@1agh/maude 0.54.0 → 0.56.0

package/apps/studio/sync/supervisor.ts

@@ -0,0 +1,178 @@
+// Sync supervisor — one owner of the live sync runtime, so linking a project
+// can START SYNCING instead of asking a person to restart the app.
+//
+// Why this exists: `createSyncRuntime` captures `cfg.linkedHub` once, and
+// `reloadConfig` deliberately refuses to hot-swap it (a config.json is
+// committed and travels with the repo — a poisoned one must never re-point the
+// sync socket, DDR-149). That rule is about the FILE WATCHER, and it was being
+// paid for by the person: after pressing Connect in the cloud panel the whole
+// product did nothing visible and the UI said "restart the studio server to
+// start syncing" — a sentence with no button behind it, and no meaning at all
+// inside the desktop app, where there is no server the person can see.
+//
+// The supervisor separates the two paths that were conflated:
+//
+//   • a linkedHub arriving from DISK        → still boot-pinned, still refused;
+//   • a linkedHub the person JUST AUTHORIZED in trusted app chrome, whose hub
+//     credential this process itself stored one line earlier → adopted in
+//     memory and applied by a real stop() + start() cycle.
+//
+// The second path never reads the value back off disk: `restart()` takes the
+// LinkedHub object the attach lane just wrote, so nothing that happens to
+// `.design/config.json` in between can steer the socket.
+
+import { adoptLinkedHub, type Context, type LinkedHub } from '../context.ts';
+import { resolveCellPairing } from './cell-pairing.ts';
+import { getHubToken } from './hubs-config.ts';
+import {
+  type CreateSyncRuntimeOptions,
+  checkUrlScheme,
+  createSyncRuntime,
+  type SyncRuntime,
+} from './index.ts';
+
+/**
+ * What happened when the runtime was (re)started — the honest answer the cloud
+ * panel repeats back to the person. `syncing:false` is never silent: `reason`
+ * is what to say, and the caller renders it verbatim rather than guessing.
+ */
+export interface SyncStartOutcome {
+  syncing: boolean;
+  /** Canvases the runtime actually took ownership of. */
+  canvases: number;
+  /** Machine-readable cause when `syncing` is false. */
+  reason?: 'unlinked' | 'no-credential' | 'insecure-url' | 'refused' | 'nothing-syncable' | 'error';
+  /** One sentence a person can act on. Present whenever `syncing` is false. */
+  detail?: string;
+}
+
+export interface SyncSupervisor {
+  /** Boot the runtime from the config as loaded. Safe when unlinked. */
+  start(): Promise<SyncStartOutcome>;
+  /**
+   * Adopt a just-authorized link and cycle the runtime. `linkedHub` is passed
+   * BY VALUE from the attach lane on purpose — never re-read from disk.
+   */
+  restart(linkedHub?: LinkedHub): Promise<SyncStartOutcome>;
+  stop(): Promise<void>;
+  /** The live runtime, or null in solo mode. Test/inspection surface. */
+  current(): SyncRuntime | null;
+}
+
+/**
+ * Why did `createSyncRuntime` decline? It logs its refusals and returns null,
+ * which is right for a boot path and useless for a dialog. Re-derive the cause
+ * from the same inputs so the panel can say something true. Kept in this order
+ * deliberately — it mirrors the guard order in createSyncRuntime.
+ */
+function diagnose(ctx: Context): { reason: SyncStartOutcome['reason']; detail: string } {
+  // Cell pairing supplies its own hub URL + credential from the environment, so
+  // "no linkedHub on disk" is not the diagnosis there — reporting "not linked to
+  // a workspace" for a cell that IS paired would send an operator looking for a
+  // config field that has nothing to do with it. Both pairing outcomes (refused
+  // to resolve, or resolved but the runtime still declined) return here — a
+  // successfully-resolved pairing always carries a non-empty `url`
+  // (`resolveCellPairing` refuses an empty one), so there is no "unlinked"
+  // state to fall through to on this path, unlike the plain linkedHub case below.
+  const { pairing, detail: pairingRefusal } = resolveCellPairing();
+  if (pairingRefusal) {
+    return { reason: 'refused', detail: pairingRefusal };
+  }
+  if (pairing) {
+    return {
+      reason: 'refused',
+      detail: 'Cell pairing is on but syncing did not start — see the server log for why.',
+    };
+  }
+  const linked = ctx.cfg.linkedHub;
+  if (!linked) {
+    return { reason: 'unlinked', detail: 'This project is not linked to a workspace.' };
+  }
+  const scheme = checkUrlScheme(linked.url);
+  if (scheme) {
+    return { reason: 'insecure-url', detail: scheme };
+  }
+  if (!getHubToken(linked.url)) {
+    return {
+      reason: 'no-credential',
+      detail: 'No sign-in for this workspace is stored on this machine yet.',
+    };
+  }
+  return {
+    reason: 'refused',
+    detail: 'Syncing is switched off in this environment — see the server log for why.',
+  };
+}
+
+export function createSyncSupervisor(
+  ctx: Context,
+  opts: CreateSyncRuntimeOptions = {},
+  factory: (c: Context, o: CreateSyncRuntimeOptions) => SyncRuntime | null = createSyncRuntime
+): SyncSupervisor {
+  let runtime: SyncRuntime | null = null;
+  // Two Connects pressed in quick succession must not interleave a stop() with
+  // another cycle's start() — the second would attach providers the first is
+  // still tearing down. One chain, in order.
+  let chain: Promise<unknown> = Promise.resolve();
+
+  async function boot(): Promise<SyncStartOutcome> {
+    runtime = factory(ctx, opts);
+    if (!runtime) return { syncing: false, canvases: 0, ...diagnose(ctx) };
+    try {
+      await runtime.start();
+    } catch (err) {
+      // Same posture as the boot path: a failed sync start never takes the
+      // server (or the attach response) down with it — solo mode continues.
+      console.error('[sync] start failed — continuing in solo mode:', err);
+      return {
+        syncing: false,
+        canvases: 0,
+        reason: 'error',
+        detail: `Syncing could not start: ${(err as Error).message}`,
+      };
+    }
+    const canvases = runtime.size();
+    if (canvases === 0) {
+      // Linked and authenticated, but nothing on disk qualifies. The runtime
+      // already wrote the full reason into `_sync.json` (9.1-D); reuse it
+      // rather than inventing a second explanation that can drift from it.
+      const status = runtime.status() as { reason?: string } | null;
+      return {
+        syncing: false,
+        canvases: 0,
+        reason: 'nothing-syncable',
+        detail: status?.reason ?? 'No canvases in this project are syncable yet.',
+      };
+    }
+    return { syncing: true, canvases };
+  }
+
+  function serialize<T>(work: () => Promise<T>): Promise<T> {
+    const next = chain.then(work, work);
+    // Keep the chain alive even when a link fails — the NEXT attach must still
+    // be able to run. (A rejected chain would poison every later restart.)
+    chain = next.catch(() => {});
+    return next;
+  }
+
+  return {
+    start: () => serialize(boot),
+    restart: (linkedHub) =>
+      serialize(async () => {
+        try {
+          await runtime?.stop();
+        } catch (err) {
+          console.error('[sync] stop before restart failed:', err);
+        }
+        runtime = null;
+        if (linkedHub) adoptLinkedHub(ctx, linkedHub);
+        return boot();
+      }),
+    stop: () =>
+      serialize(async () => {
+        await runtime?.stop();
+        runtime = null;
+      }),
+    current: () => runtime,
+  };
+}

