex((l) => words.test(l)) + 1], /^ {6}%% when r0s\d$/); + assert.ok(lines.some((l) => /^ {6}r1s\d --> r1s\d : you ask$/.test(l))); + const again = node( + "compare-charts.mjs", + ["tlc/regions-all.mmd", "tlc/regions-proof.mmd"], + proved.out, + ); + assert.equal(again.stdout, "same\n", again.stderr); + assert.match(proved.bug, / : \d\. the app drops the reply \[window closed\]$/m); + + const boxed = run("NoShownWhileClosed"); + assert.match(boxed.chart, / : you ask \[window open\]$/m); + assert.match(boxed.chart, / : you ask$/m); + }, +); + +test( + "the mapping's timer() writes after N s on timer steps, and refuses a value that is not seconds", + needsTlc, + () => { + const timed = runDoor( + `${doorMap}export const timer = (a) => (a === "Drop" ? 30 : undefined);\n`, + )("NoLostReply"); + assert.match(timed.chart, / : after 30 s, the app drops the reply \[when Window closed\]$/m); + assert.match(timed.bug, / : \d\. after 30 s, the app drops the reply$/m); + const again = node( + "compare-charts.mjs", + ["tlc/regions-all.mmd", "tlc/regions-proof.mmd"], + timed.out, + ); + assert.equal(again.stdout, "same\n", again.stderr); + + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "Door.tla"), doorSpec); + writeFileSync(join(dir, "Door.cfg"), "SPECIFICATION Spec\nINVARIANT NoLostReply\n"); + writeFileSync(join(dir, "Door.map.mjs"), `${doorMap}export const timer = () => "soon";\n`); + const r = node("statechart.mjs", ["from-spec", "Door.tla"], dir); + assert.notEqual(r.status, 0); + assert.match( + r.stderr, + /timer\(\) must return a number of seconds above 0, or nothing; got "soon" for \w+/, + ); + }, +); + +const groupMap = `${doorMap}export const group = (v) => + ({ none: "Nothing to show", pending: "Waiting", shown: "Reply shown", lost: "Reply shown" })[v.reply]; +export const groupColors = { "Reply shown": "#d1f2eb", Waiting: null, "Never drawn": "#ffffff" }; +`; + +test( + "group() fills each state with its group's color, and the legend lists only the groups the chart draws", + needsTlc, + () => { + const run = runDoor(groupMap)("NoLostReply"); + const lines = run.chart.split("\n"); + assert.deepEqual(lines.slice(0, lines.indexOf(' state "At the same time" as regions {')), [ + "---", + "config:", + " markdownAutoWrap: false", + " state:", + " useMaxWidth: false", + "---", + "stateDiagram-v2", + " classDef plain fill:#f4f6f7,stroke:#566573,color:#1b2631", + " classDef plainWrong fill:#f4f6f7,stroke:#c0392b,stroke-width:4px,color:#7b241c", + " classDef group0 fill:#d1f2eb,stroke:#697976,color:#1b2631", + " classDef group0Wrong fill:#d1f2eb,stroke:#c0392b,stroke-width:4px,color:#7b241c", + " classDef group1 fill:#d6eaf8,stroke:#6b757c,color:#1b2631", + " classDef group2 fill:#fdebd0,stroke:#7f7668,color:#1b2631", + ' state "Legend" as legend {', + ' state "Reply shown" as legendGroup0', + ' state "Waiting" as legendGroup1', + ' state "Nothing to show" as legendGroup2', + ' state "Breaks a rule" as legendWrong', + " }", + " class legendGroup0 group0", + " class legendGroup1 group1", + " class legendGroup2 group2", + " class legendWrong plainWrong", + ]); + assert.ok(lines.includes(' state "reply lost" as r1s1')); + assert.deepEqual( + lines.filter((l) => l.startsWith(" class r")), + [ + " class r0s0 plain", + " class r0s1 plain", + " class r1s0 group2", + " class r1s1 group0Wrong", + " class r1s2 group1", + " class r1s3 group0", + ], + ); + assert.match(run.stdout, /\n5 work, 1 breaks a rule\.\n/); + const again = node( + "compare-charts.mjs", + ["tlc/regions-all.mmd", "tlc/regions-proof.mmd"], + run.out, + ); + assert.equal(again.stdout, "same\n", again.stderr); + + const bug = run.bug.split("\n"); + assert.ok( + bug.includes( + " classDef group1Path fill:#d6eaf8,stroke:#1f3a93,stroke-width:4px,color:#1b2631", + ), + ); + assert.deepEqual( + bug.filter((l) => /^ {2}class s\d/.test(l)), + [ + " class s0 group0Wrong", + " class s1 group1Path", + " class s2 group2Path", + " class s3 group1Path", + ], + ); + + const summary = JSON.parse(readFileSync(join(run.out, "summary.json"), "utf8")); + assert.deepEqual(summary.chartGroups, [ + { name: "Reply shown", color: "#d1f2eb", states: 2 }, + { name: "Waiting", color: "#d6eaf8", states: 1 }, + { name: "Nothing to show", color: "#fdebd0", states: 1 }, + ]); + assert.deepEqual(summary.mixedGroups, []); + }, +); + +test( + "the mapping cannot hide a broken rule, and refuses a status name, a dark or bad color, or a group that is not a name", + needsTlc, + () => { + const run = runDoor(groupMap)("NoLostReply"); + const tlcDir = join(run.out, "tlc"); + const chart = (map, ...extra) => { + writeFileSync(join(tlcDir, "probe.map.mjs"), map); + return node( + "tlc-to-chart.mjs", + [ + "--dot", + "Door.dot", + "--map", + "probe.map.mjs", + "--traces", + "Door-NoLostReply.out", + "--highlight", + "0", + ...extra, + ], + tlcDir, + ); + }; + + const hidden = chart( + `${doorMap}export const group = () => "All good";\nexport const groupColors = { "All good": "#e9f7ef" };\n`, + "--regions", + ); + assert.equal(hidden.status, 0, hidden.stderr); + const lines = hidden.stdout.split("\n"); + assert.ok( + lines.includes( + " classDef group0Wrong fill:#e9f7ef,stroke:#c0392b,stroke-width:4px,color:#7b241c", + ), + ); + const legend = lines.indexOf(' state "Legend" as legend {'); + assert.deepEqual(lines.slice(legend, legend + 6), [ + ' state "Legend" as legend {', + ' state "All good" as legendGroup0', + ' state "Breaks a rule" as legendWrong', + " }", + " class legendGroup0 group0", + " class legendWrong plainWrong", + ]); + assert.ok(lines.includes(" class r1s1 group0Wrong")); + assert.equal(lines.filter((l) => / group0Wrong$/.test(l)).length, 1); + + const coarse = chart( + `const W = { Open: "Window open", Closed: "Window closed" }; +export const state = (v) => W[v.where]; +export const group = (v) => (v.reply === "shown" ? "Reply shown" : "Waiting"); +`, + "--summary", + "coarse.json", + ); + assert.equal(coarse.status, 0, coarse.stderr); + assert.deepEqual( + coarse.stdout.split("\n").filter((l) => /^ {2}(class|classDef) /.test(l)), + [ + " classDef plain fill:#f4f6f7,stroke:#566573,color:#1b2631", + " classDef plainWrong fill:#f4f6f7,stroke:#c0392b,stroke-width:4px,color:#7b241c", + " class legendWrong plainWrong", + " class s0 plainWrong", + " class s1 plain", + ], + ); + const summary = JSON.parse(readFileSync(join(tlcDir, "coarse.json"), "utf8")); + assert.deepEqual(summary.chartGroups, []); + assert.deepEqual(summary.mixedGroups, ["Window closed", "Window open"]); + + for (const [map, error] of [ + [ + `export const group = (v) => (v.reply === "lost" ? "Breaks a rule" : "Fine");`, + /group "Breaks a rule" has the name of a status; TLC decides the status, so name the group for what the reader sees/, + ], + [`export const group = () => "fixed";`, /group "fixed" has the name of a status/], + [ + `export const group = () => "All good";\nexport const groupColors = { "All good": "#123" };`, + /groupColors\["All good"\] "#123" is too dark for the status borders to show on it/, + ], + [ + `export const group = () => "All good";\nexport const groupColors = { "All good": "red" };`, + /groupColors\["All good"\] "red" is not "#rgb" or "#rrggbb"/, + ], + [ + `export const group = () => "All good";\nexport const groupColors = ["#ffffff"];`, + /groupColors must be an object from a group name to a color such as #d6eaf8/, + ], + [`export const group = () => 1;`, /group\(\) must return a group name or nothing; got 1/], + ]) { + const r = chart(`${doorMap}${map}\n`, "--regions"); + assert.equal(r.status, 1, map); + assert.equal(r.stdout, "", map); + assert.match(r.stderr, error); + } + }, +); + +const order = (name, note, charge) => `---- MODULE ${name} ---- +EXTENDS Naturals +VARIABLES screen, charges, note +vars == <> +Init == screen = "Cart" /\\ charges = 0 /\\ note = 0 +Pay == screen = "Cart" /\\ screen' = "Paying" /\\ note' = ${note} /\\ UNCHANGED charges +Charge == screen = "Paying" /\\ charges < 2 /\\ ${charge} +Next == Pay \\/ Charge +Spec == Init /\\ [][Next]_vars +NoDoubleCharge == charges <= 1 +==== +`; +const chargeAgain = "charges' = charges + 1 /\\ UNCHANGED <>"; +const chargeOnce = `IF charges = 0 THEN charges' = 1 /\\ UNCHANGED <> ELSE screen' = "Paid" /\\ UNCHANGED <>`; +const chargeFirstOnly = "charges = 0 /\\ charges' = 1 /\\ UNCHANGED <>"; + +test( + "the fix changes a bug only at the first step that the reader sees differently", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync(join(dir, "Order.tla"), order("Order", 0, chargeAgain)); + writeFileSync(join(dir, "Order.cfg"), "SPECIFICATION Spec\nINVARIANT NoDoubleCharge\n"); + const withFix = (charge, map = payMap) => { + writeFileSync(join(dir, "Order.map.mjs"), map); + writeFileSync(join(dir, "OrderFixed.tla"), order("OrderFixed", 1, charge)); + const r = node( + "statechart.mjs", + ["from-spec", "Order.tla", "--fixed", "OrderFixed.tla"], + dir, + ); + assert.equal(r.status, 1, r.stderr); + const chart = readFileSync(join(dir, "Order-statechart", "chart.mmd"), "utf8"); + return { + story: readFileSync(join(dir, "Order-statechart", "stories.md"), "utf8"), + fixEdges: parseMermaid(chart) + .regions.Main.transitions.filter((t) => t.label.includes("with the fix")) + .map((t) => `${t.from} --> ${t.to} : ${t.label}`), + }; + }; + const hidden = withFix(chargeAgain); + assert.deepEqual(hidden.fixEdges, []); + assert.match( + hidden.story, + /^With the fix you see the same screens and steps, so the fix does not change this path\.$/m, + ); + const once = withFix(chargeOnce); + assert.deepEqual(once.fixEdges, [ + "Paying, charged --> Paid, charged : with the fix, the bank charges you", + ]); + assert.match( + once.story, + /^With the fix, step 3 \(the bank charges you\) takes you to: Paid, charged\.$/m, + ); + const unlabeledMap = payMap.replace( + /^export const state = .*$/m, + "export const state = (v) => v.screen;", + ); + const unseen = withFix(chargeOnce, unlabeledMap); + assert.deepEqual(unseen.fixEdges, ["Paying --> Paid : with the fix, the bank charges you"]); + assert.match( + unseen.story, + /^With the fix, after step 1, "the bank charges you" happens and takes you to: Paid\.