@1agh/maude 0.43.0 → 0.44.0

package/apps/studio/server.ts

@@ -17,6 +17,7 @@
 import { spawn } from 'node:child_process';
 
 import { createAcp } from './acp/index.ts';
+import { cancelInstall, cancelSignin } from './acp/login-state.ts';
 import { createActivity } from './activity.ts';
 import { ASSET_MAX_VIDEO_BYTES, createApi } from './api.ts';
 import { bootSelfHeal } from './boot-self-heal.ts';
@@ -27,6 +28,7 @@ import { createCollab } from './collab/index.ts';
 import { createContext, reloadConfig } from './context.ts';
 import { createExportJobQueue } from './exporters/jobs.ts';
 import { createFsWatch } from './fs-watch.ts';
+import { createGenerationJobQueue } from './generation/jobs.ts';
 import { createGitWatch } from './git/watch.ts';
 import { createHttp } from './http.ts';
 import { createInspect } from './inspect.ts';
@@ -107,7 +109,9 @@ const activity = createActivity(ctx);
 const acp = createAcp(ctx, aiActivity);
 const ws = createWs(ctx, api, inspect, collab, activity, acp);
 const exportJobs = createExportJobQueue(ctx.bus, ctx.paths.designRoot);
-const http = createHttp(ctx, api, inspect, aiActivity, exportJobs);
+// feature-ai-media-generation (DDR-16x) — background AI-media generation queue.
+const generateJobs = createGenerationJobQueue(ctx.bus, ctx.paths.designRoot);
+const http = createHttp(ctx, api, inspect, aiActivity, exportJobs, generateJobs);
 const fsWatch = createFsWatch(ctx);
 
 // Port: --port arg > $PORT > $MDCC_DEV_PORT > 4399.
@@ -463,6 +467,14 @@ if (!process.env.NO_OPEN) {
 
 async function shutdown() {
   console.log('\n  Stopping…');
+  // DDR-166 — reap in-flight claude-provisioning grandchildren before this
+  // process exits. Security-review finding: neither the SIGTERM/SIGINT path
+  // here nor sidecar.rs's child.kill() on the Tauri side propagate to a
+  // spawned `claude auth login`/installer child by default, so quitting
+  // mid-signin or mid-install orphaned it — exactly the DDR's own named-but-
+  // previously-unanswered "how does app-quit reach the grandchild" question.
+  cancelSignin();
+  cancelInstall();
   fsWatch.stop();
   try {
     gitWatch.stop();

package/apps/studio/test/_helpers.ts

@@ -37,7 +37,12 @@ export function makeSandbox(): Sandbox {
   return { root, designRoot };
 }
 
-let portCounter = 4500;
+// Base is spread by pid, not a fixed literal — bun test runs different test
+// files as separate processes, each importing a fresh copy of this module, so
+// a fixed base (e.g. 4500 for everyone) reliably collides across files. The
+// pid spread doesn't guarantee uniqueness on its own — bootServer's pid check
+// below is the actual safety net — but it makes collisions rare in practice.
+let portCounter = 4500 + (process.pid % 4000);
 export function nextPort(): number {
   // Bump on every call so parallel tests don't collide. Bun.serve will throw
   // EADDRINUSE if the host happened to bind one — caller retries with nextPort().
@@ -65,7 +70,15 @@ export async function bootServer(
       const r = await fetch(`http://localhost:${port}/_health`, {
         signal: AbortSignal.timeout(200),
       });
-      if (r.ok) return proc;
+      if (r.ok) {
+        const json = (await r.json()) as { pid?: number };
+        // A same-port collision with a concurrently-running test file's server
+        // (see the portCounter comment above) would otherwise look "ready" —
+        // /_health answers fine, just from someone else's sandbox — and every
+        // later request 404s against a designRoot that doesn't have our
+        // fixtures. Only trust the health check if it's actually our process.
+        if (json.pid === proc.pid) return proc;
+      }
     } catch {
       /* not up yet */
     }

package/apps/studio/test/acp-bridge.test.ts

@@ -9,7 +9,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import { AcpBridge } from '../acp/bridge.ts';
-import { probeAcpAvailability } from '../acp/probe.ts';
+import { probeAcpAvailability, probeAcpAvailabilityAuthed } from '../acp/probe.ts';
 
