@1agh/maude 0.53.1 → 0.54.0

package/apps/studio/test/cloud-build.test.ts

@@ -0,0 +1,95 @@
+// Cloud Phase 27 D1 — the stub generator, and the reason it is generated.
+//
+// The compiled-artifact assertion lives in `scripts/check-cloud-binary.sh`
+// (two compiles, ~1 min — release-job work). These are the unit-level halves:
+// that a stub covers every runtime export of the module it replaces, and that
+// the value it substitutes cannot crash a boot on a shape nobody remembered.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import {
+  CLOUD_ELIMINATED,
+  CLOUD_FORBIDDEN_STRINGS,
+  exportedNames,
+  stubSource,
+} from '../cloud-build.ts';
+
+const STUDIO = join(import.meta.dir, '..');
+
+describe('cloud elimination', () => {
+  test('every listed module exists — a typo eliminates nothing, silently', () => {
+    for (const rel of CLOUD_ELIMINATED) {
+      expect(() => readFileSync(join(STUDIO, rel), 'utf8')).not.toThrow();
+    }
+  });
+
+  test('the stub covers every runtime export of the real module', () => {
+    // A missing export is a boot-time crash in the cloud binary and nowhere
+    // else — the worst place for it to surface. Generating from the real file
+    // is what keeps this true when a module grows a function.
+    for (const rel of CLOUD_ELIMINATED) {
+      const source = readFileSync(join(STUDIO, rel), 'utf8');
+      const stub = stubSource(source);
+      for (const name of exportedNames(source)) {
+        expect(stub).toContain(`export const ${name} = inert;`);
+      }
+    }
+  });
+
+  test('it reads the forms this codebase actually uses', () => {
+    const names = exportedNames(`
+      export function alpha() {}
+      export async function beta() {}
+      export const gamma = 1;
+      export let delta = 2;
+      export class Epsilon {}
+      export { zeta, eta as theta };
+      export interface NotThis {}
+      export type NorThis = string;
+      const notExported = 3;
+    `);
+    expect(names.sort()).toEqual(['Epsilon', 'alpha', 'beta', 'delta', 'gamma', 'theta', 'zeta']);
+    // Types are erased before any of this matters; listing them would emit a
+    // `const` where a type was and break the build for no reason.
+    expect(names).not.toContain('NotThis');
+    expect(names).not.toContain('NorThis');
+    expect(names).not.toContain('notExported');
+  });
+
+  test('the inert value survives every shape a caller might use', async () => {
+    // The callers are not alike: one calls `createExportJobQueue(...)` and
+    // hands the result to a route table, one calls `installLogRing()` for a
+    // side effect, one reads a property off what `createAcp` returned. Anything
+    // that answers all of them cannot crash a boot.
+    const mod = await import(
+      `data:text/javascript;base64,${btoa(stubSource('export function makeThing() {}'))}`
+    );
+    const { makeThing } = mod;
+    expect(() => makeThing()).not.toThrow();
+    expect(() => makeThing().someMethod()).not.toThrow();
+    expect(() => new makeThing()).not.toThrow();
+    expect(() => makeThing().a.b.c()).not.toThrow();
+    // NOT thenable — an `await` on it must resolve, not hang forever waiting
+    // for a `then` that never calls back.
+    const awaited = await makeThing();
+    expect(awaited).toBeDefined();
+    // Destructuring and iteration are both survivable.
+    const { anything } = makeThing();
+    expect(anything).toBeDefined();
+    expect([...makeThing()]).toEqual([]);
+  });
+
+  test('a sentinel is a string only our own code can produce', () => {
+    // `api.github.com` was the first candidate and is useless: Bun's own
+    // runtime carries GITHUB_API_DOMAIN, so it appears in every compiled binary
+    // whatever we do, and a gate that cannot go red is one people learn to
+    // ignore. Each sentinel must therefore be specific enough to be OURS.
