@1agh/maude 0.22.2 → 0.24.0

package/plugins/design/dev-server/test/collab-reseed-guard.test.ts

@@ -0,0 +1,78 @@
+// Gap 1 (file-sync clobber fix) — the syncRoomFrom* no-op guards.
+//
+// createCollab now re-seeds a live room from disk whenever a synced file
+// changes externally (sync-agent hub-push or `design:edit` write), so the
+// room stops clobbering the external change back. That re-seed reuses
+// syncRoomFromComments/syncRoomFromAnnotations, which ALSO run on the room's
+// own persist → file → fs-event path. Without an equality short-circuit that
+// would spin an 800ms persist storm. These tests pin the guard: an identical
+// re-seed emits NO doc update (→ no persist → no loop); a real change emits one.
+
+import { describe, expect, test } from 'bun:test';
+
+import { Y_TYPES } from '../collab/persistence.ts';
+import { createRegistry } from '../collab/registry.ts';
+import type { RoomCallbacks } from '../collab/room.ts';
+
+function noopCallbacks(): RoomCallbacks {
+  return {
+    async seed() {},
+    async persistJson() {},
+    async persistBinary() {},
+  };
+}
+
+describe('Gap 1 — syncRoomFromComments no-op guard', () => {
+  test('re-seeding identical comments emits NO doc update (loop-safe)', () => {
+    const r = createRegistry(noopCallbacks());
+    const room = r.get('s');
+    const list = [{ id: 'c1', text: 'hi' }];
+    r.syncRoomFromComments('s', list);
+
+    let updates = 0;
+    room.doc.on('update', () => {
+      updates++;
+    });
+    // Identical content (the room's-own-persist echo, or a redundant hub push)
+    // → must not emit, or the reseed↔persist loop never settles.
+    r.syncRoomFromComments('s', [{ id: 'c1', text: 'hi' }]);
+    expect(updates).toBe(0);
+
+    // A genuine change still propagates — exactly one update.
+    r.syncRoomFromComments('s', [
+      { id: 'c1', text: 'hi' },
+      { id: 'c2', text: 'yo' },
+    ]);
+    expect(updates).toBe(1);
+  });
+
+  test('re-seed brings a STALE room up to the on-disk list (the clobber fix)', () => {
+    const r = createRegistry(noopCallbacks());
+    const room = r.get('s');
+    const arr = room.doc.getArray(Y_TYPES.comments);
+    expect(arr.length).toBe(0); // room opened empty (the "B shows []" state)
+
+    // Sync agent wrote a hub-pushed comment to disk → createCollab re-seeds:
+    r.syncRoomFromComments('s', [{ id: 'c1', text: 'from peer A' }]);
+    expect(arr.toArray()).toEqual([{ id: 'c1', text: 'from peer A' }]);
+  });
+});
+
+describe('Gap 1 — syncRoomFromAnnotations no-op guard', () => {
+  test('re-seeding the identical svg emits NO doc update', () => {
+    const r = createRegistry(noopCallbacks());
+    const room = r.get('s');
+    const svg = '<svg xmlns="http://www.w3.org/2000/svg"><g/></svg>';
+    r.syncRoomFromAnnotations('s', svg);
+
+    let updates = 0;
+    room.doc.on('update', () => {
+      updates++;
+    });
+    r.syncRoomFromAnnotations('s', svg); // identical → no-op
+    expect(updates).toBe(0);
+
+    r.syncRoomFromAnnotations('s', '<svg xmlns="http://www.w3.org/2000/svg"><rect/></svg>');
+    expect(updates).toBe(1);
+  });
+});

package/plugins/design/dev-server/test/collab-room.test.ts

@@ -3,9 +3,15 @@
 
 import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 
+import { Awareness } from 'y-protocols/awareness';
 import * as Y from 'yjs';
 
