@1agh/maude 0.58.2 → 0.58.3

package/apps/studio/test/fetch-asset-gate.test.ts

@@ -0,0 +1,189 @@
+// `_fetch-asset.mjs` — the gate's pure decision functions, plus the three
+// DDR-216 additions. Standing tests, not optional hardening: DDR-216's
+// Consequences names each of these by hand because this is a SHARED,
+// security-reviewed helper whose OTHER caller (the DDR-147 moodboard lane) has
+// no host allowlist at all.
+
+import { describe, expect, test } from 'bun:test';
+
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import {
+  FetchAssetError,
+  fetchAsset,
+  parseHttpsTarget,
+  sniffImageExt,
+  sniffStagedKind,
+} from '../bin/_fetch-asset.mjs';
+
+const FIGMA_HOSTS = ['figma.com', 'figma-alpha-api.s3.us-west-2.amazonaws.com'];
+
+const png = () => Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0]);
+const svg = (s = '<svg xmlns="http://www.w3.org/2000/svg"><rect/></svg>') => Buffer.from(s, 'utf8');
+
+describe('the host allowlist is exact-or-dotted-suffix, never endsWith', () => {
+  test.each([
+    ['the apex', 'https://figma.com/x'],
+    ['a real subdomain', 'https://www.figma.com/x'],
+    ['a deep subdomain', 'https://a.b.figma.com/x'],
+    ['the render bucket, exactly', 'https://figma-alpha-api.s3.us-west-2.amazonaws.com/x'],
+  ])('admits %s', (_label, url) => {
+    expect(() => parseHttpsTarget(url, { allowHosts: FIGMA_HOSTS })).not.toThrow();
+  });
+
+  test.each([
+    // The classic suffix bug: a bare endsWith('figma.com') admits this.
+    ['a suffix look-alike', 'https://evil-figma.com/x'],
+    ['figma.com as a prefix of another domain', 'https://figma.com.evil.tld/x'],
+    ['an unrelated host', 'https://evil.tld/x'],
+    // A bare endsWith('.amazonaws.com') would admit EVERY S3 bucket on earth.
+    ['a different S3 bucket', 'https://attacker-bucket.s3.us-west-2.amazonaws.com/x'],
+    ['the bare bucket parent', 'https://s3.us-west-2.amazonaws.com/x'],
+  ])('refuses %s', (_label, url) => {
+    expect(() => parseHttpsTarget(url, { allowHosts: FIGMA_HOSTS })).toThrow(FetchAssetError);
+  });
+
+  test("an absent allowlist keeps today's unrestricted behaviour", () => {
+    // The moodboard/research lane passes no allowlist and must be untouched.
+    expect(() => parseHttpsTarget('https://upload.wikimedia.org/x.png')).not.toThrow();
+    expect(parseHttpsTarget('https://anything.example/x').host).toBe('anything.example');
+  });
+
+  test('a refusal names the host as a charset-validated token, never raw (D10)', () => {
+    try {
+      parseHttpsTarget('https://evil.tld/x', { allowHosts: FIGMA_HOSTS });
+      throw new Error('expected a rejection');
+    } catch (err) {
+      expect((err as Error).message).toMatch(/^host not in this lane's allowlist: [a-z0-9.-]+$/);
+    }
+  });
+});
+
+describe('port pinning is opt-in, and is new logic', () => {
+  test('the default still accepts any valid port (unchanged behaviour)', () => {
+    expect(parseHttpsTarget('https://example.test:8443/x').port).toBe(8443);
+  });
+
+  test('the pinned lane refuses a non-443 port', () => {
+    expect(() => parseHttpsTarget('https://figma.com:8443/x', { pinPort443: true })).toThrow(
+      FetchAssetError
+    );
+  });
+
+  test('the pinned lane accepts 443, explicit or implicit', () => {
+    expect(parseHttpsTarget('https://figma.com/x', { pinPort443: true }).port).toBe(443);
+    expect(parseHttpsTarget('https://figma.com:443/x', { pinPort443: true }).port).toBe(443);
+  });
+});
+
+describe('the allowlist NARROWS the gate — it never replaces the rest of it', () => {
+  test.each([
+    ['non-https', 'http://figma.com/x'],
+    ['embedded credentials', 'https://user:pw@figma.com/x'],
+    ['a file URL', 'file:///etc/passwd'],
+  ])('%s is still refused even on an allowlisted host', (_label, url) => {
+    expect(() => parseHttpsTarget(url, { allowHosts: FIGMA_HOSTS })).toThrow(FetchAssetError);
+  });
+});
+
+describe('sniffImageExt is NOT widened — the moodboard lane depends on it', () => {
+  test.each([
+    ['an SVG', svg()],
+    ['an XML-prologue SVG', svg('<?xml version="1.0"?><svg></svg>')],
+    ['an SVG comment prologue', svg('<!-- c --><svg></svg>')],
+    ['HTML', Buffer.from('<!doctype html><html></html>', 'utf8')],
+    ['a script', Buffer.from('alert(1)', 'utf8')],
+  ])('still returns null for %s', (_label, bytes) => {
+    // DDR-216 D11 step 6: this is THE test that makes the tempting two-line
+    // "just add svg to the sniff" fix fail CI. If it ever goes green for SVG,
+    // arbitrary remote vectors can land in the versioned, peer-synced assets/
+    // tree of a lane this feature never touches.
