@1agh/maude 0.58.1 → 0.58.3

package/apps/studio/test/annotations-bindings.test.ts

@@ -46,19 +46,124 @@ describe('bindCandidate', () => {
     );
   });
 
-  test('only bindable tools host (no text/pen/arrow/link)', () => {
-    const label: TextStroke = {
-      id: 't',
-      tool: 'text',
-      color: '#1a1a1a',
-      fontSize: 14,
-      text: 'x',
-      x: 0,
-      y: 0,
-    };
-    expect(isBindable(label)).toBe(false);
-    expect(bindCandidate(0, 0, [label], BIND_THRESHOLD_PX)).toBeNull();
+  test('pen / arrow / link never host', () => {
     expect(isBindable(rect('r'))).toBe(true);
+    expect(
+      isBindable({ id: 'p', tool: 'pen', color: '#000', width: 2, points: [[0, 0]] } as Stroke)
+    ).toBe(false);
+    expect(
+      isBindable({
+        id: 'l',
+        tool: 'link',
+        x: 0,
+        y: 0,
+        w: 10,
+        h: 10,
+        url: 'https://x.test',
+        title: 't',
+        domain: 'x.test',
+      } as Stroke)
+    ).toBe(false);
+  });
+});
+
+// DDR-216 D9 — the widening, and the three exclusions that keep it from
+// regressing the NATIVE whiteboard. FigJam binds connectors to anything; on the
+// only real board measured, 2/2 connectors had an endpoint Maude could not bind,
+// so an imported connector degraded to a frozen line. Widening also closes a
+// plain native gap (you could not attach an arrow to a text label or a section).
+describe('isBindable widening — text + section (DDR-216 D9)', () => {
+  const standaloneText = (over: Partial<TextStroke> = {}): TextStroke => ({
+    id: 't',
+    tool: 'text',
+    color: '#1a1a1a',
+    fontSize: 14,
+    text: 'Archetyp',
+    x: 0,
+    y: 0,
+    ...over,
+  });
+
+  const section = (id: string, x = 0, y = 0, w = 400, h = 300): Stroke =>
+    ({ id, tool: 'section', x, y, w, h, label: 'Sekce', color: '#8b8b94' }) as Stroke;
+
+  test('standalone text IS bindable, and hosts a real bind', () => {
+    const label = standaloneText();
+    expect(isBindable(label)).toBe(true);
+    const bind = bindCandidate(1, 1, [label], BIND_THRESHOLD_PX);
+    expect(bind?.hostId).toBe('t');
+  });
+
+  test('ANCHORED text is NOT bindable — its bbox is unresolvable here', () => {
+    // `strokeBBox` returns null for anchored text without the anchors map, which
+    // every caller in this module omits. Admitting it would mint a bind that can
+    // never resolve — worse than not binding, because it never self-corrects.
+    const anchored = standaloneText({ anchorId: 'some-shape' });
+    expect(isBindable(anchored)).toBe(false);
+    expect(bindCandidate(0, 0, [anchored], BIND_THRESHOLD_PX)).toBeNull();
+  });
+
+  test('oversized text is NOT offered — no board-wide bind magnet', () => {
+    // A TextStroke has no stored w/h; strokeBBox synthesizes one from content,
+    // so 5 000 chars on one line projects a ~38 500 px-wide invisible strip.
+    const huge = standaloneText({ text: 'x'.repeat(5000) });
+    expect(isBindable(huge)).toBe(false);
+    // A rect under the cursor still wins, rather than the giant text stealing it.
+    const r = rect('r', 0, 0, 100, 100);
+    expect(bindCandidate(50, 50, [r, huge], BIND_THRESHOLD_PX)?.hostId).toBe('r');
+  });
+
+  test('a section binds on its BORDER, matching strokeHitTest', () => {
+    const s = section('sec');
+    expect(isBindable(s)).toBe(true);
+    expect(bindCandidate(0, 150, [s], BIND_THRESHOLD_PX)?.hostId).toBe('sec');
+  });
+
+  test('a section does NOT swallow binds through its click-through interior', () => {
+    // The natural gesture is to draw a section AROUND existing notes, which puts
+    // it later in the array = topmost. Testing its raw bbox would make every
+    // arrow drawn between two stickies inside it bind to the section instead.
+    const inner = rect('inner', 100, 100, 60, 60);
+    const s = section('sec', 0, 0, 400, 300);
+    const strokes: Stroke[] = [inner, s]; // section topmost
+    expect(bindCandidate(130, 130, strokes, BIND_THRESHOLD_PX)?.hostId).toBe('inner');
+    // Deep interior with nothing under it binds to nothing, not to the section.
+    expect(bindCandidate(300, 200, [s], BIND_THRESHOLD_PX)).toBeNull();
+  });
+
+  test('a bind whose anchorPoint cannot resolve is STRIPPED, not frozen-but-claimed', () => {
+    // Fix 2: `applyEnd` used to `return` silently when anchorPoint was null,
+    // which kept a bind that could never be honoured. Inert before the widening,
+    // load-bearing after it.
+    const ghost = standaloneText({ id: 'ghost', anchorId: 'gone' });
+    const ar = arrow('ar', {
+      x1: 0,
+      y1: 0,
+      x2: 100,
+      y2: 100,
+      startBind: { hostId: 'ghost', nx: 0.5, ny: 0.5 },
+    });
+    const out = recomputeBoundArrows([ghost, ar]);
+    const a = out.find((s) => s.id === 'ar') as ArrowStroke;
+    expect(a.startBind).toBeUndefined();
+    expect([a.x1, a.y1]).toEqual([0, 0]); // endpoint frozen in place, honestly
+  });
+
+  test('a bound arrow follows a text host as it moves', () => {
+    const label = standaloneText({ x: 0, y: 0 });
+    const ar = arrow('ar', {
+      x1: 0,
+      y1: 0,
+      x2: 300,
+      y2: 300,
+      startBind: { hostId: 't', nx: 0, ny: 0 },
+    });
+    const moved: Stroke[] = [{ ...label, x: 40, y: 60 }, ar];
+    const out = recomputeBoundArrows(moved);
+    const a = out.find((s) => s.id === 'ar') as ArrowStroke;
+    // The exact bbox is content-derived; what matters is that it TRACKED.
+    expect(a.startBind?.hostId).toBe('t');
+    expect(a.x1).not.toBe(0);
   });
 });
 
