@1agh/maude 0.47.0 → 0.49.0

package/apps/studio/test/assets-s3.test.ts

@@ -0,0 +1,249 @@
+// Cloud Phase 3 Task 2 — the S3/R2 asset lane.
+//
+// Exercised against a live in-process S3-shaped server rather than MinIO: the
+// properties worth proving are content-addressing, verification of bytes
+// received from a semi-trusted hub, and never failing a local save because a
+// bucket was unreachable. None of those need a storage vendor.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+
+import { createServer, type Server } from 'node:http';
+import type { AddressInfo } from 'node:net';
+// The HUB's independent SigV4 implementation — imported to pin the two against
+// each other, exactly as the doc-namespace grammars are pinned.
+import { signRequest as hubSignRequest } from '../../hub/src/s3.mjs';
+import {
+  createAssetMirror,
+  type S3Config,
+  s3ConfigFromEnv,
+  sha8,
+  sha8FromAssetPath,
+  signRequest,
+  verifyAssetBytes,
+} from '../assets-s3.ts';
+
+let server: Server;
+let store: Map<string, Uint8Array>;
+let seenAuth: string[];
+let cfg: S3Config;
+
+beforeAll(async () => {
+  store = new Map();
+  seenAuth = [];
+  server = createServer((req, res) => {
+    seenAuth.push(req.headers.authorization ?? '');
+    const key = decodeURIComponent(
+      new URL(req.url ?? '/', 'http://x').pathname.replace('/maude-assets/', '')
+    );
+    if (req.method === 'PUT') {
+      const chunks: Buffer[] = [];
+      req.on('data', (c) => chunks.push(c));
+      req.on('end', () => {
+        store.set(key, new Uint8Array(Buffer.concat(chunks)));
+        res.writeHead(200).end();
+      });
+      return;
+    }
+    if (req.method === 'HEAD') {
+      res.writeHead(store.has(key) ? 200 : 404).end();
+      return;
+    }
+    if (req.method === 'GET') {
+      const body = store.get(key);
+      if (!body) {
+        res.writeHead(404).end();
+        return;
+      }
+      res.writeHead(200).end(Buffer.from(body));
+      return;
+    }
+    res.writeHead(405).end();
+  });
+  await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', () => resolve()));
+  cfg = {
+    endpoint: `http://127.0.0.1:${(server.address() as AddressInfo).port}`,
+    bucket: 'maude-assets',
+    accessKeyId: 'AKIAEXAMPLE',
+    secretAccessKey: 'secret',
+    region: 'auto',
+  };
+});
+
+afterAll(async () => {
+  await new Promise<void>((resolve) => server.close(() => resolve()));
+});
+
+const bytesFor = (s: string) => new TextEncoder().encode(s);
+const assetPath = (b: Uint8Array, ext = 'png') => `assets/${sha8(b)}.${ext}`;
+
+describe('content addressing', () => {
+  test('sha8 is stable and differs for different bytes', () => {
+    const a = bytesFor('hello');
+    expect(sha8(a)).toBe(sha8(new Uint8Array(a)));
+    expect(sha8(a)).not.toBe(sha8(bytesFor('hellp')));
+    expect(sha8(a)).toMatch(/^[0-9a-f]{8}$/);
+  });
+
+  test('sha8FromAssetPath accepts content-addressed paths and refuses others', () => {
+    expect(sha8FromAssetPath('assets/deadbeef.png')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef.mp4')).toBe('deadbeef');
+    // The shapes the REAL corpus contains beyond saveAsset's own output — a
+    // dotted sidecar and hash+label ingested footage. A stricter pattern
+    // classified these as "not content addressed", which made the mirror
+    // refuse legitimate assets as unverifiable.
+    expect(sha8FromAssetPath('assets/deadbeef.photo.json')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef.footage.json')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef-cloud.mp4')).toBe('deadbeef');
+    expect(sha8FromAssetPath('assets/deadbeef-cloud.srt')).toBe('deadbeef');
+    // Legacy / hand-placed / traversal shapes are not content-addressed. The
+    // 8 hex chars must be a COMPLETE token — `deadbeef1` is a different name.