package/apps/studio/test/cloud-endpoints.test.ts

@@ -9,7 +9,13 @@ import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
-import { parseDeepLink, shareViewUrl } from '../client/panels/CloudBar.jsx';
+import {
+  connectOutcomeNote,
+  isDisplayableUrl,
+  localIdentityHint,
+  parseDeepLink,
+  shareViewUrl,
+} from '../client/panels/CloudBar.jsx';
 
 let stub: ReturnType<typeof Bun.serve> | null = null;
 let scratch = '';
@@ -78,20 +84,277 @@ describe('parseDeepLink — untrusted input, strict shape', () => {
       'maude://open/x?code=nothex', // bad code
       'https://evil.example/?code=mhc_' + 'a'.repeat(64), // not maude://
       'maude://join/x/y', // join is not the open shape
+      // Over the platform's 40-char project-id cap — a drive-by link never
+      // passes through the server-side bound, so arbitrary attacker text would
+      // otherwise render in the dialog heading, prose and aria-label.
+      `maude://open/${'a'.repeat(41)}?code=mhc_${'a'.repeat(64)}`,
     ]) {
       expect(parseDeepLink(bad)).toBeNull();
     }
+    // …and exactly 40 is still a real project id.
+    expect(
+      parseDeepLink(`maude://open/${'a'.repeat(40)}?code=mhc_${'a'.repeat(64)}`)
+    ).not.toBeNull();
   });
 });
 