$/m, + ); + const blocked = withFix(chargeFirstOnly, unlabeledMap); + assert.deepEqual(blocked.fixEdges, []); + assert.match( + blocked.story, + /yet the rule holds, so the state labels do not show what the fix changes/, + ); + }, +); + +const notify = (name, mutedArrive) => `---- MODULE ${name} ---- +EXTENDS Naturals +VARIABLES screen, muted, banner, badge, missed, msgs, syncs +vars == <> +Init == screen = "Inbox" /\\ muted = FALSE /\\ banner = FALSE /\\ badge = FALSE + /\\ missed = FALSE /\\ msgs = 0 /\\ syncs = 0 +OpenThread == screen = "Inbox" /\\ screen' = "Thread" /\\ UNCHANGED <> +OpenSettings == screen \\in {"Inbox", "Thread"} /\\ screen' = "Settings" /\\ UNCHANGED <> +TapBack == screen \\in {"Thread", "Settings"} /\\ screen' = "Inbox" /\\ UNCHANGED <> +Mute == screen = "Settings" /\\ ~muted /\\ muted' = TRUE /\\ UNCHANGED <> +Refresh == syncs < 2 /\\ syncs' = syncs + 1 /\\ UNCHANGED <> +Arrive == msgs < syncs /\\ msgs' = msgs + 1 + /\\ (IF muted THEN ${mutedArrive} ELSE banner' = TRUE /\\ UNCHANGED <>) + /\\ UNCHANGED <> +Next == OpenThread \\/ OpenSettings \\/ TapBack \\/ Mute \\/ Refresh \\/ Arrive +Spec == Init /\\ [][Next]_vars +NeverMissed == ~missed +NoBannerOnThread == ~(banner /\\ screen = "Thread") +==== +`; + +test( + "a step the reader does not see breaks the rule, and the fix shows it on another screen", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "Notify.tla"), + notify("Notify", "missed' = TRUE /\\ UNCHANGED <>"), + ); + writeFileSync( + join(dir, "NotifyBadge.tla"), + notify("NotifyBadge", "badge' = TRUE /\\ UNCHANGED <>"), + ); + writeFileSync( + join(dir, "Notify.cfg"), + "SPECIFICATION Spec\nINVARIANT NeverMissed\nINVARIANT NoBannerOnThread\n", + ); + writeFileSync( + join(dir, "Notify.map.mjs"), + `export const readerActions = ["OpenThread", "OpenSettings", "TapBack", "Mute", "Refresh"]; +export const state = (v) => [v.screen, v.muted && "muted", v.banner && "banner", v.badge && "badge"].filter(Boolean).join(", "); +export const step = (a) => ({ OpenThread: "you open the thread", OpenSettings: "you open settings", TapBack: "you tap Back", Mute: "you mute alerts", Refresh: "you pull to refresh", Arrive: "a message arrives" })[a]; +export const cause = () => null; +`, + ); + const r = node( + "statechart.mjs", + ["from-spec", "Notify.tla", "--fixed", "NotifyBadge.tla", "--label", "the badge fix"], + dir, + ); + assert.equal(r.status, 1, r.stderr); + const out = (f) => readFileSync(join(dir, "Notify-statechart", f), "utf8"); + const fixEdges = (f) => + parseMermaid(out(f)) + .regions.Main.transitions.filter((t) => t.label.includes("with the badge fix")) + .map((t) => `${t.from} --> ${t.to} : ${t.label}`); + const { classes } = JSON.parse(out("summary.json")); + assert.deepEqual( + classes.map((c) => [c.invariant, c.end, c.fix]), + [ + ["NoBannerOnThread", "Thread, banner", "unchanged"], + ["NeverMissed", "Settings, muted", "Settings, muted, badge"], + ["NeverMissed", "Inbox, muted", "Inbox, muted, badge"], + ["NeverMissed", "Settings, muted, banner", "Settings, muted, banner, badge"], + ["NeverMissed", "Thread, muted", "Thread, muted, badge"], + ["NoBannerOnThread", "Thread, muted, banner", "unchanged"], + ["NeverMissed", "Inbox, muted, banner", "Inbox, muted, banner, badge"], + ["NeverMissed", "Thread, muted, banner", "Thread, muted, banner, badge"], + ["NoBannerOnThread", "Thread, muted, banner, badge", "new with the badge fix"], + ], + ); + const missed = classes.filter((c) => c.invariant === "NeverMissed"); + + const story = out("stories.md"); + assert.doesNotMatch(story, /do not show what/); + assert.match( + story, + /^With the badge fix, after step 3, "a message arrives" happens and takes you to: Settings, muted, badge\.$/m, + ); + const settings = classes.find((c) => c.end === "Settings, muted"); + assert.deepEqual(fixEdges(`bug-${settings.n}.mmd`), [ + "Settings, muted --> Settings, muted, badge : with the badge fix, a message arrives", + ]); + const drawn = fixEdges("chart.mmd"); + assert.equal(new Set(drawn).size, drawn.length); + for (const c of missed) + assert.ok( + drawn.includes(`${c.end} --> ${c.end}, badge : with the badge fix, a message arrives`), + `bug ${c.n}`, + ); + }, +); + +test( + "each looping step on a bug path keeps its own label, a null cause groups bugs by end state, and the mapping names the key's colors", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "Browse.tla"), + `---- MODULE Browse ---- +EXTENDS Naturals +VARIABLES screen, looks, scrolled +vars == <> +Init == screen = "Cart" /\\ looks = 0 /\\ scrolled = FALSE +Look == screen = "Cart" /\\ looks < 3 /\\ looks' = looks + 1 /\\ UNCHANGED <> +Scroll == screen = "Cart" /\\ looks = 1 /\\ ~scrolled /\\ scrolled' = TRUE /\\ UNCHANGED <> +Pay == screen = "Cart" /\\ looks = 3 /\\ scrolled /\\ screen' = "Paying" /\\ UNCHANGED <> +Fail == screen = "Paying" /\\ screen' = "Failed" /\\ UNCHANGED <> +Hang == screen = "Paying" /\\ screen' = "Stuck" /\\ UNCHANGED <> +Next == Look \\/ Scroll \\/ Pay \\/ Fail \\/ Hang +Spec == Init /\\ [][Next]_vars +NeverLost == screen \\notin {"Failed", "Stuck"} +==== +`, + ); + writeFileSync(join(dir, "Browse.cfg"), "SPECIFICATION Spec\nINVARIANT NeverLost\n"); + writeFileSync( + join(dir, "Browse.map.mjs"), + `export const readerActions = ["Look", "Scroll", "Pay"]; +export const state = (v) => v.screen; +export const step = (a) => ({ Look: "you look", Scroll: "you scroll", Pay: "you pay", Fail: "the payment fails", Hang: "the payment hangs" })[a]; +export const cause = () => null; +export const legend = { works: "Works on main", wrong: "Wrong on main" }; +`, + ); + const r = node("statechart.mjs", ["from-spec", "Browse.tla"], dir); + assert.equal(r.status, 1, r.stderr); + const out = (f) => readFileSync(join(dir, "Browse-statechart", f), "utf8"); + assert.deepEqual( + JSON.parse(out("summary.json")).classes.map((c) => [c.end, c.cause]), + [ + ["Failed", null], + ["Stuck", null], + ], + ); + assert.doesNotMatch(out("stories.md"), /^Why:|null/m); + const loops = (chart) => [...chart.matchAll(/^ {2}(s\d+) --> \1 : (.*)$/gm)].map((m) => m[2]); + assert.deepEqual(loops(out("bug-1.mmd")), ["1. you look
2. you scroll
3, 4. you look"]); + assert.deepEqual(loops(out("chart.mmd")), ["you look or you scroll"]); + const chart = out("chart.mmd"); + assert.ok(chart.includes('state "Works on main" as legendWorks')); + assert.ok(chart.includes('state "Wrong on main" as legendWrong')); + assert.doesNotMatch(chart, /legendFixed/); + }, +); + +test("a rule that stays broken reports only the step that broke it", needsTlc, () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "Buzz.tla"), + `---- MODULE Buzz ---- +EXTENDS Naturals +VARIABLES x, y, buzzed +vars == <> +Init == x = 0 /\\ y = 0 /\\ buzzed = FALSE +IncX == x < 6 /\\ x' = x + 1 /\\ UNCHANGED <> +IncY == y < 6 /\\ y' = y + 1 /\\ UNCHANGED <> +Ring == x = 2 /\\ ~buzzed /\\ buzzed' = TRUE /\\ UNCHANGED <> +Next == IncX \\/ IncY \\/ Ring +Spec == Init /\\ [][Next]_vars +NeverBuzzed == ~buzzed +==== +`, + ); + writeFileSync(join(dir, "Buzz.cfg"), "SPECIFICATION Spec\nINVARIANT NeverBuzzed\n"); + writeFileSync( + join(dir, "Buzz.map.mjs"), + 'export const state = (v) => (v.buzzed ? "Buzzed" : "Quiet");\nexport const step = () => "time passes";\n', + ); + const r = node("statechart.mjs", ["from-spec", "Buzz.tla"], dir); + assert.equal(r.status, 1, r.stderr); + const traces = parseTraces( + readFileSync(join(dir, "Buzz-statechart", "tlc", "Buzz-NeverBuzzed.out"), "utf8"), + ); + assert.equal(traces.length, 7); + for (const t of traces) + assert.equal( + t.steps.findIndex((s) => s.vars.buzzed), + t.steps.length - 1, + ); +}); + +test("from-spec warns when steps carry the name of the whole next-state action", needsTlc, () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const count = (next) => `---- MODULE Count ---- +EXTENDS Naturals +VARIABLES x +Init == x = 0 +Inc == x < 3 /\\ x' = x + 1 +${next} +Spec == \\* not [][Inc]_x + Init /\\ [][Next]_x +==== +`; + writeFileSync(join(dir, "Count.cfg"), "SPECIFICATION Spec\n"); + writeFileSync(join(dir, "Count.map.mjs"), "export const state = (v) => String(v.x);\n"); + writeFileSync(join(dir, "Count.tla"), count("Next == Inc \\/ (x = 3 /\\ x' = 0)")); + const unnamed = node("statechart.mjs", ["from-spec", "Count.tla"], dir); + assert.equal(unnamed.status, 0, unnamed.stderr); + assert.match( + unnamed.stderr, + /^Count\.tla: 1 step has the name Next, the whole next-state action/, + ); + writeFileSync(join(dir, "Count.tla"), count("Next == Inc")); + const named = node("statechart.mjs", ["from-spec", "Count.tla"], dir); + assert.equal(named.status, 0, named.stderr); + assert.equal(named.stderr, ""); +}); + +const writeLamp = (dir) => { + writeFileSync( + join(dir, "Lamp.tla"), + "---- MODULE Lamp ----\nVARIABLE on\nInit == on = FALSE\nOn == on' = TRUE\nOff == on' = FALSE\nSpec == Init /\\ [][On \\/ Off]_on\n====\n", + ); + writeFileSync(join(dir, "Lamp.cfg"), "SPECIFICATION Spec\n"); + writeFileSync( + join(dir, "Lamp.map.mjs"), + 'export const state = (v) => (v.on ? "On" : "Off");\nexport const step = () => "you flip the switch";\n', + ); + return join(dir, "Lamp-statechart"); +}; + +test("a rerun without --png removes the chart.png of an earlier run", needsTlc, () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const out = writeLamp(dir); + mkdirSync(out); + writeFileSync(join(out, "chart.png"), ""); + const r = node("statechart.mjs", ["from-spec", "Lamp.tla"], dir); + assert.equal(r.status, 0, r.stderr); + assert.deepEqual( + readdirSync(out).filter((f) => f.endsWith(".png")), + [], + ); +}); + +const writeSlowPay = (dir, ticks, paid = "Paid") => { + writeFileSync( + join(dir, "Pay.tla"), + `---- MODULE Pay ---- +EXTENDS Naturals +VARIABLES screen, charges, ticks +vars == <> +Init == screen = "Cart" /\\ charges = 0 /\\ ticks = 0 +TapPay == screen = "Cart" /\\ screen' = "Paying" /\\ UNCHANGED <> +Charge == screen = "Paying" /\\ charges < 2 /\\ charges' = charges + 1 /\\ UNCHANGED <> +Done == screen = "Paying" /\\ charges > 0 /\\ screen' = "${paid}" /\\ UNCHANGED <> +Tick == ticks < ${ticks} /\\ ticks' = ticks + 1 /\\ UNCHANGED <> +Spec == Init /\\ [][TapPay \\/ Charge \\/ Done \\/ Tick]_vars +ChargedAtMostTwice == charges <= 2 +==== +`, + ); + writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\nINVARIANT ChargedAtMostTwice\n"); + writeFileSync( + join(dir, "Pay.map.mjs"), + 'export const state = (v) => v.screen;\nexport const step = (a) => ({ TapPay: "you tap Pay", Charge: "the charge goes through", Done: "the receipt shows" })[a] ?? "";\n', + ); + return join(dir, "Pay-statechart"); +}; +const startRun = (dir, { wrap = [], env = {}, args = ["from-spec", "Pay.tla"] } = {}) => { + const [command, ...rest] = [...wrap, process.execPath, join(scripts, "statechart.mjs"), ...args]; + const child = spawn(command, rest, { + cwd: dir, + env: { ...process.env, ...env }, + stdio: ["ignore", "ignore", "pipe"], + detached: true, + }); + let stderr = ""; + child.stderr.on("data", (d) => { + stderr += d; + }); + return { + child, + done: new Promise((done) => child.on("close", (status) => done({ status, stderr }))), + }; +}; +const until = async (ready) => { + while (!ready()) await sleep(20); +}; +const ownTmp = (dir, name) => { + const tmp = join(dir, name); + mkdirSync(tmp); + return tmp; +}; +const tlcStarted = (tmp) => readdirSync(tmp).some((f) => f.startsWith("tlc-")); +const staged = (dir) => readdirSync(dir).filter((f) => f.startsWith(".")); + +test( + "a run whose Node is killed mid-TLC leaves the output folder as it was, and a rerun charts its own spec", + needsTlc, + async () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const out = writeSlowPay(dir, 60000); + const tmp = ownTmp(dir, "tmp"); + const first = startRun(dir, { env: { TMPDIR: tmp } }); + await until(() => tlcStarted(tmp)); + await sleep(300); + first.child.kill("SIGTERM"); + await first.done; + assert.doesNotThrow(() => process.kill(-first.child.pid, 0), "TLC outlives its Node"); + assert.equal(existsSync(out), false); + + writeSlowPay(dir, 200, "Receipt"); + const second = node("statechart.mjs", ["from-spec", "Pay.tla"], dir); + process.kill(-first.child.pid, "SIGKILL"); + assert.equal(second.status, 0, second.stderr); + for (const file of ["chart.mmd", join("tlc", "Pay.dot")]) { + const text = readFileSync(join(out, file), "utf8"); + assert.match(text, /Receipt/); + assert.doesNotMatch(text, /Paid/); + } + assert.deepEqual(staged(dir), []); + }, +); + +const changedMidRun = async ({ wrap = [], env = {} }) => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const out = writeSlowPay(dir, 20000); + const tmp = ownTmp(dir, "tmp-a"); + const first = startRun(dir, { wrap, env: { ...env, TMPDIR: tmp } }); + await until(() => tlcStarted(tmp)); + await sleep(500); + writeSlowPay(dir, 20000, "Receipt"); + const second = startRun(dir, { wrap, env: { ...env, TMPDIR: ownTmp(dir, "tmp-b") } }); + const [paid, receipt] = await Promise.all([first.done, second.done]); + assert.equal(receipt.status, 0, receipt.stderr); + assert.equal(paid.status, 2, paid.stderr); + assert.equal( + paid.stderr, + "Pay.tla changed while this run read it, so the run left Pay-statechart as it was. Run the command again.