+    expect(sniffImageExt(bytes)).toBeNull();
+  });
+
+  test('still accepts a real raster', () => {
+    expect(sniffImageExt(png())).toBe('png');
+  });
+});
+
+describe('sniffStagedKind — the --raw-out accept set', () => {
+  test('accepts everything sniffImageExt accepts', () => {
+    expect(sniffStagedKind(png())).toBe('png');
+  });
+
+  test('additionally accepts SVG, which is the whole point of the mode', () => {
+    expect(sniffStagedKind(svg())).toBe('svg');
+    expect(sniffStagedKind(svg('<?xml version="1.0"?><svg></svg>'))).toBe('svg');
+  });
+
+  test('still REFUSES the things a bypass would let through', () => {
+    // `--raw-out` must never mean "skip the type gate" — that would turn the one
+    // reviewable downloader into an unsniffed one for the next caller.
+    expect(sniffStagedKind(Buffer.from('<!doctype html><html></html>', 'utf8'))).toBeNull();
+    expect(sniffStagedKind(Buffer.from('alert(1)', 'utf8'))).toBeNull();
+    expect(sniffStagedKind(Buffer.from('PKzipbytes', 'utf8'))).toBeNull();
+    expect(sniffStagedKind(Buffer.from('', 'utf8'))).toBeNull();
+  });
+
+  test('only the HEAD is probed — a late `<svg` does not rescue a blob', () => {
+    const late = Buffer.concat([Buffer.alloc(512, 0x41), svg()]);
+    expect(sniffStagedKind(late)).toBeNull();
+  });
+});
+
+describe('--raw-out containment survives an OS-symlinked temp root', () => {
+  test('a legitimate staging path under os.tmpdir() is ACCEPTED', async () => {
+    // The bug this pins: `realpathSync` on the root but not the target compares
+    // `/private/var/…` against `/var/…` on macOS (both `/var` and `/tmp` are
+    // OS-level symlinks) and rejects every legitimate path. It shipped, and the
+    // first real import skipped all 29 of its assets with a generic
+    // "download or sanitize failed". Same trap DDR-172 Decision 1 documents.
+    const dir = mkdtempSync(join(tmpdir(), 'raw-out-probe-'));
+    try {
+      const out = join(dir, 'staged.png');
+      // Reaches the network gate rather than the containment check: any throw
+      // must NOT be the containment one.
+      let err: unknown;
+      try {
+        await fetchAsset({
+          url: 'https://figma.com/definitely-not-real.png',
+          root: dir,
+          rawOut: out,
+          rawRoot: dir,
+          allowHosts: FIGMA_HOSTS,
+          maxTime: 1,
+        });
+      } catch (e) {
+        err = e;
+      }
+      expect((err as Error | undefined)?.message ?? '').not.toContain('--raw-out must resolve');
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('a path OUTSIDE the declared root is still refused', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'raw-out-probe-'));
+    try {
+      await expect(
+        fetchAsset({
+          url: 'https://figma.com/x.png',
+          root: dir,
+          rawOut: join(dir, '..', 'escaped.png'),
+          rawRoot: dir,
+          allowHosts: FIGMA_HOSTS,
+        })
+      ).rejects.toThrow(/--raw-out must resolve inside/);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  test('--raw-out without --raw-root is refused outright', async () => {
+    await expect(
+      fetchAsset({ url: 'https://figma.com/x.png', root: '/tmp', rawOut: '/tmp/x.png' })
+    ).rejects.toThrow(/requires --raw-root/);
+  });
+});

package/apps/studio/test/figma-provenance.test.ts

@@ -0,0 +1,108 @@
+// Provenance for an imported canvas (DDR-216 D7 / T9).
