@1agh/maude 0.38.1 → 0.39.0

package/apps/studio/http.ts

@@ -658,10 +658,30 @@ export function createHttp(ctx: Context, api: Api, inspect: Inspect, ai: AiActiv
     // Phase 31 follow-up — persist an image pasted straight into the ACP composer
     // (a clipboard screenshot has no path), returning an absolute path the chip
     // expands to so Claude can Read it. MAIN-ORIGIN ONLY: sameOriginWrite CSRF gate
-    // + deliberately absent from CANVAS_SAFE_API + startCanvasServer routes, so the
-    // untrusted canvas iframe is 403'd. The disk caps live in api.saveChatAttachment
-    // (magic-byte sniff / 10 MB / content-addressed name / session write budget).
+    // on POST + deliberately absent from CANVAS_SAFE_API + startCanvasServer routes,
+    // so the untrusted canvas iframe is 403'd. The disk caps live in
+    // api.saveChatAttachment (magic-byte sniff / 10 MB / content-addressed name /
+    // session write budget).
+    //
+    // GET ?name=<sha8>.<ext> serves the pasted image back to the chat feed
+    // (thumbnail + lightbox). The name is regex-allowlisted in
+    // api.resolveChatAttachment — content-addressed, never a caller path, so
+    // traversal-proof by construction; content-addressed ⇒ immutable cache. No
+    // CSRF gate on GET (sameOriginWrite is the POST/CSRF boundary) — the
+    // main-origin posture above is what keeps the canvas origin out.
     '/_api/acp/attachment': async (req: Request) => {
+      if (req.method === 'GET') {
+        const name = new URL(req.url).searchParams.get('name');
+        const abs = await api.resolveChatAttachment(name);
+        if (!abs) return new Response('Not found', { status: 404 });
+        return serveFile(abs, {
+          'Cache-Control': 'public, max-age=31536000, immutable',
+          // Uploaded bytes on the privileged main origin — never let the browser
+          // MIME-sniff a polyglot into a richer type (mirrors the DDR-088 static
+          // lane; the sniff/allowlist on write is the primary gate).
+          'X-Content-Type-Options': 'nosniff',
+        });
+      }
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });

package/apps/studio/test/acp-attachment-serve.test.ts

@@ -0,0 +1,74 @@
+// GET /_api/acp/attachment — the content-addressed serve route behind the ACP
+// chat image thumbnails + lightbox. The name is the ONLY input and must match
+// our own `<sha8>.<ext>` shape (api.resolveChatAttachment) — traversal-proof by
+// construction, so these tests pin the allowlist: a real uploaded attachment
+// serves 200 with an image content-type + immutable cache; every malformed /
+// hostile name 404s; non-GET/POST methods 405. The canvas-origin 403 lives in
+// canvas-origin-gate.test.ts (dual-allowlist invariant, DDR-054/DDR-088).
+
+import { describe, expect, test } from 'bun:test';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+// Minimal valid PNG magic bytes, padded so length checks pass (asset-api idiom).
+const pad = (header: number[], len = 64): Uint8Array => {
+  const out = new Uint8Array(len);
+  out.set(header, 0);
+  return out;
+};
+const PNG = pad([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
+
+describe('acp-attachment-serve / GET /_api/acp/attachment', () => {
+  test('serves an uploaded attachment by name; rejects hostile names; gates methods', async () => {
+    const sandbox = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(sandbox.root, port);
+    const base = `http://localhost:${port}/_api/acp/attachment`;
+    try {
+      // Write side first — the serve route only ever serves what saveChatAttachment
+      // itself named (content-addressed <sha8>.<ext>).
+      const post = await fetch(base, {
+        method: 'POST',
+        headers: { 'Content-Type': 'image/png' },
+        body: PNG,
+      });
+      expect(post.status).toBe(201);
+      const { path: absPath } = (await post.json()) as { path: string };
+      const name = absPath.split('/').pop() as string;
+      expect(name).toMatch(/^[0-9a-f]{8}\.png$/);
+
+      // Happy path — 200, image content-type, immutable cache (content-addressed).
+      const ok = await fetch(`${base}?name=${name}`);
+      expect(ok.status).toBe(200);
+      expect(ok.headers.get('content-type')).toBe('image/png');
+      expect(ok.headers.get('cache-control')).toContain('immutable');
+      expect(new Uint8Array(await ok.arrayBuffer())).toEqual(PNG);
+
+      // Name allowlist — anything that is not our own <sha8>.(png|jpe?g|gif|webp)
+      // shape must 404 (never resolved against the filesystem).
+      for (const bad of [
+        '../../etc/passwd',
+        '..%2f..%2fetc%2fpasswd',
+        `/etc/passwd`,
+        'abc',
+        'deadbeef.svg', // SVG is never written — scriptable, stays unservable
+        'deadbeef.png.svg',
+        'DEADBEEF.png', // uppercase hex — writer emits lowercase only
+        'deadbeef1.png', // 9 hex chars
+        `_chat/attachments/${name}`,
+      ]) {
+        const res = await fetch(`${base}?name=${encodeURIComponent(bad)}`);
+        expect(res.status).toBe(404);
+      }
+      // Missing name / valid-shaped but nonexistent file → 404 too.
+      expect((await fetch(base)).status).toBe(404);
+      expect((await fetch(`${base}?name=00000000.png`)).status).toBe(404);
+
+      // Method gate — only GET (serve) + POST (upload) exist.
+      expect((await fetch(base, { method: 'DELETE' })).status).toBe(405);
+      expect((await fetch(base, { method: 'PUT' })).status).toBe(405);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});

