@1agh/maude 0.30.0 → 0.32.0

package/apps/studio/sync/agent.ts

@@ -50,17 +50,27 @@ import {
   commentsFromDoc,
   cssFromDoc,
   htmlFromDoc,
+  markSeeded,
   mergeSharedMetaIntoLocal,
   metaFromDoc,
+  seededByFromDoc,
   stampBodyEdit,
   Y_SYNC_TYPES,
 } from './codec.ts';
-import { decideColdStart, unionCommentsById } from './cold-start.ts';
+import { decideColdStart, isExactRepeat, unionCommentsById } from './cold-start.ts';
 import { type EchoGuard, hashBytes } from './echo-guard.ts';
 import type { SyncJournal } from './journal.ts';
 
 export const DOC_FLUSH_MS = 800;
 
+/**
+ * Window after a `seed-local-up` during which this agent will repair a
+ * concurrent-seed duplication (F1). Bounded so the repair only ever fires for
+ * the cold-start race — a genuine peer edit that arrives minutes later is NEVER
+ * collapsed back to our original seed. Generous relative to the hub sync RTT.
+ */
+export const SEED_REPAIR_WINDOW_MS = 10_000;
+
 export interface CanvasSyncPaths {
   /** Absolute path to <designRoot>/<canvas>.html. */
   html: string;
@@ -164,10 +174,21 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
   let lastMeta: string | null = null;
   let lastCss: string | null = null;
 
+  // F1 — the body this agent pushed on `seed-local-up`, plus the deadline past
+  // which the de-dup repair stops firing. Set on seed; nulled only when the
+  // window lapses (after convergence the repair is a cheap no-op — the
+  // `body === seedInfo.body` guard short-circuits, so we don't bother clearing).
+  // Null = this agent never seeded (so it never repairs).
+  let seedInfo: { body: string; until: number } | null = null;
+
   function onDocUpdate(_update: Uint8Array, updateOrigin: unknown): void {
     if (stopped) return;
     // Self-applied (we just synced from disk) — disk is already current.
     if (updateOrigin === origin) return;
+    // F1 — a remote update during the seed window may have concatenated a
+    // concurrent peer's identical seed onto ours. Collapse it (single elected
+    // writer) BEFORE the flush below can mirror a doubled body to disk.
+    maybeRepairSeedDuplication();
     scheduleFlush();
   }
 
@@ -188,6 +209,45 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
     }, flushMs);
   }
 
+  /**
+   * F1 — collapse a concurrent cold-seed duplication. When two peers
+   * `seed-local-up` the SAME body into an empty hub at the same instant, the
+   * merged Y.Text holds both insertions (`BODY` × N — un-buildable). This runs
+   * on every remote update inside the seed window and, on the single peer the
+   * `seededBy` Y.Map LWW elected, re-applies the canonical body so
+   * `applyHtmlToDoc`'s diff deletes the trailing duplicate(s). Only the elected
+   * owner repairs → the collapse op is emitted once and converges across peers
+   * (a non-owner just receives the delete). Restricted to an EXACT repeat of our
+   * seed: a divergent edit carries genuine bytes, so we DON'T touch it here —
+   * silently collapsing it would discard content. NOTE: that leaves the rare
+   * "two DIFFERENT bodies seeded into one empty hub at the same instant" case
+   * un-buildable until the NEXT boot, when `decideColdStart` routes it through
+   * the conflict path (dual snapshot + newest-wins). This live repair only
+   * covers the identical-seed race (the F1 RCA's scenario); the divergent
+   * variant is an accepted follow-up, not handled in-flight.
+   */
+  function maybeRepairSeedDuplication(): void {
+    if (!seedInfo) return;
+    if (Date.now() > seedInfo.until) {
+      seedInfo = null;
+      return;
+    }
+    const owner = seededByFromDoc(doc);
+    if (owner === null || owner !== doc.clientID) return; // not the elected writer
+    const body = htmlFromDoc(doc);
+    if (body === seedInfo.body) return; // already a single copy
+    if (!isExactRepeat(body, seedInfo.body)) return; // divergent edit → conflict path owns it
+    const canonical = seedInfo.body;
+    doc.transact(() => {
+      if (applyHtmlToDoc(doc, canonical, origin)) stampBodyEdit(doc, origin);
+    }, origin);
+    lastHtml = canonical;
+    opts.journal?.record(slug, { bodyHash: hashBytes(canonical) });
+    console.warn(
+      `[sync/${slug}] concurrent cold-seed duplication detected — collapsed to one copy (F1).`
+    );
+  }
+
   async function flush(): Promise<void> {
     if (!dirty || stopped) return;
     dirty = false;
@@ -348,7 +408,12 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
       if (localHtml !== null) {
         doc.transact(() => {
           if (applyHtmlToDoc(doc, localHtml, origin)) stampBodyEdit(doc, origin);
+          // F1 — adopt is also a "seed local up" (first link / fresh hub); claim
+          // it + arm the repair window so two peers adopting the same draft into
+          // one hub at once self-heal the same way the decision-table seed does.
+          markSeeded(doc, origin);
         }, origin);
+        seedInfo = { body: localHtml, until: Date.now() + SEED_REPAIR_WINDOW_MS };
       }
       if (localComments !== null) {
         const parsed = tryParseJsonArray(localComments);
@@ -396,8 +461,15 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
     const seedBodyUp = (body: string): void => {
       doc.transact(() => {
         if (applyHtmlToDoc(doc, body, origin)) stampBodyEdit(doc, origin);
+        // F1 — claim the seed (clientID marker) in the SAME update so a
+        // concurrent second seeder's merge resolves a single elected writer.
+        markSeeded(doc, origin);
       }, origin);
       lastHtml = body;
+      // Arm the de-dup repair window: if another peer seeded the same body at the
+      // same instant, the merged Y.Text will double — maybeRepairSeedDuplication
+      // (on the elected owner) collapses it back during this window.
+      seedInfo = { body, until: Date.now() + SEED_REPAIR_WINDOW_MS };
       opts.journal?.record(slug, { bodyHash: hashBytes(body) });
     };
 
