@1agh/maude 0.35.0 → 0.36.1

package/apps/studio/test/identity-cache.test.ts

@@ -0,0 +1,83 @@
+// DDR-132 — per-user GitHub identity SWR disk cache.
+//
+// Round-trips the cache against a temp XDG_CACHE_HOME, proves a different
+// token-hash is a clean miss, and asserts the raw token NEVER appears in the
+// on-disk file (only its sha256 prefix). Pure module — no network.
+
+import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  __testing,
+  cacheDir,
+  clearCached,
+  readCached,
+  tokenHash,
+  writeCached,
+} from '../github/identity-cache.ts';
+
+const realXdg = process.env.XDG_CACHE_HOME;
+let tmp: string;
+
+beforeEach(() => {
+  tmp = mkdtempSync(join(tmpdir(), 'maude-idcache-'));
+  process.env.XDG_CACHE_HOME = tmp;
+});
+afterEach(() => {
+  if (realXdg === undefined) delete process.env.XDG_CACHE_HOME;
+  else process.env.XDG_CACHE_HOME = realXdg;
+  rmSync(tmp, { recursive: true, force: true });
+});
+
+const IDENTITY = { login: 'octocat', name: 'Octo Cat', avatar_url: 'https://x/y.png' };
+
+describe('identity-cache', () => {
+  test('cacheDir lands under $XDG_CACHE_HOME/maude', () => {
+    expect(cacheDir()).toBe(join(tmp, 'maude'));
+  });
+
+  test('round-trips a written identity for the matching key', () => {
+    const key = tokenHash('tok_secret_abc');
+    expect(readCached(key)).toBeNull(); // first run: clean miss
+    writeCached(key, IDENTITY);
+    expect(readCached(key)).toEqual(IDENTITY);
+  });
+
+  test('a different token-hash is a clean miss (account/token swap)', () => {
+    writeCached(tokenHash('tok_account_A'), IDENTITY);
+    expect(readCached(tokenHash('tok_account_B'))).toBeNull();
+  });
+
+  test('the raw token never appears in the on-disk file', () => {
+    const token = 'ghp_SUPERSECRETtokenVALUE1234567890';
+    writeCached(tokenHash(token), IDENTITY);
+    const raw = readFileSync(__testing.cacheFile(), 'utf8');
+    expect(raw).not.toContain(token);
+    // the stored key IS present and is the hash prefix, not the token
+    expect(raw).toContain(tokenHash(token));
+    expect(tokenHash(token).length).toBe(16);
+  });
+
+  test('tolerates a null name', () => {
+    const key = tokenHash('t');
+    writeCached(key, { login: 'ghost', name: null, avatar_url: 'a' });
+    expect(readCached(key)?.name).toBeNull();
+  });
+
+  test('corrupt JSON is a clean miss, not a throw', () => {
+    writeCached(tokenHash('t'), IDENTITY);
+    // clobber the file with garbage
+    const fs = require('node:fs');
+    fs.writeFileSync(__testing.cacheFile(), '{ not json');
+    expect(readCached(tokenHash('t'))).toBeNull();
+  });
+
+  test('clearCached forces a subsequent miss', () => {
+    const key = tokenHash('t');
+    writeCached(key, IDENTITY);
+    expect(readCached(key)).toEqual(IDENTITY);
+    clearCached();
+    expect(readCached(key)).toBeNull();
+  });
+});

