@1agh/maude 1.0.9 → 1.2.0

package/apps/studio/test/acp-elicitation.test.ts

@@ -1,251 +0,0 @@
-// Pure unit tests for client/panels/acp-elicitation.js — the schema parser +
-// content builder ElicitationPrompt.jsx renders from. Fixture shapes mirror
-// the EXACT wire output of `@agentclientprotocol/claude-agent-acp`'s
-// `askUserQuestionsToCreateRequest` (confirmed on disk — see the file's own
-// header comment), not a guessed/simplified schema.
-
-import { describe, expect, test } from 'bun:test';
-
-import {
-  buildElicitationContent,
-  looksLikeSecretRequest,
-  parseElicitationSchema,
-} from '../client/panels/acp-elicitation.js';
-
-// A real single-question AskUserQuestion-shaped schema (single() branch of
-// askUserQuestionsToCreateRequest — message carries the question, the field
-// itself has no description).
-const SINGLE_SELECT_SCHEMA = {
-  type: 'object',
-  properties: {
-    question_0: {
-      type: 'string',
-      title: 'Which color?',
-      oneOf: [
-        { const: 'Red', title: 'Red', description: 'Warm' },
-        { const: 'Blue', title: 'Blue' },
-      ],
-    },
-    question_0_custom: {
-      type: 'string',
-      title: 'Other',
-      description: 'Type your own answer instead of choosing an option above (optional).',
-    },
-  },
-};
-
-// A real multi-question schema — index 1 is multi-select (array + items.anyOf).
-const MULTI_QUESTION_SCHEMA = {
-  type: 'object',
-  properties: {
-    question_0: {
-      type: 'string',
-      description: 'Pick one',
-      oneOf: [
-        { const: 'A', title: 'A' },
-        { const: 'B', title: 'B' },
-      ],
-    },
-    question_0_custom: { type: 'string', title: 'Other' },
-    question_1: {
-      type: 'array',
-      description: 'Pick many',
-      items: {
-        anyOf: [
-          { const: 'X', title: 'X' },
-          { const: 'Y', title: 'Y' },
-        ],
-      },
-    },
-    question_1_custom: { type: 'string', title: 'Other' },
-  },
-};
-
-describe('parseElicitationSchema', () => {
-  test('single-select (oneOf): one question, custom field paired not top-level', () => {
-    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
-    expect(qs.length).toBe(1);
-    expect(qs[0]).toMatchObject({
-      id: 'question_0',
-      kind: 'single',
-      customFieldId: 'question_0_custom',
-      required: false,
-    });
-    expect(qs[0].options).toEqual([
-      { value: 'Red', label: 'Red', description: 'Warm', preview: null },
-      { value: 'Blue', label: 'Blue', description: null, preview: null },
-    ]);
-  });
-
-  test('multi-select (array+items.anyOf) alongside a single-select sibling', () => {
-    const qs = parseElicitationSchema(MULTI_QUESTION_SCHEMA);
-    expect(qs.map((q) => q.id)).toEqual(['question_0', 'question_1']);
-    expect(qs[0].kind).toBe('single');
-    expect(qs[1].kind).toBe('multi');
-    expect(qs[1].options).toEqual([
-      { value: 'X', label: 'X', description: null, preview: null },
-      { value: 'Y', label: 'Y', description: null, preview: null },
-    ]);
-    expect(qs[1].customFieldId).toBe('question_1_custom');
-  });
-
-  test('a bare enum (untitled strings) renders with value===label', () => {
-    const qs = parseElicitationSchema({
-      type: 'object',
-      properties: { color: { type: 'string', enum: ['red', 'blue'] } },
-    });
-    expect(qs[0].options).toEqual([
-      { value: 'red', label: 'red', description: null, preview: null },
-      { value: 'blue', label: 'blue', description: null, preview: null },
-    ]);
-  });
-
-  test('an enum option carrying the AskUserQuestion preview _meta convention surfaces it as `preview`', () => {
-    const qs = parseElicitationSchema({
-      type: 'object',