\n", + ); + const chart = readFileSync(join(out, "chart.mmd"), "utf8"); + assert.match(chart, /Receipt/); + assert.doesNotMatch(chart, /Paid/); + assert.deepEqual(staged(dir), []); +}; + +test( + "a run whose spec changes while it reads it leaves the output folder, and the run that read the new spec charts it", + needsTlc, + () => changedMidRun({}), +); + +const unshare = ["unshare", "--user", "--map-root-user", "--pid", "--fork", "--mount-proc"]; +const hidePidNamespace = `#define _GNU_SOURCE +#include +#include +#include +#include +ssize_t readlink(const char *path, char *buf, size_t size) { + static ssize_t (*real)(const char *, char *, size_t); + if (!real) real = dlsym(RTLD_NEXT, "readlink"); + if (path && strcmp(path, "/proc/self/ns/pid") == 0) { errno = EIO; return -1; } + return real(path, buf, size); +} +`; +const hidingPreload = (() => { + if (spawnSync(unshare[0], [...unshare.slice(1), "true"]).status !== 0) return null; + const dir = mkdtempSync(join(tmpdir(), "statechart-preload-")); + writeFileSync(join(dir, "hide.c"), hidePidNamespace); + const so = join(dir, "hide.so"); + const cc = spawnSync("cc", ["-shared", "-fPIC", "-o", so, join(dir, "hide.c"), "-ldl"]); + return cc.status === 0 ? so : null; +})(); +test( + "runs in PID namespaces that hide which namespace they are in chart only their own spec", + { + skip: + needsTlc.skip || + (!hidingPreload && "cannot make a PID namespace, or cannot compile a readlink preload"), + }, + () => changedMidRun({ wrap: unshare, env: { LD_PRELOAD: hidingPreload } }), +); + +test( + "a file that is put in the output folder during a run stays, and the run exits 2", + needsTlc, + async () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const out = writeSlowPay(dir, 20000); + const tmp = ownTmp(dir, "tmp"); + const run = startRun(dir, { env: { TMPDIR: tmp } }); + await until(() => tlcStarted(tmp)); + mkdirSync(out); + writeFileSync(join(out, "notes.md"), "mine\n"); + const r = await run.done; + assert.equal(r.status, 2); + assert.equal( + r.stderr, + "Pay-statechart has a file that this command did not write: notes.md. A run puts its files in place of the whole output folder, so pass --out with a new folder.\n", + ); + assert.deepEqual(readdirSync(out), ["notes.md"]); + assert.deepEqual(staged(dir), []); + }, +); + +const failRenames = `#define _GNU_SOURCE +#include +#include +#include +#include +static size_t hits; +int rename(const char *from, const char *to) { + static int (*real)(const char *, const char *); + if (!real) real = dlsym(RTLD_NEXT, "rename"); + const char *base = strrchr(to, '/'), *fails = getenv("RENAME_FAILS"); + base = base ? base + 1 : to; + if (fails && strcmp(base, "shared") == 0 && hits < strlen(fails)) { + errno = fails[hits++] == 'N' ? ENOTEMPTY : EIO; + return -1; + } + return real(from, to); +} +`; +const failingRenames = (() => { + const dir = mkdtempSync(join(tmpdir(), "statechart-preload-")); + writeFileSync(join(dir, "rename.c"), failRenames); + const so = join(dir, "rename.so"); + const cc = spawnSync("cc", ["-shared", "-fPIC", "-o", so, join(dir, "rename.c"), "-ldl"]); + return cc.status === 0 ? so : null; +})(); +test( + "a run whose rename fails after it moves the output folder aside puts the folder back, or says where it is", + { skip: needsTlc.skip || (!failingRenames && "cannot compile a rename preload") }, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeLamp(dir); + const args = ["from-spec", "Lamp.tla", "--out", "shared"]; + const shared = join(dir, "shared"); + const first = node("statechart.mjs", args, dir); + assert.equal(first.status, 0, first.stderr); + const chart = readFileSync(join(shared, "chart.mmd"), "utf8"); + const run = (fails) => + node("statechart.mjs", args, dir, { LD_PRELOAD: failingRenames, RENAME_FAILS: fails }); + + const back = run("NI"); + assert.equal(back.status, 2, back.stderr); + assert.match( + back.stderr, + /^cannot replace shared: EIO: .*\. The run left shared as it was\.\n$/, + ); + assert.equal(readFileSync(join(shared, "chart.mmd"), "utf8"), chart); + assert.deepEqual(staged(dir), []); + + const stuck = run("NII"); + assert.equal(stuck.status, 2, stuck.stderr); + const named = stuck.stderr.match( + /^cannot replace shared: EIO: .*\. This run moved the previous shared to (\.shared-\w+-old) and could not put it back\.\n$/, + ); + assert.ok(named, stuck.stderr); + const aside = named[1]; + assert.equal(existsSync(shared), false); + assert.equal(readFileSync(join(dir, aside, "chart.mmd"), "utf8"), chart); + assert.deepEqual(staged(dir), [aside]); + }, +); + +test( + "each TLC run writes the standard modules in its own temp folder, so overlapping runs cannot rewrite them under each other", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeSlowPay(dir, 0); + const tmp = ownTmp(dir, "tmp"); + const log = join(dir, "java.log"); + const java = join(dir, "java"); + writeFileSync( + java, + `#!/bin/sh +for a; do case "$a" in -Djava.io.tmpdir=*) t="\${a#-Djava.io.tmpdir=}";; esac; done +"$REAL_JAVA" "$@" > "$LOG.$$"; s=$? +cat "$LOG.$$" +echo "$t: $(grep 'Naturals.tla' "$LOG.$$")" >> "$LOG" +rm "$LOG.$$" +exit $s +`, + { mode: 0o755 }, + ); + const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, { + JAVA: java, + TLA2TOOLS: tools.jar, + REAL_JAVA: tools.java, + LOG: log, + TMPDIR: tmp, + }); + assert.equal(r.status, 0, r.stderr); + const runs = readFileSync(log, "utf8").trim().split("\n"); + assert.ok(runs.length > 0); + const folders = new Set(); + for (const line of runs) { + const [folder, parsed] = line.split(": "); + assert.ok(folder.startsWith(join(tmp, "tlc-")), line); + assert.equal(parsed, `Parsing file ${join(folder, "Naturals.tla")}`); + folders.add(folder); + } + assert.equal(folders.size, runs.length); + }, +); + +test( + "a run that TLC stops on an error keeps TLC's output and writes no output folder", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + writeFileSync( + join(dir, "Pay.tla"), + "---- MODULE Pay ----\nVARIABLE x\nASSUME FALSE\nInit == x = 0\nSpec == Init /\\ [][x' = x]_x\n====\n", + ); + writeFileSync(join(dir, "Pay.cfg"), "SPECIFICATION Spec\n"); + writeFileSync(join(dir, "Pay.map.mjs"), 'export const state = () => "Cart";\n'); + const tmp = ownTmp(dir, "tmp"); + const r = node("statechart.mjs", ["from-spec", "Pay.tla"], dir, { TMPDIR: tmp }); + assert.equal(r.status, 2); + const [, file] = r.stderr.match( + /^(\S+\/tlc\/Pay\.out): TLC stopped on an error that is not a broken rule: Assumption .* is false\.\n$/, + ); + assert.ok(file.startsWith(tmp), file); + assert.match(readFileSync(file, "utf8"), /Assumption .* is false/); + assert.equal(existsSync(join(dir, "Pay-statechart")), false); + }, +); + +test( + "runs of two specs that overlap on one output folder all finish, and the folder always holds one run's files", + needsTlc, + async () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const out = writeSlowPay(dir, 400); + writeLamp(dir); + const pay = ["from-spec", "Pay.tla", "--out", "shared"]; + const lamp = ["from-spec", "Lamp.tla", "--out", "shared"]; + const alone = {}; + for (const args of [pay, lamp]) { + const solo = join(dir, `${args[1]}-alone`); + const r = node("statechart.mjs", [...args.slice(0, 2), "--out", solo], dir); + assert.equal(r.status, 0, r.stderr); + alone[args[1]] = { + top: readdirSync(solo).sort().join(), + tlc: readdirSync(join(solo, "tlc")).sort().join(), + chart: readFileSync(join(solo, "chart.mmd"), "utf8"), + summary: readFileSync(join(solo, "summary.json"), "utf8"), + }; + } + const shared = join(dir, "shared"); + const seen = new Set(); + let watching = true; + const watch = (async () => { + while (watching) { + try { + seen.add(readdirSync(join(shared, "tlc")).sort().join()); + } catch (e) { + if (e.code !== "ENOENT") throw e; + } + await sleep(5); + } + })(); + const runs = []; + for (let i = 0; i < 6; i++) { + runs.push(startRun(dir, { args: i % 2 ? lamp : pay }).done); + await sleep(150); + } + const finished = await Promise.all(runs); + watching = false; + await watch; + for (const r of finished) assert.equal(r.status, 0, r.stderr); + const runsOf = new Map(Object.entries(alone).map(([spec, a]) => [a.tlc, spec])); + for (const listing of seen) assert.ok(runsOf.has(listing), `tlc/ had ${listing}`); + const last = alone[runsOf.get(readdirSync(join(shared, "tlc")).sort().join())]; + assert.equal(readdirSync(shared).sort().join(), last.top); + assert.equal(readFileSync(join(shared, "chart.mmd"), "utf8"), last.chart); + assert.equal(readFileSync(join(shared, "summary.json"), "utf8"), last.summary); + assert.equal(existsSync(out), false); + assert.deepEqual(staged(dir), []); + }, +); + +test( + "the output folder model keeps every rule, and breaks one with a shared TLC folder, without each guard, or when a failed rename deletes the folder moved aside", + needsTlc, + () => { + const dir = mkdtempSync(join(tmpdir(), "statechart-")); + const model = (ext) => readFileSync(join(scripts, "model", `OutputFolder${ext}`), "utf8"); + const r = node( + "statechart.mjs", + ["from-spec", join(scripts, "model", "OutputFolder.tla"), "--out", join(dir, "out")], + dir, + ); + assert.equal(r.status, 0, r.stdout + r.stderr); + assert.match(r.stdout, /\nNo rule is broken\.\n/); + for (const [i, [rule, guard, without, story]] of [ + [ + "ChartsOneSpec", + "/\\ read' = Set(read, r, read[r] \\cup {spec})", + "/\\ read' = [q \\in Runs |-> read[q] \\cup {spec}]", + /You start run 2 in a second shell\..*\n.*Run 2 moves its folder into place\. Now: Two runs going: chart of both specs/, + ], + [ + "ChartsOneSpec", + '/\\ pc[r] = "publish" /\\ spec = snap[r] /\\ ~out.notes', + '/\\ pc[r] = "publish" /\\ ~out.notes', + /You edit the spec\..*\n.*Run 1 moves its folder into place\. Now: One run going: chart of both specs/, + ], + [ + "KeepsYourFiles", + '/\\ pc[r] = "aside" /\\ ~aside[r].notes\n', + '/\\ pc[r] = "aside"\n', + /Run 1 deletes the old folder and finishes\. Now: Done: chart of the spec\n/, + ], + [ + "NeverLosesChart", + " /\\ \\/ /\\ aside[r].exists /\\ ~out.exists\n /\\ out' = aside[r]\n /\\ aside' = Set(aside, r, NoFolder)\n \\/ UNCHANGED <>\n", + " /\\ out' = out\n /\\ aside' = Set(aside, r, IF aside[r].notes THEN aside[r] ELSE NoFolder)\n", + /Run 2 moves the old folder aside\. Now: .*, the old chart moved aside\n.*Run 2 cannot rename a folder and stops\. Now: One run going: no folder\n/, + ], + [ + "NeverLosesChart", + '/\\ pc[r] = "swap" /\\ out.exists /\\ aside[r].exists /\\ ~out.notes', + '/\\ pc[r] = "swap" /\\ out.exists /\\ aside[r].exists', + /You save notes in the folder\..*\n.*Run 2 finds another run's folder in place and deletes the old folder\. Now: Two runs going: your notes\n/, + ], + ].entries()) { + const mutant = join(dir, `${i}-${rule}`); + mkdirSync(mutant); + assert.ok(model(".tla").includes(guard), guard); + writeFileSync(join(mutant, "OutputFolder.tla"), model(".tla").replace(guard, without)); + for (const ext of [".cfg", ".map.mjs"]) + writeFileSync(join(mutant, `OutputFolder${ext}`), model(ext)); + const m = node( + "statechart.mjs", + ["from-spec", "OutputFolder.tla", "--expect-broken", rule], + mutant, + ); + assert.equal(m.status, 0, m.stdout + m.stderr); + assert.match(m.stdout, story); + } + }, +); diff --git a/plugins/pstack/skills/statechart/scripts/test/sync.mmd b/plugins/pstack/skills/statechart/scripts/test/sync.mmd new file mode 100644 index 0000000..c780c2e --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/test/sync.mmd @@ -0,0 +1,19 @@ +stateDiagram-v2 + state "Notes app" as App { + state "Connection" as Connection { + [*] --> Online + Online --> Offline : the network drops + Offline --> Online : the network returns + } + -- + state "Sync badge" as Sync { + state "Synced" as Synced + state "Waiting to sync" as Pending + [*] --> Synced + Synced --> Pending : you edit a note + Synced --> Pending : the network drops + Pending --> Synced : the server confirms + } + } + [*] --> App + %% never NeverSyncedWhileOffline: Offline & Synced -- You never see "Synced" while you are offline. diff --git a/plugins/pstack/skills/statechart/scripts/test/upload.mmd b/plugins/pstack/skills/statechart/scripts/test/upload.mmd new file mode 100644 index 0000000..dcfafa7 --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/test/upload.mmd @@ -0,0 +1,16 @@ +stateDiagram-v2 + state "Nothing chosen" as Idle + state "Uploading" as Uploading { + state "Sending the file" as Sending + state "Checking the file" as Checking + [*] --> Sending + Sending --> Checking : the last byte arrives + } + state "Uploaded" as Done + state "Upload failed" as Failed + [*] --> Idle + Idle --> Uploading : you choose a file + Checking --> Done : the check passes + Uploading --> Failed : the network drops + Failed --> Uploading : you retry + Uploading --> Idle : you cancel diff --git a/plugins/pstack/skills/statechart/scripts/tlc-to-chart.mjs b/plugins/pstack/skills/statechart/scripts/tlc-to-chart.mjs new file mode 100644 index 0000000..ccb68fd --- /dev/null +++ b/plugins/pstack/skills/statechart/scripts/tlc-to-chart.mjs @@ -0,0 +1,1347 @@ +#!