 describe('shareViewUrl — the viewer’s browser home', () => {
-  test('derives view-<host> from the project url', () => {
+  test('is the project’s OWN address — the view- gallery is gone (Phase 25 C5)', () => {
+    // `view-*` is hard-refused by tenantFromHostname, so the old derivation
+    // produced a guaranteed 404 — invisible only because window.open was a no-op
+    // in the shell. Making the opener work would have made it a dead menu item.
     expect(shareViewUrl('https://alligators.cloud.maude.sh', 'alligators')).toBe(
-      'https://view-alligators.cloud.maude.sh'
+      'https://alligators.cloud.maude.sh'
     );
+    expect(shareViewUrl('https://alligators.cloud.maude.sh', 'alligators')).not.toContain('view-');
   });
   test('falls back to the platform zone on garbage', () => {
-    expect(shareViewUrl('nonsense', 'p1')).toBe('https://view-p1.cloud.maude.sh');
+    expect(shareViewUrl('nonsense', 'p1')).toBe('https://p1.cloud.maude.sh');
+  });
+});
+
+describe('isDisplayableUrl — what may be rendered as a clickable address', () => {
+  const CLOUD = 'https://cloud.maude.sh';
+
+  test('the configured origin and the cloud zone’s front doors pass', () => {
+    expect(isDisplayableUrl('https://cloud.maude.sh/activate?code=ABCD', CLOUD)).toBe(true);
+    expect(isDisplayableUrl('https://alligators.cloud.maude.sh/', CLOUD)).toBe(true);
+    // A self-host origin is legitimate for its OWN addresses.
+    expect(isDisplayableUrl('http://127.0.0.1:8788/activate', 'http://127.0.0.1:8788')).toBe(true);
+  });
+
+  test('an off-zone address is never rendered — a scheme check was not enough', () => {
+    // The bug this closes: `https://evil.example/activate?code=…` from a hostile
+    // or MITM'd control plane passed a protocol-only check and still rendered as
+    // a live href with a Copy button, and middle-click never reaches the click
+    // handler, let alone the Rust zone lock.
+    for (const bad of [
+      'https://evil.example/activate?code=x',
+      'https://cloud.maude.sh.attacker.example/',
+      'javascript:alert(1)',
+      'file:///etc/passwd',
+      'not a url',
+    ]) {
+      expect(isDisplayableUrl(bad, CLOUD)).toBe(false);
+    }
+    // Deep paths on a TENANT host are refused here too — same rule as the opener.
+    expect(isDisplayableUrl('https://canvas-evil.cloud.maude.sh/stored.svg', CLOUD)).toBe(false);
+  });
+});
+
+describe('status — names the LOCAL half so a deep link can be read', () => {
+  test('reports the open folder and its workspace, and never a credential', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const { mkdirSync } = await import('node:fs');
+    const repoRoot = join(scratch, 'alligators-web');
+    const designRoot = join(repoRoot, '.design');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(
+      join(designRoot, 'config.json'),
+      JSON.stringify({ linkedHub: { url: 'https://alligators.cloud.maude.sh', linkedAt: 1 } })
+    );
+
+    const r = createCloudEndpoints({ paths: { repoRoot, designRoot } }).status();
+    expect(r.status).toBe(200);
+    const json = r.json as Record<string, unknown>;
+    expect(json.project).toBe('alligators-web');
+    // No hub credential was stored in this scratch dir, so the link is reported
+    // but explicitly UNCORROBORATED — the dialog may not vouch for it.
+    expect(json.linkedHub).toEqual({
+      url: 'https://alligators.cloud.maude.sh',
+      credentialed: false,
+    });
+    // Signed out here — and the payload must stay free of token material
+    // whatever the state (this response reaches the browser surface too).
+    expect(json.connected).toBe(false);
+    expect(JSON.stringify(json)).not.toContain('token');
+  });
+
+  test('an unlinked (or malformed-config) folder reports linkedHub: null, not an error', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const { mkdirSync } = await import('node:fs');
+    const repoRoot = join(scratch, 'fresh-thing');
+    const designRoot = join(repoRoot, '.design');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(join(designRoot, 'config.json'), '{ not json');
+
+    const json = createCloudEndpoints({ paths: { repoRoot, designRoot } }).status().json as Record<
+      string,
+      unknown
+    >;
+    expect(json.linkedHub).toBeNull();
+    expect(json.project).toBe('fresh-thing');
+  });
+});
+
+describe('localIdentityHint — only an exact, corroborated agreement is silent', () => {
+  const CLOUD = 'https://cloud.maude.sh';
+
+  test('the reported case warns: one project open, the link naming another', () => {
+    // StudyFi open, "Open in Maude" pressed on alligators — one click from
+    // syncing StudyFi's designs into somebody else's workspace.
+    expect(
+      localIdentityHint({ localProject: 'AI-StudyMate', cloudUrl: CLOUD, claimed: 'alligators' })
+    ).toBe('mismatch');
+  });
+
+  test('a name an ATTACKER chose to look like yours does not buy silence', () => {
+    // The whole point (attacker pass B1). The cloud project id is registerable by
+    // anyone, so treating "contains your folder name" as agreement handed the
+    // attacker the off-switch for the warning. And the server's 409 cannot help:
+    // the claim and the actual project agree — it IS their project.
+    for (const claimed of [
+      'alligators-design-sync',
+      'alligators-backup',
+      'shared-alligators',
+      'web-design-studio-app',
+    ]) {
+      expect(localIdentityHint({ localProject: 'alligators', cloudUrl: CLOUD, claimed })).not.toBe(
+        'match'
+      );
+      expect(