-      properties: {
-        question_0: {
-          type: 'string',
-          oneOf: [
-            {
-              const: 'Option A',
-              title: 'Option A',
-              _meta: { '_claude/askUserQuestionOption': { preview: 'const x = 1' } },
-            },
-            { const: 'Option B', title: 'Option B' },
-          ],
-        },
-      },
-    });
-    expect(qs[0].options[0].preview).toBe('const x = 1');
-    expect(qs[0].options[1].preview).toBeNull();
-  });
-
-  test('a plain string/number/boolean property with no enum falls back to a text question', () => {
-    const qs = parseElicitationSchema({
-      type: 'object',
-      properties: { note: { type: 'string', title: 'Note' }, age: { type: 'number' } },
-    });
-    expect(qs.map((q) => q.kind)).toEqual(['text', 'text']);
-  });
-
-  test('schema.required marks a question required', () => {
-    const qs = parseElicitationSchema({
-      type: 'object',
-      properties: { note: { type: 'string' } },
-      required: ['note'],
-    });
-    expect(qs[0].required).toBe(true);
-  });
-
-  test('a "_custom"-suffixed field with NO base sibling renders as its own question', () => {
-    const qs = parseElicitationSchema({
-      type: 'object',
-      properties: { foo_custom: { type: 'string' } },
-    });
-    expect(qs.map((q) => q.id)).toEqual(['foo_custom']);
-  });
-
-  test('malformed/missing schema tolerance — never throws, returns []', () => {
-    expect(parseElicitationSchema(null)).toEqual([]);
-    expect(parseElicitationSchema(undefined)).toEqual([]);
-    expect(parseElicitationSchema({})).toEqual([]);
-    expect(parseElicitationSchema({ properties: null })).toEqual([]);
-    expect(parseElicitationSchema({ properties: 'not-an-object' })).toEqual([]);
-  });
-});
-
-describe('buildElicitationContent', () => {
-  test('a selected single-select option folds into content[id]', () => {
-    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
-    const content = buildElicitationContent(qs, { question_0: 'Red' });
-    expect(content).toEqual({ question_0: 'Red' });
-  });
-
-  test('a non-empty custom answer overrides the selection (matches applyAskElicitationResponse read order)', () => {
-    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
-    const content = buildElicitationContent(qs, {
-      question_0: 'Red',
-      question_0_custom: '  Something else  ',
-    });
-    expect(content).toEqual({ question_0_custom: 'Something else' });
-  });
-
-  test('a blank/whitespace-only custom answer does NOT override the selection', () => {
-    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
-    const content = buildElicitationContent(qs, { question_0: 'Blue', question_0_custom: '   ' });
-    expect(content).toEqual({ question_0: 'Blue' });
-  });
-
-  test('multi-select folds a non-empty array; an empty selection is omitted', () => {
-    const qs = parseElicitationSchema(MULTI_QUESTION_SCHEMA);
-    const content = buildElicitationContent(qs, { question_1: ['X', 'Y'] });
-    expect(content).toEqual({ question_1: ['X', 'Y'] });
-  });
-
-  test('multi-select: a custom answer is ADDED to the picks (via the base field), not routed through customFieldId', () => {
-    const qs = parseElicitationSchema(MULTI_QUESTION_SCHEMA);
-    const content = buildElicitationContent(qs, {
-      question_1: ['X', 'Y'],
-      question_1_custom: '  Z  ',
-    });
-    // Combined into the BASE field's array — applyAskElicitationResponse only
-    // overrides when content[customFieldId] itself is non-empty, so leaving
-    // that key absent and appending to content[question_1] instead means the
-    // adapter's own join() sees the pick AND the custom text.
