@1agh/maude 1.0.9 → 1.2.0

package/apps/studio/bin/_curl-local.test.mjs

@@ -1,280 +0,0 @@
-// DDR-185 — the loopback-only curl gate behind `maude design curl-local`
-// (apps/studio/bin/_curl-local.mjs). This suite locks the SECURITY CORE: the
-// strict-loopback address classifier (accepts ONLY 127.0.0.0/8 / ::1 / the
-// IPv4-mapped form — unlike `_fetch-asset.mjs`'s `classifyAddress`, an
-// ordinary private-LAN address like 192.168.1.1 is REJECTED here, not
-// allowed), the every-record DNS check (closes the multi-A-record rebinding
-// gap), and — round 2 of the security addendum — the Maude-owned request
-// parser (`parseRequestArgv`) that REPLACED the raw-curl-argv allowlist a
-// live security fan-out found still bypassable via curl's own concatenated
-// short-flag syntax (`-K<path>`, `-x<url>`, `-T<path>` all slipped past the
-// `a.split('=')[0]` check) and a missing `--noproxy` reject entry. This file
-// no longer recognizes ANY curl flag at all — only its own small vocabulary
-// — so there is no curl-syntax bypass class left to enumerate against.
-
-import { describe, expect, test } from 'bun:test';
-import {
-  buildCurlArgs,
-  CurlLocalArgvError,
-  CurlLocalError,
-  classifyRecords,
-  isLoopbackAddress,
-  parseRequestArgv,
-  resolveLoopbackIp,
-} from './_curl-local.mjs';
-
-describe('isLoopbackAddress', () => {
-  test('accepts IPv4 loopback (127.0.0.0/8, not just 127.0.0.1)', () => {
-    expect(isLoopbackAddress('127.0.0.1')).toBe(true);
-    expect(isLoopbackAddress('127.9.9.9')).toBe(true);
-    expect(isLoopbackAddress('127.255.255.255')).toBe(true);
-  });
-
-  test('accepts IPv6 ::1 and the IPv4-mapped loopback form', () => {
-    expect(isLoopbackAddress('::1')).toBe(true);
-    expect(isLoopbackAddress('::ffff:127.0.0.1')).toBe(true);
-  });
-
-  test("rejects ordinary private-LAN addresses — this is STRICTER than fetch-asset's classifier", () => {
-    // fetch-asset's classifyAddress blocks these too (as "not a safe egress
-    // target"), but for a different reason (SSRF from an external URL). Here
-    // the bar is "is this literally my own machine" — a private-LAN IP is a
-    // real, different host, not loopback, and must still prompt.
-    expect(isLoopbackAddress('192.168.1.1')).toBe(false);
-    expect(isLoopbackAddress('10.0.0.1')).toBe(false);
-    expect(isLoopbackAddress('172.16.0.1')).toBe(false);
-    expect(isLoopbackAddress('169.254.169.254')).toBe(false); // cloud IMDS
-  });
-
-  test('rejects public addresses and link-local/multicast/reserved ranges', () => {
-    for (const ip of ['8.8.8.8', '1.1.1.1', '224.0.0.1', '240.0.0.1', 'fe80::1']) {
-      expect(isLoopbackAddress(ip)).toBe(false);
-    }
-  });
-
-  test('rejects a non-IP string', () => {
-    expect(isLoopbackAddress('not-an-ip')).toBe(false);
-    expect(isLoopbackAddress('localhost')).toBe(false); // a hostname, not a literal — resolved separately
-  });
-});
-
-describe('classifyRecords — the every-record check (multi-A-record DNS rebinding)', () => {
-  test('all-loopback records pass', () => {
-    expect(
-      classifyRecords('localhost', [{ address: '127.0.0.1' }, { address: '127.0.0.2' }])
-    ).toBeNull();
-  });
-
-  test('a single non-loopback record among several loopback ones still fails the whole host', () => {
-    const reason = classifyRecords('rebind.example', [
-      { address: '127.0.0.1' },
-      { address: '93.184.216.34' },
-    ]);
-    expect(reason).toContain('93.184.216.34');
-    expect(reason).toContain('non-loopback');
-  });
-
-  test('empty record set fails', () => {
-    expect(classifyRecords('empty.example', [])).toContain('no DNS records');
-  });
-});
-
-describe('resolveLoopbackIp', () => {
-  test('an IP-literal host skips DNS entirely — loopback passes, returns itself', async () => {
-    await expect(resolveLoopbackIp('127.0.0.1')).resolves.toBe('127.0.0.1');
-  });
-
-  test('an IP-literal host that is not loopback throws CurlLocalError(3)', async () => {
-    await expect(resolveLoopbackIp('8.8.8.8')).rejects.toThrow(CurlLocalError);
-    try {
