@1agh/maude 0.42.0 → 0.44.0

package/apps/studio/test/git-branches.test.ts

@@ -14,6 +14,8 @@ import {
   gitFetchRemote,
   gitFoldDraft,
   gitListBranches,
+  gitPull,
+  gitPush,
   remoteAheadBehind,
 } from '../git/service.ts';
 
@@ -111,6 +113,30 @@ test('fold: merges the draft into the Shared version locally; a tokenless publis
   expect((await gitListBranches(dir)).some((b) => b.name === 'nav')).toBe(true);
 });
 
+test('fold: a GitHub remote takes the PR path — pushes the draft, never locally merges main (DDR-162)', async () => {
+  // isGitHubRemote(github.com) → PR flow: publish the DRAFT branch (fails here — no
+  // real access) and NEVER merge/modify the local Shared version. `false` as the ssh
+  // command fails the transport instantly, so there's no network to github.com.
+  const prevSsh = process.env.GIT_SSH_COMMAND;
+  process.env.GIT_SSH_COMMAND = 'false';
+  const shared = (await gitListBranches(dir)).find((b) => b.current)?.name as string;
+  sh(['remote', 'add', 'origin', 'git@github.com:fake-org/fake-repo.git']);
+  await gitCreateBranch(dir, 'nav'); // now on 'nav'
+  writeFileSync(join(dir, 'b.txt'), 'draft work\n');
+  sh(['add', '.']);
+  sh(['commit', '-q', '-m', 'draft work']);
+  const r = await gitFoldDraft(dir, 'nav', undefined, {});
+  process.env.GIT_SSH_COMMAND = prevSsh ?? '';
+  // The draft push failed (fake repo) → not ok, and NOT the iso transport error…
+  expect(r.ok).toBe(false);
+  expect(r.error || '').not.toMatch(/unrecognized transport/i);
+  // …but crucially the Shared version was NEVER locally merged/modified…
+  sh(['checkout', shared]);
+  expect(existsSync(join(dir, 'b.txt'))).toBe(false);
+  // …and the draft still exists (nothing destroyed on a failed publish).
+  expect((await gitListBranches(dir)).some((b) => b.name === 'nav')).toBe(true);
+});
+
 // ── remote drafts (phase: surface remote branches) ───────────────────────────
 
 /** Stand up a bare "remote" with main + a teammate draft, clone it locally (system
@@ -197,6 +223,77 @@ test('an ssh remote routes to system git, never the iso transport error', async
   expect(r.error || '').not.toMatch(/unrecognized transport/i); // didn't fall into iso
 });
 