@@ -122,3 +227,36 @@ describe('facingAnchor (AI annotate / quick-create side pick)', () => {
     expect(facingAnchor(host, 50, -900)).toEqual({ hostId: 'h', nx: 0.5, ny: 0 });
   });
 });
+
+describe('the text bind cap is PER AXIS, not an area product (review F8)', () => {
+  test('a long single line at the font-size floor is NOT a bind host', () => {
+    // The area cap it replaced was satisfiable by exactly this shape: 4 000
+    // chars at fontSize 8 gives w ≈ 17 600 × h ≈ 9.6 — area 168 960, under a
+    // 640×480 product — i.e. a 17 600 px-wide invisible magnet.
+    const strip: TextStroke = {
+      id: 'strip',
+      tool: 'text',
+      color: '#1a1a1a',
+      fontSize: 8,
+      text: 'x'.repeat(4000),
+      x: 0,
+      y: 0,
+    };
+    expect(isBindable(strip)).toBe(false);
+    const r = rect('r', 100, 0, 100, 100);
+    expect(bindCandidate(150, 50, [r, strip], BIND_THRESHOLD_PX)?.hostId).toBe('r');
+  });
+
+  test('an ordinary label is still a bind host', () => {
+    const label: TextStroke = {
+      id: 't',
+      tool: 'text',
+      color: '#1a1a1a',
+      fontSize: 14,
+      text: 'Archetyp',
+      x: 0,
+      y: 0,
+    };
+    expect(isBindable(label)).toBe(true);
+  });
+});