-import { encodeHandshake, encodeSyncUpdate, handleMessage } from '../collab/protocol.ts';
+import {
+  encodeAwarenessFrame,
+  encodeHandshake,
+  encodeSyncUpdate,
+  handleMessage,
+} from '../collab/protocol.ts';
 import { type RoomCallbacks, type RoomConn, createRoom } from '../collab/room.ts';
 
 function makeConn(id: string): RoomConn & { recv: Uint8Array[] } {
@@ -140,24 +146,29 @@ describe('Room', () => {
     await room.destroy();
   });
 
-  test('disconnect cleans up awareness states tagged with __connId', async () => {
+  test('disconnect removes the awareness states a conn published', async () => {
     const cb = makeCallbacks();
     const room = createRoom('aw-cleanup-slug', cb);
     const A = makeConn('a');
     await room.connect(A);
 
-    // Simulate Alice publishing her awareness state with the matching __connId.
-    room.awareness.setLocalState({ name: 'Alice', __connId: 'a' });
-    expect(room.awareness.getStates().size).toBe(1);
+    // Alice (conn A) publishes her awareness over the wire — the server learns
+    // her clientID belongs to conn 'a' from the update origin (server-authoritative;
+    // it does NOT trust a client-supplied __connId). Mirrors the real receive path.
+    const clientDoc = new Y.Doc();
+    const clientAw = new Awareness(clientDoc);
+    clientAw.setLocalState({ name: 'Alice' });
+    room.receive(A, encodeAwarenessFrame(clientAw, [clientAw.clientID]));
+    expect(room.awareness.getStates().has(clientAw.clientID)).toBe(true);
 
     room.disconnect(A);
     expect(room.size()).toBe(0);
-    // Awareness state owned by the disconnected conn is gone.
-    const states = room.awareness.getStates();
-    for (const s of states.values()) {
-      expect((s as { __connId?: string }).__connId).not.toBe('a');
-    }
+    // The disconnected conn's awareness state is dropped immediately — no waiting
+    // out the ~30s awareness timeout (the phantom-accumulation bug).
+    expect(room.awareness.getStates().has(clientAw.clientID)).toBe(false);
 
+    clientAw.destroy();
+    clientDoc.destroy();
     await room.destroy();
   });
 

