@1agh/maude 0.39.0 → 0.40.0

package/apps/studio/test/config-reload.test.ts

@@ -0,0 +1,230 @@
+// Config hot-reload — `/design:setup-ds` rewrites `.design/config.json`
+// mid-session; the server must re-read it so a newly added canvas group
+// (`system`) reaches /_index-data and scaffolded DS files show in the tree.
+// reloadConfig mutates ctx.cfg IN PLACE so every `const { cfg } = ctx`
+// capture sees the fresh values.
+// RCA: .ai/logs/rca/issue-ds-scaffold-files-not-in-filetree-stale-config.md
+
+import { describe, expect, test } from 'bun:test';
+import { mkdirSync, mkdtempSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { type Context, createBus, reloadConfig } from '../context.ts';
+
+/** The pre-scaffold e2e fixture shape — UI-only group, no design systems. */
+const BOOT_CONFIG = {
+  name: 'e2e-fixture',
+  designRoot: '.design',
+  canvasGroups: [{ label: 'UI kit', path: 'ui' }],
+  designSystems: [],
+};
+
+/** What /design:setup-ds writes: system group + DS entry + tokens path. */
+const SCAFFOLDED_CONFIG = {
+  ...BOOT_CONFIG,
+  tokensCssRel: 'system/kanban-glass/colors_and_type.css',
+  canvasGroups: [
+    { label: 'Design system', path: 'system' },
+    { label: 'UI kit', path: 'ui' },
+  ],
+  designSystems: [{ name: 'kanban-glass', path: 'system/kanban-glass' }],
+  defaultDesignSystem: 'kanban-glass',
+};
+
+function sandbox(): { root: string; designRoot: string } {
+  const root = mkdtempSync(join(tmpdir(), 'cfg-reload-test-'));
+  const designRoot = join(root, '.design');
+  mkdirSync(designRoot, { recursive: true });
+  writeFileSync(join(designRoot, 'config.json'), JSON.stringify(BOOT_CONFIG, null, 2));
+  return { root, designRoot };
+}
+
+/** Mirrors what createContext builds at boot from BOOT_CONFIG. */
+function mkCtx(root: string, designRoot: string): Context {
+  return {
+    cfg: {
+      name: 'e2e-fixture',
+      projectLabel: null,
+      designRoot: '.design',
+      canvasGroups: [{ label: 'UI kit', path: 'ui' }],
+      designSystems: [],
+      rootClass: 'app',
+      themeDefault: 'dark',
+      tokensCssRel: 'system/colors_and_type.css',
+      teamAccentDefault: null,
+      handoffTargets: [],
+      newCanvasDir: 'ui',
+      newComponentDir: 'ui/components',
+      _source: '.design/config.json',
+    },
+    projectLabel: 'e2e-fixture Design',
+    paths: {
+      repoRoot: root,
+      designRel: '.design',
+      designRoot,
+      serverInfoFile: join(designRoot, '_server.json'),
+      activeFile: join(designRoot, '_active.json'),
+      commentsDir: join(designRoot, '_comments'),
+      canvasStateDir: join(designRoot, '_canvas-state'),
+      historyDir: join(designRoot, '_history'),
+      tokensUrlRel: '.design/system/colors_and_type.css',
+      systemDirRel: 'system',
+    },
+    bus: createBus(),
+  };
+}
+
+describe('reloadConfig', () => {
+  test('a group added on disk reaches a boot-time captured cfg reference (the bug)', () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(root, designRoot);
+    // What every module factory holds: the object reference, captured at boot.
+    const captured = ctx.cfg;
+    try {
+      writeFileSync(join(designRoot, 'config.json'), JSON.stringify(SCAFFOLDED_CONFIG, null, 2));
+      expect(reloadConfig(ctx)).toBe(true);
+      // The capture sees the scaffolded groups — no restart needed.
+      expect(captured.canvasGroups.map((g) => g.path)).toEqual(['system', 'ui']);
+      expect(captured.designSystems?.[0]?.name).toBe('kanban-glass');
+      // normalizeDesignSystems runs on reload too (derived per-DS tokens path).
+      expect(captured.designSystems?.[0]?.tokensCssRel).toBe(
+        'system/kanban-glass/colors_and_type.css'
+      );
+      expect(captured.defaultDesignSystem).toBe('kanban-glass');
+      // Derived paths recompute in place.
+      expect(ctx.paths.tokensUrlRel).toBe('.design/system/kanban-glass/colors_and_type.css');
+      expect(ctx.paths.systemDirRel).toBe('system');
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('an unchanged config reports false (no spurious nudges)', () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(root, designRoot);