/usr/bin/env node +import fs from "node:fs"; +import path from "node:path"; +import process from "node:process"; +import { pathToFileURL } from "node:url"; +import { + FULL_LABELS, + GROUP_PALETTE, + LEGEND_ID, + PLAIN_FILL, + checkTlcOutput, + compareCharts, + groupClassDef, + groupColorProblem, + isRecord, + joinLabels, + parseDot, + parseMermaid, + parseTraces, + productOf, + quote, + ruleSentences, + stateKey, + wrap, + STATUS_CLASSES, +} from "./lib.mjs"; + +const USAGE = "Usage: node tlc-to-chart.mjs --dot FILE --map FILE [options]"; +const HELP = `${USAGE} + +Collapses a TLC state graph onto the reader's states and writes a Mermaid stateDiagram-v2. +statechart.mjs runs it once for the overview and once for each bug chart. + + --dot FILE The state graph from TLC -dump dot,actionlabels FILE, for the current code. + Required. + --map FILE The mapping module. Required. It exports state(vars, facts), and + optionally detail(vars, facts), step(action, before, after), + guard(action, before, after), timer(action, before, after), + cause(vars, facts, invariant), group(vars, facts), groupColors, + regionNames, readerActions, and legend. guard is when the step + can happen, in plain words. An edge reads "step [words]" when every + model step behind it has words. timer is how many seconds the code waits + before a timer step, and the step reads "after N s, step". + cause is the hidden reason a bad state is bad: counterexamples with the + same invariant and cause are one bug. When cause returns nothing, the + end state stands in for it. readerActions are the actions the + reader takes. group is the group of a state, below. legend, such as + { works: "Works on main" }, gives the legend's words for the works, + wrong, and fixed statuses. + facts.enabled is the set of actions the state enables. facts.settled is + true when only reader actions are enabled, so nothing else happens until + the reader acts. + --traces FILE TLC output that holds counterexamples. Repeat it. TLC -continue gives one + per bad state. It refuses a file from a TLC run that stopped early or hit + an error other than a broken rule. + --fixed-dot FILE The state graph of the model with the open fix. Each bug's steps replay + on it. + --fixed-traces FILE TLC output for the same invariants on the fixed model. Repeat it. It marks + states fixed or still wrong, and adds the bugs that only the fixed model + has after the current model's bugs. + --against-dot FILE The state graph of the spec that the current code must follow. + Each bug's steps replay on it. Do not use it with --fixed-dot. + --against-traces FILE TLC output for the spec. Repeat it. Its bugs are drawn wrong, and the + bugs that only the spec has number after the code's bugs. + --label TEXT The name of the second model in the chart and the stories. Default: + "the fix" with --fixed-dot, "the spec" with --against-dot. + --spec FILE A TLA+ file whose \\* comment lines above a rule are the rule's sentence in + the stories. Repeat it. The first file that has a sentence wins. + --view NAME customer (state labels, the default), developer (detail labels), or + layered (detail inside state). + --cover Keep only the shortest path to each settled reader state, plus the + counterexample paths. + --highlight N Draw bug N as a numbered path. Default 1. 0 draws none. + --path-only Draw only the highlighted path. + --full-labels Write each label on an edge in full, joined by " or ", and mark the chart + "${FULL_LABELS}". Default: write the leading words that the labels + share once, as in "you tap Pay or Back". + --flat Draw every state on its own, with no boxes. + --regions When every state reads "context: progress", draw two parallel regions, + context and progress, when they are smaller and proved. They draw the + steps of the shortest way to each region state, of each bug path, and + the nearest step with each label. + Otherwise draw the chart the other flags ask for, and print why. + Customer view, --highlight 0, no --flat or --path-only. + --proof FILE With --regions, write the flat chart that the proof compares with. + --regions-all FILE With --regions, also write the regions with every step. + --title TEXT The chart title. + --out FILE The Mermaid chart. Default: stdout. + --story FILE The reader stories, one per bug. + --summary FILE The counts for the chart and the bugs, as JSON. + -h, --help Print this help, and exit 0. + +Each bug replays on the second model by its screens and step words, which are what the reader +sees. The replay takes the second model's steps that keep the screen and that the reader does not +take. A bug step that the reader does not see must keep the screen on the second model too, unless +the second model cannot take it. The replay stops at the first step that the second model shows +the reader differently. There the chart draws "with LABEL, STEP" (or "in LABEL, STEP" for +--against-dot) to where the second model goes, or a loop "... STEP cannot happen" when it cannot +take a step that the reader sees. + +The second model may have other variables and actions than the current model. Variables and +record fields that one start state has and the other does not are left out when the two models +are compared. The second model's states take the current model's start values for the variables +it does not have, so one mapping draws both. A step of an action that the second model does not +have is skipped when it changes no shared variable, and matches any step to the same shared state +when it does. + +In the customer view, states whose labels read "context: progress" with the same context sit in +one box named context, and each shows only its progress. A context with one state stays a plain +state. An arrow from a box's border stands for the same step from every state in the box: it is +drawn only when every state in the box takes that step, with the same labels, to the same state. +The layered view puts each detail state in a box named by its state label. + +With --regions, each "context: progress" label is one state in the context region and one in the +progress region. A step that happens beside only some states of the other region gets a guard: +"[when A or B]" or "[unless A or B]", whichever is shorter, and a "%% when [not] ids" line under it. +The mapping's guard words, when the step has them, replace "when A or B" in the label. +The proof combines the regions with every step as compare-charts.mjs does, and needs exactly the +flat chart's states, start states, and labeled steps. Each state's color must be the worse color +of its two region states. Then the drawn arrows, combined, must make only steps of the flat chart: +a step that they make wrongly gets back every arrow that the full regions take there. +compare-charts.mjs on the --regions-all and --proof files repeats the first proof. +mapping.regionNames = [context, progress] names the two regions. + +Outside regions, two states have at most one arrow. Its lines are the numbered steps, then the +current model's steps, then the second model's steps, with a blank line between each group. + +Without group(), the legend shows only the statuses the chart uses. A chart with a second model +has the line "%% second model (fix|against): LABEL" right after stateDiagram-v2. Each chart +starts with front matter that keeps Mermaid from shrinking it to the page or rewrapping its labels. + +Groups: group(vars, facts) returns the name of the group that a model state is in, such as +"Toast shown", or nothing. A chart state is in a group when all its model states are in it. A +region state is in a group when every state that it is part of is in it. Each group fills its +states with one color, and the legend lists only the groups that the chart draws: first the +groups in groupColors, in that order, then the others from A to Z. groupColors, such as +{ "Toast shown": "#d6eaf8" }, gives a group a light "#rgb" or "#rrggbb" color. A group with no +color, or null, takes the next free palette color: light blue, orange, purple, yellow, teal, tan, +then pink. A state in no group, or in more than one, is gray. summary.json counts the drawn +states of each group in chartGroups, and lists the chart states with more than one in mixedGroups. +TLC decides the status, and a group cannot change it. On top of the group color, a state that +breaks a rule has a thick red border, and a fixed state or a state only in the second model a +thick green border. The legend then shows that border. A thick blue border marks the bug path on +states that work. On other states of the path, the numbered arrows show it. A group cannot have +the name of a status, such as "Breaks a rule". + +Writes only the files that --out, --story, and --summary name. + +Exit codes + 0 It wrote the chart. + 1 It cannot use an input: a mapping without state(), TLC output that it refuses, or a + --highlight with no such bug. The error says why. + 2 A bad argument.`; +const more = "Run node tlc-to-chart.mjs --help for the flags."; + +const args = { + traces: [], + fixedTraces: [], + againstTraces: [], + specs: [], + view: "customer", + highlight: 1, +}; +for (let i = 2; i < process.argv.length; i++) { + const a = process.argv[i]; + const next = () => process.argv[++i]; + if (a === "-h" || a === "--help") { + console.log(HELP); + process.exit(0); + } else if (a === "--dot") args.dot = next(); + else if (a === "--map") args.map = next(); + else if (a === "--traces") args.traces.push(next()); + else if (a === "--fixed-dot") args.fixedDot = next(); + else if (a === "--fixed-traces") args.fixedTraces.push(next()); + else if (a === "--against-dot") args.againstDot = next(); + else if (a === "--against-traces") args.againstTraces.push(next()); + else if (a === "--label") args.label = next(); + else if (a === "--spec") args.specs.push(next()); + else if (a === "--view") args.view = next(); + else if (a === "--highlight") args.highlight = Number(next()); + else if (a === "--path-only") args.pathOnly = true; + else if (a === "--full-labels") args.fullLabels = true; + else if (a === "--flat") args.flat = true; + else if (a === "--regions") args.regions = true; + else if (a === "--proof") args.proof = next(); + else if (a === "--regions-all") args.regionsAll = next(); + else if (a === "--cover") args.cover = true; + else if (a === "--title") args.title = next(); + else if (a === "--out") args.out = next(); + else if (a === "--story") args.story = next(); + else if (a === "--summary") args.summary = next(); + else { + console.error(`unknown argument ${a}. ${more}`); + process.exit(2); + } +} +const fail = (message) => { + console.error(`${message} ${more}`); + process.exit(2); +}; +if (!args.dot || !args.map) fail(USAGE); +if (!