package/apps/studio/test/remote-ahead-behind-cache.test.ts

@@ -0,0 +1,89 @@
+// DDR-132 — remote ahead/behind probe: in-memory TTL cache + in-flight dedupe.
+//
+// Verifies the cache WRAPPER (TTL-serve / invalidate / in-flight coalesce) fully
+// offline, with no network and no git spawn. Trick: the probe's DDR-131 transport
+// gate classifies a bare local-path remote as `unsafe`, so `remoteAheadBehind`
+// returns a FRESH `{ahead:0,behind:0}` object on every *uncached* evaluation
+// without touching the network. Object IDENTITY (`Object.is`) therefore tells a
+// cache-serve (same reference) apart from a re-run (new reference) — a stronger
+// signal than value equality, and one the security hardening can't invalidate.
+//
+// (The real fetch/count path needs a reachable github.com remote and is covered
+// by the manual native dogfood — same offline ceiling DDR-131 records for
+// `gitFetchRemote`. This file owns the wrapper semantics only.)
+//
+// This file deliberately does NOT set MAUDE_USE_SYSTEM_GIT (it would leak into the
+// shared bun-test process and flip other files' iso-engine expectations).
+
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { invalidateRemoteProbe, remoteAheadBehind } from '../git/service.ts';
+
+function git(cwd: string, args: string[]): void {
+  const p = Bun.spawnSync(['git', ...args], {
+    cwd,
+    env: { ...process.env, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null' },
+  });
+  if (p.exitCode !== 0) throw new Error(`git ${args.join(' ')}: ${p.stderr.toString()}`);
+}
+
+let work: string;
+
+beforeEach(() => {
+  work = mkdtempSync(join(tmpdir(), 'maude-ab-work-'));
+  git(work, ['init', '-q', '-b', 'main']);
+  git(work, ['config', 'user.email', 't@t.dev']);
+  git(work, ['config', 'user.name', 'Tester']);
+  writeFileSync(join(work, 'a.txt'), 'hello\n');
+  git(work, ['add', '.']);
+  git(work, ['commit', '-q', '-m', 'init']);
+  // A bare local path → DDR-131 transport gate classifies it `unsafe` → the probe
+  // returns {0,0} with no spawn. (Any value is fine; we assert on identity.)
+  git(work, ['remote', 'add', 'origin', '/var/empty/maude-test-remote']);
+});
+
+afterEach(() => {
+  invalidateRemoteProbe(work);
+  rmSync(work, { recursive: true, force: true });
+});
+
+test('a second call within the TTL serves the cached object (no re-run)', async () => {
+  const a = await remoteAheadBehind(work, undefined);
+  expect(a).toEqual({ ahead: 0, behind: 0 });
+  const b = await remoteAheadBehind(work, undefined);
+  expect(Object.is(a, b)).toBe(true); // same reference ⇒ served from cache
+});
+
+test('invalidateRemoteProbe forces a fresh evaluation (new object)', async () => {
+  const a = await remoteAheadBehind(work, undefined);
+  invalidateRemoteProbe(work);
+  const c = await remoteAheadBehind(work, undefined);
+  expect(c).toEqual({ ahead: 0, behind: 0 });
+  expect(Object.is(a, c)).toBe(false); // new reference ⇒ re-ran after invalidation
+});
+
+test('SECURITY (DDR-133 F1): the unattended probe never fetches a non-github HTTP remote', async () => {
+  // Repoint origin to a non-github HTTPS host (a poisoned `.git/config` riding a clone).
+  // With system git auto-preferred (DDR-133), the host-allowlist must gate this probe
+  // BEFORE the engine branch — otherwise an http transport reached `git fetch` against
+  // ANY host on the unattended 45s poll (SSRF / presence beacon). The guard returns
+  // {0,0} with NO spawn; a regression would attempt the fetch and reject/hang here.
+  git(work, ['remote', 'set-url', 'origin', 'https://evil.example.invalid/repo.git']);
+  invalidateRemoteProbe(work);
+  const r = await remoteAheadBehind(work, 'tok_must_never_be_sent');
+  expect(r).toEqual({ ahead: 0, behind: 0 });
+});
+
+test('concurrent callers coalesce onto one shared in-flight result', async () => {
+  const [a, b, c] = await Promise.all([
+    remoteAheadBehind(work, undefined),
+    remoteAheadBehind(work, undefined),
+    remoteAheadBehind(work, undefined),
+  ]);
+  // One shared in-flight promise (or the just-written cache) ⇒ identical reference,
+  // never three independent evaluations.
+  expect(Object.is(a, b)).toBe(true);
+  expect(Object.is(b, c)).toBe(true);
+});

package/apps/studio/test/use-undo-stack.test.tsx

@@ -155,6 +155,36 @@ describe('use-undo-stack / runner side-effects', () => {
   });
 });
 