+//
+// The plan flags this exact prop-threading as having silently no-opped once
+// before: a badge shipped prop-threaded-but-never-stored, so `.meta.json` said
+// one thing and the tree showed nothing. So this asserts the SERVER half
+// end-to-end against a live `/_index-data` — that `kind` actually survives
+// `loadCanvasMeta` → `NOTABLE_KINDS` → the wire — rather than unit-testing a
+// constant that a missing wire would leave green.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import type { Subprocess } from 'bun';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+let proc: Subprocess;
+let base: string;
+let designRoot: string;
+
+const CANVAS = `import { DCArtboard, DesignCanvas } from '@maude/canvas-lib';
+export default function Canvas() {
+  return (
+    <DesignCanvas>
+      <DCArtboard id="node-2-23" label="Imported" width={400} height={300} kind="digital" />
+    </DesignCanvas>
+  );
+}
+`;
+
+beforeAll(async () => {
+  const sandbox = makeSandbox();
+  designRoot = sandbox.designRoot;
+  mkdirSync(join(designRoot, 'ui'), { recursive: true });
+
+  // An imported canvas: `kind` + a source block carrying IDENTIFIERS ONLY.
+  writeFileSync(join(designRoot, 'ui', 'imported.tsx'), CANVAS);
+  writeFileSync(
+    join(designRoot, 'ui', 'imported.meta.json'),
+    JSON.stringify({
+      kind: 'imported-figma',
+      source: {
+        fileKey: 'dGNzRC2kmrmGnOxaBa0RI7',
+        nodeId: '2:23',
+        importedAt: '2026-08-09T00:00:00.000Z',
+      },
+      layout: { artboards: [{ id: 'node-2-23', x: 0, y: 0 }] },
+    })
+  );
+
+  // A hand-authored canvas alongside it — the badge must NOT appear on this one.
+  writeFileSync(join(designRoot, 'ui', 'handmade.tsx'), CANVAS);
+  writeFileSync(join(designRoot, 'ui', 'handmade.meta.json'), JSON.stringify({ layout: {} }));
+
+  const port = nextPort();
+  base = `http://localhost:${port}`;
+  proc = await bootServer(sandbox.root, port);
+});
+
+afterAll(async () => {
+  await killProc(proc);
+});
+
+async function indexData(): Promise<Record<string, unknown>> {
+  const res = await fetch(`${base}/_index-data`);
+  expect(res.status).toBe(200);
+  return (await res.json()) as Record<string, unknown>;
+}
+
+describe('the imported-figma kind reaches the tree', () => {
+  test('canvasKinds carries it for the imported canvas', async () => {
+    const data = await indexData();
+    const kinds = data.canvasKinds as Record<string, string>;
+    const entry = Object.entries(kinds).find(([p]) => p.endsWith('imported.tsx'));
+    expect(entry).toBeDefined();
+    expect(entry?.[1]).toBe('imported-figma');
+  });
+
+  test('a hand-authored canvas gets NO kind — the badge means something', async () => {
+    const data = await indexData();
+    const kinds = data.canvasKinds as Record<string, string>;
+    expect(Object.keys(kinds).some((p) => p.endsWith('handmade.tsx'))).toBe(false);
+  });
+});
+
+describe('provenance carries identifiers only (D7)', () => {
+  test('no Figma NAME or node text is anywhere on the wire', async () => {
+    // `.meta.json` and `config.json` are versioned, peer-synced (DDR-054) AND
+    // read into multiple agents' context. DDR-172 Decision 8 traced exactly
+    // this class and ELIMINATED the free-text sink rather than bounding it;
+    // D7 applies the same elimination here.
