@1agh/maude 0.60.7 → 1.0.3

package/apps/studio/test/canvas-origin-gate.test.ts

@@ -248,6 +248,18 @@ describe('canvas-origin gate — A1/A2 traversal + privilege containment', () =>
         // budget. A GET here 403s at the gate, never 405 from a reached handler.
         '/_api/sync/resync',
         '/_api/sync/cancel-assets',
+        // feature-before-first-external-users Task 2 — the sync toggles write
+        // `.design/config.json` linkedHub and can restart the sync runtime.
+        // From the canvas origin this would let untrusted content turn
+        // delete-propagation on or settle a first-anchor hold against the
+        // user — MAIN-ORIGIN ONLY, absent from both allowlists.
+        '/_api/sync/settings',
+        // Ownership mutations (adopt/detach) rewrite `.gitignore` + the git
+        // index and can drop the hub link — MAIN-ORIGIN ONLY, same posture.
+        '/_api/sync/ownership',
+        // Task 3 (F-6) — restore MOVES parked files into the live project and
+        // prune DELETES them; untrusted canvas content gets neither primitive.
+        '/_api/sync/trash',
         // ACP chat attachments (POST upload + GET thumbnail serve) are MAIN-ORIGIN
         // ONLY — absent from CANVAS_SAFE_API + startCanvasServer's routes. The
         // untrusted canvas origin must never read (or write) the user's pasted

package/apps/studio/test/canvas-shell-build-error.test.ts

@@ -0,0 +1,49 @@
+// Spike finding M8 (studyfi-design AWS run, 2026-08-20) — the mount's catch
+// showed `err.stack`, which for a failed dynamic import is the bare
+// "TypeError: Failed to fetch dynamically imported module". The 422 body the
+// server wrote ("Canvas build error: this canvas imports …") names the culprit
+// and the rule — and the browser throws it away on non-2xx. The spike spent
+// several rounds on token/cookie hypotheses before a manual curl surfaced the
+// body.
+//
+// The shell is a static template, so this suite pins the WIRING the way
+// canvas-shell-base.test.ts does: the diagnosis helper exists, and both import
+// failure paths (initial mount + soft reload) route through it instead of
+// printing the TypeError.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const SHELL = readFileSync(
+  join(import.meta.dir, '..', '..', '..', 'plugins', 'design', 'templates', '_shell.html'),
+  'utf8'
+);
+
+describe('a canvas build error reaches the person (M8)', () => {
+  test('the shell carries the import-failure diagnosis helper', () => {
+    expect(SHELL).toContain('function diagnoseImportFailure(');
+    // It refetches the module URL to recover the discarded response body…
+    expect(SHELL).toMatch(/diagnoseImportFailure[\s\S]{0,400}fetch\(url/);
+    // …and shows the body, not just the status line.
+    expect(SHELL).toMatch(/r\.text\(\)/);
+  });
+
+  test('the initial mount catch routes through the diagnosis, not err.stack', () => {
+    expect(SHELL).toContain('diagnoseImportFailure(canvasUrl, err).then(showError)');
+    // The old shape — showError straight from the stack — must not come back.
+    expect(SHELL).not.toContain('showError((err && err.stack) || String(err))');
+  });
+
+  test('the soft-reload holding toast gets the same diagnosis', () => {
+    const soft = SHELL.slice(SHELL.indexOf('function softReload'), SHELL.indexOf('function softReload') + 1500);
+    expect(soft).toContain('diagnoseImportFailure(canvasUrl, err)');
+  });
+
+  test('a 2xx refetch falls back to the original error — the diagnosis never masks a module-level throw', () => {
+    // If the module fetches fine, the failure was inside the module (a runtime
+    // throw at import time). Showing an "HTTP 200" line there would point the
+    // person at the network when the bug is in their code.
+    expect(SHELL).toMatch(/if \(r\.ok\) return fallback/);
+  });
+});

