@1agh/maude 0.58.2 → 0.58.3

package/apps/studio/annotations-bindings.ts

@@ -17,18 +17,69 @@ import {
   rotatePoint,
   type Stroke,
   strokeBBox,
+  strokeHitTest,
   strokeRotation,
 } from './annotations-model.ts';
 
-/** Hosts an arrow endpoint can attach to (shapes + cards, FigJam set). */
+/**
+ * The largest bbox a TEXT stroke may present as a bind target, PER AXIS.
+ *
+ * A `TextStroke` has no stored `w`/`h` — `strokeBBox` SYNTHESIZES one from the
+ * content (`max(8, longest * fontSize * 0.55)` wide). So a long single line can
+ * project a bind strip tens of thousands of px wide, and `bindCandidate` scans
+ * topmost-first with no area preference: one such stroke would silently become a
+ * board-wide magnet that steals every endpoint the user drags. Text bigger than
+ * a plausible label is therefore not offered as a host at all (DDR-216 D9).
+ */
+export const MAX_TEXT_BIND_W = 1200;
+export const MAX_TEXT_BIND_H = 480;
+
+/**
+ * Hosts an arrow endpoint can attach to (shapes + cards, FigJam set).
+ *
+ * **Widened to `text` + `section` (DDR-216 D9).** FigJam binds connectors to
+ * anything, and on the only real board measured 2/2 connectors had at least one
+ * endpoint Maude could not bind — so an imported connector degraded to a frozen
+ * line. It is also a plain native gap: you could not attach an arrow to a text
+ * label or a section, independent of import.
+ *
+ * Three deliberate exclusions, each closing a regression the naive widening
+ * would have introduced:
+ *
+ *  1. **ANCHORED text is still not bindable.** `bindCandidate`/`anchorPoint`/
+ *     `recomputeBoundArrows` call `strokeBBox(s)` WITHOUT the anchors map, and
+ *     for a text stroke with `anchorId` that returns `null`. Admitting it would
+ *     mint a bind that `anchorPoint` can never resolve — and `applyEnd` would
+ *     keep it (it only strips when the host stops being bindable), freezing the
+ *     arrow at stale coordinates forever. That is strictly worse than today's
+ *     honest "strip the bind, freeze the endpoint". Anchored text lives inside a
+ *     host shape which is itself bindable, so nothing is lost: bind to the shape.
+ *  2. **Oversized text is not offered** — see `MAX_TEXT_BIND_W`/`_H`.
+ *  3. **Groups are not bindable by construction** — Maude groups are a flat
+ *     `groupIds[]` tag array, not addressable objects. A group-targeted import
+ *     endpoint falls back to the group's geometric bbox and is reported.
+ */
 export function isBindable(s: Stroke): boolean {
-  return (
+  if (
     s.tool === 'rect' ||
     s.tool === 'ellipse' ||
     s.tool === 'polygon' ||
     s.tool === 'sticky' ||
     s.tool === 'image'
-  );
+  ) {
+    return true;
+  }
+  if (s.tool === 'section') return true;
+  if (s.tool === 'text') {
+    if (s.anchorId) return false; // (1) — no resolvable bbox without the anchors map
+    const bb = strokeBBox(s);
+    // Per-AXIS, not an area product: an area cap is satisfiable by a very wide,
+    // very short strip, which is precisely the board-wide magnet shape. 4 000
+    // chars at the fontSize floor of 8 gives w ≈ 17 600 × h ≈ 9.6 — area 168 960,
+    // comfortably under a 640×480 product (post-implementation review F8).
+    return !!bb && bb.w > 0 && bb.h > 0 && bb.w <= MAX_TEXT_BIND_W && bb.h <= MAX_TEXT_BIND_H; // (2)
+  }
+  return false;
 }
 
