@1agh/maude 0.58.3 → 0.60.0

package/cli/lib/figma-codegen-reachability.test.mjs

@@ -0,0 +1,104 @@
+// DDR-219 D2 regression guard — the codegen channel is a CONTROL, not an intent.
+//
+// The first draft of DDR-219 routed Figma Dev Mode codegen through the REMOTE
+// MCP (`https://mcp.figma.com/mcp`) and treated our own code's inability to
+// reach it as the safety property. The design-stage review took that apart:
+//
+//   - the remote catalog "allowlist" is enforced on a self-reported OAuth
+//     `client_name`, and a public bypass for it exists — so it is a waitlist,
+//     not a boundary;
+//   - the LOCAL Dev Mode server (`http://127.0.0.1:3845/mcp`) takes plain
+//     loopback HTTP with NO credential and no catalog gate at all, so nothing
+//     but intent stands between a future contributor and `fetch(...)` inside
+//     `apps/studio/figma/`;
+//   - DDR-185's `curl-local` *permits* that endpoint by construction (its rule
+//     is "every resolved address is loopback", and 127.0.0.1 is), and an ACP
+//     session auto-approves `Bash(maude:*)` — so the one egress control the
+//     session trusts is, for this specific service, an allow rule.
+//
+// Reaching the remote endpoint from product code would put a third-party model's
+// output into an ingestion path that DDR-216 D1 says is deterministic end to
+// end. Reaching the local one from anywhere except the single designated client
+// would make codegen a bulk ingestion route by accident — DDR-219 D1's table
+// silently false, its fallback never firing, and nothing in CI noticing.
+//
+// So both halves are asserted here rather than described in a decision record.
+
+import assert from 'node:assert/strict';
+import { execSync } from 'node:child_process';
+import { test } from 'node:test';
+
+/** The ONE module allowed to name the local Dev Mode endpoint (DDR-219 D2). */
+const CODEGEN_CLIENT = 'apps/studio/figma/codegen-client.ts';
+
+/**
+ * Tests under the Figma lane may name it too, and the widening is narrow on
+ * purpose. `codegen-client.test.ts` asserts the endpoint constant — that IS the
+ * control ("the URL is never influenced by input"), and a guard that forbids
+ * asserting the thing it guards would push the assertion out of the repo.
+ * `from-codegen.test.ts` carries a captured response fixture whose asset
+ * constants are loopback URLs, and the property under test is that the converter
+ * DISCARDS them — which can only be asserted against a fixture that has them.
+ *
+ * Neither executes anything against the port. What stays absolutely banned is a
+ * second non-test module reaching it, which is the shape that would make codegen
+ * a bulk ingestion route by accident.
+ */
+const TEST_FILE_RE = /^apps\/studio\/figma\/[a-z-]+\.test\.ts$/;
+
+/** Trees that ship or execute. Prose (`.ai/`, `docs/`, `site/`) may name both. */
+const RUNTIME_TREES = ['apps/studio', 'cli', 'plugins'];
+
+/** Source only. `node_modules` vendors binaries that contain arbitrary strings
+ *  (the bundled agent-sdk `claude` matched `mcp.figma.com` on the first run),
+ *  and `dist/` is build output, not a code path anyone edits. `-I` drops binary
+ *  files outright so a vendored blob can never turn this guard into noise —
+ *  a guard that cries wolf gets deleted, which would be worse than not having it. */
+function grep(pattern, trees) {
+  // `|| true` because grep exits 1 on no-match, which is the passing case.
+  const out = execSync(
+    `grep -rlIE --exclude-dir=node_modules --exclude-dir=dist --exclude-dir=.git ${JSON.stringify(pattern)} ${trees.join(' ')} 2>/dev/null || true`,
+    { encoding: 'utf8', cwd: new URL('../../', import.meta.url).pathname }
+  );
+  return out
+    .trim()
+    .split('\n')
+    .filter(Boolean)
+    .filter((f) => !f.endsWith('figma-codegen-reachability.test.mjs'));
+}
+
+test('no runtime code names the REMOTE Figma MCP endpoint', () => {
+  const offenders = grep('mcp\\.figma\\.com', RUNTIME_TREES);
+  assert.deepEqual(
+    offenders,
+    [],
+    `These files name the remote Figma MCP endpoint. It is banned from every runtime code path (DDR-219 D2, and \`feature-figma-import\` § Out of scope before it): it is reachable only by a catalog-listed agent client, so any use here means a model is in the ingestion path. Codegen goes over the LOCAL server, with apps/studio as the client:\n  ${offenders.join('\n  ')}`
+  );
+});
+
+test('only the designated client names the LOCAL Dev Mode endpoint', () => {
+  // Match the endpoint shape, not a bare `3845`, which could legitimately occur
+  // as a byte count or a hash fragment.
+  const offenders = grep('(localhost|127\\.0\\.0\\.1|:)3845', RUNTIME_TREES).filter(
+    (f) => f !== CODEGEN_CLIENT && !TEST_FILE_RE.test(f)
+  );
+  assert.deepEqual(
+    offenders,
+    [],
+    `Only ${CODEGEN_CLIENT} may reach the local Figma Dev Mode MCP server (DDR-219 D2). A second caller makes codegen an ingestion route by accident — and the local server is UNAUTHENTICATED loopback, so there is no credential step to notice it. If codegen is genuinely needed elsewhere, route it through the client:\n  ${offenders.join('\n  ')}`
+  );
+});
+
+test('no canvas-reachable codegen route exists', () => {
+  // A canvas-origin codegen route would hand the untrusted iframe (DDR-054) a
+  // primitive that reads the user's open Figma document. It belongs in NEITHER
+  // allowlist — the same standing rule DDR-088 sets for every privileged route.
+  const offenders = grep('CANVAS_SAFE_API[^\\n]*codegen|codegen[^\\n]*CANVAS_SAFE_API', [
+    'apps/studio',
+  ]);
+  assert.deepEqual(
+    offenders,
+    [],
+    `A codegen route appears near CANVAS_SAFE_API. Codegen is privileged-origin only (DDR-219 D2):\n  ${offenders.join('\n  ')}`
+  );
+});