@@ -421,6 +493,14 @@ export function createCanvasSyncAgent(opts: CanvasSyncAgentOptions): CanvasSyncA
         seedBodyUp(localHtml as string);
         bodyWinner = 'local';
         break;
+      case 'recover-seed-dup':
+        // F1 — booting against a hub whose body is our local body repeated (a
+        // concurrent cold-seed that already duplicated). Re-apply local so the
+        // diff deletes the extra copy/copies; the content equals local, so the
+        // visually-coupled lanes follow local too. Idempotent across peers.
+        seedBodyUp(localHtml as string);
+        bodyWinner = 'local';
+        break;
       case 'conflict': {
         // Divergence: snapshot BOTH versions to `_history/<slug>/` BEFORE any
         // write, then apply the newest-wins winner. Even a wrong pick costs

package/apps/studio/sync/codec.ts

@@ -338,6 +338,30 @@ export function bodyEditAtFromDoc(doc: Y.Doc): number | null {
   return typeof v === 'number' && Number.isFinite(v) ? v : null;
 }
 
+/**
+ * Record THIS doc's clientID as the seeder in `syncMeta.seededBy` (F1). Call it
+ * in the SAME transaction + origin as a `seed-local-up` body apply. The value is
+ * a Yjs clientID, so when two peers seed the same empty hub simultaneously and
+ * their maps merge, Y.Map's deterministic last-writer-wins resolution converges
+ * `seededBy` to ONE clientID on EVERY peer — that elected peer is the
+ * single-writer that performs the de-duplication repair, so the collapse op is
+ * never emitted twice. Informational/bookkeeping only; never materialized to
+ * disk (syncMeta is a sync-internal lane).
+ */
+export function markSeeded(doc: Y.Doc, origin?: unknown): void {
+  const map = doc.getMap<unknown>(Y_SYNC_TYPES.syncMeta);
+  doc.transact(() => {
+    map.set('seededBy', doc.clientID);
+  }, origin);
+}
+
+/** The elected seeder's clientID (`syncMeta.seededBy`), or null when no peer
+ *  ever seeded through the marker path (older peers / non-seed canvases). */
+export function seededByFromDoc(doc: Y.Doc): number | null {
+  const v = doc.getMap<unknown>(Y_SYNC_TYPES.syncMeta).get('seededBy');
+  return typeof v === 'number' && Number.isFinite(v) ? v : null;
+}
+
 /* ---------------------------------------------------------------- css */
 
