@1agh/maude 0.51.1 → 0.52.0

package/apps/studio/test/cloud-endpoints.test.ts

@@ -24,7 +24,10 @@ beforeAll(() => {
       const url = new URL(req.url);
       seen.push(`${req.method} ${url.pathname}`);
       const json = (b: unknown, status = 200) =>
-        new Response(JSON.stringify(b), { status, headers: { 'content-type': 'application/json' } });
+        new Response(JSON.stringify(b), {
+          status,
+          headers: { 'content-type': 'application/json' },
+        });
       if (url.pathname === '/auth/handoff/exchange') {
         const body: any = await req.json();
         if (body.code === 'mhc_' + 'a'.repeat(64)) {
@@ -63,7 +66,9 @@ afterAll(() => {
 
 describe('parseDeepLink — untrusted input, strict shape', () => {
   test('accepts exactly the minted shape', () => {
-    const p = parseDeepLink(`maude://open/alligators?code=mhc_${'a'.repeat(64)}&origin=https://cloud.maude.sh`);
+    const p = parseDeepLink(
+      `maude://open/alligators?code=mhc_${'a'.repeat(64)}&origin=https://cloud.maude.sh`
+    );
     expect(p).toEqual({ project: 'alligators', code: `mhc_${'a'.repeat(64)}` });
   });
   test('refuses everything else', () => {
@@ -113,6 +118,36 @@ describe('attachCode — the maude:// lane end to end (stubbed)', () => {
     expect(seen.filter((s) => s.includes('/auth/handoff/exchange')).length).toBe(1);
   });
 
+  test('F2 — a link that names one project but opens another is refused, nothing linked', async () => {
+    // The person confirmed a FAMILIAR name. If the exchange opens something
+    // else, that consent was borrowed — refuse rather than point linkedHub at
+    // whoever minted the code (validate 2026-07-30, defender F2).
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const designRoot = join(scratch, '.design-f2');
+    const { mkdirSync } = await import('node:fs');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(join(designRoot, 'config.json'), '{}\n');
+
+    const apiEndpoints = createCloudEndpoints({ paths: { repoRoot: scratch, designRoot } });
+    const r = await apiEndpoints.attachCode(`mhc_${'a'.repeat(64)}`, 'a-project-i-trust');
+    expect(r.status).toBe(409);
+    expect((r.json as { error: string }).error).toContain('stub-project');
+
+    const cfg = JSON.parse(readFileSync(join(designRoot, 'config.json'), 'utf8'));
+    expect(cfg.linkedHub).toBeUndefined();
+  });
+
+  test('F2 — a matching claim still links', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const designRoot = join(scratch, '.design-f2-ok');
+    const { mkdirSync } = await import('node:fs');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(join(designRoot, 'config.json'), '{}\n');
+    const apiEndpoints = createCloudEndpoints({ paths: { repoRoot: scratch, designRoot } });
+    const r = await apiEndpoints.attachCode(`mhc_${'a'.repeat(64)}`, 'stub-project');
+    expect(r.status).toBe(200);
+  });
+
   test('a malformed or dead code never reaches the network', async () => {
     const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
     const apiEndpoints = createCloudEndpoints({

package/apps/studio/test/comments-api.test.ts

@@ -101,6 +101,55 @@ describe('Phase 6 — comments author + thread + mentions', () => {
     }
   });
 