["customer", "developer", "layered"].includes(args.view)) + fail(`--view must be customer, developer, or layered, not ${args.view}.`); +if (args.fixedDot && args.againstDot) fail("use --fixed-dot or --against-dot, not both."); +if (args.fixedTraces.length && !args.fixedDot) fail("--fixed-traces needs --fixed-dot."); +if (args.againstTraces.length && !args.againstDot) fail("--against-traces needs --against-dot."); +if (args.label !== undefined && !args.fixedDot && !args.againstDot) + fail("--label names the second model; it needs --fixed-dot or --against-dot."); +if (args.proof && !args.regions) fail("--proof writes the regions proof; it needs --regions."); +if (args.regionsAll && !args.regions) + fail("--regions-all writes every regions arrow; it needs --regions."); +if ( + args.regions && + (args.view !== "customer" || args.flat || args.pathOnly || args.highlight !== 0) +) + fail( + "--regions draws the whole customer chart: use --highlight 0, without --flat or --path-only.", + ); + +const role = args.fixedDot ? "fix" : args.againstDot ? "against" : null; +const L = args.label ?? (role === "fix" ? "the fix" : "the spec"); +const within = role === "fix" ? "with" : "in"; +const cap = (s) => s.charAt(0).toUpperCase() + s.slice(1); + +const mapping = await import(pathToFileURL(path.resolve(args.map)).href); +if (typeof mapping.state !== "function") + throw new Error("the mapping module must export state(vars)"); +if (args.view !== "customer" && typeof mapping.detail !== "function") + throw new Error(`--view ${args.view} needs detail(vars) in the mapping module`); +const SEP = "\u0000"; +const edgeId = (from, to) => `${from}${SEP}${SEP}${to}`; + +const rules = new Map(); +for (const f of args.specs) + for (const [name, sentence] of ruleSentences(fs.readFileSync(f, "utf8"))) + if (!rules.has(name)) rules.set(name, sentence); + +const readerActions = new Set(mapping.readerActions ?? []); +const factsFrom = (enabled) => ({ + enabled, + settled: [...enabled].every((a) => readerActions.has(a)), +}); +function keyOf(vars, facts) { + if (args.view === "developer") return String(mapping.detail(vars, facts)); + const outer = mapping.state(vars, facts); + if (typeof outer !== "string") + throw new Error(`state() must return a string; got ${JSON.stringify(outer)}`); + return args.view === "layered" ? `${outer}${SEP}${mapping.detail(vars, facts)}` : outer; +} +function stepLabel(action, before, after, view = args.view) { + const said = typeof mapping.step === "function" ? mapping.step(action, before, after) : action; + const named = view === "customer" || said === action ? said : `${said} [${action}]`; + const seconds = typeof mapping.timer === "function" ? mapping.timer(action, before, after) : null; + if (seconds === undefined || seconds === null || seconds === "" || !named) return named; + if (typeof seconds !== "number" || !Number.isFinite(seconds) || seconds <= 0) + throw new Error( + `timer() must return a number of seconds above 0, or nothing; got ${JSON.stringify(seconds)} for ${action}`, + ); + return `after ${seconds} s, ${named}`; +} +function stepGuard(action, before, after) { + if (typeof mapping.guard !== "function") return ""; + return String(mapping.guard(action, before, after) ?? "") + .replace(/[[\]]/g, "") + .trim(); +} +function guarded(guards, label) { + const words = guards?.get(label); + return words && !words.has("") ? `${label} [${[...words].sort().join(" or ")}]` : label; +} +const addGuard = (guards, label, words) => { + if (!guards.has(label)) guards.set(label, new Set()); + guards.get(label).add(words); +}; + +function lacking(a, b, prefix = []) { + return Object.keys(a).flatMap((k) => + !(k in b) + ? [[...prefix, k]] + : isRecord(a[k]) && isRecord(b[k]) + ? lacking(a[k], b[k], [...prefix, k]) + : [], + ); +} +const holder = (o, p) => p.slice(0, -1).reduce((x, k) => (isRecord(x?.[k]) ? x[k] : null), o); +function omit(vars, paths) { + if (!paths.length) return vars; + const out = structuredClone(vars); + for (const p of paths) { + const o = holder(out, p); + if (o) delete o[p.at(-1)]; + } + return out; +} +function fill(vars, paths, from) { + if (!paths.length) return vars; + const out = structuredClone(vars); + for (const p of paths) { + const [o, f] = [holder(out, p), holder(from, p)]; + if (o && f && p.at(-1) in f) o[p.at(-1)] = structuredClone(f[p.at(-1)]); + } + return out; +} + +function modelOf(graph, lookup = (vars) => vars) { + const byId = new Map([...graph.nodes.keys()].map((id) => [id, new Set()])); + for (const e of [...graph.edges, ...graph.loops]) byId.get(e.from).add(e.action); + const index = new Map( + [...graph.nodes.values()].map((n) => [stateKey(n.raw ?? n.vars), byId.get(n.id)]), + ); + const facts = (vars) => factsFrom(index.get(stateKey(lookup(vars))) ?? new Set()); + return { + graph, + facts, + key: (vars) => keyOf(vars, facts(vars)), + customer: (vars) => String(mapping.state(vars, facts(vars))), + }; +} + +function quotient(m) { + const { graph } = m; + const keys = new Map(); + for (const n of graph.nodes.values()) keys.set(n.id, m.key(n.vars)); + const nodes = new Set(keys.values()); + const initial = new Set( + [...graph.nodes.values()].filter((n) => n.init).map((n) => keys.get(n.id)), + ); + const edges = new Map(); + for (const e of graph.edges) { + const from = keys.get(e.from); + const to = keys.get(e.to); + if (from === to) continue; + const id = edgeId(from, to); + if (!edges.has(id)) edges.set(id, { from, to, counts: new Map(), guards: new Map() }); + const [before, after] = [graph.nodes.get(e.from).vars, graph.nodes.get(e.to).vars]; + const label = stepLabel(e.action, before, after); + if (!label) continue; + edges.get(id).counts.set(label, (edges.get(id).counts.get(label) ?? 0) + 1); + addGuard(edges.get(id).guards, label, stepGuard(e.action, before, after)); + } + for (const e of edges.values()) + e.labels = new Set([...e.counts].sort((a, b) => b[1] - a[1]).map(([l]) => l)); + const settled = new Set( + [...graph.nodes.values()].filter((n) => m.facts(n.vars).settled).map((n) => keys.get(n.id)), + ); + return { nodes, initial, edges, keys, settled }; +} + +const graph = parseDot(fs.readFileSync(args.dot, "utf8")); +const main = modelOf(graph); +const now = quotient(main); +const mainInit = [...graph.nodes.values()].find((n) => n.init).vars; + +const secondDot = args.fixedDot ?? args.againstDot; +const secondGraph = secondDot ? parseDot(fs.readFileSync(secondDot, "utf8")) : null; +const secondInit = secondGraph && [...secondGraph.nodes.values()].find((n) => n.init).vars; +const lacks = secondGraph ? lacking(mainInit, secondInit) : []; +const extra = secondGraph ? lacking(secondInit, mainInit) : []; +const secondFilled = secondGraph && { + ...secondGraph, + nodes: new Map( + [...secondGraph.nodes].map(([id, n]) => [ + id, + { ...n, raw: n.vars, vars: fill(n.vars, lacks, mainInit) }, + ]), + ), +}; +const second = secondFilled && modelOf(secondFilled, (vars) => omit(vars, lacks)); +const secondQ = second && quotient(second); + +function readerPath(trace, key, labelOf = stepLabel) { + const out = [{ key: key(trace.steps[0].vars), label: null, modelStep: 0 }]; + for (let i = 1; i < trace.steps.length; i++) { + const { action } = trace.steps[i]; + const k = key(trace.steps[i].vars); + if (k === out[out.length - 1].key && !readerActions.has(action)) continue; + const [before, after] = [trace.steps[i - 1].vars, trace.steps[i].vars]; + const label = labelOf(action, before, after) || action; + const guard = stepGuard(action, before, after); + out.push({ key: k, label, guard, action, modelStep: i }); + } + return out; +} + +const readerLabel = (action, before, after) => stepLabel(action, before, after, "customer"); +function replaySecond(trace) { + if (!second) return null; + const shared = (vars) => stateKey(omit(vars, lacks)); + const sharedOf = (n) => stateKey(omit(n.raw, extra)); + const out = new Map(); + for (const e of [...second.graph.edges, ...second.graph.loops]) { + if (!out.has(e.from)) out.set(e.from, []); + out.get(e.from).push(e); + } + const actions = new Set([...second.graph.edges, ...second.graph.loops].map((e) => e.action)); + const nodeOf = (id) => second.graph.nodes.get(id); + const screen = new Map( + [...second.graph.nodes.values()].map((n) => [n.id, second.customer(n.vars)]), + ); + const words = (e) => readerLabel(e.action, nodeOf(e.from).vars, nodeOf(e.to).vars) || e.action; + const settle = (ids) => { + const all = new Set(ids); + for (const id of all) + for (const e of out.get(id) ?? []) + if (!readerActions.has(e.action) && screen.get(e.to) === screen.get(id)) all.add(e.to); + return all; + }; + const seen = readerPath(trace, main.customer, readerLabel); + const shownAt = new Map(seen.map((p, j) => [p.modelStep, j])); + let here = settle( + [...second.graph.nodes.values()] + .filter((n) => n.init && screen.get(n.id) === seen[0].key) + .map((n) => n.id), + ); + if (here.size === 0) return { reason: "starts on another screen" }; + const passed = new Set(here); + let j = 0; + for (let i = 1; i < trace.steps.length; i++) { + const { action } = trace.steps[i]; + const hidden = !shownAt.has(i); + if (!hidden) j = shownAt.get(i); + const want = seen[j]; + const [before, after] = [trace.steps[i - 1].vars, trace.steps[i].vars]; + const known = actions.has(action); + if (!known && (hidden || shared(before) === shared(after))) continue; + const tries = [...here].flatMap((id) => + (out.get(id) ?? []).filter((e) => + known ? e.action === action : sharedOf(nodeOf(e.to)) === shared(after), + ), + ); + if (hidden && tries.length === 0) continue; + const same = known + ? tries.filter((e) => screen.get(e.to) === want.key && (hidden || words(e) === want.label)) + : tries; + if (same.length) { + here = settle(same.map((e) => e.to)); + for (const id of here) passed.add(id); + continue; + } + const outcomes = new Map(); + for (const e of tries) { + const id = `${screen.get(e.to)}${SEP}${words(e)}`; + outcomes.set(id, [...(outcomes.get(id) ?? []), e]); + } + const taken = [...outcomes.values()].sort((a, b) => b.length - a.length)[0]?.[0]; + const from = main.key(before); + const said = hidden ? readerLabel(action, before, after) || action : want.label; + const at = { step: j, said, from, hidden }; + if (!taken) + return { + ...at, + key: from, + label: stepLabel(action, before, after) || action, + disabled: true, + }; + const [b, a] = [nodeOf(taken.from).vars, nodeOf(taken.to).vars]; + return { ...at, key: second.key(a), label: stepLabel(taken.action, b, a) || taken.action }; + } + const bad = new Set( + rawSecondTraces + .filter((t) => t.invariant === trace.invariant) + .map((t) => stateKey(t.steps[t.steps.length - 1].vars)), + ); + const ruleHolds = + secondTraceFiles.length > 0 && ![...passed].some((id) => bad.has(stateKey(nodeOf(id).vars))); + return { sameEnd: true, ruleHolds }; +} + +function readTraces(files, paths = []) { + return files.flatMap((f) => { + const text = fs.readFileSync(f, "utf8"); + checkTlcOutput(text, f); + return parseTraces(text).map((t) => ({ + ...t, + steps: t.steps.map((s) => ({ ...s, vars: fill(s.vars, paths, mainInit) })), + })); + }); +} +// With -continue, TLC reports every bad state, including states after the first bad one. +function firstBad(raw) { + const badStates = new Map(); + for (const t of raw) { + if (!badStates.has(t.invariant)) badStates.set(t.invariant, new Set()); + badStates.get(t.invariant).add(stateKey(t.steps[t.steps.length - 1].vars)); + } + const cuts = []; + const seen = new Set(); + for (const t of raw) { + const first = t.steps.findIndex((s) => badStates.get(t.invariant).has(stateKey(s.vars))); + const cut = { invariant: t.invariant, steps: t.steps.slice(0, first + 1) }; + const id = `${t.invariant}${SEP}${stateKey(cut.steps[cut.steps.length - 1].vars)}`; + if (seen.has(id)) continue; + seen.add(id); + cuts.push(cut); + } + return cuts; +} +const rawTraces = readTraces(args.traces); +const secondTraceFiles = role === "fix" ? args.fixedTraces : args.againstTraces; +const rawSecondTraces = readTraces(secondTraceFiles, lacks); +const traces = firstBad(rawTraces); +const secondTraces = firstBad(rawSecondTraces); +function group(cuts, m) { + const byId = new Map(); + for (const trace of cuts) { + const rp = readerPath(trace, m.customer); + const last = trace.steps[trace.steps.length - 1].vars; + const said = + typeof mapping.cause === "function" + ? mapping.cause(last, m.facts(last), trace.invariant) + : null; + const cause = said === undefined || said === null ? null : String(said); + const id = `${trace.invariant}${SEP}${cause ?? rp[rp.length - 1].key}`; + const prev = byId.get(id); + if ( + !prev || + rp.length < prev.steps || + (rp.length === prev.steps && trace.steps.length < prev.trace.steps.length) + ) { + byId.set(id, { + id, + cause, + steps: rp.length, + trace, + invariant: trace.invariant, + count: (prev?.count ?? 