 /** The synced canvas CSS string held in the doc, or null when unset/empty. */

package/apps/studio/sync/cold-start.ts

@@ -26,6 +26,7 @@ export type ColdStartAction =
   | 'materialize-hub'
   | 'seed-local-up'
   | 'fast-forward-hub'
+  | 'recover-seed-dup'
   | 'conflict';
 
 export interface ColdStartInput {
@@ -56,6 +57,24 @@ function isEmptyBody(body: string | null): boolean {
   return body === null || body.trim() === '';
 }
 
+/**
+ * True when `docBody` is exactly `localBody` repeated N≥2 times — the signature
+ * of a concurrent cold-seed collision (F1): two peers each `seed-local-up`-ed
+ * the SAME body into an empty hub before either's write propagated, so the CRDT
+ * preserved both insertions and the Y.Text became `BODY` × N. We detect the
+ * exact-repeat shape (not a fuzzy "contains") so a legitimate later edit — which
+ * is never a clean integer-multiple repeat of the prior body — can't be
+ * mis-read as a duplication and clobbered back. Exact equality (N==1) is the
+ * caller's `noop`, handled before this is consulted.
+ */
+export function isExactRepeat(docBody: string, localBody: string): boolean {
+  if (localBody.length === 0) return false;
+  if (docBody.length <= localBody.length) return false;
+  if (docBody.length % localBody.length !== 0) return false;
+  const n = docBody.length / localBody.length;
+  return docBody === localBody.repeat(n);
+}
+
 function commentId(c: unknown): string | null {
   if (c && typeof c === 'object' && typeof (c as { id?: unknown }).id === 'string') {
     return (c as { id: string }).id;
@@ -117,6 +136,27 @@ export function decideColdStart(input: ColdStartInput): ColdStartDecision {
     return { action: 'noop', reason: 'local and hub identical' };
   }
 
+  // Concurrent cold-seed collision (F1): the hub body is our local body repeated
+  // N≥2 times — two peers seeded the same canvas into an empty hub at the same
+  // moment and the CRDT concatenated both insertions (un-buildable: two `export
+  // default`). This is NOT divergence (it carries no new bytes — just a doubled
+  // copy of ours), so it must NOT take the conflict/fast-forward path. Collapse
+  // it back to one copy by re-applying local (the caller's `applyHtmlToDoc` diff
+  // deletes the trailing duplicate). Idempotent across peers — the delete targets
+  // the same CRDT items, so concurrent recoveries converge instead of fighting.
+  if (
+    input.localBody !== null &&
+    !localEmpty &&
+    !docEmpty &&
+    isExactRepeat(input.docBody, input.localBody)
+  ) {
+    return {
+      action: 'recover-seed-dup',
+      reason:
+        'hub body is local repeated — concurrent cold-seed duplication; collapsing to one copy',
+    };
+  }
+
   // Hash via hashBytes ONLY — the journal recorded its hashes through the same
   // fn (single source, echo-guard.ts), so this comparison is apples-to-apples.
   if (

