@1agh/maude 0.48.0 → 0.49.0

package/apps/studio/test/workspace-signin.test.ts

@@ -0,0 +1,270 @@
+// Cloud Phase 3 Task 3 — "Sign in to workspace".
+//
+// The persona is the invited teammate who has never used git. So alongside the
+// mechanics (probe, login, credential custody) these tests assert the WORDS:
+// a flow that says "paste your bearer token" has already told that person the
+// product isn't for them (DDR-193 §5).
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  type DisclosureItem,
+  signInToWorkspace,
+  workspaceDisclosure,
+} from '../sync/workspace-signin.ts';
+
+/** A fetch stand-in scripted per URL suffix, recording what it was called with. */
+function scriptedFetch(routes: Record<string, () => Response>) {
+  const calls: Array<{ url: string; init?: RequestInit }> = [];
+  const impl = (async (url: string | URL | Request, init?: RequestInit) => {
+    const href = String(url);
+    calls.push({ url: href, init });
+    for (const [suffix, make] of Object.entries(routes)) {
+      if (href.endsWith(suffix)) return make();
+    }
+    throw new Error(`unrouted ${href}`);
+  }) as unknown as typeof fetch;
+  return { impl, calls };
+}
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
+
+const HEALTHY = () => json({ ok: true, version: '0.48.0' });
+const LOGGED_IN = () =>
+  json({
+    token: 'mau_0123456789abcdef0123456789abcdef',
+    label: 'u-abcdef012345',
+    expiresAt: 1_800_000_000_000,
+    user: { email: 'alice@example.com', role: 'member' },
+  });
+
+const CREDS = {
+  url: 'https://team.example.com',
+  email: 'alice@example.com',
+  password: 'hunter2222222',
+};
+
+describe('input validation speaks to a person, not a developer', () => {
+  test('each missing field names what to do next', async () => {
+    const saved: string[] = [];
+    const save = (u: string) => void saved.push(u);
+    for (const [input, expected] of [
+      [{}, /address your team sent you/i],
+      [{ url: 'https://x.example.com' }, /email address/i],
+      [{ url: 'https://x.example.com', email: 'a@b.com' }, /password/i],
+    ] as const) {
+      const res = await signInToWorkspace(input, { save, fetchImpl: scriptedFetch({}).impl });
+      expect(res.status).toBe(400);
+      expect(res.json.ok).toBe(false);
+      expect((res.json as { error: string }).error).toMatch(expected);
+    }
+    expect(saved).toEqual([]);
+  });
+
+  test('a non-http address is refused before anything is sent', async () => {
+    const { impl, calls } = scriptedFetch({});
+    const res = await signInToWorkspace(
+      { ...CREDS, url: 'file:///etc/passwd' },
+      { fetchImpl: impl, save: () => {} }
+    );
+    expect(res.status).toBe(400);
+    expect(calls).toEqual([]);
+  });
+});
+
+describe('credential custody', () => {
+  test('the health probe is TOKENLESS and carries no password', async () => {
+    // A lookalike address must never receive a credential (phase-29 A2).
+    const { impl, calls } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+    await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+
+    const probe = calls.find((c) => c.url.endsWith('/health'));
+    expect(probe).toBeDefined();
+    expect(probe?.init?.body).toBeUndefined();
+    expect(JSON.stringify(probe?.init?.headers ?? {})).not.toContain('Authorization');
+  });
+
+  test('the password goes ONLY to the typed address, once, and is never stored', async () => {
+    const stored: Array<{ url: string; token: string }> = [];
+    const { impl, calls } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+    await signInToWorkspace(CREDS, {
+      fetchImpl: impl,
+      save: (url, token) => void stored.push({ url, token }),
+    });
+
+    const withPassword = calls.filter((c) => String(c.init?.body ?? '').includes('hunter2222222'));
+    expect(withPassword).toHaveLength(1);
+    expect(withPassword[0]?.url).toBe('https://team.example.com/auth/login');
+
+    // What is persisted is the minted TOKEN — never the password.
+    expect(stored).toHaveLength(1);
+    expect(stored[0]?.token).toBe('mau_0123456789abcdef0123456789abcdef');
+    expect(JSON.stringify(stored)).not.toContain('hunter2222222');
+  });
+
+  test('nothing is saved when sign-in fails', async () => {
+    const stored: string[] = [];
+    const { impl } = scriptedFetch({
+      '/health': HEALTHY,
+      '/auth/login': () => json({ error: 'invalid email or password' }, 401),
+    });
+    const res = await signInToWorkspace(CREDS, {
+      fetchImpl: impl,
+      save: (u) => void stored.push(u),
+    });
+    expect(res.status).toBe(401);
+    expect(stored).toEqual([]);
+  });
+});
+
+describe('failure modes are distinguishable and actionable', () => {
+  test('an unreachable address says so, and never reaches login', async () => {
+    const { impl, calls } = scriptedFetch({
+      '/health': () => {
+        throw new Error('ECONNREFUSED');
+      },
+    });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    expect((res.json as { reason: string }).reason).toBe('unreachable');
+    expect((res.json as { error: string }).error).toMatch(/couldn't reach/i);
+    expect(calls.some((c) => c.url.includes('/auth/login'))).toBe(false);
+  });
+
+  test('an address that answers but is not a Maude workspace is named as such', async () => {
+    // A typo'd address that lands on someone else's server would otherwise fail
+    // later as a mysterious auth error.
+    const { impl } = scriptedFetch({ '/health': () => json({ status: 'ok, but not maude' }) });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    expect((res.json as { reason: string }).reason).toBe('not-a-maude-workspace');