-      await resolveLoopbackIp('8.8.8.8');
-      throw new Error('should have thrown');
-    } catch (err) {
-      expect(err.code).toBe(3);
-    }
-  });
-
-  test('a hostname resolving to all-loopback records (injected lookup) passes, returns the pin IP', async () => {
-    const lookupFn = async () => [
-      { address: '127.0.0.1', family: 4 },
-      { address: '::1', family: 6 },
-    ];
-    await expect(resolveLoopbackIp('localhost', { lookupFn })).resolves.toBe('127.0.0.1');
-  });
-
-  test('a hostname with ONE non-loopback record among several is rejected (DNS-rebinding defense)', async () => {
-    const lookupFn = async () => [
-      { address: '127.0.0.1', family: 4 },
-      { address: '203.0.113.5', family: 4 }, // TEST-NET-3 — a real "other" address
-    ];
-    await expect(resolveLoopbackIp('rebind.example', { lookupFn })).rejects.toThrow(CurlLocalError);
-  });
-
-  test('DNS resolution failure is a rejection, not a silent pass', async () => {
-    const lookupFn = async () => {
-      const err = new Error('getaddrinfo ENOTFOUND nope.invalid');
-      err.code = 'ENOTFOUND';
-      throw err;
-    };
-    await expect(resolveLoopbackIp('nope.invalid', { lookupFn })).rejects.toThrow(CurlLocalError);
-  });
-});
-
-describe('parseRequestArgv — the Maude-owned flag vocabulary (never raw curl syntax)', () => {
-  test('a bare URL parses as a GET with no headers/body', () => {
-    const req = parseRequestArgv(['http://localhost:3000/api']);
-    expect(req.url).toBe('http://localhost:3000/api');
-    expect(req.method).toBe('GET');
-    expect(req.headers).toEqual([]);
-    expect(req.data).toBeNull();
-  });
-
-  test('--method, repeated --header, and --data all parse', () => {
-    const req = parseRequestArgv([
-      'http://localhost:3000/api',
-      '--method',
-      'post',
-      '--header',
-      'Content-Type: application/json',
-      '--header',
-      'X-Test: 1',
-      '--data',
-      '{"a":1}',
-    ]);
-    expect(req.method).toBe('POST'); // uppercased
-    expect(req.headers).toEqual(['Content-Type: application/json', 'X-Test: 1']);
-    expect(req.data).toBe('{"a":1}');
-  });
-
-  test('boolean flags (--insecure/--include/--verbose) parse with no value consumed', () => {
-    const req = parseRequestArgv([
-      'http://localhost:3000/',
-      '--insecure',
-      '--include',
-      '--verbose',
-    ]);
-    expect(req.insecure).toBe(true);
-    expect(req.include).toBe(true);
-    expect(req.verbose).toBe(true);
-  });
-
-  test('rejects an unrecognized method', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--method', 'TRACE'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects a malformed header (must look like "Name: value")', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--header', 'not-a-header'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects a non-positive --max-time', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--max-time', '0'])).toThrow(
-      CurlLocalArgvError
-    );
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--max-time', 'nope'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects a non-http(s) URL scheme', () => {
-    expect(() => parseRequestArgv(['file:///etc/passwd'])).toThrow(CurlLocalArgvError);
-  });
-
-  test('rejects a value-taking flag with no value', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', '--header'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects more than one positional argument', () => {
-    expect(() => parseRequestArgv(['http://localhost:3000/', 'http://localhost:4000/'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects when no URL is given at all', () => {
-    expect(() => parseRequestArgv(['--method', 'GET'])).toThrow(CurlLocalArgvError);
-  });
-
-  // ── Round-2 security addendum: these are exactly the argv forms that
-  // bypassed the PREVIOUS raw-curl-argv allowlist. None of them are
-  // "rejected flags" here — they're simply not part of this file's flag
-  // vocabulary at all, so they fall through to the generic
-  // "unrecognized flag" / "unexpected extra argument" path.