package/apps/studio/sync/hub-link.ts

@@ -0,0 +1,137 @@
+// sync/hub-link.ts — Phase 29 (E4) Door C: connect to a team hub from the wizard.
+//
+// The CLI (`maude design link`) owns the FULL link flow (interactive trust gate +
+// per-project `.design/config.json` linkedHub write + `--adopt` push). This is the
+// lean in-app counterpart used by the onboarding wizard's advanced door: it saves the
+// hub CREDENTIAL to the global `~/.config/maude/hubs.json` (mode 0600) and records the
+// hub as trusted on THIS machine — the in-UI "Connect" IS the explicit trust grant the
+// CLI's interactive confirmation provides (DDR-054 F2). Hub tokens are GLOBAL /
+// per-machine (keyed by normalized URL), so a project later opened whose
+// `.design/config.json` names this hub syncs using the saved token. We deliberately do
+// NOT write a per-project `linkedHub` here (onboarding has no project yet) — that stays
+// a CLI / post-onboarding operation.
+//
+// SECURITY: the http layer gates this main-origin + loopback only (mirrors
+// /_api/github/*). The health probe is a best-effort, TOKENLESS GET to the user-entered
+// hub URL; only `{ ok, version }` is reflected back — no response-body passthrough, so it
+// can't become an SSRF data-exfil channel. The probe deliberately does NOT carry the hub
+// token: a user who pastes a lookalike URL must not have their credential delivered to the
+// attacker's host (phase-29 /flow:done attacker finding A2). The token is only persisted
+// locally (mode 0600) and presented later on the authenticated sync WS upgrade. The hub
+// address is whatever the user typed (a LAN / Tailscale / fly.dev URL is legitimate —
+// phase-9's hub model expects private hosts), so we do NOT block private IPs; the safety
+// is the loopback caller gate + no reflection + no token on the probe.
+
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+
+import { hubsConfigPath, normalizeUrl } from './hubs-config.ts';
+
+export interface HubLinkResult {
+  status: number;
+  json: unknown;
+}
+
+const HUB_PROBE_TIMEOUT_MS = 4000;
+
+interface HubsFile {
+  hubs: Record<string, { token: string; linkedAt: number }>;
+  trusted?: string[];
+}
+
+/** Validate + probe + persist a hub credential. Returns an http-shaped result. */
+export async function linkHub(body: unknown): Promise<HubLinkResult> {
+  const b = (body ?? {}) as { url?: unknown; token?: unknown };
+  if (typeof b.url !== 'string' || !b.url.trim()) return bad('Enter the hub address.');
+  if (typeof b.token !== 'string' || !b.token.trim())
+    return bad('Paste the invite link or token your team gave you.');
+
+  let norm: string;
+  try {
+    norm = normalizeUrl(b.url.trim());
+  } catch {
+    return bad("That doesn't look like a valid hub address.");
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(norm);
+  } catch {
+    return bad('Invalid hub address.');
+  }
+  if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:')
+    return bad('The hub address must start with http:// or https://.');
+
+  const token = b.token.trim();
+
+  // Best-effort reachability probe — TOKENLESS (never deliver the credential to a
+  // possibly-lookalike host) and does NOT gate the save (a firewalled hub the user
+  // trusts still links; the real auth happens on the sync WS upgrade).
+  const probe = await probeHealth(norm);
+
+  try {
+    saveHubCredential(norm, token);
+  } catch {
+    return { status: 500, json: { ok: false, error: "Couldn't save the hub connection." } };
+  }
+
+  return {
+    status: 200,
+    json: { ok: true, url: norm, healthy: probe.ok, version: probe.version ?? null },
+  };
+}
+
+function bad(error: string): HubLinkResult {
+  return { status: 400, json: { ok: false, error } };
+}
+
+async function probeHealth(url: string): Promise<{ ok: boolean; version?: string }> {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), HUB_PROBE_TIMEOUT_MS);
+  try {
+    // Tokenless on purpose (attacker finding A2): /health is a liveness check; the
+    // credential is never sent to the user-typed host, only to the trusted hub on the
+    // authenticated sync WS upgrade later.
+    const res = await fetch(`${url}/health`, { signal: ctrl.signal });
+    if (!res.ok) return { ok: false };
+    let version: string | undefined;
+    try {
+      const j = (await res.json()) as { version?: unknown };
+      if (j && typeof j.version === 'string') version = j.version;
+    } catch {
+      /* health may not be JSON — reachability alone is enough */
+    }
+    return { ok: true, version };
+  } catch {
+    return { ok: false };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** Upsert the token under `normUrl` + record per-machine trust; mode 0600. */
+export function saveHubCredential(normUrl: string, token: string): void {
+  const path = hubsConfigPath();
+  const dir = dirname(path);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  let cfg: HubsFile = { hubs: {} };
+  if (existsSync(path)) {
+    try {
+      const parsed = JSON.parse(readFileSync(path, 'utf8'));
+      if (parsed && typeof parsed.hubs === 'object' && parsed.hubs !== null)
+        cfg = parsed as HubsFile;
+    } catch {
+      /* malformed → start fresh rather than throw */
+    }
+  }
+  cfg.hubs[normUrl] = { token, linkedAt: Date.now() };
+  if (!Array.isArray(cfg.trusted)) cfg.trusted = [];
+  if (!cfg.trusted.includes(normUrl)) cfg.trusted.push(normUrl);
+  writeFileSync(path, `${JSON.stringify(cfg, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+  try {
+    chmodSync(path, 0o600);
+  } catch {
+    /* windows / read-only fs — best effort */
+  }
+}
+
+export const __testing = { probeHealth };