+    expect((res.json as { error: string }).error).toMatch(/isn't a Maude workspace/i);
+  });
+
+  test('bad credentials do not guess WHICH half was wrong', async () => {
+    // The hub refuses to be a user-existence oracle, so the client must not
+    // invent one by saying "wrong password" when the account may not exist.
+    const { impl } = scriptedFetch({
+      '/health': HEALTHY,
+      '/auth/login': () => json({ error: 'invalid email or password' }, 401),
+    });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    const error = (res.json as { error: string }).error;
+    expect(error).not.toMatch(/no such (user|account)/i);
+    expect(error).not.toMatch(/wrong password/i);
+    expect(error).toMatch(/not accepted/i);
+  });
+
+  test('rate limiting says to wait rather than to retry', async () => {
+    const { impl } = scriptedFetch({
+      '/health': HEALTHY,
+      '/auth/login': () => json({ error: 'rate limit exceeded' }, 429),
+    });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    expect((res.json as { reason: string }).reason).toBe('rate-limited');
+    expect((res.json as { error: string }).error).toMatch(/wait a minute/i);
+  });
+
+  test('a failed save is reported instead of pretending success', async () => {
+    const { impl } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+    const res = await signInToWorkspace(CREDS, {
+      fetchImpl: impl,
+      save: () => {
+        throw new Error('read-only fs');
+      },
+    });
+    expect((res.json as { reason: string }).reason).toBe('save-failed');
+  });
+});
+
+describe('success', () => {
+  test('returns the person and their session, never the token', async () => {
+    const { impl } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+
+    expect(res.status).toBe(200);
+    expect(res.json).toEqual({
+      ok: true,
+      url: 'https://team.example.com',
+      user: { email: 'alice@example.com', role: 'member' },
+      expiresAt: 1_800_000_000_000,
+      version: '0.48.0',
+    });
+    // The token must not travel back to the UI layer — it has no use for it and
+    // every surface that holds one is a surface that can leak one.
+    expect(JSON.stringify(res.json)).not.toContain('mau_');
+  });
+
+  test('a trailing slash or bare host normalizes to the same workspace', async () => {
+    const stored: string[] = [];
+    for (const url of ['https://team.example.com/', 'https://team.example.com']) {
+      const { impl } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
+      await signInToWorkspace(
+        { ...CREDS, url },
+        { fetchImpl: impl, save: (u) => void stored.push(u) }
+      );
+    }
+    expect(new Set(stored).size).toBe(1);
+  });
+});
+
+describe('the disclosure panel — DDR-054 made visible (DDR-192 §6)', () => {
+  const text = (items: DisclosureItem[]) => items.map((i) => `${i.title} ${i.detail}`).join(' ');
+
+  test('it says what the operator CAN see, not only what they cannot', () => {
+    // A disclosure that only lists reassurances is marketing. The point is that
+    // the person can decide, which requires the uncomfortable half.
+    const items = workspaceDisclosure({ operator: 'your team', aiAvailable: true });
+    const sees = items.filter((i) => i.kind === 'sees');
+    expect(sees.length).toBeGreaterThanOrEqual(3);
+    expect(text(sees)).toMatch(/edit history/i);
+    expect(text(sees)).toMatch(/when you are editing/i);
+    expect(text(sees)).toMatch(/comments/i);
+  });
+
+  test('it names the containment invariant in words a person understands', () => {
+    const items = workspaceDisclosure({ operator: 'Maude Cloud', aiAvailable: true });
+    expect(text(items)).toMatch(/never executes them/i);
+    expect(text(items)).toMatch(/render here, on your machine/i);
+  });
+
+  test('it names the operator, so "who can see this" has an answer', () => {
+    const items = workspaceDisclosure({ operator: 'Acme Design Ltd', aiAvailable: true });
+    expect(text(items)).toContain('Acme Design Ltd');
+  });
+
+  test('the AI-less state is stated as a fact, not an error', () => {
+    // Phase 6's persona: an invitee without a Claude subscription gets a
+    // first-class product, not a broken one.
+    const off = workspaceDisclosure({ operator: 'your team', aiAvailable: false });
+    const ai = off.find((i) => i.title.includes('AI'));
+    expect(ai?.detail).toMatch(/Everything else works normally/i);
+    expect(ai?.detail).not.toMatch(/error|unavailable|failed|missing/i);
+
+    const on = workspaceDisclosure({ operator: 'your team', aiAvailable: true });
+    expect(on.find((i) => i.title.includes('AI'))?.detail).toMatch(/your own subscription/i);
+  });
+
+  test('it promises the exit, because that is what makes the rest believable', () => {
+    const items = workspaceDisclosure({ operator: 'Maude Cloud', aiAvailable: true });
+    expect(text(items)).toMatch(/opens without Maude/i);
+  });
+
+  test('no jargon reaches the person', () => {
+    // DDR-193 §5 — the product word is "project"/"workspace". These words on an
+    // invite path tell a non-developer the product is not for them.
+    const items = workspaceDisclosure({ operator: 'your team', aiAvailable: false });
+    const all = text(items).toLowerCase();
+    for (const word of [
+      'token',
+      'repository',
+      'repo ',
+      'oauth',
+      'bearer',
+      'crdt',
+      'yjs',
+      'commit',
+    ]) {
+      expect(all).not.toContain(word);
+    }
+  });
+});