-    expect(content).toEqual({ question_1: ['X', 'Y', 'Z'] });
-    expect(content.question_1_custom).toBeUndefined();
-  });
-
-  test('multi-select: a custom answer with NO picks still sends as a single-entry array', () => {
-    const qs = parseElicitationSchema(MULTI_QUESTION_SCHEMA);
-    const content = buildElicitationContent(qs, { question_1_custom: 'Just this' });
-    expect(content).toEqual({ question_1: ['Just this'] });
-  });
-
-  test('an unanswered, non-required question is omitted entirely — never fabricates a value', () => {
-    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
-    expect(buildElicitationContent(qs, {})).toEqual({});
-    expect(buildElicitationContent([], { anything: 'x' })).toEqual({});
-  });
-
-  test('tolerates a missing/malformed answers object', () => {
-    const qs = parseElicitationSchema(SINGLE_SELECT_SCHEMA);
-    expect(buildElicitationContent(qs, null)).toEqual({});
-    expect(buildElicitationContent(qs, undefined)).toEqual({});
-  });
-});
-
-describe('looksLikeSecretRequest', () => {
-  test('matches common credential-shaped phrasing, case-insensitively', () => {
-    expect(looksLikeSecretRequest('Enter your API key')).toBe(true);
-    expect(looksLikeSecretRequest('what is your PASSWORD')).toBe(true);
-    expect(looksLikeSecretRequest('Paste your auth token here')).toBe(true);
-    expect(looksLikeSecretRequest('Provide your OAuth token')).toBe(true);
-  });
-
-  test('checks all provided texts, not just the first', () => {
-    expect(looksLikeSecretRequest('Which color do you like?', 'a secret preference')).toBe(true);
-    expect(looksLikeSecretRequest(null, 'Enter your secret key', undefined)).toBe(true);
-  });
-
-  test('an ordinary question does not trip the heuristic', () => {
-    expect(looksLikeSecretRequest('Which color do you like?')).toBe(false);
-    expect(looksLikeSecretRequest('What layout do you prefer?')).toBe(false);
-  });
-
-  test('tolerates no/malformed input', () => {
-    expect(looksLikeSecretRequest()).toBe(false);
-    expect(looksLikeSecretRequest(null, undefined, 42)).toBe(false);
-  });
-
-  test("parseElicitationSchema tags each question's own secretShaped flag from its title/description", () => {
-    const qs = parseElicitationSchema({
-      type: 'object',
-      properties: {
-        question_0: { type: 'string', description: 'Enter your password to continue' },
-      },
-    });
-    expect(qs[0].secretShaped).toBe(true);
-  });
-});

package/apps/studio/test/acp-env.test.ts

@@ -1,95 +0,0 @@
-// DDR-123 guardrail #1 — the single load-bearing detail that keeps the chat
-// panel on the user's Pro/Max subscription instead of metered API billing.
