@1agh/maude 1.0.9 → 1.0.11

package/apps/studio/readiness.ts

@@ -214,8 +214,22 @@ export async function probeReadiness(): Promise<ReadinessReport> {
   const authStatus =
     e2eForce === 'signed-out' ? { loggedIn: false } : claude ? await getClaudeAuthStatus() : null;
   const signedIn = !!authStatus?.loggedIn;
-  const offSubscription =
-    signedIn && authStatus?.apiProvider && authStatus.apiProvider !== 'firstParty';
+  // Issue #107 — a resolvable CLI whose auth status we could not READ is NOT
+  // the same as a signed-out one, and must not be reported as one. Claiming
+  // "not signed in" to a user who is signed in is a false accusation they
+  // can't argue with, and it routes them to a Sign-in button that can only
+  // dead-end (the poll re-runs the same failing probe until it times out).
+  // The probe's own tolerance for wrapper stdout noise now lives in probe.ts;
+  // this is the honest fallback for whatever noise that still can't read.
+  const authUnreadable = !!claude && e2eForce !== 'signed-out' && authStatus === null;
+  // Anything that is not an explicit `firstParty` counts as off-subscription,
+  // ABSENT included (attacker R2-3). The old `authStatus?.apiProvider &&`
+  // truthiness guard meant a metered user could suppress DDR-123's billing
+  // warning by OMITTING the field rather than forging `firstParty` — the exact
+  // outcome `narrowStatusTag`'s sentinel was written to prevent, reached through
+  // a different input shape. Over-warning is the safe direction here.
+  const offSubscription = signedIn && authStatus?.apiProvider !== 'firstParty';
+  const providerLabel = authStatus?.apiProvider ?? 'provider not reported';
   // DDR-166 Decision 5 — the settings-UI opt-out (prefs.rs `claude_auto_setup`,
   // DEFAULT ON) reaches the dev-server as an env var set fresh at each sidecar
   // spawn. Disabled → fall back to guide-only: no automated action offered,
@@ -226,21 +240,42 @@ export async function probeReadiness(): Promise<ReadinessReport> {
     id: 'claude',
     label: 'Claude Code (the `claude` CLI)',
     required: true,
-    status: claude && signedIn ? 'present' : 'missing',
+    status: claude && signedIn ? 'present' : authUnreadable ? 'unknown' : 'missing',
     detail: !claude
       ? 'Not found on PATH.'
       : signedIn
         ? offSubscription
-          ? `Signed in, but not on a Claude subscription (${authStatus?.apiProvider}) — AI editing may bill metered API usage.`
+          ? `Signed in, but not on a Claude subscription (${providerLabel}) — AI editing may bill metered API usage.`
           : `Signed in${authStatus?.subscriptionType ? ` · ${authStatus.subscriptionType}` : ''} — AI editing runs on your own Pro/Max subscription.`
-        : 'Installed, but not signed in.',
+        : authUnreadable
+          ? "Installed, but Maude couldn't read its sign-in state."
+          : 'Installed, but not signed in.',
     remediation: !claude
       ? 'Install Claude Code, then sign in. AI editing runs on your own Pro/Max subscription — never API billing.'
       : signedIn
         ? undefined
-        : 'Sign in to connect it to your Pro/Max subscription.',
+        : authUnreadable
+          ? // Deliberately does NOT interpolate the resolved path (attacker
+            // R2-2). This row carries a Copy affordance, and `copyFix` strips
+            // the backticks — so a path containing shell metacharacters would
+            // land on the clipboard inside a sentence the user is being told to
+            // paste. Worse, it would turn the possibly-hijacked binary that
+            // DDR-166 Decision 3 shows them precisely so they can DOUBT it into
+            // an instruction to run it. The path renders on its own line below.
+            'Maude ran `claude auth status --json` and could not read a status back. The usual cause is a version-manager shim or wrapper (mise, asdf, volta) fronting the real binary — check the path below, fix or quiet the wrapper, then Re-check.'
+          : 'Sign in to connect it to your Pro/Max subscription.',
     installCommand: !claude ? 'curl -fsSL https://claude.ai/install.sh | bash' : undefined,
-    action: !autoSetupEnabled ? undefined : !claude ? 'install' : !signedIn ? 'signin' : undefined,
+    // No Sign-in button when the status is unreadable: `pollForSignin` in
+    // ReadinessList.jsx polls THIS probe, so a button whose success signal we
+    // can't read can only ever end in "Sign-in timed out" (issue #107). The
+    // remediation text above is the actionable path in that state.
+    action: !autoSetupEnabled
+      ? undefined
+      : !claude
+        ? 'install'
+        : !signedIn && !authUnreadable
+          ? 'signin'
+          : undefined,
     resolvedPath: claude ?? undefined,
     resolvedViaMaude: !!claude && claude === process.env.MAUDE_CLAUDE_BIN,
   });