-  test('rejects the concatenated -K<path> config-file-smuggling PoC verbatim (round-2 finding #1)', () => {
-    expect(() => parseRequestArgv(['http://127.0.0.1:1/', '-Kevil.conf'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects a caller-supplied --noproxy override verbatim (round-2 finding #2)', () => {
-    expect(() => parseRequestArgv(['http://127.0.0.1:1/', '--noproxy', ''])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects the concatenated -x<url>/-T<path> short forms (round-2 finding #3)', () => {
-    expect(() => parseRequestArgv(['-xhttp://evil.example', 'http://127.0.0.1:1/'])).toThrow(
-      CurlLocalArgvError
-    );
-    expect(() => parseRequestArgv(['http://127.0.0.1:1/', '-T/etc/passwd'])).toThrow(
-      CurlLocalArgvError
-    );
-  });
-
-  test('rejects the original --resolve/--connect-to target-override PoC verbatim', () => {
-    expect(() =>
-      parseRequestArgv(['--resolve', 'localhost:80:203.0.113.5', 'http://localhost/'])
-    ).toThrow(CurlLocalArgvError);
-  });
-
-  test('a value containing curl-flag-shaped text is inert data, not a flag — no injection via --data', () => {
-    // "@/etc/passwd" as a --data value must never be treated as curl's
-    // "read a file" shorthand (that's -d/--data's behavior, not
-    // --data-raw's, which buildCurlArgs always uses — see the live
-    // end-to-end test below for the full round-trip proof).
-    const req = parseRequestArgv([
-      'http://localhost:3000/',
-      '--data',
-      '@/etc/passwd; -K evil.conf',
-    ]);
-    expect(req.data).toBe('@/etc/passwd; -K evil.conf');
-  });
-});
-
-describe("buildCurlArgs — every flag name is one of THIS file's own hardcoded literals", () => {
-  test('a bare GET pins the connection and forces the safety flags', () => {
-    const req = parseRequestArgv(['http://localhost:3000/']);
-    const args = buildCurlArgs(req, '127.0.0.1', 3000);
-    expect(args).toContain('--resolve');
-    expect(args[args.indexOf('--resolve') + 1]).toBe('localhost:3000:127.0.0.1');
-    expect(args).toContain('--noproxy');
-    expect(args).toContain('-q'); // curlrc disabled
-    expect(args).toEqual(expect.arrayContaining(['--max-redirs', '0']));
-    expect(args.at(-1)).toBe('http://localhost:3000/'); // the URL, always last, after `--`
-    expect(args.at(-2)).toBe('--');
-  });
-
-  test('POST + headers + data map to -X/-H/--data-raw (never -d, which treats a leading @ as a file path)', () => {
-    const req = parseRequestArgv([
-      'http://localhost:3000/api',
-      '--method',
-      'POST',
-      '--header',
-      'Content-Type: application/json',
-      '--data',
-      '@/etc/passwd',
-    ]);
-    const args = buildCurlArgs(req, '127.0.0.1', 3000);
-    expect(args).toContain('-X');
-    expect(args[args.indexOf('-X') + 1]).toBe('POST');
-    expect(args).toContain('-H');
-    expect(args[args.indexOf('-H') + 1]).toBe('Content-Type: application/json');
-    expect(args).toContain('--data-raw');
-    expect(args).not.toContain('-d');
-    expect(args[args.indexOf('--data-raw') + 1]).toBe('@/etc/passwd');
-  });
-});

package/apps/studio/bin/_pw-launch.test.mjs

@@ -1,90 +0,0 @@
-// _pw-launch.test.mjs — the pure, security-relevant helpers shared by the
-// multi-artboard export shims (_png/_pdf-playwright.mjs). Regression coverage
-// for the arbitrary-file-write finding fixed in the print-artboards dogfood
-// pass (DDR-182 addendum): a `data-dc-screen` id is DDR-054 untrusted canvas
-// content, and used to be trusted verbatim as a `path.join` segment.
