@1agh/maude 0.41.0 → 0.43.0

package/apps/studio/git/service.ts

@@ -211,7 +211,9 @@ function isMaudeRuntimeState(p: string): boolean {
   return (
     /(^|\/)_(?:server|active|sync|preflight|locator|export-history)\.json$/.test(p) ||
     /(^|\/)_server\.(?:lock|log)$/.test(p) ||
-    /(^|\/)_(?:history|trash|draw|smoke|canvas-state|state|chat|comments|untrusted)(?:\/|$)/.test(p)
+    /(^|\/)_(?:history|trash|draw|photo|smoke|canvas-state|state|chat|comments|untrusted|export-jobs)(?:\/|$)/.test(
+      p
+    )
   );
 }
 
@@ -539,6 +541,16 @@ function classifyRemoteUrl(url: string): RemoteTransport {
   return 'unsafe';
 }
 
+/** True when a remote URL points at github.com (https or the scp-like ssh form).
+ *  Decides the fold path (DDR-162): a GitHub remote gets the PR flow (push draft +
+ *  open a pull request via the endpoint); anything else (no remote, a local/file
+ *  remote) keeps the local-merge path. Only a routing decision — the authoritative,
+ *  security-anchored owner/repo parse is `parseGitHubRemote` at the endpoint, which
+ *  rejects an embedded `evil.com/github.com/…` even if this heuristic didn't. */
+function isGitHubRemote(url: string): boolean {
+  return /(?:^|\/\/|@)github\.com[:/]/i.test((url || '').trim());
+}
+
 /** Read a remote's configured URL (empty string when missing). */
 async function readRemoteUrl(dir: string, remote: string): Promise<string> {
   return (await git.getConfig({ fs, dir, path: `remote.${remote}.url` }).catch(() => null)) || '';
@@ -548,14 +560,42 @@ async function readRemoteUrl(dir: string, remote: string): Promise<string> {
  *  never to an arbitrary HTTPS host an attacker put in `remote.origin.url` (PAT
  *  exfil / SSRF). HTTP(S) urls only; ssh carries no token regardless. */
 function isTrustedTokenHost(url: string): boolean {
+  const u = (url || '').trim();
+  // SECURITY (F1 — parser-differential PAT exfil): the token-attach decision must NOT
+  // trust a `new URL()` parse that git+libcurl will REDO with a different grammar. A
+  // `https://github.com\@attacker/x` reads as host github.com under WHATWG but as host
+  // `attacker` under curl (backslash = path/userinfo char). Reject any byte that could
+  // re-open the authority — backslash, userinfo `@`, whitespace, control chars — then
+  // require the byte-exact canonical github.com https prefix, so the host resolves to
+  // github.com under BOTH parsers before the PAT is ever lent.
+  // Only printable ASCII (rejects whitespace, control, and non-ASCII homoglyphs),
+  // and no backslash / userinfo `@` — the two bytes that let curl re-resolve the host.
+  if (/[^\x21-\x7e]/.test(u) || u.includes('\\') || u.includes('@')) return false;
+  if (!/^https:\/\/github\.com\//i.test(u)) return false;
   try {
-    const h = new URL(url).hostname.toLowerCase();
-    return h === 'github.com' || h.endsWith('.github.com');
+    return new URL(u).hostname.toLowerCase() === 'github.com';
   } catch {
     return false;
   }
 }
 