package/apps/studio/test/acp-bridge.test.ts

@@ -9,7 +9,11 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import { AcpBridge } from '../acp/bridge.ts';
-import { probeAcpAvailability, probeAcpAvailabilityAuthed } from '../acp/probe.ts';
+import {
+  getClaudeAuthStatus,
+  probeAcpAvailability,
+  probeAcpAvailabilityAuthed,
+} from '../acp/probe.ts';
 
 const FIXTURE = join(import.meta.dir, 'fixtures', 'mock-acp-agent.mjs');
 const TEST_ENV_KEYS = [
@@ -272,6 +276,7 @@ describe('probeAcpAvailabilityAuthed — DDR-166 T0d, logged-out must not read a
 
   afterEach(() => {
     delete process.env.FAKE_CLAUDE_LOGGED_IN;
+    delete process.env.FAKE_CLAUDE_STDOUT_NOISE;
   });
 
   test('installed but NOT signed in reports available:false (the bug this closes)', async () => {
@@ -298,4 +303,243 @@ describe('probeAcpAvailabilityAuthed — DDR-166 T0d, logged-out must not read a
     expect(probe.available).toBe(false);
     expect(probe.reason ?? '').toMatch(/Claude Code/i);
   });
+
+  // Issue #107 — the reported `claude` was a mise shim printing a banner to
+  // STDOUT before the JSON. Parsing the whole blob threw, the catch returned
+  // null, and a signed-in user was told they were signed out.
+  test('signed in through a stdout-noisy shim still reports available:true (#107)', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = AUTH_FIXTURE;
+    process.env.FAKE_CLAUDE_LOGGED_IN = '1';
+    process.env.FAKE_CLAUDE_STDOUT_NOISE = '1';
+    const probe = await probeAcpAvailabilityAuthed();
+    expect(probe.available).toBe(true);
+  });
+
+  test('an UNREADABLE status says so — it does not accuse the user of being signed out (#107)', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = join(import.meta.dir, 'fixtures', 'noisy-claude-auth.mjs');
+    process.env.FAKE_CLAUDE_OUT = 'mise: something went sideways\nno json here\n';
+    try {
+      const probe = await probeAcpAvailabilityAuthed();
+      expect(probe.available).toBe(false);
+      expect(probe.reason ?? '').toContain("couldn't read");
+      expect(probe.reason ?? '').not.toMatch(/not signed in/i);
+    } finally {
+      delete process.env.FAKE_CLAUDE_OUT;
+    }
+  });
+
+  test('signed OUT through a stdout-noisy shim is still reported as signed out (no false positive)', async () => {
+    process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+    process.env.MAUDE_CLAUDE_BIN = AUTH_FIXTURE;
+    process.env.FAKE_CLAUDE_LOGGED_IN = '0';
+    process.env.FAKE_CLAUDE_STDOUT_NOISE = '1';
+    const probe = await probeAcpAvailabilityAuthed();
+    expect(probe.available).toBe(false);
+    expect(probe.reason ?? '').toMatch(/signed in/i);
+  });
+});
+
+// Issue #107 — direct coverage of the stdout shape tolerated by the auth probe.
+// A wrapper on PATH (mise/asdf/volta, corporate `bin` shims) can prepend noise
+// to stdout; the fast path (clean JSON) and the honest failure (nothing
+// parseable → null) both have to keep working alongside it.
+describe('getClaudeAuthStatus — wrapper-stdout tolerance', () => {
+  const NOISY = join(import.meta.dir, 'fixtures', 'noisy-claude-auth.mjs');
+
+  afterEach(() => {
+    delete process.env.FAKE_CLAUDE_OUT;
+    delete process.env.FAKE_CLAUDE_HEAD;
+    delete process.env.FAKE_CLAUDE_PAD_BYTES;
+    delete process.env.FAKE_CLAUDE_TAIL;