package/plugins/design/dev-server/test/comment-mount.test.ts

@@ -0,0 +1,87 @@
+// comment-mount — shell-owned comment layer. Covers provider dedup (the
+// Maybe* wrappers consume an outer instance instead of double-mounting) and
+// the bundle scope-guard (react/react-dom externalized to the importmap so the
+// comment layer shares the canvas's single React singleton).
+
+import { describe, expect, test } from 'bun:test';
+import { join } from 'node:path';
+
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+
+import {
+  MaybeSelectionSetProvider,
+  SelectionSetProvider,
+  useSelectionSetOptional,
+} from '../use-selection-set.tsx';
+import { MaybeToolProvider, ToolProvider, useToolMode } from '../use-tool-mode.tsx';
+
+describe('comment-mount / MaybeToolProvider dedup', () => {
+  function ToolReader() {
+    const { tool } = useToolMode();
+    return createElement('span', { 'data-tool': tool });
+  }
+
+  test('consumes an OUTER ToolProvider instead of double-mounting', () => {
+    // Outer provider seeds tool='comment'. If MaybeToolProvider mounted a
+    // fresh provider, the reader would see the default 'move' instead.
+    const html = renderToStaticMarkup(
+      createElement(
+        ToolProvider,
+        { initial: 'comment' },
+        createElement(MaybeToolProvider, null, createElement(ToolReader))
+      )
+    );
+    expect(html).toContain('data-tool="comment"');
+  });
+
+  test('mounts its OWN ToolProvider when none exists above', () => {
+    const html = renderToStaticMarkup(
+      createElement(MaybeToolProvider, null, createElement(ToolReader))
+    );
+    expect(html).toContain('data-tool="move"');
+  });
+});
+
+describe('comment-mount / MaybeSelectionSetProvider dedup', () => {
+  function SelReader() {
+    const ctx = useSelectionSetOptional();
+    // Tag identity so we can assert a single context instance is shared.
+    return createElement('span', { 'data-has-ctx': ctx ? 'yes' : 'no' });
+  }
+
+  test('provides a SelectionSet when none exists above', () => {
+    const html = renderToStaticMarkup(
+      createElement(MaybeSelectionSetProvider, null, createElement(SelReader))
+    );
+    expect(html).toContain('data-has-ctx="yes"');
+  });
+
+  test('does not throw when nested inside an existing SelectionSetProvider', () => {
+    expect(() =>
+      renderToStaticMarkup(
+        createElement(
+          SelectionSetProvider,
+          { postTarget: null },
+          createElement(MaybeSelectionSetProvider, null, createElement(SelReader))
+        )
+      )
+    ).not.toThrow();
+  });
+});
+
+describe('comment-mount / bundle scope-guard', () => {
+  test('dist/comment-mount.js externalizes react + exports mountCanvas', async () => {
+    const here = join(import.meta.dir, '..');
+    const bundle = Bun.file(join(here, 'dist', 'comment-mount.js'));
+    expect(await bundle.exists()).toBe(true);
+    const src = await bundle.text();
+    // mountCanvas is the public entry the shell calls.
+    expect(src.includes('mountCanvas')).toBe(true);
+    // React must be a BARE import (resolved by _shell.html's importmap), not
+    // inlined — a second React instance would break hooks ("invalid hook
+    // call") across the canvas module and the comment layer.
+    expect(/import[^;]*["']react-dom\/client["']/.test(src)).toBe(true);
+    expect(/import[^;]*["']react["']/.test(src)).toBe(true);
+  });
+});

package/plugins/design/dev-server/test/csp-canvas-shell.test.ts

@@ -0,0 +1,46 @@
+// cspForCanvasShell — A6 (DDR-060 F1 re-audit) CSP hardening for the segregated
+// canvas origin. Asserts the exfil-relevant directives are present and that
+// `frame-ancestors` is only emitted when the main origin is known (so the legit
+// cross-origin embed is never accidentally blocked).
+
+import { describe, expect, test } from 'bun:test';
+
+import { cspForCanvasShell } from '../http.ts';
+
+const SHELL = '<!doctype html><html><head><script>const x=1;</script></head><body></body></html>';
+
+describe('cspForCanvasShell — A6 hardening', () => {
+  test('locks down the dangerous lanes', () => {
+    const csp = cspForCanvasShell(SHELL);
+    expect(csp).toContain("default-src 'none'");
+    expect(csp).toContain("connect-src 'self'");
+    expect(csp).toContain("object-src 'none'");
+    expect(csp).toContain("base-uri 'none'");
+    // No eval / no inline-script escape hatch.
+    expect(csp).not.toContain('unsafe-eval');
+    expect(csp).not.toMatch(/script-src[^;]*unsafe-inline/);
+  });
+
+  test("adds webrtc 'block' (connect-src does not cover WebRTC exfil)", () => {
+    expect(cspForCanvasShell(SHELL)).toContain("webrtc 'block'");
+  });
+
+  test("adds form-action 'none'", () => {
+    expect(cspForCanvasShell(SHELL)).toContain("form-action 'none'");
+  });
+
+  test('hashes inline scripts (no unsafe-inline for script-src)', () => {
+    const csp = cspForCanvasShell(SHELL);
+    expect(csp).toMatch(/script-src 'self' 'sha256-[A-Za-z0-9+/=]+'/);
+  });
+
+  test('frame-ancestors allowlists the main origin when known', () => {
+    const csp = cspForCanvasShell(SHELL, 'http://localhost:4399');
+    expect(csp).toContain("frame-ancestors 'self' http://localhost:4399");
+  });
+
+  test('frame-ancestors is OMITTED when the main origin is unknown (would block the legit embed)', () => {
+    const csp = cspForCanvasShell(SHELL);
+    expect(csp).not.toContain('frame-ancestors');
+  });
+});

