@1agh/maude 0.29.0 → 0.31.0

package/apps/studio/test/csrf-write-guard.test.ts

@@ -0,0 +1,78 @@
+// CSRF Origin guard for the main-origin source-write routes (edit-css /
+// edit-text / edit-attr). DDR-105. The DDR-054 origin-split already blocks the
+// untrusted canvas *iframe* (canvas-origin-gate.test.ts proves that). This guard
+// covers the OTHER untrusted origin: a malicious top-level page in another tab
+// forging a `text/plain` CORS simple-request POST to localhost. The browser
+// stamps such a request with an unspoofable cross-origin `Origin` header, so the
+// guard must reject it — while still letting the legit same-origin shell write
+// and not breaking non-browser clients (which send no Origin header).
+//
+// Unit-level on purpose: `sameOriginWrite` is a pure function of the Request, so
+// we exercise the decision directly instead of booting a subprocess server.
+// (A booted-server integration test would add a 124th server-booting file to the
+// suite, which perturbs bun's worker scheduling and surfaces a PRE-EXISTING
+// cross-worker port-collision flake in canvas-meta-api.test.ts — a test-harness
+// race unrelated to this guard. See the Phase 12.2 validate notes.)
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+import { sameOriginWrite } from '../http.ts';
+
+const SELF = 'http://localhost:4399';
+const post = (origin?: string): Request =>
+  new Request(`${SELF}/_api/edit-css`, {
+    method: 'POST',
+    headers: { 'content-type': 'text/plain', ...(origin ? { origin } : {}) },
+    body: '{}',
+  });
+
+describe('CSRF Origin guard — sameOriginWrite (DDR-105)', () => {
+  test('rejects a forged cross-origin Origin', () => {
+    expect(sameOriginWrite(post('http://evil.example'))).toBe(false);
+    // A look-alike host (substring / suffix tricks) must not slip through.
+    expect(sameOriginWrite(post('http://localhost.evil.example'))).toBe(false);
+    expect(sameOriginWrite(post('http://localhost:4399.evil.example'))).toBe(false);
+    // Right host, wrong port is still cross-origin.
+    expect(sameOriginWrite(post('http://localhost:4400'))).toBe(false);
+    // Right host:port, wrong scheme is still cross-origin.
+    expect(sameOriginWrite(post('https://localhost:4399'))).toBe(false);
+  });
+
+  test('allows the legit same-origin shell Origin', () => {
+    expect(sameOriginWrite(post(SELF))).toBe(true);
+  });
+
+  test('allows a request with no Origin header (curl / programmatic / bun:test)', () => {
+    expect(sameOriginWrite(post())).toBe(true);
+  });
+
+  test('rejects an unparseable Origin rather than letting it through', () => {
+    expect(sameOriginWrite(post('not a url'))).toBe(false);
+  });
+});
+
+// phase-30 / DDR-120: the ai-activity bridge now projects `/_api/ai/*` POSTs
+// onto room awareness, which crosses the hub to every connected peer. So a
+// forged cross-origin POST to /start /heartbeat /end is no longer a harmless
+// loopback banner — it injects a fake "<x> is editing <slug>" presence to all
+// peers (the channel that drives the social save/publish decision). These three
+// routes MUST carry the same `sameOriginWrite` guard as the other write routes.
+// Source-level assertion (same "don't boot a server" rationale as above): pin
+// the guard into each route block so an accidental removal fails CI.
+describe('CSRF Origin guard — /_api/ai/* presence-bridge routes (phase-30)', () => {
+  const src = readFileSync(fileURLToPath(new URL('../http.ts', import.meta.url)), 'utf8');
+
+  for (const route of ['/_api/ai/start', '/_api/ai/heartbeat', '/_api/ai/end']) {
+    test(`${route} is wired with the sameOriginWrite CSRF guard`, () => {
+      // Slice from this route's key to the next route key, then assert the guard
+      // appears inside that block.