package/apps/studio/test/acp-bridge.test.ts

@@ -0,0 +1,127 @@
+// End-to-end bridge test against a mock ACP agent (test/fixtures/mock-acp-agent.mjs)
+// so no real `claude` install is needed. Proves: spawn + handshake + streamed
+// update + turn completion, AND that ANTHROPIC_API_KEY never reaches the child
+// (DDR-123 guardrail #1, verified end-to-end — the mock echoes its own env).
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import { join } from 'node:path';
+
+import { AcpBridge } from '../acp/bridge.ts';
+import { probeAcpAvailability } from '../acp/probe.ts';
+
+const FIXTURE = join(import.meta.dir, 'fixtures', 'mock-acp-agent.mjs');
+const TEST_ENV_KEYS = [
+  'ANTHROPIC_API_KEY',
+  'MAUDE_ACP_ADAPTER_ENTRY',
+  'MAUDE_ACP_RUNTIME',
+  'MAUDE_CLAUDE_BIN',
+];
+
+afterEach(() => {
+  for (const key of TEST_ENV_KEYS) delete process.env[key];
+});
+
+describe('AcpBridge — round-trip + subscription guardrail', () => {
+  test('connects, streams an update, completes a turn, and scrubs ANTHROPIC_API_KEY', async () => {
+    process.env.ANTHROPIC_API_KEY = 'sk-must-be-scrubbed';
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath; // run the mock under this bun
+    process.env.MAUDE_CLAUDE_BIN = process.execPath; // satisfy the claude-present check
+
+    const updates: unknown[] = [];
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: (u) => updates.push(u) });
+    try {
+      const result = await bridge.prompt('hello', 'c1');
+      expect(bridge.connected).toBe(true);
+      expect(bridge.sessionId).toBe('mock-session-1');
+      expect(result.stopReason).toBe('end_turn');
+
+      // The mock streamed its own ANTHROPIC_API_KEY — it must read `<unset>`,
+      // proving scrubAgentEnv stripped it from the child env before spawn.
+      const streamed = JSON.stringify(updates);
+      expect(streamed).toContain('apiKey=<unset>');
+      expect(streamed).not.toContain('sk-must-be-scrubbed');
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('setConfig passes model + effort to the child env (ANTHROPIC_MODEL / MAX_THINKING_TOKENS)', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+
+    const updates: unknown[] = [];
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: (u) => updates.push(u) });
+    try {
+      bridge.setConfig('opus', 'thorough');
+      await bridge.prompt('hi', 'c1');
+      const first = JSON.stringify(updates);
+      expect(first).toContain('model=opus');
+      expect(first).toContain('thinking=31999');
+
+      // Changing the config re-spawns with the new env on the next prompt.
+      updates.length = 0;
+      bridge.setConfig(null, 'fast');
+      await bridge.prompt('again', 'c1');
+      const second = JSON.stringify(updates);
+      expect(second).toContain('model=<unset>'); // null model → ANTHROPIC_MODEL not set
+      expect(second).toContain('thinking=0'); // fast → thinking disabled
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('a second prompt reuses the same live session', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    try {
+      await bridge.prompt('first', 'c1');
+      const sid = bridge.sessionId;
+      await bridge.prompt('second', 'c1');
+      expect(bridge.sessionId).toBe(sid);
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+
+  test('different chat ids get separate claude sessions; same id reuses its own', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_ACP_RUNTIME = process.execPath;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    try {
+      await bridge.prompt('a', 'chatA');
+      const sa = bridge.sessionId;
+      await bridge.prompt('b', 'chatB');
+      const sb = bridge.sessionId;
+      expect(sa).not.toBe(sb); // separate per-chat contexts
+      await bridge.prompt('a again', 'chatA');
+      expect(bridge.sessionId).toBe(sa); // chatA reuses its own session
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+});
+
+describe('probeAcpAvailability — not-connected detection', () => {
+  test('reports not-available with a Claude-Code reason when the CLI is absent', () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = join(import.meta.dir, 'no-such-claude-bin');
+    const probe = probeAcpAvailability();
+    expect(probe.available).toBe(false);
+    expect(probe.reason ?? '').toMatch(/Claude Code/i);
+  });
+
+  test('reports available when both the adapter and a claude binary resolve', () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = process.execPath;
+    const probe = probeAcpAvailability();
+    expect(probe.available).toBe(true);
+    expect(probe.adapterEntry).toBe(FIXTURE);
+  });
+});