+  });
+
+  const statusFor = async (stdout: string) => {
+    process.env.MAUDE_CLAUDE_BIN = NOISY;
+    process.env.FAKE_CLAUDE_OUT = stdout;
+    return getClaudeAuthStatus();
+  };
+
+  const PAYLOAD = '{"loggedIn":true,"apiProvider":"firstParty","subscriptionType":"max"}';
+
+  test('clean JSON — the unchanged fast path', async () => {
+    expect(await statusFor(PAYLOAD)).toEqual({
+      loggedIn: true,
+      apiProvider: 'firstParty',
+      subscriptionType: 'max',
+    });
+  });
+
+  test('a banner line ahead of the JSON (the reported mise shim)', async () => {
+    const out = `mise ~/.config/mise/config.toml tools: claude@2.1.246\n${PAYLOAD}`;
+    expect((await statusFor(out))?.loggedIn).toBe(true);
+  });
+
+  test('noise carrying braces of its own does not outrank the real payload', async () => {
+    const out = `warning: {"loggedIn":false} is not a real status\nresolving {claude}\n${PAYLOAD}`;
+    expect((await statusFor(out))?.subscriptionType).toBe('max');
+  });
+
+  test('trailing noise after the JSON', async () => {
+    expect((await statusFor(`${PAYLOAD}\nmise: done in 12ms\n`))?.loggedIn).toBe(true);
+  });
+
+  test('a brace inside a string value never miscounts the object bounds', async () => {
+    const out = `noise\n{"orgName":"a } brace \\" in a string","loggedIn":true}\n`;
+    expect((await statusFor(out))?.loggedIn).toBe(true);
+  });
+
+  test('nothing parseable still returns null — an unreadable status is not a signed-in one', async () => {
+    expect(await statusFor('mise: command failed\nno json here at all\n')).toBeNull();
+  });
+
+  test('a signed-out payload behind noise stays signed out', async () => {
+    expect((await statusFor(`mise banner\n{"loggedIn":false}`))?.loggedIn).toBe(false);
+  });
+
+  // ── Security-review regressions (defender M1, attacker F1/F2/F5) ──
+  // Every one of these is a way the FIRST cut of this parser failed SOFT and
+  // re-created #107 — a confident false claim — through a new door.
+
+  test('an object with no `loggedIn` is not a status document → null, never a false "signed out" (F2)', async () => {
+    // A plain NDJSON-logging wrapper. The first cut returned this as the
+    // "fallback", and `!!undefined` rendered it as "Installed, but not signed
+    // in." with the dead-end Sign-in button armed.
+    const out =
+      '{"level":"info","msg":"resolving claude"}\n{"level":"error","msg":"exec failed"}\n';
+    expect(await statusFor(out)).toBeNull();
+  });
+
+  test('a JSON error document is not a status document either (F2)', async () => {
+    expect(await statusFor('{"error":"ENOENT","code":127}')).toBeNull();
+  });
+
+  test('a signed-in user behind 150 JSON log lines is still read as signed in (M1)', async () => {
+    // Forwards + a 100-candidate budget put the real payload outside the scan
+    // window and demoted a signed-in user. Backwards spends the budget on noise.
+    const noise = Array.from({ length: 150 }, (_, i) => `{"level":"debug","msg":"tool ${i}"}`).join(
+      '\n'
+    );
+    expect((await statusFor(`${noise}\n${PAYLOAD}`))?.loggedIn).toBe(true);
+  });
+
+  test('a flood prefix cannot push the real payload out of range and forge loggedIn (F1)', async () => {
+    // The verbatim exploit: a 242-byte prefix — one forged object plus 99 bare