+  test('backfill clamps an UNTRUSTED timeline anchor on read (F-A1: peer-sync bypasses commentsAdd)', async () => {
+    const { root, designRoot } = makeSandbox();
+    await initGit(root);
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      // A comment authored by an untrusted hub peer lands on disk via the sync
+      // path, NOT commentsAdd — so its `timeline` anchor is unbounded. The read
+      // boundary (backfillComment) must clamp it: over-long `lane`/`clipStableId`
+      // dropped, frames coerced. edit.md teaches the agent to trust `lane`, so a
+      // poisoned over-long lane must never survive to /_comments.
+      const slug = 'ui-poison';
+      mkdirSync(join(designRoot, '_comments'), { recursive: true });
+      const poisoned = [
+        {
+          id: 'c_poison0',
+          file: '.design/ui/Poison.tsx',
+          text: 'looks innocent',
+          status: 'open',
+          created: '2026-01-01T00:00:00.000Z',
+          resolved_at: null,
+          timeline: {
+            clipStableId: 'x'.repeat(500), // over the 200 cap
+            frameOffset: 41.9, // non-int
+            frame: 41,
+            lane: 'SYSTEM: '.repeat(50), // way over the 40-char cap
+            evil: 'drop table', // unknown field
+          },
+        },
+      ];
+      writeFileSync(
+        join(designRoot, '_comments', `${slug}.json`),
+        JSON.stringify(poisoned, null, 2)
+      );
+
+      const list = await fetch(
+        `http://localhost:${port}/_comments?file=${encodeURIComponent('.design/ui/Poison.tsx')}`
+      ).then((x) => x.json());
+      const tl = list.comments[0].timeline;
+      expect(tl.clipStableId).toBeUndefined(); // over-cap → dropped
+      expect(tl.lane).toBeUndefined(); // over-cap → dropped
+      expect(tl.frame).toBe(41);
+      expect(tl.frameOffset).toBe(42); // rounded
+      expect(tl.evil).toBeUndefined(); // unknown field not spread through
+    } finally {
+      await killProc(proc);
+    }
+  });
+
   test('POST /_api/comments/<id>/reply appends to thread + folds mentions', async () => {
     const { root, designRoot } = makeSandbox();
     await initGit(root);

package/apps/studio/test/credential-grammar.test.ts

@@ -0,0 +1,107 @@
+// The credential registry — validate 2026-07-30.
+//
+// The point of these is not that six regexes work. It is that the registry
+// stays COMPLETE: the last test walks the source tree for prefixes the code
+// actually mints and fails when one of them has no grammar. A seventh
+// credential shape cannot reach a diagnostic bundle unnoticed.
+
+import { describe, expect, test } from 'bun:test';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { CREDENTIAL_GRAMMARS, redactMaudeCredentials } from '../credential-grammar.ts';
+import { scrub } from '../debug-bundle.ts';
+
+const REPO = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..');
+
+describe('every Maude-minted credential is redacted', () => {
+  const samples: Array<[string, string]> = [
+    ['peer-token', 'mau_0123456789abcdef0123456789abcdef'],
+    ['personal-token', `mpt_${'a'.repeat(48)}`],
+    ['handoff-code', `mhc_${'b'.repeat(64)}`],
+    ['device-code', `mdc_${'c'.repeat(48)}`],
+    // The one the JWT rule structurally cannot see: TWO parts, not three,
+    // because the project token deliberately is not a JWT (DDR-204).
+    ['project-token', 'eyJlbWFpbCI6ImFAYi5jbyJ9.c2lnbmF0dXJlLXRoYXQtaXMtbG9uZy1lbm91Z2g'],
+    ['derived-cell-secret', 'f'.repeat(64)],
+  ];
+
+  for (const [id, sample] of samples) {
+    test(`${id} never survives a scrub`, () => {
+      const line = `[sync] presenting ${sample} to the workspace`;
+      expect(redactMaudeCredentials(line)).not.toContain(sample);
+      // And through the real front door the bug report uses.
+      expect(scrub(line)).not.toContain(sample);
+    });
+  }
+
+  test('a two-part project token is caught even though the JWT rule needs three', () => {
+    const twoPart = 'eyJlbWFpbCI6ImFAYi5jbyJ9.c2lnbmF0dXJlLXRoYXQtaXMtbG9uZy1lbm91Z2g';
+    expect(twoPart.split('.').length).toBe(2);
+    expect(scrub(`token=${twoPart}`)).not.toContain(twoPart);
+  });
+
+  test('an underscore-joined secret env name is redacted (\\b cannot match inside HUB_SECRET)', () => {
+    const out = scrub('HUB_SECRET=s3cr3t-value-here CELL_SECRET_MASTER=another-one');
+    expect(out).not.toContain('s3cr3t-value-here');
+    expect(out).not.toContain('another-one');
+    expect(out).toContain('HUB_SECRET');
+  });
+
+  test('ordinary text is left alone', () => {
+    const plain = 'opened .design/ui/home.tsx and rendered 42 artboards in 1.2s';
+    expect(scrub(plain)).toContain('home.tsx');
+    expect(scrub(plain)).not.toContain('[redacted]');
+  });
+});
+
+describe('the registry stays complete', () => {
+  /** Every `<prefix>_` literal the codebase mints a credential with. */
+  function mintedPrefixes(): Set<string> {
+    const found = new Set<string>();
+    const walk = (dir: string, depth = 0) => {
+      if (depth > 4) return;
+      for (const entry of readdirSync(dir)) {
+        if (entry === 'node_modules' || entry.startsWith('.')) continue;
+        const p = join(dir, entry);
+        let st: ReturnType<typeof statSync>;
+        try {
+          st = statSync(p);
+        } catch {
+          continue;
+        }
+        if (st.isDirectory()) {
+          walk(p, depth + 1);
+          continue;
+        }
+        if (!/\.(mjs|ts)$/.test(entry) || /\.test\./.test(entry)) continue;
+        const src = readFileSync(p, 'utf8');
+        // A mint always builds the value from a literal prefix plus randomness,
+        // e.g. `` `mpt_${b64hex(crypto.getRandomValues(...))}` ``.
+        for (const m of src.matchAll(/`(m[a-z]{2})_\$\{/g)) found.add(m[1]);
+      }
+    };
+    for (const app of ['apps/cloud', 'apps/hub', 'apps/cells', 'cli']) {
+      try {
+        walk(join(REPO, app));
+      } catch {
+        /* an absent app is not a failure */
+      }
+    }
+    return found;
+  }
+
+  test('every prefix the code mints has a grammar', () => {
+    const registered = new Set(
+      CREDENTIAL_GRAMMARS.flatMap((g) => {
+        const m = /\\b(m[a-z]{2})_/.exec(g.pattern.source);
+        return m ? [m[1]] : [];
+      })
+    );
+    const minted = mintedPrefixes();
+    expect(minted.size).toBeGreaterThan(0); // the walk must actually find things
+    const missing = [...minted].filter((p) => !registered.has(p));
+    expect(missing).toEqual([]);
+  });
+});