 const FIXTURE = join(import.meta.dir, 'fixtures', 'mock-acp-agent.mjs');
 const TEST_ENV_KEYS = [
@@ -261,3 +261,36 @@ describe('probeAcpAvailability — not-connected detection', () => {
     expect(probe.adapterEntry).toBe(FIXTURE);
   });
 });
+
+describe('probeAcpAvailabilityAuthed — DDR-166 T0d, logged-out must not read as available', () => {
+  const AUTH_FIXTURE = join(import.meta.dir, 'fixtures', 'fake-claude-auth.mjs');
+
+  afterEach(() => {
+    delete process.env.FAKE_CLAUDE_LOGGED_IN;
+  });
+
+  test('installed but NOT signed in reports available:false (the bug this closes)', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = AUTH_FIXTURE;
+    process.env.FAKE_CLAUDE_LOGGED_IN = '0';
+    const probe = await probeAcpAvailabilityAuthed();
+    expect(probe.available).toBe(false);
+    expect(probe.reason ?? '').toMatch(/signed in/i);
+  });
+
+  test('installed AND signed in reports available:true', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = AUTH_FIXTURE;
+    process.env.FAKE_CLAUDE_LOGGED_IN = '1';
+    const probe = await probeAcpAvailabilityAuthed();
+    expect(probe.available).toBe(true);
+  });
+
+  test('not installed still reports the plain not-installed reason (no auth spawn attempted)', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = join(import.meta.dir, 'no-such-claude-bin');
+    const probe = await probeAcpAvailabilityAuthed();
+    expect(probe.available).toBe(false);
+    expect(probe.reason ?? '').toMatch(/Claude Code/i);
+  });
+});

package/apps/studio/test/acp-env.test.ts

@@ -62,4 +62,34 @@ describe('scrubAgentEnv — subscription guardrail', () => {
     const out = scrubAgentEnv();
     expect('ANTHROPIC_API_KEY' in out).toBe(false);
   });
+
+  // feature-ai-media-generation Phase 1 (Task 1.4) + DDR-164 F3 — the ACP chat
+  // panel can TRIGGER generation because the BYOK provider key is resolved
+  // SERVER-SIDE (the dev-server, a separate process, reads the 0600 file /
+  // keychain via keys.ts). The ACP `claude` subprocess never needs a generation
+  // key-custody env var, so we SCRUB them: the Phase-5.1 keychain-bridge endpoint
+  // + key (`MAUDE_GEN_KEY_*` — F3, brought forward so the tripwire is armed before
+  // the bridge is wired) AND a custom key-file path (`MAUDE_GEN_KEYS_PATH`). This
+  // does NOT make the key unreachable to a compromised same-UID agent (it can
+  // still read the default keys.json off disk — the pre-existing full-tool-agent
+  // trifecta, documented, not closable by an env-scrub); it only ensures the child
+  // is never HANDED a pointer/credential it doesn't need. Meanwhile the `maude`
+  // CLI on PATH still resolves, so generation keeps working through the scrub.
+  test('scrubs the generation key-custody env vars, keeps CLI PATH (Task 1.4 / DDR-164 F3)', () => {
+    const out = scrubAgentEnv({
+      PATH: '/usr/local/bin:/usr/bin',
+      MAUDE_GEN_KEYS_PATH: '/Users/x/.config/maude/keys.json',
+      MAUDE_GEN_KEY_ENDPOINT: 'http://127.0.0.1:9/keychain', // Phase-5.1 bridge — MUST be scrubbed (F3)
+      MAUDE_GEN_KEY_KEY: 'per-launch-bridge-secret',
+      ANTHROPIC_API_KEY: 'sk-should-be-scrubbed',
+    });
+    // The generate CLI stays reachable (the sidecar, not this child, holds the key).
+    expect(out.PATH).toBe('/usr/local/bin:/usr/bin');
+    // Every generation key-custody var is stripped from the agent env.
+    expect('MAUDE_GEN_KEYS_PATH' in out).toBe(false);
+    expect('MAUDE_GEN_KEY_ENDPOINT' in out).toBe(false);
+    expect('MAUDE_GEN_KEY_KEY' in out).toBe(false);
+    // The subscription guardrail still fires.
+    expect('ANTHROPIC_API_KEY' in out).toBe(false);
+  });
 });

