@1agh/maude 0.49.2 → 0.51.0

package/apps/studio/http.ts

@@ -27,6 +27,7 @@ import { TranspileError } from './canvas-pipeline.ts';
 import type { AiActivity } from './collab/ai-activity.ts';
 import type { Context } from './context.ts';
 import { reloadConfig } from './context.ts';
+import { buildDebugBundle } from './debug-bundle.ts';
 import { probeSetupReadiness } from './design-setup-readiness.ts';
 import { type Format, isFormat, isScope, type Scope } from './exporters/index.ts';
 import { type ExportJobQueue, ExportQueueFullError } from './exporters/jobs.ts';
@@ -77,6 +78,7 @@ import {
 } from './generation/whisper-models.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
+import { createCloudEndpoints } from './cloud/endpoints.ts';
 import { createGitHubEndpoints } from './github/endpoints.ts';
 import type { Inspect } from './inspect.ts';
 import { canvasSlug, writeLocator } from './locator.ts';
@@ -87,7 +89,7 @@ import { getRuntimeBundle, packageForSlug } from './runtime-bundle.ts';
 import { linkHub } from './sync/hub-link.ts';
 import { signInToWorkspace, workspaceDisclosure } from './sync/workspace-signin.ts';
 import { readUiPrefs, type UiPrefs, writeUiPrefs } from './ui-prefs.ts';
-import { loadWhatsNew } from './whats-new.ts';
+import { loadWhatsNew, resolveMaudeVersion } from './whats-new.ts';
 import { isLoopbackHost } from './ws.ts';
 
 // Real disk install root — never the virtual `/$bunfs/root` of compiled bins.
@@ -837,6 +839,11 @@ export function createHttp(
   // and every route is token-bearing (server-held keychain token via the loopback
   // bridge), so all four also carry a loopback-Host check.
   const githubApi = createGitHubEndpoints(ctx);
+  // Cloud Phase 23 C3 — `/_api/cloud/*`. Same dual-allowlist rule as the
+  // GitHub routes: MAIN-ORIGIN ONLY (absent from CANVAS_SAFE_API +
+  // startCanvasServer) and loopback-Host gated — every route either bears or
+  // stores the cloud credential.
+  const cloudApi = createCloudEndpoints(ctx);
   const gitJson = (r: { status: number; json: unknown }) =>
     Response.json(r.json, { status: r.status, headers: { 'Cache-Control': 'no-store' } });
 
@@ -1164,6 +1171,84 @@ export function createHttp(
     '/_api/whats-new': () =>
       Response.json(loadWhatsNew(), { headers: { 'Cache-Control': 'no-store' } }),
 
+    // feature-bug-report-button — the scrubbed diagnostic bundle the Report-a-Bug
+    // dialog previews for consent. PRIVILEGED (logs could reveal paths pre-scrub;
+    // the scrubber runs here, server-side): MAIN-ORIGIN ONLY — absent from
+    // CANVAS_SAFE_API + startCanvasServer routes — plus the same double gate as
+    // /_api/acp/status (a drive-by page must not read logs via DNS rebinding).
+    '/_api/debug-bundle': (req: Request) => {
+      if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      return Response.json(
+        buildDebugBundle({
+          maudeVersion: resolveMaudeVersion(),
+          projectName: ctx.cfg.name ?? null,
+          activeCanvas: (inspect.state as { active?: string | null }).active ?? null,
+          repoRoot: ctx.paths.repoRoot,
+        }),
+        { headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    // feature-bug-report-button — submit proxy. The client never talks to
+    // cloud.maude.sh directly (no CORS surface to open, and the endpoint can be
+    // overridden for self-hosters/tests via MAUDE_REPORT_URL). Forwards the
+    // multipart body verbatim; the cloud route owns validation + quota.
+    // PRIVILEGED: main-origin only + double gate (it triggers outbound network).
+    '/_api/report': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const endpoint = process.env.MAUDE_REPORT_URL || 'https://cloud.maude.sh/report';
+      try {
+        const upstream = await fetch(endpoint, {
+          method: 'POST',
+          body: await req.formData(),
+          signal: AbortSignal.timeout(30_000),
+        });
+        const body = await upstream.text();
+        return new Response(body, {
+          status: upstream.status,
+          headers: { 'content-type': 'application/json', 'Cache-Control': 'no-store' },
+        });
+      } catch {
+        // Unreachable/timeout — the client falls back to the local bundle path.
+        return Response.json({ error: 'report service unreachable' }, { status: 502 });
+      }
+    },
+
+    // feature-bug-report-button — offline/declined fallback: persist the bundle
+    // locally under `<designRoot>/_reports/<ts>/` (gitignored runtime state,
+    // DDR-115 taxonomy) so the user can attach it to a hand-filed issue.
+    // PRIVILEGED: main-origin only + double gate (filesystem write).
+    '/_api/report-fallback': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{ report?: unknown; screenshots?: unknown }>(req);
+      if (!body || typeof body.report !== 'object' || body.report === null) {
+        return new Response('body must include { report }', { status: 400 });
+      }
+      const shots = Array.isArray(body.screenshots) ? body.screenshots.slice(0, 3) : [];
+      const dir = join(ctx.paths.designRoot, '_reports', String(Date.now()));
+      await Bun.write(join(dir, 'report.json'), JSON.stringify(body.report, null, 2));
+      let n = 0;
+      for (const shot of shots) {
+        if (typeof shot !== 'string') continue;
+        const m = /^data:image\/(png|jpeg);base64,([A-Za-z0-9+/=]+)$/.exec(shot);
+        if (!m || m[2].length > 7_000_000) continue; // ~5 MB decoded cap
+        n += 1;
+        await Bun.write(join(dir, `screenshot-${n}.${m[1] === 'png' ? 'png' : 'jpg'}`), Buffer.from(m[2], 'base64'));
+      }
+      return Response.json(
+        { dir: relative(ctx.paths.repoRoot, dir), screenshots: n },
+        { headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_index-data': async () =>
       Response.json(await api.buildIndexData(), { headers: { 'Cache-Control': 'no-store' } }),
 