+    expect(CLOUD_FORBIDDEN_STRINGS.length).toBeGreaterThan(0);
+    for (const s of CLOUD_FORBIDDEN_STRINGS) {
+      expect(s).not.toBe('api.github.com');
+      expect(s.length).toBeGreaterThan(3);
+    }
+  });
+});

package/apps/studio/test/cloud-session-role.test.ts

@@ -0,0 +1,131 @@
+// Cloud Phase 27 A3/A4 + C2/C4 (DDR-209) — the studio in a cell.
+//
+// The behaviour under test is the one that makes a cell multi-tenant-safe: in
+// workspace mode this process serves an owner and a viewer at the SAME TIME, so
+// "what may this request do" cannot come from a file on disk. It comes from the
+// proxy in front, per request, and in the absence of proof it is `viewer`.
+//
+// The local gate this replaces fails OPEN by design — `isHubReadOnly()` returns
+// false from its `catch`, and `projectReadOnly()` returns false when `linkedHub`
+// is unset. That is correct for a tool on your own laptop and is the whole
+// ballgame on the internet, which is why the no-header case below is the most
+// important assertion in the file.
+
+import { afterAll, describe, expect, test } from 'bun:test';
+import type { Subprocess } from 'bun';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+const procs: Subprocess[] = [];
+afterAll(async () => {
+  for (const p of procs) await killProc(p);
+});
+
+async function bootCell() {
+  const { root } = makeSandbox();
+  const port = nextPort();
+  const proc = await bootServer(root, port, {
+    MAUDE_WORKSPACE_MODE: '1',
+    // A dev checkout resolves Playwright (the E2E harness), which is a
+    // legitimate devDependency here and would otherwise fail the module half of
+    // the containment assert before workspace mode could be tested at all.
+    MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+    HUB_DASHBOARD_URL: 'https://cloud.maude.sh',
+    MAUDE_PROJECT_NAME: 'Alligators',
+  });
+  procs.push(proc);
+  return { base: `http://localhost:${port}` };
+}
+
+describe('a cell resolves the role per request, and defaults to read-only', () => {
+  test('no injected role at all ⇒ read-only, and writes are refused', async () => {
+    const { base } = await bootCell();
+
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as { readOnly?: boolean };
+    expect(cfg.readOnly).toBe(true);
+
+    const res = await fetch(`${base}/_api/edit-text`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ file: 'ui/Sample.tsx', id: 'x', text: 'y' }),
+    });
+    expect(res.status).toBe(403);
+    expect(((await res.json()) as { reason?: string }).reason).toBe('read-only');
+  });
+
+  test('a vouched editing role opens the same write', async () => {
+    const { base } = await bootCell();
+
+    const cfg = (await (
+      await fetch(`${base}/_config`, { headers: { 'x-maude-readonly': '0' } })
+    ).json()) as { readOnly?: boolean };
+    expect(cfg.readOnly).toBe(false);
+
+    const res = await fetch(`${base}/_api/edit-text`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', 'x-maude-readonly': '0' },
+      body: JSON.stringify({ file: 'ui/Sample.tsx', id: 'x', text: 'y' }),
+    });
+    // Whatever the handler makes of the payload, the GATE let it through — the
+    // read-only refusal is the specific thing that must not happen.
+    expect(res.status).not.toBe(403);
+  });
+
+  test('anything other than a positive `0` is read-only', async () => {
+    // The failure mode this rules out: a truthy-string check, where
+    // `x-maude-readonly: false` (a plausible thing for a future caller to send)
+    // reads as "not read-only".
+    const { base } = await bootCell();
+    for (const value of ['1', 'false', 'no', '', 'true', 'owner']) {
+      const cfg = (await (
+        await fetch(`${base}/_config`, { headers: { 'x-maude-readonly': value } })
+      ).json()) as { readOnly?: boolean };
+      expect(cfg.readOnly).toBe(true);
+    }
+  });
+
+  test('two requests to ONE process get two different answers', async () => {
+    // The actual multi-tenancy property, stated as a test: this is what a
+    // per-PROCESS config file cannot do, and it is why A3 exists.