+      const start = src.indexOf(`'${route}':`);
+      expect(start).toBeGreaterThan(-1);
+      const after = src.indexOf("'/_api/", start + 1);
+      const block = src.slice(start, after === -1 ? undefined : after);
+      expect(block).toContain('sameOriginWrite(req)');
+    });
+  }
+});

package/apps/studio/test/editing-presence.test.ts

@@ -0,0 +1,103 @@
+// Unit: soft editing-presence (Phase 30) — the `editing` awareness field at the
+// hub trust boundary. Locking is deliberately NOT built (no lease/takeover); the
+// `editing` field is a soft heads-up. Every foreign value is attacker-influenceable
+// through the semi-trusted hub (DDR-054), so it MUST be validated for VALUE — a
+// future / NaN / non-positive `since` is rejected so a hostile peer can't pin a
+// permanent badge or poison a `Date.now() - since` age computation.
+
+import { describe, expect, test } from 'bun:test';
+
+import { createRoom, type RoomCallbacks } from '../collab/room.ts';
+import { sanitizeForeignState } from '../use-collab.tsx';
+
+const noopCallbacks: RoomCallbacks = {
+  seed() {},
+  persistJson() {},
+  persistBinary() {},
+};
+
+describe('sanitizeForeignState — editing field (Phase 30)', () => {
+  test('keeps a valid current `editing.since`', () => {
+    const now = Date.now();
+    const peer = sanitizeForeignState(3, { name: 'Anna', editing: { since: now } });
+    expect(peer?.editing).toEqual({ since: now });
+  });
+
+  test('absent editing → null (peer is not editing)', () => {
+    const peer = sanitizeForeignState(3, { name: 'Anna' });
+    expect(peer?.editing).toBeNull();
+  });
+
+  test('rejects a FUTURE since beyond the ±5s skew window (no permanent-badge pin)', () => {
+    const future = Date.now() + 60_000;
+    const peer = sanitizeForeignState(3, { name: 'Anna', editing: { since: future } });
+    expect(peer?.editing).toBeNull();
+  });
+
+  test('allows a near-future since inside the 5s skew window', () => {
+    const skew = Date.now() + 3_000;
+    const peer = sanitizeForeignState(3, { name: 'Anna', editing: { since: skew } });
+    expect(peer?.editing).toEqual({ since: skew });
+  });
+
+  test('rejects NaN / Infinity / non-positive since (no Date-math poison)', () => {
+    for (const bad of [Number.NaN, Number.POSITIVE_INFINITY, 0, -1]) {
+      const peer = sanitizeForeignState(3, { name: 'Anna', editing: { since: bad } });
+      expect(peer?.editing).toBeNull();
+    }
+  });
+
+  test('rejects a non-object / malformed editing payload', () => {
+    expect(sanitizeForeignState(3, { name: 'Anna', editing: 'now' })?.editing).toBeNull();
+    expect(sanitizeForeignState(3, { name: 'Anna', editing: 12345 })?.editing).toBeNull();
+    expect(sanitizeForeignState(3, { name: 'Anna', editing: {} })?.editing).toBeNull();
+    expect(sanitizeForeignState(3, { name: 'Anna', editing: { since: '5' } })?.editing).toBeNull();
+  });
+
+  test('editing presence does not disturb the other sanitized fields', () => {
+    const peer = sanitizeForeignState(9, {
+      name: 'Anna',
+      cursor: { x: 1, y: 2 },
+      editing: { since: Date.now() },
+    });
+    expect(peer?.name).toBe('Anna');
+    expect(peer?.cursor).toEqual({ x: 1, y: 2 });
+    expect(peer?.editing).not.toBeNull();
+  });
+});
+
+describe('room.setAgentEditing — agent presence projected onto awareness (Phase 30)', () => {
+  test('projects an editing state that a remote peer can sanitize, then clears it', async () => {
+    const room = createRoom('agent-editing-slug', noopCallbacks);
+    const since = Date.now();
+
+    room.setAgentEditing({ name: 'Anna', since });
+    const states = Array.from(room.awareness.getStates().values());
+    expect(states.length).toBe(1);
+    // The projected state survives the client trust-boundary sanitizer with the
+    // editing field intact (name → re-derived color; since preserved).