@@ -1515,6 +1600,66 @@ export function createHttp(
       );
     },
 
+    // feature-file-tree-drag-drop-folders (Task 5) — move/rename a canvas.
+    // POST body { file, toDir } -> 200 { fromRel, toRel, fromSlug, toSlug, moved[] }
+    // Same guard stack as /_api/canvas, copied verbatim: MAIN ORIGIN ONLY —
+    // intentionally absent from BOTH startCanvasServer's allowlist and
+    // CANVAS_SAFE_API (DDR-054/DDR-088) — the untrusted canvas iframe origin
+    // must never reach a file-move endpoint. Validation lives in
+    // api.moveCanvas (containment + non-DS-group allowlist + collision +
+    // collab-pin guard).
+    '/_api/fs-move': async (req: Request) => {
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      const body = await readJson<{ file?: unknown; toDir?: unknown }>(req, 4 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.moveCanvas(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        {
+          ok: true,
+          fromRel: result.fromRel,
+          toRel: result.toRel,
+          fromSlug: result.fromSlug,
+          toSlug: result.toSlug,
+          moved: result.moved,
+        },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    // feature-file-tree-drag-drop-folders (Task 5) — create an empty folder.
+    // POST body { parent?, name } -> 201 { dir }. Same guard stack, same
+    // MAIN-ORIGIN-ONLY / dual-allowlist posture as /_api/fs-move above.
+    '/_api/fs-mkdir': async (req: Request) => {
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      const body = await readJson<{ parent?: unknown; name?: unknown }>(req, 4 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.createFolder(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, dir: result.dir },
+        { status: 201, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     // ── Phase 27 (E2) — in-UI git layer. Save version / Publish / Get latest /
     // History / visual diff. All MAIN-ORIGIN ONLY (see gitApi comment above).
     // POST routes add the sameOriginWrite CSRF guard (cross-site forged POST);
@@ -1663,6 +1808,65 @@ export function createHttp(
     // since every one is token-bearing. (Sign-out is the `github_sign_out` Tauri
     // command — the dev-server can't touch the OS keychain — so there is no
     // DELETE /_api/github/identity here; see DDR-114.)
+    '/_api/cloud/status': async (req: Request) => {
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      return gitJson(cloudApi.status());
+    },
+    '/_api/cloud/signin/start': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      return gitJson(await cloudApi.signinStart());
+    },
+    '/_api/cloud/signin/poll': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      const body = (await req.json().catch(() => ({}))) as { deviceCode?: string };
+      return gitJson(await cloudApi.signinPoll(String(body.deviceCode ?? '')));
+    },
+    '/_api/cloud/signout': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      return gitJson(cloudApi.signout());
+    },
+    '/_api/cloud/projects': async (req: Request) => {
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      return gitJson(await cloudApi.projects());
+    },
+    '/_api/cloud/attach': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      const body = (await req.json().catch(() => ({}))) as { project?: string };
+      return gitJson(await cloudApi.attach(String(body.project ?? '')));
+    },
+    '/_api/cloud/attach/code': async (req: Request) => {
+      // The maude:// lane (Phase 17): a one-time handoff code from a deep
+      // link. Same gates as attach; the code is exchanged only against the
+      // CONFIGURED cloud address, never one the link named.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      const body = (await req.json().catch(() => ({}))) as { code?: string };
+      return gitJson(await cloudApi.attachCode(String(body.code ?? '')));
+    },
+
     '/_api/github/identity': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       if (!isLoopbackHost(req.headers.get('host')))