+    const { base } = await bootCell();
+    const [viewer, member] = await Promise.all([
+      fetch(`${base}/_config`, { headers: { 'x-maude-readonly': '1' } }).then((r) => r.json()),
+      fetch(`${base}/_config`, { headers: { 'x-maude-readonly': '0' } }).then((r) => r.json()),
+    ]);
+    expect((viewer as { readOnly: boolean }).readOnly).toBe(true);
+    expect((member as { readOnly: boolean }).readOnly).toBe(false);
+  });
+});
+
+describe('the cloud shell states what it is', () => {
+  test('/_config carries the cloud block C2 and C4 render from', async () => {
+    const { base } = await bootCell();
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as {
+      cloud?: { dashboardUrl?: string; projectName?: string };
+    };
+    expect(cfg.cloud).toBeTruthy();
+    expect(cfg.cloud?.dashboardUrl).toBe('https://cloud.maude.sh');
+    expect(cfg.cloud?.projectName).toBe('Alligators');
+  });
+
+  test('the canvas capability is echoed only when the proxy minted one', async () => {
+    const { base } = await bootCell();
+    const without = (await (await fetch(`${base}/_config`)).json()) as { canvasToken?: string };
+    expect(without.canvasToken).toBeUndefined();
+
+    const with_ = (await (
+      await fetch(`${base}/_config`, { headers: { 'x-maude-canvas-token': 'cap-123' } })
+    ).json()) as { canvasToken?: string };
+    expect(with_.canvasToken).toBe('cap-123');
+  });
+
+  test('a cell SERVES the canvas surfaces it used to 404 (DDR-209 A′1)', async () => {
+    const { base } = await bootCell();
+    // The shell is a static harness; the browser is what evaluates it. Before
+    // DDR-209 this was a hard 404 in workspace mode, which is precisely why
+    // Phase 25 had to hand-roll a second studio.
+    const shell = await fetch(`${base}/_canvas-shell.html`);
+    expect(shell.status).toBe(200);
+    expect(shell.headers.get('content-type')).toContain('text/html');
+  });
+});

package/apps/studio/test/cloud-shell-surfaces.test.ts

@@ -0,0 +1,119 @@
+// Surfaces a cloud tab must not offer — Cloud Phase 27, found by using it.
+//
+// The phase's rule is C1's: role shapes what is OFFERED, never what is VISIBLE.
+// That rule is about ROLES. A different question turned up the moment the real
+// studio actually ran in a browser: what about a control whose feature cannot
+// exist in THIS SHELL at all?
+//
+// Three answers, and the difference between them is the whole point:
+//
+//   the agent chat        ABSENT, WITH A NOTICE. It runs on your own Claude
+//                         subscription on your own machine (DDR-123). The
+//                         feature exists and you can have it — the menu row
+//                         stays, disabled, saying where. (C2)
+//
+//   "Sign in to Maude     ABSENT, SILENTLY. It offers to do the thing you have
+//    Cloud"               already done: you reached this tab THROUGH a Maude
+//                         account. There is nothing to explain.
+//
+//   AI generation /       ABSENT, SILENTLY. These configure ffmpeg, mlx-vlm, a
+//   Subtitles / Video     HuggingFace cache and your own provider keys — none
+//                         of which a browser tab has, and whose routes a cell
+//                         refuses by design (DDR-209 D1). Left in, they render
+//                         as a wall of `HTTP 404`, which is what the owner saw.
+//
+// Source-level assertions, because the menubar's dropdowns do not open under a
+// synthetic click and a test that cannot fail is worse than no test. What these
+// pin is exactly what would regress: someone re-introducing `TABS.map` or
+// dropping the gate on `<CloudBar />`.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const STUDIO = join(import.meta.dir, '..');
+const APP = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
+const SETTINGS = readFileSync(join(STUDIO, 'client', 'panels', 'SettingsPanel.jsx'), 'utf8');
+
+describe('the cloud shell offers nothing it cannot honour', () => {
+  test('the local-machine settings tabs are flagged, and only those three', () => {
+    const flagged = [
+      ...SETTINGS.matchAll(/\{ id: '([a-z-]+)', label: '[^']+', local: true \}/g),
+    ].map((m) => m[1]);
+    expect(flagged.sort()).toEqual(['ai-generation', 'subtitles', 'video']);
+  });
+
+  test('the tab rail renders the FILTERED list, not the raw table', () => {
+    // `TABS.map` is what shipped the wall of 404s.