package/apps/studio/test/read-only-role.test.ts

@@ -0,0 +1,95 @@
+// The client learns it is a viewer at BOOT — Cloud Phase 25 C2.
+//
+// The alternative is learning it from the first refused write, which means
+// drawing somebody an editor and then taking it away. So the role the
+// workspace vouched for at sign-in is persisted with the credential and
+// resolved before the UI paints.
+//
+// This flag decides what the UI OFFERS. It is never what stops a write: the
+// cell enforces that (Phase 25 C1 — a read-only peer token, Hocuspocus
+// dropping SyncStep2/Update, one HTTP gate), and it holds whatever a patched
+// client believes about itself.
+
+import { describe, expect, test } from 'bun:test';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { saveHubCredential } from '../sync/hub-link.ts';
+import { signInToWorkspace } from '../sync/workspace-signin.ts';
+
+function withHome<T>(fn: (home: string) => T): T {
+  const home = mkdtempSync(join(tmpdir(), 'maude-ro-'));
+  const prevXdg = process.env.XDG_CONFIG_HOME;
+  process.env.XDG_CONFIG_HOME = home;
+  try {
+    return fn(home);
+  } finally {
+    if (prevXdg === undefined) delete process.env.XDG_CONFIG_HOME;
+    else process.env.XDG_CONFIG_HOME = prevXdg;
+    rmSync(home, { recursive: true, force: true });
+  }
+}
+
+describe('the vouched role is persisted with the credential', () => {
+  test('a viewer is recorded as one', () => {
+    withHome((home) => {
+      saveHubCredential('https://p.cloud.maude.sh', 'mau_tok', 'viewer');
+      const cfg = JSON.parse(readFileSync(join(home, 'maude', 'hubs.json'), 'utf8'));
+      expect(cfg.hubs['https://p.cloud.maude.sh'].role).toBe('viewer');
+    });
+  });
+
+  test('a credential written without a role stays write-capable', () => {
+    // The upgrade promise: nobody is demoted by shipping this.
+    withHome((home) => {
+      saveHubCredential('https://p.cloud.maude.sh', 'mau_tok');
+      const cfg = JSON.parse(readFileSync(join(home, 'maude', 'hubs.json'), 'utf8'));
+      expect(cfg.hubs['https://p.cloud.maude.sh'].role).toBeUndefined();
+    });
+  });
+});
+
+describe('sign-in carries the role through to the credential', () => {
+  const okHub = (role: string) =>
+    (async (url: string) => {
+      const u = String(url);
+      if (u.endsWith('/health')) return Response.json({ ok: true, version: '1.0.0' });
+      return Response.json({ token: 'mau_minted', user: { email: 'v@example.com', role } });
+    }) as unknown as typeof fetch;
+
+  test('a viewer sign-in saves the role, and reports it back', async () => {
+    const saved: Array<[string, string, string | undefined]> = [];
+    const res = await signInToWorkspace(
+      { url: 'https://p.cloud.maude.sh', email: 'v@example.com', password: 'x'.repeat(12) },
+      {
+        save: (u, t, r) => saved.push([u, t, r]),
+        fetchImpl: okHub('viewer'),
+      }
+    );
+    expect(res.status).toBe(200);
+    expect(saved[0][2]).toBe('viewer');
+    expect((res.json as { user: { role: string } }).user.role).toBe('viewer');
+  });
+
+  test('a hub that names no role is treated as member, never as viewer', async () => {
+    // Failing OPEN on the UI flag is correct: the cell is what refuses a
+    // write, so a wrong guess here costs a redundant affordance, never
+    // access. Guessing "viewer" instead would lock out every self-hoster
+    // whose hub predates this field.
+    const saved: Array<[string, string, string | undefined]> = [];
+    const res = await signInToWorkspace(
+      { url: 'https://hub.example.com', email: 'm@example.com', password: 'x'.repeat(12) },
+      {
+        save: (u, t, r) => saved.push([u, t, r]),
+        fetchImpl: (async (url: string) => {
+          const u = String(url);
+          if (u.endsWith('/health')) return Response.json({ ok: true, version: '1.0.0' });
+          return Response.json({ token: 'mau_minted', user: { email: 'm@example.com' } });
+        }) as unknown as typeof fetch,
+      }
+    );
+    expect(res.status).toBe(200);
+    expect(saved[0][2]).toBe('member');
+  });
+});