-
-import { describe, expect, test } from 'bun:test';
-
-import { SUBSCRIPTION_SCRUBBED_ENV_KEYS, scrubAgentEnv } from '../acp/env.ts';
-
-describe('scrubAgentEnv — subscription guardrail', () => {
-  test('strips the billing-switching keys, keeps everything else', () => {
-    const out = scrubAgentEnv({
-      PATH: '/usr/bin',
-      HOME: '/Users/x',
-      ANTHROPIC_API_KEY: 'sk-live-xxx',
-      ANTHROPIC_AUTH_TOKEN: 'tok-xxx',
-      UNDEFINED_VAR: undefined,
-    });
-    expect(out.PATH).toBe('/usr/bin');
-    expect(out.HOME).toBe('/Users/x');
-    expect('ANTHROPIC_API_KEY' in out).toBe(false);
-    expect('ANTHROPIC_AUTH_TOKEN' in out).toBe(false);
-    // undefined values are dropped (Bun.spawn env wants Record<string,string>)
-    expect('UNDEFINED_VAR' in out).toBe(false);
-  });
-
-  test('pins exactly the two precedence-relevant keys', () => {
-    expect([...SUBSCRIPTION_SCRUBBED_ENV_KEYS].sort()).toEqual([
-      'ANTHROPIC_API_KEY',
-      'ANTHROPIC_AUTH_TOKEN',
-    ]);
-  });
-
-  test('scrubs the whole provider/billing namespace, not just the two keys (F1)', () => {
-    const out = scrubAgentEnv({
-      PATH: '/usr/bin',
-      ANTHROPIC_BASE_URL: 'https://evil.example/v1',
-      ANTHROPIC_MODEL: 'attacker-pinned',
-      ANTHROPIC_BEDROCK_BASE_URL: 'https://evil',
-      CLAUDE_CODE_USE_BEDROCK: '1',
-      CLAUDE_CODE_USE_VERTEX: '1',
-      AWS_BEARER_TOKEN_BEDROCK: 'tok',
-      claude_session: 'keep-me', // not a provider redirect → kept
-    });
-    expect(out.PATH).toBe('/usr/bin');
-    expect('ANTHROPIC_BASE_URL' in out).toBe(false);
-    expect('ANTHROPIC_MODEL' in out).toBe(false); // re-added by the bridge from a validated value
-    expect('ANTHROPIC_BEDROCK_BASE_URL' in out).toBe(false);
-    expect('CLAUDE_CODE_USE_BEDROCK' in out).toBe(false);
-    expect('CLAUDE_CODE_USE_VERTEX' in out).toBe(false);
-    expect('AWS_BEARER_TOKEN_BEDROCK' in out).toBe(false);
-    expect(out.claude_session).toBe('keep-me');
-  });
-
-  test('never mutates the source (process.env stays intact for the parent)', () => {
-    const src: Record<string, string | undefined> = { ANTHROPIC_API_KEY: 'sk', PATH: '/bin' };
-    const out = scrubAgentEnv(src);
-    expect(src.ANTHROPIC_API_KEY).toBe('sk');
-    expect(out).not.toBe(src);
-  });
-
-  test('defaults to process.env when called with no argument', () => {
-    // Smoke: doesn't throw, returns a string map without the scrubbed keys.
-    const out = scrubAgentEnv();
-    expect('ANTHROPIC_API_KEY' in out).toBe(false);
-  });
-
-  // feature-ai-media-generation Phase 1 (Task 1.4) + DDR-164 F3 — the ACP chat
-  // panel can TRIGGER generation because the BYOK provider key is resolved
-  // SERVER-SIDE (the dev-server, a separate process, reads the 0600 file /
-  // keychain via keys.ts). The ACP `claude` subprocess never needs a generation
-  // key-custody env var, so we SCRUB them: the Phase-5.1 keychain-bridge endpoint
-  // + key (`MAUDE_GEN_KEY_*` — F3, brought forward so the tripwire is armed before
-  // the bridge is wired) AND a custom key-file path (`MAUDE_GEN_KEYS_PATH`). This
-  // does NOT make the key unreachable to a compromised same-UID agent (it can
-  // still read the default keys.json off disk — the pre-existing full-tool-agent
-  // trifecta, documented, not closable by an env-scrub); it only ensures the child
-  // is never HANDED a pointer/credential it doesn't need. Meanwhile the `maude`
-  // CLI on PATH still resolves, so generation keeps working through the scrub.
-  test('scrubs the generation key-custody env vars, keeps CLI PATH (Task 1.4 / DDR-164 F3)', () => {
-    const out = scrubAgentEnv({
-      PATH: '/usr/local/bin:/usr/bin',
-      MAUDE_GEN_KEYS_PATH: '/Users/x/.config/maude/keys.json',
-      MAUDE_GEN_KEY_ENDPOINT: 'http://127.0.0.1:9/keychain', // Phase-5.1 bridge — MUST be scrubbed (F3)
-      MAUDE_GEN_KEY_KEY: 'per-launch-bridge-secret',
-      ANTHROPIC_API_KEY: 'sk-should-be-scrubbed',
-    });
-    // The generate CLI stays reachable (the sidecar, not this child, holds the key).