+/** The URL git will ACTUALLY dial for `remote`, after any `url.<base>.insteadOf`
+ *  rewrite — the URL that must be host-validated, NOT the raw `remote.url`. A poisoned
+ *  `.git/config` `url.<attacker>.insteadOf = https://github.com/` (rides a clone/folder,
+ *  no file-review sees it) makes the SYSTEM engine dial the attacker even though
+ *  `remote.url` is a clean github URL; this is the surviving instance of the F1
+ *  "validate-here / connect-there" class (verify re-review). `git ls-remote --get-url`
+ *  applies insteadOf and prints WITHOUT touching the network. iso-git ignores insteadOf,
+ *  so when there's no system git the raw URL IS the effective one. */
+async function effectiveRemoteUrl(dir: string, remote: string): Promise<string> {
+  const raw = await readRemoteUrl(dir, remote);
+  if (!raw) return ''; // no remote → 'none'
+  if (!(await systemGitAvailable())) return raw;
+  const r = await runGit(dir, [...HARDENED_REMOTE_FLAGS, 'ls-remote', '--get-url', remote]);
+  const eff = r.code === 0 ? r.stdout.trim() : '';
+  return eff || raw;
+}
+
 /** Defense-in-depth for any `runGit` that resolves a config remote URL: disable the
  *  command-EXECUTING transports at the git layer too (`classifyRemoteUrl` already
  *  refuses them before we spawn — this is the backstop). Deliberately does NOT
@@ -765,8 +805,15 @@ export interface GitFoldResult {
   conflict?: boolean;
   authRequired?: boolean;
   error?: string;
-  /** The Shared-version branch the draft was added to. */
+  /** The Shared-version branch the draft was added to (local merge) or targeted (PR). */
   shared?: string;
+  /** PR flow (DDR-162): a GitHub remote exists, the draft branch was pushed, and the
+   *  endpoint should open a pull request `head → base`. When set, no local merge or
+   *  push of the Shared version happened — the merge lands on GitHub, post-review. */
+  prReady?: boolean;
+  head?: string;
+  base?: string;
+  remoteUrl?: string;
 }
 
 /** "Add this draft to the Shared version" (phase-29 / E4, Task 7): merge the draft
@@ -791,6 +838,29 @@ export async function gitFoldDraft(
   if (!branches.some((b) => b.name === draftName))
     return { ok: false, error: "That draft doesn't exist." };
 
+  // A GitHub remote → PR flow (DDR-162): publish the DRAFT branch (branch protection
+  // guards the Shared version, not the draft) and signal the endpoint to open a pull
+  // request draft→shared. We deliberately do NOT merge or push the Shared version here
+  // — pushing a protected `main` is exactly what GitHub forbids, and the reason the PR
+  // exists. The merge lands on GitHub after review.
+  const remoteUrl = await readRemoteUrl(dir, remote);
+  if (isGitHubRemote(remoteUrl)) {
+    const push = await gitPush(dir, token, { remote, ref: draftName });
+    if (!push.ok) {
+      if (push.authRequired) return { ok: false, authRequired: true, error: push.error };
+      if (push.conflict)
+        return {
+          ok: false,
+          conflict: true,
+          error: 'Your draft moved on the server — Get latest first, then add it.',
+        };
+      return { ok: false, error: push.error ?? 'Could not publish your draft.' };
+    }
+    return { ok: true, shared, prReady: true, head: draftName, base: shared, remoteUrl };
+  }
+
+  // No remote (or a non-GitHub local remote) → merge the draft into the Shared version
+  // locally; there's no PR host. Unchanged pre-PR-flow behavior.
   // Merge the draft into the Shared version (FF when possible, else a merge commit).
   try {
     if (USE_SYSTEM_GIT) {
@@ -864,11 +934,59 @@ export async function gitFoldDraft(
 