package/apps/studio/test/ripple.test.ts

@@ -0,0 +1,197 @@
+// ripple.test.ts — feature-enhanced-video-editing Phase 0 (Task 2). Golden-file
+// fixtures for the pure ripple engine: literal shifts, const-arithmetic
+// trailing-term merges, the TOTAL-follows-const double-shift guard, series
+// TOTAL-only behavior, and the loud structured refusals.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  applyRippleAfterClip,
+  collectConsts,
+  RippleError,
+  resolveNum,
+  shiftExpression,
+} from '../ripple.ts';
+
+const CANVAS = '/abs/Canvas.tsx';
+
+describe('shiftExpression', () => {
+  test('literal rewrites in place', () => {
+    expect(shiftExpression('90', 12)).toBe('102');
+    expect(shiftExpression('90', -30)).toBe('60');
+  });
+  test('trailing integer term merges', () => {
+    expect(shiftExpression('A + B - 20', 12)).toBe('A + B - 8');
+    expect(shiftExpression('A + B - 20', 20)).toBe('A + B');
+    expect(shiftExpression('A + 10', -22)).toBe('A - 12');
+  });
+  test('no trailing term → appends', () => {
+    expect(shiftExpression('A', 12)).toBe('A + 12');
+    expect(shiftExpression('A + B', -12)).toBe('A + B - 12');
+  });
+  test('trailing int that is an operand of * stays untouched (appends instead)', () => {
+    expect(shiftExpression('A * 2', 12)).toBe('A * 2 + 12');
+  });
+  test('unsafe charset → null (a call slips the charset but fails resolveNum — the engine refuses there)', () => {
+    expect(shiftExpression('a ? 1 : 2', 12)).toBe(null);
+    expect(resolveNum('fn(A)', { A: 1 })).toBe(null);
+  });
+});
+
+describe('collectConsts + resolveNum', () => {
+  const SRC = 'const A = 40;\nconst B = 50;\nconst TOTAL = A + B - 20;\n';
+  test('derived consts resolve', () => {
+    const c = collectConsts(SRC);
+    expect(c.TOTAL).toBe(70);
+    expect(resolveNum('TOTAL - 10', c)).toBe(60);
+    expect(resolveNum('mystery + 1', c)).toBe(null);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Standalone-Sequence comp (overlay/audio band shape) — literal + expression.
+
+const STANDALONE = [
+  'const A = 90;',
+  'const TOTAL = 300;',
+  'const Comp = () => (',
+  '  <>',
+  '    <Sequence name="one" from={0} durationInFrames={A}><Video src="a.mp4" /></Sequence>',
+  '    <Sequence name="two" from={90} durationInFrames={100}><Video src="b.mp4" /></Sequence>',
+  '    <Sequence name="three" from={A + 100} durationInFrames={110}><Video src="c.mp4" /></Sequence>',
+  '  </>',
+  ');',
+  'function Canvas() {',
+  '  return (',
+  '    <DCArtboard id="a"><VideoComp component={Comp} durationInFrames={TOTAL} fps={30} /></DCArtboard>',
+  '  );',
+  '}',
+].join('\n');
+
+describe('applyRippleAfterClip — standalone sequences', () => {
+  test('shifts literal and expression froms, bumps the TOTAL const', () => {
+    const r = applyRippleAfterClip(CANVAS, STANDALONE, 'a', 'name:one', 12);
+    expect(r.totalEdited).toBe(true);
+    expect(r.shifted).toEqual(['name:two', 'name:three']);
+    expect(r.source).toContain('const TOTAL = 312;');
+    expect(r.source).toContain('from={102}');
+    expect(r.source).toContain('from={A + 112}');
+    // upstream untouched
+    expect(r.source).toContain('from={0}');
+  });
+
+  test('negative delta merges the trailing term back down', () => {
+    const r = applyRippleAfterClip(CANVAS, STANDALONE, 'a', 'name:one', -30);
+    expect(r.source).toContain('const TOTAL = 270;');
+    expect(r.source).toContain('from={60}');
+    expect(r.source).toContain('from={A + 70}');
+  });
+
+  test('delta 0 is a no-op', () => {
+    const r = applyRippleAfterClip(CANVAS, STANDALONE, 'a', 'name:one', 0);
+    expect(r.source).toBe(STANDALONE);
+    expect(r.shifted).toEqual([]);
+  });
+
+  test('only clips AFTER the target shift', () => {
+    const r = applyRippleAfterClip(CANVAS, STANDALONE, 'a', 'name:two', 12);