 /** Bind proximity threshold in world px at zoom 1 (Excalidraw's 15 px). */
@@ -78,6 +129,20 @@ export function bindCandidate(
     ) {
       continue;
     }
+    // A SECTION is a large container, and the natural gesture is to draw one
+    // AROUND existing notes — which puts it later in the array, i.e. topmost.
+    // Testing its raw bbox would make the whole interior a magnet, so every
+    // arrow drawn between two stickies inside a section would bind to the
+    // section instead. `strokeHitTest` already encodes the right rule (a section
+    // is grabbed by its BORDER or its label chip; the interior stays
+    // click-through), so defer to it rather than inventing a second geometry.
+    //
+    // Deliberately NOT "prefer the smallest containing bbox": containment here
+    // is over a bbox INFLATED by `threshold`, so smallest-area lets an 8×8 dot
+    // 14 px AWAY beat the large rect the pointer is actually inside — and it
+    // inverts the visual invariant, letting a shape hidden behind an opaque one
+    // win a bind the user cannot see happening (DDR-216 D9 fix 4).
+    if (s.tool === 'section' && !strokeHitTest(s, wx, wy, threshold)) continue;
     return {
       hostId: s.id,
       nx: snapMagnet(clamp01((wx - bb.x) / bb.w)),
@@ -155,7 +220,21 @@ export function recomputeBoundArrows(strokes: readonly Stroke[]): Stroke[] {
         }
       }
       const pt = anchorPoint(host, effective.nx, effective.ny);
-      if (!pt) return;
+      if (!pt) {
+        // The host is bindable but its bbox is unresolvable right now (e.g. a
+        // text stroke whose anchors map isn't reachable from here). Returning
+        // silently would KEEP a bind that can never be honoured — the arrow
+        // would freeze at stale coordinates permanently, across save/load,
+        // while still claiming to be attached. Strip it instead: the arrow
+        // survives unbound with its endpoint frozen, which is the same honest
+        // degradation a deleted host already gets. (DDR-216 D9 fix 2 — inert
+        // before the `isBindable` widening, load-bearing after it.)
+        const copy: ArrowStroke = { ...next };
+        delete copy[end === 'start' ? 'startBind' : 'endBind'];
+        next = copy;
+        mutated = true;
+        return;
+      }
       if (end === 'start') {
         if (next.x1 !== pt[0] || next.y1 !== pt[1]) {
           next = { ...next, x1: pt[0], y1: pt[1] };

package/apps/studio/api.ts

@@ -5260,7 +5260,12 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     // `loadCanvasMeta` call the DDR-093 DS-map loop below already makes for
     // non-path-owned (`ui/`) canvases — no extra I/O for the common case.
     const canvasKinds: Record<string, string> = {};
-    const NOTABLE_KINDS = new Set(['reconstructed-experimental']);
+    // DDR-216 D7 adds `imported-figma`. The badge deliberately reads as
+    // THIRD-PARTY CONTENT rather than as provenance-therefore-trustworthy: a
+    // clean "imported from Figma" stamp otherwise makes the most
+    // attacker-influenced artifact in the tree look like real design work, to a
+    // human AND to `design-system-keeper` / the critic panel.
+    const NOTABLE_KINDS = new Set(['reconstructed-experimental', 'imported-figma']);
     const defaultDs = cfg.defaultDesignSystem || cfg.designSystems?.[0]?.name || 'project';
     // A file under `system/<folder>/` belongs to the DS that owns that folder —
     // path-authoritative, because specimens/ui_kits rarely carry a sidecar

package/apps/studio/bin/_fetch-asset.mjs

@@ -39,9 +39,9 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { lookup } from 'node:dns/promises';
-import { existsSync, mkdirSync, readFileSync, renameSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync } from 'node:fs';
 import { isIP } from 'node:net';
-import { join, resolve, sep } from 'node:path';
+import { basename, dirname, join, resolve, sep } from 'node:path';
 import { pathToFileURL } from 'node:url';
 
 // A real browser UA — some CDNs (wikimedia) 403 a bare curl/UA; the memory
@@ -202,7 +202,7 @@ export function classifyAddress(addr) {
  * FetchAssetError (code 3) on anything else — non-https scheme, embedded
  * credentials, missing host.
  */
-export function parseHttpsTarget(rawUrl) {
+export function parseHttpsTarget(rawUrl, opts = {}) {
   let u;
   try {
     u = new URL(rawUrl);
@@ -221,9 +221,71 @@ export function parseHttpsTarget(rawUrl) {
   if (!Number.isInteger(port) || port < 1 || port > 65535) {
     throw new FetchAssetError(3, `bad port ${u.port}`);
   }
+  // DDR-216 D4 — an OPTIONAL host allowlist, at the gate rather than at the
+  // caller. Absent (the default) = today's unrestricted behaviour, so the
+  // existing moodboard/research callers are untouched. The Figma lane always
+  // passes it.
+  //
+  // Matching is exact-or-DOTTED-SUFFIX, never a bare `endsWith`: `endsWith(
+  // 'figma.com')` admits `evil-figma.com`, and `endsWith('.amazonaws.com')`
+  // admits every S3 bucket on earth.
+  //
+  // This is a REACH control (which endpoint), never a CONTENT control — the
+  // Figma render bucket is a SHARED object store any account can write into,
+  // so the byte-level sniff below is what actually protects the tree. And it
+  // NARROWS the IP gate, never replaces it: an allowlisted hostname that
+  // resolves to 127.0.0.1 is still refused by `resolveSafeIp`.
+  if (opts.allowHosts?.length) {
+    const h = host.toLowerCase();
+    const ok = opts.allowHosts.some((suffix) => {
+      const s = String(suffix).toLowerCase().replace(/^\./, '');
+      return h === s || h.endsWith(`.${s}`);
+    });
+    if (!ok) throw new FetchAssetError(3, `host not in this lane's allowlist: ${safeHostLabel(h)}`);
+  }
+  // DDR-216 D4 — the Figma lane pins 443. Named as NEW logic rather than
+  // assumed: this function accepts 1–65535 by default and always has.
+  if (opts.pinPort443 && port !== 443) {
+    throw new FetchAssetError(3, `this lane requires port 443 (got ${port})`);
+  }
   return { host, port };
 }
 