package/apps/studio/use-collab.tsx

@@ -33,6 +33,8 @@ import { Awareness, applyAwarenessUpdate, encodeAwarenessUpdate } from 'y-protoc
 import { readSyncMessage, writeSyncStep1, writeUpdate } from 'y-protocols/sync';
 import * as Y from 'yjs';
 
+import { isTrustedOrigin, touchesBodyLane } from './collab/origins.ts';
+
 const MESSAGE_SYNC = 0;
 const MESSAGE_AWARENESS = 1;
 
@@ -677,10 +679,35 @@ function createSession(slug: string): CollabSession {
 
   // Wire doc updates → broadcast to server. Origin tagged with the ws so
   // server-side updates we receive don't echo back.
-  const onDocUpdate = (update: Uint8Array, origin: unknown) => {
+  //
+  // ORIGIN GATE, lock 1 (DDR-122 follow-up — see collab/origins.ts). This file
+  // runs in the UNTRUSTED canvas realm, so any script sharing the realm can
+  // reach this doc through `useCollab().doc` and write the body lanes — the
+  // canvas's own source. Refuse to broadcast such an op unless it carries a
+  // trusted origin sentinel, which canvas script cannot obtain. Comments,
+  // annotations, and presentation are untouched: the canvas realm co-authors
+  // those by design, and same-machine boards must keep working.
+  let bodyLaneWarned = false;
+  const onDocUpdate = (
+    update: Uint8Array,
+    origin: unknown,
+    _doc: Y.Doc,
+    transaction: Y.Transaction
+  ) => {
     const ws = wsRef;
     if (!ws || ws.readyState !== WebSocket.OPEN) return;
     if (origin === ws) return; // came from server, don't echo
+    if (touchesBodyLane(transaction) && !isTrustedOrigin(origin)) {
+      if (!bodyLaneWarned) {
+        bodyLaneWarned = true;
+        console.warn(
+          '[collab] refused to broadcast a canvas-realm write to the canvas source ' +
+            '(html/css/meta). Untrusted canvas script may not edit the document body — ' +
+            'DDR-122 follow-up.'
+        );
+      }
+      return;
+    }
     broadcastSyncUpdate(ws, update);
   };
   doc.on('update', onDocUpdate);