+    // `{}` fillers — burned the whole candidate budget so the genuine
+    // signed-OUT payload never got looked at. Fail-closed became fail-open.
+    const forged = '{"loggedIn":true,"apiProvider":"firstParty","subscriptionType":"max"}';
+    const out = forged + '{}'.repeat(99) + '{"loggedIn":false,"apiProvider":"firstParty"}';
+    const status = await statusFor(out);
+    expect(status?.loggedIn).toBe(false);
+    expect(status?.subscriptionType).toBeUndefined();
+  });
+
+  test('padding past the read cap drops the OLDEST bytes, so the forged head loses (F1, variant 2)', async () => {
+    // The exploit padded 1 MiB after a forged object so the real payload fell
+    // outside the scan window. The read cap is a sliding TAIL window now, so the
+    // bytes that get dropped are the attacker's, and the trailing real payload
+    // is what survives.
+    //
+    // The padding is generated by the fixture, not passed through the
+    // environment — a multi-MiB env var exceeds the exec limit and the spawn
+    // fails with E2BIG, which reads as a null status and would make this test
+    // pass for entirely the wrong reason.
+    process.env.MAUDE_CLAUDE_BIN = NOISY;
+    process.env.FAKE_CLAUDE_HEAD =
+      '{"loggedIn":true,"apiProvider":"firstParty","subscriptionType":"max"}';
+    process.env.FAKE_CLAUDE_PAD_BYTES = String((1 << 20) + 64);
+    process.env.FAKE_CLAUDE_TAIL = '{"loggedIn":false}';
+    const status = await getClaudeAuthStatus();
+    expect(status?.loggedIn).toBe(false); // the trailing real payload
+    expect(status?.subscriptionType).toBeUndefined(); // the forged head was dropped
+  });
+
+  test('a large but sub-cap blob still reads the trailing payload', async () => {
+    const out = `${'noise\n'.repeat(20000)}${PAYLOAD}`; // ~120 kB, well under the cap
+    expect((await statusFor(out))?.subscriptionType).toBe('max');
+  });
+
+  test('a `{` at index 0 that does not parse costs one candidate, not the whole budget (R2-1)', async () => {
+    // `lastIndexOf(needle, -1)` clamps to 0, so index 0 was re-tested for the
+    // rest of the budget — a 116x cost amplification measured at ~2.2 s of
+    // blocked event loop per probe, at a 1.5-2 s poll cadence. The payload must
+    // still be found, and fast.
+    const out = `{unparseable at index zero\n${PAYLOAD}`;
+    const started = Date.now();
+    expect((await statusFor(out))?.subscriptionType).toBe('max');
+    expect(Date.now() - started).toBeLessThan(5000);
+  });
+
+  test('a payload whose `{` IS index 0 is still found (the R2-1 fix must not skip it)', async () => {
+    expect((await statusFor(PAYLOAD))?.subscriptionType).toBe('max');
+  });
+
+  test('the read cap drops the exact overflow, not a whole chunk (R3-2)', async () => {
+    // Chunk-granular shifting over-dropped up to `sizeof(oldest chunk) - 1` —
+    // 262 144 B measured for a 150-byte overflow against a real Bun pipe. Here
+    // the payload sits 50 bytes into the stream and the stream is 10 bytes over
+    // the cap: byte-exact drops 10 bytes of leading junk and keeps it, while a
+    // whole-chunk drop takes the payload with it.
+    // The assertion has to depend on the HEAD surviving — asserting on the tail
