@1agh/maude 0.42.0 → 0.44.0

package/cli/lib/pkg-root.test.mjs

@@ -0,0 +1,79 @@
+// pkg-root.mjs tests (DDR-166 T0b).
+//
+// The regression this locks down: a naive single-anchor check
+// (`apps/studio/bin/screenshot.sh` alone) false-positives inside the Tauri
+// desktop build, because `stage-resources.mjs` stages a full working copy of
+// `apps/studio` into `target/debug/apps/studio/` for the sidecar's own
+// runtime resolution — that staged copy has no `cli/`, so a compiled `maude`
+// binary walking up from `target/debug/maude` matched it and stopped one
+// level too early, resolving PKG_ROOT to `target/debug` instead of the real
+// repo root. Caught by live testing against the real Tauri build (not a
+// synthetic path), not by static review — worth a regression test.
+
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+
+import { isPkgRoot, resolvePkgRoot } from './pkg-root.mjs';
+
+function makeRealRoot(base) {
+  mkdirSync(join(base, 'apps', 'studio', 'bin'), { recursive: true });
+  writeFileSync(join(base, 'apps', 'studio', 'bin', 'screenshot.sh'), '#!/bin/sh\n');
+  mkdirSync(join(base, 'cli', 'commands'), { recursive: true });
+  writeFileSync(join(base, 'cli', 'commands', 'design.mjs'), 'export const run = () => {};\n');
+}
+
+test('isPkgRoot requires BOTH anchors — the staged-resources false-positive is rejected', () => {
+  const tmp = mkdtempSync(join(tmpdir(), 'maude-pkgroot-'));
+  try {
+    // The exact shape of the bug: apps/studio/bin/screenshot.sh present
+    // (mirrors stage-resources.mjs's staged copy), no cli/ at all.
+    mkdirSync(join(tmp, 'apps', 'studio', 'bin'), { recursive: true });
+    writeFileSync(join(tmp, 'apps', 'studio', 'bin', 'screenshot.sh'), '#!/bin/sh\n');
+    assert.equal(isPkgRoot(tmp), false);
+
+    // cli/ alone, no apps/studio — also not a real root.
+    const tmp2 = mkdtempSync(join(tmpdir(), 'maude-pkgroot-'));
+    try {
+      mkdirSync(join(tmp2, 'cli', 'commands'), { recursive: true });
+      writeFileSync(join(tmp2, 'cli', 'commands', 'design.mjs'), '');
+      assert.equal(isPkgRoot(tmp2), false);
+    } finally {
+      rmSync(tmp2, { recursive: true, force: true });
+    }
+
+    // Both anchors together — a genuine package root.
+    makeRealRoot(tmp);
+    assert.equal(isPkgRoot(tmp), true);
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('resolvePkgRoot honors MAUDE_PKG_ROOT only when it actually satisfies both anchors', () => {
+  const real = mkdtempSync(join(tmpdir(), 'maude-pkgroot-real-'));
+  const fake = mkdtempSync(join(tmpdir(), 'maude-pkgroot-fake-'));
+  const prevOverride = process.env.MAUDE_PKG_ROOT;
+  try {
+    makeRealRoot(real);
+    // Fake: only the staged-resources-shaped anchor, same false-positive shape.
+    mkdirSync(join(fake, 'apps', 'studio', 'bin'), { recursive: true });
+    writeFileSync(join(fake, 'apps', 'studio', 'bin', 'screenshot.sh'), '#!/bin/sh\n');
+
+    process.env.MAUDE_PKG_ROOT = real;
+    assert.equal(resolvePkgRoot(), real);
+
+    process.env.MAUDE_PKG_ROOT = fake;
+    // Falls through past the (rejected) override to whatever the real
+    // walk-up finds in THIS test process — just assert it's NOT the fake
+    // dir, since accepting it would be exactly the regression.
+    assert.notEqual(resolvePkgRoot(), fake);
+  } finally {
+    if (prevOverride === undefined) delete process.env.MAUDE_PKG_ROOT;
+    else process.env.MAUDE_PKG_ROOT = prevOverride;
+    rmSync(real, { recursive: true, force: true });
+    rmSync(fake, { recursive: true, force: true });
+  }
+});