+describe('use-undo-stack / record (already-applied edits)', () => {
+  test('record() appends WITHOUT running do()', async () => {
+    const v = captureProvider(undefined, { layoutPatchFn: () => {} });
+    v.record(rec('inline-edit', 'X'));
+    // undo() is enqueued after record(), so awaiting it flushes record first.
+    await v.undo();
+    expect(doSpy).toHaveBeenCalledTimes(0); // record never runs do()
+    expect(undoSpy).toHaveBeenCalledTimes(1);
+    expect(undoSpy.mock.calls[0]?.[0]).toBe('X');
+  });
+
+  test('record() then redo() (after undo) re-runs do()', async () => {
+    const v = captureProvider(undefined, { layoutPatchFn: () => {} });
+    v.record(rec('e', 'Y'));
+    await v.undo();
+    await v.redo();
+    expect(doSpy).toHaveBeenCalledTimes(1); // only redo's do(), not the record
+    expect(doSpy.mock.calls[0]?.[0]).toBe('Y');
+  });
+
+  test('record() clears the redo future', async () => {
+    const v = captureProvider(undefined, { layoutPatchFn: () => {} });
+    await v.push(rec('a', 'A')); // doSpy: 1
+    await v.undo(); // future = [a]
+    v.record(rec('b', 'B')); // clears future
+    await v.redo(); // future empty → no-op, no extra do()
+    expect(doSpy).toHaveBeenCalledTimes(1);
+  });
+});
+
 describe('use-undo-stack / cross-canvas persistence', () => {
   test('history under a canvasFile survives a fresh provider mount with the same canvasFile', async () => {
     // First mount: push 2 records.

package/apps/studio/undo-stack.ts

@@ -71,6 +71,16 @@ export interface CommandSinks {
   layoutPatchFn?: unknown;
   /** Wired by `AnnotationsLayer`. */
   strokesPutFn?: unknown;
+  /**
+   * Wired by `CanvasShell` (canvas-shell.tsx). Applies a single inline source
+   * edit (CSS / text / attr) by posting `dgn:'apply-edit'` to the parent shell,
+   * which owns the main-origin-only `/_api/edit-*` write (DDR-054 — the canvas
+   * iframe can't call those routes directly). Drives undo/redo of inspector
+   * CSS edits, inline text rewrites, and custom-attribute edits, which write
+   * the canvas `.tsx` source and were previously unrecoverable (no command, no
+   * snapshot). See `commands/edit-source-command.ts`.
+   */
+  editSourceApplyFn?: unknown;
 }
 
 export type CommandBuilder<P = unknown> = (

package/apps/studio/use-undo-stack.tsx

@@ -51,6 +51,14 @@ export interface UndoStackValue {
    * Awaiting the returned promise is optional.
    */
   push: (record: CommandRecord) => Promise<void>;
+  /**
+   * Record an ALREADY-APPLIED command — appends to `past` + clears `future`
+   * WITHOUT running `do()`. Use when the side-effect happened outside the
+   * stack (e.g. an inspector CSS commit / inline text edit that already POSTed
+   * `/_api/edit-*`), so re-running `do()` would double-apply. `undo()` / `redo()`
+   * still drive the command's `undo()` / `do()` normally afterwards.
+   */
+  record: (record: CommandRecord) => void;
   /** Undo the top of `past`. No-op when empty. */
   undo: () => Promise<void>;
   /** Redo the top of `future`. No-op when empty. */
@@ -69,6 +77,7 @@ const UndoStackContext = createContext<UndoStackValue | null>(null);
 
 const NOOP_VALUE: UndoStackValue = {
   push: () => Promise.resolve(),
+  record: () => {},
   undo: () => Promise.resolve(),
   redo: () => Promise.resolve(),
   clear: () => {},
@@ -213,6 +222,16 @@ export function UndoStackProvider({
     [enqueue, build, reportError, bumpLabel, writeState]
   );
 
+  const record = useCallback(
+    (rec: CommandRecord): void => {
+      void enqueue(async () => {
+        writeState(undoReducer(stateRef.current, { type: 'push', record: rec }));
+        bumpLabel(rec.label);
+      });
+    },
+    [enqueue, writeState, bumpLabel]
+  );
+
   const undo = useCallback(
     (): Promise<void> =>
       enqueue(async () => {
@@ -306,6 +325,7 @@ export function UndoStackProvider({
   const value = useMemo<UndoStackValue>(
     () => ({
       push,
+      record,
       undo,
       redo,
       clear,
@@ -318,7 +338,7 @@ export function UndoStackProvider({
     // `lastTick` (bumped by every push/undo/redo/clear) as the proxy so the
     // memoized canUndo/canRedo readouts re-evaluate on each transition.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [push, undo, redo, clear, lastLabel, lastTick]
+    [push, record, undo, redo, clear, lastLabel, lastTick]
   );
 