package/apps/studio/test/acp-plugin-bootstrap.test.ts

@@ -1,10 +1,14 @@
-// ACP session-scoped plugin auto-bootstrap resolver (DDR-143).
+// ACP session-scoped plugin auto-bootstrap resolver (DDR-143; unconditional
+// injection DDR-168).
 //
-// The pure gate logic — native/bundle context, per-plugin bundled-dir presence,
-// and the no-op-for-power-users registry gate — all exercised without touching
-// disk or ~/.claude. The wire-level presence test (that the resolved configs
-// actually land on `_meta.claudeCode.options.plugins`) lives in
-// acp-session-plugins.test.ts.
+// The pure gate logic — native/bundle context and per-plugin bundled-dir
+// presence — all exercised without touching disk or ~/.claude. Since DDR-168,
+// there is no longer a `scan`-gated no-op: a bundled plugin injects regardless
+// of whether it's ALSO installed on disk (the double-registration risk that
+// used to gate this is now closed structurally in bridge.ts instead — see
+// acp-session-plugins.test.ts). The wire-level presence test (that the
+// resolved configs actually land on `_meta.claudeCode.options.plugins`) lives
+// in acp-session-plugins.test.ts.
 
 import { describe, expect, test } from 'bun:test';
 
@@ -12,78 +16,40 @@ import { computeSessionPlugins } from '../acp/plugin-bootstrap.ts';
 
 const DESIGN = '/bundle/plugins/design';
 const FLOW = '/bundle/plugins/flow';
-const NEITHER_INSTALLED = { design: false, flow: false };
 
 describe('computeSessionPlugins — gates', () => {
   // `/flow` auto-load is intentionally OFF for now (2026-07-03) — only `design`
-  // is ever injected, even when the flow dir resolves + flow is not installed.
-  test('neither installed, native, both bundled ⇒ inject design only (flow disabled)', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: NEITHER_INSTALLED,
-    });
+  // is ever injected, even when the flow dir resolves.
+  test('native, both bundled ⇒ inject design only (flow disabled)', () => {
+    const out = computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW });
     expect(out).toEqual([{ type: 'local', path: DESIGN, skipMcpDiscovery: true }]);
   });
 
-  test('no-op gate: design already installed ⇒ inject nothing (flow never injected)', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: { design: true, flow: false },
-    });
-    expect(out).toEqual([]);
-  });
-
-  test('no-op gate: BOTH already installed (power user) ⇒ inject nothing', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: { design: true, flow: true },
-    });
-    expect(out).toEqual([]);
+  // DDR-168 — no more no-op gate: injection no longer depends on disk state.
+  // The double-registration risk this used to guard against is now closed
+  // structurally via bridge.ts's `options.settings.enabledPlugins` override.
+  test('design already installed on disk ⇒ STILL injects (no more scan-gated no-op)', () => {
+    const out = computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW });
+    expect(out).toEqual([{ type: 'local', path: DESIGN, skipMcpDiscovery: true }]);
   });
 
   test('native-only gate: not native (web serve) ⇒ inject nothing even if dirs resolve', () => {
-    const out = computeSessionPlugins({
-      native: false,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: NEITHER_INSTALLED,
-    });
+    const out = computeSessionPlugins({ native: false, designDir: DESIGN, flowDir: FLOW });
     expect(out).toEqual([]);
   });
 
   test('path-missing gate: design dir null ⇒ inject nothing (flow disabled, so no fallback)', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: null,
-      flowDir: FLOW,
-      scan: NEITHER_INSTALLED,
-    });
+    const out = computeSessionPlugins({ native: true, designDir: null, flowDir: FLOW });
     expect(out).toEqual([]);
   });
 
   test('web/npm layout: native false AND both dirs null ⇒ empty', () => {
-    const out = computeSessionPlugins({
-      native: false,
-      designDir: null,
-      flowDir: null,
-      scan: NEITHER_INSTALLED,
-    });
+    const out = computeSessionPlugins({ native: false, designDir: null, flowDir: null });
     expect(out).toEqual([]);
   });
 
   test('every injected config sets skipMcpDiscovery (SDK host owns MCP)', () => {
-    const out = computeSessionPlugins({
-      native: true,
-      designDir: DESIGN,
-      flowDir: FLOW,
-      scan: NEITHER_INSTALLED,
-    });
+    const out = computeSessionPlugins({ native: true, designDir: DESIGN, flowDir: FLOW });
     expect(out.every((c) => c.skipMcpDiscovery === true && c.type === 'local')).toBe(true);
   });
 });