package/cli/lib/reconstruct-toolset.test.mjs

@@ -0,0 +1,194 @@
+// DDR-174 regression guard (T15).
+//
+// The whole security architecture of `/design:import --reconstruct` rests on
+// ONE fact: every agent turn that ever reads the untrusted source image —
+// `reconstruct-agent` (authoring) AND `reconstruct-critic` (the reality-check
+// comparator) — has `tools: Read, Write, Glob, Grep` and NEVER `Bash`,
+// `WebSearch`, or `WebFetch`. DDR-174's own Consequences section calls for
+// exactly this test: "a targeted grep-based test mirroring
+// plugin-cli-reachability.test.mjs's pattern should assert BOTH the authoring
+// agent's AND the comparator agent's frontmatter never gain
+// Bash/WebSearch/WebFetch, not just this DDR's prose." A future maintainer
+// "helpfully" widening either agent's toolset (e.g. "just give it Bash so it
+// can screenshot itself") would silently reopen DDR-174's entire closure —
+// this fails loudly instead.
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { test } from 'node:test';
+
+const AGENTS = [
+  'plugins/design/agents/reconstruct-agent.md',
+  'plugins/design/agents/reconstruct-critic.md',
+];
+
+const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---/;
+
+function readFrontmatter(path) {
+  const text = readFileSync(path, 'utf8');
+  const fm = FRONTMATTER_RE.exec(text);
+  assert.ok(fm, `${path}: no frontmatter block found`);
+  return fm[1];
+}
+
+function readToolsLine(path) {
+  const fm = readFrontmatter(path);
+  const toolsLine = fm.split('\n').find((l) => l.startsWith('tools:'));
+  assert.ok(toolsLine, `${path}: frontmatter has no tools: line`);
+  return toolsLine;
+}
+
+for (const path of AGENTS) {
+  test(`${path}: tools: line never grants Bash`, () => {
+    const line = readToolsLine(path);
+    assert.ok(
+      !/\bBash\b/.test(line),
+      `${path} declares Bash — this reopens DDR-174's core closure (the agent reads an untrusted image and must never hold a shell). Line: ${line}`
+    );
+  });
+
+  test(`${path}: tools: line never grants WebSearch or WebFetch`, () => {
+    const line = readToolsLine(path);
+    assert.ok(
+      !/\bWebSearch\b/.test(line) && !/\bWebFetch\b/.test(line),
+      `${path} declares WebSearch/WebFetch — DDR-174 requires these agents have no tool call that reaches the network. Line: ${line}`
+    );
+  });
+
+  test(`${path}: tools: line is exactly Read, Write, Glob, Grep`, () => {
+    const line = readToolsLine(path);
+    const tools = line
+      .replace(/^tools:\s*/, '')
+      .split(',')
+      .map((t) => t.trim())
+      .filter(Boolean);
+    assert.deepEqual(
+      [...tools].sort(),
+      ['Glob', 'Grep', 'Read', 'Write'],
+      `${path}: expected exactly Read/Write/Glob/Grep per DDR-174 Decision 1, got: ${line}`
+    );
+  });
+
+  // DDR-174 Addendum (post-implementation adversarial review) — Write has no
+  // path restriction (Claude Code has no per-subagent path-scoping mechanism,
+  // verified authoritatively, not assumed) and the only real closure for a
+  // non-bypassPermissions session is a human approval prompt on any write.
+  // `permissionMode: default` is what makes that prompt happen instead of
+  // silently inheriting the parent session's (possibly bypassPermissions)
+  // mode. A future maintainer removing this line silently re-widens the
+  // agent's effective write reach for every downstream consumer NOT running