+/**
+ * A hostname reduced to a charset-validated token before it can be printed.
+ *
+ * DDR-216 D10: this verb's output is read BY an agent, so an upstream-controlled
+ * string must never appear verbatim in a message. A DNS label charset is narrow
+ * enough to be safe and specific enough to diagnose.
+ */
+function safeHostLabel(host) {
+  const cleaned = String(host)
+    .toLowerCase()
+    .replace(/[^a-z0-9.-]/g, '');
+  return cleaned.slice(0, 253) || '(unprintable)';
+}
+
+/**
+ * The `--raw-out` accept set: everything `sniffImageExt` accepts, PLUS SVG.
+ *
+ * `sniffImageExt` is deliberately NOT modified — it is the type gate the
+ * moodboard lane depends on, and a standing test asserts it still returns null
+ * for `<svg`/`<?xml`. The SVG probe below reuses the exact leading-token shape
+ * `_import-asset.mjs`'s own `svgPreParseReject` uses, so a payload accepted here
+ * is one that lane will actually attempt to parse (and then sanitize).
+ */
+export function sniffStagedKind(bytes) {
+  const raster = sniffImageExt(bytes);
+  if (raster) return raster;
+  // Text probe on the first bytes only — never decode the whole body to guess.
+  const head = Buffer.from(bytes.subarray(0, 256)).toString('utf8');
+  // Deliberately NARROWER than `svgPreParseReject`'s own leading-token set: a
+  // bare `<!--` prologue is legal SVG but it is also what lets an arbitrary text
+  // payload masquerade as one (review F2), and no Figma export starts with it.
+  // The full DDR-167 lane still validates properly downstream.
+  return /^\s*(<\?xml|<svg)/i.test(head) ? 'svg' : null;
+}
+
 // ── image sniff + naming ─────────────────────────────────────────────────────
 
 /**
@@ -408,10 +470,91 @@ export async function fetchAsset({
   designRootRel = '.design',
   maxBytes = DEFAULT_MAX_BYTES,
   maxTime = DEFAULT_MAX_TIME,
+  allowHosts,
+  pinPort443 = false,
+  rawOut = null,
+  rawRoot = null,
 }) {
-  const { host, port } = parseHttpsTarget(url);
+  const { host, port } = parseHttpsTarget(url, { allowHosts, pinPort443 });
   const pinIp = await resolveSafeIp(host);
 