package/apps/studio/inspect.ts

@@ -101,6 +101,16 @@ export interface Inspect {
   setActive(file: string): void;
   setOpenTabs(tabs: string[]): void;
   setSelected(sel: SetSelectedInput): void;
+  /**
+   * feature-file-tree-drag-drop-folders (Task 3) — a canvas moved server-side
+   * (`moveCanvas`). Retarget every reference to the OLD designRel-prefixed
+   * file path (`active`, `open_tabs[]`, the active `selected`) to the new
+   * one, and re-key the parked `selections` map entry from the old slug to
+   * the new one. Returns whether anything actually changed (so the caller
+   * can skip an unnecessary `canvas-list-update` detail). Idempotent no-op
+   * when the moved canvas wasn't referenced anywhere in this state.
+   */
+  retarget(fromFile: string, toFile: string): boolean;
   save(): Promise<void>;
   injectInspector(html: string): string;
 }
@@ -313,6 +323,44 @@ export function createInspect(
     ctx.bus.emit('selected', state.selected);
   }
 
+  function retarget(fromFile: string, toFile: string): boolean {
+    const fromSlug = deriveCanvasSlug(fromFile);
+    const toSlug = deriveCanvasSlug(toFile);
+    let changed = false;
+
+    if (state.active === fromFile) {
+      state.active = toFile;
+      changed = true;
+    }
+    if (state.open_tabs.includes(fromFile)) {
+      state.open_tabs = state.open_tabs.map((t) => (t === fromFile ? toFile : t));
+      changed = true;
+    }
+    if (Object.hasOwn(state.selections, fromSlug)) {
+      state.selections[toSlug] = state.selections[fromSlug] as SelectedValue;
+      delete state.selections[fromSlug];
+      changed = true;
+    }
+    if (state.selected != null) {
+      const list = Array.isArray(state.selected) ? state.selected : [state.selected];
+      let selChanged = false;
+      const next = list.map((e) => {
+        if (e.canvas !== fromSlug) return e;
+        selChanged = true;
+        return { ...e, canvas: toSlug, file: e.file === fromFile ? toFile : e.file };
+      });
+      if (selChanged) {
+        state.selected = Array.isArray(state.selected) ? next : (next[0] ?? null);
+        changed = true;
+      }
+    }
+
+    if (!changed) return false;
+    state.last_change = new Date().toISOString();
+    scheduleSave();
+    return true;
+  }
+
   /**
    * Canvas slug for v2 selections. Mirrors `canvasSlug()` from locator.ts but
    * accepts a designRoot-relative `file` path (which is what the iframe reports)
@@ -336,6 +384,7 @@ export function createInspect(
     setActive,
     setOpenTabs,
     setSelected,
+    retarget,
     save,
     injectInspector,
   };

package/apps/studio/server.ts

@@ -62,6 +62,10 @@ ctx.sharedDoc = /^(1|true|on|yes)$/i.test(process.env.MAUDE_SHARED_DOC ?? '');
 // synchronously below; the callback only fires at runtime, by which point the
 // binding is set.
 let collab: ReturnType<typeof createCollab> | null = null;
+// Forward-declared for the same reason — moveCanvas (feature-file-tree-
+// drag-drop-folders, Task 3) retargets `_active.json` through the live
+// Inspect instance, which is constructed after `api`.
+let inspectHandle: ReturnType<typeof createInspect> | null = null;
 