package/apps/studio/test/cloud-history-hardening.test.ts

@@ -0,0 +1,165 @@
+// The three MEDIUM findings from the 8134ca8f security re-review, pinned.
+//
+// These are BEHAVIOURAL, not source-text pins — the re-review's own closing
+// note was that the posture suite pins the letter and not the behaviour, and
+// that nothing exercised the two findings most worth a regression test.
+//
+//   F1  a transient cloud failure, or a MUTABLE ref, must never be remembered
+//       as "this version does not exist". Caching either turns an outage (or a
+//       later commit) into a permanent 404 that only a restart clears.
+//   F2  the cell is not trusted to respect its own limits — an oversized
+//       response must be refused, not buffered for the whole timeout.
+//   F3  `git show` output is decoded across chunk boundaries, so a canvas with
+//       non-ASCII copy must survive a body larger than one pipe chunk.
+
+import { describe, expect, test } from 'bun:test';
+import { spawn } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { StringDecoder } from 'node:string_decoder';
+
+describe('F1 — only an authoritative absence is remembered', () => {
+  // The decision the route makes, extracted exactly as it is written there.
+  const shouldCache = (r: { ok: boolean; reason?: string }, sha: string): boolean =>
+    !r.ok && r.reason === 'not-found' && /^[0-9a-f]{7,40}$/.test(sha);
+
+  const REAL_SHA = 'a'.repeat(40);
+
+  test('an unreachable cell is NOT remembered — the outage would outlive itself', () => {
+    expect(shouldCache({ ok: false, reason: 'unreachable' }, REAL_SHA)).toBe(false);
+  });
+
+  test('an unlinked project is NOT remembered — it says nothing about the version', () => {
+    expect(shouldCache({ ok: false, reason: 'not-linked' }, REAL_SHA)).toBe(false);
+  });
+
+  test('a MUTABLE ref is never remembered, however authoritative the answer', () => {
+    // DiffView's "compare with saved" opens `?sha=HEAD` on a canvas that may
+    // not be committed yet. Cache that miss and committing the file leaves the
+    // preview permanently 404 — the exact read-failure-as-absence collapse
+    // this feature exists to delete.
+    for (const ref of ['HEAD', 'main', 'v1.2.0', 'HEAD~1']) {
+      expect(shouldCache({ ok: false, reason: 'not-found' }, ref)).toBe(false);
+    }
+  });
+
+  test('a genuine absence at a real object name IS remembered', () => {
+    // Without this the DoS guard the negative cache exists to be is gone.
+    expect(shouldCache({ ok: false, reason: 'not-found' }, REAL_SHA)).toBe(true);
+    expect(shouldCache({ ok: false, reason: 'not-found' }, 'abc1234')).toBe(true);
+  });
+});
+
+describe('F2 — an oversized cell response is refused, not buffered', () => {
+  // `readCapped`'s contract, exercised over a real ReadableStream.
+  async function readCapped(res: Response, maxBytes: number): Promise<string | null> {
+    const declared = Number(res.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > maxBytes) return null;
+    if (!res.body) {
+      const t = await res.text();
+      return t.length > maxBytes ? null : t;
+    }
+    const reader = res.body.getReader();
+    const dec = new TextDecoder('utf8');
+    let out = '';
+    let seen = 0;
+    for (;;) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      seen += value?.byteLength ?? 0;
+      if (seen > maxBytes) {
+        await reader.cancel().catch(() => {});
+        return null;
+      }
+      out += dec.decode(value, { stream: true });
+    }
+    return out + dec.decode();
+  }
+