 // ── push (Publish) ─────────────────────────────────────────────────────────
 
+/** Publish / Get-latest transport routing — brings the network WRITE paths up to the
+ *  same DDR-131/DDR-133 gate the network READ paths already enforce (gitFetchRemote
+ *  `:1099`, remoteAheadBehind `:1628`). iso-git speaks HTTP(S) ONLY, so an ssh/git
+ *  remote MUST run through the system binary (the "unrecognized transport protocol:
+ *  ssh" bug was push/pull skipping this); a command-executing / non-github URL is
+ *  REFUSED before any spawn; and the keychain PAT rides only a trusted-host HTTPS
+ *  request. `none` (no remote configured) keeps the pre-gate routing so a local-only
+ *  project's tokenless publish still short-circuits to "sign in" unchanged. */
+type NetWriteRoute =
+  | { via: 'system'; tokenForSystem: string | undefined }
+  | { via: 'iso' }
+  | { via: 'legacy' }
+  | { via: 'authRequired' }
+  | { via: 'reject'; error: string };
+
+async function resolveNetWriteRoute(
+  dir: string,
+  remote: string,
+  token: string | undefined
+): Promise<NetWriteRoute> {
+  const url = await effectiveRemoteUrl(dir, remote); // post-insteadOf — the URL git dials
+  const transport = classifyRemoteUrl(url);
+  if (transport === 'none') return { via: 'legacy' };
+  // Command-executing transports (ext::/fd::/transport:: — the `::` helpers) are RCE:
+  // refuse BEFORE any spawn so neither engine ever resolves them. A plain file/local
+  // remote is NOT rejected here — it's a legitimate explicit local-repo transfer
+  // (handled by the system branch below), matching HARDENED_REMOTE_FLAGS' stance that
+  // only shell-spawning helpers are blocked, not file object transfer.
+  if (url.includes('::'))
+    return { via: 'reject', error: 'Maude can only sync github.com (HTTPS or SSH) projects.' };
+  const trustedHttp = transport === 'http' && isTrustedTokenHost(url);
+  if (transport === 'http' && !trustedHttp)
+    return { via: 'reject', error: 'Maude can only sync github.com projects.' };
+  // Tokenless github HTTPS with no system git to fall back on: iso can't authenticate
+  // → ask the user to sign in (mirrors gitFetchRemote `:1096`).
+  if (transport === 'http' && !token && !(await systemGitAvailable()))
+    return { via: 'authRequired' };
+  // System engine for: ssh (iso can't speak it), a file/local remote ('unsafe' minus
+  // the `::` helpers rejected above — e.g. a bare-repo path), or ANY remote once a git
+  // binary exists. The PAT rides only a trusted-host HTTPS request; ssh/local use the
+  // user's own key / on-disk path.
+  if ((await systemGitAvailable()) || transport === 'ssh' || transport === 'unsafe')
+    return { via: 'system', tokenForSystem: trustedHttp ? token : undefined };
+  return { via: 'iso' }; // github HTTPS + token, no system git present
+}
+
 /** Publish. `token` is optional in phase-27: the system-git engine falls back to
  *  the user's configured credential helper / SSH, so a developer-ish user who
  *  cloned with system git can publish today (no in-UI token). The iso-git default
  *  engine needs the token (no helper integration) → `authRequired` when absent,
- *  which the UI renders as "Sign in to publish" (phase-28 keychain fills it). */
+ *  which the UI renders as "Sign in to publish" (phase-28 keychain fills it).
+ *  Engine choice goes through resolveNetWriteRoute so an ssh remote reaches the git
+ *  binary instead of iso's HTTP-only transport (DDR-131/DDR-133 parity). */
 export async function gitPush(
   dir: string,
   token: string | undefined,
@@ -877,9 +995,21 @@ export async function gitPush(
   if (!isRepo(dir)) return { ok: false, error: 'This project is not versioned yet.' };
   invalidateRemoteProbe(dir); // a publish changes ahead/behind — re-probe next status
   const remote = opts.remote || 'origin';
-  return USE_SYSTEM_GIT
-    ? pushSystem(dir, token, remote, opts.ref)
-    : pushIso(dir, token, remote, opts.ref);
+  const route = await resolveNetWriteRoute(dir, remote, token);
+  switch (route.via) {
+    case 'reject':
+      return { ok: false, error: route.error };
+    case 'authRequired':
+      return { ok: false, authRequired: true, error: 'Sign in to publish.' };
+    case 'system':
+      return pushSystem(dir, route.tokenForSystem, remote, opts.ref);
+    case 'iso':
+      return pushIso(dir, token, remote, opts.ref);
+    case 'legacy':
+      return USE_SYSTEM_GIT
+        ? pushSystem(dir, token, remote, opts.ref)
+        : pushIso(dir, token, remote, opts.ref);
+  }
 }
 