+    expect(sha8FromAssetPath('assets/my-photo.png')).toBe(null);
+    expect(sha8FromAssetPath('assets/DEADBEEF.png')).toBe(null);
+    expect(sha8FromAssetPath('assets/deadbeef1.png')).toBe(null);
+    expect(sha8FromAssetPath('assets/deadbeefcafe.png')).toBe(null);
+    expect(sha8FromAssetPath('assets/sub/deadbeef.png')).toBe(null);
+    expect(sha8FromAssetPath('../assets/deadbeef.png')).toBe(null);
+    expect(sha8FromAssetPath('')).toBe(null);
+  });
+
+  test('verifyAssetBytes is the check that makes a semi-trusted hub usable', () => {
+    const bytes = bytesFor('the real image');
+    const path = assetPath(bytes);
+    expect(verifyAssetBytes(path, bytes)).toBe(true);
+    // ...including the labelled and sidecar shapes.
+    expect(verifyAssetBytes(`assets/${sha8(bytes)}-cloud.mp4`, bytes)).toBe(true);
+    expect(verifyAssetBytes(`assets/${sha8(bytes)}.photo.json`, bytes)).toBe(true);
+    // Substituted content under the same name — the attack DDR-054 describes.
+    expect(verifyAssetBytes(path, bytesFor('malicious replacement'))).toBe(false);
+    // A path with no content address cannot be verified, so it is not trusted.
+    expect(verifyAssetBytes('assets/logo.png', bytes)).toBe(false);
+  });
+});
+
+describe('config', () => {
+  test('an unconfigured lane is the default, not an error', () => {
+    expect(s3ConfigFromEnv({})).toBe(null);
+    // Partial config must not half-enable the lane.
+    expect(s3ConfigFromEnv({ MAUDE_S3_BUCKET: 'b', MAUDE_S3_ENDPOINT: 'e' })).toBe(null);
+    const mirror = createAssetMirror(null);
+    expect(mirror.configured).toBe(false);
+  });
+
+  test('a full env set configures it, trailing slash trimmed, region defaulted', () => {
+    const resolved = s3ConfigFromEnv({
+      MAUDE_S3_ENDPOINT: 'https://acct.r2.cloudflarestorage.com/',
+      MAUDE_S3_BUCKET: 'maude-assets',
+      MAUDE_S3_ACCESS_KEY_ID: 'AKIA',
+      MAUDE_S3_SECRET_ACCESS_KEY: 'secret',
+    });
+    expect(resolved?.endpoint).toBe('https://acct.r2.cloudflarestorage.com');
+    expect(resolved?.region).toBe('auto');
+  });
+});
+
+describe('SigV4 — pinned against the hub implementation', () => {
+  test('studio and hub sign the same request identically', () => {
+    // Two independent implementations in two independently-built packages. If
+    // they drift, one of them is wrong against real R2 and nobody would notice
+    // until a deploy.