package/apps/studio/workspace-mode.ts

@@ -0,0 +1,210 @@
+// Workspace mode + the containment invariant's first enforcement point.
+//
+// DDR-193 states the invariant:
+//
+//   > No tenant-authored TSX is ever evaluated by vendor-operated compute.
+//   > A cell runs sync + git + asset storage — nothing else. It never renders a
+//   > canvas, never builds a bundle, never executes a canvas module, never runs
+//   > a headless browser against tenant content.
+//
+// and states how it is kept: "enforced, not asserted — a boot-assert in the cell
+// image plus a CI grep gate." This module is the boot-assert. The grep gate is
+// `scripts/check-containment.sh`.
+//
+// WHY A BOOT-ASSERT AND NOT A CODE REVIEW RULE. Every canvas is code the tenant
+// wrote. The moment vendor compute evaluates it, an anonymous signup has
+// arbitrary code execution inside our perimeter, next to other tenants' designs
+// and the control plane's credentials. A convention protects that for exactly as
+// long as everyone remembers it; a process that refuses to start does not
+// forget. The failure mode this prevents is not "someone adds a bad route on
+// purpose" — it is "someone adds a thumbnail endpoint in 2027 without knowing
+// this line exists."
+//
+// It fails CLOSED and LOUD: the cell refuses to boot, naming the exact surfaces
+// that broke it. A cell that will not start is a page; a cell that quietly
+// renders tenant code is an incident.
+
+/** True when this process is a vendor-operated workspace cell. */
+export function isWorkspaceMode(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.MAUDE_WORKSPACE_MODE === '1';
+}
+
+/**
+ * Route paths a workspace cell must not expose, with the reason each one
+ * violates containment. The reason travels with the entry so the error message
+ * teaches rather than just refusing.
+ *
+ * These are prefixes: `/_api/export-jobs` is caught by `/_api/export` and that
+ * is intended — a variant of a forbidden surface is still forbidden.
+ */
+export const FORBIDDEN_ROUTE_PREFIXES: ReadonlyArray<{ prefix: string; why: string }> =
+  Object.freeze([
+    {
+      prefix: '/_api/export',
+      why: 'export renders the canvas through a headless browser — it EVALUATES tenant TSX',
+    },
+    {
+      prefix: '/_api/photo-edit',
+      why: 'photo editing decodes and processes tenant-supplied media in-process',
+    },
+    {
+      prefix: '/_api/generate',
+      why: 'media generation runs tenant-authored prompts against a provider key held here',
+    },
+    {
+      prefix: '/_canvas-shell',
+      why: 'the canvas shell is the surface that mounts and executes a canvas module',
+    },
+    {
+      prefix: '/_canvas-runtime',
+      why: 'serving the canvas runtime only makes sense if something here renders a canvas',
+    },
+    {
+      prefix: '/_ws/acp',
+      why: 'the ACP bridge spawns the user’s own `claude` and can drive file edits (DDR-123 is desktop-only)',
+    },
+  ]);
+
+/**
+ * Modules a cell must not be able to load. Presence of the *dependency* is the
+ * signal — a cell image that ships Playwright is one `import()` away from
+ * rendering tenant content, so the invariant is cheaper to hold at the image
+ * boundary than at the call site.
+ */
+export const FORBIDDEN_MODULES: ReadonlyArray<string> = Object.freeze([
+  'playwright',
+  'playwright-core',
+  'puppeteer',
+  'puppeteer-core',
+]);
+
+/** True when `route` is (or starts with) a forbidden prefix. */
+export function isForbiddenRoute(route: string): boolean {
+  return FORBIDDEN_ROUTE_PREFIXES.some((f) => route === f.prefix || route.startsWith(f.prefix));
+}
+
+/**
+ * Remove every forbidden surface from a route table.
+ *
+ * This is what lets a cell boot at all: the studio serves one route table, and
+ * most of it (sync, comments, annotations, assets, git) is exactly what a cell
+ * needs. Pruning — rather than maintaining a separate cell server — means a cell
+ * runs the SAME code path a self-hoster runs, which is the property DDR-192 §1
+ * is built on. A second implementation would drift.
+ *
+ * Order matters: prune first, then `assertContainment` over the PRUNED keys.
+ * That makes the boot-assert a post-condition on this function rather than an