-
-import { describe, expect, test } from 'bun:test';
-import { assertRenderOutputSizeOk, safeArtboardFilename } from './_pw-launch.mjs';
-
-describe('safeArtboardFilename', () => {
-  test('passes a well-formed id through unchanged', () => {
-    expect(safeArtboardFilename('ak-alpha', 0, 'pdf')).toBe('ak-alpha.pdf');
-    expect(safeArtboardFilename('Beta_2', 3, 'png')).toBe('Beta_2.png');
-  });
-
-  test('falls back to the positional name for a path-traversal id', () => {
-    expect(safeArtboardFilename('../../../../tmp/pwned', 2, 'pdf')).toBe('artboard-3.pdf');
-    expect(safeArtboardFilename('/etc/passwd', 0, 'png')).toBe('artboard-1.png');
-    expect(safeArtboardFilename('..', 1, 'pdf')).toBe('artboard-2.pdf');
-  });
-
-  test('falls back for null/undefined/empty/non-string ids', () => {
-    expect(safeArtboardFilename(null, 0, 'pdf')).toBe('artboard-1.pdf');
-    expect(safeArtboardFilename(undefined, 4, 'png')).toBe('artboard-5.png');
-    expect(safeArtboardFilename('', 1, 'pdf')).toBe('artboard-2.pdf');
-  });
-
-  test('falls back for an id starting with a digit or containing unsafe chars', () => {
-    expect(safeArtboardFilename('1abc', 0, 'pdf')).toBe('artboard-1.pdf');
-    expect(safeArtboardFilename('a/b', 0, 'pdf')).toBe('artboard-1.pdf');
-    expect(safeArtboardFilename('a b', 0, 'pdf')).toBe('artboard-1.pdf');
-  });
-
-  test('falls back for an id over the 64-char cap', () => {
-    expect(safeArtboardFilename(`a${'x'.repeat(64)}`, 0, 'pdf')).toBe('artboard-1.pdf');
-  });
-});
-
-describe('assertRenderOutputSizeOk', () => {
-  test('does not exit for a reasonable A4-at-300dpi request', () => {
-    const origExit = process.exit;
-    let exited = false;
-    process.exit = () => {
-      exited = true;
-    };
-    try {
-      assertRenderOutputSizeOk(818, 1146, 3.125, '_test');
-    } finally {
-      process.exit = origExit;
-    }
-    expect(exited).toBe(false);
-  });
-
-  test('exits when the requested output exceeds the max side guard', () => {
-    const origExit = process.exit;
-    const origError = console.error;
-    let exitCode;
-    process.exit = (code) => {
-      exitCode = code;
-      throw new Error('exit'); // stop the (test-only) function from continuing past exit
-    };
-    console.error = () => {};
-    try {
-      expect(() => assertRenderOutputSizeOk(20000, 20000, 1, '_test')).toThrow();
-    } finally {
-      process.exit = origExit;
-      console.error = origError;
-    }
-    expect(exitCode).toBe(1);
-  });
-
-  test('exits when the requested output exceeds the byte-size guard even under the side cap', () => {
-    const origExit = process.exit;
-    const origError = console.error;
-    let exitCode;
-    process.exit = (code) => {
-      exitCode = code;
-      throw new Error('exit');
-    };
-    console.error = () => {};
-    try {
-      // 15000×15000 stays under the 16000px side cap but blows the ~600MB estimate.