+    try {
+      reloadConfig(ctx); // sync ctx.cfg to the on-disk file once
+      expect(reloadConfig(ctx)).toBe(false);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('invalid JSON mid-edit keeps the running config', () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(root, designRoot);
+    try {
+      writeFileSync(join(designRoot, 'config.json'), '{ "name": "half-writ');
+      expect(reloadConfig(ctx)).toBe(false);
+      expect(ctx.cfg.name).toBe('e2e-fixture');
+      expect(ctx.cfg.canvasGroups.map((g) => g.path)).toEqual(['ui']);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('a deleted config keeps the running config (no downgrade to defaults)', () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(root, designRoot);
+    try {
+      unlinkSync(join(designRoot, 'config.json'));
+      expect(reloadConfig(ctx)).toBe(false);
+      expect(ctx.cfg.name).toBe('e2e-fixture');
+      expect(ctx.cfg._source).toBe('.design/config.json');
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('designRoot is not hot-reloadable — kept, rest of the change applies', () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(root, designRoot);
+    try {
+      writeFileSync(
+        join(designRoot, 'config.json'),
+        JSON.stringify({ ...BOOT_CONFIG, name: 'renamed', designRoot: 'designs' }, null, 2)
+      );
+      expect(reloadConfig(ctx)).toBe(true);
+      expect(ctx.cfg.name).toBe('renamed');
+      expect(ctx.cfg.designRoot).toBe('.design');
+      expect(ctx.paths.designRel).toBe('.design');
+      expect(ctx.projectLabel).toBe('renamed Design');
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('linkedHub is boot-pinned — a live add is ignored, the rest applies', () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(root, designRoot);
+    try {
+      writeFileSync(
+        join(designRoot, 'config.json'),
+        JSON.stringify(
+          {
+            ...BOOT_CONFIG,
+            name: 'renamed',
+            linkedHub: { url: 'wss://evil.example', linkedAt: 1, syncTsx: true },
+          },
+          null,
+          2
+        )
+      );
+      expect(reloadConfig(ctx)).toBe(true);
+      expect(ctx.cfg.name).toBe('renamed');
+      expect(ctx.cfg.linkedHub).toBeUndefined();
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('design-root escapes are clamped: bad group dropped, bad tokensCssRel reset', () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(root, designRoot);
+    try {
+      writeFileSync(
+        join(designRoot, 'config.json'),
+        JSON.stringify(
+          {
+            ...SCAFFOLDED_CONFIG,
+            tokensCssRel: '../../../etc/passwd',
+            canvasGroups: [
+              { label: 'Escape', path: '../..' },
+              { label: 'Abs', path: '/etc' },
+              { label: 'UI kit', path: 'ui' },
+            ],
+            designSystems: [
+              { name: 'evil', path: '../outside' },
+              { name: 'kanban-glass', path: 'system/kanban-glass' },
+            ],
+          },
+          null,
+          2
+        )
+      );
+      expect(reloadConfig(ctx)).toBe(true);
+      expect(ctx.cfg.canvasGroups.map((g) => g.path)).toEqual(['ui']);
+      expect(ctx.cfg.tokensCssRel).toBe('system/colors_and_type.css');
+      expect(ctx.cfg.designSystems?.map((d) => d.name)).toEqual(['kanban-glass']);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+
+  test('a config.json created after a defaults boot applies', () => {
+    const { root, designRoot } = sandbox();
+    const ctx = mkCtx(root, designRoot);
+    // Simulate a boot without config.json (createContext fell back to defaults).
+    unlinkSync(join(designRoot, 'config.json'));
+    ctx.cfg._source = 'defaults';
+    try {
+      writeFileSync(join(designRoot, 'config.json'), JSON.stringify(SCAFFOLDED_CONFIG, null, 2));
+      expect(reloadConfig(ctx)).toBe(true);
+      expect(ctx.cfg._source).toBe('.design/config.json');
+      expect(ctx.cfg.canvasGroups.map((g) => g.path)).toEqual(['system', 'ui']);
+    } finally {
+      rmSync(root, { recursive: true, force: true });
+    }
+  });
+});