+  const streamOf = (chunks: Uint8Array[], headers: Record<string, string> = {}) =>
+    new Response(
+      new ReadableStream({
+        start(c) {
+          for (const ch of chunks) c.enqueue(ch);
+          c.close();
+        },
+      }),
+      { headers }
+    );
+
+  test('a lying Content-Length is refused up front', () => {
+    const res = new Response('short', { headers: { 'content-length': String(99 * 1024 * 1024) } });
+    return expect(readCapped(res, 1024)).resolves.toBeNull();
+  });
+
+  test('a body that EXCEEDS the cap without declaring it is refused mid-stream', async () => {
+    // The measurement, not the claim — a hostile cell simply omits the header.
+    const chunk = new Uint8Array(512).fill(0x61);
+    expect(await readCapped(streamOf([chunk, chunk, chunk, chunk]), 1024)).toBeNull();
+  });
+
+  test('a legitimate body under the cap still reads whole', async () => {
+    const body = new TextEncoder().encode('export default function C(){}');
+    expect(await readCapped(streamOf([body]), 1024)).toBe('export default function C(){}');
+  });
+
+  test('multi-byte content split across chunks survives the counted read', async () => {
+    // The stream decoder must not corrupt what the cap lets through.
+    const bytes = new TextEncoder().encode('č'.repeat(64));
+    const mid = 5; // deliberately mid-sequence
+    expect(await readCapped(streamOf([bytes.subarray(0, mid), bytes.subarray(mid)]), 4096)).toBe(
+      'č'.repeat(64)
+    );
+  });
+});
+
+describe('F3 — git output survives a multi-byte sequence split across chunks', () => {
+  test('StringDecoder preserves what per-chunk toString() corrupts', () => {
+    const bytes = Buffer.from('č'.repeat(3), 'utf8');
+    const a = bytes.subarray(0, 3); // splits the 2nd `č` in half
+    const b = bytes.subarray(3);
+
+    // What the runners used to do — silent U+FFFD on both sides of the seam.
+    expect(a.toString() + b.toString()).not.toBe('ččč');
+
+    const dec = new StringDecoder('utf8');
+    expect(dec.write(a) + dec.write(b) + dec.end()).toBe('ččč');
+  });
+
+  test('a real `git show` of a canvas larger than one pipe chunk is byte-exact', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'git-utf8-'));
+    try {
+      // >64 KiB so the pipe genuinely splits it, with non-ASCII throughout —
+      // this repo's own canvases carry Czech copy, which is what made a latent
+      // decoding bug a live data-integrity one.
+      const body = `// příliš žluťoučký kůň úpěl ďábelské ódy — ${'č'.repeat(40000)}\n`;
+      writeFileSync(join(dir, 'canvas.tsx'), body, 'utf8');
+      const git = (args: string[]) =>
+        new Promise<string>((res, rej) => {
+          const outDec = new StringDecoder('utf8');
+          let out = '';
+          const c = spawn('git', args, { cwd: dir, env: { ...process.env, LC_ALL: 'C' } });
+          c.stdout.on('data', (d) => {
+            out += outDec.write(d);
+          });
+          c.on('close', (code) =>
+            code === 0 ? res(out + outDec.end()) : rej(new Error(`git ${code}`))
+          );
+          c.on('error', rej);
+        });
+      await git(['init', '-b', 'main']);
+      await git(['config', 'user.email', 't@t.t']);
+      await git(['config', 'user.name', 'T']);
+      await git(['add', '-A']);
+      await git(['commit', '-m', 'x']);
+      const shown = await git(['show', 'HEAD:canvas.tsx']);
+
+      expect(shown).toBe(body);
+      expect(shown).not.toContain('�');
+      expect(shown.length).toBeGreaterThan(40000);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+});