+    const raw = JSON.stringify(await indexData());
+    expect(raw).not.toContain('Karta');
+    expect(raw).not.toContain('žluť');
+    expect(raw).not.toContain('<script');
+  });
+
+  test('the recorded source fields are charset-constrained shapes', async () => {
+    const meta = JSON.parse(
+      await Bun.file(join(designRoot, 'ui', 'imported.meta.json')).text()
+    ) as { source: { fileKey: string; nodeId: string; importedAt: string } };
+    expect(meta.source.fileKey).toMatch(/^[A-Za-z0-9]{10,64}$/);
+    expect(meta.source.nodeId).toMatch(/^[0-9]+:[0-9]+$/);
+    expect(Number.isNaN(Date.parse(meta.source.importedAt))).toBe(false);
+    // Exactly three fields — no room for a name, a title or a description.
+    expect(Object.keys(meta.source).sort()).toEqual(['fileKey', 'importedAt', 'nodeId']);
+  });
+});

package/apps/studio/test/figma-routes.test.ts

@@ -0,0 +1,294 @@
+// `/_api/figma/*` — the MAIN-origin half of DDR-216 D3.
+//
+// canvas-origin-gate.test.ts already asserts these routes are unreachable from
+// the segregated canvas origin. That proves the wrong property on its own: the
+// MAIN origin is reachable from any website the user visits while the dev
+// server is up. Round 1 of the DDR-216 security review found the first draft
+// named no CSRF / DNS-rebind guard at all, with a working PoC — a CORS-simple
+// POST that plants an attacker's PAT (`connect`) or spends the user's on an
+// attacker-chosen key (`probe`), opaque response, real side effect.
+//
+// So this file asserts the complementary half:
+//   • cross-site  → 403 (Sec-Fetch-Site, the `sameOriginWrite` guard)
+//   • foreign Host header → 403 (the DNS-rebinding `isTrustedRequestHost` guard)
+//   • the stored key is NEVER echoed on ANY response path
+//   • `probe` is gated as a WRITE even though it stores nothing — it spends the
+//     credential and reaches the network.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { Subprocess } from 'bun';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+const TOKEN = 'figd_ROUTECANARY_0123456789abcdef';
+
+let proc: Subprocess;
+let port: number;
+let base: string;
+let keysPath: string;
+let keysDir: string;
+
+beforeAll(async () => {
+  const { root } = makeSandbox();
+  keysDir = mkdtempSync(join(tmpdir(), 'maude-figma-routes-keys-'));
+  keysPath = join(keysDir, 'keys.json');
+  writeFileSync(keysPath, JSON.stringify({ keys: {} }), { mode: 0o600 });
+  port = nextPort();
+  base = `http://localhost:${port}`;
+  proc = await bootServer(root, port, { MAUDE_GEN_KEYS_PATH: keysPath });
+});
+
+afterAll(async () => {
+  await killProc(proc);
+  rmSync(keysDir, { recursive: true, force: true });
+});
+
+function storedToken(): string | undefined {
+  try {
+    return JSON.parse(readFileSync(keysPath, 'utf8')).keys?.figma;
+  } catch {
+    return undefined;
+  }
+}
+
+// The WRITE guard in this codebase is `sameOriginWrite`, which keys on `Origin`
+// — the header a browser stamps unspoofably on every cross-origin POST/DELETE.
+// (`Sec-Fetch-Site` is what `sameOriginRead` uses, for the GET case below where
+// browsers do NOT reliably send Origin.) These tests therefore send a real
+// cross-origin `Origin`, which is what an attacker page actually produces.