+    const sanitized = sanitizeForeignState(1, states[0]);
+    expect(sanitized?.name).toBe('Anna');
+    expect(sanitized?.editing).toEqual({ since });
+
+    room.setAgentEditing(null);
+    expect(room.awareness.getStates().size).toBe(0);
+
+    await room.destroy();
+  });
+
+  test('re-setting the same {name, since} is a no-op (heartbeat re-emit guard)', async () => {
+    const room = createRoom('agent-editing-idempotent', noopCallbacks);
+    const since = Date.now();
+    let updates = 0;
+    room.awareness.on('update', () => {
+      updates += 1;
+    });
+
+    room.setAgentEditing({ name: 'Anna', since });
+    room.setAgentEditing({ name: 'Anna', since }); // identical → no second update
+    expect(updates).toBe(1);
+
+    await room.destroy();
+  });
+});

package/apps/studio/test/figjam-v3-model.test.ts

@@ -0,0 +1,342 @@
+// FigJam v3 — model schema extension: data-group-ids / data-author /
+// data-start-bind / data-end-bind. Three load-bearing assertions:
+//   1. the new fixture round-trips BYTE-IDENTICAL (parse → re-serialize),
+//   2. legacy strokes (no new fields) serialize WITHOUT any new attribute
+//      (the Phase-24 canary holds — covered again here from the model side),
+//   3. the sanitizer passes the new data-* attrs through (it denylists only
+//      on*/style/href) and poisoned bind values are rejected on parse.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { GlobalRegistrator } from '@happy-dom/global-registrator';
+
+import {
+  type AnchorHost,
+  type ArrowStroke,
+  convertShapeKind,
+  type PolygonStroke,
+  type RectStroke,
+  type StickyStroke,
+  type Stroke,
+  shapeKindOf,
+  strokeBBox,
+  strokeHitTest,
+  strokesToSvg,
+  svgToStrokes,
+  type TextStroke,
+} from '../annotations-model.ts';
+import { sanitizeAnnotationSvg } from '../api.ts';
+
+beforeAll(() => {
+  GlobalRegistrator.register();
+});
+afterAll(async () => {
+  await GlobalRegistrator.unregister();
+});
+
+const FIXTURE_URL = new URL('./fixtures/figjam-v3-groups-bindings.svg', import.meta.url);
+
+describe('figjam-v3 fixture canary', () => {
+  test('round-trips byte-identical (groups + nested groups + binds + author)', async () => {
+    const fixture = await Bun.file(FIXTURE_URL).text();
+    expect(strokesToSvg(svgToStrokes(fixture))).toBe(fixture);
+  });
+
+  test('round-trips byte-identical THROUGH the sanitizer', async () => {
+    const fixture = await Bun.file(FIXTURE_URL).text();
+    expect(sanitizeAnnotationSvg(fixture)).toBe(fixture);
+  });
+
+  test('parse recovers the new fields exactly', async () => {
+    const strokes = svgToStrokes(await Bun.file(FIXTURE_URL).text());
+    const rect = strokes.find((s) => s.id === 's_aaa1') as RectStroke;
+    expect(rect.groupIds).toEqual(['g_team1']);
+    const sticky = strokes.find((s) => s.id === 's_aaa2') as StickyStroke;
+    expect(sticky.groupIds).toEqual(['g_inner', 'g_team1']); // deepest→shallowest order kept
+    const arrow = strokes.find((s) => s.id === 's_aaa3') as ArrowStroke;
+    expect(arrow.startBind).toEqual({ hostId: 's_aaa1', nx: 1, ny: 0.5 }); // auto
+    expect(arrow.endBind).toEqual({ hostId: 's_aaa2', nx: 0, ny: 0.5, pinned: true });
+    const note = strokes.find((s) => s.id === 's_aaa4') as TextStroke;
+    expect(note.author).toBe('ai');
+    // The ellipse carries rotation but none of the other new fields.