package/apps/studio/test/acp-env.test.ts

@@ -0,0 +1,65 @@
+// DDR-123 guardrail #1 — the single load-bearing detail that keeps the chat
+// panel on the user's Pro/Max subscription instead of metered API billing.
+
+import { describe, expect, test } from 'bun:test';
+
+import { SUBSCRIPTION_SCRUBBED_ENV_KEYS, scrubAgentEnv } from '../acp/env.ts';
+
+describe('scrubAgentEnv — subscription guardrail', () => {
+  test('strips the billing-switching keys, keeps everything else', () => {
+    const out = scrubAgentEnv({
+      PATH: '/usr/bin',
+      HOME: '/Users/x',
+      ANTHROPIC_API_KEY: 'sk-live-xxx',
+      ANTHROPIC_AUTH_TOKEN: 'tok-xxx',
+      UNDEFINED_VAR: undefined,
+    });
+    expect(out.PATH).toBe('/usr/bin');
+    expect(out.HOME).toBe('/Users/x');
+    expect('ANTHROPIC_API_KEY' in out).toBe(false);
+    expect('ANTHROPIC_AUTH_TOKEN' in out).toBe(false);
+    // undefined values are dropped (Bun.spawn env wants Record<string,string>)
+    expect('UNDEFINED_VAR' in out).toBe(false);
+  });
+
+  test('pins exactly the two precedence-relevant keys', () => {
+    expect([...SUBSCRIPTION_SCRUBBED_ENV_KEYS].sort()).toEqual([
+      'ANTHROPIC_API_KEY',
+      'ANTHROPIC_AUTH_TOKEN',
+    ]);
+  });
+
+  test('scrubs the whole provider/billing namespace, not just the two keys (F1)', () => {
+    const out = scrubAgentEnv({
+      PATH: '/usr/bin',
+      ANTHROPIC_BASE_URL: 'https://evil.example/v1',
+      ANTHROPIC_MODEL: 'attacker-pinned',
+      ANTHROPIC_BEDROCK_BASE_URL: 'https://evil',
+      CLAUDE_CODE_USE_BEDROCK: '1',
+      CLAUDE_CODE_USE_VERTEX: '1',
+      AWS_BEARER_TOKEN_BEDROCK: 'tok',
+      claude_session: 'keep-me', // not a provider redirect → kept
+    });
+    expect(out.PATH).toBe('/usr/bin');
+    expect('ANTHROPIC_BASE_URL' in out).toBe(false);
+    expect('ANTHROPIC_MODEL' in out).toBe(false); // re-added by the bridge from a validated value
+    expect('ANTHROPIC_BEDROCK_BASE_URL' in out).toBe(false);
+    expect('CLAUDE_CODE_USE_BEDROCK' in out).toBe(false);
+    expect('CLAUDE_CODE_USE_VERTEX' in out).toBe(false);
+    expect('AWS_BEARER_TOKEN_BEDROCK' in out).toBe(false);
+    expect(out.claude_session).toBe('keep-me');
+  });
+
+  test('never mutates the source (process.env stays intact for the parent)', () => {
+    const src: Record<string, string | undefined> = { ANTHROPIC_API_KEY: 'sk', PATH: '/bin' };
+    const out = scrubAgentEnv(src);
+    expect(src.ANTHROPIC_API_KEY).toBe('sk');
+    expect(out).not.toBe(src);
+  });
+
+  test('defaults to process.env when called with no argument', () => {
+    // Smoke: doesn't throw, returns a string map without the scrubbed keys.
+    const out = scrubAgentEnv();
+    expect('ANTHROPIC_API_KEY' in out).toBe(false);
+  });
+});

