@1agh/maude 0.49.2 → 0.51.0

package/apps/studio/test/cloud-endpoints.test.ts

@@ -0,0 +1,130 @@
+// The dev-server's Maude Cloud lane — Cloud Phase 23 C3 + the maude:// code
+// attach (Phase 17). The control plane AND the cell are stubbed on one local
+// server; the assertions are about custody and trust posture, not transport:
+// the code is exchanged only against the CONFIGURED cloud address, the hub
+// token lands in the credential store, and linkedHub is written token-free.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { parseDeepLink, shareViewUrl } from '../client/panels/CloudBar.jsx';
+
+let stub: ReturnType<typeof Bun.serve> | null = null;
+let scratch = '';
+const seen: string[] = [];
+
+beforeAll(() => {
+  scratch = mkdtempSync(join(tmpdir(), 'maude-cloud-test-'));
+  stub = Bun.serve({
+    port: 0,
+    hostname: '127.0.0.1',
+    fetch: async (req) => {
+      const url = new URL(req.url);
+      seen.push(`${req.method} ${url.pathname}`);
+      const json = (b: unknown, status = 200) =>
+        new Response(JSON.stringify(b), { status, headers: { 'content-type': 'application/json' } });
+      if (url.pathname === '/auth/handoff/exchange') {
+        const body: any = await req.json();
+        if (body.code === 'mhc_' + 'a'.repeat(64)) {
+          return json({
+            token: 'x.y',
+            role: 'owner',
+            project: 'stub-project',
+            // The "cell" is this same stub server.
+            url: `http://127.0.0.1:${stub!.port}`,
+            expiresAt: Date.now() + 3600_000,
+          });
+        }
+        return json({ error: 'that code is not valid or has expired' }, 400);
+      }
+      if (url.pathname === '/auth/login') {
+        const body: any = await req.json();
+        return body?.token === 'x.y'
+          ? json({ token: 'mau_stub_hub_token', user: { email: 'e@example.com', role: 'owner' } })
+          : json({ error: 'no' }, 401);
+      }
+      return json({ error: 'not stubbed' }, 404);
+    },
+  });
+  process.env.MAUDE_CLOUD_URL = `http://127.0.0.1:${stub.port}`;
+  process.env.MAUDE_CLOUD_CONFIG = join(scratch, 'cloud.json');
+  process.env.HUBS_CONFIG_PATH = join(scratch, 'hubs.json');
+});
+
+afterAll(() => {
+  stub?.stop(true);
+  rmSync(scratch, { recursive: true, force: true });
+  delete process.env.MAUDE_CLOUD_URL;
+  delete process.env.MAUDE_CLOUD_CONFIG;
+  delete process.env.HUBS_CONFIG_PATH;
+});
+
+describe('parseDeepLink — untrusted input, strict shape', () => {
+  test('accepts exactly the minted shape', () => {
+    const p = parseDeepLink(`maude://open/alligators?code=mhc_${'a'.repeat(64)}&origin=https://cloud.maude.sh`);
+    expect(p).toEqual({ project: 'alligators', code: `mhc_${'a'.repeat(64)}` });
+  });
+  test('refuses everything else', () => {
+    for (const bad of [
+      'maude://open/alligators', // no code
+      'maude://open/Alligators?code=mhc_' + 'a'.repeat(64), // bad slug
+      'maude://open/x?code=nothex', // bad code
+      'https://evil.example/?code=mhc_' + 'a'.repeat(64), // not maude://
+      'maude://join/x/y', // join is not the open shape
+    ]) {
+      expect(parseDeepLink(bad)).toBeNull();
+    }
+  });
+});
+
+describe('shareViewUrl — the viewer’s browser home', () => {
+  test('derives view-<host> from the project url', () => {
+    expect(shareViewUrl('https://alligators.cloud.maude.sh', 'alligators')).toBe(
+      'https://view-alligators.cloud.maude.sh'
+    );
+  });
+  test('falls back to the platform zone on garbage', () => {
+    expect(shareViewUrl('nonsense', 'p1')).toBe('https://view-p1.cloud.maude.sh');
+  });
+});
+
+describe('attachCode — the maude:// lane end to end (stubbed)', () => {
+  test('a valid code links: hub credential stored, linkedHub written token-free', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const designRoot = join(scratch, '.design');
+    const { mkdirSync } = await import('node:fs');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(join(designRoot, 'config.json'), '{}\n');
+
+    const apiEndpoints = createCloudEndpoints({ paths: { repoRoot: scratch, designRoot } });
+    const r = await apiEndpoints.attachCode(`mhc_${'a'.repeat(64)}`);
+    expect(r.status).toBe(200);
+    expect((r.json as any).ok).toBe(true);
+    expect((r.json as any).project).toBe('stub-project');
+
+    const cfg = JSON.parse(readFileSync(join(designRoot, 'config.json'), 'utf8'));
+    expect(cfg.linkedHub?.url).toContain('127.0.0.1');
+    expect(JSON.stringify(cfg)).not.toContain('mau_stub_hub_token');
+
+    // The exchange went to the CONFIGURED cloud address (this stub) — the
+    // only /auth/handoff/exchange call seen is ours.
+    expect(seen.filter((s) => s.includes('/auth/handoff/exchange')).length).toBe(1);
+  });
+
+  test('a malformed or dead code never reaches the network', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const apiEndpoints = createCloudEndpoints({
+      paths: { repoRoot: scratch, designRoot: join(scratch, '.design') },
+    });
+    const before = seen.length;
+    const r = await apiEndpoints.attachCode('not-a-code');
+    expect(r.status).toBe(400);
+    expect(seen.length).toBe(before);
+
+    const dead = await apiEndpoints.attachCode(`mhc_${'b'.repeat(64)}`);
+    expect(dead.status).toBe(410);
+    expect((dead.json as any).error).toMatch(/works once/);
+  });
+});