package/apps/studio/test/dns-rebinding-guard.test.ts

@@ -0,0 +1,74 @@
+// DNS-rebinding guard on the main-origin source-write/read family.
+//
+// The dev-server binds 127.0.0.1, but `sameOriginWrite` is a *reflective* Origin
+// check — after a DNS-rebind (`evil.example → 127.0.0.1`) the browser sends
+// `Origin: http://evil.example:<port>` AND `Host: evil.example:<port>`, so both
+// sides of the origin comparison are attacker-controlled and equal → CSRF passes.
+// Every source-write/read route now also requires a loopback `Host` (the same
+// `isLoopbackHost` guard the /_api/git/* routes already carry). A real browser
+// always sends `Host: localhost|127.0.0.1:<port>` → passes; a rebound foreign
+// hostname → 403. Regression guard for the /flow:done DDR-150 attacker finding.
+
+import { describe, expect, test } from 'bun:test';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+describe('DNS-rebinding guard — source-write/read family requires a loopback Host', () => {
+  test('rebound Host 403s writes + reads; a loopback Host passes the guard', async () => {
+    const { root, designRoot } = makeSandbox();
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    writeFileSync(join(designRoot, 'ui', 'C.tsx'), 'export default function C(){return <main/>}\n');
+
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const base = `http://localhost:${port}`;
+      // A rebound page: its Host header is the attacker's rebound hostname.
+      const evilHost = `evil.example:${port}`;
+
+      // WRITE route (POST) — the loopback guard fires (before the op runs).
+      const wEvil = await fetch(`${base}/_api/toggle-hide`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', host: evilHost },
+        body: JSON.stringify({ canvas: 'ui/C.tsx', stableId: 'x' }),
+      });
+      expect(wEvil.status).toBe(403);
+
+      // A second write route, to prove it's the whole family, not one endpoint.
+      const wEvil2 = await fetch(`${base}/_api/edit-text`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', host: evilHost },
+        body: JSON.stringify({ canvas: 'ui/C.tsx', id: 'x', text: 'y' }),
+      });
+      expect(wEvil2.status).toBe(403);
+
+      // READ routes (GET) — a rebound same-origin page could otherwise CORS-read
+      // raw project source; the guard 403s them too.
+      const rEvil = await fetch(`${base}/_api/canvas-source?file=ui/C.tsx`, {
+        headers: { host: evilHost },
+      });
+      expect(rEvil.status).toBe(403);
+      const rEvil2 = await fetch(`${base}/_api/comp-clips?canvas=ui/C.tsx`, {
+        headers: { host: evilHost },
+      });
+      expect(rEvil2.status).toBe(403);
+
+      // A real browser (loopback Host) is NOT rejected by the rebind guard — the
+      // source read succeeds (200). Proves the guard doesn't false-positive on
+      // the legitimate local request every real user makes.
+      const rOk = await fetch(`${base}/_api/canvas-source?file=ui/C.tsx`, {
+        headers: { host: `localhost:${port}` },
+      });
+      expect(rOk.status).toBe(200);
+      // 127.0.0.1 Host is equally valid (the printed URL variant).
+      const rOk2 = await fetch(`${base}/_api/canvas-source?file=ui/C.tsx`, {
+        headers: { host: `127.0.0.1:${port}` },
+      });
+      expect(rOk2.status).toBe(200);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});