 const api = createApi(ctx, {
   onCommentsChanged: async (file) => {
@@ -82,9 +86,20 @@ const api = createApi(ctx, {
       collab.registry.syncRoomFromAnnotations(api.fileSlug(file), svg);
     }
   },
+  // feature-file-tree-drag-drop-folders (Task 3) — moveCanvas's collab guard
+  // + `_active.json` retarget, bridged the same forward-declared way as the
+  // comments/annotations hooks above.
+  isRoomPinned: (slug) => collab?.registry.isPinned(slug) ?? false,
+  flushAndDropRoom: async (slug) => {
+    if (collab) await collab.registry.forceDrop(slug);
+  },
+  retargetActive: (fromFile, toFile) => {
+    inspectHandle?.retarget(fromFile, toFile);
+  },
 });
 
 const inspect = createInspect(ctx, (file) => api.loadCommentsForFile(file));
+inspectHandle = inspect;
 await inspect.load();
 
 collab = createCollab(ctx, api);

package/apps/studio/sync/workspace-signin.ts

@@ -53,6 +53,7 @@ export type SignInFailure =
   | 'unreachable'
   | 'not-a-maude-workspace'
   | 'bad-credentials'
+  | 'cloud-identity'
   | 'rate-limited'
   | 'save-failed'
   | 'server-error';
@@ -148,6 +149,20 @@ export async function signInToWorkspace(
   if (res.status === 429) {
     return fail(429, 'Too many attempts. Wait a minute and try again.', 'rate-limited');
   }
+  if (res.status === 400) {
+    // The ONE refusal that comes with directions (Phase 23 B3): a cloud
+    // workspace saying "this door signs in through Maude Cloud" — or a viewer
+    // being told what viewing needs. Swallowing it into "try again shortly"
+    // turned the most actionable message on this path into a shrug.
+    let message = 'The workspace refused the sign-in.';
+    try {
+      const body = (await res.json()) as { error?: unknown };
+      if (typeof body.error === 'string' && body.error) message = body.error;
+    } catch {
+      /* keep the generic sentence */
+    }
+    return fail(400, message, 'cloud-identity');
+  }
   if (!res.ok) {
     return fail(502, 'The workspace refused the sign-in. Try again shortly.', 'server-error');
   }