+    expect(r.shifted).toEqual(['name:three']);
+    expect(r.source).toContain('from={90}'); // "two" itself untouched
+    expect(r.source).toContain('from={A + 112}');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// The double-shift guard — an end card at `from={TOTAL - 60}` already follows
+// the bumped const and must be SKIPPED, not shifted twice.
+
+const COUPLED = [
+  'const TOTAL = 300;',
+  'const Comp = () => (',
+  '  <>',
+  '    <Sequence name="body" from={0} durationInFrames={240}><Video src="a.mp4" /></Sequence>',
+  '    <Sequence name="end" from={TOTAL - 60} durationInFrames={60}><Video src="b.mp4" /></Sequence>',
+  '  </>',
+  ');',
+  'function Canvas() {',
+  '  return (',
+  '    <DCArtboard id="a"><VideoComp component={Comp} durationInFrames={TOTAL} fps={30} /></DCArtboard>',
+  '  );',
+  '}',
+].join('\n');
+
+describe('applyRippleAfterClip — const-coupled froms', () => {
+  test('a from that follows the bumped TOTAL is skipped (no double shift)', () => {
+    const r = applyRippleAfterClip(CANVAS, COUPLED, 'a', 'name:body', 30);
+    expect(r.source).toContain('const TOTAL = 330;');
+    expect(r.source).toContain('from={TOTAL - 60}'); // untouched — follows the const
+    expect(r.shifted).toEqual([]);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// TransitionSeries storyline — series clips get NO from; TOTAL still moves.
+
+const SERIES = [
+  "import { TransitionSeries } from '@remotion/transitions';",
+  'const S1 = 90;',
+  'const S2 = 120;',
+  'const XF = 15;',
+  'const TOTAL = S1 + S2 - XF;',
+  'const Comp = () => (',
+  '  <TransitionSeries>',
+  '    <TransitionSeries.Sequence name="s1" durationInFrames={S1}><Video src="a.mp4" /></TransitionSeries.Sequence>',
+  '    <TransitionSeries.Transition presentation={fade()} timing={linearTiming({ durationInFrames: XF })} />',
+  '    <TransitionSeries.Sequence name="s2" durationInFrames={S2}><Video src="b.mp4" /></TransitionSeries.Sequence>',
+  '  </TransitionSeries>',
+  ');',
+  'function Canvas() {',
+  '  return (',
+  '    <DCArtboard id="a"><VideoComp component={Comp} durationInFrames={TOTAL} fps={30} /></DCArtboard>',
+  '  );',
+  '}',
+].join('\n');
+
+describe('applyRippleAfterClip — series storyline', () => {
+  test('series clips get no from shift; TOTAL const merges the delta', () => {
+    const r = applyRippleAfterClip(CANVAS, SERIES, 'a', 'name:s1', 12);
+    expect(r.totalEdited).toBe(true);
+    expect(r.shifted).toEqual([]);
+    expect(r.source).toContain('const TOTAL = S1 + S2 - XF + 12;');
+    // clip tags untouched
+    expect(r.source).toContain('durationInFrames={S1}');
+    expect(r.source).toContain('durationInFrames={S2}');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Refusals — loud, structured, never a silent mis-shift.
+
+describe('applyRippleAfterClip — refusals', () => {
+  test('unresolvable downstream from refuses with the clip named', () => {
+    const SRC = STANDALONE.replace('from={A + 100}', 'from={computeStart()}');
+    let err: unknown;
+    try {
+      applyRippleAfterClip(CANVAS, SRC, 'a', 'name:one', 12);
+    } catch (e) {
+      err = e;
+    }
+    expect(err).toBeInstanceOf(RippleError);
+    expect(String((err as Error).message)).toContain('name:three');
+  });
+
+  test('unresolvable TOTAL const refuses', () => {
+    const SRC = STANDALONE.replace('const TOTAL = 300;', 'const TOTAL = computeTotal();');
+    expect(() => applyRippleAfterClip(CANVAS, SRC, 'a', 'name:one', 12)).toThrow(RippleError);
+  });
+
+  test('a shift below frame 0 refuses', () => {
+    expect(() => applyRippleAfterClip(CANVAS, STANDALONE, 'a', 'name:one', -120)).toThrow(
+      RippleError
+    );
+  });
+
+  test('unknown clip refuses', () => {
+    expect(() => applyRippleAfterClip(CANVAS, STANDALONE, 'a', 'name:nope', 12)).toThrow();
+  });
+});