+  // bypassPermissions.
+  test(`${path}: frontmatter declares permissionMode: default (DDR-174 Addendum)`, () => {
+    const fm = readFrontmatter(path);
+    const line = fm.split('\n').find((l) => l.startsWith('permissionMode:'));
+    assert.ok(
+      line,
+      `${path}: missing permissionMode: default — without it this agent silently inherits the parent session's permission mode (e.g. bypassPermissions), losing the one real per-write approval gate available for its unrestricted Write tool (DDR-174 Addendum)`
+    );
+    assert.equal(
+      line.replace(/^permissionMode:\s*/, '').trim(),
+      'default',
+      `${path}: permissionMode must be exactly "default" (prompts on every write), not a looser mode. Line: ${line}`
+    );
+  });
+}
+
+test('import.md diff-check is whole-repo scoped, not just $DESIGN_ROOT (DDR-174 Addendum)', () => {
+  // The first implementation scoped `git status --porcelain -- "$DESIGN_ROOT"`,
+  // which made a write to .claude/settings.json, CLAUDE.md, or plugins/**
+  // structurally invisible to the check — an adversarial review built a full
+  // exploit chain out of exactly that gap. Assert the pathspec was actually
+  // widened, not just documented as widened in prose.
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  assert.ok(
+    !/git -C "\$REPO" status --porcelain -- "\$DESIGN_ROOT"/.test(importMd),
+    'import.md must NOT scope the diff-check to $DESIGN_ROOT only — this was the exact gap the DDR-174 Addendum closes (a write outside $DESIGN_ROOT, e.g. to .claude/settings.json, would be invisible to a $DESIGN_ROOT-scoped check)'
+  );
+  const wholeRepoOccurrences = (importMd.match(/git -C "\$REPO" status --porcelain\b/g) || [])
+    .length;
+  assert.ok(
+    wholeRepoOccurrences >= 2,
+    `import.md must run an UNSCOPED \`git -C "$REPO" status --porcelain\` for both the BEFORE (step 4) and AFTER (step 5b) snapshots — found ${wholeRepoOccurrences} occurrence(s)`
+  );
+});
+
+test('import.md snapshots the two well-known global Claude Code config paths (DDR-174 Addendum)', () => {
+  // A repo-scoped git diff can never see $HOME/.claude/** — these are the two
+  // specific files an adversarial review named as attack targets (a planted
+  // hook, or a poisoned global CLAUDE.md loaded into every future session).
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  assert.ok(
+    importMd.includes('$HOME/.claude/settings.json') &&
+      importMd.includes('$HOME/.claude/CLAUDE.md'),
+    'import.md must snapshot $HOME/.claude/settings.json and $HOME/.claude/CLAUDE.md before/after each round and hard-fail on any change (DDR-174 Addendum) — these are outside any repo-scoped diff check'
+  );
+});
+
+test('import.md stat calls are portable (GNU-first, BSD-fallback), not BSD-only (DDR-174 Addendum confirmation pass)', () => {
+  // The first Addendum revision used BSD-only `stat -f` unconditionally — it
+  // silently no-ops on Linux (a platform this project ships a .deb for),
+  // because GNU `stat -f` means something else entirely and errors out,
+  // swallowed by the trailing `2>/dev/null`. Both empty strings compare
+  // equal, so the check trivially "passes" without ever having checked
+  // anything. Assert every stat call tries GNU syntax (`stat -c`) first.