package/apps/studio/test/canvas-artifacts.test.ts

@@ -0,0 +1,125 @@
+// canvas-artifacts.ts — the canonical artifact inventory. Pure, no server boot
+// needed: cover inventory completeness, the divergent `_locator.json` slug
+// shape, and relocatedName()'s path math for both a pure directory move and a
+// combined move+rename.
+
+import { describe, expect, test } from 'bun:test';
+import path from 'node:path';
+
+import { canvasArtifacts, locatorKeyFor, relocatedName } from '../canvas-artifacts.ts';
+import type { Paths } from '../context.ts';
+
+function fakePaths(repoRoot: string): Paths {
+  const designRoot = path.join(repoRoot, '.design');
+  return {
+    repoRoot,
+    designRel: '.design',
+    designRoot,
+    serverInfoFile: path.join(designRoot, '_server.json'),
+    activeFile: path.join(designRoot, '_active.json'),
+    commentsDir: path.join(designRoot, '_comments'),
+    canvasStateDir: path.join(designRoot, '_canvas-state'),
+    historyDir: path.join(designRoot, '_history'),
+    tokensUrlRel: '.design/system/colors_and_type.css',
+    systemDirRel: 'system',
+  };
+}
+
+describe('canvasArtifacts', () => {
+  const paths = fakePaths('/repo');
+
+  test('lists the primary + siblings + every slug-keyed sidecar', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const abs = artifacts.map((a) => a.abs);
+    expect(abs).toContain(path.join(paths.designRoot, 'ui', 'Foo.tsx'));
+    expect(abs).toContain(path.join(paths.designRoot, 'ui', 'Foo.meta.json'));
+    expect(abs).toContain(path.join(paths.designRoot, 'ui', 'Foo.css'));
+    expect(abs).toContain(path.join(paths.designRoot, 'ui', 'Foo.registry.json'));
+    const slug = 'ui-foo';
+    expect(abs).toContain(path.join(paths.historyDir, slug));
+    expect(abs).toContain(path.join(paths.canvasStateDir, `${slug}.json`));
+    expect(abs).toContain(path.join(paths.canvasStateDir, `${slug}.view.json`));
+    expect(abs).toContain(path.join(paths.commentsDir, `${slug}.json`));
+    expect(abs).toContain(path.join(paths.designRoot, '_state', `${slug}.ydoc.bin`));
+    expect(abs).toContain(path.join(paths.designRoot, `${slug}.annotations.svg`));
+    expect(abs).toContain(path.join(paths.designRoot, `${slug}.edl.json`));
+  });
+
+  test('does NOT include _photo/ or _draw/ (asset-keyed / mark-slug-keyed, not canvas-slug-keyed)', () => {
+    const abs = canvasArtifacts({ rel: 'ui/Foo.tsx', paths }).map((a) => a.abs);
+    expect(abs.some((p) => p.includes('_photo'))).toBe(false);
+    expect(abs.some((p) => p.includes('_draw'))).toBe(false);
+  });
+
+  test('marks exactly one primary and the rest sibling/slug-keyed', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const primaries = artifacts.filter((a) => a.kind === 'primary');
+    expect(primaries.length).toBe(1);
+    expect(primaries[0]?.abs).toBe(path.join(paths.designRoot, 'ui', 'Foo.tsx'));
+  });
+
+  test('handles a nested rel (subfolder)', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/sub/Bar.tsx', paths });
+    const primary = artifacts.find((a) => a.kind === 'primary');
+    expect(primary?.abs).toBe(path.join(paths.designRoot, 'ui', 'sub', 'Bar.tsx'));
+    const slug = 'ui-sub-bar';
+    expect(artifacts.some((a) => a.abs === path.join(paths.historyDir, slug))).toBe(true);
+  });
+});
+
+describe('locatorKeyFor — the DIVERGENT slug shape', () => {
+  test('posix, extension-less, NOT lowercased or dash-flattened', () => {
+    expect(locatorKeyFor('ui/Onboarding Brief.tsx')).toBe('ui/Onboarding Brief');
+  });
+
+  test('differs from canvasSlugFromRel for a mixed-case / spaced name', () => {
+    // canvasSlugFromRel('ui/Onboarding Brief.tsx', ...) => 'ui-onboarding_brief'
+    expect(locatorKeyFor('ui/Onboarding Brief.tsx')).not.toBe('ui-onboarding_brief');
+  });
+});
+
+describe('relocatedName', () => {
+  const paths = fakePaths('/repo');
+
+  test('pure directory move (basename unchanged) — siblings track the new dir', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const primary = artifacts.find((a) => a.kind === 'primary');
+    if (!primary) throw new Error('no primary');
+    expect(relocatedName(primary, 'ui/Foo.tsx', 'ui/sub/Foo.tsx', paths)).toBe(
+      path.join(paths.designRoot, 'ui', 'sub', 'Foo.tsx')
+    );
+    const meta = artifacts.find((a) => a.abs.endsWith('Foo.meta.json'));
+    if (!meta) throw new Error('no meta sibling');
+    expect(relocatedName(meta, 'ui/Foo.tsx', 'ui/sub/Foo.tsx', paths)).toBe(
+      path.join(paths.designRoot, 'ui', 'sub', 'Foo.meta.json')
+    );
+  });
+
+  test('slug-keyed sidecars stay in their fixed dir but re-key the filename', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const history = artifacts.find((a) => a.abs === path.join(paths.historyDir, 'ui-foo'));
+    if (!history) throw new Error('no history artifact');
+    expect(relocatedName(history, 'ui/Foo.tsx', 'ui/sub/Foo.tsx', paths)).toBe(
+      path.join(paths.historyDir, 'ui-sub-foo')
+    );
+    const view = artifacts.find((a) => a.abs.endsWith('ui-foo.view.json'));
+    if (!view) throw new Error('no view artifact');
+    expect(relocatedName(view, 'ui/Foo.tsx', 'ui/sub/Foo.tsx', paths)).toBe(
+      path.join(paths.canvasStateDir, 'ui-sub-foo.view.json')
+    );
+  });
+
+  test('a rename (same dir, new basename) re-keys both the sibling and the slug-keyed sidecar', () => {
+    const artifacts = canvasArtifacts({ rel: 'ui/Foo.tsx', paths });
+    const primary = artifacts.find((a) => a.kind === 'primary');
+    if (!primary) throw new Error('no primary');
+    expect(relocatedName(primary, 'ui/Foo.tsx', 'ui/Bar.tsx', paths)).toBe(
+      path.join(paths.designRoot, 'ui', 'Bar.tsx')
+    );
+    const comments = artifacts.find((a) => a.abs === path.join(paths.commentsDir, 'ui-foo.json'));
+    if (!comments) throw new Error('no comments artifact');
+    expect(relocatedName(comments, 'ui/Foo.tsx', 'ui/Bar.tsx', paths)).toBe(
+      path.join(paths.commentsDir, 'ui-bar.json')
+    );
+  });
+});