package/apps/studio/test/cloud-history-posture.test.ts

@@ -0,0 +1,230 @@
+// The cloud-managed posture, widened — feature-cloud-managed-git-posture.
+//
+// DDR-218 withdrew the working-tree half of the Changes panel when the cell
+// commits this project. It withdrew the OFFER and not the machinery: the app
+// went on polling `/_api/git/status`, probing the remote, badging the tree, and
+// pointing History at the local repo — a repo that, in this posture, has no
+// commits at all. The panel therefore said "Cloud is saving" and "No saved
+// versions yet" in the same breath.
+//
+// Source-level, in the `cloud-managed-save-surfaces.test.ts` house style: what
+// these pin is exactly what would regress — a poll re-added ungated, the loader
+// choice migrating into the panel, or a "tidy-up" disabling the ONE local-git
+// mechanism that must stay live.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const STUDIO = join(import.meta.dir, '..');
+const APP = readFileSync(join(STUDIO, 'client', 'app.jsx'), 'utf8');
+const PANEL = readFileSync(join(STUDIO, 'client', 'panels', 'GitPanel.jsx'), 'utf8');
+const HTTP = readFileSync(join(STUDIO, 'http.ts'), 'utf8');
+const ENDPOINTS = readFileSync(join(STUDIO, 'cloud', 'endpoints.ts'), 'utf8');
+
+describe('the loader is chosen ONCE, where the posture is named', () => {
+  test('the call site swaps it; the panel never re-derives it', () => {
+    expect(APP).toContain('loadLog={cloudManaged ? gitLoadCloudLog : gitLoadLog}');
+    expect(APP).toContain("historySource={cloudManaged ? 'cloud' : 'local'}");
+    // The panel may READ the source, never compute it from `cloudManaged` —
+    // that would be the second derivation the posture constant exists to stop.
+    expect(PANEL).toContain("const cloudHistorySource = historySource === 'cloud';");
+    expect(PANEL).not.toMatch(/historySource\s*=\s*cloudManaged/);
+  });
+
+  test('the cloud loader talks to the loopback proxy, never to a hub directly', () => {
+    expect(APP).toContain("'/_api/cloud/history?limit=40'");
+    // No hub URL, and therefore no token, anywhere in the client.
+    expect(APP).not.toContain('getHubToken');
+  });
+
+  test('a failed load is reported, not rendered as an empty history', () => {
+    // Collapsing "could not reach" into "nothing saved yet" IS the bug.
+    expect(APP).toMatch(/if \(!r\.ok\) return null;/);
+    expect(PANEL).toContain('const [logFailed, setLogFailed] = useState(false);');
+    expect(PANEL).toContain('setLogFailed(entries == null);');
+    expect(PANEL).toContain('data-testid="git-history-unreachable"');
+    expect(PANEL).toContain('data-testid="git-history-retry"');
+  });
+
+  test('the cloud empty state never offers the Save this posture withdrew', () => {
+    expect(PANEL).toContain('The cloud is saving this project');
+    // The old copy must still exist for the LOCAL branch — and only there.
+    expect(PANEL).toContain("Save a version and it'll show up here.");
+  });
+
+  test('the header names the cloud project, falling back to the hub host', () => {
+    expect(PANEL).toContain(
+      'const headerProject = cloudHistorySource\n    ? (cloudHistory?.project ?? cloudHistory?.hubHost ?? null)\n    : project;'
+    );
+  });
+});
+
+describe('while cloud-managed, the desktop runs NO local git of its own', () => {
+  test('the mount status fetch is gated, and reacts live', () => {
+    // Reactive on the posture, not mount-only: Connect must stop it and
+    // Disconnect must resume it, both without a reload.
+    expect(APP).toMatch(/if \(savingIsManaged\) \{\n\s*\/\/[\s\S]*?setGitStatus\(null\);/);
+    expect(APP).toMatch(/\}, \[savingIsManaged\]\);/);
+  });
+
+  test('both refreshers refuse in that posture', () => {
+    const refreshers = APP.match(
+      /const refresh(GitStatus|RemoteSync) = useCallback\(async \(\) => \{[\s\S]{0,600}?\n {2}\}, \[\]\);/g
+    );
+    expect(refreshers?.length).toBe(2);
+    for (const fn of refreshers ?? []) expect(fn).toContain('savingIsManagedRef.current');
+  });
+
+  test('the remote ahead/behind probe stops AND clears its last answer', () => {