-      expect(() => assertRenderOutputSizeOk(15000, 15000, 1, '_test')).toThrow();
-    } finally {
-      process.exit = origExit;
-      console.error = origError;
-    }
-    expect(exitCode).toBe(1);
-  });
-});

package/apps/studio/bin/_smart-frames.test.mjs

@@ -1,195 +0,0 @@
-// _smart-frames.test.mjs — the pure timestamp/tier logic behind
-// `maude design smart-frames` (feature-scene-aware-keyframes). The ffmpeg/gemma
-// spawns + Chromium delegate are soft-dep live gates covered by manual runs; this
-// covers the deterministic math that decides WHICH frames get pulled.
-
-import { describe, expect, test } from 'bun:test';
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import {
-  clipCandidates,
-  mergeTimestamps,
-  ollamaHost,
-  ollamaScoutPrompt,
-  parseBeats,
-  parseSceneCuts,
-  pickOllamaGemmaTag,
-  readEnginePref,
-  selectTier,
-} from './_smart-frames.mjs';
-
-describe('parseSceneCuts', () => {
-  test('extracts pts_time values from ffmpeg showinfo stderr', () => {
-    const stderr =
-      'frame:0 pts_time:0.233333 ...\nframe:1 pts_time:6.533333 ...\nnoise pts_time:bad';
-    expect(parseSceneCuts(stderr)).toEqual([0.233333, 6.533333]);
-  });
-  test('empty on no cuts', () => {
-    expect(parseSceneCuts('nothing here')).toEqual([]);
-  });
-});
-
-describe('parseBeats', () => {
-  test('parses the TIME=<sec> format', () => {
-    const t = 'TIME=0.5 | opener\nTIME=6.9 | run play\n';
-    expect(parseBeats(t, 8).map((b) => b.t)).toEqual([0.5, 6.9]);
-  });
-  test('parses the M:SS format the small model tends to emit', () => {
-    const t = '0:00 | game action\n0:06 | interview\n1:03 | reveal\n';
-    const beats = parseBeats(t, 90);
-    expect(beats.map((b) => b.t)).toEqual([0, 6, 63]);
-    expect(beats[1].what).toBe('interview');
-  });
-  test('drops out-of-range beats', () => {
-    expect(parseBeats('TIME=99 | too late', 8)).toEqual([]);
-  });
-});
-
-describe('mergeTimestamps', () => {
-  test('always includes the true first and last frame', () => {
-    const ts = mergeTimestamps({ durationSec: 8, cuts: [], beats: [], maxFrames: 12 });
-    expect(ts[0]).toBe(0);
-    expect(ts[ts.length - 1]).toBeCloseTo(7.95, 2);
-  });
-  test('puts a frame just inside a shot at a cut (when not deduped against an endpoint)', () => {
-    const ts = mergeTimestamps({ durationSec: 8, cuts: [0.233, 6.533], beats: [], maxFrames: 20 });
-    // 6.583 = just after the 6.533 cut — clearly separated, survives dedup.
-    expect(ts.some((t) => Math.abs(t - 6.583) < 0.01)).toBe(true);
-    // 0.283 (just after the 0.233 cut) is within 0.4s of t=0, so dedup folds it into
-    // the opening frame — same moment, correct behavior.