 async function pushIso(
@@ -924,6 +1054,11 @@ async function pushIso(
   } catch (e) {
     const msg = errMsg(e);
     if (isNonFastForward(msg)) return { ok: false, conflict: true };
+    if (isTransportError(msg))
+      return {
+        ok: false,
+        error: 'Publishing needs the git command-line tool for this project’s connection.',
+      };
     return { ok: false, error: msg };
   }
 }
@@ -942,9 +1077,15 @@ async function pushSystem(
   // disk). Without one, fall through to the user's configured credential helper /
   // SSH agent — the phase-27 "I cloned with system git" publish path.
   const args = tokenHeaderArgs(token);
-  args.push('push', remote, branch || 'HEAD');
+  args.push(...HARDENED_REMOTE_FLAGS, 'push', remote, branch || 'HEAD');
   const r = await runGit(dir, args);
   if (r.code === 0) return { ok: true };
+  // 127 = no git binary on PATH (the ssh-remote-but-no-CLI case; ssh always routes here).
+  if (r.code === 127)
+    return {
+      ok: false,
+      error: 'Publishing needs the git command-line tool for this project’s connection.',
+    };
   if (isNonFastForward(`${r.stderr} ${r.stdout}`.toLowerCase()))
     return { ok: false, conflict: true };
   return { ok: false, error: r.stderr.trim() || 'Publish failed.' };
@@ -960,13 +1101,17 @@ function isSafeGitPositional(v: string): boolean {
   return SAFE_GIT_POSITIONAL.test(v);
 }
 
-/** Ephemeral `git -c http.extraheader=…` args carrying a token as HTTPS basic
- *  auth, or `[]` when no token (fall back to the user's credential helper). The
- *  header is per-invocation so the PAT never lands in the on-disk remote URL. */
+/** Ephemeral `git -c http.<github>.extraheader=…` args carrying a token as HTTPS
+ *  basic auth, or `[]` when no token (fall back to the user's credential helper). The
+ *  header is per-invocation so the PAT never lands in the on-disk remote URL — AND it
+ *  is SCOPED to `https://github.com/` (not the global `http.extraheader`): git attaches
+ *  it only to a request whose curl-RESOLVED host is github.com, so a poisoned remote
+ *  that WHATWG reads as github.com but curl dials elsewhere never receives the PAT
+ *  (F1 defense-in-depth, on top of the isTrustedTokenHost strict-validate). */
 function tokenHeaderArgs(token: string | undefined): string[] {
   if (!token) return [];
   const auth = Buffer.from(`x-access-token:${token}`).toString('base64');
-  return ['-c', `http.extraheader=Authorization: Basic ${auth}`];
+  return ['-c', `http.https://github.com/.extraheader=Authorization: Basic ${auth}`];
 }
 
 function isNonFastForward(blob: string): boolean {
@@ -979,6 +1124,15 @@ function isNonFastForward(blob: string): boolean {
   );
 }
 
+/** iso-git speaks HTTP(S) only and throws "unrecognized transport protocol" on an
+ *  ssh/git remote. Routing now sends those to system git (resolveNetWriteRoute), so
+ *  this is a BELT: if a transport error ever still reaches an iso catch, map it to the
+ *  same "use the git CLI" copy gitFetchRemote shows (`:1153`) instead of leaking the
+ *  raw isomorphic-git string to the UI. */
+function isTransportError(blob: string): boolean {
+  return /unrecognized transport|unsupported|protocol/i.test(blob);
+}
+
 // ── pull (Get latest) ─────────────────────────────────────────────────────
 