-    expect(out.PATH).toBe('/usr/local/bin:/usr/bin');
-    // Every generation key-custody var is stripped from the agent env.
-    expect('MAUDE_GEN_KEYS_PATH' in out).toBe(false);
-    expect('MAUDE_GEN_KEY_ENDPOINT' in out).toBe(false);
-    expect('MAUDE_GEN_KEY_KEY' in out).toBe(false);
-    // The subscription guardrail still fires.
-    expect('ANTHROPIC_API_KEY' in out).toBe(false);
-  });
-});

package/apps/studio/test/acp-mode-banner.test.ts

@@ -1,45 +0,0 @@
-// DDR-184 #3 — the predicate behind ChatPanel's loud "you can't edit" ModeBanner.
-// Pure unit test (the banner itself is a thin render of this). Keyed off the mode
-// ID, never a label, so it stays truthful as the adapter's roster evolves.
-
-import { describe, expect, test } from 'bun:test';
-
-import { modeBlocksEdits, NO_EDIT_MODE_IDS } from '../client/panels/acp-capabilities.js';
-
-const rosterWith = (currentModeId: string) => ({
-  currentModeId,
-  availableModes: [
-    { id: 'default', name: 'Manual' },
-    { id: 'acceptEdits', name: 'Accept Edits' },
-    { id: 'plan', name: 'Plan Mode' },
-    { id: 'dontAsk', name: "Don't Ask" },
-    { id: 'bypassPermissions', name: 'Bypass Permissions' },
-  ],
-});
-
-describe('modeBlocksEdits', () => {
-  test('blocks in Plan Mode (no tool execution)', () => {
-    expect(modeBlocksEdits(rosterWith('plan'))).toBe(true);
-  });
-
-  test("blocks in Don't-Ask (denies anything without a standing approval)", () => {
-    expect(modeBlocksEdits(rosterWith('dontAsk'))).toBe(true);
-  });
-
-  test('does NOT block in the editing modes (Manual / Accept-Edits / Bypass)', () => {
-    expect(modeBlocksEdits(rosterWith('default'))).toBe(false);
-    expect(modeBlocksEdits(rosterWith('acceptEdits'))).toBe(false);
-    expect(modeBlocksEdits(rosterWith('bypassPermissions'))).toBe(false);
-  });
-
-  test('false when the roster is empty / not yet loaded (no premature alarm)', () => {
-    expect(modeBlocksEdits(null)).toBe(false);
-    expect(modeBlocksEdits(undefined)).toBe(false);
-    expect(modeBlocksEdits({ availableModes: [] })).toBe(false);
-    expect(modeBlocksEdits({ currentModeId: '' })).toBe(false);
-  });
-
-  test('NO_EDIT_MODE_IDS is exactly {plan, dontAsk}', () => {
-    expect([...NO_EDIT_MODE_IDS].sort()).toEqual(['dontAsk', 'plan']);
-  });
-});

package/apps/studio/test/acp-origin-gate.test.ts

@@ -1,160 +0,0 @@
-// ACP bridge origin gate (DDR-123). The agent bridge spawns the user's `claude`
-// and can drive file edits, so it lives ONLY on the main (privileged) origin and
-// only over loopback. This proves:
-//   (1) GET /_api/acp/status serves on the main origin;
-//   (2) it is 403'd on the untrusted canvas origin (off CANVAS_SAFE_API +
-//       startCanvasServer routes — the dual-allowlist rule);
-//   (3) /_ws/acp is wired on the main origin (upgrade-without-headers → 400);
-//   (4) the loopback guard that fronts /_ws/acp rejects non-loopback hosts.