+// ── publish / get-latest over ssh (DDR-131/DDR-133 parity — the gap that shipped) ──
+// gitFetchRemote was hardened for ssh; gitPush/gitPull historically routed on the
+// USE_SYSTEM_GIT env flag only (default off) and fell into iso → "unrecognized
+// transport protocol: ssh". These prove the write paths now take the same gate.
+
+test('gitPush: an ssh remote routes to system git, never the iso transport error', async () => {
+  process.env.GIT_SSH_COMMAND =
+    'ssh -o BatchMode=yes -o ConnectTimeout=2 -o StrictHostKeyChecking=no';
+  sh(['remote', 'add', 'origin', 'git@nonexistent.invalid:team/app.git']);
+  const r = await gitPush(dir, undefined, {});
+  process.env.GIT_SSH_COMMAND = '';
+  expect(r.ok).toBe(false);
+  expect(r.authRequired).toBeFalsy(); // an ssh failure is not a GitHub sign-in prompt
+  expect(r.error || '').not.toMatch(/unrecognized transport/i); // didn't fall into iso
+});
+
+test('gitPull: an ssh remote routes to system git, never the iso transport error', async () => {
+  process.env.GIT_SSH_COMMAND =
+    'ssh -o BatchMode=yes -o ConnectTimeout=2 -o StrictHostKeyChecking=no';
+  sh(['remote', 'add', 'origin', 'git@nonexistent.invalid:team/app.git']);
+  const r = await gitPull(dir, undefined, {});
+  process.env.GIT_SSH_COMMAND = '';
+  expect(r.ok).toBe(false);
+  expect(r.authRequired).toBeFalsy();
+  expect(r.error || '').not.toMatch(/unrecognized transport/i);
+});
+
+test('SECURITY: gitPush refuses an unsafe (ext::) remote — no spawn, no RCE', async () => {
+  // A poisoned .git/config remote — must be refused BEFORE any git spawn (the payload
+  // never runs); classifyRemoteUrl reads the url via iso getConfig, not the git binary.
+  const sentinel = join(dir, 'PWNED_PUSH');
+  sh(['remote', 'add', 'origin', `ext::sh -c "touch ${sentinel}"`]);
+  const r = await gitPush(dir, 'tok_should_not_be_used', {});
+  expect(r.ok).toBe(false);
+  expect(r.error).toMatch(/github\.com/i); // "can only sync github.com…"
+  expect(existsSync(sentinel)).toBe(false); // payload NEVER executed
+});
+
+test('SECURITY: gitPush does not send the GitHub token to a non-GitHub HTTPS host', async () => {
+  sh(['remote', 'add', 'origin', 'https://evil.example.com/repo.git']);
+  const r = await gitPush(dir, 'tok_secret', {});
+  expect(r.ok).toBe(false);
+  expect(r.error).toMatch(/github\.com/i); // refused by policy, token never attached
+});
+
+test('SECURITY: a backslash-@ host-confusion remote is refused, PAT never attached (F1)', async () => {
+  // `https://github.com\@evil` — new URL() parses host=github.com (backslash → '/'),
+  // but git/curl dials `evil` (backslash = path/userinfo char). The token-host allowlist
+  // must reject the parser differential and NOT lend the PAT — on every token path:
+  // explicit fetch, the unattended ahead/behind probe (the zero-click trigger), and push.
+  sh(['remote', 'add', 'origin', 'https://github.com\\@evil.example/x.git']);
+  const f = await gitFetchRemote(dir, 'tok_secret');
+  expect(f.ok).toBe(false);
+  expect(f.error).toMatch(/github\.com/i); // refused by policy — token never attached
+  const ab = await remoteAheadBehind(dir, 'tok_secret');
+  expect(ab).toEqual({ ahead: 0, behind: 0 }); // the unattended probe refuses too (0/0, no fetch)
+  const p = await gitPush(dir, 'tok_secret', {});
+  expect(p.ok).toBe(false);
+  expect(p.error).toMatch(/github\.com/i);
+});
+
+test('SECURITY: the unattended probe refuses a repo with a url.insteadOf rewrite (verify re-review)', async () => {
+  // A clean github `origin.url` (passes isTrustedTokenHost) + a poisoned
+  // `url.<attacker>.insteadOf` that redirects github.com → attacker (only the system
+  // engine honors it). git would dial the attacker; the zero-click probe must refuse.
+  sh(['remote', 'add', 'origin', 'https://github.com/owner/repo.git']);
+  sh(['config', '--local', 'url.https://attacker.example/.insteadOf', 'https://github.com/']);
+  const ab = await remoteAheadBehind(dir, 'tok_secret');
+  expect(ab).toEqual({ ahead: 0, behind: 0 });
+});
+
 // ── transport-injection hardening (adversarial review of 75a2f0d) ────────────
 
 test('SECURITY: refuses to fetch an `ext::` (command-executing) remote — no spawn, no RCE', async () => {

package/apps/studio/test/github-api.test.ts

@@ -18,6 +18,7 @@ import git from 'isomorphic-git';
 import type { Context } from '../context.ts';
 import { createGitHubEndpoints, __testing as epTesting } from '../github/endpoints.ts';
 import {
+  createPullRequest,
   createRepo,
   GitHubApiError,
   getIdentity,
@@ -98,6 +99,59 @@ describe('GitHub REST request construction', () => {
     expect((err as GitHubApiError).message).toMatch(/already have a project with that name/i);
   });
 