package/apps/studio/test/acp-session-plugins.test.ts

@@ -22,7 +22,13 @@ const PLUGINS: SdkPluginConfig[] = [
 
 type Meta = {
   systemPrompt?: { append?: string };
-  claudeCode?: { options?: { plugins?: SdkPluginConfig[]; settingSources?: string[] } };
+  claudeCode?: {
+    options?: {
+      plugins?: SdkPluginConfig[];
+      settingSources?: string[];
+      settings?: { enabledPlugins?: Record<string, boolean> };
+    };
+  };
 };
 
 describe('newSessionParams — plugin carrier shape', () => {
@@ -79,6 +85,27 @@ describe('newSessionParams — plugin carrier shape', () => {
       expect((p._meta as Meta).claudeCode?.options?.settingSources).toEqual(['user']);
     }
   });
+
+  // DDR-168 — the structural double-registration guard: a non-empty `plugins`
+  // must also force off any natively-loaded user-level copy of the same id via
+  // the SDK's "flag" settings layer, so the bundled copy is the ONLY one that
+  // ever loads.
+  test('with plugins: forces design@maude off via options.settings.enabledPlugins (double-registration guard)', () => {
+    const p = newSessionParams('/repo', undefined, PLUGINS);
+    expect((p._meta as Meta).claudeCode?.options?.settings?.enabledPlugins).toEqual({
+      'design@maude': false,
+    });
+  });
+
+  test('empty plugins: options.settings is entirely absent (web/npm path unaffected)', () => {
+    const p = newSessionParams('/repo', 'BRIEF', []);
+    expect((p._meta as Meta).claudeCode?.options?.settings).toBeUndefined();
+  });
+
+  test('undefined plugins: options.settings is entirely absent', () => {
+    const p = newSessionParams('/repo', 'BRIEF');
+    expect((p._meta as Meta).claudeCode?.options?.settings).toBeUndefined();
+  });
 });
 
 describe('upgrade guard — installed adapter + SDK still honor the plugins contract', () => {
@@ -129,4 +156,48 @@ describe('upgrade guard — installed adapter + SDK still honor the plugins cont
     expect(src).toMatch(/SdkPluginConfig\s*=\s*\{/);
     expect(src).toMatch(/type:\s*'local'/);
   });
+
+  // DDR-168 — the same style of guard, for the `options.settings` mechanism the
+  // double-registration fix depends on: `settings` must NOT be among the fields
+  // the adapter overrides after the `...userProvidedOptions` spread (else our
+  // `enabledPlugins: false` override would be silently discarded), and the SDK
+  // must still declare `Settings.enabledPlugins` as an accepted field.
+  test('adapter forwards `settings` from userProvidedOptions and only ever overrides it conditionally when the caller left it unset', () => {
+    expect(existsSync(adapterEntry)).toBe(true);
+    const src = readFileSync(adapterEntry, 'utf8');
+    // Locate the `...userProvidedOptions` spread and inspect what follows it up
+    // to the `query({ options })` call. Verified live at claude-agent-acp@0.57.0:
+    // the object DOES contain a later `settings:` assignment (a
+    // CLAUDE_MODEL_CONFIG env-var fallback) — but it's gated behind
+    // `!userProvidedOptions?.settings && …`, i.e. it only fires when the caller
+    // did NOT already provide a settings object. A caller-provided `settings`
+    // (ours, carrying `enabledPlugins`) always wins. A bump that drops that
+    // guard — making the fallback unconditional — must fail here, since it
+    // would silently clobber DDR-168's double-registration override.
+    const spreadIdx = src.indexOf('...userProvidedOptions');
+    expect(spreadIdx).toBeGreaterThan(-1);
+    const queryIdx = src.indexOf('query(', spreadIdx);
+    expect(queryIdx).toBeGreaterThan(spreadIdx);
+    const window = src.slice(spreadIdx, queryIdx);
+    expect(window).toMatch(/!userProvidedOptions\?\.settings\s*&&/);
+  });
+
+  test("SDK Options declares settings (Settings.enabledPlugins is the field DDR-168's guard relies on)", () => {
+    let sdkPkg: string | null = null;
+    try {
+      const realAdapterDir = dirname(realpathSync(adapterEntry));
+      sdkPkg = Bun.resolveSync('@anthropic-ai/claude-agent-sdk/package.json', realAdapterDir);
+    } catch {
+      sdkPkg = null;
+    }
+    expect(sdkPkg).not.toBeNull();
+    const dts = join(dirname(sdkPkg as string), 'sdk.d.ts');
+    expect(existsSync(dts)).toBe(true);
+    const src = readFileSync(dts, 'utf8');
+    // sdk.d.ts:1831 `settings?: Settings;` (or similarly named field on Options) +
+    // :5193 `Settings.enabledPlugins` — a bump that renames/drops either must
+    // fail here, then adapt, rather than silently reopening double-registration.
+    expect(src).toMatch(/settings\?\s*:/);
+    expect(src).toMatch(/enabledPlugins\??\s*:/);
+  });
 });