package/apps/studio/test/acp-origin-gate.test.ts

@@ -0,0 +1,95 @@
+// ACP bridge origin gate (DDR-123). The agent bridge spawns the user's `claude`
+// and can drive file edits, so it lives ONLY on the main (privileged) origin and
+// only over loopback. This proves:
+//   (1) GET /_api/acp/status serves on the main origin;
+//   (2) it is 403'd on the untrusted canvas origin (off CANVAS_SAFE_API +
+//       startCanvasServer routes — the dual-allowlist rule);
+//   (3) /_ws/acp is wired on the main origin (upgrade-without-headers → 400);
+//   (4) the loopback guard that fronts /_ws/acp rejects non-loopback hosts.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { isLoopbackHost } from '../ws.ts';
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+async function readCanvasOrigin(designRoot: string): Promise<string> {
+  for (let i = 0; i < 40; i++) {
+    try {
+      const info = JSON.parse(readFileSync(join(designRoot, '_server.json'), 'utf8'));
+      if (info.canvasOrigin) return info.canvasOrigin as string;
+    } catch {
+      /* not written yet */
+    }
+    await Bun.sleep(50);
+  }
+  throw new Error('canvasOrigin never appeared in _server.json');
+}
+
+describe('ACP bridge origin gate', () => {
+  test('status is main-origin only; /_ws/acp wired on main', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, { MAUDE_CANVAS_ORIGIN_SPLIT: '1' });
+    try {
+      const main = `http://localhost:${port}`;
+      const canvas = await readCanvasOrigin(designRoot);
+      const status = async (base: string, path: string) =>
+        (await fetch(base + path, { signal: AbortSignal.timeout(2000) })).status;
+
+      // (1) main origin exposes the readiness probe
+      const probe = await fetch(`${main}/_api/acp/status`, { signal: AbortSignal.timeout(2000) });
+      expect(probe.status).toBe(200);
+      expect(typeof (await probe.json()).available).toBe('boolean');
+
+      // (2) the untrusted canvas origin must NOT reach the probe
+      expect(await status(canvas, '/_api/acp/status')).toBe(403);
+
+      // (3) /_ws/acp is wired on the main origin — a plain GET (no Upgrade
+      // headers) passes the loopback guard then fails the WS upgrade → 400,
+      // which proves the route branch exists (a 404 would mean it's unwired).
+      expect(await status(main, '/_ws/acp')).toBe(400);
+
+      // (4) /_api/acp/focus (the /design:chat hook) — POST-only on the main
+      // origin, 403 on the canvas origin.
+      const focusPost = await fetch(`${main}/_api/acp/focus`, {
+        method: 'POST',
+        signal: AbortSignal.timeout(2000),
+      });
+      expect(focusPost.status).toBe(200);
+      expect((await focusPost.json()).ok).toBe(true);
+      expect(await status(main, '/_api/acp/focus')).toBe(405); // GET not allowed
+      expect(await status(canvas, '/_api/acp/focus')).toBe(403); // off the canvas origin
+
+      // (5) DDR-128 — /_api/preflight readiness probe: main-origin 200 with the
+      // {ready, items[]} shape; 403 on the untrusted canvas origin (dual-allowlist).
+      const pre = await fetch(`${main}/_api/preflight`, { signal: AbortSignal.timeout(2000) });
+      expect(pre.status).toBe(200);
+      const preJson = await pre.json();
+      expect(typeof preJson.ready).toBe('boolean');
+      expect(Array.isArray(preJson.items)).toBe(true);
+      expect(await status(canvas, '/_api/preflight')).toBe(403);
+      // A cross-origin drive-by GET is Origin-rejected before the probe can shell
+      // out — DDR-128 DoS hardening (ethical-hacker F1). Same-origin/loopback (no
+      // Origin header, asserted above) stays 200.
+      const crossOrigin = await fetch(`${main}/_api/preflight`, {
+        headers: { Origin: 'https://evil.example' },
+        signal: AbortSignal.timeout(2000),
+      });
+      expect(crossOrigin.status).toBe(403);
+    } finally {
+      await killProc(proc);
+    }
+  }, 15000);
+
+  test('the loopback guard fronting /_ws/acp rejects non-loopback hosts', () => {
+    // Same guard server.ts applies before upgrading the acp socket.
+    expect(isLoopbackHost('127.0.0.1:4399')).toBe(true);
+    expect(isLoopbackHost('localhost:4399')).toBe(true);
+    expect(isLoopbackHost('[::1]:4399')).toBe(true);
+    expect(isLoopbackHost('evil.example.com')).toBe(false);
+    expect(isLoopbackHost('10.0.0.5:4399')).toBe(false);
+    expect(isLoopbackHost(null)).toBe(false);
+  });
+});