+    // A stale ahead/behind would otherwise outlive the link and keep the
+    // "Get latest" nudge on a remote this project has nothing to do with.
+    expect(APP).toMatch(/if \(savingIsManaged\) \{[\s\S]{0,400}?setRemoteSync\(null\);/);
+    expect(APP).toContain(
+      '}, [savingIsManaged, gitStatus?.repo, changesOpen, refreshRemoteSync]);'
+    );
+  });
+
+  test('the WS push is gated too — otherwise it re-populates what the polls stopped', () => {
+    expect(APP).toContain('if (!savingIsManagedRef.current) setGitStatus(m.payload);');
+  });
+
+  test('the tree M/A/D badges are withdrawn — the same claim, one row at a time', () => {
+    expect(APP).toMatch(/if \(savingIsManaged\) return m;/);
+    expect(APP).toContain('}, [gitStatus, savingIsManaged]);');
+  });
+
+  test('the drafts switcher is withdrawn — a branch switch moves a HEAD the cell has never seen', () => {
+    expect(APP).toContain('{!savingIsManaged && (\n        <RepoBranchSwitcher');
+    expect(APP).toContain('savingIsManaged={savingIsManaged}');
+  });
+
+  test('the posture is declared above every effect that names it', () => {
+    // A dependency array evaluates during render, so a `const` below its first
+    // consumer is a temporal-dead-zone ReferenceError at boot, not a warning.
+    const declared = APP.indexOf('const savingIsManaged = cellManaged || cloudManaged;');
+    expect(declared).toBeGreaterThan(0);
+    expect(declared).toBeLessThan(APP.indexOf("fetch('/_api/git/status')"));
+    expect(declared).toBeLessThan(APP.indexOf('const dirtyByPath = useMemo'));
+  });
+});
+
+describe('what must NOT be withdrawn', () => {
+  test('the git-lifecycle watcher stays live — it is correctness, not a save surface', () => {
+    // DDR-051: a terminal `git checkout` flushes into Yjs and reloads the open
+    // canvases. Disabling it would silently desync anyone who uses git in a
+    // terminal — precisely the workflow DDR-218 promised would survive. A
+    // NEGATIVE assertion, so a future tidy-up cannot quietly add the gate.
+    const handler = APP.slice(APP.indexOf("m.type === 'git-lifecycle'"));
+    const body = handler.slice(0, handler.indexOf('}\n        } catch {}'));
+    expect(body).toContain('setGitLifecycle(m.payload);');
+    expect(body).not.toContain('savingIsManaged');
+  });
+
+  test('nothing touches .git — no hook, no config write', () => {
+    for (const src of [APP, HTTP, ENDPOINTS]) {
+      expect(src).not.toMatch(/\.git\/hooks/);
+      expect(src).not.toMatch(/core\.hooksPath/);
+    }
+  });
+
+  test('the local /_api/git/* routes keep exactly their old gates', () => {
+    // "Presentation, not a control" (DDR-218) is KEPT, not reversed: what stops
+    // is Maude's own polling, not the user's ability to use git.
+    expect(HTTP).toContain("'/_api/git/status': async (req: Request) => {");
+    expect(HTTP).toContain("'/_api/git/log': async (req: Request) => {");
+    expect(HTTP).not.toContain('savingIsManaged');
+  });
+});
+
+describe('the new network surface', () => {
+  test('the studio route carries BOTH mandatory guards', () => {
+    const route = HTTP.slice(HTTP.indexOf("'/_api/cloud/history':"));
+    const body = route.slice(0, route.indexOf('\n    },'));
+    expect(body).toContain("if (!sameOriginRead(req)) return new Response('cross-origin rejected'");
+    expect(body).toContain('if (!isTrustedRequestHost(req))');
+    expect(body).toContain("if (req.method !== 'GET')");
+  });
+
+  test('it is in NEITHER canvas allowlist (DDR-088 — it proxies a credential)', () => {
+    const safe = HTTP.slice(HTTP.indexOf('const CANVAS_SAFE_API = new Set(['));
+    expect(safe.slice(0, safe.indexOf('])')).includes('/_api/cloud/history')).toBe(false);
+    const canvasRoutes = HTTP.slice(HTTP.indexOf('function startCanvasServer'));
+    expect(canvasRoutes.includes("'/_api/cloud/history'")).toBe(false);
+  });
+
+  test('a hub 401 is a plain read failure — it must never delete the credential', () => {
+    // `/_api/cloud/status`'s 401 path calls `signout()` (confused-deputy F6).