package/plugins/design/dev-server/test/fixtures/phase-20-annotations.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><path data-id="p1" data-tool="pen" stroke="#d63b1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" d="M0 0 L10 10 L20 5" pointer-events="stroke"/><rect data-id="r1" data-tool="rect" stroke="#222" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="#fff4d6" x="10" y="20" width="30" height="40"/><ellipse data-id="e1" data-tool="ellipse" stroke="#222" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="#e6f4ea" cx="100" cy="100" rx="40" ry="25"/><g data-id="a1" data-tool="arrow" stroke="#1a8f3e" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none"><line x1="0" y1="0" x2="100" y2="0"/><polyline points="85.5844981135613,6.94213982588093 100,0 85.5844981135613,-6.94213982588093" fill="#1a8f3e"/></g><text data-id="t1" data-tool="text" data-anchor-id="r1" data-font-size="14" fill="#1a1a1a" text-anchor="middle" dominant-baseline="middle">needs work</text></svg>

package/plugins/design/dev-server/test/hmr-classify.test.ts

@@ -0,0 +1,70 @@
+// Unit test for hmr-broadcast.ts classifyChange().
+//
+// The load-bearing case: a canvas/specimen sibling stylesheet (e.g. motion.css
+// next to motion.tsx) is INLINED into the built module — there is no <link> for
+// the iframe css-swap to target, so it must route to a module reload keyed on
+// the sibling .tsx. Link-mounted CSS (tokens / _components / _layout — no
+// sibling .tsx) keeps the fast css swap. Regression guard for the silent-drop
+// bug (see .ai/logs/rca/hmr-inlined-css-dropped.md).
+
+import { describe, expect, test } from 'bun:test';
+
+import { classifyChange } from '../hmr-broadcast.ts';
+
+describe('classifyChange', () => {
+  const noSibling = () => false;
+  const hasSibling = () => true;
+
+  test('sibling-tsx CSS → module reload keyed on the .tsx', () => {
+    const msg = classifyChange(
+      'system/x/preview/motion.css',
+      (cssRel) => cssRel === 'system/x/preview/motion.css'
+    );
+    expect(msg?.mode).toBe('module');
+    expect(msg?.file).toBe('system/x/preview/motion.tsx');
+    expect(msg?.scope).toBe('canvas');
+  });
+
+  test('link-mounted partial CSS (no sibling .tsx) → css swap', () => {
+    expect(classifyChange('system/x/preview/_components.css', noSibling)?.mode).toBe('css');
+    expect(classifyChange('system/x/preview/_layout.css', noSibling)?.mode).toBe('css');
+    expect(classifyChange('system/x/colors_and_type.css', noSibling)?.mode).toBe('css');
+  });
+
+  test('css mode echoes the changed file path', () => {
+    const msg = classifyChange('system/x/colors_and_type.css', noSibling);
+    expect(msg?.mode).toBe('css');
+    expect(msg?.file).toBe('system/x/colors_and_type.css');
+  });
+
+  test('_lib/** → hard reload (no file)', () => {
+    const msg = classifyChange('_lib/canvas-lib.tsx', hasSibling);
+    expect(msg?.mode).toBe('hard');
+    expect(msg?.scope).toBe('lib');
+    expect(msg?.file).toBeUndefined();
+  });
+
+  test('.tsx / .jsx / .ts / .js → module reload', () => {
+    for (const f of ['ui/Foo.tsx', 'ui/Foo.jsx', 'ui/Foo.ts', 'ui/Foo.js']) {
+      expect(classifyChange(f, noSibling)?.mode).toBe('module');
+      expect(classifyChange(f, noSibling)?.file).toBe(f);
+    }
+  });
+
+  test('.meta.json → meta (not treated as a .json no-op)', () => {
+    const msg = classifyChange('ui/Foo.meta.json', noSibling);
+    expect(msg?.mode).toBe('meta');
+    expect(msg?.file).toBe('ui/Foo.meta.json');
+  });
+
+  test('unrelated extensions → null', () => {
+    expect(classifyChange('ui/notes.md', noSibling)).toBeNull();
+    expect(classifyChange('assets/logo.svg', noSibling)).toBeNull();
+  });
+
+  test('backslash paths are normalised before classification', () => {
+    const msg = classifyChange('system\\x\\preview\\motion.css', () => true);
+    expect(msg?.mode).toBe('module');
+    expect(msg?.file).toBe('system/x/preview/motion.tsx');
+  });
+});