0) + 1, + }); + } else prev.count++; + } + return byId; +} +const byOrder = (a, b) => + a.steps - b.steps || + a.trace.steps.length - b.trace.steps.length || + (a.id < b.id ? -1 : a.id > b.id ? 1 : 0); +const inSecond = (l) => `${within} ${L}, ${l}`; +const modelEdges = new Map(now.edges); +if (secondQ) + for (const [id, e] of secondQ.edges) + if (!modelEdges.has(id)) + modelEdges.set(id, { + ...e, + labels: new Set([...e.labels].map(inSecond)), + guards: new Map([...e.guards].map(([l, words]) => [inSecond(l), words])), + secondOnly: true, + }); +function divergence(s) { + if (s?.key === undefined) return s; + const plain = edgeId(s.from, s.key); + const text = inSecond(`${s.label}${s.disabled ? " cannot happen" : ""}`); + const drawn = !s.disabled && [s.label, text].some((l) => modelEdges.get(plain)?.labels.has(l)); + return { ...s, text, edge: drawn ? plain : `${plain}${SEP}second` }; +} +const withPath = (c, m) => { + const path = readerPath(c.trace, m.key); + return { ...c, path, end: path[path.length - 1].key }; +}; +const classesById = group(traces, main); +const mainClasses = [...classesById.values()] + .sort(byOrder) + .map((c) => ({ ...withPath(c, main), second: divergence(replaySecond(c.trace)) })); +const introduced = second + ? [...group(secondTraces, second).values()] + .filter((c) => !classesById.has(c.id)) + .sort(byOrder) + .map((c) => ({ ...withPath(c, second), second: null, introduced: true })) + : []; +const classes = [...mainClasses, ...introduced]; + +const diverges = (c) => c.second?.key !== undefined; +function badKeys(m, keys, raw) { + const g = m.graph; + const bad = new Set(raw.map((t) => stateKey(t.steps[t.steps.length - 1].vars))); + const out = new Set(raw.map((t) => m.key(t.steps[t.steps.length - 1].vars))); + const ok = (id) => !bad.has(stateKey(g.nodes.get(id).vars)); + const next = new Map(); + for (const e of g.edges) { + if (!next.has(e.from)) next.set(e.from, []); + next.get(e.from).push(e.to); + } + const clean = new Set([...g.nodes.values()].filter((n) => n.init && ok(n.id)).map((n) => n.id)); + const queue = [...clean]; + while (queue.length) { + for (const to of next.get(queue.shift()) ?? []) { + if (clean.has(to) || !ok(to)) continue; + clean.add(to); + queue.push(to); + } + } + const reached = new Set([...clean].map((id) => keys.get(id))); + for (const k of keys.values()) if (!reached.has(k)) out.add(k); + return out; +} +const badNow = badKeys(main, now.keys, rawTraces); +const badSecond = + second && secondTraceFiles.length > 0 + ? badKeys(second, secondQ.keys, rawSecondTraces) + : role === "fix" + ? badNow + : new Set(); +const allNodes = new Set([...now.nodes, ...(secondQ?.nodes ?? [])]); +const initial = new Set([...now.initial, ...(secondQ?.initial ?? [])]); +const onlySecond = (k) => second && !now.nodes.has(k); +const status = (k) => { + if (role === "against") + return badNow.has(k) || badSecond.has(k) ? "wrong" : onlySecond(k) ? "fixed" : "works"; + if (role === "fix") + return badSecond.has(k) ? "wrong" : badNow.has(k) || onlySecond(k) ? "fixed" : "works"; + return badNow.has(k) ? "wrong" : "works"; +}; + +const chosen = args.highlight > 0 ? classes[args.highlight - 1] : null; +if (args.highlight > 0 && classes.length > 0 && !chosen) + throw new Error(`--highlight ${args.highlight}: only ${classes.length} classes`); +const onPath = new Set(chosen ? chosen.path.map((p) => p.key) : []); +if (chosen && diverges(chosen)) onPath.add(chosen.second.key); + +const edgesAlong = (c) => + c.path.slice(1).map((p, i) => ({ + id: edgeId(c.path[i].key, p.key), + from: c.path[i].key, + to: p.key, + label: p.label, + guard: p.guard, + })); +function chartEdges() { + const edges = new Map(modelEdges); + for (const { second: s } of classes.filter(diverges)) { + if (modelEdges.has(s.edge)) continue; + if (!edges.has(s.edge)) + edges.set(s.edge, { from: s.from, to: s.key, labels: new Set(), secondOnly: true }); + edges.get(s.edge).labels.add(s.text); + } + const pathNumbers = new Map(); + (chosen ? edgesAlong(chosen) : []).forEach((step, i) => { + if (!pathNumbers.has(step.id)) pathNumbers.set(step.id, []); + const shown = step.guard ? `${step.label} [${step.guard}]` : step.label; + pathNumbers.get(step.id).push({ n: i + 1, label: step.label, shown }); + if (!edges.has(step.id)) + edges.set(step.id, { from: step.from, to: step.to, labels: new Set([step.label]) }); + }); + if (!args.cover) return { edges, pathNumbers, coverEdges: null }; + + const coverEdges = new Set(); + const bfs = (q, targets) => { + const parent = new Map([...q.initial].map((k) => [k, null])); + const queue = [...q.initial]; + const outEdges = new Map(); + for (const [id, e] of q.edges) { + if (!outEdges.has(e.from)) outEdges.set(e.from, []); + outEdges.get(e.from).push([id, e]); + } + while (queue.length) { + const k = queue.shift(); + for (const [id, e] of outEdges.get(k) ?? []) { + if (parent.has(e.to)) continue; + parent.set(e.to, id); + queue.push(e.to); + } + } + for (const t of targets) { + for (let id = parent.get(t); id; id = parent.get(q.edges.get(id).from)) coverEdges.add(id); + } + }; + bfs(now, now.settled); + if (secondQ) + bfs( + secondQ, + [...secondQ.settled].filter((k) => !now.nodes.has(k)), + ); + const pathLabels = new Map(); + for (const c of classes) { + for (const step of edgesAlong(c)) { + coverEdges.add(step.id); + pathLabels.set(step.id, (pathLabels.get(step.id) ?? new Set()).add(step.label)); + } + if (diverges(c)) coverEdges.add(c.second.edge); + } + for (const id of coverEdges) { + if (edges.has(id)) continue; + const [from, to] = id.split(`${SEP}${SEP}`); + edges.set(id, { from, to, labels: pathLabels.get(id) }); + } + return { edges, pathNumbers, coverEdges }; +} +const { edges, pathNumbers, coverEdges } = chartEdges(); + +const LEGEND = { + works: ["legendWorks", mapping.legend?.works ?? (role === "fix" ? "Works today" : "Works")], + wrong: [ + "legendWrong", + mapping.legend?.wrong ?? (role === "fix" ? `Still wrong with ${L}` : "Breaks a rule"), + ], + fixed: [ + "legendFixed", + mapping.legend?.fixed ?? (role === "fix" ? `Fixed or new with ${L}` : `Only in ${L}`), + ], +}; + +const grouping = typeof mapping.group === "function"; +const groupsOf = new Map(); +const groupOf = (k) => (groupsOf.get(k)?.size === 1 ? [...groupsOf.get(k)][0] : ""); +const groupNames = []; +const fills = new Map(); +if (grouping) { + const add = (k, vars, m) => { + const g = mapping.group(vars, m.facts(vars)); + if (g !== undefined && g !== null && typeof g !== "string") + throw new Error(`group() must return a group name or nothing; got ${JSON.stringify(g)}`); + if (!groupsOf.has(k)) groupsOf.set(k, new Set()); + groupsOf.get(k).add((g ?? "").replace(/\s+/g, " ").trim()); + }; + for (const n of graph.nodes.values()) add(now.keys.get(n.id), n.vars, main); + if (second) + for (const n of second.graph.nodes.values()) add(secondQ.keys.get(n.id), n.vars, second); + + const given = mapping.groupColors ?? {}; + if (!isRecord(given)) + throw new Error("groupColors must be an object from a group name to a color such as #d6eaf8"); + const statusNames = new Set( + [ + "Works", + "Works today", + "Breaks a rule", + "Still wrong", + "Fixed", + ...Object.values(LEGEND).map(([, t]) => t), + ].map((t) => t.toLowerCase()), + ); + const found = new Set([...groupsOf.values()].flatMap((gs) => [...gs]).filter(Boolean)); + for (const g of found) + if (statusNames.has(g.toLowerCase())) + throw new Error( + `group "${g}" has the name of a status; TLC decides the status, so name the group for what the reader sees`, + ); + groupNames.push( + ...Object.keys(given).filter((g) => found.has(g)), + ...[...found].filter((g) => !Object.hasOwn(given, g)).sort(), + ); + for (const [g, color] of Object.entries(given)) { + if (color === undefined || color === null || color === "") continue; + const why = groupColorProblem(color); + if (why) throw new Error(`groupColors["${g}"] ${JSON.stringify(color)} ${why}`); + if (found.has(g)) fills.set(g, color.toLowerCase()); + } + const free = GROUP_PALETTE.filter((c) => ![...fills.values()].includes(c)); + for (const g of groupNames) { + if (fills.has(g)) continue; + if (!free.length) + throw new Error( + `the mapping has ${groupNames.length} groups, more than the ${GROUP_PALETTE.length} colors of the palette; give the others a color in groupColors`, + ); + fills.set(g, free.shift()); + } +} +const mixedGroups = [...groupsOf].filter(([, gs]) => gs.size > 1).map(([k]) => k); + +const BORDER = { works: "", wrong: "Wrong", fixed: "Fixed" }; +const classFor = (g, s, path) => + grouping + ? `${g ? `group${groupNames.indexOf(g)}` : "plain"}${BORDER[s] || (path ? "Path" : "")}` + : `${s}${path ? "Path" : ""}`; +const drawnState = (g, s, path = false) => ({ group: g, status: s, cls: classFor(g, s, path) }); +const groupCounts = (drawn) => + groupNames + .map((g) => ({ + name: g, + color: fills.get(g), + states: drawn.filter((d) => d.group === g).length, + })) + .filter((g) => g.states > 0); + +// Mermaid shrinks a chart to the page width unless useMaxWidth is false, and rewraps labels that +// wrap() already wrapped unless markdownAutoWrap is false. +const frontMatter = (title) => [ + "---", + ...