+ * independent opinion, so a prefix added to the vocabulary automatically both
+ * prunes and is verified.
+ */
+export function pruneForWorkspace<T extends Record<string, unknown>>(
+  routes: T
+): { routes: Partial<T>; removed: string[] } {
+  const kept: Record<string, unknown> = {};
+  const removed: string[] = [];
+  for (const [route, handler] of Object.entries(routes)) {
+    if (isForbiddenRoute(route)) removed.push(route);
+    else kept[route] = handler;
+  }
+  return { routes: kept as Partial<T>, removed: removed.sort() };
+}
+
+export interface ContainmentReport {
+  ok: boolean;
+  /** Route prefixes that are reachable and must not be. */
+  routes: Array<{ route: string; prefix: string; why: string }>;
+  /** Forbidden modules that resolve in this process. */
+  modules: string[];
+}
+
+/**
+ * Check a route table against the invariant. Pure — takes the route names so it
+ * can be unit-tested without booting a server, and so the caller decides what
+ * "reachable" means for its own dispatch shape.
+ */
+export function checkContainment(
+  routeNames: Iterable<string>,
+  { resolveModule }: { resolveModule?: (specifier: string) => boolean } = {}
+): ContainmentReport {
+  const routes: ContainmentReport['routes'] = [];
+  for (const route of routeNames) {
+    for (const { prefix, why } of FORBIDDEN_ROUTE_PREFIXES) {
+      if (route === prefix || route.startsWith(prefix)) {
+        routes.push({ route, prefix, why });
+        break;
+      }
+    }
+  }
+
+  const modules: string[] = [];
+  if (resolveModule) {
+    for (const specifier of FORBIDDEN_MODULES) {
+      if (resolveModule(specifier)) modules.push(specifier);
+    }
+  }
+
+  return { ok: routes.length === 0 && modules.length === 0, routes, modules };
+}
+
+/** Render a report as the message the operator sees when a cell refuses to boot. */
+export function formatContainmentFailure(report: ContainmentReport): string {
+  const lines = [
+    'REFUSING TO START: this process is running as a workspace cell',
+    '(MAUDE_WORKSPACE_MODE=1) but exposes surfaces that break the containment',
+    'invariant — "no tenant-authored TSX is ever evaluated by vendor-operated',
+    'compute" (DDR-193 §2).',
+    '',
+  ];
+  if (report.routes.length > 0) {
+    lines.push('Reachable routes that must not be:');
+    for (const { route, prefix, why } of report.routes) {
+      lines.push(`  ${route}`);
+      lines.push(`      matches ${prefix} — ${why}`);
+    }
+    lines.push('');
+  }
+  if (report.modules.length > 0) {
+    lines.push('Modules that resolve in this process and must not:');
+    for (const m of report.modules) lines.push(`  ${m}`);
+    lines.push('');
+  }
+  lines.push(
+    'A cell runs sync + git + asset storage. Rendering happens on a member’s own',
+    'machine, in Maude Desktop, where DDR-063/DDR-054 already contain it.',
+    '',
+    'If a feature genuinely needs one of these, Direction B (a structured,',
+    'non-executable synced unit) is its HARD PREREQUISITE — not a flag to add here.'
+  );
+  if (report.modules.length > 0) {
+    lines.push(
+      '',
+      'Testing workspace mode inside a DEV CHECKOUT? Playwright is a legitimate',
+      'devDependency here (the E2E harness), so it resolves and this fires. Set',
+      'MAUDE_WORKSPACE_ALLOW_DEV_MODULES=1 to skip the module check locally. It has',
+      'no effect on a built cell image, where the runtime-dependency gate in',
+      'scripts/check-containment.sh is the enforcement — a shipped cell must not',
+      'contain a browser at all.'
+    );
+  }
+  return lines.join('\n');
+}
+
+/**
+ * Boot gate. No-op unless workspace mode is on; otherwise throws with the full
+ * report when anything forbidden is reachable.
+ *
+ * Deliberately throws rather than returning a boolean: a caller that forgets to
+ * check a return value is exactly the class of mistake this exists to survive.
+ */
+export function assertContainment(
+  routeNames: Iterable<string>,
+  {
+    env = process.env,
+    resolveModule,
+  }: { env?: NodeJS.ProcessEnv; resolveModule?: (specifier: string) => boolean } = {}
+): void {
+  if (!isWorkspaceMode(env)) return;
+  const report = checkContainment(routeNames, { resolveModule });
+  if (report.ok) return;
+  throw new Error(formatContainmentFailure(report));
+}