package/apps/studio/test/edit-persistence.test.ts

@@ -0,0 +1,91 @@
+// edit-persistence — DDR-148 dogfood. A CSS edit on a video-comp element must
+// survive into the RENDERED module, not just the optimistic DOM overlay — i.e.
+// source edit → build → the new value is in the compiled canvas the Player runs.
+// This end-to-end guard would have caught the original "my color reverts when
+// the video replays" bug (a trailing-comma insert produced `opacity: o, , color`
+// → the build FAILED → the Player kept rendering the OLD source).
+
+import { describe, expect, test } from 'bun:test';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { buildCanvasModule } from '../canvas-build.ts';
+import { applyEdit } from '../canvas-edit.ts';
+import { transpileCanvasSource } from '../canvas-pipeline.ts';
+
+const CANVAS = '/tmp/edit-persist.tsx';
+
+/** buildCanvasModule needs the entrypoint on disk — write the source, then build. */
+async function buildAt(source: string) {
+  const dir = mkdtempSync(join(tmpdir(), 'edit-persist-'));
+  const abs = join(dir, 'Comp.tsx');
+  writeFileSync(abs, source);
+  return buildCanvasModule(abs, source);
+}
+
+// A frame-driven letter span (the exact shape from the intro demo): computed
+// transform/opacity + a trailing comma on the last property.
+const COMP = `import { AbsoluteFill, interpolate, useCurrentFrame } from 'remotion';
+export default function Comp() {
+  const frame = useCurrentFrame();
+  const y = interpolate(frame, [0, 20], [40, 0]);
+  const o = interpolate(frame, [0, 20], [0, 1]);
+  return (
+    <AbsoluteFill>
+      <span
+        style={{
+          fontSize: 132,
+          fontWeight: 800,
+          transform: \`translateY(\${y}px)\`,
+          opacity: o,
+          color: '#f0ece5',
+        }}
+      >
+        maude
+      </span>
+    </AbsoluteFill>
+  );
+}
+`;
+
+function spanId(source: string): string {
+  const { withIds } = transpileCanvasSource(CANVAS, source);
+  const m = withIds.match(/<span[^>]*?data-cd-id="([0-9a-f]{8})"/);
+  if (!m) throw new Error('no span id');
+  return m[1] as string;
+}
+
+describe('edit-persistence — a CSS edit survives into the built module', () => {
+  test('SWAP an existing color → the new color is in the compiled canvas', async () => {
+    const id = spanId(COMP);
+    const edited = applyEdit(CANVAS, COMP, id, 'style.color', "'#ff0000'").source;
+    expect(edited).toContain("color: '#ff0000'");
+    // The value the Player actually renders is the BUILT module — assert it there.
+    const built = await buildAt(edited);
+    expect(built.js).toContain('#ff0000');
+    expect(built.js).not.toContain('#f0ece5'); // old value fully replaced
+  });
+
+  test('INSERT a new prop next to a TRAILING comma → still builds + renders (the bug)', async () => {
+    const id = spanId(COMP);
+    // Insert a brand-new property where the last one (color) ends with a comma.
+    const edited = applyEdit(CANVAS, COMP, id, 'style.letterSpacing', "'-0.04em'").source;
+    expect(edited).not.toMatch(/,\s*,/); // NO double comma (the crash that reverted the render)
+    const built = await buildAt(edited); // must not throw
+    expect(built.js).toContain('-0.04em');
+    expect(built.js).toContain('#f0ece5'); // untouched props survive
+  });
+
+  test('a SEQUENCE of edits all persist (no edit clobbers a prior one)', async () => {
+    let src = COMP;
+    const id = spanId(src);
+    src = applyEdit(CANVAS, src, id, 'style.color', "'#00ff00'").source;
+    src = applyEdit(CANVAS, src, id, 'style.fontWeight', '900').source;
+    src = applyEdit(CANVAS, src, id, 'style.fontSize', '148').source;
+    const built = await buildAt(src);
+    expect(built.js).toContain('#00ff00');
+    expect(built.js).toContain('148');
+    // the frame-driven values must still be present (edits never touched them)
+    expect(built.js).toContain('translateY');
+  });
+});