package/apps/studio/test/annotation-strokes-command.test.ts

@@ -90,6 +90,23 @@ describe('createAnnotationStrokesCommand', () => {
     expect(putFn.mock.calls[1]?.[0]).toEqual([pen1]);
   });
 
+  test("do() passes the pre-op BEFORE as putFn's second arg; undo() passes the post-op AFTER", async () => {
+    // The live-bug regression this locks in: putStrokes needs its own
+    // command's baseline to tell a delete (an id `before` had that `next`
+    // dropped) apart from a genuinely concurrent sibling addition (an id
+    // `prev` has that this command's OWN before/next never knew about).
+    const putFn = mock(() => Promise.resolve());
+    const cmd = createAnnotationStrokesCommand({
+      before: [pen1, pen2],
+      after: [pen1],
+      putFn,
+    });
+    await cmd.do();
+    expect(putFn.mock.calls[0]).toEqual([[pen1], [pen1, pen2]]);
+    await cmd.undo();
+    expect(putFn.mock.calls[1]).toEqual([[pen1, pen2], [pen1]]);
+  });
+
   test('default label — add 2 strokes', () => {
     const cmd = createAnnotationStrokesCommand({
       before: [pen1],

package/apps/studio/test/annotations-layer.test.ts

@@ -21,6 +21,9 @@ import {
   polygonPoints,
   polygonVertices,
   type RectStroke,
+  reconcileCommit,
+  reconcileForeignEcho,
+  resolveImageUploadSwap,
   rid,
   STICKY_PALETTE,
   type StickyStroke,
@@ -427,6 +430,177 @@ describe('annotations-layer / strokes round-trip is stable for arrays', () => {
   });
 });
 