+  test('createPullRequest POSTs title/head/base/body and shapes the result', async () => {
+    const calls = stubFetch(() =>
+      json({ number: 12, html_url: 'https://github.com/octocat/acme/pull/12' }, 201)
+    );
+    const pr = await createPullRequest('t', 'octocat', 'acme', {
+      head: 'nav-redesign',
+      base: 'main',
+      title: 'Add draft',
+      body: 'hi',
+    });
+    expect(pr).toEqual({ number: 12, html_url: 'https://github.com/octocat/acme/pull/12' });
+    expect(calls[0].url).toBe('https://api.github.com/repos/octocat/acme/pulls');
+    expect(calls[0].init?.method).toBe('POST');
+    expect(JSON.parse(calls[0].init?.body as string)).toEqual({
+      title: 'Add draft',
+      head: 'nav-redesign',
+      base: 'main',
+      body: 'hi',
+    });
+  });
+
+  test('createPullRequest recovers the existing PR link on a 422 (already exists)', async () => {
+    const calls = stubFetch((_url, init) =>
+      init?.method === 'POST'
+        ? json({ message: 'A pull request already exists for octocat:nav.' }, 422)
+        : json([{ number: 7, html_url: 'https://github.com/octocat/acme/pull/7' }])
+    );
+    const pr = await createPullRequest('t', 'octocat', 'acme', {
+      head: 'nav',
+      base: 'main',
+      title: 'x',
+    });
+    expect(pr).toEqual({ number: 7, html_url: 'https://github.com/octocat/acme/pull/7' });
+    // the recovery GET filters by head=owner:branch + base + state=open
+    expect(calls[1].url).toContain('head=octocat%3Anav');
+    expect(calls[1].url).toContain('base=main');
+    expect(calls[1].url).toContain('state=open');
+  });
+
+  test('createPullRequest maps a 422 with no existing PR to a "nothing new" message', async () => {
+    stubFetch((_url, init) =>
+      init?.method === 'POST' ? json({ message: 'No commits between main and nav' }, 422) : json([])
+    );
+    const err = await createPullRequest('t', 'octocat', 'acme', {
+      head: 'nav',
+      base: 'main',
+      title: 'x',
+    }).catch((e) => e);
+    expect(err).toBeInstanceOf(GitHubApiError);
+    expect((err as GitHubApiError).status).toBe(422);
+    expect((err as GitHubApiError).message).toMatch(/nothing new to add/i);
+  });
+
   test('inviteCollaborator PUTs permission=push, 201 = invited', async () => {
     const calls = stubFetch(() => json({ id: 1 }, 201));
     const r = await inviteCollaborator('t', 'octocat', 'acme', 'anna');
@@ -242,7 +296,8 @@ describe('token bridge fetch', () => {
     const calls = stubFetch(() => new Response('gho_secret\n', { status: 200 }));
     expect(tokenBridgeAvailable()).toBe(true);
     expect(await getGithubToken()).toBe('gho_secret');
-    expect((calls[0].init?.headers as Record<string, string>)['X-Maude-Token-Key']).toBe('k123');
+    const headers = calls[0].init?.headers as Record<string, string>;
+    expect(headers['X-Maude-Token-Key']).toBe('k123');
   });
 