+    // A History poll is not that authority: a cell restarting mid-renewal would
+    // otherwise silently unlink a working project.
+    const fetchFn = ENDPOINTS.slice(ENDPOINTS.indexOf('async function hubFetch('));
+    const body = fetchFn.slice(0, fetchFn.indexOf('\n  }\n'));
+    expect(body).not.toContain('signout');
+    expect(body).not.toContain('deleteHubCredential');
+  });
+
+  test('the token and the hub error body never leave the server', () => {
+    // Assert the PROPERTY, not the line — the re-review's closing note was that
+    // these pins caught the letter and not the behaviour, and this one broke on
+    // the very fix it should have been indifferent to. A non-2xx must produce
+    // no body and no text; a bare status code is fine, the cell's message never is.
+    const fn = ENDPOINTS.slice(ENDPOINTS.indexOf('async function hubFetch('));
+    const body = fn.slice(0, fn.indexOf('\n  }\n'));
+    expect(body).toContain('if (!res.ok) return { ok: false');
+    expect(body).not.toMatch(/if \(!res\.ok\)[\s\S]{0,120}await res\.(text|json)/);
+    // The token reaches exactly one place: the Authorization header.
+    expect((ENDPOINTS.match(/hub\.token/g) ?? []).length).toBe(1);
+    expect(APP).not.toContain('Bearer');
+  });
+
+  test('an uncredentialed link makes no network call at all', () => {
+    expect(ENDPOINTS).toContain(
+      "if (!hub) return { status: 200, json: { ok: false, reason: 'not-linked' } };"
+    );
+    expect(ENDPOINTS).toContain('if (!linked?.credentialed) return null;');
+  });
+
+  test('the sha is validated on the desktop too, not only on the hub', () => {
+    // It reaches the preview route from the UNTRUSTED canvas origin (DDR-054);
+    // "the other end checks it" is how a guard ends up on neither end. Pin the
+    // GUARD, not the whole statement — the failure branch changed shape once
+    // already (it now reports a reason so a caller can tell absence from an
+    // outage), and this assertion should survive that.
+    const fn = ENDPOINTS.slice(ENDPOINTS.indexOf('async historyFile('));
+    const body = fn.slice(0, fn.indexOf('\n    },'));
+    expect(body).toContain('[0-9a-f]{7,40}');
+    // The guard must come FIRST — before the path, the link, or any fetch.
+    expect(body.indexOf('[0-9a-f]{7,40}')).toBeLessThan(body.indexOf('hubFetch'));
+  });
+});
+
+describe('the version preview resolves a cloud-only sha', () => {
+  test('local first, then the cell, with the cache key unchanged', () => {
+    const fn = HTTP.slice(HTTP.indexOf('async function serveHistoricalCanvas('));
+    const body = fn.slice(0, fn.indexOf('\n}\n'));
+    expect(body).toContain('let source = await gitShowFile(ctx.paths.repoRoot, sha, repoRel);');
+    expect(body).toContain('await cloudHistoryApi(ctx).historyFile(sha, repoRel);');
+    // Historical content is immutable, so a cloud-sourced build must cache
+    // under the identical key a local one would have.
+    expect(body).toContain(
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: asserting SOURCE text, not interpolating.
+      'const key = `${absPath}\\0${sha}\\0${RUNTIME_BOOT_ID}\\0${CHROME_EPOCH}`;'
+    );
+  });
+
+  test('the build budget still gates the miss path, and misses are remembered', () => {
+    const fn = HTTP.slice(HTTP.indexOf('async function serveHistoricalCanvas('));
+    const body = fn.slice(0, fn.indexOf('\n}\n'));
+    // The limiter must stay ABOVE the lookups (the recorded DoS invariant) —
+    // now guarding a network round trip as well as a git process.
+    expect(body.indexOf('historicalBuildAllowed()')).toBeLessThan(body.indexOf('gitShowFile'));
+    expect(body).toContain('historicalMissCache.has(key)');
+    expect(body).toContain('historicalMissCache.add(key);');
+  });
+
+  test('the posture is asked of the module that owns it, not re-derived', () => {
+    // `historyFile` already answers null unless the folder is linked AND
+    // credentialed — which IS the cloud-managed condition.
+    expect(HTTP).not.toMatch(/serveHistoricalCanvas[\s\S]{0,2000}?credentialed/);
+  });
+});