package/apps/studio/test/exporters/runtime.test.ts

@@ -0,0 +1,59 @@
+// Regression tests for exporters/_runtime.ts — the shared shim-path + runtime
+// resolver behind the desktop-export fix (RCA issue-desktop-export-failures).
+//
+// Guards the two defects the render exporters shipped with:
+//   1. shim paths must derive from DEV_SERVER_ROOT (paths.ts), NEVER a virtual
+//      `/$bunfs/root` (DDR-045).
+//   2. the JS runtime must be resolved (not a hardcoded `'node'`), with an
+//      actionable throw when none is on PATH.
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import { EXPORT_SHIM_DIR, exportShimPath, resolveExportRuntime } from '../../exporters/_runtime.ts';
+import { DEV_SERVER_ROOT } from '../../paths.ts';
+
+const ORIGINAL_PATH = process.env.PATH;
+const ORIGINAL_RUNTIME = process.env.MAUDE_EXPORT_RUNTIME;
+
+afterEach(() => {
+  // Restore any env mutated by a test (each bun:test file is its own process,
+  // but tests within it share env — keep them isolated).
+  if (ORIGINAL_PATH === undefined) delete process.env.PATH;
+  else process.env.PATH = ORIGINAL_PATH;
+  if (ORIGINAL_RUNTIME === undefined) delete process.env.MAUDE_EXPORT_RUNTIME;
+  else process.env.MAUDE_EXPORT_RUNTIME = ORIGINAL_RUNTIME;
+});
+
+describe('exporters/_runtime — shim paths (DDR-045)', () => {
+  test('EXPORT_SHIM_DIR is <DEV_SERVER_ROOT>/bin and never virtual /$bunfs', () => {
+    expect(EXPORT_SHIM_DIR).toBe(`${DEV_SERVER_ROOT}/bin`);
+    expect(EXPORT_SHIM_DIR).not.toContain('$bunfs');
+    expect(EXPORT_SHIM_DIR).not.toContain('~BUN');
+  });
+
+  test('exportShimPath resolves a real disk path under the shim dir', () => {
+    const p = exportShimPath('_png-playwright.mjs');
+    expect(p).toBe(`${DEV_SERVER_ROOT}/bin/_png-playwright.mjs`);
+    expect(p).not.toContain('$bunfs');
+  });
+});
+
+describe('exporters/_runtime — runtime ladder', () => {
+  test('honors the MAUDE_EXPORT_RUNTIME override', () => {
+    process.env.MAUDE_EXPORT_RUNTIME = '/opt/custom/bin/node';
+    expect(resolveExportRuntime()).toBe('/opt/custom/bin/node');
+  });
+
+  test('resolves an on-PATH runtime when no override is set', () => {
+    delete process.env.MAUDE_EXPORT_RUNTIME;
+    // The test host has bun (and usually node) on PATH → a truthy absolute path.
+    const runtime = resolveExportRuntime();
+    expect(runtime).toBeTruthy();
+    expect(runtime).not.toBe('node'); // resolved to an absolute path, not the bare name
+  });
+
+  test('throws an actionable error when no node/bun runtime is reachable', () => {
+    delete process.env.MAUDE_EXPORT_RUNTIME;
+    process.env.PATH = '/nonexistent-maude-export-runtime-probe';
+    expect(() => resolveExportRuntime()).toThrow(/render export needs a JS runtime/i);
+  });
+});