+    const ell = strokes.find((s) => s.id === 's_aaa5') as Stroke;
+    expect(ell.rotation).toBe(15);
+    expect('groupIds' in ell).toBe(false);
+    expect('author' in ell).toBe(false);
+  });
+});
+
+describe('serialize-only-non-default invariant for the v3 fields', () => {
+  test('a legacy stroke set emits NO v3 attribute', () => {
+    const strokes: Stroke[] = [
+      { id: 's_1', tool: 'rect', color: '#1f1f1f', width: 3, x: 0, y: 0, w: 10, h: 10 },
+      { id: 's_2', tool: 'arrow', color: '#1f1f1f', width: 3, x1: 0, y1: 0, x2: 9, y2: 0 },
+    ];
+    const svg = strokesToSvg(strokes);
+    expect(svg).not.toContain('data-group-ids');
+    expect(svg).not.toContain('data-author');
+    expect(svg).not.toContain('data-start-bind');
+    expect(svg).not.toContain('data-end-bind');
+  });
+
+  test('empty groupIds array serializes as no attribute', () => {
+    const svg = strokesToSvg([
+      {
+        id: 's_1',
+        tool: 'rect',
+        color: '#1f1f1f',
+        width: 3,
+        x: 0,
+        y: 0,
+        w: 10,
+        h: 10,
+        groupIds: [],
+      },
+    ]);
+    expect(svg).not.toContain('data-group-ids');
+  });
+});
+
+describe('poisoned input hardening', () => {
+  test('malformed / out-of-range bind values are rejected on parse', () => {
+    const bad = [
+      'data-start-bind="onlyhost"',
+      'data-start-bind="h 2 0.5"', // nx out of [0..1]
+      'data-start-bind="h NaN 0.5"',
+      'data-start-bind="h 0.5 -1"',
+    ];
+    for (const attr of bad) {
+      const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><g data-id="s_x" data-tool="arrow" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" ${attr}><line x1="0" y1="0" x2="9" y2="0"/><polyline points="1,1 9,0 1,-1" fill="#1f1f1f"/></g></svg>`;
+      const arrow = svgToStrokes(svg).find((s) => s.tool === 'arrow') as ArrowStroke;
+      expect(arrow).toBeDefined();
+      expect(arrow.startBind).toBeUndefined();
+    }
+  });
+
+  test('data-author only honours the literal "ai"', () => {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect data-id="s_x" data-tool="rect" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" x="0" y="0" width="10" height="10" data-author="evil"/></svg>`;
+    const rect = svgToStrokes(svg)[0] as RectStroke;
+    expect('author' in rect).toBe(false);
+  });
+
+  test('sanitizer still strips handlers glued next to the new attrs', () => {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg"><rect data-tool="rect" data-group-ids="g_1" onload="alert(1)" x="0" y="0" width="10" height="10"/></svg>`;
+    const clean = sanitizeAnnotationSvg(svg);
+    expect(clean).toContain('data-group-ids="g_1"');
+    expect(clean).not.toContain('onload');
+  });
+});
+
+describe('rotation (FigJam v3)', () => {
+  test('serializes data-rot + presentational transform only when non-zero; round-trips', () => {
+    const r: Stroke = {
+      id: 's_r',
+      tool: 'rect',
+      color: '#1f1f1f',
+      width: 3,
+      x: 0,
+      y: 0,
+      w: 100,
+      h: 50,
+      rotation: 30,
+    };
+    const svg = strokesToSvg([r]);
+    expect(svg).toContain('data-rot="30"');
+    expect(svg).toContain('transform="rotate(30 50 25)"');
+    const back = svgToStrokes(svg);
+    expect((back[0] as RectStroke).rotation).toBe(30);
+    expect(strokesToSvg(back)).toBe(svg);
+    expect(strokesToSvg([{ ...r, rotation: 0 }])).not.toContain('data-rot');
+    expect(sanitizeAnnotationSvg(svg)).toBe(svg);
+  });
+
+  test('hit-testing happens in the rotated frame', () => {
+    // A wide flat bar rotated 90° stands upright: a probe above the original
+    // top edge now hits; the original east tip is empty space.