package/apps/studio/test/canvas-create-api.test.ts

@@ -153,7 +153,10 @@ describe('/_api/canvas — POST round-trip', () => {
       expect(j.ok).toBe(true);
       const tsx = readFileSync(join(designRoot, 'ui', 'My Reel.tsx'), 'utf8');
       expect(tsx).toContain('<VideoComp component={Comp}');
-      expect(tsx).toContain('<OffthreadVideo src="assets/a.mp4" />');
+      // <Video> from @remotion/media, not <OffthreadVideo> — the renderer
+      // rejects the latter and the export loses its audio (RCA
+      // issue-mp4-audio-export-html5audio-silent-degrade).
+      expect(tsx).toContain('<Video src="assets/a.mp4" />');
       expect(tsx).toContain('<Audio src="assets/music.mp3" />');
       expect(tsx).toContain('name="clip-1"');
       const m = JSON.parse(readFileSync(join(designRoot, 'ui', 'My Reel.meta.json'), 'utf8'));

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -214,6 +214,19 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         '/_api/github/invite',
         '/_api/github/clone',
         '/_api/github/create-project',
+        // DDR-216 D3 — every /_api/figma/* route is MAIN-ORIGIN ONLY (absent from
+        // CANVAS_SAFE_API + startCanvasServer's `routes` map). A canvas-reachable
+        // Figma route would be a token-exfiltration primitive AND an SSRF
+        // primitive at once: `connect` stores the user's PAT, `probe` spends it,
+        // and `status` would leak whether one exists. A request from this origin
+        // 403s at the gate rather than reaching a handler. (The complementary
+        // cross-SITE guard — `isTrustedRequestHost` + `sameOriginWrite` on the
+        // MAIN origin, which allowlist omission does nothing about — lives in
+        // figma-routes.test.ts; both halves are required, neither is sufficient.)
+        '/_api/figma/status',
+        '/_api/figma/connect',
+        '/_api/figma/probe',
+        '/_api/figma/import',
         // Local-only project create (mkdir + git init + scaffold) — writes to disk,
         // no token; MAIN-ORIGIN ONLY, so the canvas origin must 403 at the gate.
         '/_api/project/create-local',