-
-import { describe, expect, test } from 'bun:test';
-import { readFileSync } from 'node:fs';
-import { join } from 'node:path';
-
-import { isLoopbackHost, isSameOriginWs } from '../ws.ts';
-import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
-
-// A minimal Request stand-in — `new Request()` strips forbidden headers like
-// `Host`, so drive the gate through a header-getter shim instead.
-function wsReq(host: string | null, origin: string | null): Request {
-  return {
-    headers: {
-      get: (n: string) =>
-        n.toLowerCase() === 'host' ? host : n.toLowerCase() === 'origin' ? origin : null,
-    },
-  } as unknown as Request;
-}
-
-async function readCanvasOrigin(designRoot: string): Promise<string> {
-  for (let i = 0; i < 40; i++) {
-    try {
-      const info = JSON.parse(readFileSync(join(designRoot, '_server.json'), 'utf8'));
-      if (info.canvasOrigin) return info.canvasOrigin as string;
-    } catch {
-      /* not written yet */
-    }
-    await Bun.sleep(50);
-  }
-  throw new Error('canvasOrigin never appeared in _server.json');
-}
-
-describe('ACP bridge origin gate', () => {
-  test('status is main-origin only; /_ws/acp wired on main', async () => {
-    const { root, designRoot } = makeSandbox();
-    const port = nextPort();
-    const proc = await bootServer(root, port, { MAUDE_CANVAS_ORIGIN_SPLIT: '1' });
-    try {
-      const main = `http://localhost:${port}`;
-      const canvas = await readCanvasOrigin(designRoot);
-      const status = async (base: string, path: string) =>
-        (await fetch(base + path, { signal: AbortSignal.timeout(2000) })).status;
-
-      // (1) main origin exposes the readiness probe
-      const probe = await fetch(`${main}/_api/acp/status`, { signal: AbortSignal.timeout(2000) });
-      expect(probe.status).toBe(200);
-      expect(typeof (await probe.json()).available).toBe('boolean');
-
-      // (2) the untrusted canvas origin must NOT reach the probe
-      expect(await status(canvas, '/_api/acp/status')).toBe(403);
-
-      // (3) /_ws/acp is wired on the main origin — a plain GET (no Upgrade
-      // headers) passes the loopback guard then fails the WS upgrade → 400,
-      // which proves the route branch exists (a 404 would mean it's unwired).
-      expect(await status(main, '/_ws/acp')).toBe(400);
-
-      // (3b) CSWSH gate — a cross-origin drive-by CANNOT open /_ws/acp even over
-      // loopback: an Origin that isn't this same loopback server is 403'd BEFORE
-      // the upgrade. WS handshakes bypass SOP, and the bridge spawns the user's
-      // `claude` + drives edits, so Host-loopback alone is not enough.
-      const driveBy = await fetch(`${main}/_ws/acp`, {
-        headers: { Origin: 'https://evil.example' },
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(driveBy.status).toBe(403);
-
-      // (4) /_api/acp/focus (the /design:chat hook) — POST-only on the main
-      // origin, 403 on the canvas origin.
-      const focusPost = await fetch(`${main}/_api/acp/focus`, {
-        method: 'POST',
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(focusPost.status).toBe(200);
-      expect((await focusPost.json()).ok).toBe(true);
-      expect(await status(main, '/_api/acp/focus')).toBe(405); // GET not allowed
-      expect(await status(canvas, '/_api/acp/focus')).toBe(403); // off the canvas origin
-
-      // (5) DDR-128 — /_api/preflight readiness probe: main-origin 200 with the
-      // {ready, items[]} shape; 403 on the untrusted canvas origin (dual-allowlist).