+  // ── `--raw-out` (DDR-216 D11) ──────────────────────────────────────────────
+  //
+  // Download under the FULL network gate (IP classification, DNS pin, redirect
+  // ban, size/time caps, host allowlist) but write to a CALLER-SUPPLIED path
+  // instead of `assets/`, and do NOT content-address or name the file.
+  //
+  // Why this exists: D11 composes two already-reviewed gates rather than
+  // widening one. A Figma vector export is an SVG, and this helper's raster-only
+  // sniff is load-bearing for its OTHER caller (the DDR-147 moodboard lane,
+  // where URLs are research-harvested and there is no allowlist at all). So the
+  // Figma lane stages the bytes here and hands them to `_import-asset.mjs`'s
+  // DDR-167 SVG lane (allowlist DOM-sanitize → SVGO validity gate) before
+  // anything is named or lands in the versioned tree.
+  //
+  // IT STILL SNIFFS. `--raw-out` must never mean "skip the type gate" — that
+  // would turn the one reviewable downloader into an unsniffed one (HTML, JS,
+  // polyglots, archives) for the next caller who copies it. It sniffs against
+  // an EXTENDED accept set; `sniffImageExt` itself is untouched, which is what
+  // keeps the standing "sniffImageExt still rejects SVG" test literally true.
+  if (rawOut) {
+    // CONTAINMENT (post-implementation review F2). Without this, `--raw-out`
+    // was an arbitrary-file-write primitive on the ONE helper whose whole job
+    // is to be the safe downloader: `resolve()` + `renameSync()` with no root
+    // relationship, no charset assertion, and a type gate a leading `<!--`
+    // satisfies. An agent that can run `maude design fetch-asset` (ACP
+    // default-allows `Bash(maude:*)`) could have written remote bytes over
+    // `CLAUDE.md` — durable prompt injection.
+    //
+    // So the mode now REQUIRES the caller to declare the directory it owns, and
+    // the target must resolve inside it. The Figma lane passes its per-run
+    // staging dir; there is no way to express "anywhere".
+    if (!rawRoot) {
+      throw new FetchAssetError(2, '--raw-out requires --raw-root (the directory the caller owns)');
+    }
+    // BOTH sides get realpath'd, or neither. On macOS `/var` and `/tmp` are
+    // themselves OS-level symlinks (`-> /private/var`, `-> /private/tmp`), so
+    // realpath'ing only the root compares `/private/var/…` against `/var/…` and
+    // rejects EVERY legitimate staging path — which is exactly how this shipped
+    // and why the first real import skipped all 29 of its assets. Same trap
+    // DDR-172 Decision 1 documents for its own symlink check.
+    //
+    // The target does not exist yet, so realpath its PARENT (which does — the
+    // caller made the staging dir) and rebuild the leaf onto it.
+    const rootAbs = realpathSync(resolve(rawRoot));
+    const requested = resolve(rawOut);
+    const parentAbs = realpathSync(dirname(requested));
+    const outAbs = join(parentAbs, basename(requested));
+    if (outAbs !== rootAbs && !outAbs.startsWith(rootAbs + sep)) {
+      throw new FetchAssetError(6, '--raw-out must resolve inside --raw-root');
+    }
+    // Never overwrite: a staged download is always a fresh file, so an existing
+    // target means either a collision or an attempt to clobber something.
+    if (existsSync(outAbs)) {
+      throw new FetchAssetError(6, '--raw-out target already exists');
+    }
+    const tmpRaw = `${outAbs}.part`;
+    try {
+      curlDownload({ url, host, port, pinIp, tmpAbs: tmpRaw, maxBytes, maxTime });
+      let data;
+      try {
+        data = readFileSync(tmpRaw);
+      } catch {
+        throw new FetchAssetError(4, 'download produced no file');
+      }
+      if (data.length === 0) throw new FetchAssetError(4, 'downloaded empty body');
+      if (data.length > maxBytes) throw new FetchAssetError(4, `file exceeds ${maxBytes} bytes`);
+      const kind = sniffStagedKind(data);
+      if (!kind) {
+        throw new FetchAssetError(5, 'not a png/jpg/gif/webp/svg payload (HTML/script rejected)');
+      }
+      renameSync(tmpRaw, outAbs);
+      return { ref: null, path: outAbs, name: null, bytes: data.length, ext: kind };
+    } finally {
+      rmSync(tmpRaw, { force: true });
+    }
+  }
+
   const { assetsDir } = containedAssetPath(root, designRootRel, 'placeholder.png');
   mkdirSync(assetsDir, { recursive: true });
   const tmpAbs = join(
@@ -476,6 +619,21 @@ function parseArgv(argv) {
       case '--max-time':
         out.maxTime = Number(argv[++i]);
         break;
+      // DDR-216 D4/D11 — all three default to today's behaviour, so every
+      // existing caller of this helper is untouched.
+      case '--allow-host':
+        if (!out.allowHosts) out.allowHosts = [];
+        out.allowHosts.push(argv[++i]);
+        break;
+      case '--pin-port-443':
+        out.pinPort443 = true;
+        break;
+      case '--raw-out':
+        out.rawOut = argv[++i];
+        break;
+      case '--raw-root':
+        out.rawRoot = argv[++i];
+        break;
       case '--json':
         out.json = true;
         break;
@@ -540,8 +698,14 @@ async function main() {
       designRootRel: opts.designRoot,
       maxBytes: opts.maxBytes,
       maxTime: opts.maxTime,
+      ...(opts.allowHosts ? { allowHosts: opts.allowHosts } : {}),
+      ...(opts.pinPort443 ? { pinPort443: true } : {}),
+      ...(opts.rawOut ? { rawOut: opts.rawOut } : {}),
+      ...(opts.rawRoot ? { rawRoot: opts.rawRoot } : {}),
     });
-    process.stdout.write(opts.json ? `${JSON.stringify(r)}\n` : `${r.ref}\n`);
+    // `--raw-out` has no canvas ref (it deliberately writes outside `assets/`),
+    // so print the staged path instead of a null.
+    process.stdout.write(opts.json ? `${JSON.stringify(r)}\n` : `${r.ref ?? r.path}\n`);
   } catch (err) {
     process.stderr.write(`fetch-asset: ${err.message}\n`);
     process.exit(err instanceof FetchAssetError ? err.code : 1);