+    const bar: Stroke = {
+      id: 's_b',
+      tool: 'rect',
+      color: '#000',
+      width: 2,
+      x: 0,
+      y: 0,
+      w: 100,
+      h: 10,
+      fill: '#fff',
+      rotation: 90,
+    };
+    expect(strokeHitTest(bar, 50, -40, 2)).toBe(true);
+    expect(strokeHitTest(bar, 95, 5, 2)).toBe(false);
+  });
+
+  test('pen/arrow/anchored text ignore rotation (no attr emitted)', () => {
+    const pen: Stroke = {
+      id: 's_p',
+      tool: 'pen',
+      color: '#000',
+      width: 3,
+      points: [
+        [0, 0],
+        [10, 10],
+      ],
+      rotation: 45,
+    };
+    expect(strokesToSvg([pen])).not.toContain('data-rot');
+  });
+});
+
+describe('polygon anchored text (Wave G)', () => {
+  const diamond: PolygonStroke = {
+    id: 'poly1',
+    tool: 'polygon',
+    shape: 'diamond',
+    color: '#1a1a1a',
+    width: 2,
+    x: 10,
+    y: 20,
+    w: 120,
+    h: 80,
+  };
+  const label: TextStroke = {
+    id: 'txt1',
+    tool: 'text',
+    color: '#1a1a1a',
+    fontSize: 16,
+    text: 'decision',
+    anchorId: 'poly1',
+  };
+
+  test('anchored text inherits a polygon host bbox', () => {
+    const anchors = new Map<string, AnchorHost>([[diamond.id, diamond]]);
+    expect(strokeBBox(label, anchors)).toEqual({ x: 10, y: 20, w: 120, h: 80 });
+  });
+
+  test('serialize → parse round-trips the anchor binding', () => {
+    const svg = strokesToSvg([diamond, label]);
+    expect(svg).toContain('data-anchor-id="poly1"');
+    const back = svgToStrokes(svg);
+    const txt = back.find((s) => s.tool === 'text') as TextStroke;
+    expect(txt.anchorId).toBe('poly1');
+    expect(strokesToSvg(back)).toBe(svg);
+  });
+});
+
+describe('shape-kind conversion (Wave H)', () => {
+  const base: RectStroke = {
+    id: 's_conv',
+    tool: 'rect',
+    color: '#3b82f6',
+    width: 3,
+    x: 10,
+    y: 20,
+    w: 100,
+    h: 60,
+    fill: '#e0ebfd',
+    rotation: 30,
+    groupIds: ['g_1'],
+  };
+
+  test('shapeKindOf maps every closed shape; null otherwise', () => {
+    expect(shapeKindOf(base)).toBe('square');
+    expect(shapeKindOf({ ...base, cornerRadius: 8 })).toBe('rounded');
+    expect(
+      shapeKindOf({ id: 'e', tool: 'ellipse', color: '#000', width: 2, cx: 0, cy: 0, rx: 5, ry: 5 })
+    ).toBe('circle');
+    expect(
+      shapeKindOf({
+        id: 'p',
+        tool: 'polygon',
+        shape: 'diamond',
+        color: '#000',
+        width: 2,
+        x: 0,
+        y: 0,
+        w: 10,
+        h: 10,
+      })
+    ).toBe('diamond');
+    expect(shapeKindOf({ id: 't', tool: 'text', color: '#000', fontSize: 14, text: 'x' })).toBe(
+      null
+    );
+  });
+
+  test('rect → circle preserves bbox, styling, rotation, groups, id', () => {
+    const patch = convertShapeKind(base, 'circle');
+    expect(patch).toMatchObject({ tool: 'ellipse', cx: 60, cy: 50, rx: 50, ry: 30 });
+    const converted = { ...base, ...patch } as Stroke;
+    // Styling + identity ride along via the merge; stale rect geometry cleared.