-    expect(ts.filter((t) => t < 0.4)).toEqual([0]);
-  });
-  test('samples long shots more densely', () => {
-    // one 8s shot, no cuts → midpoints added (gap>3 → floor(8/3)=2 extra)
-    const ts = mergeTimestamps({ durationSec: 8, cuts: [], beats: [], maxFrames: 20 });
-    expect(ts.length).toBeGreaterThanOrEqual(4);
-  });
-  test('dedups within 0.4s', () => {
-    const ts = mergeTimestamps({
-      durationSec: 8,
-      cuts: [],
-      beats: [
-        { t: 0.1, what: '' },
-        { t: 0.2, what: '' },
-      ],
-      maxFrames: 20,
-    });
-    // 0, 0.05(inside), 0.1, 0.2 all within 0.4 → collapse toward the earliest kept
-    const near0 = ts.filter((t) => t < 0.4);
-    expect(near0.length).toBe(1);
-  });
-  test('caps to maxFrames with an even spread', () => {
-    const beats = Array.from({ length: 40 }, (_, i) => ({ t: (i * 8) / 40, what: '' }));
-    const ts = mergeTimestamps({ durationSec: 8, cuts: [], beats, maxFrames: 6 });
-    expect(ts.length).toBeLessThanOrEqual(6);
-    expect(ts[0]).toBe(0);
-  });
-});
-
-describe('selectTier', () => {
-  const gemmaReady = { ffmpeg: true, mlxPython: 'python3', ollama: null };
-  const ollamaReady = {
-    ffmpeg: true,
-    mlxPython: null,
-    ollama: { host: 'http://127.0.0.1:11434', model: 'gemma3:4b' },
-  };
-  const ffmpegOnly = { ffmpeg: true, mlxPython: null, ollama: null };
-  const bare = { ffmpeg: false, mlxPython: null, ollama: null };
-
-  test('auto degrades gemma → ffmpeg → blind', () => {
-    expect(selectTier('auto', gemmaReady)).toBe('gemma');
-    expect(selectTier('auto', ffmpegOnly)).toBe('ffmpeg');
-    expect(selectTier('auto', bare)).toBe('blind');
-  });
-  test('ollama alone unlocks the gemma tier (no mlx-vlm needed)', () => {
-    expect(selectTier('auto', ollamaReady)).toBe('gemma');
-    expect(selectTier('gemma', ollamaReady)).toBe('gemma');
-  });
-  test('explicit engine errors when its deps are missing (no silent downgrade)', () => {
-    expect(() => selectTier('gemma', ffmpegOnly)).toThrow(/mlx-vlm|Ollama/);
-    expect(() => selectTier('ffmpeg', bare)).toThrow(/ffmpeg/);
-  });
-  test('blind is always allowed', () => {
-    expect(selectTier('blind', bare)).toBe('blind');
-  });
-});
-
-describe('ollama runtime helpers', () => {
-  test('pickOllamaGemmaTag picks a vision-capable gemma3 tag', () => {
-    expect(pickOllamaGemmaTag(['llama3:8b', 'gemma3:4b'], {})).toBe('gemma3:4b');
-    expect(pickOllamaGemmaTag(['gemma3:latest'], {})).toBe('gemma3:latest');
-    expect(pickOllamaGemmaTag(['gemma3:12b'], {})).toBe('gemma3:12b');
-  });
-  test('pickOllamaGemmaTag excludes text-only tags', () => {
-    expect(pickOllamaGemmaTag(['gemma3:1b'], {})).toBe(null);
-    expect(pickOllamaGemmaTag(['gemma3n:e4b'], {})).toBe(null);
-    expect(pickOllamaGemmaTag(['llama3:8b'], {})).toBe(null);
-  });
-  test('$MAUDE_OLLAMA_MODEL wins verbatim', () => {
-    expect(pickOllamaGemmaTag(['gemma3:4b'], { MAUDE_OLLAMA_MODEL: 'gemma3:27b' })).toBe(
-      'gemma3:27b'
-    );
-  });
-  test('ollamaHost normalizes $OLLAMA_HOST and pins it to loopback', () => {