+    const shared = {
+      endpoint: 'https://acct.r2.cloudflarestorage.com',
+      bucket: 'maude-assets',
+      accessKeyId: 'AKIAEXAMPLE',
+      secretAccessKey: 'wJalrXUtnFEMI',
+      region: 'auto',
+    };
+    const now = new Date('2026-07-28T20:30:00Z');
+    for (const key of ['assets/deadbeef.png', 'assets/a b+c!.png', 'assets/ünïcode.png']) {
+      for (const body of [null, bytesFor('payload')]) {
+        const mine = signRequest(shared, { method: 'PUT', key, body, now });
+        const theirs = hubSignRequest(shared, { method: 'PUT', key, body, now });
+        expect(mine.headers.authorization).toBe(theirs.headers.authorization);
+        expect(mine.url).toBe(theirs.url);
+      }
+    }
+  });
+
+  test('the payload is signed, so different bytes give a different signature', () => {
+    const now = new Date('2026-07-28T20:30:00Z');
+    const a = signRequest(cfg, { method: 'PUT', key: 'assets/x.png', body: bytesFor('a'), now });
+    const b = signRequest(cfg, { method: 'PUT', key: 'assets/x.png', body: bytesFor('b'), now });
+    expect(a.headers.authorization).not.toBe(b.headers.authorization);
+  });
+});
+
+describe('the mirror, against a live S3-shaped server', () => {
+  test('push then pull round-trips, and every request is signed', async () => {
+    const mirror = createAssetMirror(cfg);
+    const bytes = bytesFor('a small png, pretend');
+    const rel = assetPath(bytes);
+
+    expect(await mirror.push(rel, bytes)).toBe(true);
+    expect(await mirror.has(rel)).toBe(true);
+    const pulled = await mirror.pull(rel);
+    expect(pulled).not.toBe(null);
+    expect([...(pulled ?? [])]).toEqual([...bytes]);
+
+    expect(seenAuth.length).toBeGreaterThan(0);
+    expect(seenAuth.every((a) => a.startsWith('AWS4-HMAC-SHA256 Credential='))).toBe(true);
+  });
+
+  test('push is idempotent — content addressing means a re-push is a no-op', async () => {
+    const mirror = createAssetMirror(cfg);
+    const bytes = bytesFor('idempotent content');
+    const rel = assetPath(bytes);
+    expect(await mirror.push(rel, bytes)).toBe(true);
+    const sizeAfterFirst = store.size;
+    expect(await mirror.push(rel, bytes)).toBe(true);
+    expect(store.size).toBe(sizeAfterFirst);
+  });
+
+  test('a missing object pulls as null, not an error', async () => {
+    const mirror = createAssetMirror(cfg);
+    expect(await mirror.pull('assets/00000000.png')).toBe(null);
+    expect(await mirror.has('assets/00000000.png')).toBe(false);
+  });
+
+  test('SUBSTITUTED bytes are REFUSED — the hub cannot swap an asset', async () => {
+    // Plant content under a name it does not hash to, exactly as a compromised
+    // or malicious hub would. The pull must refuse rather than write it to disk,
+    // where it would poison every peer that later mirrors from us.
+    const honest = bytesFor('the real asset');
+    const rel = assetPath(honest);
+    store.set(rel, bytesFor('malicious replacement of the same length!!'));
+
+    const warnings: string[] = [];
+    const mirror = createAssetMirror(cfg, { log: { warn: (m: string) => warnings.push(m) } });
+    expect(await mirror.pull(rel)).toBe(null);
+    expect(warnings.join(' ')).toMatch(/does not hash to its own name/);
+  });
+
+  test('an unreachable bucket NEVER fails the caller — it returns false', async () => {
+    // The local file is already on disk and in git; the bucket is the redundant
+    // copy. Throwing here would turn a network blip into a failed save.
+    const dead = createAssetMirror(
+      { ...cfg, endpoint: 'http://127.0.0.1:1' },
+      { log: { warn: () => {} } }
+    );
+    expect(await dead.push('assets/deadbeef.png', bytesFor('x'))).toBe(false);
+    expect(await dead.pull('assets/deadbeef.png')).toBe(null);
+    expect(await dead.has('assets/deadbeef.png')).toBe(false);
+  });
+
+  test('a non-2xx response is handled like a miss, not a crash', async () => {
+    const mirror = createAssetMirror(
+      { ...cfg, bucket: 'wrong-bucket' },
+      { log: { warn: () => {} } }
+    );
+    expect(await mirror.pull('assets/deadbeef.png')).toBe(null);
+  });
+
+  test('the unconfigured mirror answers safely for every verb', async () => {
+    const mirror = createAssetMirror(null);
+    expect(await mirror.push('assets/deadbeef.png', bytesFor('x'))).toBe(false);
+    expect(await mirror.pull('assets/deadbeef.png')).toBe(null);
+    expect(await mirror.has('assets/deadbeef.png')).toBe(false);
+    expect(mirror.describe).toBe('none');
+  });
+});

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -62,6 +62,13 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
       for (const p of [
         '/_config',
         '/_sync-status',
+        // Cloud Phase 3 Task 3 — the sign-in handler RECEIVES A PASSWORD, and
+        // the disclosure route is main-origin UI chrome. Both are absent from
+        // CANVAS_SAFE_API and from startCanvasServer's route map, so a GET
+        // 403s at the gate rather than 405-ing from the handler — which is what
+        // proves the route is unreachable on this origin at all.