package/apps/studio/test/acp-origin-gate.test.ts

@@ -101,9 +101,11 @@ describe('ACP bridge origin gate', () => {
       expect(crossOrigin.status).toBe(403);
 
       // (6) Phase 31 follow-up — /_api/acp/attachment (clipboard-image paste):
-      // POST-only, main-origin only. A valid PNG → 201 with an absolute path under
-      // the runtime _chat/attachments/; GET is 405; the canvas origin + a
-      // cross-origin drive-by POST are 403.
+      // main-origin only. A valid PNG → 201 with an absolute path under the
+      // runtime _chat/attachments/; GET (the thumbnail serve branch) 404s
+      // without a valid content-addressed name — full serve coverage lives in
+      // acp-attachment-serve.test.ts; the canvas origin + a cross-origin
+      // drive-by POST are 403.
       const png = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0]);
       const up = await fetch(`${main}/_api/acp/attachment`, {
         method: 'POST',
@@ -115,7 +117,7 @@ describe('ACP bridge origin gate', () => {
       const upJson = await up.json();
       expect(typeof upJson.path).toBe('string');
       expect(upJson.path).toContain('_chat/attachments/');
-      expect(await status(main, '/_api/acp/attachment')).toBe(405); // GET not allowed
+      expect(await status(main, '/_api/acp/attachment')).toBe(404); // GET without a name → 404
       expect(await status(canvas, '/_api/acp/attachment')).toBe(403); // off the canvas origin
       const attDriveBy = await fetch(`${main}/_api/acp/attachment`, {
         method: 'POST',

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -114,6 +114,11 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         // the untrusted canvas origin must never reach it (it writes the global
         // ~/.config/maude/hubs.json token store).
         '/_api/hub/link',
+        // ACP chat attachments (POST upload + GET thumbnail serve) are MAIN-ORIGIN
+        // ONLY — absent from CANVAS_SAFE_API + startCanvasServer's routes. The
+        // untrusted canvas origin must never read (or write) the user's pasted
+        // chat images; a GET here 403s at the gate, not 404 from the handler.
+        '/_api/acp/attachment',
         '/package.json',
       ]) {
         expect(await code(p)).toBe(403);