package/apps/studio/test/timeline-scale.test.ts

@@ -0,0 +1,65 @@
+// timeline-scale.test.ts — Task 4 pure zoom/scale helpers.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  clampPxPerFrame,
+  fitPxPerFrame,
+  frameToPx,
+  MAX_PX_PER_FRAME,
+  pxToFrame,
+  tickLabel,
+  tickStepFrames,
+  zoomAroundScroll,
+} from '../client/panels/timeline-scale.js';
+
+describe('fit + clamp', () => {
+  test('fit spans the viewport exactly', () => {
+    expect(fitPxPerFrame(900, 900)).toBe(1);
+    expect(fitPxPerFrame(1200, 300)).toBe(4);
+  });
+  test('clamp: never below fit, never above the max', () => {
+    expect(clampPxPerFrame(0.1, 900, 900)).toBe(1); // below fit → fit
+    expect(clampPxPerFrame(100, 900, 900)).toBe(MAX_PX_PER_FRAME);
+    expect(clampPxPerFrame(3, 900, 900)).toBe(3);
+    expect(clampPxPerFrame(null, 900, 900)).toBe(1); // absent → fit
+  });
+});
+
+describe('frame ↔ px round-trip', () => {
+  test('at any scale, px→frame(frame→px) is identity', () => {
+    for (const pxf of [0.5, 1, 3.7, 40]) {
+      expect(pxToFrame(frameToPx(123, pxf), pxf)).toBeCloseTo(123, 6);
+    }
+  });
+});
+
+describe('zoomAroundScroll', () => {
+  test('the anchor frame stays at the same viewport x', () => {
+    const prev = 1;
+    const next = 2;
+    const anchor = 300;
+    const prevScroll = 100; // anchor at viewport x = 200
+    const nextScroll = zoomAroundScroll(prev, next, anchor, prevScroll);
+    expect(frameToPx(anchor, next) - nextScroll).toBeCloseTo(frameToPx(anchor, prev) - prevScroll);
+  });
+  test('never scrolls negative', () => {
+    expect(zoomAroundScroll(2, 1, 10, 0)).toBe(0);
+  });
+});
+
+describe('tickStepFrames — density adapts 1 s → 10 f → 1 f', () => {
+  test('at fit on a long comp, ticks are whole/multi seconds', () => {
+    const step = tickStepFrames(0.3, 30); // 0.3 px/frame → 30f = 9px, needs ≥56px
+    expect(step % 30).toBe(0);
+    expect(step).toBeGreaterThanOrEqual(150);
+  });
+  test('zoomed to 8px/frame → single-frame ticks', () => {
+    expect(tickStepFrames(8, 30)).toBe(10); // 10f = 80px ≥ 56 → 10-frame ticks
+    expect(tickStepFrames(60, 30)).toBe(1); // 1f = 60px ≥ 56
+  });
+  test('labels: seconds at whole seconds, frames otherwise', () => {
+    expect(tickLabel(60, 30)).toBe('2s');
+    expect(tickLabel(45, 30)).toBe('45f');
+  });
+});