+    // passes under both granularities and proves nothing (verified: the first
+    // cut of this test was green against the chunk-granular implementation it
+    // was written to reject). So the tail carries NO `loggedIn`, and the only
+    // status document in the stream is the one 50 bytes in.
+    const OVERFLOW = 10;
+    const head = `${'z'.repeat(50)}${PAYLOAD}`;
+    const tail = '\nmise: done\n';
+    process.env.MAUDE_CLAUDE_BIN = NOISY;
+    process.env.FAKE_CLAUDE_HEAD = head;
+    process.env.FAKE_CLAUDE_PAD_BYTES = String((1 << 20) + OVERFLOW - head.length - tail.length);
+    process.env.FAKE_CLAUDE_TAIL = tail;
+    expect((await getClaudeAuthStatus())?.subscriptionType).toBe('max');
+  });
+
+  test('a hostile apiProvider is bounded for display but still trips the billing warning (F5)', async () => {
+    // Unbounded attacker text used to render verbatim inside a trusted status
+    // row. It must be neutralised WITHOUT becoming undefined — that would read
+    // as "no provider" and silently suppress the metered-billing warning.
+    const evil = `{"loggedIn":true,"apiProvider":"expired — re-authorize at https://evil.example/${'A'.repeat(300)}"}`;
+    const status = await statusFor(evil);
+    expect(status?.apiProvider).toBe('unrecognized');
+    expect(status?.apiProvider).not.toBe('firstParty'); // → offSubscription warning still fires
+  });
+
+  test('a non-string loggedIn is not truthy-coerced into a sign-in', async () => {
+    expect((await statusFor('{"loggedIn":"yes"}'))?.loggedIn).toBe(false);
+    expect((await statusFor('{"loggedIn":1}'))?.loggedIn).toBe(false);
+  });
+});
+
+// Defender M2 / attacker F3 — the probe MUST always resolve. `.text()` waits for
+// pipe EOF and `proc.kill()` signals only the direct child, so a wrapper whose
+// descendants keep fd 1 open (exactly #107's self-recursive shape) wedged the
+// read forever: probeReadiness() never resolved, /_api/preflight never answered,
+// and the honest "couldn't read" row was unreachable in its own headline case.
+describe('getClaudeAuthStatus — a wedged CLI must not wedge the probe', () => {
+  test('resolves to null within the deadline when a descendant holds stdout open', async () => {
+    process.env.MAUDE_CLAUDE_BIN = join(import.meta.dir, 'fixtures', 'wedged-claude-auth.sh');
+    const started = Date.now();
+    const status = await getClaudeAuthStatus();
+    const elapsed = Date.now() - started;
+    expect(status).toBeNull(); // unreadable — NOT a "signed out" claim
+    expect(elapsed).toBeLessThan(15000); // bounded by AUTH_STATUS_TIMEOUT_MS (5 s) + slack
+  }, 30000);
+
+  // Round-2 defender L6 — the deadline must not throw away an answer already
+  // held. A signed-in user whose wrapper backgrounds anything at all printed a
+  // perfectly good status and still lost AI editing.
+  test('a status printed before a descendant wedges the pipe is still read', async () => {
+    process.env.MAUDE_CLAUDE_BIN = join(
+      import.meta.dir,
+      'fixtures',
+      'backgrounding-claude-auth.sh'
+    );
+    const started = Date.now();
+    const status = await getClaudeAuthStatus();
+    expect(status?.loggedIn).toBe(true);
+    expect(status?.subscriptionType).toBe('max');
+    expect(Date.now() - started).toBeLessThan(15000);
+  }, 30000);
 });

