@1agh/maude 0.58.0 → 0.58.1

package/apps/studio/test/artboard-hug-commit.test.ts

@@ -0,0 +1,36 @@
+// artboard-hug-commit.ts — issue #79. The Artboard Inspector's Height
+// NumberField silently dropped a typed value whenever the artboard was in
+// Hug mode (fixed=false, the default per DDR-027 Design Decision 1) — Width
+// always worked because it has no such mode. Typing a height should instead
+// promote the artboard to Fixed at that height, same as the Hug/Fixed
+// toggle's own freeze-current-height write.
+
+import { describe, expect, test } from 'bun:test';
+
+import { resolveHeightCommit } from '../artboard-hug-commit.ts';
+
+describe('artboard-hug-commit / resolveHeightCommit', () => {
+  test('fixed=true → plain resize (Width-field parity)', () => {
+    expect(resolveHeightCommit(true, 480)).toEqual({ kind: 'resize', height: 480 });
+  });
+
+  test('fixed=false (Hug, the default) → promotes to Fixed at the typed height', () => {
+    // Before the fix this typed value was dropped entirely (no action) —
+    // reproducing "when I want to set height... manually from inspector
+    // panel, nothing happened. Width works."
+    expect(resolveHeightCommit(false, 480)).toEqual({ kind: 'promote-to-fixed', height: 480 });
+  });
+
+  test('rounds a fractional typed value', () => {
+    expect(resolveHeightCommit(true, 480.6)).toEqual({ kind: 'resize', height: 481 });
+    expect(resolveHeightCommit(false, 480.6)).toEqual({ kind: 'promote-to-fixed', height: 481 });
+  });
+
+  test('non-finite or non-positive input → noop, in either mode', () => {
+    expect(resolveHeightCommit(true, Number.NaN)).toEqual({ kind: 'noop' });
+    expect(resolveHeightCommit(true, 0)).toEqual({ kind: 'noop' });
+    expect(resolveHeightCommit(true, -10)).toEqual({ kind: 'noop' });
+    expect(resolveHeightCommit(false, Number.NaN)).toEqual({ kind: 'noop' });
+    expect(resolveHeightCommit(false, 0)).toEqual({ kind: 'noop' });
+  });
+});

package/apps/studio/test/clip-ops.test.ts

@@ -31,6 +31,11 @@ import {
 
 const CANVAS = '/abs/Canvas.tsx';
 
+// Adversarial fixture (security review 2026-07-30) — a prompt embedding a
+// fake </AIPlaceholder> close tag + template-literal/env-var syntax, proving
+// the JSON.stringify escaping discipline (DDR-150 P1) holds under attack.
+const EVIL = '*/ `backtick` ${process.env.HOME} </AIPlaceholder> "q" \\';
+
 const SERIES = [
   "import { TransitionSeries } from '@remotion/transitions';",
   'const S1 = 90;',
@@ -568,8 +573,6 @@ describe('greenfield first drop (Task 20)', () => {
 });
 
 describe('AIPlaceholder insert + resolve (Tasks 21–22)', () => {
-  const EVIL = '*/ `backtick` ${process.env.HOME} </AIPlaceholder> "q" \\';
-
   test('prompt is JSON.stringified into the JSX (injection fixtures) and enumerates back', () => {
     const r = applyInsertClipAt(CANVAS, SERIES, 'a', {
       lane: 'storyline',
@@ -833,4 +836,83 @@ describe('layers model — set-text + move between layers', () => {
     expect(cc.clips.filter((c) => c.tag === 'Sequence').length).toBe(0); // overlay row gone
     expect(back.source).toContain('const TOTAL = 270;'); // exact content end again
   });
+
+  // Bug: issue #81 — an AI placeholder slate (no media src yet) was refused by
+  // both move verbs, so it could never leave the storyline it was dropped
+  // into. A placeholder has no <src> to graft, but it has a prompt + kind
+  // that can ride over unchanged.
+  test('AI placeholder beat → overlay layer keeps the prompt (no media src required)', () => {
+    const withPh = applyInsertClipAt(CANVAS, HARDCUT, 'a', {
+      lane: 'storyline',
+      index: 3,
+      durationInFrames: 60,
+      placeholder: { prompt: 'drone shot over Brno', kind: 'veo' },
+    });
+    const r = applyMoveClipToOverlay(
+      CANVAS,
+      withPh.source,
+      'a',
+      withPh.stableId as string,
+      undefined
+    );
+    const cc = enumerateClips(CANVAS, r.source, 'a');
+    const overlays = cc.clips.filter((c) => c.tag === 'Sequence');
+    expect(overlays.length).toBe(1);
+    expect(overlays[0]?.placeholder?.prompt).toBe('drone shot over Brno');
+    expect(overlays[0]?.mediaSrc).toBe(null);
+    const beats = cc.clips.filter((c) => c.kind === 'sequence' && c.tag !== 'Sequence');
+    expect(beats.length).toBe(3); // the placeholder beat left the storyline
+  });
+
+  test('AI placeholder overlay → storyline round-trips the prompt back into a beat', () => {
+    const withPh = applyInsertClipAt(CANVAS, HARDCUT, 'a', {
+      lane: 'overlay',
+      from: 0,
+      durationInFrames: 45,
+      placeholder: { prompt: 'sunset time-lapse', kind: 'image' },
+    });
+    const back = applyMoveClipToStoryline(
+      CANVAS,
+      withPh.source,
+      'a',
+      withPh.stableId as string,
+      undefined
+    );
+    const cc = enumerateClips(CANVAS, back.source, 'a');
+    const beats = cc.clips.filter((c) => c.kind === 'sequence' && c.tag !== 'Sequence');
+    expect(beats.some((c) => c.placeholder?.prompt === 'sunset time-lapse')).toBe(true);
+    expect(cc.clips.filter((c) => c.tag === 'Sequence').length).toBe(0); // overlay row gone
+  });
+
+  // Adversarial (security review 2026-08-07): the move path must go through
+  // the same JSON.stringify escaping as a fresh insert (DDR-150 P1) — prove
+  // it with the same EVIL fixture the insert/resolve suite uses above, not
+  // just infer it from code-path sharing.
+  test('AI placeholder move preserves EVIL-prompt escaping (F-A3 companion)', () => {
+    const withPh = applyInsertClipAt(CANVAS, HARDCUT, 'a', {
+      lane: 'storyline',
+      index: 3,
+      durationInFrames: 60,
+      placeholder: { prompt: EVIL, kind: 'veo' },
+    });
+    const moved = applyMoveClipToOverlay(
+      CANVAS,
+      withPh.source,
+      'a',
+      withPh.stableId as string,
+      undefined
+    );
+    expect(moved.source).toContain(`<span>{${JSON.stringify(EVIL)}}</span>`);
+    const back = applyMoveClipToStoryline(
+      CANVAS,
+      moved.source,
+      'a',
+      moved.stableId as string,
+      undefined
+    );
+    expect(back.source).toContain(`<span>{${JSON.stringify(EVIL)}}</span>`);
+    const cc = enumerateClips(CANVAS, back.source, 'a');
+    const beats = cc.clips.filter((c) => c.kind === 'sequence' && c.tag !== 'Sequence');
+    expect(beats.some((c) => c.placeholder?.prompt === EVIL)).toBe(true);
+  });
 });