package/apps/studio/test/workspace-signin.test.ts

@@ -172,7 +172,10 @@ describe('failure modes are distinguishable and actionable', () => {
       '/health': HEALTHY,
       '/auth/login': () =>
         json(
-          { error: 'This workspace signs in through Maude Cloud — use Sign in to Maude Cloud in the app.' },
+          {
+            error:
+              'This workspace signs in through Maude Cloud — use Sign in to Maude Cloud in the app.',
+          },
           400
         ),
     });

package/apps/studio/whats-new.json

@@ -1,6 +1,41 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "desktop-opens-again",
+      "version": "0.52.0",
+      "date": "2026-08-02",
+      "kind": "fix",
+      "title": "The desktop app opens again",
+      "summary": "0.51.1 launched to an empty window on every project — the app booted fine and the interface simply never drew. It only broke inside the desktop shell, which is why a browser and a dev build both looked healthy. Fixed, and the release now refuses to ship an app whose interface does not come up.",
+      "surface": "desktop"
+    },
+    {
+      "id": "manual-timeline-editor",
+      "version": "0.52.0",
+      "date": "2026-08-02",
+      "kind": "feature",
+      "title": "Edit video on the timeline, like iMovie",
+      "summary": "Split, trim, retime, crop, grade, and lay clips across stacked layers right on the timeline — drag to reorder, drop to make a new layer, add transitions, drop AI placeholder clips, and pin comments to an exact frame with the C tool.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "report-a-bug-from-the-app",
+      "version": "0.52.0",
+      "date": "2026-08-02",
+      "kind": "feature",
+      "title": "Report a bug without leaving Maude",
+      "summary": "Hit a problem? Help › Report a Bug… files it for you — with a screenshot of your canvas you can black-out before sending, and a review screen where you choose exactly what gets attached. The report lands on the public Maude issue tracker; screenshots and logs stay in a private space only maintainers can open.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-tour=\"help\"]",
+          "title": "Report a bug",
+          "body": "Open Help › Report a bug… whenever something breaks — a screenshot and the details maintainers need are gathered for you, and nothing is sent until you approve it.",
+          "placement": "bottom"
+        }
+      ]
+    },
     {
       "id": "maude-deeplink-open-in-app",
       "version": "0.51.0",

package/cli/commands/share.mjs

@@ -56,9 +56,11 @@ function listFiles(dir, prefix = '', out = []) {
 }
 
 function s3ConfigFromEnv(env = process.env) {
-  const missing = ['MAUDE_R2_ENDPOINT', 'MAUDE_R2_ACCESS_KEY_ID', 'MAUDE_R2_SECRET_ACCESS_KEY'].filter(
-    (k) => !env[k]
-  );
+  const missing = [
+    'MAUDE_R2_ENDPOINT',
+    'MAUDE_R2_ACCESS_KEY_ID',
+    'MAUDE_R2_SECRET_ACCESS_KEY',
+  ].filter((k) => !env[k]);
   if (missing.length) {
     throw new Error(
       `object storage is not configured — missing ${missing.join(', ')}.\n` +
@@ -95,7 +97,9 @@ export async function run({ args, pkgRoot }) {
 
   const project = validProjectId(flags.project);
   if (!project) {
-    process.stderr.write('maude share: --project is required (lowercase letters, digits, hyphens)\n');
+    process.stderr.write(
+      'maude share: --project is required (lowercase letters, digits, hyphens)\n'
+    );
     process.exit(2);
   }
   const zone = String(flags.zone ?? 'cloud.maude.sh');