package/plugins/design/dev-server/test/input-router.test.ts

@@ -229,6 +229,20 @@ describe('input-router / keydown — Phase 5 draw tools', () => {
     });
   });
 
+  test('N → tool sticky (Phase 21)', () => {
+    expect(classify(base({ type: 'keydown', key: 'n' }))).toEqual({
+      kind: 'tool',
+      tool: 'sticky',
+    });
+  });
+
+  test('T → tool text (Phase 21)', () => {
+    expect(classify(base({ type: 'keydown', key: 't' }))).toEqual({
+      kind: 'tool',
+      tool: 'text',
+    });
+  });
+
   test('uppercase B (shift held) — still maps to pen (lowercased)', () => {
     expect(classify(base({ type: 'keydown', key: 'B', shiftKey: true }))).toEqual({
       kind: 'tool',
@@ -268,6 +282,13 @@ describe('input-router / pointer events — Phase 5 annotation tools', () => {
     expect(classify(base({ type: 'pointermove', activeTool: 'ellipse' })).kind).toBe('no-op');
   });
 
+  test('sticky + text tools own bare pointer events (Phase 21 — SVG overlay claims)', () => {
+    for (const activeTool of ['sticky', 'text'] as const) {
+      expect(classify(base({ type: 'pointerdown', activeTool, button: 0 })).kind).toBe('no-op');
+      expect(classify(base({ type: 'pointermove', activeTool })).kind).toBe('no-op');
+    }
+  });
+
   test('cmd+left-click in arrow tool → select replace (escape hatch to move)', () => {
     expect(
       classify(

