@1agh/maude 0.46.0 → 0.47.0

package/apps/studio/bin/curl-local.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# curl-local.sh — loopback-only curl. Thin shim over _curl-local.mjs; reached
+# via `maude design curl-local` (DDR-062), never a raw bin path. See
+# _curl-local.mjs for the full security rationale (DDR-185).
+#
+# Usage:
+#   curl-local.sh <curl-args...>
+#
+# Resolves every http(s) target among the given curl args and refuses to run
+# curl at all unless EVERY resolved address is loopback (127.0.0.0/8 or ::1).
+# Exit: curl's own exit code · 2 usage · 3 non-loopback target rejected · 1 other.
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+
+if ! command -v curl >/dev/null 2>&1; then
+  echo "curl-local.sh: curl is required." >&2
+  exit 1
+fi
+
+# Prefer node (always present with a maude install); fall back to bun in a dev
+# tree that has bun but a shimmed node. The module is pure Node ESM — no .ts.
+if command -v node >/dev/null 2>&1; then
+  exec node "$SCRIPT_DIR/_curl-local.mjs" "$@"
+elif command -v bun >/dev/null 2>&1; then
+  exec bun run "$SCRIPT_DIR/_curl-local.mjs" "$@"
+else
+  echo "curl-local.sh: node (or bun) is required." >&2
+  exit 1
+fi

package/apps/studio/canvas-cursors.ts

@@ -167,6 +167,12 @@ const STICKY = svgCursor(
 // shell-side code ever mutating an entry out from under the lookup (the canvas
 // runs cross-origin and can't reach it regardless — this is belt-and-braces).
 export const TOOL_CURSORS: Record<Tool, string> = Object.freeze({
+  // feature-4 (browse/move split) — the browse tool is a pure native
+  // pass-through, so it shows the SYSTEM cursor: `default` over the shell
+  // chrome, and (special-cased in use-tool-mode.tsx) native element cursors
+  // — pointer over buttons, text over inputs — over the live mock, so the
+  // canvas reads as ALIVE. Never a forced custom glyph.
+  browse: 'default',
   move: MOVE,
   hand: HAND,
   comment: COMMENT,