+    expect(SETTINGS).toContain('{tabs.map((t) => (');
+    expect(SETTINGS).not.toContain('{TABS.map(');
+    // …and every keyboard path must walk the same list, or End/Home select a
+    // tab that is not on screen.
+    expect(SETTINGS).not.toMatch(/setTab\(TABS\[/);
+    expect(SETTINGS).toContain('const tabs = useMemo(');
+  });
+
+  test('a remembered tab this shell does not have cannot select nothing', () => {
+    // Open Video on the desktop, then open Settings in the cloud.
+    const init =
+      /const \[tab, setTab\] = useState\(\(\) => \{[\s\S]*?\}\);/.exec(SETTINGS)?.[0] ?? '';
+    expect(init).toContain('!(cloud && t.local)');
+  });
+
+  test('the cloud sign-in is not offered inside the cloud', () => {
+    // `=== null`, not falsiness. `cloud` is undefined until `/_config` answers,
+    // and treating unknown as "not cloud" mounted this bar for one frame in
+    // every cloud tab — long enough to fire the one request the cell refuses.
+    expect(APP).toContain('{cloud === null ? <CloudBar /> : null}');
+    expect(APP).not.toContain('{cloud ? null : <CloudBar />}');
+  });
+
+  test('the local export queue does not hydrate before the shell is known', () => {
+    expect(APP).toContain('useExportCenter({ enabled: cfg.cloud === null })');
+  });
+
+  test('every component that gates on the shell is actually GIVEN the flag', () => {
+    // The bug this exists for: three `cfg?.cloud` reads inside a component that
+    // never receives `cfg` — a ReferenceError at render, and a blank app.
+    for (const call of ['<Menubar', '<Sidebar', '<SettingsPanel']) {
+      const at = APP.indexOf(call);
+      expect(at).toBeGreaterThan(0);
+      const props = APP.slice(at, at + 900);
+      // Passed RAW — a `?? null` here would erase the "not known yet" state
+      // before any component could see it.
+      expect(props).toContain('cloud={cfg.cloud}');
+    }
+  });
+
+  test('no component reaches for `cfg` where only the flag was passed', () => {
+    // `cfg` is a real variable at the top level, so a stray reference in a
+    // child component is a ReferenceError the bundler happily emits.
+    for (const fn of ['function Menubar({', 'function Sidebar({']) {
+      const start = APP.indexOf(fn);
+      expect(start).toBeGreaterThan(0);
+      // Bounded window: the component's own body, not the whole file.
+      const body = APP.slice(start, APP.indexOf('\nfunction ', start + 10));
+      expect(body).not.toMatch(/\bcfg\?\./);
+      expect(body).not.toMatch(/\bcfg\./);
+    }
+  });
+});
+
+describe('"not known yet" survives every layer between /_config and the DOM', () => {
+  // The three-line bug: the call sites were fixed to pass `cfg.cloud` raw, and
+  // the components still declared `cloud = null` as a default parameter. A
+  // default fires on `undefined` — so "we have not asked yet" turned back into
+  // "this is not the cloud" one layer further in, the sign-in bar mounted for a
+  // frame, and the boot 404 came back looking exactly like the one just fixed.
+  const APP_SRC = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
+  const SETTINGS_SRC = readFileSync(join(STUDIO, 'client', 'panels', 'SettingsPanel.jsx'), 'utf8');
+
+  test('no component defaults the shell flag', () => {
+    for (const [label, src] of [
+      ['app.jsx', APP_SRC],
+      ['SettingsPanel.jsx', SETTINGS_SRC],
+    ] as const) {
+      expect(src, label).not.toMatch(/^\s*cloud = (null|false|\{\}),$/m);
+    }
+  });
+});

package/apps/studio/test/collab-readonly-gate.test.ts

@@ -0,0 +1,194 @@
+// Unit: the read-only role gate on collab sync writes — the cloud collab lane
+// (RCA issue-cloud-live-collaboration-dead).