package/apps/studio/test/chat-attachments.test.ts

@@ -0,0 +1,117 @@
+// ACP chat image thumbnails — the pure ref helpers behind the two render paths:
+// a LIVE user bubble carries the collapsed chip token ([image-1]), a RELOADED
+// bubble (transcript) carries the expanded absolute `_chat/attachments/` path.
+// Both must resolve to the same content-addressed `<sha8>.<ext>` name the GET
+// serve route accepts — and nothing else may match (a random project path must
+// never render as a thumbnail).
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  attachmentName,
+  designImageRefs,
+  extractAttachmentRefs,
+} from '../client/panels/acp-runtime.js';
+
+const ABS = '/Users/x/proj/.design/_chat/attachments/ab12cd34.png';
+
+describe('chat-attachments / attachmentName', () => {
+  test('extracts the content-addressed basename from attachment paths', () => {
+    expect(attachmentName(ABS)).toBe('ab12cd34.png');
+    expect(attachmentName('_chat/attachments/00ff00ff.webp')).toBe('00ff00ff.webp');
+    expect(attachmentName(`  ${ABS}  `)).toBe('ab12cd34.png'); // trimmed
+    expect(attachmentName('/x/_chat/attachments/deadbeef.jpeg')).toBe('deadbeef.jpeg');
+  });
+
+  test('rejects everything that is not a servable attachment path', () => {
+    expect(attachmentName('/Users/x/proj/assets/ab12cd34.png')).toBeNull(); // wrong dir
+    expect(attachmentName('/x/_chat/attachments/ab12cd34.svg')).toBeNull(); // never served
+    expect(attachmentName('/x/_chat/attachments/AB12CD34.png')).toBeNull(); // uppercase hex
+    expect(attachmentName('/x/_chat/attachments/abc.png')).toBeNull(); // short hash
+    expect(attachmentName(`${ABS}/../secret.png`)).toBeNull(); // trailing junk
+    expect(attachmentName('')).toBeNull();
+    expect(attachmentName(null)).toBeNull();
+  });
+});
+
+describe('chat-attachments / extractAttachmentRefs', () => {
+  test('chip-only string (live bubble)', () => {
+    expect(extractAttachmentRefs('[image-1]')).toEqual([
+      { type: 'chip', token: '[image-1]', kind: 'image' },
+    ]);
+  });
+
+  test('expanded absolute path (reloaded bubble) — path never leaks as text', () => {
+    expect(extractAttachmentRefs(`look at ${ABS}`)).toEqual([
+      { type: 'text', text: 'look at ' },
+      { type: 'attachment', name: 'ab12cd34.png', raw: ABS },
+    ]);
+  });
+
+  test('mixed text, multiple ref kinds, order preserved', () => {
+    const segs = extractAttachmentRefs(`fix [image-2] and [file-1] then ${ABS} done`);
+    expect(segs).toEqual([
+      { type: 'text', text: 'fix ' },
+      { type: 'chip', token: '[image-2]', kind: 'image' },
+      { type: 'text', text: ' and ' },
+      { type: 'chip', token: '[file-1]', kind: 'file' },
+      { type: 'text', text: ' then ' },
+      { type: 'attachment', name: 'ab12cd34.png', raw: ABS },
+      { type: 'text', text: ' done' },
+    ]);
+  });
+
+  test('non-attachment paths and near-miss tokens stay plain text', () => {
+    expect(extractAttachmentRefs('/Users/x/proj/assets/ab12cd34.png')).toEqual([
+      { type: 'text', text: '/Users/x/proj/assets/ab12cd34.png' },
+    ]);
+    expect(extractAttachmentRefs('[image-x] [screenshot-1]')).toEqual([
+      { type: 'text', text: '[image-x] [screenshot-1]' },
+    ]);
+    expect(extractAttachmentRefs('')).toEqual([]);
+  });
+});
+
+describe('chat-attachments / designImageRefs (assistant-mentioned images — DDR-145)', () => {
+  test('the /design:screenshot reply shape — backticked relative path', () => {
+    expect(
+      designImageRefs('Saved to: `.design/_history/.design-ui-smoke/screenshots/001-smoke.png`')
+    ).toEqual(['/.design/_history/.design-ui-smoke/screenshots/001-smoke.png']);
+  });
+
+  test('absolute path is clamped to the designRel-relative URL', () => {
+    expect(designImageRefs('see /Users/x/proj/.design/exports/hero.png done')).toEqual([
+      '/.design/exports/hero.png',
+    ]);
+  });
+
+  test('custom designRel + trailing punctuation + dedup + cap', () => {
+    expect(designImageRefs('wrote mocks/a.png.', 'mocks')).toEqual(['/mocks/a.png']);
+    expect(designImageRefs('x .design/a.png and .design/a.png again')).toEqual(['/.design/a.png']);
+    const many = Array.from({ length: 9 }, (_, i) => `.design/s/${i}0000000.png`).join(' ');
+    expect(designImageRefs(many)).toHaveLength(6);
+  });
+
+  test('never matches outside designRel, non-images, SVG, or lookalike dirs', () => {
+    expect(designImageRefs('site/public/logo.png')).toEqual([]);
+    expect(designImageRefs('.design/ui/Canvas.tsx')).toEqual([]);
+    expect(designImageRefs('.design/assets/mark.svg')).toEqual([]); // scriptable — excluded
+    expect(designImageRefs('not-.design/a.png')).toEqual([]); // prefix must be a path segment
+    expect(designImageRefs('', undefined)).toEqual([]);
+  });
+
+  test('traversal is rejected before it can escape designRel (DDR-145 A9 fix)', () => {
+    // A `..` dot-segment would collapse to /etc/x.png in the browser.
+    expect(designImageRefs('.design/../../etc/secret.png')).toEqual([]);
+    expect(designImageRefs('.design/../.git/config.png')).toEqual([]);
+    // Percent-encoding would decode past <rel>/ server-side — reject any `%`.
+    expect(designImageRefs('.design/..%2f..%2fsecrets/cam.png')).toEqual([]);
+    expect(designImageRefs('.design/%2e%2e/x.png')).toEqual([]);
+    // Backslash: WHATWG rewrites `\`→`/` for http(s), so `..\..\` would climb out
+    // AFTER a naive guard — the canonical-form allowlist catches it (attacker F).
+    expect(designImageRefs('.design/..\\..\\secret.png')).toEqual([]);
+    expect(designImageRefs('.design/a\\..\\..\\x.png')).toEqual([]);
+    // A legit path that merely CONTAINS "dotdot"-ish text (not a segment) is fine.
+    expect(designImageRefs('.design/a..b/hero.png')).toEqual(['/.design/a..b/hero.png']);
+  });
+});