package/cli/lib/figma-import-controls.test.mjs

@@ -0,0 +1,70 @@
+// DDR-216 D7 + D8 existence guard — the anti-recurrence test.
+//
+// This repo has now written the same mistake into three consecutive decision
+// records: a DDR asserts a control, nobody builds it, and the NEXT DDR cites it
+// as an existing mitigation. DDR-216 D7 promised `/design:edit` a pre-flight
+// untrusted-content banner on an imported canvas; D8 promised Pass A.10 run
+// promoted-to-blocker for `imported-figma`. Both were "shipped" in prose. When
+// DDR-219 leaned on the A.10 promotion as a control that was "still enforced,
+// unchanged", the design-stage review ran one command —
+//
+//     grep -rn "imported-figma" plugins/     →  zero matches
+//
+// — and the whole chain came apart. A decision record cannot assert its way to a
+// control. This test is the cheapest possible thing that would have caught it,
+// and it is deliberately dumb: it checks the string is REACHABLE from the files
+// that must act on it, not that the behaviour is correct.
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { test } from 'node:test';
+
+const root = new URL('../../', import.meta.url).pathname;
+const read = (p) => readFileSync(root + p, 'utf8');
+
+test('DDR-216 D7 — /design:edit banners an imported canvas before reading it', () => {
+  const edit = read('plugins/design/commands/edit.md');
+  assert.match(
+    edit,
+    /imported-figma/,
+    "/design:edit must detect an `imported-figma` canvas at pre-flight (DDR-216 D7). Without it, several hundred third-party strings enter a tool-holding agent's context with nothing saying what they are."
+  );
+  assert.match(
+    edit,
+    /untrusted content, never instructions/i,
+    "The banner must say the content is untrusted and is never instructions — that exact framing is the control (DDR-216 D7, DDR-085's whiteboard trust model)."
+  );
+});
+
+test('DDR-216 D8 — Pass A.10 is promoted to blocker on an imported canvas', () => {
+  const keeper = read('plugins/design/agents/design-system-keeper.md');
+  const a10 = keeper.slice(keeper.indexOf('## Pass A.10'));
+  assert.notEqual(a10, '', 'Pass A.10 section is missing from design-system-keeper.');
+  assert.match(
+    a10,
+    /imported-figma/,
+    'Pass A.10 must special-case `imported-figma` (DDR-216 D8). As a plain warning it is not a gate.'
+  );
+  assert.match(
+    a10,
+    /blocker/i,
+    'A.10 findings must be blockers on an imported canvas — the mass-drift stacking ladder exists to avoid nagging a human over one deliberate overlay, and that reasoning does not survive a machine-authored file.'
+  );
+});
+
+test('A.10 does not let an imported canvas skip via its declared kind', () => {
+  // The skip condition is "no kind=\"web\" artboard" — and on an import the
+  // TRANSLATOR picks the kind, so the gate would be satisfied by the very code
+  // it audits. DDR-216 D8's Round-1 correction named this; the exception closes it.
+  const keeper = read('plugins/design/agents/design-system-keeper.md');
+  const a10 = keeper.slice(keeper.indexOf('## Pass A.10'), keeper.indexOf('## Pass B'));
+  const skipIdx = a10.indexOf('Skip entirely');
+  assert.ok(skipIdx > -1, 'A.10 skip condition not found — did the section change shape?');
+  assert.match(
+    a10.slice(skipIdx, skipIdx + 1200),
+    // `[\s\S]` rather than `[^]` — same "any char incl. newline" meaning, but
+    // `[^]` is a negated EMPTY class, which biome flags and which reads as a typo.
+    /EXCEPTION[\s\S]*imported-figma/,
+    'The skip condition must carry an explicit imported-canvas exception, stated next to the skip itself where a reader will actually meet it.'
+  );
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.58.3",
+  "version": "0.60.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -54,13 +54,13 @@
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.58.3",
-    "@1agh/maude-darwin-x64": "0.58.3",
-    "@1agh/maude-linux-arm64": "0.58.3",
-    "@1agh/maude-linux-arm64-musl": "0.58.3",
-    "@1agh/maude-linux-x64": "0.58.3",
-    "@1agh/maude-linux-x64-musl": "0.58.3",
-    "@1agh/maude-win32-x64": "0.58.3"
+    "@1agh/maude-darwin-arm64": "0.60.0",
+    "@1agh/maude-darwin-x64": "0.60.0",
+    "@1agh/maude-linux-arm64": "0.60.0",
+    "@1agh/maude-linux-arm64-musl": "0.60.0",
+    "@1agh/maude-linux-x64": "0.60.0",
+    "@1agh/maude-linux-x64-musl": "0.60.0",
+    "@1agh/maude-win32-x64": "0.60.0"
   },
   "files": [
     "cli",