package/apps/studio/test/capture-determinism-shape.test.ts

@@ -0,0 +1,135 @@
+// Source-shape gates for capture determinism.
+//
+// These guard properties that only manifest in a browser under load, which CI
+// has no way to run — `test/exporters/pw-launch.test.ts` says as much ("the
+// launch path itself is integration-shape (needs a real browser)"), and
+// `test/export-shim-multi-capture.test.ts` exists precisely because of it. So,
+// in that same house style, the FIX SHAPE is asserted at the source level.
+//
+// Why these particular shapes: the plan's original premise was that frame-step
+// capture is "deterministic by construction" — a doc comment in video-comp.tsx
+// with nothing enforcing it. It was not true. A seek could fail silently, and
+// the capture wait could give up on a wall-clock timer and screenshot a stale
+// frame. Serially both were survivable; under any parallel capture neither is.
+// If someone deletes these guards, the resulting bug is a valid-looking video
+// with wrong frames — invisible to every other test we have.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const STUDIO = join(import.meta.dir, '..');
+const read = (rel: string) => readFileSync(join(STUDIO, rel), 'utf8');
+
+describe('the seek bridge must not report a seek that did not happen', () => {
+  const src = () => read('video-comp.tsx');
+
+  test('no empty catch swallows a failed seekTo', () => {
+    // The exact regression: `catch { /* comment only */ }` around the seek.
+    const emptyCatch = /catch\s*\{\s*(?:\/\*[\s\S]*?\*\/|\/\/[^\n]*)?\s*\}/g;
+    const body = src();
+    const seekRegion = body.slice(
+      body.indexOf('__maude_seek__ = async'),
+      body.indexOf('Ordinary-artboard fallback')
+    );
+    expect(seekRegion.length).toBeGreaterThan(0);
+    expect(seekRegion.match(emptyCatch)).toBeNull();
+  });
+
+  test('an unlanded seek throws rather than resolving', () => {
+    expect(src()).toContain('refusing to report a seek that did not happen');
+  });
+
+  test('failures are counted where the shim can read them', () => {
+    expect(src()).toContain('__maude_seek_failures__');
+  });
+
+  test('a cold Player still gets bounded retries — the fix is not "fail faster"', () => {
+    expect(src()).toContain('SEEK_ATTEMPTS');
+    expect(src()).toContain('seekEntryWithRetry');
+  });
+});
+
+describe('the capture shim must refuse a capture built on stale frames', () => {
+  test('it reads the in-page failure count and throws on any', () => {
+    const shim = read('bin/_video-playwright.mjs');
+    expect(shim).toContain('__maude_seek_failures__');
+    expect(shim).toMatch(/seekFailures\s*>\s*0/);
+    expect(shim).toContain('Refusing to encode');
+  });
+
+  test('the refusal happens BEFORE the encoded output is written', () => {
+    const shim = read('bin/_video-playwright.mjs');
+    const guardAt = shim.indexOf('seekFailures');
+    const writeAt = shim.indexOf('writeFileSync(out, Buffer.from(enc.b64');
+    expect(guardAt).toBeGreaterThan(0);
+    expect(writeAt).toBeGreaterThan(0);
+    // Ordering is the whole point — a check after the write ships the bad file.
+    expect(guardAt).toBeLessThan(writeAt);
+  });
+});
+
+describe('encoder guards (unit-shape — these run without a browser)', () => {
+  const enc = () => read('exporters/video-encode-lib.ts');
+
+  test('a mismatched frame is rejected, never silently resampled', () => {
+    const src = enc();
+    expect(src).toContain('refusing to resample');
+    // The check must precede the draw, or the resample already happened.
+    const guardAt = src.indexOf('refusing to resample');
+    const drawAt = src.indexOf('vstate.ctx.drawImage(bmp, 0, 0');
+    expect(guardAt).toBeGreaterThan(0);
+    expect(guardAt).toBeLessThan(drawAt);
+  });
+
+  test("latencyMode is pinned to 'quality' — 'realtime' may drop frames", () => {
+    expect(enc()).toContain("latencyMode: 'quality'");
+  });
+
+  test('the encoder canvas is NOT cleared between frames — pinned deliberately', () => {
+    // Current behaviour: a transparent artboard ghosts the previous frame,
+    // because nothing clears the canvas before drawImage. That is a real defect
+    // for transparent comps, but changing it is a visual change to every export
+    // and belongs in its own change with its own before/after. Pinned here so
+    // the next person changes it ON PURPOSE rather than as a side effect.
+    expect(enc()).not.toContain('clearRect');
+  });
+});
+
+describe('bundle cache paths must be content-addressed', () => {
+  test('no fixed-name temp bundle two servers could race on', () => {
+    const src = read('exporters/_browser-bundles.ts');
+    expect(src).toContain('writeHashedBundle');
+    expect(src).not.toContain("'maude-video-encode-lib.mjs'");
+    expect(src).not.toContain("'maude-video-render-lib.mjs'");
+  });
+});
+
+describe('the video shim must guard its output size', () => {
+  test('it calls assertRenderOutputSizeOk like the pdf shim does', () => {
+    const shim = read('bin/_video-playwright.mjs');
+    expect(shim).toContain(
+      "assertRenderOutputSizeOk(clip.width, clip.height, deviceScaleFactor, '_video-playwright')"
+    );
+  });
+});
+
+describe('timing telemetry must not break the summary contract', () => {
+  test('MAUDE_TIMING is filtered in _runtime.ts, not in an adapter', () => {
+    const rt = read('exporters/_runtime.ts');
+    expect(rt).toContain('TIMING_LINE');
+    expect(rt).toContain('onTiming');
+    // video.ts parses stdoutLines.at(-1) as its summary JSON — an unfiltered
+    // trailing diagnostic line would break EVERY video export.
+    const video = read('exporters/video.ts');
+    expect(video).toContain('stdoutLines.at(-1)');
+    expect(video).not.toContain('MAUDE_TIMING');
+  });
+
+  test('both capture paths emit it, so they are comparable', () => {
+    const shim = read('bin/_video-playwright.mjs');
+    expect(shim).toContain("path: 'frame-step'");
+    expect(shim).toContain("path: 'renderer'");
+    expect(shim).toContain('stageMs');
+  });
+});