+describe('cross-origin writes are refused (the CSRF guard)', () => {
+  const EVIL = 'https://evil.example';
+  const PLANTED = 'figd_ATTACKER_PLANTED_0123456789';
+
+  test('POST /_api/figma/connect cross-origin is 403 and stores nothing', async () => {
+    const res = await fetch(`${base}/_api/figma/connect`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Origin: EVIL },
+      body: JSON.stringify({ token: PLANTED }),
+    });
+    expect(res.status).toBe(403);
+    expect(storedToken()).toBeUndefined();
+  });
+
+  test('POST /_api/figma/probe cross-origin is 403 — probe spends the credential', async () => {
+    const res = await fetch(`${base}/_api/figma/probe`, {
+      method: 'POST',
+      headers: { Origin: EVIL },
+    });
+    expect(res.status).toBe(403);
+  });
+
+  test('DELETE /_api/figma/connect cross-origin is 403', async () => {
+    const res = await fetch(`${base}/_api/figma/connect`, {
+      method: 'DELETE',
+      headers: { Origin: EVIL },
+    });
+    expect(res.status).toBe(403);
+  });
+
+  test('a CORS-simple POST (no preflight, text/plain) is still refused', async () => {
+    // The PoC shape from the DDR-216 review: a simple content type means no
+    // preflight and the page cannot read the response — but the side effect
+    // would land if the server allowed it. Origin is still stamped.
+    const res = await fetch(`${base}/_api/figma/connect`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'text/plain', Origin: EVIL },
+      body: JSON.stringify({ token: PLANTED }),
+    });
+    expect(res.status).toBe(403);
+    expect(storedToken()).toBeUndefined();
+  });
+});
+
+describe('cross-site reads are refused (Sec-Fetch-Site, the GET case)', () => {
+  test('GET /_api/figma/status with Sec-Fetch-Site: cross-site is 403', async () => {
+    // A no-cors GET from an attacker page passes the loopback guard and may omit
+    // Origin entirely, so `sameOriginWrite` cannot see it. Without the read
+    // guard this leaks whether the user has Figma connected.
+    const res = await fetch(`${base}/_api/figma/status`, {
+      headers: { 'Sec-Fetch-Site': 'cross-site' },
+    });
+    expect(res.status).toBe(403);
+  });
+});
+
+describe('a foreign Host header is refused (the DNS-rebinding guard)', () => {
+  for (const [label, host] of [
+    ['an attacker-controlled name', 'evil.example'],
+    ['a rebinding service name', 'figma.127.0.0.1.nip.io'],
+  ]) {
+    test(`GET /_api/figma/status with Host: ${label} is 403`, async () => {
+      const res = await fetch(`${base}/_api/figma/status`, { headers: { Host: host } });
+      expect(res.status).toBe(403);
+    });
+  }
+});
+
+describe('method gating', () => {
+  test('GET /_api/figma/connect is 405', async () => {
+    expect((await fetch(`${base}/_api/figma/connect`)).status).toBe(405);
+  });
+
+  test('GET /_api/figma/probe is 405 — probe is a write', async () => {
+    expect((await fetch(`${base}/_api/figma/probe`)).status).toBe(405);
+  });
+
+  test('POST /_api/figma/status is 405', async () => {
+    expect((await fetch(`${base}/_api/figma/status`, { method: 'POST' })).status).toBe(405);
+  });
+});
+
+describe('same-origin happy path — and the key never comes back out', () => {
+  test('status reports presence only, plus the granular scope to ask for', async () => {
+    const res = await fetch(`${base}/_api/figma/status`, {
+      headers: { 'Sec-Fetch-Site': 'same-origin' },
+    });
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Record<string, unknown>;
+    expect(body.configured).toBe(false);
+    // The blanket `files:read` scope is deprecated — the UI must never name it.
+    expect(body.requiredScope).toBe('file_content:read');
+    expect(JSON.stringify(body)).not.toContain('figd_');
+  });
+
+  test('connect stores the key and returns presence only — never the value', async () => {
+    const res = await fetch(`${base}/_api/figma/connect`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+      body: JSON.stringify({ token: TOKEN }),
+    });
+    expect(res.status).toBe(200);
+    const raw = await res.text();
+    expect(JSON.parse(raw)).toEqual({ configured: true });
+    expect(raw).not.toContain(TOKEN);
+    expect(raw).not.toContain('ROUTECANARY');
+    // It really did store it — the assertion above is about the RESPONSE, not
+    // about the write silently failing.