+describe('annotations-layer / reconcileCommit (live-bug regression — delete must stick)', () => {
+  const a: RectStroke = {
+    id: 'a',
+    tool: 'rect',
+    color: '#000',
+    width: 2,
+    x: 0,
+    y: 0,
+    w: 10,
+    h: 10,
+  };
+  const b: RectStroke = {
+    id: 'b',
+    tool: 'rect',
+    color: '#000',
+    width: 2,
+    x: 20,
+    y: 0,
+    w: 10,
+    h: 10,
+  };
+  const c: RectStroke = {
+    id: 'c',
+    tool: 'rect',
+    color: '#000',
+    width: 2,
+    x: 40,
+    y: 0,
+    w: 10,
+    h: 10,
+  };
+  const d: RectStroke = {
+    id: 'd',
+    tool: 'rect',
+    color: '#000',
+    width: 2,
+    x: 60,
+    y: 0,
+    w: 10,
+    h: 10,
+  };
+
+  test('a delete stays deleted even when the rendered `prev` has not caught up yet', () => {
+    // This is exactly the reported bug: Backspace computes next = before
+    // minus the deleted id, but React's `prev` (read by the functional
+    // updater) still shows the pre-delete set. The old reconcileIncoming
+    // treated "id missing from next" as "not caught up, fold it back" —
+    // reverting every delete locally while the smaller set still went out
+    // over PUT.
+    const prev = [a, b, c]; // rendered state, hasn't caught up to the delete
+    const opBefore = [a, b, c]; // this command's own baseline
+    const next = [a, b]; // c deleted
+    expect(reconcileCommit(prev, opBefore, next)).toEqual([a, b]);
+  });
+
+  test('a genuinely concurrent sibling addition (unknown to this commit) is still folded in', () => {
+    // `prev` has `d`, which neither this commit's `opBefore` nor `next` knows
+    // about — a different in-flight commit added it after `opBefore` was
+    // captured. It must survive.
+    const prev = [a, b, d];
+    const opBefore = [a, b];
+    const next = [a, b, c]; // this commit adds c
+    expect(reconcileCommit(prev, opBefore, next)).toEqual([a, b, c, d]);
+  });
+
+  test('delete + concurrent addition combine correctly (delete wins for its own id, addition still folds in)', () => {
+    const prev = [a, b, c, d]; // rendered: hasn't caught up to the delete OR seen `d` reconciled yet
+    const opBefore = [a, b, c];
+    const next = [a, b]; // deletes c
+    expect(reconcileCommit(prev, opBefore, next)).toEqual([a, b, d]);
+  });
+});
+
+describe('annotations-layer / reconcileForeignEcho (deletes must sync across tabs/peers)', () => {
+  const a: RectStroke = {
+    id: 'a',
+    tool: 'rect',
+    color: '#000',
+    width: 2,
+    x: 0,
+    y: 0,
+    w: 10,
+    h: 10,
+  };
+  const b: RectStroke = {
+    id: 'b',
+    tool: 'rect',
+    color: '#000',
+    width: 2,
+    x: 20,
+    y: 0,
+    w: 10,
+    h: 10,
+  };
+  const optimisticImage: ImageStroke = {
+    id: 'img',
+    tool: 'image',
+    x: 0,
+    y: 0,
+    w: 10,
+    h: 10,
+    href: 'blob:local-preview',
+  };
+
+  test('a foreign echo missing a non-ephemeral id (a real delete) is NOT reverted', () => {
+    const prev = [a, b];
+    const incoming = [a]; // peer deleted b
+    expect(reconcileForeignEcho(prev, incoming)).toEqual([a]);
+  });
+
+  test('a still-uploading local optimistic image (ephemeral href) survives a foreign echo that predates it', () => {
+    const prev = [a, optimisticImage];
+    const incoming = [a]; // the peer's broadcast was authored before our upload started
+    expect(reconcileForeignEcho(prev, incoming)).toEqual([a, optimisticImage]);
+  });
+});
+
+describe('annotations-layer / resolveImageUploadSwap (delete-during-upload must not resurrect)', () => {
+  // Adversarial-review finding: dropping an image, then Backspacing it
+  // before its upload resolves, used to resurrect it once the upload
+  // landed — the swap read "id absent from `before`" as render lag
+  // unconditionally, with no way to tell that apart from a genuine delete.
+  const optimistic: ImageStroke = {
+    id: 'img-1',
+    tool: 'image',
+    x: 0,
+    y: 0,
+    w: 10,
+    h: 10,
+    href: 'blob:optimistic-preview',
+  };
+  const sibling: RectStroke = {
+    id: 'sib',
+    tool: 'rect',
+    color: '#000',
+    width: 2,
+    x: 20,
+    y: 0,
+    w: 10,
+    h: 10,
+  };
+
+  test('deleted before the chain caught up to the optimistic insert (common case) → stays gone, no undo record', () => {
+    const before = [sibling]; // render lag — optimistic insert not reflected yet
+    const result = resolveImageUploadSwap(before, 'img-1', optimistic, 'assets/real.png', true);
+    expect(result).toBeNull();
+  });
+
+  test('deleted after the chain already had the optimistic entry → explicitly stripped from `after`', () => {
+    const before = [sibling, optimistic];
+    const result = resolveImageUploadSwap(before, 'img-1', optimistic, 'assets/real.png', true);
+    expect(result?.after).toEqual([sibling]);
+  });
+
+  test('NOT deleted + render lag (the original, still-valid case) → swaps to the real href', () => {
+    const before = [sibling]; // optimistic insert hasn't rendered into `before` yet
+    const result = resolveImageUploadSwap(before, 'img-1', optimistic, 'assets/real.png', false);
+    const img = result?.after.find((s) => s.id === 'img-1') as unknown as { href: string };
+    expect(img?.href).toBe('assets/real.png');
+    expect(result?.commitBefore).toEqual([sibling]); // undo excludes the never-committed blob: entry
+  });
+
+  test('NOT deleted, already present in `before` → swaps in place, sibling order preserved', () => {
+    const before = [sibling, optimistic];
+    const result = resolveImageUploadSwap(before, 'img-1', optimistic, 'assets/real.png', false);
+    expect(result?.after.map((s) => s.id)).toEqual(['sib', 'img-1']);
+    const img = result?.after.find((s) => s.id === 'img-1') as unknown as { href: string };
+    expect(img?.href).toBe('assets/real.png');
+  });
+});
+
 describe('annotations-layer / strokesShallowEqual (drag no-op gate)', () => {
   const pen: PenStroke = {
     id: 'p',