package/apps/studio/test/file-lock.test.ts

@@ -0,0 +1,84 @@
+// file-lock.test.ts — DDR-150 P2. The cross-process advisory lock that closes
+// the race the in-process mutex couldn't see: the HTTP server, the /design:edit
+// CLI, and the HMR watcher all editing the same comp file. Verifies mutual
+// exclusion across "processes" (concurrent acquirers), stale-lock stealing (a
+// crashed holder), and that an edit through the integrated withLock cleans up.
+
+import { describe, expect, test } from 'bun:test';
+import { utimes } from 'node:fs/promises';
+
+import { acquireFileLock, editAttribute, lockPathFor } from '../canvas-edit.ts';
+import { transpileCanvasSource } from '../canvas-pipeline.ts';
+
+const tmp = (tag: string) => `/tmp/maude-lock-${tag}-${Math.random().toString(36).slice(2)}.tsx`;
+
+describe('acquireFileLock', () => {
+  test('acquires + releases; release is idempotent', async () => {
+    const f = tmp('basic');
+    const rel = await acquireFileLock(f);
+    expect(await Bun.file(lockPathFor(f)).exists()).toBe(true);
+    await rel();
+    expect(await Bun.file(lockPathFor(f)).exists()).toBe(false);
+    await rel(); // second release is a no-op, never throws
+  });
+
+  test('serialises a second (cross-process) contender until the first releases', async () => {
+    const f = tmp('contend');
+    const relA = await acquireFileLock(f);
+    let bAcquired = false;
+    const bPromise = acquireFileLock(f).then((rel) => {
+      bAcquired = true;
+      return rel;
+    });
+    // While A holds the lock, B must be blocked (it's polling the lockfile).
+    await new Promise((r) => setTimeout(r, 80));
+    expect(bAcquired).toBe(false);
+    await relA();
+    const relB = await bPromise; // B now wins the lock
+    expect(bAcquired).toBe(true);
+    await relB();
+    expect(await Bun.file(lockPathFor(f)).exists()).toBe(false);
+  });
+
+  test('steals a STALE lock (holder crashed) instead of waiting forever', async () => {
+    const f = tmp('stale');
+    const lp = lockPathFor(f);
+    await Bun.write(lp, '99999 0'); // a "held" lock from a dead pid
+    const old = new Date(Date.now() - 60_000); // mtime 60s ago (> LOCK_STALE_MS)
+    await utimes(lp, old, old);
+    const start = Date.now();
+    const rel = await acquireFileLock(f); // must steal it, not block
+    expect(Date.now() - start).toBeLessThan(2000);
+    await rel();
+  });
+});
+
+describe('withLock integration', () => {
+  test('an edit acquires + cleans up the cross-process lock', async () => {
+    const f = tmp('edit');
+    const src = 'function Demo() { return <div className="x">y</div>; }';
+    await Bun.write(f, src);
+    const { withIds } = transpileCanvasSource(f, src);
+    const id = withIds.match(/data-cd-id="([0-9a-f]{8})"/)?.[1] as string;
+    const r = await editAttribute(f, id, 'className', 'edited');
+    expect(r.changed).toBe(true);
+    expect(await Bun.file(f).text()).toContain('className="edited"');
+    // The lockfile must be released after the edit — not left dangling.
+    expect(await Bun.file(lockPathFor(f)).exists()).toBe(false);
+  });
+
+  test('concurrent edits to the same file both land (serialised, no lost write)', async () => {
+    const f = tmp('concurrent');
+    const src = 'function Demo() { return <div className="x" title="t">y</div>; }';
+    await Bun.write(f, src);
+    const { withIds } = transpileCanvasSource(f, src);
+    const id = withIds.match(/data-cd-id="([0-9a-f]{8})"/)?.[1] as string;
+    await Promise.all([
+      editAttribute(f, id, 'className', 'cls-A'),
+      editAttribute(f, id, 'title', 'title-B'),
+    ]);
+    const out = await Bun.file(f).text();
+    expect(out).toContain('cls-A');
+    expect(out).toContain('title-B'); // neither edit clobbered the other
+  });
+});

package/apps/studio/test/fixtures/mock-acp-agent.mjs

@@ -5,6 +5,16 @@
 // `agent_message_chunk` whose text echoes whether ANTHROPIC_API_KEY survived
 // into the child env — it MUST read `<unset>`, proving scrubAgentEnv (DDR-123
 // guardrail #1) stripped it before spawn.
+//
+// session/load simulates the REAL adapter's cross-restart resume (this is a
+// fresh subprocess per test, so it has no memory of a prior session/new call —
+// exactly like the real claude-agent-acp adapter after an app restart, whose
+// resume is backed by the underlying `claude` CLI's own on-disk store, not its
+// own process memory). Any sessionId resolves EXCEPT the `not-found` sentinel
+// (simulates a pruned/unresumable session), so a test controls resume
+// success/failure by choosing which id it persists. It also emits one replay
+// `session/update` BEFORE resolving, mirroring claude-agent-acp's
+// `replaySessionHistory` — bridge.ts must not forward or re-transcript it.
 
 import { Readable, Writable } from 'node:stream';
 