+//
+// A cell's proxy opens the canvas iframe's collab socket at the member's real
+// role; a viewer's socket arrives with readOnly=true. The room mirrors the role
+// matrix at the WS door the same way the inspector channel does for
+// comments-patch/delete: a read-only conn receives everything and publishes
+// awareness (presence for viewers is the point of the channel), but its sync
+// writes are gated to the COMMENT lane — the one write a viewer holds
+// (`viewer.comment === true`). Composes with, never replaces, the DDR-122
+// canvas-realm body-lane gate (test/collab-origin-gate.test.ts).
+
+import { describe, expect, test } from 'bun:test';
+
+import * as encoding from 'lib0/encoding';
+import { writeUpdate } from 'y-protocols/sync';
+import * as Y from 'yjs';
+
+import { MESSAGE_SYNC } from '../collab/protocol.ts';
+import { createRoom, type RoomCallbacks, type RoomConn } from '../collab/room.ts';
+
+function makeConn(
+  id: string,
+  opts: { realm?: 'main' | 'canvas'; readOnly?: boolean } = {}
+): RoomConn & { recv: Uint8Array[] } {
+  const recv: Uint8Array[] = [];
+  return {
+    id,
+    ...(opts.realm ? { realm: opts.realm } : {}),
+    ...(opts.readOnly !== undefined ? { readOnly: opts.readOnly } : {}),
+    send(payload: Uint8Array) {
+      recv.push(payload);
+    },
+    recv,
+  };
+}
+
+function makeCallbacks(): RoomCallbacks {
+  return {
+    seed() {},
+    persistJson() {},
+    persistBinary() {},
+  };
+}
+
+function syncUpdateFrame(update: Uint8Array): Uint8Array {
+  const encoder = encoding.createEncoder();
+  encoding.writeVarUint(encoder, MESSAGE_SYNC);
+  writeUpdate(encoder, update);
+  return encoding.toUint8Array(encoder);
+}
+
+function peerDelta(room: { doc: Y.Doc }, mutate: (doc: Y.Doc) => void): Uint8Array {
+  const peer = new Y.Doc();
+  Y.applyUpdate(peer, Y.encodeStateAsUpdate(room.doc));
+  const before = Y.encodeStateVector(peer);
+  mutate(peer);
+  return Y.encodeStateAsUpdate(peer, before);
+}
+
+describe('room read-only gate — cloud viewer sockets', () => {
+  test('a read-only canvas conn may write COMMENTS (the viewer capability)', async () => {
+    const room = createRoom('viewer-comments', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(viewer);
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(
+        peerDelta(room, (d) => d.getArray('comments').push([{ id: 'c1', text: 'a viewer note' }]))
+      )
+    );
+
+    expect(room.doc.getArray('comments').toArray()).toEqual([{ id: 'c1', text: 'a viewer note' }]);
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a read-only conn may NOT write annotations — refused, doc untouched, not broadcast', async () => {
+    const room = createRoom('viewer-annotations', makeCallbacks());
+    const editor = makeConn('editor', { realm: 'canvas', readOnly: false });
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(editor);
+    await room.connect(viewer);
+    editor.recv.length = 0;
+    viewer.recv.length = 0;
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(peerDelta(room, (d) => d.getMap('annotations').set('svg', '<svg/>')))
+    );
+
+    expect(room.doc.getMap('annotations').get('svg')).toBeUndefined();
+    expect(room.gateRefusals()).toBe(1);
+    expect(editor.recv.length).toBe(0);
+    // The refused peer got a corrective full-state frame instead.
+    expect(viewer.recv.length).toBe(1);
+    await room.destroy();
+  });
+
+  test('a read-only conn may not write body lanes either — even on the main realm', async () => {
+    const room = createRoom('viewer-body', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'main', readOnly: true });
+    await room.connect(viewer);
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(peerDelta(room, (d) => d.getText('html').insert(0, 'PWNED')))
+    );
+
+    expect(room.doc.getText('html').toString()).toBe('');
+    expect(room.gateRefusals()).toBe(1);
+    await room.destroy();
+  });
+
+  test('a WRITABLE canvas conn (an owner through the cloud lane) still annotates', async () => {
+    // The reason the role claim exists at all: annotations are exactly what the
+    // cloud complaint was about, and they need an editor-or-better socket.