+        '/_api/workspace/sign-in',
+        '/_api/workspace/disclosure',
         '/_api/export',
         // feature-background-export-notification-center — the background job
         // routes carry the same privileged data class as /_api/export (job

package/apps/studio/test/collab-origin-gate.test.ts

@@ -0,0 +1,323 @@
+// Unit: the DDR-122 follow-up origin gate — untrusted canvas-realm doc ops may
+// never write the canvas SOURCE lanes (html / css / meta / syncMeta), while the
+// lanes the canvas legitimately co-authors (comments / annotations /
+// presentation) keep working for same-machine boards.
+//
+// Cloud Phase 1 Task 3. See apps/studio/collab/origins.ts for the threat model
+// and for why the gate needs a mirror doc rather than update-byte inspection.
+
+import { describe, expect, test } from 'bun:test';
+
+import * as encoding from 'lib0/encoding';
+import { writeUpdate } from 'y-protocols/sync';
+import * as Y from 'yjs';
+
+import {
+  isBodyLane,
+  isCanvasAuthorableLane,
+  isTrustedOrigin,
+  laneVocabulary,
+  markTrustedOrigin,
+  rootTypesTouched,
+  SHELL_EDIT_ORIGIN,
+  touchesBodyLane,
+} from '../collab/origins.ts';
+import { MESSAGE_SYNC } from '../collab/protocol.ts';
+import { createRoom, type RoomCallbacks, type RoomConn } from '../collab/room.ts';
+
+const MESSAGE_SYNC_UPDATE = 2; // y-protocols/sync messageYjsUpdate
+
+function makeConn(id: string, realm?: 'main' | 'canvas'): RoomConn & { recv: Uint8Array[] } {
+  const recv: Uint8Array[] = [];
+  return {
+    id,
+    ...(realm ? { realm } : {}),
+    send(payload: Uint8Array) {
+      recv.push(payload);
+    },
+    recv,
+  };
+}
+
+function makeCallbacks(): RoomCallbacks {
+  return {
+    seed() {
+      /* nothing on disk */
+    },
+    persistJson() {
+      /* no-op */
+    },
+    persistBinary() {
+      /* no-op */
+    },
+  };
+}
+
+/** Frame a raw Y update as a y-websocket MESSAGE_SYNC / update frame. */
+function syncUpdateFrame(update: Uint8Array): Uint8Array {
+  const encoder = encoding.createEncoder();
+  encoding.writeVarUint(encoder, MESSAGE_SYNC);
+  writeUpdate(encoder, update);
+  return encoding.toUint8Array(encoder);
+}
+
+/**
+ * Build the frame a malicious (or merely careless) canvas peer would send: it
+ * mirrors the room's current state, mutates locally, and ships the delta —
+ * exactly what `use-collab.tsx` does, minus lock 1.
+ */
+function peerDelta(room: { doc: Y.Doc }, mutate: (doc: Y.Doc) => void): Uint8Array {
+  const peer = new Y.Doc();
+  Y.applyUpdate(peer, Y.encodeStateAsUpdate(room.doc));
+  const before = Y.encodeStateVector(peer);
+  mutate(peer);
+  return Y.encodeStateAsUpdate(peer, before);
+}
+
+describe('origins — lane vocabulary + trusted sentinels', () => {
+  test('body lanes and canvas-authorable lanes are disjoint and complete', () => {
+    const { body, canvasAuthorable } = laneVocabulary();
+    expect(body).toEqual(['css', 'html', 'meta', 'syncMeta']);
+    expect(canvasAuthorable).toEqual(['annotations', 'comments', 'presentation']);
+    for (const lane of body) {
+      expect(isBodyLane(lane)).toBe(true);
+      expect(isCanvasAuthorableLane(lane)).toBe(false);
+    }
+    for (const lane of canvasAuthorable) {
+      expect(isBodyLane(lane)).toBe(false);
+      expect(isCanvasAuthorableLane(lane)).toBe(true);
+    }
+  });
+
+  test('a forged origin object is NOT trusted; only the real sentinel is', () => {
+    expect(isTrustedOrigin(SHELL_EDIT_ORIGIN)).toBe(true);
+    // The exact shape of the sentinel, rebuilt by an attacker who read the source.