 /** Get latest. Same optional-token model as gitPush (see its doc comment). */
@@ -989,9 +1143,22 @@ export async function gitPull(
 ): Promise<GitPullResult> {
   if (!isRepo(dir)) return { ok: false, error: 'This project is not versioned yet.' };
   invalidateRemoteProbe(dir); // a pull changes ahead/behind — re-probe next status
-  return USE_SYSTEM_GIT
-    ? pullSystem(dir, token, opts.remote || 'origin', opts.ref)
-    : pullIso(dir, token, opts.remote || 'origin', opts.ref);
+  const remote = opts.remote || 'origin';
+  const route = await resolveNetWriteRoute(dir, remote, token);
+  switch (route.via) {
+    case 'reject':
+      return { ok: false, error: route.error };
+    case 'authRequired':
+      return { ok: false, authRequired: true, error: 'Sign in to get the latest.' };
+    case 'system':
+      return pullSystem(dir, route.tokenForSystem, remote, opts.ref);
+    case 'iso':
+      return pullIso(dir, token, remote, opts.ref);
+    case 'legacy':
+      return USE_SYSTEM_GIT
+        ? pullSystem(dir, token, remote, opts.ref)
+        : pullIso(dir, token, remote, opts.ref);
+  }
 }
 
 async function pullIso(
@@ -1020,7 +1187,13 @@ async function pullIso(
     // `data` is the list of conflicted filepaths. DiffView opens on these.
     const conflictFiles = mergeConflictFiles(e);
     if (conflictFiles) return { ok: false, conflict: true, files: conflictFiles };
-    return { ok: false, error: errMsg(e) };
+    const msg = errMsg(e);
+    if (isTransportError(msg))
+      return {
+        ok: false,
+        error: 'Getting the latest needs the git command-line tool for this project’s connection.',
+      };
+    return { ok: false, error: msg };
   }
 }
 
@@ -1035,9 +1208,14 @@ async function pullSystem(
     return { ok: false, error: 'Invalid remote or draft name.' };
   }
   const args = tokenHeaderArgs(token);
-  args.push('pull', '--no-rebase', remote, branch || 'HEAD');
+  args.push(...HARDENED_REMOTE_FLAGS, 'pull', '--no-rebase', remote, branch || 'HEAD');
   const r = await runGit(dir, args);
   if (r.code === 0) return { ok: true };
+  if (r.code === 127)
+    return {
+      ok: false,
+      error: 'Getting the latest needs the git command-line tool for this project’s connection.',
+    };
   const blob = `${r.stderr}\n${r.stdout}`;
   if (/conflict/i.test(blob)) {
     // Parse `CONFLICT (content): Merge conflict in <path>` lines.
@@ -1076,7 +1254,7 @@ export async function gitFetchRemote(
   // binary — but a command-executing (`ext::`) / local (`file://`) URL must be
   // REFUSED, never handed to `git fetch` (it would run as the user). And the GitHub
   // token may only ride a github.com HTTPS request, never an attacker-chosen host.
-  const url = await readRemoteUrl(dir, remote);
+  const url = await effectiveRemoteUrl(dir, remote); // post-insteadOf — the URL git dials
   const transport = classifyRemoteUrl(url);
   if (transport === 'none') return { ok: false, error: 'This project has no remote to refresh.' };
   if (transport === 'unsafe')
@@ -1611,7 +1789,7 @@ async function remoteAheadBehindUncached(
   // remote URL before touching the git binary. A command-executing (`ext::`) or
   // local (`file://`) URL is refused (return 0/0, no spawn); the token rides only a
   // github.com HTTPS request, never an attacker-chosen host.
-  const url = await readRemoteUrl(dir, remote);
+  const url = await effectiveRemoteUrl(dir, remote); // post-insteadOf — the URL git dials
   const transport = classifyRemoteUrl(url);
   if (transport === 'none' || transport === 'unsafe') return { ahead: 0, behind: 0 };
   const trustedHttp = transport === 'http' && isTrustedTokenHost(url);

package/apps/studio/github/service.ts

@@ -164,6 +164,73 @@ export async function createRepo(token: string, input: CreateRepoInput): Promise
   };
 }
 