+    expect(converted.id).toBe('s_conv');
+    expect(converted.color).toBe('#3b82f6');
+    expect((converted as { fill?: string | null }).fill).toBe('#e0ebfd');
+    expect(converted.rotation).toBe(30);
+    expect(converted.groupIds).toEqual(['g_1']);
+    expect((converted as { x?: number }).x).toBeUndefined();
+  });
+
+  test('circle → diamond → square round-trips the bbox', () => {
+    const circle = {
+      id: 'e2',
+      tool: 'ellipse',
+      color: '#000',
+      width: 2,
+      cx: 60,
+      cy: 50,
+      rx: 50,
+      ry: 30,
+    } as Stroke;
+    const toDiamond = { ...circle, ...convertShapeKind(circle, 'diamond') } as Stroke;
+    expect(toDiamond).toMatchObject({
+      tool: 'polygon',
+      shape: 'diamond',
+      x: 10,
+      y: 20,
+      w: 100,
+      h: 60,
+    });
+    const toSquare = { ...toDiamond, ...convertShapeKind(toDiamond, 'square') } as Stroke;
+    expect(toSquare).toMatchObject({ tool: 'rect', x: 10, y: 20, w: 100, h: 60, cornerRadius: 0 });
+  });
+
+  test('identity + non-shape conversions return null', () => {
+    expect(convertShapeKind(base, 'square')).toBe(null);
+    expect(
+      convertShapeKind({ id: 't', tool: 'text', color: '#000', fontSize: 14, text: 'x' }, 'circle')
+    ).toBe(null);
+  });
+
+  test('converted stroke serializes cleanly and round-trips', () => {
+    const converted = { ...base, ...convertShapeKind(base, 'triangle') } as Stroke;
+    const svg = strokesToSvg([converted]);
+    expect(svg).toContain('data-shape="triangle"');
+    expect(strokesToSvg(svgToStrokes(svg))).toBe(svg);
+  });
+});
+
+describe('non-finite geometry hardening (Wave H — security F4)', () => {
+  test('Infinity / NaN / non-numeric coords clamp to 0 on parse (no off-board spoof)', () => {
+    // A poisoned/synced SVG carries x="1e999" (→ Infinity) and a non-numeric y.
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect data-id="s_evil" data-tool="rect" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" x="1e999" y="abc" width="100" height="50"/></svg>`;
+    const rect = svgToStrokes(svg)[0] as RectStroke;
+    expect(rect).toBeDefined();
+    expect(Number.isFinite(rect.x)).toBe(true);
+    expect(Number.isFinite(rect.y)).toBe(true);
+    expect(rect.x).toBe(0);
+    expect(rect.y).toBe(0);
+    // The bbox the AI reader + the renderer both consume is finite — they agree.