+    expect(isTrustedOrigin({ maudeOrigin: 'shell-edit' })).toBe(false);
+    expect(isTrustedOrigin('shell-edit')).toBe(false);
+    expect(isTrustedOrigin(null)).toBe(false);
+    expect(isTrustedOrigin(undefined)).toBe(false);
+  });
+
+  test('markTrustedOrigin registers a frozen object and returns it', () => {
+    const sentinel = markTrustedOrigin(Object.freeze({ maudeOrigin: 'test' }));
+    expect(isTrustedOrigin(sentinel)).toBe(true);
+  });
+
+  test('rootTypesTouched resolves nested types up to their root', () => {
+    const doc = new Y.Doc();
+    const seen: Set<string>[] = [];
+    doc.on('afterTransaction', (tr: Y.Transaction) => {
+      if (tr.origin === 'probe') seen.push(rootTypesTouched(tr));
+    });
+    doc.transact(() => {
+      const nested = new Y.Map<string>();
+      doc.getArray<Y.Map<string>>('comments').push([nested]);
+      nested.set('text', 'hi');
+    }, 'probe');
+    expect(seen.length).toBe(1);
+    expect([...(seen[0] ?? [])]).toEqual(['comments']);
+  });
+
+  test('touchesBodyLane discriminates body writes from comment writes', () => {
+    const doc = new Y.Doc();
+    const verdicts: boolean[] = [];
+    doc.on('afterTransaction', (tr: Y.Transaction) => {
+      if (tr.origin === 'probe') verdicts.push(touchesBodyLane(tr));
+    });
+    doc.transact(() => doc.getArray('comments').push([{ id: 'c1' }]), 'probe');
+    doc.transact(() => doc.getText('html').insert(0, '<b>x</b>'), 'probe');
+    // An insert into EXISTING text — the case whose target lane is absent from
+    // the update bytes (origins.ts § "why a mirror doc").
+    doc.transact(() => doc.getText('html').insert(3, 'evil'), 'probe');
+    expect(verdicts).toEqual([false, true, true]);
+  });
+});
+
+describe('room origin gate — canvas realm', () => {
+  test('REJECTS a canvas-realm write to the body lane; doc untouched, not broadcast', async () => {
+    const room = createRoom('ui-screen', makeCallbacks());
+    const shell = makeConn('shell', 'main');
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(shell);
+    await room.connect(canvas);
+    shell.recv.length = 0;
+
+    // Seed a body through the trusted path so the attack is an insert into
+    // EXISTING text — the case update-byte inspection cannot classify.
+    room.doc.transact(() => room.doc.getText('html').insert(0, '<main>ok</main>'), 'sync-agent');
+    shell.recv.length = 0;
+    canvas.recv.length = 0;
+
+    const evil = peerDelta(room, (d) => d.getText('html').insert(6, 'PWNED'));
+    room.receive(canvas, syncUpdateFrame(evil));
+
+    expect(room.doc.getText('html').toString()).toBe('<main>ok</main>');
+    expect(room.gateRefusals()).toBe(1);
+    // Nothing reached the other peer.
+    expect(shell.recv.length).toBe(0);
+    // The refused peer got a corrective full-state frame instead.