+export interface PullRequest {
+  number: number;
+  html_url: string;
+}
+
+export interface CreatePullRequestInput {
+  /** The draft branch (same-repo head — a bare branch name). */
+  head: string;
+  /** The Shared-version branch the PR targets (main/master). */
+  base: string;
+  title: string;
+  body?: string;
+}
+
+/** Open a pull request `head → base` in the given repo. GitHub returns 422 both when
+ *  a PR for this head/base already exists AND when there are no commits between them;
+ *  we can't tell from the (friendly-mapped) message, so we probe for an already-open
+ *  PR — if one exists, re-running "Add to Shared version" links it instead of erroring;
+ *  otherwise it's a genuine no-op and we surface a friendly message. */
+export async function createPullRequest(
+  token: string,
+  owner: string,
+  repo: string,
+  input: CreatePullRequestInput
+): Promise<PullRequest> {
+  const path = `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls`;
+  try {
+    const res = await api(token, path, {
+      method: 'POST',
+      body: { title: input.title, head: input.head, base: input.base, body: input.body ?? '' },
+    });
+    const r = (await res.json()) as { number: number; html_url: string };
+    return { number: r.number, html_url: r.html_url };
+  } catch (e) {
+    if (e instanceof GitHubApiError && e.status === 422) {
+      const existing = await findOpenPullRequest(token, owner, repo, input.head, input.base);
+      if (existing) return existing;
+      throw new GitHubApiError(
+        422,
+        'Nothing new to add — this draft already matches the Shared version.'
+      );
+    }
+    throw e;
+  }
+}
+
+/** The open PR for `head → base`, if any (recovers a link from the 422 above). */
+async function findOpenPullRequest(
+  token: string,
+  owner: string,
+  repo: string,
+  head: string,
+  base: string
+): Promise<PullRequest | null> {
+  const q =
+    `/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}/pulls` +
+    `?state=open&head=${encodeURIComponent(`${owner}:${head}`)}&base=${encodeURIComponent(base)}`;
+  const res = await api(token, q).catch(() => null);
+  if (!res) return null;
+  const list = (await res.json().catch(() => null)) as Array<{
+    number: number;
+    html_url: string;
+  }> | null;
+  if (!Array.isArray(list) || list.length === 0) return null;
+  return { number: list[0].number, html_url: list[0].html_url };
+}
+
 /**
  * Point the local project's `origin` at `remoteUrl` (iso-git, no network). Replaces
  * any existing remote of the same name so re-running "create project" is idempotent.

package/apps/studio/handoff.ts

@@ -107,7 +107,8 @@ export interface EmitOptions {
 // Strip data-cd-id from source — the inverse of canvas-pipeline.ts pass 1.
 
 /**
- * Remove every ` data-cd-id="<hex>"` attribute from a TSX source string.
+ * Remove every pipeline-emitted attribute — ` data-cd-id="<hex>"` and the
+ * Phase-6 ` data-cd-editable="text"` marker — from a TSX source string.
  * Pure: caller persists. Uses the same oxc-parser + magic-string toolchain as
  * the pipeline that emitted them.
  */
@@ -136,7 +137,7 @@ export function stripDataCdId(canvasAbsPath: string, source: string): string {
           if (
             a?.type === 'JSXAttribute' &&
             a.name?.type === 'JSXIdentifier' &&
-            a.name.name === 'data-cd-id' &&
+            (a.name.name === 'data-cd-id' || a.name.name === 'data-cd-editable') &&
             typeof a.start === 'number' &&
             typeof a.end === 'number'
           ) {