package/apps/studio/test/fixtures/backgrounding-claude-auth.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Test fixture for issue #107 round-2 defender L6 — a `claude` stand-in that
+# prints a perfectly good status document and THEN leaves a descendant holding
+# fd 1 (a daemon, an update check, a corporate agent). The pipe never reaches
+# EOF, so the read hits its deadline — but the answer is already in the buffer
+# and must not be thrown away.
+if [ "$1" = "auth" ] && [ "$2" = "status" ]; then
+  echo '{"loggedIn":true,"apiProvider":"firstParty","subscriptionType":"max"}'
+  sleep 120 &
+  exit 0
+fi
+exit 1

package/apps/studio/test/fixtures/fake-claude-auth.mjs

@@ -2,9 +2,19 @@
 // Test fixture standing in for the `claude` CLI — implements only the one
 // subcommand probeAcpAvailabilityAuthed()/getClaudeAuthStatus() shell out to.
 // FAKE_CLAUDE_LOGGED_IN=1 controls the reported sign-in state.
+//
+// FAKE_CLAUDE_STDOUT_NOISE=1 reproduces issue #107: a version-manager shim
+// (mise/asdf/volta) or corporate wrapper fronting the real binary and printing
+// a banner to STDOUT ahead of the JSON. The second noise line deliberately
+// carries braces of its own, pinning that a brace-bearing banner can't outrank
+// the real payload.
 const [, , cmd, sub] = process.argv;
 if (cmd === 'auth' && sub === 'status') {
   const loggedIn = process.env.FAKE_CLAUDE_LOGGED_IN === '1';
+  if (process.env.FAKE_CLAUDE_STDOUT_NOISE === '1') {
+    process.stdout.write('mise ~/.config/mise/config.toml tools: claude@2.1.246\n');
+    process.stdout.write('resolving {claude} from {global} config\n');
+  }
   process.stdout.write(
     JSON.stringify({ loggedIn, apiProvider: loggedIn ? 'firstParty' : undefined })
   );

package/apps/studio/test/fixtures/noisy-claude-auth.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// Test fixture for issue #107 — a `claude` stand-in whose `auth status --json`
+// stdout is exactly what the test asks for. Lets a test pin the wrapper-noise
+// shape it cares about (banner line, brace-bearing noise, trailing chatter,
+// pure garbage) without a fixture per case.
+//
+//   FAKE_CLAUDE_OUT   verbatim stdout, for the small cases.
+//   FAKE_CLAUDE_HEAD / FAKE_CLAUDE_PAD_BYTES / FAKE_CLAUDE_TAIL
+//                     head + N generated filler bytes + tail. The padding is
+//                     generated HERE because a multi-MiB env var exceeds the
+//                     exec argument/environment limit — passing it in makes the
+//                     spawn fail with E2BIG, which a test would misread as the
+//                     parser rejecting the input.
+//
+// No `process.exit()` after the write: on a pipe a large write completes
+// asynchronously, and an explicit exit truncates it. Let the process end on its
+// own once stdout has drained, so multi-MiB cases deliver every byte.
+const [, , cmd, sub] = process.argv;
+if (cmd !== 'auth' || sub !== 'status') {
+  process.exitCode = 1;
+} else if (process.env.FAKE_CLAUDE_PAD_BYTES) {
+  process.stdout.write(process.env.FAKE_CLAUDE_HEAD ?? '');
+  process.stdout.write('x'.repeat(Number(process.env.FAKE_CLAUDE_PAD_BYTES)));
+  process.stdout.write(process.env.FAKE_CLAUDE_TAIL ?? '');
+} else {
+  process.stdout.write(process.env.FAKE_CLAUDE_OUT ?? '');
+}

package/apps/studio/test/fixtures/wedged-claude-auth.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+# Test fixture for issue #107 (defender M2 / attacker F3) — a `claude` stand-in
+# that reproduces the wedge shape: it exits immediately, but leaves a background
+# descendant holding fd 1 (stdout). `proc.kill()` signals only the direct child,
+# so the pipe never reaches EOF and a read that waits for EOF hangs forever.
+# `readBounded` must give up on its own deadline instead.
+if [ "$1" = "auth" ] && [ "$2" = "status" ]; then
+  sleep 120 &
+  exit 0
+fi
+exit 1

package/apps/studio/test/readiness.test.ts

@@ -139,6 +139,117 @@ describe('readiness — plugin auto-bootstrap (native, DDR-143/DDR-168)', () =>
   });
 });
 