+        ['similar', 'mismatch'].includes(
+          localIdentityHint({ localProject: 'alligators', cloudUrl: CLOUD, claimed })
+        )
+      ).toBe(true);
+    }
+  });
+
+  test('an exact name is the only silent name-based verdict', () => {
+    expect(
+      localIdentityHint({ localProject: 'alligators', cloudUrl: CLOUD, claimed: 'alligators' })
+    ).toBe('match');
+    // Normalization still applies — casing and separators are not a difference.
+    expect(
+      localIdentityHint({ localProject: 'Alligators', cloudUrl: CLOUD, claimed: 'alligators' })
+    ).toBe('match');
+    // A near-match is its own state: alike, and still NOT the same workspace.
+    expect(
+      localIdentityHint({ localProject: 'alligators-web', cloudUrl: CLOUD, claimed: 'alligators' })
+    ).toBe('similar');
+  });
+
+  test('a CREDENTIALED link to that project reads as linked', () => {
+    expect(
+      localIdentityHint({
+        localProject: 'anything',
+        linkedHubUrl: 'https://alligators.cloud.maude.sh',
+        linkedHubCredentialed: true,
+        cloudUrl: CLOUD,
+        claimed: 'alligators',
+      })
+    ).toBe('linked');
+  });
+
+  test('an UNCREDENTIALED linkedHub cannot vouch for anyone', () => {
+    // config.json is committed and travels with the repo, so a hostile template
+    // could otherwise make the dialog say "already linked to <attacker>" — the
+    // strongest reassurance it can give (attacker pass B2). Without a stored
+    // credential it is ignored and the folder name decides.
+    expect(
+      localIdentityHint({
+        localProject: 'my-thing',
+        linkedHubUrl: 'https://attacker.cloud.maude.sh',
+        linkedHubCredentialed: false,
+        cloudUrl: CLOUD,
+        claimed: 'attacker',
+      })
+    ).toBe('mismatch');
+  });
+
+  test('a folder credentialed to a DIFFERENT workspace warns', () => {
+    expect(
+      localIdentityHint({
+        localProject: 'alligators',
+        linkedHubUrl: 'https://someone-else.cloud.maude.sh',
+        linkedHubCredentialed: true,
+        cloudUrl: CLOUD,
+        claimed: 'alligators',
+      })
+    ).toBe('mismatch');
+  });
+
+  test('a short generic folder name does not buy agreement by containment', () => {
+    for (const localProject of ['web', 'app', 'src']) {
+      expect(
+        localIdentityHint({ localProject, cloudUrl: CLOUD, claimed: 'webshop-frontend' })
+      ).toBe('mismatch');
+    }
+  });
+
+  test('an accented or over-long folder name still matches its own workspace', () => {
+    // The fold must mirror the platform's deriveProjectId (NFKD + strip + 40-cap)
+    // or the warning fires on every LEGITIMATE connect for a whole class of
+    // names — which is how a consent warning dies (attacker re-review).
+    expect(
+      localIdentityHint({ localProject: 'Zkušební tým', cloudUrl: CLOUD, claimed: 'zkusebni-tym' })
+    ).toBe('match');
+    expect(
+      localIdentityHint({ localProject: 'Přátelé', cloudUrl: CLOUD, claimed: 'pratele' })
+    ).toBe('match');
+    // >40 chars: the platform truncates the id, so the fold must truncate too.
+    const long = 'a-very-long-project-name-that-the-platform-truncates-at-forty';
+    expect(
+      localIdentityHint({ localProject: long, cloudUrl: CLOUD, claimed: long.slice(0, 40) })
+    ).toBe('match');
+  });
+
+  test('no signal is "unknown", which warns — it must never read as agreement', () => {
+    // Every stub and self-hoster is http://127.0.0.1:<port>, carrying no project
+    // name. Before, that produced a reassuring neutral with a primary Connect;
+    // on the launch path an unresolved status did the same (attacker pass B3).
+    expect(
+      localIdentityHint({
+        localProject: '',
+        linkedHubUrl: 'http://127.0.0.1:4599',
+        cloudUrl: 'http://127.0.0.1:4599',
+        claimed: 'stub-project',
+      })
+    ).toBe('unknown');
+    // Status not yet resolved → unknown, whatever else is on hand.
+    expect(
+      localIdentityHint({
+        localProject: 'alligators',
+        cloudUrl: CLOUD,
+        claimed: 'alligators',
+        resolved: false,
+      })
+    ).toBe('unknown');
+  });
+});
+
+describe('connectOutcomeNote — what the rail says after Connect', () => {
+  test('syncing: a result, and where to watch it', () => {
+    const n = connectOutcomeNote('alligators', { syncing: true, canvases: 12 });
+    expect(n.text).toBe('Syncing with alligators — 12 canvases.');
+    expect(n.title).toContain('hub sync');
+    expect(connectOutcomeNote('alligators', { syncing: true, canvases: 1 }).text).toContain(
+      '1 canvas.'
+    );
+  });
+
+  test('linked but nothing syncable says so — and never claims a restart would help', () => {
+    const n = connectOutcomeNote('alligators', {
+      syncing: false,
+      canvases: 0,
+      reason: 'nothing-syncable',
+      detail: 'no canvases found under .design.',
+    });
+    expect(n.text).toBe('Connected to alligators — nothing to sync yet.');
+    expect(n.title).toContain('no canvases found');
+    expect(n.text).not.toMatch(/restart/i);
+  });
+
+  test('any other refusal repeats the server’s own reason', () => {
+    const n = connectOutcomeNote('alligators', {
+      syncing: false,
+      canvases: 0,
+      reason: 'no-credential',
+      detail: 'No sign-in for this workspace is stored on this machine yet.',
+    });
+    expect(n.text).toContain('No sign-in for this workspace');
+    // Never the old sentence: there is no studio server a person can see.
+    expect(n.text).not.toContain('studio server');
   });
 });
 