(title ? [`title: ${JSON.stringify(title)}`] : []), + "config:", + " markdownAutoWrap: false", + " state:", + " useMaxWidth: false", + "---", +]; +function head(drawn) { + const out = [...frontMatter(args.title), "stateDiagram-v2"]; + if (role) out.push(` %% second model (${role}): ${L}`); + if (args.fullLabels) out.push(` ${FULL_LABELS}`); + const used = Object.keys(LEGEND).filter((s) => drawn.some((d) => d.status === s)); + const legend = grouping + ? [ + ...groupCounts(drawn).map(({ name }) => { + const i = groupNames.indexOf(name); + return [`legendGroup${i}`, name, `group${i}`]; + }), + ...used.filter((s) => BORDER[s]).map((s) => [...LEGEND[s], `plain${BORDER[s]}`]), + ] + : used.map((s) => [...LEGEND[s], s]); + if (grouping) { + const styleClasses = new Set([...drawn.map((d) => d.cls), ...legend.map(([, , c]) => c)]); + const bases = [["plain", PLAIN_FILL], ...groupNames.map((g, i) => [`group${i}`, fills.get(g)])]; + for (const [base, fill] of bases) + for (const border of ["", "Wrong", "Fixed", "Path"]) + if (styleClasses.has(base + border)) out.push(` ${groupClassDef(base, fill, border)}`); + } else for (const c of STATUS_CLASSES) out.push(` ${c}`); + if (legend.length) { + out.push(` state "Legend" as ${LEGEND_ID} {`); + for (const [id, text] of legend) out.push(` state "${quote(text)}" as ${id}`); + out.push(" }"); + for (const [id, , c] of legend) out.push(` class ${id} ${c}`); + } + return out; +} + +function regionsChart({ states, starts, edges, classes, proofPath, allPath }) { + const norm = (s) => s.replaceAll(";", ",").replace(/\s+/g, " ").trim(); + const split = (k) => { + const at = k.indexOf(": "); + return at > 0 && at + 2 < k.length ? [norm(k.slice(0, at)), norm(k.slice(at + 2))] : null; + }; + const nodes = [...states].sort(); + if (!nodes.every(split)) return null; + const steps = []; + for (const e of edges.values()) { + if (e.labels.size === 0) return { why: "a step has no label" }; + for (const l of e.labels) + steps.push({ + from: split(e.from), + to: split(e.to), + label: norm(l), + words: e.guards?.get(l) ?? new Set([""]), + }); + } + const bar = (p) => p.join(" | "); + const flat = { + Main: { + states: new Set(nodes.map((k) => bar(split(k)))), + initial: new Set(starts.map((k) => bar(split(k)))), + transitions: steps.map((s) => ({ from: bar(s.from), to: bar(s.to), label: s.label })), + }, + }; + const ids = new Map([...flat.Main.states].map((s, i) => [s, `p${i}`])); + const proof = [ + ...frontMatter(), + "stateDiagram-v2", + ...[...ids].map(([s, id]) => ` state "${quote(s)}" as ${id}`), + ...[...flat.Main.initial].map((s) => ` [*] --> ${ids.get(s)}`), + ...steps.map((s) => ` ${ids.get(bar(s.from))} --> ${ids.get(bar(s.to))} : ${s.label}`), + ]; + if (proofPath) fs.writeFileSync(proofPath, proof.join("\n") + "\n"); + + const beside = [new Map(), new Map()]; + for (const k of nodes) { + const p = split(k); + for (const i of [0, 1]) { + if (!beside[i].has(p[i])) beside[i].set(p[i], new Set()); + beside[i].get(p[i]).add(p[1 - i]); + } + } + const size = beside[0].size + beside[1].size; + if (size >= nodes.length) + return { why: `${size} region states are not fewer than the ${nodes.length} flat states` }; + + const rank = ["works", "fixed", "wrong"]; + const regionStatus = [new Map(), new Map()]; + for (const k of nodes) { + const p = split(k); + for (const i of [0, 1]) { + const prev = regionStatus[i].get(p[i]); + if (!prev || rank.indexOf(status(k)) < rank.indexOf(prev)) + regionStatus[i].set(p[i], status(k)); + } + } + for (const k of nodes) { + const p = split(k); + const shown = rank[Math.max(...[0, 1].map((i) => rank.indexOf(regionStatus[i].get(p[i]))))]; + if (shown !== status(k)) + return { + why: `"${k}" is "${LEGEND[status(k)][1]}", and its two region states would show "${LEGEND[shown][1]}"`, + }; + } + + const moves = [new Map(), new Map()]; + for (const s of steps) + for (const i of [0, 1]) { + const id = [s.from[i], s.label, s.to[i]].join(SEP); + if (!moves[i].has(id)) + moves[i].set(id, { + from: s.from[i], + label: s.label, + to: s.to[i], + beside: new Set(), + guards: new Map(), + }); + moves[i].get(id).beside.add(s.from[1 - i]); + for (const w of s.words) addGuard(moves[i].get(id).guards, s.label, norm(w)); + } + for (const m of moves) + for (const [id, x] of m) + if ( + x.from === x.to && + ![...m.values()].some((y) => y.from === x.from && y.label === x.label && y.to !== x.from) + ) + m.delete(id); + const rid = beside.map((m, i) => new Map([...m.keys()].sort().map((s, j) => [s, `r${i}s${j}`]))); + const regionGroup = [new Map(), new Map()]; + for (const k of nodes) { + const p = split(k); + for (const i of [0, 1]) { + const prev = regionGroup[i].get(p[i]); + regionGroup[i].set(p[i], prev === undefined || prev === groupOf(k) ? groupOf(k) : ""); + } + } + const drawn = rid.map((m, i) => + [...m.keys()].map((s) => drawnState(regionGroup[i].get(s), regionStatus[i].get(s))), + ); + const draw = (only) => { + const out = head(drawn.flat()); + out.push(` state "At the same time" as regions {`); + let count = 0; + for (const i of [0, 1]) { + if (i) out.push(" --"); + const name = mapping.regionNames?.[i]; + const pad = name ? " " : " "; + if (name) out.push(` state "${quote(wrap(name))}" as region${i} {`); + for (const s of new Set(starts.map((k) => split(k)[i]))) + out.push(`${pad}[*] --> ${rid[i].get(s)}`); + for (const [s, id] of rid[i]) out.push(`${pad}state "${quote(wrap(s))}" as ${id}`); + const shownMoves = [...moves[i]] + .filter(([id]) => !only || only[i].has(id)) + .map(([, m]) => m) + .sort((a, b) => a.from.localeCompare(b.from) || a.label.localeCompare(b.label)); + for (const m of shownMoves) { + const all = beside[i].get(m.from); + const not = [...all].filter((s) => !m.beside.has(s)).sort(); + const yes = [...m.beside].sort(); + const unless = not.length > 0 && not.length < yes.length; + const guard = not.length === 0 ? null : unless ? not : yes; + const worded = guarded(m.guards, m.label); + const text = + worded !== m.label || !guard + ? worded + : `${m.label} [${unless ? "unless" : "when"} ${guard.join(" or ")}]`; + out.push(`${pad}${rid[i].get(m.from)} --> ${rid[i].get(m.to)} : ${wrap(text, 30)}`); + if (guard) + out.push( + `${pad}%% when ${unless ? "not " : ""}${guard.map((s) => rid[1 - i].get(s)).join(", ")}`, + ); + count++; + } + if (name) out.push(" }"); + } + out.push(" }"); + for (const i of [0, 1]) + [...rid[i].values()].forEach((id, j) => out.push(` class ${id} ${drawn[i][j].cls}`)); + return { mermaid: out.join("\n") + "\n", count }; + }; + + const all = draw(null); + const differences = compareCharts(parseMermaid(all.mermaid).regions, flat); + if (differences.length) { + const n = differences.reduce((sum, [, xs]) => sum + xs.length, 0); + return { + why: `the regions do not combine into the flat chart, with ${n} difference(s), such as ${differences[0][0]}: ${differences[0][1][0]}`, + }; + } + if (allPath) fs.writeFileSync(allPath, all.mermaid); + + const parts = new Map(nodes.map((k) => [bar(split(k)), split(k)])); + const key = (from, label, to) => `${from} --> ${to} : ${label}`; + const real = new Set(steps.map((s) => key(bar(s.from), s.label, bar(s.to)))); + const next = new Map(); + for (const s of steps) { + if (!next.has(bar(s.from))) next.set(bar(s.from), []); + next.get(bar(s.from)).push(s); + } + const keep = [new Set(), new Set()]; + const movesOf = (s) => + [0, 1] + .filter((i) => s.from[i] !== s.to[i]) + .map((i) => [i, [s.from[i], s.label, s.to[i]].join(SEP)]); + const price = (s) => movesOf(s).filter(([i, id]) => !keep[i].has(id)).length * nodes.length + 1; + const wanted = []; + const want = (s) => { + wanted.push(s); + for (const [i, id] of movesOf(s)) keep[i].add(id); + }; + const stepsOf = (e, said) => { + const labels = [...e.labels].map(norm); + return (labels.includes(said) ? [said] : labels).map((label) => ({ + from: split(e.from), + to: split(e.to), + label, + })); + }; + for (const c of classes) { + for (const step of edgesAlong(c)) { + const e = edges.get(step.id); + if (e) stepsOf(e, norm(step.label)).forEach(want); + } + if (diverges(c)) stepsOf(edges.get(c.second.edge), "").forEach(want); + } + const cheapest = () => { + const cost = new Map(starts.map((k) => [bar(split(k)), 0])); + const parent = new Map(); + const open = new Set(cost.keys()); + while (open.size) { + const k = [...open].reduce((a, b) => (cost.get(b) < cost.get(a) ? b : a)); + open.delete(k); + for (const s of next.get(k) ?? []) { + const c = cost.get(k) + price(s); + if (c < (cost.get(bar(s.to)) ?? Infinity)) { + cost.set(bar(s.to), c); + parent.set(bar(s.to), s); + open.add(bar(s.to)); + } + } + } + return { cost, parent }; + }; + const targets = [ + ...[0, 1].flatMap((i) => + [...beside[i].keys()].sort().map((r) => ({ at: (k) => parts.get(k)[i] === r })), + ), + ...[...new Set(steps.map((s) => s.label))] + .filter((l) => !wanted.some((s) => s.label === l)) + .sort() + .map((l) => ({ ends: (s) => s.label === l })), + ]; + while (targets.length) { + const { cost, parent } = cheapest(); + let best = null; + targets.forEach((t, n) => { + const ways = t.at + ? [...cost.keys()].filter(t.at).map((k) => ({ k, c: cost.get(k), last: null })) + : steps + .filter(t.ends) + .filter((s) => cost.has(bar(s.from))) + .map((s) => ({ k: bar(s.from), c: cost.get(bar(s.from)) + price(s), last: s })); + for (const w of ways) if (!best || w.c < best.c) best = { ...w, n }; + }); + if (!best) break; + targets.splice(best.n, 1); + const path = best.last ? [best.last] : []; + for (let s = parent.get(best.k); s; s = parent.get(bar(s.from))) path.push(s); + path.forEach(want); + } + const takes = (x, label) => + [0, 1].flatMap((i) => + [...moves[i]] + .filter(([, m]) => m.from === x[i] && m.label === label && m.beside.has(x[1 - i])) + .map(([id]) => [i, id]), + ); + let scoped; + let made; + for (;;) { + scoped = draw(keep); + made = productOf(parseMermaid(scoped.mermaid).regions); + const madeKeys = new Set(made.transitions.map((t) => key(t.from, t.label, t.to))); + const redo = [ + ...made.transitions + .filter((t) => parts.has(t.from) && !real.has(key(t.from, t.label, t.to))) + .map((t) => [parts.get(t.from), t.label]), + ...wanted + .filter((s) => made.states.has(bar(s.from))) + .filter((s) => !madeKeys.has(key(bar(s.from), s.label, bar(s.to)))) + .map((s) => [s.from, s.label]), + ]; + const before = keep[0].size + keep[1].size; + for (const [x, label] of redo) for (const [i, id] of takes(x, label)) keep[i].add(id); + if (keep[0].size + keep[1].size === before) break; + } + const sound = + [...made.states].every((s) => parts.has(s)) && + made.transitions.every((t) => real.has(key(t.from, t.label, t.to))); + if (!sound) scoped = all; + + return { + mermaid: scoped.mermaid, + states: [beside[0].size, beside[1].size], + transitions: scoped.count, + all: all.count, + flat: { states: nodes.length, transitions: steps.length }, + status: Object.fromEntries( + rank.map((s) => [ + s, + regionStatus.reduce((n, m) => n + [...m.values()].filter((x) => x === s).length, 0), + ]), + ), + groups: groupCounts(drawn.flat()), + }; +} +const regions = args.regions + ? regionsChart({ + states: allNodes, + starts: [...initial], + edges, + classes, + proofPath: args.proof, + allPath: args.regionsAll, + }) + : null; +if (regions?.why) console.error(`regions: not drawn, because ${regions.why}`); + +const flatStates = + args.pathOnly && chosen + ? onPath + : coverEdges + ? new Set([ + ...initial, + ...[...coverEdges].flatMap((id) => [edges.get(id).from, edges.get(id).to]), + ]) + : allNodes; +const sorted = [...flatStates].sort(); +const drawn = sorted.map((k) => drawnState(groupOf(k), status(k), onPath.has(k))); + +const boxes = new Map(); +const boxOf = new Map(); +const inBox = (k, box) => { + if (!boxes.has(box)) boxes.set(box, []); + boxes.get(box).push(k); +}; +if (args.view === "layered") for (const k of sorted) inBox(k, k.split(SEP)[0]); +else if (args.view === "customer" && !args.flat) { + for (const k of sorted) { + const at = k.indexOf(": "); + if (at > 0 && at + 2 < k.length) inBox(k, k.slice(0, at)); + } + for (const [box, members] of boxes) if (members.length < 2) boxes.delete(box); +} +const boxIds = new Map([...boxes.keys()].map((box, i) => [box, `g${i}`])); +for (const [box, members] of boxes) for (const k of members) boxOf.set(k, box); +const declared = [...[...boxes.values()].flat(), ...sorted.filter((k) => !boxOf.has(k))]; +const stateIds = new Map(declared.map((k, i) => [k, `s${i}`])); +const idOf = (k) => stateIds.get(k); +const caption = (k) => + args.view === "layered" ? k.split(SEP)[1] : boxOf.has(k) ? k.slice(boxOf.get(k).length + 2) : k; + +function numbered(steps) { + const runs = []; + for (const { n, shown } of steps) { + const last = runs.at(-1); + if (last?.shown === shown && last.n.at(-1) === n - 1) last.n.push(n); + else runs.push({ shown, n: [n] }); + } + return runs.map(({ shown, n }) => `${n.join(", ")}. ${shown}`); +} +const drawnLabels = new Set(); +const arrows = new Map(); +for (const [id, e] of edges) { + if (!flatStates.has(e.from) || !flatStates.has(e.to)) continue; + if (args.pathOnly && chosen && !pathNumbers.has(id) && id !== chosen.second?.edge) continue; + if (coverEdges && !coverEdges.has(id)) continue; + const pair = edgeId(e.from, e.to); + if (!arrows.has(pair)) + arrows.set(pair, { from: e.from, to: e.to, groups: [[], [], []], plain: true, labels: [] }); + const a = arrows.get(pair); + const [numbers, current, other] = a.groups; + const all = [...e.labels]; + const shown = all.map((l) => guarded(e.guards, l)); + const said = args.fullLabels ? shown.join(" or ") : joinLabels(shown); + const p = pathNumbers.get(id); + const chosenStep = chosen?.second && id === chosen.second.edge; + if (p) numbers.push(...numbered(p)); + else if (!e.secondOnly) current.push(said); + else other.push(args.pathOnly && chosenStep ? chosen.second.text : said); + if (chosenStep && !e.secondOnly) other.push(chosen.second.text); + if (p || chosenStep || id.endsWith(`${SEP}second`)) a.plain = false; + a.labels.push(...all); + for (const l of p ? p.map((s) => s.label) : all) drawnLabels.add(l); +} +const transitions = [...arrows.values()].map(({ from, to, groups, plain, labels }) => ({ + from, + to, + // ";" ends a Mermaid statement, even inside a transition label. + text: groups + .map((g) => + g + .filter(Boolean) + .map((l) => wrap(l.replaceAll(";", ","), 30)) + .join("