+// Issue #107 — the `claude` row must never assert "not signed in" about a CLI
+// whose auth status it could not READ. That lie is what a mise-shim user hit:
+// signed in in the terminal, told otherwise by the app, and routed to a Sign-in
+// button whose poll re-ran the same failing probe until it timed out.
+describe('readiness — claude row, unreadable auth status (#107)', () => {
+  const claudeItem = async (bin: string) => {
+    const saved = process.env.MAUDE_CLAUDE_BIN;
+    process.env.MAUDE_CLAUDE_BIN = bin;
+    try {
+      return (await probeReadiness()).items.find((i) => i.id === 'claude')!;
+    } finally {
+      if (saved === undefined) delete process.env.MAUDE_CLAUDE_BIN;
+      else process.env.MAUDE_CLAUDE_BIN = saved;
+    }
+  };
+
+  test('resolvable CLI + unreadable status → unknown, not a "not signed in" claim', async () => {
+    // `sh` resolves as a binary but answers nothing useful to `auth status --json`.
+    const item = await claudeItem('/bin/sh');
+    expect(item.status).toBe('unknown');
+    expect(item.detail).not.toContain('not signed in');
+    expect(item.detail).toContain("couldn't read");
+  });
+
+  test('the remediation names the wrapper cause but keeps the path OUT of the copyable sentence', async () => {
+    const item = await claudeItem('/bin/sh');
+    expect(item.remediation ?? '').toMatch(/shim|wrapper/i);
+    // The row has a Copy affordance and `copyFix` strips backticks, so a path
+    // with shell metacharacters would ride onto the clipboard inside a sentence
+    // the user is told to paste — and it would turn the possibly-hijacked binary
+    // into an instruction to RUN it (attacker R2-2). It renders on its own line.
+    expect(item.remediation ?? '').not.toContain('/bin/sh');
+    // Nor does it coach an un-content-pinned PATH override at a confused user
+    // (attacker F4 — Maude would be clipboard-loading the incantation).
+    expect(item.remediation ?? '').not.toContain('MAUDE_CLAUDE_BIN');
+  });
+
+  test('the resolved path stays visible in the unknown state (DDR-166 Decision 3)', async () => {
+    // The row must still say WHICH binary it resolved — that display is the
+    // control against an invisible PATH hijack, and the unknown state is exactly
+    // where a hijack is most likely.
+    expect((await claudeItem('/bin/sh')).resolvedPath).toBe('/bin/sh');
+  });
+
+  test('no Sign-in button offered — its success signal is the probe that just failed', async () => {
+    expect((await claudeItem('/bin/sh')).action).toBeUndefined();
+  });
+
+  test('unknown still leaves the report not-ready (claude is a required item)', async () => {
+    const saved = process.env.MAUDE_CLAUDE_BIN;
+    process.env.MAUDE_CLAUDE_BIN = '/bin/sh';
+    try {
+      expect((await probeReadiness()).ready).toBe(false);
+    } finally {
+      if (saved === undefined) delete process.env.MAUDE_CLAUDE_BIN;
+      else process.env.MAUDE_CLAUDE_BIN = saved;
+    }
+  });
+
+  // Attacker R2-3 — a metered user could suppress DDR-123's billing warning by
+  // OMITTING apiProvider rather than forging 'firstParty'. Absent is not
+  // first-party; over-warning is the safe direction.
+  test('an absent apiProvider still trips the metered-billing warning', async () => {
+    const noisy = join(import.meta.dir, 'fixtures', 'noisy-claude-auth.mjs');
+    const saved = process.env.MAUDE_CLAUDE_BIN;
+    process.env.MAUDE_CLAUDE_BIN = noisy;
+    process.env.FAKE_CLAUDE_OUT = '{"loggedIn":true}'; // signed in, no provider field
+    try {
+      const item = (await probeReadiness()).items.find((i) => i.id === 'claude')!;
+      expect(item.status).toBe('present');
+      expect(item.detail).toContain('may bill metered API usage');
+      expect(item.detail).not.toContain('Pro/Max subscription.');
+    } finally {
+      delete process.env.FAKE_CLAUDE_OUT;
+      if (saved === undefined) delete process.env.MAUDE_CLAUDE_BIN;
+      else process.env.MAUDE_CLAUDE_BIN = saved;
+    }
+  });
+
+  test('an explicit firstParty still reads as on-subscription, with no warning', async () => {
+    const noisy = join(import.meta.dir, 'fixtures', 'noisy-claude-auth.mjs');
+    const saved = process.env.MAUDE_CLAUDE_BIN;
+    process.env.MAUDE_CLAUDE_BIN = noisy;
+    process.env.FAKE_CLAUDE_OUT =
+      '{"loggedIn":true,"apiProvider":"firstParty","subscriptionType":"max"}';
+    try {
+      const item = (await probeReadiness()).items.find((i) => i.id === 'claude')!;
+      expect(item.detail).toContain('Pro/Max subscription');
+      expect(item.detail).not.toContain('metered');
+    } finally {
+      delete process.env.FAKE_CLAUDE_OUT;
+      if (saved === undefined) delete process.env.MAUDE_CLAUDE_BIN;
+      else process.env.MAUDE_CLAUDE_BIN = saved;
+    }
+  });
+
+  test('a signed-out CLI is still reported as signed out, with the Sign-in action intact', async () => {
+    const saved = process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS;
+    process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS = 'signed-out';
+    try {
+      const item = (await probeReadiness()).items.find((i) => i.id === 'claude')!;
+      expect(item.status).toBe('missing');
+      expect(item.detail).toContain('not signed in');
+      expect(item.action).toBe('signin');
+    } finally {
+      if (saved === undefined) delete process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS;
+      else process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS = saved;
+    }
+  });
+});
+
 describe('readiness — resolveOnPath', () => {
   test('finds a binary that is on PATH', async () => {
     const hit = await resolveOnPath('sh');