   test('returns null on 404 (not signed in) and 403 (bad key)', async () => {

package/apps/studio/test/import-asset-browser.test.ts

@@ -0,0 +1,64 @@
+// Browser-driven pieces of local-file/SVG/PDF ingestion (DDR-167) — the SVG
+// execution canary. Spawns real agent-browser sessions, so this is slower
+// than import-asset.test.ts and is skipped (not failed) when agent-browser
+// can't be resolved, mirroring how the rest of this codebase treats
+// browser-dependent verification as a real-environment concern rather than a
+// hard CI requirement (e.g. ensure-browser.test.ts's resolution-only tests).
+//
+// DDR-167 requires the SVG canary fixtures be a PERMANENT regression test,
+// not a one-time pre-ship check — this file is that test. The PDF rasterize
+// adversarial fixtures (OpenAction/JS canary, SubmitForm/URI/Launch) are NOT
+// here: live spike-verification found the planned rasterization mechanism
+// (headless-Chromium navigating a file://*.pdf URL) does not render PDF
+// content under agent-browser automation (confirmed blank output on both
+// chrome-headless-shell and full Chrome) — see DDR-167's addendum. PDF
+// rasterization throws "not yet available" rather than shipping broken
+// output; there is nothing to fixture-test until a follow-up mechanism lands.
+
+import { describe, expect, test } from 'bun:test';
+import { execFileSync } from 'node:child_process';
+
+import { rasterizePdfPage, runSvgExecutionCanary } from '../bin/_import-asset.mjs';
+
+function agentBrowserAvailable(): boolean {
+  try {
+    execFileSync(process.env.MAUDE_AGENT_BROWSER_BIN || 'agent-browser', ['--version'], {
+      stdio: 'ignore',
+      timeout: 5000,
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+const HAS_AGENT_BROWSER = agentBrowserAvailable();
+const d = HAS_AGENT_BROWSER ? describe : describe.skip;
+
+d('SVG execution canary (Decision 1, step 6) — permanent regression fixtures', () => {
+  test('accepts a clean, allowlist-sanitized SVG (no false positive)', async () => {
+    const clean =
+      '<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><path d="M16 5l2.8 8.2L27 16l-8.2 2.8L16 27l-2.8-8.2L5 16l8.2-2.8z" fill="#4f46e5"/></svg>';
+    await expect(runSvgExecutionCanary(clean)).resolves.toBe(clean);
+  }, 30_000);
+
+  test('trips on a raw <script>-bearing SVG (defense-in-depth if the allowlist sanitizer were ever bypassed)', async () => {
+    const malicious =
+      '<svg xmlns="http://www.w3.org/2000/svg"><script>window.__MAUDE_IMPORT_CANARY__=true;</script></svg>';
+    await expect(runSvgExecutionCanary(malicious)).rejects.toThrow(/canary tripped/);
+  }, 30_000);
+
+  test('the sandboxed-render helper does not block the file:// navigation it needs (regression: a bare "*" network route also blocks local file loads)', async () => {
+    // A file:// SVG with no scripting at all must still load and be
+    // observable — this specifically guards against re-introducing the
+    // wildcard-route regression found during implementation.
+    const trivial = '<svg xmlns="http://www.w3.org/2000/svg"><rect width="1" height="1"/></svg>';
+    await expect(runSvgExecutionCanary(trivial)).resolves.toBeTruthy();
+  }, 30_000);
+});
+
+d('PDF rasterization — explicitly NOT shipped (DDR-167 addendum)', () => {
+  test('rasterizePdfPage throws "not yet available" rather than producing output', async () => {
+    await expect(rasterizePdfPage('/nonexistent.pdf', 1)).rejects.toThrow(/not yet available/);
+  });
+});

package/apps/studio/test/import-asset-route.test.ts

@@ -0,0 +1,71 @@
+// POST /_api/import-asset — DDR-167 (Phase 3 / T10). Full HTTP round-trip
+// against a real booted server (privilege/CSRF boundary is covered generically
+// by canvas-origin-gate.test.ts — this file exercises the route's own
+// success/error shapes).
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+const MALICIOUS_SVG =
+  '<svg xmlns="http://www.w3.org/2000/svg"><script>alert(1)</script>' +
+  '<rect onclick="alert(2)" fill="#4f46e5" width="10" height="10"/></svg>';
+
+describe('POST /_api/import-asset', () => {
+  test('imports and sanitizes an SVG, rejects a PDF kind as not-yet-available, rejects GET', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const base = `http://localhost:${port}`;
+
+      const post = await fetch(`${base}/_api/import-asset`, {
+        method: 'POST',
+        headers: { 'X-Import-Kind': 'svg', Origin: base },
+        body: MALICIOUS_SVG,
+      });
+      expect(post.status).toBe(201);
+      const body = (await post.json()) as { ok: boolean; path: string };
+      expect(body.ok).toBe(true);
+      expect(body.path).toMatch(/^assets\/[a-z0-9]{8}\.svg$/);
+      const written = readFileSync(`${designRoot}/${body.path}`, 'utf8');
+      expect(written).not.toContain('script');
+      expect(written).not.toContain('onclick');
+
+      const pdfAttempt = await fetch(`${base}/_api/import-asset`, {
+        method: 'POST',
+        headers: { 'X-Import-Kind': 'pdf', Origin: base },
+        body: '%PDF-1.4 fixture',
+      });
+      expect(pdfAttempt.status).toBe(501);
+      const pdfBody = (await pdfAttempt.json()) as { ok: boolean; error: string };
+      expect(pdfBody.ok).toBe(false);
+      expect(pdfBody.error).toContain('not yet available');
+
+      const getAttempt = await fetch(`${base}/_api/import-asset`, { method: 'GET' });
+      expect(getAttempt.status).toBe(405);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+
+  test('a malformed SVG is rejected with a clean 400, not a 500 crash', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const base = `http://localhost:${port}`;
+      const res = await fetch(`${base}/_api/import-asset`, {
+        method: 'POST',
+        headers: { 'X-Import-Kind': 'svg', Origin: base },
+        body: '<svg><rect',
+      });
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as { ok: boolean };
+      expect(body.ok).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+});