package/apps/studio/test/timeline-media-cache.test.ts

@@ -0,0 +1,41 @@
+// timeline-media-cache.test.ts — bug fix: dropping a clip on the timeline
+// used to always trim it to a flat 3s instead of its real duration
+// (durationInFrames was `Math.round(fps * 3)` regardless of the probed
+// media length). durationFramesForDrop is the pure decision the drop
+// handler in app.jsx now delegates to.
+
+import { describe, expect, test } from 'bun:test';
+
+import { durationFramesForDrop } from '../client/panels/timeline-media-cache.js';
+
+describe('durationFramesForDrop', () => {
+  test('uses the real probed duration, not the flat 3s default', () => {
+    // A 7.4s clip at 30fps must land at its own length (222 frames), not the
+    // fixed fps*3 = 90 frames the drop handler used to hardcode.
+    expect(durationFramesForDrop(30, 7.4)).toBe(Math.round(30 * 7.4));
+    expect(durationFramesForDrop(30, 7.4)).not.toBe(Math.round(30 * 3));
+  });
+
+  test('rounds to the nearest frame', () => {
+    expect(durationFramesForDrop(24, 2.501)).toBe(60); // 24 * 2.501 = 60.024
+  });
+
+  test('falls back to 3s when no duration was probed (null/failed probe)', () => {
+    expect(durationFramesForDrop(30, null)).toBe(90);
+    expect(durationFramesForDrop(30, undefined)).toBe(90);
+    expect(durationFramesForDrop(30, NaN)).toBe(90);
+  });
+
+  test('falls back to 3s for a non-positive probed duration', () => {
+    expect(durationFramesForDrop(30, 0)).toBe(90);
+    expect(durationFramesForDrop(30, -1)).toBe(90);
+  });
+
+  test('a caller can override the fallback (e.g. synthetic content)', () => {
+    expect(durationFramesForDrop(30, null, 5)).toBe(150);
+  });
+
+  test('never returns less than 1 frame', () => {
+    expect(durationFramesForDrop(30, 0.001)).toBeGreaterThanOrEqual(1);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.58.0",
+  "version": "0.58.1",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -54,13 +54,13 @@
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.58.0",
-    "@1agh/maude-darwin-x64": "0.58.0",
-    "@1agh/maude-linux-arm64": "0.58.0",
-    "@1agh/maude-linux-arm64-musl": "0.58.0",
-    "@1agh/maude-linux-x64": "0.58.0",
-    "@1agh/maude-linux-x64-musl": "0.58.0",
-    "@1agh/maude-win32-x64": "0.58.0"
+    "@1agh/maude-darwin-arm64": "0.58.1",
+    "@1agh/maude-darwin-x64": "0.58.1",
+    "@1agh/maude-linux-arm64": "0.58.1",
+    "@1agh/maude-linux-arm64-musl": "0.58.1",
+    "@1agh/maude-linux-x64": "0.58.1",
+    "@1agh/maude-linux-x64-musl": "0.58.1",
+    "@1agh/maude-win32-x64": "0.58.1"
   },
   "files": [
     "cli",