package/apps/studio/test/cloud-session-role.test.ts

@@ -108,6 +108,36 @@ describe('the cloud shell states what it is', () => {
     expect(cfg.cloud?.projectName).toBe('Alligators');
   });
 
+  // The shape every test above this line assumed away. A self-hosted
+  // `maude hub workspace` sets MAUDE_WORKSPACE_MODE but never
+  // HUB_DASHBOARD_URL (only cli/lib/cell-plan.mjs writes that), and the
+  // studio used to default it to the vendor's SaaS — so the ONE way out a
+  // browser tab offers walked a self-hoster off their own deployment onto
+  // cloud.maude.sh. Every cloud-block test booted WITH the variable set, so
+  // the whole suite was blind to the deployment the bug applies to.
+  test('a self-hosted hub gets the cloud block WITHOUT a dashboard link', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, {
+      MAUDE_WORKSPACE_MODE: '1',
+      MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+      MAUDE_PROJECT_NAME: 'Alligators',
+      // deliberately NO HUB_DASHBOARD_URL — this is what self-hosted looks like
+    });
+    procs.push(proc);
+    const cfg = (await (await fetch(`http://localhost:${port}/_config`)).json()) as {
+      cloud?: { dashboardUrl?: string; projectName?: string };
+    };
+    // The block still exists: "you are in a browser tab on somebody else's
+    // machine" is just as true self-hosted, and C2's stated agent absence,
+    // the account chip and the sign-out all hang off it.
+    expect(cfg.cloud).toBeTruthy();
+    expect(cfg.cloud?.projectName).toBe('Alligators');
+    // Only the platform-specific field is gone — absent, so the client's
+    // truthiness check is the single gate.
+    expect(cfg.cloud?.dashboardUrl).toBeUndefined();
+  });
+
   test('the canvas capability is echoed only when the proxy minted one', async () => {
     const { base } = await bootCell();
     const without = (await (await fetch(`${base}/_config`)).json()) as { canvasToken?: string };

package/apps/studio/test/cloud-shell-surfaces.test.ts

@@ -129,3 +129,42 @@ describe('"not known yet" survives every layer between /_config and the DOM', ()
     }
   });
 });
+
+describe('the way back out exists only where there is somewhere to go', () => {
+  // A self-hosted `maude hub workspace` is workspace mode too — the whole
+  // point of "one studio, three shells" — so it gets the `cloud` block, the
+  // stated agent absence, the account chip and the sign-out. What it does NOT
+  // have is a dashboard: one hub serves one project, and `HUB_DASHBOARD_URL`
+  // is written only by the managed fleet (cli/lib/cell-plan.mjs).
+  //
+  // Both sides had defaulted that URL to the vendor's SaaS, so the ONE way out
+  // a browser tab offers walked every self-hoster off their own deployment
+  // onto cloud.maude.sh — a dead end for an account most of them do not have.
+  // Fixing the server alone would not have fixed the button; the client
+  // carried its own copy of the same fallback.
+  test('the client never names the vendor as a fallback destination', () => {
+    // The literal is the bug. `dashboardUrl` is either configured or absent.
+    expect(APP).not.toContain("'https://cloud.maude.sh'");
+  });
+
+  test('the ← Dashboard anchor is gated on the URL, not on the shell', () => {
+    const at = APP.indexOf('data-testid="cloud-back"');
+    expect(at).toBeGreaterThan(0);
+    const block = APP.slice(at, at + 1200);
+    expect(block).toContain('{cloud.dashboardUrl ? (');
+    expect(block).toContain('href={cloud.dashboardUrl}');
+    // The project name is NOT gated with it: a tab must still say which
+    // project it is showing, dashboard or no dashboard.
+    expect(block).toContain('data-testid="cloud-project-name"');
+  });
+
+  test('the server sends the field only when it is configured', () => {
+    const HTTP = readFileSync(join(STUDIO, 'http.ts'), 'utf8');
+    // Conditional spread — the same shape `canvasToken` uses two fields down,
+    // so an absent value is absent rather than a string nobody can act on.
+    expect(HTTP).toContain(
+      '...(process.env.HUB_DASHBOARD_URL\n                  ? { dashboardUrl: process.env.HUB_DASHBOARD_URL }\n                  : {}),'
+    );
+    expect(HTTP).not.toContain("HUB_DASHBOARD_URL ?? 'https://cloud.maude.sh'");
+  });
+});