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  // Only scan actual shell inside fenced ```bash blocks — prose elsewhere
+  // legitimately mentions `stat -f` by name when explaining the old bug.
+  const codeBlocks = [...importMd.matchAll(/```bash\n([\s\S]*?)```/g)].map((m) => m[1]).join('\n');
+  const bareStatF = codeBlocks.match(/(?<!\|\| )\bstat -f\b/g) || [];
+  assert.deepEqual(
+    bareStatF,
+    [],
+    `import.md has a \`stat -f\` call in executable shell with no \`stat -c\` GNU fallback tried first — this silently no-ops on Linux (DDR-174 Addendum confirmation-pass finding). Found ${bareStatF.length} bare occurrence(s).`
+  );
+  const statCOccurrences = (codeBlocks.match(/stat -c '/g) || []).length;
+  assert.ok(
+    statCOccurrences >= 4,
+    `expected at least 4 GNU-first \`stat -c\` attempts (2 for the non-git repo-wide fallback, 2 for the global-config snapshot) — found ${statCOccurrences}`
+  );
+});
+
+test('import.md non-git fallback excludes _history/ (DDR-174 Addendum confirmation pass)', () => {
+  // The reconstruct loop writes its own screenshots/verdict files under
+  // _history/_reconstruct/<slug>/ every round. A git-repo target gets this
+  // excluded for free via .gitignore; the non-git `find`-based fallback has
+  // no such filter and would false-positive-abort on its own round-1 output
+  // the moment round 2's diff check runs, in a non-git target repo.
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  const findOccurrences = importMd.match(/find "\$REPO" -type f[^\n]*/g) || [];
+  assert.ok(
+    findOccurrences.length >= 2,
+    'expected the non-git fallback find command in both step 4 and step 5b'
+  );
+  for (const line of findOccurrences) {
+    assert.ok(
+      line.includes("-not -path '*/_history/*'"),
+      `non-git fallback find command must exclude _history/ (its own round-N artifacts) or every multi-round run in a non-git target repo false-positive-aborts: ${line}`
+    );
+  }
+});
+
+test('import.md uses mktemp for the _active.json patch, not a fixed /tmp filename (DDR-174 Addendum)', () => {
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  assert.ok(
+    !/\/tmp\/active\.json\.tmp/.test(importMd),
+    'import.md must not use a fixed, predictable /tmp filename for the _active.json patch — a symlink race target on a shared machine (DDR-174 Addendum adversarial finding)'
+  );
+  assert.ok(/mktemp/.test(importMd), 'import.md must use mktemp for its temp file(s)');
+});
+
+test('design-critic.md is never repurposed as the reconstruct comparator (DDR-174 Decision 1 Round-2)', () => {
+  // The comparator must be reconstruct-critic (Bash-free), never the default
+  // Bash-capable design-critic — assert import.md's orchestrator spawns the
+  // dedicated agent, not design-critic, for the reality-check step.
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  const reconstructSection = importMd.slice(importMd.indexOf('## `--reconstruct'));
+  assert.ok(
+    reconstructSection.includes('design:reconstruct-critic'),
+    'import.md --reconstruct mode must spawn design:reconstruct-critic for the reality-check step'
+  );
+  assert.ok(
+    !/subagent_type:\s*"design:design-critic"/.test(reconstructSection),
+    'import.md --reconstruct mode must NOT spawn the default design-critic as its comparator (DDR-174 Decision 1 Round-2) — it is Bash-capable and reopens the trifecta this DDR closes'
+  );
+});