+    expect(canvas.recv.length).toBe(1);
+    await room.destroy();
+  });
+
+  test('REJECTS canvas-realm writes to css, meta and syncMeta too', async () => {
+    for (const [lane, mutate] of [
+      ['css', (d: Y.Doc) => d.getText('css').insert(0, '.evil{}')],
+      ['meta', (d: Y.Doc) => d.getText('meta').insert(0, '{"evil":1}')],
+      ['syncMeta', (d: Y.Doc) => d.getMap('syncMeta').set('bodyEditAt', 1)],
+    ] as const) {
+      const room = createRoom(`lane-${lane}`, makeCallbacks());
+      const canvas = makeConn('canvas', 'canvas');
+      await room.connect(canvas);
+      room.receive(canvas, syncUpdateFrame(peerDelta(room, mutate)));
+      expect(room.gateRefusals()).toBe(1);
+      expect(Y.encodeStateAsUpdate(room.doc).length).toBe(
+        Y.encodeStateAsUpdate(new Y.Doc()).length
+      );
+      await room.destroy();
+    }
+  });
+
+  test('ALLOWS canvas-realm comments + annotations (same-machine boards keep working)', async () => {
+    const room = createRoom('board', makeCallbacks());
+    const shell = makeConn('shell', 'main');
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(shell);
+    await room.connect(canvas);
+    shell.recv.length = 0;
+
+    room.receive(
+      canvas,
+      syncUpdateFrame(
+        peerDelta(room, (d) => {
+          d.getArray('comments').push([{ id: 'c1', text: 'from the canvas' }]);
+          d.getMap('annotations').set('svg', '<svg><rect/></svg>');
+        })
+      )
+    );
+
+    expect(room.doc.getArray('comments').toArray()).toEqual([
+      { id: 'c1', text: 'from the canvas' },
+    ]);
+    expect(room.doc.getMap('annotations').get('svg')).toBe('<svg><rect/></svg>');
+    expect(room.gateRefusals()).toBe(0);
+    // And it DID reach the other peer.
+    expect(shell.recv.length).toBeGreaterThan(0);
+    await room.destroy();
+  });
+
+  test('a mixed frame is refused WHOLESALE — no partial application of the good half', async () => {
+    const room = createRoom('mixed', makeCallbacks());
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(canvas);
+
+    room.receive(
+      canvas,
+      syncUpdateFrame(
+        peerDelta(room, (d) => {
+          d.getArray('comments').push([{ id: 'decoy' }]);
+          d.getText('html').insert(0, 'PWNED');
+        })
+      )
+    );
+
+    expect(room.gateRefusals()).toBe(1);
+    expect(room.doc.getArray('comments').length).toBe(0);
+    expect(room.doc.getText('html').toString()).toBe('');
+    await room.destroy();
+  });
+
+  test('the gate SURVIVES a refusal — the next honest canvas frame still applies', async () => {
+    const room = createRoom('recover', makeCallbacks());
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(canvas);
+
+    room.receive(canvas, syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'x'))));
+    expect(room.gateRefusals()).toBe(1);
+
+    room.receive(
+      canvas,
+      syncUpdateFrame(peerDelta(room, (d) => d.getArray('comments').push([{ id: 'after' }])))
+    );
+    expect(room.gateRefusals()).toBe(1);
+    expect(room.doc.getArray('comments').toArray()).toEqual([{ id: 'after' }]);
+    await room.destroy();
+  });
+
+  test('the MAIN realm is ungated — the shell may still write the body', async () => {
+    const room = createRoom('shell-write', makeCallbacks());
+    const shell = makeConn('shell', 'main');
+    await room.connect(shell);
+
+    room.receive(shell, syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'ok'))));
+
+    expect(room.doc.getText('html').toString()).toBe('ok');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a conn with no realm defaults to trusted (pre-existing callers unchanged)', async () => {
+    const room = createRoom('legacy', makeCallbacks());
+    const legacy = makeConn('legacy');
+    await room.connect(legacy);
+
+    room.receive(
+      legacy,
+      syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'ok')))
+    );
+
+    expect(room.doc.getText('html').toString()).toBe('ok');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('awareness frames from the canvas realm pass through the gate untouched', async () => {
+    const room = createRoom('presence', makeCallbacks());
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(canvas);
+
+    // A well-formed awareness frame from a peer's own Awareness instance.