-      const pre = await fetch(`${main}/_api/preflight`, { signal: AbortSignal.timeout(2000) });
-      expect(pre.status).toBe(200);
-      const preJson = await pre.json();
-      expect(typeof preJson.ready).toBe('boolean');
-      expect(Array.isArray(preJson.items)).toBe(true);
-      expect(await status(canvas, '/_api/preflight')).toBe(403);
-      // A cross-origin drive-by GET is Origin-rejected before the probe can shell
-      // out — DDR-128 DoS hardening (ethical-hacker F1). Same-origin/loopback (no
-      // Origin header, asserted above) stays 200.
-      const crossOrigin = await fetch(`${main}/_api/preflight`, {
-        headers: { Origin: 'https://evil.example' },
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(crossOrigin.status).toBe(403);
-
-      // (6) Phase 31 follow-up — /_api/acp/attachment (clipboard-image paste):
-      // main-origin only. A valid PNG → 201 with an absolute path under the
-      // runtime _chat/attachments/; GET (the thumbnail serve branch) 404s
-      // without a valid content-addressed name — full serve coverage lives in
-      // acp-attachment-serve.test.ts; the canvas origin + a cross-origin
-      // drive-by POST are 403.
-      const png = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0]);
-      const up = await fetch(`${main}/_api/acp/attachment`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'image/png' },
-        body: png,
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(up.status).toBe(201);
-      const upJson = await up.json();
-      expect(typeof upJson.path).toBe('string');
-      expect(upJson.path).toContain('_chat/attachments/');
-      expect(await status(main, '/_api/acp/attachment')).toBe(404); // GET without a name → 404
-      expect(await status(canvas, '/_api/acp/attachment')).toBe(403); // off the canvas origin
-      const attDriveBy = await fetch(`${main}/_api/acp/attachment`, {
-        method: 'POST',
-        headers: { Origin: 'https://evil.example', 'Content-Type': 'image/png' },
-        body: png,
-        signal: AbortSignal.timeout(2000),
-      });
-      expect(attDriveBy.status).toBe(403);
-    } finally {
-      await killProc(proc);
-    }
-  }, 15000);
-
-  test('the loopback guard fronting /_ws/acp rejects non-loopback hosts', () => {
-    // Same guard server.ts applies before upgrading the acp socket.
-    expect(isLoopbackHost('127.0.0.1:4399')).toBe(true);
-    expect(isLoopbackHost('localhost:4399')).toBe(true);
-    expect(isLoopbackHost('[::1]:4399')).toBe(true);
-    expect(isLoopbackHost('evil.example.com')).toBe(false);
-    expect(isLoopbackHost('10.0.0.5:4399')).toBe(false);
-    expect(isLoopbackHost(null)).toBe(false);
-  });
-
-  test('isSameOriginWs — CSWSH gate: only same-loopback-port Origins (or none) pass', () => {
-    // No Origin (CLI / tests / non-browser) → allowed.
-    expect(isSameOriginWs(wsReq('localhost:4399', null))).toBe(true);
-    // Same loopback host + port (native panel + same-origin `maude design serve`
-    // tab both navigate to http://localhost:<serverport>) → allowed.
-    expect(isSameOriginWs(wsReq('localhost:4399', 'http://localhost:4399'))).toBe(true);
-    expect(isSameOriginWs(wsReq('127.0.0.1:4399', 'http://127.0.0.1:4399'))).toBe(true);
-    // localhost ≡ 127.0.0.1 on the same port → allowed (same server).
-    expect(isSameOriginWs(wsReq('localhost:4399', 'http://127.0.0.1:4399'))).toBe(true);
-    // Cross-origin drive-by (remote host) → rejected — the CSWSH close.
-    expect(isSameOriginWs(wsReq('localhost:4399', 'https://evil.example'))).toBe(false);
-    // Same host, DIFFERENT local port (attacker's own dev server) → rejected.
-    expect(isSameOriginWs(wsReq('localhost:4399', 'http://localhost:3000'))).toBe(false);
-    // Opaque/null origin (sandboxed iframe, file://) → rejected.
-    expect(isSameOriginWs(wsReq('localhost:4399', 'null'))).toBe(false);
-  });
-});