-    expect(ollamaHost({})).toBe('http://127.0.0.1:11434');
-    expect(ollamaHost({ OLLAMA_HOST: 'http://localhost:11434/' })).toBe('http://localhost:11434');
-    expect(ollamaHost({ OLLAMA_HOST: '127.0.0.1:11434' })).toBe('http://127.0.0.1:11434');
-    expect(ollamaHost({ OLLAMA_HOST: '[::1]:11434' })).toBe('http://[::1]:11434');
-    // non-loopback = refused (frames must never leave this machine — DDR-183)
-    expect(ollamaHost({ OLLAMA_HOST: '0.0.0.0:11434' })).toBe(null);
-    expect(ollamaHost({ OLLAMA_HOST: '192.168.1.20:11434' })).toBe(null);
-    expect(ollamaHost({ OLLAMA_HOST: 'http://ollama.internal:11434' })).toBe(null);
-    expect(ollamaHost({ OLLAMA_HOST: 'http://169.254.169.254' })).toBe(null);
-  });
-  test('parseBeats sanitizes model-authored labels (control chars stripped, capped)', () => {
-    const evil = `0:05 | a\x00b\x1bc ${'x'.repeat(300)}`;
-    const beats = parseBeats(evil, 10);
-    expect(beats).toHaveLength(1);
-    expect(beats[0].what.length).toBeLessThanOrEqual(120);
-    // biome-ignore lint/suspicious/noControlCharactersInRegex: asserting that control chars were stripped is the point.
-    expect(beats[0].what).not.toMatch(/[\x00-\x1f]/);
-  });
-  test('ollamaScoutPrompt maps frames to timestamps', () => {
-    const p = ollamaScoutPrompt(10, [0.05, 5, 9.95]);
-    expect(p).toContain('frame 1 = t=0.05s');
-    expect(p).toContain('frame 3 = t=9.95s');
-    expect(p).toContain('TIME=');
-  });
-});
-
-describe('clipCandidates', () => {
-  test('tries raw, root-relative, and designRoot/assets locations', () => {
-    const c = clipCandidates('assets/abc12345.mp4', '/repo', '.design');
-    expect(c).toContain('assets/abc12345.mp4');
-    expect(c).toContain('/repo/assets/abc12345.mp4');
-    expect(c).toContain('/repo/.design/assets/abc12345.mp4');
-  });
-  test('bare filename resolves under designRoot/assets', () => {
-    const c = clipCandidates('abc12345.mp4', '/repo', '.design');
-    expect(c).toContain('/repo/.design/assets/abc12345.mp4');
-  });
-});
-
-describe('readEnginePref', () => {
-  function repoWith(config) {
-    const root = mkdtempSync(join(tmpdir(), 'maude-sf-'));
-    mkdirSync(join(root, '.design'), { recursive: true });
-    if (config !== undefined)
-      writeFileSync(join(root, '.design', 'config.json'), JSON.stringify(config));
-    return root;
-  }
-  test('reads generation.keyframes.engine when present', () => {
-    const root = repoWith({ generation: { keyframes: { engine: 'ffmpeg' } } });
-    expect(readEnginePref(root)).toBe('ffmpeg');
-  });
-  test('null when absent / no config / no root (terminal self-detect path)', () => {
-    expect(readEnginePref(repoWith({}))).toBeNull();
-    expect(readEnginePref(repoWith(undefined))).toBeNull();
-    expect(readEnginePref(null)).toBeNull();
-  });
-  test('null on an invalid engine value', () => {
-    const root = repoWith({ generation: { keyframes: { engine: 'nonsense' } } });
-    expect(readEnginePref(root)).toBeNull();
-  });
-});

package/apps/studio/bin/_transcribe.test.mjs

@@ -1,80 +0,0 @@
-// _transcribe.test.mjs — the whisper.cpp JSON → word-timings parser (Phase 2).