+    const peerDoc = new Y.Doc();
+    const { Awareness, encodeAwarenessUpdate } = await import('y-protocols/awareness');
+    const peerAwareness = new Awareness(peerDoc);
+    peerAwareness.setLocalState({ name: 'canvas peer' });
+    const encoder = encoding.createEncoder();
+    encoding.writeVarUint(encoder, 1 /* MESSAGE_AWARENESS */);
+    encoding.writeVarUint8Array(
+      encoder,
+      encodeAwarenessUpdate(peerAwareness, [peerAwareness.clientID])
+    );
+    room.receive(canvas, encoding.toUint8Array(encoder));
+
+    expect(room.awareness.getStates().get(peerAwareness.clientID)).toEqual({ name: 'canvas peer' });
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a malformed sync frame from the canvas realm mutates nothing and leaves the room usable', async () => {
+    const room = createRoom('garbage', makeCallbacks());
+    const canvas = makeConn('canvas', 'canvas');
+    await room.connect(canvas);
+
+    const encoder = encoding.createEncoder();
+    encoding.writeVarUint(encoder, MESSAGE_SYNC);
+    encoding.writeVarUint(encoder, MESSAGE_SYNC_UPDATE);
+    encoding.writeVarUint8Array(encoder, new Uint8Array([0xff, 0xff, 0xff, 0xff]));
+    // yjs swallows an undecodable update internally rather than throwing, so
+    // this is not a *gate* refusal — it never becomes a transaction at all, on
+    // the mirror or on the room doc. Assert the property that matters: nothing
+    // applied, no crash, and the gate still works afterwards.
+    room.receive(canvas, encoding.toUint8Array(encoder));
+
+    expect(Y.encodeStateAsUpdate(room.doc).length).toBe(Y.encodeStateAsUpdate(new Y.Doc()).length);
+
+    room.receive(canvas, syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'x'))));
+    expect(room.gateRefusals()).toBe(1);
+    room.receive(
+      canvas,
+      syncUpdateFrame(peerDelta(room, (d) => d.getArray('comments').push([{ id: 'ok' }])))
+    );
+    expect(room.doc.getArray('comments').toArray()).toEqual([{ id: 'ok' }]);
+    await room.destroy();
+  });
+});

package/apps/studio/test/exporters/pdf.test.ts

@@ -6,9 +6,12 @@
 // via a synthetic single-target run that short-circuits screenshot.
 
 import { describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import path from 'node:path';
 
 import { PDFDocument } from 'pdf-lib';
-import { run } from '../../exporters/pdf.ts';
+import { assertTotalSizeOk, MAX_TOTAL_OUTPUT_BYTES, run } from '../../exporters/pdf.ts';
 
 const CTX = {
   designRoot: '/tmp/.design',
@@ -31,6 +34,35 @@ describe('pdf adapter — contract', () => {
   });
 });
 
+describe('pdf adapter — total output-size guard (RCA issue-desktop-print-pdf-save-as-hang-large-payload)', () => {
+  test('passes when total bytes are under the ceiling', () => {
+    const tmp = mkdtempSync(path.join(tmpdir(), 'maude-pdf-guard-'));
+    try {
+      const p = path.join(tmp, 'a.pdf');
+      writeFileSync(p, Buffer.alloc(1024));
+      expect(() => assertTotalSizeOk([p])).not.toThrow();
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  test('throws an actionable error when total bytes exceed the ceiling', () => {
+    const tmp = mkdtempSync(path.join(tmpdir(), 'maude-pdf-guard-'));
+    try {
+      // Two files, each just over half the ceiling — sums past the limit
+      // without needing to actually allocate a giant single buffer.
+      const half = Math.ceil(MAX_TOTAL_OUTPUT_BYTES / 2) + 1024;
+      const a = path.join(tmp, 'a.pdf');
+      const b = path.join(tmp, 'b.pdf');
+      writeFileSync(a, Buffer.alloc(half));
+      writeFileSync(b, Buffer.alloc(half));
+      expect(() => assertTotalSizeOk([a, b])).toThrow(/too large/i);
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+});
+
 describe('pdf-lib smoke — embed + save', () => {
   test('embeds a PNG and produces a valid PDF buffer', async () => {
     const pdf = await PDFDocument.create();