package/apps/studio/bin/_import-asset.mjs

@@ -623,6 +623,78 @@ export async function importSvg(svgText, { root, designRootRel = '.design' }) {
  * only the rasterize step is blocked, so this fails loud there rather than
  * pretending the whole pipeline is unavailable.
  */
+
+/**
+ * The execution canary for MANY sanitized SVGs, in ONE browser session.
+ *
+ * Same coverage as `runSvgExecutionCanary`, same probe, same hard network
+ * denial, same directly-navigated document — the only thing that changes is
+ * that the session is created once instead of once per file.
+ *
+ * Why it exists: measured on a real 6-page product file, a per-file canary cost
+ * ~4.5 s each, so a normal design system's icon set (530 distinct vector
+ * renders after component dedupe) would have taken ~40 minutes and forced the
+ * import to drop most of its artwork against an asset-count cap. The canary is
+ * not what needed relaxing — the session-per-file was.
+ *
+ * Returns the set of indices that TRIPPED, so the caller refuses exactly those
+ * and keeps the rest. A tripped canary is still a hard refusal for that file.
+ */
+export async function runSvgExecutionCanaryBatch(sanitizedSvgs, { timeoutMs = 15_000 } = {}) {
+  const tripped = new Set();
+  if (sanitizedSvgs.length === 0) return tripped;
+  const dir = mkdtempSync(join(tmpdir(), 'maude-import-svg-batch-'));
+  const probePath = join(dir, 'probe.js');
+  try {
+    writeFileSync(probePath, 'window.__MAUDE_IMPORT_CANARY__ = false;\n');
+    const paths = sanitizedSvgs.map((svg, i) => {
+      const p = join(dir, `candidate-${i}.svg`);
+      writeFileSync(p, svg);
+      return p;
+    });
+    await withSandboxedRender(
+      async (session) => {
+        for (let i = 0; i < paths.length; i += 1) {
+          session.open(pathToFileURL(paths[i]).href);
+          // The probe re-runs on EVERY navigation in this session (it is
+          // registered as an init script), so the flag is per-document — a
+          // clean file after a tripped one still reads false.
+          if (session.eval('window.__MAUDE_IMPORT_CANARY__ === true').trim() === 'true') {
+            tripped.add(i);
+          }
+        }
+      },
+      { timeoutMs, initScriptPath: probePath }
+    );
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  return tripped;
+}
+
+/**
+ * Sanitize + canary + write MANY SVGs. The batched counterpart of `importSvg`.
+ * Returns one result per input, or `null` where the file was refused.
+ */
+export async function importSvgBatch(svgTexts, { root, designRootRel = '.design' }) {
+  const sanitized = svgTexts.map((t) => {
+    try {
+      return sanitizeSvgAllowlist(t);
+    } catch {
+      return null;
+    }
+  });
+  const live = [];
+  for (let i = 0; i < sanitized.length; i += 1) if (sanitized[i] !== null) live.push(i);
+
+  const tripped = await runSvgExecutionCanaryBatch(live.map((i) => sanitized[i]));
+  return sanitized.map((svg, i) => {
+    if (svg === null) return null;
+    if (tripped.has(live.indexOf(i))) return null;
+    return writeContainedAsset(root, designRootRel, Buffer.from(svg, 'utf8'), 'svg');
+  });
+}
+
 export async function importPdf(inputPath, { root, designRootRel = '.design' }) {
   const buffer = readPdfCapped(inputPath);
   const pageCount = await getPdfPageCountIsolated(buffer);