@@ -16,7 +26,7 @@ acp
   .agent({ name: 'mock-acp-agent' })
   .onRequest('initialize', () => ({
     protocolVersion: acp.PROTOCOL_VERSION,
-    agentCapabilities: { loadSession: false },
+    agentCapabilities: { loadSession: true },
   }))
   .onRequest(
     'session/new',
@@ -25,6 +35,19 @@ acp
       return () => ({ sessionId: `mock-session-${++n}` });
     })()
   )
+  .onRequest('session/load', async (ctx) => {
+    if (ctx.params.sessionId === 'not-found') {
+      throw new Error('session not found');
+    }
+    await ctx.client.notify('session/update', {
+      sessionId: ctx.params.sessionId,
+      update: {
+        sessionUpdate: 'agent_message_chunk',
+        content: { type: 'text', text: 'REPLAYED-HISTORY-SHOULD-NOT-SURFACE' },
+      },
+    });
+    return {};
+  })
   .onRequest('session/prompt', async (ctx) => {
     // The per-request handler context exposes the client connection at `.client`.
     await ctx.client.notify('session/update', {

package/apps/studio/test/fixtures/video-comp-fixture.tsx

@@ -0,0 +1,82 @@
+// video-comp-fixture.tsx — DDR-148 canonical video-comp fixture.
+//
+// A reusable comp exercising the full authoring vocabulary: a frame-driven
+// animated title, two "clips" joined by a crossfade in a <TransitionSeries>,
+// and a music-bed <Audio> with a volume envelope. Used by:
+//   • video-comp-fixture.test.ts — builds it through the real canvas pipeline
+//     (buildCanvasModule) and asserts remotion / @remotion/transitions stay
+//     external + <VideoComp> is present (CI-safe, no browser).
+//   • the live E2E sweep (drop → scrub → export) as a stable target.
+//
+// Deterministic BY CONSTRUCTION — every value is a pure function of the frame.
+
+import { DCArtboard, DCSection, DesignCanvas, VideoComp } from '@maude/canvas-lib';
+import { linearTiming, TransitionSeries } from '@remotion/transitions';
+import { fade } from '@remotion/transitions/fade';
+import { AbsoluteFill, Audio, interpolate, useCurrentFrame } from 'remotion';
+
+const CLIP = 45;
+const XF = 15;
+const TOTAL = 2 * CLIP - XF; // two clips + one crossfade
+
+const Beat = ({ label, bg }: { label: string; bg: string }) => {
+  const frame = useCurrentFrame();
+  const y = interpolate(frame, [0, 14], [24, 0], { extrapolateRight: 'clamp' });
+  const opacity = interpolate(frame, [0, 14], [0, 1], { extrapolateRight: 'clamp' });
+  return (
+    <AbsoluteFill
+      style={{
+        background: bg,
+        color: '#fff',
+        alignItems: 'center',
+        justifyContent: 'center',
+        fontFamily: 'system-ui, sans-serif',
+        fontSize: 72,
+        fontWeight: 800,
+      }}
+    >
+      <div style={{ transform: `translateY(${y}px)`, opacity }}>{label}</div>
+    </AbsoluteFill>
+  );
+};
+
+function Fixture() {
+  return (
+    <AbsoluteFill>
+      <TransitionSeries>
+        <TransitionSeries.Sequence durationInFrames={CLIP}>
+          <Beat label="MAUDE" bg="#0f172a" />
+        </TransitionSeries.Sequence>
+        <TransitionSeries.Transition
+          presentation={fade()}
+          timing={linearTiming({ durationInFrames: XF })}
+        />
+        <TransitionSeries.Sequence durationInFrames={CLIP}>
+          <Beat label="VIDEO" bg="#7c2d12" />
+        </TransitionSeries.Sequence>
+      </TransitionSeries>
+      <Audio
+        src="assets/music.mp3"
+        volume={(f) => interpolate(f, [TOTAL - 15, TOTAL], [0.7, 0], { extrapolateLeft: 'clamp' })}
+      />
+    </AbsoluteFill>
+  );
+}
+
+export default function Canvas() {
+  return (
+    <DesignCanvas>
+      <DCSection title="Video-comp fixture">
+        <DCArtboard id="fixture" label="Fixture" width={640} height={360}>
+          <VideoComp
+            component={Fixture}
+            durationInFrames={TOTAL}
+            fps={30}
+            width={640}
+            height={360}
+          />
+        </DCArtboard>
+      </DCSection>
+    </DesignCanvas>
+  );
+}