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -169,12 +169,49 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         // the gate on both — the catalogue route and the static PNG serve.
         '/_api/stickers',
         '/_stickers/some-pack/some-sticker.png',
+        // DDR-166 Phase 1 / T2 — the bundled intro-video media serve is
+        // MAIN-ORIGIN ONLY, same posture as /_stickers above: a Maude-product
+        // asset, absent from CANVAS_SAFE_API + startCanvasServer's routes.
+        '/_media/intro.mp4',
         // feature-footage-analysis-director — the footage-analysis + EDL sidecar
         // route is MAIN-ORIGIN ONLY (written by the analyst/director agents over
         // loopback; absent from CANVAS_SAFE_API + startCanvasServer's routes). The
         // untrusted canvas origin must never read/write the director's analysis —
         // a GET here 403s at the gate, not 405 from a reached handler.
         '/_api/footage',
+        // feature-ai-media-generation (DDR-16x) — the generation job queue +
+        // provider catalogue + key routes are MAIN-ORIGIN ONLY (they resolve a
+        // provider KEY and make outbound provider calls). The untrusted canvas
+        // origin must never reach them — it sees only the produced /assets/<sha8>.
+        // A GET here 403s at the gate, not 405/200 from a reached handler.
+        '/_api/generate-jobs',
+        '/_api/generate/providers',
+        '/_api/generate/keys',
+        // Task 2.6 — the non-secret transcription-engine preference writes into
+        // .design/config.json + hot-reloads; still MAIN-ORIGIN ONLY (the canvas
+        // must not steer the user's engine choice).
+        '/_api/generate/prefs',
+        // Task 2.5 — reuse-before-you-pay audio search + history re-download
+        // resolve the provider key server-side; MAIN-ORIGIN ONLY.
+        '/_api/generate/audio-search',
+        '/_api/generate/audio-reuse',
+        // Task 2.7 — managed whisper-model download (egress + local disk write);
+        // MAIN-ORIGIN ONLY.
+        '/_api/generate/whisper-model',
+        // DDR-166 plan, Phase 2 (T6) — the design-setup readiness probe (project/
+        // design-system/first-canvas/brand-assets progress) is a shell/onboarding
+        // concern, same posture as /_api/preflight above; MAIN-ORIGIN ONLY.
+        '/_api/setup-readiness',
+        // DDR-167 (Phase 3 / T10) — local-file SVG/PDF ingestion is a
+        // file-write + local-file-adjacent surface (Decision 4); MAIN-ORIGIN
+        // ONLY, same posture as /_api/asset's containment but privileged
+        // rather than canvas-reachable — the untrusted canvas iframe must
+        // never drive an import.
+        '/_api/import-asset',
+        // DDR-173 (Phase 3 / T12) — brand-file typed-cue extraction is a
+        // file-write surface (writes assets/logos/*), same privileged
+        // posture as /_api/import-asset above; MAIN-ORIGIN ONLY.
+        '/_api/import-brand',
         '/package.json',
       ]) {
         expect(await code(p)).toBe(403);

package/apps/studio/test/csp-canvas-shell.test.ts

@@ -48,4 +48,15 @@ describe('cspForCanvasShell — A6 hardening', () => {
     const csp = cspForCanvasShell(SHELL);
     expect(csp).not.toContain('frame-ancestors');
   });
+
+  // fix-photo-editor-followup-debt Task 22 — the narrow, documented
+  // `connect-src` exception for @imgly/background-removal's model-weight CDN.
+  // Regression guard against both directions of drift: the exception being
+  // silently reverted, AND further hosts creeping in beside it.
+  test('connect-src carries the exact staticimgly.com exception, no more', () => {
+    const csp = cspForCanvasShell(SHELL);
+    expect(csp).toContain("connect-src 'self' https://staticimgly.com");
+    const connectSrc = csp.split('; ').find((d) => d.startsWith('connect-src'));
+    expect(connectSrc).toBe("connect-src 'self' https://staticimgly.com");
+  });
 });