+    const room = createRoom('owner-annotates', makeCallbacks());
+    const owner = makeConn('owner', { realm: 'canvas', readOnly: false });
+    await room.connect(owner);
+
+    room.receive(
+      owner,
+      syncUpdateFrame(
+        peerDelta(room, (d) => d.getMap('annotations').set('svg', '<svg><rect/></svg>'))
+      )
+    );
+
+    expect(room.doc.getMap('annotations').get('svg')).toBe('<svg><rect/></svg>');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('awareness frames from a read-only conn pass — presence for viewers is the point', async () => {
+    const room = createRoom('viewer-presence', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(viewer);
+
+    const peerDoc = new Y.Doc();
+    const { Awareness, encodeAwarenessUpdate } = await import('y-protocols/awareness');
+    const peerAwareness = new Awareness(peerDoc);
+    peerAwareness.setLocalState({ name: 'viewing member' });
+    const encoder = encoding.createEncoder();
+    encoding.writeVarUint(encoder, 1 /* MESSAGE_AWARENESS */);
+    encoding.writeVarUint8Array(
+      encoder,
+      encodeAwarenessUpdate(peerAwareness, [peerAwareness.clientID])
+    );
+    room.receive(viewer, encoding.toUint8Array(encoder));
+
+    expect(room.awareness.getStates().get(peerAwareness.clientID)).toEqual({
+      name: 'viewing member',
+    });
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+
+  test('a mixed frame (comment + annotation) from a read-only conn is refused wholesale', async () => {
+    const room = createRoom('viewer-mixed', makeCallbacks());
+    const viewer = makeConn('viewer', { realm: 'canvas', readOnly: true });
+    await room.connect(viewer);
+
+    room.receive(
+      viewer,
+      syncUpdateFrame(
+        peerDelta(room, (d) => {
+          d.getArray('comments').push([{ id: 'decoy' }]);
+          d.getMap('annotations').set('svg', '<svg/>');
+        })
+      )
+    );
+
+    expect(room.gateRefusals()).toBe(1);
+    expect(room.doc.getArray('comments').length).toBe(0);
+    expect(room.doc.getMap('annotations').get('svg')).toBeUndefined();
+    await room.destroy();
+  });
+
+  test('absent readOnly defaults to writable — pre-existing loopback callers unchanged', async () => {
+    const room = createRoom('legacy-writable', makeCallbacks());
+    const legacy = makeConn('legacy', { realm: 'canvas' });
+    await room.connect(legacy);
+
+    room.receive(
+      legacy,
+      syncUpdateFrame(peerDelta(room, (d) => d.getMap('annotations').set('svg', '<svg/>')))
+    );
+
+    expect(room.doc.getMap('annotations').get('svg')).toBe('<svg/>');
+    expect(room.gateRefusals()).toBe(0);
+    await room.destroy();
+  });
+});

package/apps/studio/test/config-projection.test.ts

@@ -0,0 +1,104 @@
+// The `/_config` projection — Cloud Phase 27.
+//
+// WHAT WENT WRONG, TWICE IN ONE CHANGE.
+//
+// The server's `/_config` handler adds fields to the config it returns. The
+// client does NOT spread that response — it builds a new object naming each
+// field it wants (a deliberate choice: `/_config` and `/_index-data` race, and
+// a full replace would clobber `canvasDesignSystems`). So a field the server
+// starts returning arrives nowhere until somebody names it on the client too,
+// and NOTHING says so. Phase 27 added two and named neither:
+//
+//   `cloud`        → the cloud studio rendered without its "which project am I
+//                    in / how do I leave" chrome, silently.
+//   `canvasToken`  → every canvas iframe loaded the cookieless canvas origin
+//                    with no capability, so every canvas would have 401'd.
+//
+// Both shipped to production. The first was found by looking at the page; the
+// second had not been found at all.