+    expect(storedToken()).toBe(TOKEN);
+  });
+
+  test('status still never echoes the value once one is configured', async () => {
+    const res = await fetch(`${base}/_api/figma/status`, {
+      headers: { 'Sec-Fetch-Site': 'same-origin' },
+    });
+    const raw = await res.text();
+    expect(JSON.parse(raw).configured).toBe(true);
+    expect(raw).not.toContain('ROUTECANARY');
+  });
+
+  test('a malformed token is refused with a message that does not echo it', async () => {
+    const junk = 'not a token REFLECTION_CANARY';
+    const res = await fetch(`${base}/_api/figma/connect`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+      body: JSON.stringify({ token: junk }),
+    });
+    expect(res.status).toBe(400);
+    const raw = await res.text();
+    expect(raw).not.toContain('REFLECTION_CANARY');
+    // The previously-stored good token is untouched by a failed write.
+    expect(storedToken()).toBe(TOKEN);
+  });
+
+  test('probe surfaces a typed failure without leaking the token', async () => {
+    // No network stub here — the real api.figma.com will reject this canary
+    // token (or the call fails to connect in CI). Either way the response must
+    // be a typed reason with a code-owned message and no credential in it.
+    const res = await fetch(`${base}/_api/figma/probe`, {
+      method: 'POST',
+      headers: { 'Sec-Fetch-Site': 'same-origin' },
+    });
+    const raw = await res.text();
+    expect(raw).not.toContain('ROUTECANARY');
+    expect(raw).not.toContain('figd_');
+    const body = JSON.parse(raw) as { ok: boolean; reason?: string };
+    if (!body.ok) {
+      expect(['unauthorized', 'forbidden', 'network', 'bad_response', 'rate_limited']).toContain(
+        body.reason
+      );
+    }
+  });
+
+  test('disconnect clears the key', async () => {
+    const res = await fetch(`${base}/_api/figma/connect`, {
+      method: 'DELETE',
+      headers: { 'Sec-Fetch-Site': 'same-origin' },
+    });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ configured: false });
+    expect(storedToken()).toBeUndefined();
+  });
+});
+
+describe('/_api/figma/import — same gate, and a validated body', () => {
+  test('cross-origin is 403 — it spends the PAT and writes to disk', async () => {
+    const res = await fetch(`${base}/_api/figma/import`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Origin: 'https://evil.example' },
+      body: JSON.stringify({ mode: 'board', url: 'https://www.figma.com/board/AAAAAAAAAA/x' }),
+    });
+    expect(res.status).toBe(403);
+  });
+
+  test('a foreign Host is 403', async () => {
+    const res = await fetch(`${base}/_api/figma/import`, {
+      method: 'POST',
+      headers: { Host: 'evil.example' },
+      body: '{}',
+    });
+    expect(res.status).toBe(403);
+  });
+
+  test('GET is 405', async () => {
+    expect((await fetch(`${base}/_api/figma/import`)).status).toBe(405);
+  });
+
+  test.each([
+    ['no body', {}],
+    ['unknown mode', { mode: 'everything', url: 'https://www.figma.com/board/AAAAAAAAAA/x' }],
+    ['missing url', { mode: 'board' }],
+    ['empty url', { mode: 'board', url: '' }],
+  ])('a malformed request is 400 (%s)', async (_label, body) => {
+    const res = await fetch(`${base}/_api/figma/import`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+      body: JSON.stringify(body),
+    });
+    expect(res.status).toBe(400);
+  });
+
+  test('a caller cannot choose an output path', async () => {
+    // The body shape is fixed: {mode, url, dryRun}. A slug/path/into field is
+    // simply not read — the same "the producer never picks its own target"
+    // discipline DDR-174 applies to its authoring agent.
+    const res = await fetch(`${base}/_api/figma/import`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+      body: JSON.stringify({
+        mode: 'board',
+        url: 'https://www.figma.com/board/AAAAAAAAAA/x',
+        slug: '../../etc/passwd',
+        into: '/etc/passwd',
+      }),
+    });
+    // It gets past validation (the url is well-formed) and fails on the
+    // credential instead — the point is that the path fields were ignored.
+    const raw = await res.text();
+    expect(raw).not.toContain('etc/passwd');
+    expect([400, 502]).toContain(res.status);
+  });
+
+  test('a failure never echoes an upstream string', async () => {
+    const res = await fetch(`${base}/_api/figma/import`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'Sec-Fetch-Site': 'same-origin' },
+      body: JSON.stringify({ mode: 'board', url: 'https://www.figma.com/board/AAAAAAAAAA/x' }),
+    });
+    const raw = await res.text();
+    expect(raw).not.toContain('figd_');
+    expect(raw).not.toContain('ROUTECANARY');
+  });
+});

package/apps/studio/test/git-cloud-posture.test.ts

@@ -0,0 +1,50 @@
+// DDR-218 (fix 8, sync RCA 2026-08-10) — the cloud-managed GitPanel posture.