package/plugins/design/dev-server/test/sanitize-annotation-svg.test.ts

@@ -0,0 +1,100 @@
+// sanitizeAnnotationSvg — A3 (DDR-060 F1 re-audit). Strips executable constructs
+// from a persisted annotation SVG while leaving the legit presentational
+// vocabulary (strokesToSvg: path/rect/ellipse/g/line/polyline/text) byte-intact.
+
+import { describe, expect, test } from 'bun:test';
+
+import { sanitizeAnnotationSvg } from '../api.ts';
+
+// The exact shape strokesToSvg() emits — must survive sanitization unchanged.
+const LEGIT =
+  '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
+  '<path data-id="p1" data-tool="pen" stroke="#d63b1f" stroke-width="2" fill="none" d="M0 0 L10 10" pointer-events="stroke"/>' +
+  '<rect data-id="r1" data-tool="rect" stroke="#222" stroke-width="2" fill="none" x="5" y="5" width="20" height="20"/>' +
+  '<ellipse data-id="e1" data-tool="ellipse" stroke="#222" stroke-width="2" fill="none" cx="10" cy="10" rx="4" ry="4"/>' +
+  '<g data-id="a1" data-tool="arrow" stroke="#222" stroke-width="2" fill="none"><line x1="0" y1="0" x2="9" y2="9"/><polyline points="3,3 9,9 5,7" fill="#222"/></g>' +
+  '<text data-id="t1" data-tool="text" data-anchor-id="x" data-font-size="14" fill="#222" text-anchor="middle" dominant-baseline="middle">label</text>' +
+  '</svg>';
+
+describe('sanitizeAnnotationSvg — A3', () => {
+  test('leaves the legit annotation vocabulary byte-identical (zero regression)', () => {
+    expect(sanitizeAnnotationSvg(LEGIT)).toBe(LEGIT);
+  });
+
+  test('strips <script> blocks', () => {
+    const dirty = LEGIT.replace('</svg>', '<script>fetch("/_api/export")</script></svg>');
+    const out = sanitizeAnnotationSvg(dirty);
+    expect(out).not.toContain('<script');
+    expect(out).not.toContain('fetch("/_api/export")');
+  });
+
+  test('strips <foreignObject> (the SVG-XSS smuggle)', () => {
+    const dirty = LEGIT.replace(
+      '</svg>',
+      '<foreignObject><div onload="x"></div></foreignObject></svg>'
+    );
+    const out = sanitizeAnnotationSvg(dirty);
+    expect(out.toLowerCase()).not.toContain('foreignobject');
+  });
+
+  test('strips inline event-handler attributes (onload/onclick/…)', () => {
+    const dirty =
+      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
+      '<rect x="0" y="0" width="9" height="9" onload="alert(1)" onclick=\'evil()\'/>' +
+      '</svg>';
+    const out = sanitizeAnnotationSvg(dirty);
+    expect(out).not.toMatch(/\son\w+\s*=/i);
+    expect(out).toContain('<rect');
+    expect(out).toContain('width="9"');
+  });
+
+  test('strips <image>/<use> and javascript: URLs', () => {
+    const dirty =
+      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
+      '<image href="javascript:alert(1)"/><use href="#x"/>' +
+      '</svg>';
+    const out = sanitizeAnnotationSvg(dirty);
+    expect(out.toLowerCase()).not.toContain('<image');
+    expect(out.toLowerCase()).not.toContain('<use');
+    expect(out.toLowerCase()).not.toContain('javascript:');
+  });
+
+  // Bypasses the F1 confirming pass found against the prior denylist — the
+  // allowlist must close all of them.
+  test('drops namespaced <svg:script> (denylist missed this)', () => {
+    const out = sanitizeAnnotationSvg(
+      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><svg:script>alert(1)</svg:script></svg>'
+    );
+    expect(out.toLowerCase()).not.toContain('<svg:script');
+    expect(out.toLowerCase()).not.toContain('script>');
+  });
+
+  test('drops <style> (CSS @import / url(javascript:) exfil lane)', () => {
+    const out = sanitizeAnnotationSvg(
+      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><style>@import url("//evil")</style></svg>'
+    );
+    expect(out.toLowerCase()).not.toContain('<style');
+  });
+
+  test('strips style= (CSS url(javascript:)) and entity-encoded xlink:href on survivors', () => {
+    const out = sanitizeAnnotationSvg(
+      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1">' +
+        '<rect x="0" y="0" width="9" height="9" style="fill:url(javascript:alert(1))"/>' +
+        '<text xlink:href="javascript&#58;alert(1)">hi</text></svg>'
+    );
+    expect(out).not.toMatch(/\sstyle\s*=/i);
+    expect(out).not.toMatch(/href\s*=/i);
+    // The legit elements + safe attrs survive.
+    expect(out).toContain('<rect');
+    expect(out).toContain('width="9"');
+    expect(out).toContain('<text');
+  });
+
+  test('drops <set>/<animate> animation elements (attribute-name vector)', () => {
+    const out = sanitizeAnnotationSvg(
+      '<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect><set attributeName="onload" to="alert(1)"/></rect></svg>'
+    );
+    expect(out.toLowerCase()).not.toContain('<set');
+    expect(out.toLowerCase()).not.toContain('<animate');
+  });
+});