   return (

package/apps/studio/whats-new.json

@@ -1,6 +1,24 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "git-native-switcher",
+      "version": "0.36.0",
+      "date": "2026-06-30",
+      "kind": "feature",
+      "title": "The version switcher now speaks Git",
+      "summary": "The bottom-left switcher uses plain Git names now — your branches by name, main as the default branch everyone shares, and a one-click “Merge this branch → main.” It opens instantly even on repos with hundreds of branches (it uses your installed Git when you have it), and “Pull a local copy” lists every repo you can reach on GitHub — including ones shared through your team or organization.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "remote-drafts-in-switcher",
+      "version": "0.36.0",
+      "date": "2026-06-30",
+      "kind": "feature",
+      "title": "Open any draft, including your team's",
+      "summary": "The version switcher now shows drafts that live on your team's shared remote — not only the ones already on this computer. They're marked “from your team,” and picking one downloads it for you. Hit Refresh to pull in a draft someone just made, search to find one in a long list, and your most recently worked-on drafts sort to the top. Works whether your project connects over SSH or HTTPS.",
+      "surface": "design-ui"
+    },
     {
       "id": "desktop-ai-chat-fix",
       "version": "0.32.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.35.0",
+  "version": "0.36.1",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -22,7 +22,10 @@
     "dev:site": "pnpm --filter @maude/site dev --port 4398",
     "dev:desktop": "PATH=\"$HOME/.cargo/bin:$PATH\" pnpm --filter @maude/desktop tauri dev",
     "build:desktop": "PATH=\"$HOME/.cargo/bin:$PATH\" pnpm --filter @maude/desktop tauri build",
-    "build": "pnpm -r --if-present --filter '!@maude/desktop' run build",
+    "test:e2e:desktop:build": "PATH=\"$HOME/.cargo/bin:$PATH\" pnpm --filter @maude/desktop tauri build --debug --config src-tauri/tauri.e2e.conf.json",
+    "test:e2e:desktop": "pnpm --filter @maude/desktop-e2e e2e",
+    "test:e2e:desktop:git": "pnpm --filter @maude/desktop-e2e e2e:git",
+    "build": "pnpm -r --if-present --filter '!@maude/desktop' '!@maude/desktop-e2e' run build",
     "build:binary": "bun run apps/studio/build.ts --release",
     "test": "node --test --test-reporter=spec cli/**/*.test.mjs",
     "test:dev-server": "cd apps/studio && bun test",
@@ -40,16 +43,18 @@
     "video:render": "cd scripts/video/final && pnpm run render",
     "video:studio": "cd scripts/video/final && pnpm run studio",
     "postinstall": "node cli/install.cjs",
-    "prepublishOnly": "bash scripts/check-version-parity.sh && bash apps/studio/bin/check-runtime-bundles.sh"
+    "prepublishOnly": "bash scripts/check-version-parity.sh && bash apps/studio/bin/check-runtime-bundles.sh",
+    "test:e2e:desktop:lifecycle": "pnpm --filter @maude/desktop-e2e e2e:lifecycle",
+    "test:e2e:desktop:switchrepos": "pnpm --filter @maude/desktop-e2e e2e:switchrepos"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.35.0",
-    "@1agh/maude-darwin-x64": "0.35.0",
-    "@1agh/maude-linux-arm64": "0.35.0",
-    "@1agh/maude-linux-arm64-musl": "0.35.0",
-    "@1agh/maude-linux-x64": "0.35.0",
-    "@1agh/maude-linux-x64-musl": "0.35.0",
-    "@1agh/maude-win32-x64": "0.35.0"
+    "@1agh/maude-darwin-arm64": "0.36.1",
+    "@1agh/maude-darwin-x64": "0.36.1",
+    "@1agh/maude-linux-arm64": "0.36.1",
+    "@1agh/maude-linux-arm64-musl": "0.36.1",
+    "@1agh/maude-linux-x64": "0.36.1",
+    "@1agh/maude-linux-x64-musl": "0.36.1",
+    "@1agh/maude-win32-x64": "0.36.1"
   },
   "files": [
     "cli",