+//
+// Source-level assertions, the cloud-shell-surfaces pattern: what these pin is
+// exactly what would regress — someone gating the withdrawal on `historyOnly`
+// alone (dropping the desktop half), breaking the live connect/disconnect
+// reaction, or wiring `cloudManaged` from something other than the
+// CORROBORATED link (`credentialed` — config.json alone is attacker-authorable,
+// B2).
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const STUDIO = join(import.meta.dir, '..');
+const APP = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
+const GIT_PANEL = readFileSync(join(STUDIO, 'client', 'panels', 'GitPanel.jsx'), 'utf8');
+const CLOUD_BAR = readFileSync(join(STUDIO, 'client', 'panels', 'CloudBar.jsx'), 'utf8');
+
+describe('a cloud-linked repo shows ONE save mechanism (DDR-218)', () => {
+  test('cloudManaged withdraws exactly like the cell-side historyOnly', () => {
+    expect(GIT_PANEL).toContain('const withdrawn = historyOnly || cloudManaged;');
+    // Every render gate the working-tree half hides behind must read the
+    // merged flag — a `!historyOnly` guard reintroduces the desktop leak.
+    expect(GIT_PANEL).toMatch(/\{!withdrawn && \(\s*<div className="gp-tabs"/);
+    expect(GIT_PANEL).toContain("{tab === 'changes' && !withdrawn ? (");
+  });
+
+  test('the posture reacts LIVE to connect/disconnect, not only at mount', () => {
+    // The initial useState alone would leave a freshly-linked panel on Changes.
+    expect(GIT_PANEL).toMatch(/useEffect\(\(\) => \{\s*if \(withdrawn\) setTab\('history'\);/);
+  });
+
+  test('the note names the active mechanism, and only in the desktop posture', () => {
+    expect(GIT_PANEL).toContain('data-testid="git-cloud-managed"');
+    expect(GIT_PANEL).toMatch(/\{cloudManaged && \(\s*<div className="gp-cloud-note"/);
+    expect(GIT_PANEL).toContain('Cloud is saving');
+  });
+
+  test('the app gate is the CORROBORATED link, and the cell posture is untouched', () => {
+    expect(APP).toContain('cloudManaged={!cfg.cloud && !!cloudLinkedHub?.credentialed}');
+    expect(APP).toContain('historyOnly={!!cfg.cloud}');
+  });
+
+  test('CloudBar lifts every link change the posture depends on', () => {
+    // status resolve + attach + detach — the three places the link changes.
+    const lifts = CLOUD_BAR.match(/onLinkedHub\?\.\(/g) ?? [];
+    expect(lifts.length).toBeGreaterThanOrEqual(3);
+    expect(APP).toContain('onLinkedHub={setCloudLinkedHub}');
+  });
+});

package/apps/studio/test/hub-link.test.ts

@@ -67,3 +67,14 @@ test('a second credential for the same hub replaces the token (per-machine key)'
   // Trust is not duplicated.
   expect(cfg.trusted.filter((u: string) => u === 'https://hub.example.dev')).toHaveLength(1);
 });
+
+test('role + expiresAt round-trip through the store (the renewal deadline survives)', () => {
+  saveHubCredential('https://hub.example.dev', 'mau_secret', 'member', 1786400000000);
+  const cfg = JSON.parse(readFileSync(process.env.HUBS_CONFIG_PATH as string, 'utf8'));
+  expect(cfg.hubs['https://hub.example.dev'].role).toBe('member');
+  expect(cfg.hubs['https://hub.example.dev'].expiresAt).toBe(1786400000000);
+  // Absent stays absent — a self-hosted hub's credential carries no deadline.
+  saveHubCredential('https://hub.example.dev', 'mau_secret2');
+  const cfg2 = JSON.parse(readFileSync(process.env.HUBS_CONFIG_PATH as string, 'utf8'));
+  expect(cfg2.hubs['https://hub.example.dev'].expiresAt).toBeUndefined();
+});