package/apps/studio/ws.ts

@@ -27,6 +27,10 @@ export type WsData =
       remote: string;
       kind: 'collab';
       slug: string;
+      /** Which origin upgraded this socket — 'canvas' marks the untrusted
+       *  canvas iframe origin, whose sync frames go through the DDR-122
+       *  origin gate in collab/room.ts. Set at upgrade time in server.ts. */
+      realm: 'main' | 'canvas';
     }
   | {
       // T2 (9.1-A) — HMR-only socket for the segregated canvas origin. Receives
@@ -244,9 +248,14 @@ export function createWs(
   // right room to disconnect from. Multiplexed via ws.data.id.
   const collabConns = new Map<string, { roomSlug: string; conn: RoomConn }>();
 
-  function bindCollab(ws: ServerWebSocket<WsData>, slug: string): RoomConn {
+  function bindCollab(
+    ws: ServerWebSocket<WsData>,
+    slug: string,
+    realm: 'main' | 'canvas'
+  ): RoomConn {
     const conn: RoomConn = {
       id: ws.data.id,
+      realm,
       send(payload: Uint8Array) {
         try {
           // Bun's ws.send accepts Uint8Array directly as binary.
@@ -264,7 +273,7 @@ export function createWs(
     async open(ws) {
       if (ws.data.kind === 'collab') {
         const room = collab.registry.get(ws.data.slug);
-        const conn = bindCollab(ws, ws.data.slug);
+        const conn = bindCollab(ws, ws.data.slug, ws.data.realm ?? 'main');
         await room.connect(conn);
         return;
       }