@@ -148,6 +411,65 @@ describe('attachCode — the maude:// lane end to end (stubbed)', () => {
     expect(r.status).toBe(200);
   });
 
+  test('linking STARTS syncing — the outcome is reported, not homework', async () => {
+    // The bug this closes: the panel used to answer a successful Connect with
+    // "restart the studio server to start syncing" — a task, naming a thing
+    // the desktop user cannot see. The attach lane now cycles the runtime and
+    // reports what happened.
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const designRoot = join(scratch, '.design-sync');
+    const { mkdirSync } = await import('node:fs');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(join(designRoot, 'config.json'), '{}\n');
+
+    const handed: unknown[] = [];
+    const apiEndpoints = createCloudEndpoints({
+      paths: { repoRoot: scratch, designRoot },
+      syncControl: {
+        restart: async (linkedHub) => {
+          handed.push(linkedHub);
+          return { syncing: true, canvases: 4 };
+        },
+      },
+    });
+    const r = await apiEndpoints.attachCode(`mhc_${'a'.repeat(64)}`);
+    expect(r.status).toBe(200);
+    expect((r.json as any).sync).toEqual({ syncing: true, canvases: 4 });
+    expect((r.json as any).note).toBe('Linked — syncing 4 canvases.');
+
+    // The supervisor is handed the value BY VALUE — the same object written to
+    // config.json — so nothing that touches that committed file in between can
+    // steer the socket.
+    const cfg = JSON.parse(readFileSync(join(designRoot, 'config.json'), 'utf8'));
+    expect(handed).toEqual([cfg.linkedHub]);
+  });
+
+  test('a TSX opt-out survives a re-link — only the restrictive direction carries', async () => {
+    // `syncTsx: false` means "do not upload canvas bodies to this hub"
+    // (DDR-072/DDR-079). Re-linking used to overwrite linkedHub wholesale,
+    // which silently re-enabled it — harmless while nothing synced until a
+    // restart, a real disclosure now that Connect starts syncing immediately.
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const designRoot = join(scratch, '.design-opt-out');
+    const { mkdirSync } = await import('node:fs');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(
+      join(designRoot, 'config.json'),
+      JSON.stringify({ linkedHub: { url: 'https://old.example', linkedAt: 1, syncTsx: false } })
+    );
+
+    const apiEndpoints = createCloudEndpoints({ paths: { repoRoot: scratch, designRoot } });
+    const r = await apiEndpoints.attachCode(`mhc_${'a'.repeat(64)}`);
+    expect(r.status).toBe(200);
+    const cfg = JSON.parse(readFileSync(join(designRoot, 'config.json'), 'utf8'));
+    expect(cfg.linkedHub.syncTsx).toBe(false);
+    expect(cfg.linkedHub.url).toContain('127.0.0.1');
+    // No supervisor wired (a plain embedder): still linked, and the note says
+    // what is left to do instead of claiming success.
+    expect((r.json as any).sync.syncing).toBe(false);
+    expect((r.json as any).note).toMatch(/Restart Maude/);
+  });
+
   test('a malformed or dead code never reaches the network', async () => {
     const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
     const apiEndpoints = createCloudEndpoints({