package/cli/lib/update-check.mjs

@@ -15,6 +15,7 @@ import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isCompiledBinary } from './pkg-root.mjs';
 
 const PKG_NAME = '@1agh/maude';
 const REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
@@ -31,6 +32,13 @@ function shouldSkip() {
   if (process.env.NO_UPDATE_NOTIFIER) return true;
   if (process.env.CI) return true;
   if (!process.stderr.isTTY) return true;
+  // DDR-166 T0b — a Tauri-bundled `maude` binary updates via the app's own
+  // auto-updater (DDR-126), not `npm i -g @1agh/maude@latest`; the notice
+  // would be actively wrong advice. Also sidesteps spawnDetachedRefresh()'s
+  // self-respawn, which re-invokes `import.meta.url` as a script path — a
+  // real file:// path in dev/node, but Bun's virtual `/$bunfs/root` inside
+  // this exact compiled binary (DDR-045-class trap).
+  if (isCompiledBinary()) return true;
   return false;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.42.0",
+  "version": "0.44.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -47,16 +47,17 @@
     "prepublishOnly": "bash scripts/check-version-parity.sh && bash apps/studio/bin/check-runtime-bundles.sh",
     "test:e2e:desktop:lifecycle": "pnpm --filter @maude/desktop-e2e e2e:lifecycle",
     "test:e2e:desktop:switchrepos": "pnpm --filter @maude/desktop-e2e e2e:switchrepos",
-    "test:e2e:desktop:onboarding": "pnpm --filter @maude/desktop-e2e e2e:onboarding"
+    "test:e2e:desktop:onboarding": "pnpm --filter @maude/desktop-e2e e2e:onboarding",
+    "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.42.0",
-    "@1agh/maude-darwin-x64": "0.42.0",
-    "@1agh/maude-linux-arm64": "0.42.0",
-    "@1agh/maude-linux-arm64-musl": "0.42.0",
-    "@1agh/maude-linux-x64": "0.42.0",
-    "@1agh/maude-linux-x64-musl": "0.42.0",
-    "@1agh/maude-win32-x64": "0.42.0"
+    "@1agh/maude-darwin-arm64": "0.44.0",
+    "@1agh/maude-darwin-x64": "0.44.0",
+    "@1agh/maude-linux-arm64": "0.44.0",
+    "@1agh/maude-linux-arm64-musl": "0.44.0",
+    "@1agh/maude-linux-x64": "0.44.0",
+    "@1agh/maude-linux-x64-musl": "0.44.0",
+    "@1agh/maude-win32-x64": "0.44.0"
   },
   "files": [
     "cli",
@@ -94,9 +95,10 @@
     "scaffold"
   ],
   "devDependencies": {
-    "@biomejs/biome": "^2.4.16",
+    "@biomejs/biome": "^2.5.3",
     "@changesets/cli": "^2.27.10",
-    "@playwright/test": "^1.60.0"
+    "@playwright/test": "^1.61.1",
+    "lucide-react": "^1.24.0"
   },
   "dependencies": {
     "ajv": "^8.20.0",

package/plugins/design/dependencies.json

@@ -195,6 +195,24 @@
       "fallbackBehavior": "Phase 31 (DDR-123) — the native ACP chat sidepanel drives the user's OWN installed `claude` CLI on their Pro/Max subscription (never API billing). Without it the panel shows the not-connected explainer ('run `claude` in a terminal and `/login`'); every other design surface is unaffected.",
       "usedBy": ["dev-server/acp/probe.ts", "dev-server/acp/bridge.ts"],
       "docsUrl": "https://docs.claude.com/en/docs/claude-code"
+    },
+    {
+      "id": "whisper-cpp",
+      "type": "cli",
+      "hardness": "soft",
+      "check": {
+        "command": "whisper-cli --help",
+        "expectExit": 0
+      },
+      "install": {
+        "darwin": "brew install whisper-cpp",
+        "linux": "https://github.com/ggml-org/whisper.cpp#quick-start",
+        "preferred": "https://github.com/ggml-org/whisper.cpp"
+      },
+      "autoInstall": false,
+      "fallbackBehavior": "feature-ai-media-generation Phase 2 (DDR-164) — `maude design transcribe` uses whisper.cpp for local, no-key, word-timestamped subtitles (the DEFAULT subtitle path). Without it, transcription falls back to cloud STT (ElevenLabs Scribe / Groq Whisper) via a provider key. whisper.cpp also needs a ggml model file (--model / $MAUDE_WHISPER_MODEL); it ships no default and does not auto-download — see https://huggingface.co/ggerganov/whisper.cpp (e.g. ggml-large-v3-turbo.bin).",
+      "usedBy": ["dev-server/bin/transcribe.sh", "dev-server/bin/_transcribe.mjs"],
+      "docsUrl": "https://github.com/ggml-org/whisper.cpp"
     }
   ]
 }

package/plugins/design/templates/_shell.html

@@ -135,6 +135,7 @@
           "react/jsx-runtime": "/_canvas-runtime/react_jsx-runtime.js",
           "react/jsx-dev-runtime": "/_canvas-runtime/react_jsx-dev-runtime.js",
           "pixi.js": "/_canvas-runtime/pixi-js.js",
+          "@imgly/background-removal": "/_canvas-runtime/@imgly_background-removal.js",
           "motion": "/_canvas-runtime/motion.js",
           "motion/react": "/_canvas-runtime/motion_react.js",
           "yjs": "/_canvas-runtime/yjs.js",