package/apps/studio/test/clip-addressing.test.ts

@@ -708,7 +708,12 @@ describe('assembleCompSource — refs → comp (DDR-150 P4 Task 12)', () => {
     ]);
     expect(tsx).toContain('<Audio src="assets/music.mp3" />');
     expect(tsx).toContain(`import { TransitionSeries } from '@remotion/transitions';`);
-    expect(tsx).toContain(`import { AbsoluteFill, OffthreadVideo, Audio } from 'remotion';`);
+    // Media elements MUST come from @remotion/media — importing them from
+    // 'remotion' is what made every assembled reel export muted (RCA
+    // issue-mp4-audio-export-html5audio-silent-degrade).
+    expect(tsx).toContain(`import { Video, Audio } from '@remotion/media';`);
+    expect(tsx).toContain(`import { AbsoluteFill } from 'remotion';`);
+    expect(tsx).not.toContain(`Audio } from 'remotion'`);
     // total driven by the video clip's duration (audio doesn't extend it).
     expect(enumerateClips('/abs/R.tsx', tsx, 'reel').durationInFrames).toBe(90);
   });

package/apps/studio/test/clip-ops.test.ts

@@ -755,7 +755,11 @@ describe('applyEnsureVideoComp — kind="video" artboard upgrade', () => {
     expect(r.source).toContain('<VideoComp component={VideoCut}');
     expect(r.source).toContain('width={1280} height={800}');
     expect(r.source).toMatch(/import \{[^}]*AbsoluteFill[^}]*\} from 'remotion';/);
-    expect(r.source).toContain('<OffthreadVideo src="assets/x.mp4" />');
+    // The canvas declares `export default function Video()`, so the inserted
+    // media element is ALIASED to dodge the collision — it is no longer
+    // rewritten to <OffthreadVideo>, which silently cost the audio track.
+    expect(r.source).toContain('<MaudeVideo src="assets/x.mp4" />');
+    expect(r.source).toContain(`import { Video as MaudeVideo } from '@remotion/media';`);
     const cc = enumerateClips('/abs/Video.tsx', r.source, 'brief');
     expect(cc.compName).toBe('VideoCut');
     expect(cc.clips.length).toBe(1);

package/apps/studio/test/cloud-endpoints.test.ts

@@ -12,6 +12,7 @@ import { join } from 'node:path';
 import {
   connectOutcomeNote,
   isDisplayableUrl,
+  isLinkedProjectRow,
   localIdentityHint,
   parseDeepLink,
   shareViewUrl,
@@ -187,6 +188,101 @@ describe('status — names the LOCAL half so a deep link can be read', () => {
   });
 });
 