package/apps/studio/whats-new.json

@@ -1,6 +1,25 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "canvas-media-plays-on-linux",
+      "version": "1.0.10",
+      "date": "2026-08-26",
+      "kind": "fix",
+      "title": "Canvas video and audio work on Linux",
+      "summary": "Opening a canvas with video or audio on Linux could take the whole view down with no message — once because the GStreamer plugins it needs are optional on most distros, and again because the GPU video path faults on AMD graphics. The .deb now pulls those plugins in, Maude steers around the AMD fault by itself, and if the plugins are missing anyway it tells you, with the exact install command for your distro.",
+      "learnMore": "https://maude.sh/docs/desktop#media-playback-on-linux",
+      "surface": "design-ui"
+    },
+    {
+      "id": "a-stopped-server-says-so",
+      "version": "1.0.10",
+      "date": "2026-08-26",
+      "kind": "fix",
+      "title": "A stopped server now says so",
+      "summary": "If the server behind your project stopped for good, Maude used to leave the window sitting there — nothing loading, nothing saving, and no reason given. Now it tells you which project stopped, confirms your files on disk are untouched, and offers Try again. A one-off crash hours into a session also no longer counts against the give-up limit the way a genuine restart loop does.",
+      "surface": "design-ui"
+    },
     {
       "id": "exports-match-what-you-see",
       "version": "1.0.8",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "1.0.9",
+  "version": "1.0.11",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -54,13 +54,13 @@
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "1.0.9",
-    "@1agh/maude-darwin-x64": "1.0.9",
-    "@1agh/maude-linux-arm64": "1.0.9",
-    "@1agh/maude-linux-arm64-musl": "1.0.9",
-    "@1agh/maude-linux-x64": "1.0.9",
-    "@1agh/maude-linux-x64-musl": "1.0.9",
-    "@1agh/maude-win32-x64": "1.0.9"
+    "@1agh/maude-darwin-arm64": "1.0.11",
+    "@1agh/maude-darwin-x64": "1.0.11",
+    "@1agh/maude-linux-arm64": "1.0.11",
+    "@1agh/maude-linux-arm64-musl": "1.0.11",
+    "@1agh/maude-linux-x64": "1.0.11",
+    "@1agh/maude-linux-x64-musl": "1.0.11",
+    "@1agh/maude-win32-x64": "1.0.11"
   },
   "files": [
     "cli",