@1agh/maude 0.29.0 → 0.31.0

package/apps/studio/github/token.ts

@@ -0,0 +1,53 @@
+// github/token.ts — fetch the GitHub access token from the Tauri shell's
+// loopback bridge at request time (Phase 28 / DDR-108).
+//
+// The token lives ONLY in the OS keychain, owned by the Tauri shell. The dev-server
+// is a separate process and can't read the keychain, so it fetches the token over
+// loopback (keychain.rs → GET /_tauri/github-token, 127.0.0.1-only, per-launch key).
+// The endpoint + key arrive as env from the shell at spawn (sidecar.rs):
+//   MAUDE_TOKEN_ENDPOINT=http://127.0.0.1:<port>/_tauri/github-token
+//   MAUDE_TOKEN_KEY=<per-launch hex>
+//
+// In non-Tauri mode (`maude design serve` in a browser) those envs are absent →
+// this returns null → the /_api/github/* endpoints degrade to "sign in via the
+// desktop app". The token is never logged, persisted, or returned to the canvas.
+
+let warnedNoBridge = false;
+
+/**
+ * Resolve the current GitHub token from the loopback bridge, or null when not
+ * running under the Tauri shell / not signed in. NEVER cache the token (it can be
+ * revoked / rotated; the keychain is the single source of truth).
+ */
+export async function getGithubToken(): Promise<string | null> {
+  const endpoint = process.env.MAUDE_TOKEN_ENDPOINT;
+  const key = process.env.MAUDE_TOKEN_KEY;
+  if (!endpoint || !key) {
+    if (!warnedNoBridge) {
+      warnedNoBridge = true;
+      // One-time, non-secret: explains why github endpoints 401 outside the app.
+      console.error(
+        '[maude:github] no token bridge (not the desktop app) — GitHub features disabled'
+      );
+    }
+    return null;
+  }
+  try {
+    const res = await fetch(endpoint, {
+      headers: { 'X-Maude-Token-Key': key },
+      // The bridge is local + instant; don't hang a request on it.
+      signal: AbortSignal.timeout(3000),
+    });
+    if (res.status !== 200) return null; // 404 = not signed in; 403 = bad key
+    const token = (await res.text()).trim();
+    return token.length > 0 ? token : null;
+  } catch {
+    // Bridge unreachable (shell quit mid-request, etc.) — treat as signed out.
+    return null;
+  }
+}
+
+/** Whether the token bridge is configured at all (i.e. running under the shell). */
+export function tokenBridgeAvailable(): boolean {
+  return Boolean(process.env.MAUDE_TOKEN_ENDPOINT && process.env.MAUDE_TOKEN_KEY);
+}

package/apps/studio/history.ts

@@ -5,6 +5,7 @@
 // from the WS layer and from a future server-driven auto-snapshot hook.
 
 import type { Dirent } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { readdir } from 'node:fs/promises';
 import path from 'node:path';
 
@@ -37,10 +38,14 @@ function fileSlug(file: string, designRel: string): string {
   }
   const prefix = `${designRel.replace(/^\/+|\/+$/g, '')}/`;
   if (p.startsWith(prefix)) p = p.slice(prefix.length);
+  // Extension strip mirrors bin/slug.sh (the canonical `_history/<slug>/`
+  // recipe) — previously only `.html` was stripped, so `.tsx` canvases got a
+  // `ui-foo.tsx` history dir that /design:rollback (slug.sh: `ui-foo`) could
+  // never find. DDR-102 conflict snapshots rely on the dirs matching.
   return p
     .replace(/\//g, '-')
     .replace(/\s+/g, '_')
-    .replace(/\.html$/i, '')
+    .replace(/\.(tsx|jsx|html?|css|json|md)$/i, '')
     .replace(/^\.+/, '')
     .toLowerCase();
 }
@@ -60,8 +65,20 @@ export function createHistory(ctx: Context): History {
 
   async function writeSnapshot(file: string, contentBytes: Uint8Array | string, reason: string) {
     const slug = fileSlug(file, ctx.paths.designRel);
-    const ts = new Date().toISOString();
-    const contentPath = snapshotPath(slug, ts);
+    // Snapshot blob keeps the source file's extension (a `.tsx` body snapshot
+    // is a `.tsx` blob); unknown/absent extension falls back to `.html`.
+    const extMatch = /\.(tsx|jsx|html?|css|json|svg|md)$/i.exec(file);
+    const ext = extMatch ? extMatch[0].toLowerCase() : '.html';
+    // Two snapshots can land within the same millisecond (the DDR-102 dual
+    // pre-sync pair does) — toISOString() would collide and the second blob
+    // would overwrite the first. Bump by 1 ms until the slot is free.
+    let tsMs = Date.now();
+    let ts = new Date(tsMs).toISOString();
+    while (existsSync(snapshotPath(slug, ts, ext)) || existsSync(metaPath(slug, ts))) {
+      tsMs += 1;
+      ts = new Date(tsMs).toISOString();
+    }
+    const contentPath = snapshotPath(slug, ts, ext);
     const meta: Snapshot = {
       slug,
       ts,

package/apps/studio/hmr-broadcast.ts

@@ -6,8 +6,15 @@
 //
 //   - `mode: "css"`    → swap <link> href with a cache-bust query (no module
 //                        reload, no React state loss). Sub-150ms latency.
-//   - `mode: "module"` → location.reload() of the canvas iframe. State is lost
-//                        but the change always picks up. <250ms latency.
+//   - `mode: "module"` → in-place hot-swap of the canvas module when the canvas
+//                        runtime is mounted (re-import + remount only the canvas
+//                        content; the iframe — and the live CollabProvider +
+//                        presence — stay mounted, so a cross-peer synced edit
+//                        updates seamlessly without a presence blink — Phase 30
+//                        / F4). Falls back to location.reload() with no runtime
+//                        (gallery thumbnails) or on a re-import with no usable
+//                        default export. State (scroll / tool / undo) survives
+//                        the hot-swap path.
 //   - `mode: "hard"`   → location.reload() (used when canvas-lib.tsx or any
 //                        `_lib/**` file changes — every open canvas needs to
 //                        re-bundle).