package/apps/studio/test/csrf-write-guard.test.ts

@@ -36,14 +36,31 @@ describe('CSRF Origin guard — sameOriginWrite (DDR-105)', () => {
     expect(sameOriginWrite(post('http://localhost:4399.evil.example'))).toBe(false);
     // Right host, wrong port is still cross-origin.
     expect(sameOriginWrite(post('http://localhost:4400'))).toBe(false);
-    // Right host:port, wrong scheme is still cross-origin.
-    expect(sameOriginWrite(post('https://localhost:4399'))).toBe(false);
   });
 
   test('allows the legit same-origin shell Origin', () => {
     expect(sameOriginWrite(post(SELF))).toBe(true);
   });
 
+  test('a matching host on a different SCHEME is same-origin — TLS terminates at the cell proxy', () => {
+    // The second half of the inspector-edits RCA. In a cell the browser sends
+    // `https://<host>` but the studio serves plaintext and computes `req.url` as
+    // `http://<host>`, so a scheme-strict compare 403'd every legitimate shell
+    // write. Host+port still pins it; a cross-site page has a different host.
+    const cell = 'https://alligators.cloud.maude.sh';
+    const cellReq = (origin?: string) =>
+      new Request('http://alligators.cloud.maude.sh/_api/edit-css', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...(origin ? { origin } : {}) },
+        body: '{}',
+      });
+    expect(sameOriginWrite(cellReq(cell))).toBe(true); // https Origin ↔ http req.url, same host
+    // But a genuinely different host is still rejected, scheme notwithstanding.
+    expect(sameOriginWrite(cellReq('https://evil.cloud.maude.sh'))).toBe(false);
+    // And the port still discriminates when present.
+    expect(sameOriginWrite(post('https://localhost:4400'))).toBe(false);
+  });
+
   test('allows a request with no Origin header (curl / programmatic / bun:test)', () => {
     expect(sameOriginWrite(post())).toBe(true);
   });