+describe('isLinkedProjectRow — Connected is a state only a credentialed link earns (fix 7)', () => {
+  const CLOUD = 'https://cloud.maude.sh';
+  const row = (over = {}) =>
+    isLinkedProjectRow({
+      projectUrl: 'https://alligators.cloud.maude.sh',
+      linkedHubUrl: 'https://alligators.cloud.maude.sh',
+      linkedHubCredentialed: true,
+      cloudUrl: CLOUD,
+      ...over,
+    });
+
+  test('linked + credentialed → the row is Connected', () => {
+    expect(row()).toBe(true);
+  });
+  test('linked but UNCREDENTIALED still offers Connect — config.json travels with the repo (B2)', () => {
+    expect(row({ linkedHubCredentialed: false })).toBe(false);
+  });
+  test('an unrelated project keeps its Connect button', () => {
+    expect(row({ projectUrl: 'https://dugmate.cloud.maude.sh' })).toBe(false);
+  });
+  test('unlinked folder: no row is Connected', () => {
+    expect(row({ linkedHubUrl: null, linkedHubCredentialed: false })).toBe(false);
+  });
+  test('self-host addresses carry no project label — exact origin decides', () => {
+    expect(
+      row({
+        projectUrl: 'http://127.0.0.1:8788',
+        linkedHubUrl: 'http://127.0.0.1:8788',
+        cloudUrl: 'http://127.0.0.1:8788',
+      })
+    ).toBe(true);
+    // Two stubs on different ports are two different workspaces.
+    expect(
+      row({
+        projectUrl: 'http://127.0.0.1:8788',
+        linkedHubUrl: 'http://127.0.0.1:9999',
+        cloudUrl: 'http://127.0.0.1:8788',
+      })
+    ).toBe(false);
+  });
+  test('a label on one side and none on the other never matches', () => {
+    expect(row({ projectUrl: 'http://127.0.0.1:8788' })).toBe(false);
+  });
+});
+
+describe('detach — the in-app unlink (fix 7 Disconnect)', () => {
+  test('drops linkedHub + the hub credential, cycles the runtime to solo; idempotent', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const { mkdirSync, existsSync } = await import('node:fs');
+    const repoRoot = join(scratch, 'detach-me');
+    const designRoot = join(repoRoot, '.design');
+    mkdirSync(designRoot, { recursive: true });
+    const hubUrl = 'https://alligators.cloud.maude.sh';
+    writeFileSync(
+      join(designRoot, 'config.json'),
+      JSON.stringify({ designRoot: '.design', linkedHub: { url: hubUrl, linkedAt: 1 } })
+    );
+    writeFileSync(
+      join(scratch, 'hubs.json'),
+      JSON.stringify({ hubs: { [hubUrl]: { token: 'mau_x', linkedAt: 1 } }, trusted: [hubUrl] })
+    );
+
+    const restarts: unknown[] = [];
+    const api = createCloudEndpoints({
+      paths: { repoRoot, designRoot },
+      syncControl: {
+        restart: async (linkedHub) => {
+          restarts.push(linkedHub);
+          return { syncing: false, canvases: 0, reason: 'unlinked' };
+        },
+      },
+    });
+
+    const r = await api.detach();
+    expect(r.status).toBe(200);
+    expect((r.json as { detached?: boolean }).detached).toBe(true);
+    // The committed half is gone, the rest of config.json survives.
+    const cfg = JSON.parse(readFileSync(join(designRoot, 'config.json'), 'utf8'));
+    expect(cfg.linkedHub).toBeUndefined();
+    expect(cfg.designRoot).toBe('.design');
+    // The credential + trust entry are gone too (the CLI unlink default).
+    const hubs = JSON.parse(readFileSync(join(scratch, 'hubs.json'), 'utf8'));
+    expect(hubs.hubs[hubUrl]).toBeUndefined();
+    expect(hubs.trusted).not.toContain(hubUrl);
+    // The runtime was cycled with the explicit unlink sentinel, not undefined.
+    expect(restarts).toEqual([null]);
+    expect(existsSync(join(designRoot, 'config.json'))).toBe(true);
+
+    // Second detach: still ok, nothing to do.
+    const again = await api.detach();
+    expect(again.status).toBe(200);
+    expect((again.json as { detached?: boolean }).detached).toBe(false);
+  });
+});
+
 describe('localIdentityHint — only an exact, corroborated agreement is silent', () => {
   const CLOUD = 'https://cloud.maude.sh';