+//
+// This test reads BOTH sides out of source and demands they agree. It is a
+// grep-gate, the same trade `scripts/check-containment.sh` makes, and it is
+// sound for the same reason: the shapes it matches are the ones both files have
+// had since they were written, and the "did the regex find anything" assertions
+// below are what stop it passing vacuously.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const STUDIO = join(import.meta.dir, '..');
+const HTTP_TS = readFileSync(join(STUDIO, 'http.ts'), 'utf8');
+const APP_JSX = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
+
+/**
+ * Fields the `/_config` handler adds ON TOP of the `...ctx.cfg` spread.
+ *
+ * The spread itself is not enumerable from source and does not need to be: it
+ * is the project's own config file, which the client already carries wholesale.
+ * The risk is in the COMPUTED fields — the ones the server decides per request.
+ */
+function serverComputedConfigFields(): string[] {
+  const start = HTTP_TS.indexOf("'/_config':");
+  expect(start).toBeGreaterThan(0);
+  // The handler is short; take to the end of its `Response.json({...})`.
+  const body = HTTP_TS.slice(start, start + 2000);
+  const end = body.indexOf('\n    // ');
+  const src = end > 0 ? body.slice(0, end) : body;
+
+  const fields = new Set<string>();
+  // `canvasOrigin: ctx.canvasOrigin,` / `readOnly: projectReadOnly(req),`
+  for (const m of src.matchAll(/^\s{8}([a-zA-Z][a-zA-Z0-9]*):\s/gm)) fields.add(m[1]);
+  // Conditionally-spread fields: `? { canvasToken: … }` / `? { cloud: { … } }`
+  for (const m of src.matchAll(/\?\s*\{\s*([a-zA-Z][a-zA-Z0-9]*):/g)) fields.add(m[1]);
+  return [...fields].sort();
+}
+
+/** Fields the client's `/_config` handler copies into `cfg`. */
+function clientProjectedFields(): string[] {
+  const start = APP_JSX.indexOf("fetch('/_config')");
+  expect(start).toBeGreaterThan(0);
+  const end = APP_JSX.indexOf('.catch(() => {});', start);
+  expect(end).toBeGreaterThan(start);
+  const src = APP_JSX.slice(start, end);
+  const fields = new Set<string>();
+  for (const m of src.matchAll(/^\s{10}([a-zA-Z][a-zA-Z0-9]*):\s/gm)) fields.add(m[1]);
+  return [...fields].sort();
+}
+
+describe('/_config projection', () => {
+  test('the scrape finds both sides — a regex that matches nothing approves everything', () => {
+    const server = serverComputedConfigFields();
+    const client = clientProjectedFields();
+    expect(server.length).toBeGreaterThanOrEqual(3);
+    expect(client.length).toBeGreaterThanOrEqual(5);
+    expect(server).toContain('readOnly');
+    expect(client).toContain('readOnly');
+  });
+
+  test('every field the server COMPUTES is named by the client', () => {
+    const client = new Set(clientProjectedFields());
+    const missing = serverComputedConfigFields().filter((f) => !client.has(f));
+    expect(missing).toEqual([]);
+  });
+
+  test('the two fields this gate was written for are both present', () => {
+    // Named explicitly as well as covered by the rule above, because these are
+    // the ones that actually shipped broken and a future refactor of the regex
+    // should not be able to quietly stop covering them.
+    const client = new Set(clientProjectedFields());
+    expect(client.has('canvasToken')).toBe(true);
+    expect(client.has('cloud')).toBe(true);
+  });
+
+  test('the client still MERGES rather than replaces', () => {
+    // The reason the projection is explicit in the first place: `/_config` and
+    // `/_index-data` race, and a full replace clobbers `canvasDesignSystems`
+    // (DDR-093). Anyone "simplifying" this into a spread of `data` must not
+    // also drop the functional merge.
+    const start = APP_JSX.indexOf("fetch('/_config')");
+    const src = APP_JSX.slice(start, APP_JSX.indexOf('.catch(() => {});', start));
+    expect(src).toContain('setCfg((prev) => ({');
+    expect(src).toContain('...prev,');
+  });
+});