-// The spawn/model resolution is a soft-dep live gate; this covers the pure,
-// deterministic parsing that turns whisper.cpp `-oj` output into CaptionWords
-// (then captions.ts renders the SRT — covered in captions.test.ts).
-
-import { describe, expect, test } from 'bun:test';
-import { mkdirSync, mkdtempSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { wordsToSrt } from '../generation/captions.ts';
-import { resolveProvider, whisperJsonToWords } from './_transcribe.mjs';
-
-function tmpRepo(config) {
-  const root = mkdtempSync(join(tmpdir(), 'maude-transcribe-'));
-  mkdirSync(join(root, '.design'), { recursive: true });
-  if (config !== undefined)
-    writeFileSync(join(root, '.design', 'config.json'), JSON.stringify(config));
-  return root;
-}
-
-const WHISPER_JSON = JSON.stringify({
-  transcription: [
-    { offsets: { from: 0, to: 480 }, text: ' Hello' },
-    { offsets: { from: 480, to: 900 }, text: ' there.' },
-    { offsets: { from: 1200, to: 1800 }, text: ' Maude' },
-    { offsets: { from: 0, to: 0 }, text: '   ' }, // blank → dropped
-  ],
-});
-
-describe('whisperJsonToWords', () => {
-  test('maps offsets (ms) to seconds and trims text', () => {
-    const words = whisperJsonToWords(WHISPER_JSON);
-    expect(words).toHaveLength(3);
-    expect(words[0]).toEqual({ text: 'Hello', start: 0, end: 0.48 });
-    expect(words[1]).toEqual({ text: 'there.', start: 0.48, end: 0.9 });
-    expect(words[2].text).toBe('Maude');
-  });
-
-  test('feeds captions.ts to produce a valid SRT', () => {
-    const srt = wordsToSrt(whisperJsonToWords(WHISPER_JSON));
-    expect(srt).toContain('00:00:00,000 --> 00:00:00,900');
-    expect(srt).toContain('Hello there.');
-  });
-
-  test('malformed / empty JSON yields no words (never throws)', () => {
-    expect(whisperJsonToWords('not json')).toEqual([]);
-    expect(whisperJsonToWords('{}')).toEqual([]);
-    expect(whisperJsonToWords(JSON.stringify({ transcription: [] }))).toEqual([]);
-  });
-
-  test('tolerates missing offsets', () => {
-    const words = whisperJsonToWords(JSON.stringify({ transcription: [{ text: 'x' }] }));
-    expect(words).toEqual([{ text: 'x', start: 0, end: 0 }]);
-  });
-});
-
-describe('resolveProvider (Task 2.6 — explicit engine choice, no silent switch)', () => {
-  test('an explicit valid flag wins over config', () => {
-    const repo = tmpRepo({ generation: { transcription: { provider: 'groq' } } });
-    expect(resolveProvider('elevenlabs', repo)).toEqual({
-      provider: 'elevenlabs',
-      defaulted: false,
-    });
-  });
-
-  test('falls back to the project config default', () => {
-    const repo = tmpRepo({ generation: { transcription: { provider: 'groq' } } });
-    expect(resolveProvider(undefined, repo)).toEqual({ provider: 'groq', defaulted: false });
-  });
-
-  test('defaults to local whisper (marked defaulted) when nothing is set', () => {
-    const repo = tmpRepo(); // no config
-    expect(resolveProvider(undefined, repo)).toEqual({ provider: 'whisper', defaulted: true });
-  });
-
-  test('a malformed config provider is ignored → whisper default', () => {
-    const repo = tmpRepo({ generation: { transcription: { provider: 'bogus' } } });
-    expect(resolveProvider(undefined, repo)).toEqual({ provider: 'whisper', defaulted: true });
-  });
-});