package/apps/studio/whats-new.json

@@ -1,6 +1,15 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "acp-chat-image-thumbnails",
+      "version": "0.39.0",
+      "date": "2026-07-03",
+      "kind": "feature",
+      "title": "See images right in the chat",
+      "summary": "Images now show up as thumbnails in the Assistant panel — paste a screenshot into the box and it appears in your message, and when Claude points to an image it made (like a /design:screenshot capture) that shows up too. Click any thumbnail to open it full-size in a lightbox.",
+      "surface": "design-ui"
+    },
     {
       "id": "acp-context-hardening",
       "version": "0.38.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.38.1",
+  "version": "0.39.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -50,13 +50,13 @@
     "test:e2e:desktop:onboarding": "pnpm --filter @maude/desktop-e2e e2e:onboarding"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.38.1",
-    "@1agh/maude-darwin-x64": "0.38.1",
-    "@1agh/maude-linux-arm64": "0.38.1",
-    "@1agh/maude-linux-arm64-musl": "0.38.1",
-    "@1agh/maude-linux-x64": "0.38.1",
-    "@1agh/maude-linux-x64-musl": "0.38.1",
-    "@1agh/maude-win32-x64": "0.38.1"
+    "@1agh/maude-darwin-arm64": "0.39.0",
+    "@1agh/maude-darwin-x64": "0.39.0",
+    "@1agh/maude-linux-arm64": "0.39.0",
+    "@1agh/maude-linux-arm64-musl": "0.39.0",
+    "@1agh/maude-linux-x64": "0.39.0",
+    "@1agh/maude-linux-x64-musl": "0.39.0",
+    "@1agh/maude-win32-x64": "0.39.0"
   },
   "files": [
     "cli",