+    const bb = strokeBBox(rect);
+    expect(bb && Number.isFinite(bb.x) && Number.isFinite(bb.w)).toBe(true);
+  });
+
+  test('polygon with an Infinity vertex does not blow the bbox to Infinity', () => {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><polygon data-id="s_p" data-tool="polygon" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" data-shape="diamond" points="50,0 1e999,25 50,50 0,25"/></svg>`;
+    const poly = svgToStrokes(svg)[0] as PolygonStroke;
+    if (poly) {
+      expect(Number.isFinite(poly.w)).toBe(true);
+      expect(Number.isFinite(poly.x)).toBe(true);
+    }
+  });
+
+  test('finite geometry is untouched (round-trip stays byte-identical)', () => {
+    const svg = `<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect data-id="s_ok" data-tool="rect" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" x="12.5" y="-3" width="100" height="50"/></svg>`;
+    expect(strokesToSvg(svgToStrokes(svg))).toBe(svg);
+  });
+});

package/apps/studio/test/fixtures/figjam-v3-groups-bindings.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" data-mdcc-annotations="1"><rect data-id="s_aaa1" data-tool="rect" stroke="#3b82f6" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="#e0ebfd" x="100" y="100" width="160" height="100" data-group-ids="g_team1"/><g data-id="s_aaa2" data-tool="sticky" data-r="8" data-fs="14" fill="#fce8a6" data-group-ids="g_inner g_team1"><rect x="320" y="100" width="200" height="200" rx="8" ry="8"/><text data-sticky-body="1" x="332" y="112" font-size="14" fill="#1a1a1a" dominant-baseline="hanging">flow start</text></g><g data-id="s_aaa3" data-tool="arrow" stroke="#1f1f1f" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" data-start-bind="s_aaa1 1 0.5" data-end-bind="s_aaa2 0 0.5 p"><line x1="260" y1="150" x2="320" y2="200"/><polyline points="307.1972004393032,196.78622909829892 320,200 314.5302123070536,187.9866148569984" fill="#1f1f1f"/></g><text data-id="s_aaa4" data-tool="text" x="100" y="260" data-font-size="14" fill="#1f1f1f" text-anchor="start" dominant-baseline="hanging" data-author="ai">AI note</text><ellipse data-id="s_aaa5" data-tool="ellipse" stroke="#30a46c" stroke-width="3" stroke-linecap="round" stroke-linejoin="round" vector-effect="non-scaling-stroke" fill="none" cx="700" cy="150" rx="60" ry="40" data-rot="15" transform="rotate(15 700 150)"/></svg>

package/apps/studio/test/fixtures/mock-acp-agent.mjs

@@ -0,0 +1,45 @@
+#!/usr/bin/env bun
+// Mock ACP agent for acp/bridge.test.ts. Stands in for `claude-agent-acp` so the
+// bridge can be exercised without a real `claude` install. Implements the
+// minimal handshake (initialize + session/new + session/prompt) and streams one
+// `agent_message_chunk` whose text echoes whether ANTHROPIC_API_KEY survived
+// into the child env — it MUST read `<unset>`, proving scrubAgentEnv (DDR-123
+// guardrail #1) stripped it before spawn.
+
+import { Readable, Writable } from 'node:stream';
+
+import * as acp from '@agentclientprotocol/sdk';
+
+const stream = acp.ndJsonStream(Writable.toWeb(process.stdout), Readable.toWeb(process.stdin));
+
+acp
+  .agent({ name: 'mock-acp-agent' })
+  .onRequest('initialize', () => ({
+    protocolVersion: acp.PROTOCOL_VERSION,
+    agentCapabilities: { loadSession: false },
+  }))
+  .onRequest(
+    'session/new',
+    (() => {
+      let n = 0;
+      return () => ({ sessionId: `mock-session-${++n}` });
+    })()
+  )
+  .onRequest('session/prompt', async (ctx) => {
+    // The per-request handler context exposes the client connection at `.client`.
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: {
+        sessionUpdate: 'agent_message_chunk',
+        content: {
+          type: 'text',
+          text:
+            `apiKey=${process.env.ANTHROPIC_API_KEY ?? '<unset>'} ` +
+            `model=${process.env.ANTHROPIC_MODEL ?? '<unset>'} ` +
+            `thinking=${process.env.MAX_THINKING_TOKENS ?? '<unset>'}`,
+        },
+      },
+    });
+    return { stopReason: 'end_turn' };
+  })
+  .connect(stream);