"), + ) + .filter(Boolean) + .join("
#160;
"), + plain, + labels: labels.sort(), +})); +const fromBox = []; +const folded = new Set(); +for (const [box, members] of boxes) { + const mine = new Set(members); + const byStep = new Map(); + for (const l of transitions) { + if (!l.plain || !mine.has(l.from) || mine.has(l.to)) continue; + const step = `${l.to}${SEP}${l.text}${SEP}${l.labels.join(SEP)}`; + if (!byStep.has(step)) byStep.set(step, []); + byStep.get(step).push(l); + } + for (const same of byStep.values()) { + if (new Set(same.map((l) => l.from)).size !== members.length) continue; + for (const l of same) folded.add(l); + fromBox.push({ ...same[0], box }); + } +} + +const out = head(drawn); +for (const [box, members] of boxes) { + out.push(` state "${quote(wrap(box))}" as ${boxIds.get(box)} {`); + for (const k of members) out.push(` state "${quote(wrap(caption(k)))}" as ${idOf(k)}`); + out.push(" }"); +} +for (const k of sorted) + if (!boxOf.has(k)) out.push(` state "${quote(wrap(caption(k)))}" as ${idOf(k)}`); +for (const k of sorted) + if (initial.has(k) && (!args.pathOnly || k === chosen?.path[0].key)) + out.push(` [*] --> ${idOf(k)}`); +const arrow = (from, l) => ` ${from} --> ${idOf(l.to)}${l.text ? ` : ${l.text}` : ""}`; +for (const l of fromBox) out.push(arrow(boxIds.get(l.box), l)); +for (const l of transitions) if (!folded.has(l)) out.push(arrow(idOf(l.from), l)); +sorted.forEach((k, i) => out.push(` class ${idOf(k)} ${drawn[i].cls}`)); +const mermaid = regions?.mermaid ?? out.join("\n") + "\n"; +if (args.out) fs.writeFileSync(args.out, mermaid); +else process.stdout.write(mermaid); + +const show = (k) => (args.view === "layered" ? k.replace(SEP, ": ") : k); +const ruleOf = (c) => rules.get(c.invariant) ?? `\`${c.invariant}\``; +function secondLine(c) { + const W = cap(within); + if (c.introduced) return `Only ${L} has this bug. The steps above happen ${within} ${L}.`; + const s = c.second; + if (!s) return null; + if (s.sameEnd) + return s.ruleHolds + ? `${W} ${L} you see the same screens and steps, yet the rule holds, so the state labels do not show what ${L} changes.` + : `${W} ${L} you see the same screens and steps, so ${L} does not change this path.`; + if (s.reason) return `${cap(L)} cannot take these steps: it ${s.reason}.`; + const outcome = s.disabled + ? "cannot happen, so you stay at" + : s.key === s.from + ? "keeps you at" + : "takes you to"; + if (s.hidden) { + const when = s.step ? `after step ${s.step}` : "before your first step"; + return `${W} ${L}, ${when}, "${s.said}" happens and ${outcome}: ${show(s.key)}.`; + } + return `${W} ${L}, step ${s.step} (${s.said}) ${outcome}: ${show(s.key)}.`; +} +if (args.story) { + const lines = []; + const header = role === "fix" ? `New with ${L}: ` : `Only in ${L}: `; + classes.forEach((c, i) => { + lines.push(`## ${i + 1}. ${c.introduced ? header : ""}${show(c.end)}`, ""); + lines.push(`Rule broken: ${ruleOf(c)}`); + if (c.cause) lines.push(`Why: ${c.cause.replace(/\.$/, "")}.`); + lines.push( + c.count === 1 + ? "This is the only way to get here in the model." + : `There are ${c.count} ways to get here in the model. This is the shortest.`, + "", + ); + c.path.forEach((p, j) => + lines.push( + j === 0 ? `0. Start: ${show(p.key)}` : `${j}. ${cap(p.label)}. Now: ${show(p.key)}`, + ), + ); + lines.push(""); + const said = secondLine(c); + if (said) lines.push(said, ""); + }); + fs.writeFileSync(args.story, lines.join("\n")); +} +const CODE_LIKE = /\b[a-z]{2,}[A-Z][a-z]|\b\w+_\w+\b|\b[A-Za-z_]\w*\(|\b[A-Z][a-z]+[A-Z][a-z]/; +const codeLike = [ + ...new Set([ + ...(args.view === "customer" ? [...sorted, ...drawnLabels] : []), + ...classes.map((c) => c.cause).filter(Boolean), + ]), +].filter((t) => CODE_LIKE.test(t)); +const secondOf = (c) => + c.introduced + ? role === "fix" + ? `new with ${L}` + : `only in ${L}` + : c.second + ? c.second.sameEnd + ? c.second.ruleHolds + ? "same screens, but the rule holds" + : "unchanged" + : (c.second.reason ?? show(c.second.key)) + : null; +const summary = { + view: args.view, + ...(role ? { second: { role, label: L, lacks: lacks.map((p) => p.join(".")) } } : {}), + modelStates: graph.nodes.size, + modelTransitions: graph.edges.length, + chartStates: regions?.mermaid ? regions.states[0] + regions.states[1] : flatStates.size, + chartTransitions: regions?.mermaid ? regions.transitions : transitions.length, + chartStatus: regions?.mermaid + ? regions.status + : Object.fromEntries( + ["works", "wrong", "fixed"].map((s) => [ + s, + [...flatStates].filter((k) => status(k) === s).length, + ]), + ), + ...(grouping + ? { + chartGroups: regions?.mermaid ? regions.groups : groupCounts(drawn), + mixedGroups: mixedGroups.map(show).sort(), + } + : {}), + ...(regions + ? { + regions: regions.mermaid + ? { + drawn: true, + states: regions.states, + transitions: regions.transitions, + all: regions.all, + flat: regions.flat, + } + : { drawn: false, why: regions.why }, + } + : {}), + classes: classes.map((c, i) => ({ + n: i + 1, + end: show(c.end), + invariant: c.invariant, + rule: rules.get(c.invariant) ?? null, + cause: c.cause, + readerSteps: c.path.length - 1, + modelSteps: c.trace.steps.length, + counterexamples: c.count, + [role ?? "fix"]: secondOf(c), + })), + codeLike, +}; +if (args.summary) fs.writeFileSync(args.summary, JSON.stringify(summary, null, 2) + "\n"); +const extraBugs = introduced.length + ? `, ${introduced.length} ${role === "fix" ? `new with ${L}` : `only in ${L}`}` + : ""; +const drawnAs = regions?.mermaid + ? ` of ${regions.all} in 2 regions (proved against ${regions.flat.states} states, ${regions.flat.transitions} transitions)` + : ""; +console.error( + `chart: ${summary.chartStates} states, ${summary.chartTransitions} transitions${drawnAs} from ${summary.modelStates} model states; ` + + `${mainClasses.length} bug(s)${extraBugs}`, +); diff --git a/plugins/pstack/skills/swarm/SKILL.md b/plugins/pstack/skills/swarm/SKILL.md index c78fe80..fd2b4ea 100644 --- a/plugins/pstack/skills/swarm/SKILL.md +++ b/plugins/pstack/skills/swarm/SKILL.md @@ -6,8 +6,6 @@ disable-model-invocation: true # Swarm -Fan out N parallel workers. They may cover separate slices, race the same brief, or mix both. The parent waits, aggregates, and returns one report. - ## Start Open a todolist with one entry per phase before launching anything. @@ -21,7 +19,6 @@ Open a todolist with one entry per phase before launching anything. 1. State the done predicate and the artifact or report the swarm must return. 2. Choose the shape. Partition into slices, race N workers on identical briefs, or mix both. For a race or mixed shape, declare `first pass`, `rank all`, or `best-of` before spawning. -3. Set N from the user or derive it from the shape. N is total workers. `task.maxConcurrency` in `~/.omp/agent/config.yml` caps how many run at once. 4. Pick exact discovered agent names. Inspect each agent's frontmatter or `task.agentModelOverrides[]` for its model. A model race needs one loaded agent file and one exact override entry per arm; overrides cannot create agents. Pick each subagent's reasoning level and fast or standard speed for the job, per the Subagents section of the **poteto-mode** skill. 5. Give each worker its own writable output when it writes. When workers verify or measure commits, each brief names the exact SHAs. A measurement brief also names the method (sample count, what one sample is, order). The worker records both in its result. @@ -39,8 +36,6 @@ If a worker drops out, proceed with N-1 and note it. Read the terminal results. Drop a result that does not record the SHAs and method its brief names, and respawn that worker once. After a second miss, record a gap. A gap does not count as a pass. For coverage, every required slice needs a result. For a race, apply the selection rule declared up front. Use first pass, rank all, or best-of. Do not paste raw worker dumps. -Keep a compact result table, one-line evidenced issues, and explicit gaps or dropouts. - ## Phase D: Report Return one consolidated in-chat report with the table, issue one-liners, gaps or dropouts, and the race rule when used. diff --git a/plugins/pstack/skills/typescript-best-practices/SKILL.md b/plugins/pstack/skills/typescript-best-practices/SKILL.md index ac442f8..c94d9e9 100644 --- a/plugins/pstack/skills/typescript-best-practices/SKILL.md +++ b/plugins/pstack/skills/typescript-best-practices/SKILL.md @@ -12,7 +12,7 @@ Apply the **type-system-discipline** principle skill first. | Rule | Summary | |------|---------| | Discriminated unions | Model variants with a `kind` literal discriminant so impossible states can't be represented. No optional-field bags. | -| Branded types | Brand primitives with `& { readonly __brand: "X" }` so they can't be mixed up. Validate once at the boundary. | +| Branded types | Brand primitives with `& { readonly __brand: "X" }` so they can't be mixed up. Validate once at the boundary. A brand comes from a verifying type guard (`input is AgentId`), never from `as`. | | Constructive modeling | Build the shape so the illegal value can't be constructed. `[T, ...T[]]` for non-empty, `[T, T][]` for even length, `start` plus `duration` for a range. Not a runtime guard, not a wish for refinement types. | | Simplest total type | Keep `T[]` while every operation on it stays total. Strengthen to `NonEmpty` only where the loose type forces `!`, a cast, or a "should never happen" throw. | | `unknown` over `any` | External data is `unknown`. | diff --git a/plugins/pstack/skills/typescript-best-practices/references/patterns.md b/plugins/pstack/skills/typescript-best-practices/references/patterns.md index c21d876..f8dd99b 100644 --- a/plugins/pstack/skills/typescript-best-practices/references/patterns.md +++ b/plugins/pstack/skills/typescript-best-practices/references/patterns.md @@ -9,9 +9,13 @@ Brand primitives so they can't be mixed up. Validate once at the boundary. Downs ```ts type AgentId = string & { readonly __brand: "AgentId" }; +function isAgentId(input: string): input is AgentId { + return isUUID(input); +} + function parseAgentId(input: string): AgentId { - if (!isUUID(input)) throw new Error(`Invalid agent id: ${input}`); - return input as AgentId; + if (!isAgentId(input)) throw new Error(`Invalid agent id: ${input}`); + return input; } function focusAgent(id: AgentId): void {