package/apps/studio/test/debug-bundle.test.ts

@@ -0,0 +1,105 @@
+// debug-bundle scrubber + ring — feature-bug-report-button.
+//
+// The scrubber is a PRIVACY GATE, not tidiness: docs/report-schema.md promises
+// every log line is deterministically cleaned server-side before it can enter
+// a report. Extend these tests FIRST when extending the scrubber.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  buildDebugBundle,
+  installLogRing,
+  logRingLines,
+  recordLogLine,
+  scrub,
+} from '../debug-bundle.ts';
+
+describe('scrub()', () => {
+  test('repo-absolute paths collapse to <project>/ BEFORE home collapses to ~', () => {
+    const out = scrub('error at /Users/jane/git/acme/src/app.ts and /Users/jane/notes.txt', {
+      home: '/Users/jane',
+      repoRoot: '/Users/jane/git/acme',
+    });
+    expect(out).toBe('error at <project>/src/app.ts and ~/notes.txt');
+  });
+
+  test('GitHub tokens (classic + fine-grained) are redacted', () => {
+    const out = scrub('using ghp_AbC123xyzAbC123xyz and github_pat_11ABCDEF0abcdef', {
+      home: '/h',
+    });
+    expect(out).not.toContain('ghp_');
+    expect(out).not.toContain('github_pat_');
+    expect(out).toContain('[redacted]');
+  });
+
+  test('bearer headers, sk- keys and JWTs are redacted', () => {
+    const out = scrub(
+      'sent Bearer abc.def.ghi then sk-ant-api03-longsecretvalue then eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig-part',
+      { home: '/h' }
+    );
+    expect(out).toContain('Bearer [redacted]');
+    expect(out).not.toContain('sk-ant-api03');
+    expect(out).not.toContain('eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0');
+    // An `Authorization:` header form over-redacts (key rule wins) — that is
+    // acceptable: privacy failures here are leaks, never extra redaction.
+    const hdr = scrub('Authorization: Bearer abc.def.ghi', { home: '/h' });
+    expect(hdr).not.toContain('abc.def.ghi');
+  });
+
+  test('secret-shaped key=value keeps the key, redacts the value', () => {
+    const out = scrub('token=abc123secret api_key: "xyz789" password=hunter2', { home: '/h' });
+    expect(out).toContain('token=[redacted]');
+    expect(out).toContain('password=[redacted]');
+    expect(out).not.toContain('abc123secret');
+    expect(out).not.toContain('hunter2');
+  });
+
+  test('emails are redacted', () => {
+    expect(scrub('reported by jane.doe+test@example.co.uk', { home: '/h' })).toBe(
+      'reported by [email]'
+    );
+  });
+
+  test('clean text passes through untouched', () => {
+    const line = '[log] canvas ui/Dashboard.tsx rebuilt in 43ms';
+    expect(scrub(line, { home: '/h', repoRoot: '/r' })).toBe(line);
+  });
+});
+
+describe('log ring', () => {
+  test('caps at 500 lines, keeps the newest, tail selects the last N', () => {
+    for (let i = 0; i < 620; i++) recordLogLine(`line ${i}`);
+    const all = logRingLines(500);
+    expect(all.length).toBe(500);
+    expect(all[0]).toBe('line 120');
+    expect(all[all.length - 1]).toBe('line 619');
+    expect(logRingLines(3)).toEqual(['line 617', 'line 618', 'line 619']);
+  });
+
+  test('console tap mirrors into the ring and is idempotent', () => {
+    installLogRing();
+    installLogRing(); // second call must not double-wrap (no duplicate lines)
+    console.log('tap-check', { a: 1 });
+    const tail = logRingLines(5);
+    expect(tail.filter((l) => l.includes('tap-check')).length).toBe(1);
+    expect(tail.some((l) => l.includes('[log] tap-check {"a":1}'))).toBe(true);
+  });
+});
+
+describe('buildDebugBundle()', () => {
+  test('assembles scrubbed fields; canvas path scrubbed; no content leaks', () => {
+    recordLogLine('boot at /Users/jane/git/acme with token=verysecret');
+    const bundle = buildDebugBundle({
+      maudeVersion: '9.9.9',
+      projectName: 'acme',
+      activeCanvas: 'ui/Dashboard.tsx',
+      repoRoot: '/Users/jane/git/acme',
+    });
+    expect(bundle.app.maudeVersion).toBe('9.9.9');
+    expect(bundle.app.platform).toBe(process.platform);
+    expect(bundle.context.activeCanvas).toBe('ui/Dashboard.tsx');
+    expect(bundle.logs.serverLogTail).toContain('<project>');
+    expect(bundle.logs.serverLogTail).not.toContain('verysecret');
+    expect(bundle.logs.serverLogTail).not.toContain('/Users/jane/git/acme');
+  });
+});

package/apps/studio/test/fs-mkdir-api.test.ts

@@ -0,0 +1,248 @@
+// /_api/fs-mkdir — feature-file-tree-drag-drop-folders (Task 4). Folder-name
+// validation, containment, `.gitkeep`, collision.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdirSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { validateFolderName } from '../canvas-create.ts';
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+describe('validateFolderName', () => {
+  test('accepts ordinary names (incl. spaces + accents)', () => {
+    for (const n of ['Marketing', 'checkout-flow', 'Krok_1', 'Přihlášení']) {
+      const v = validateFolderName(n);
+      expect(v.ok).toBe(true);
+      expect(v.name).toBe(n);
+    }
+  });
+
+  const REJECT: Array<[string, unknown]> = [
+    ['empty', ''],
+    ['non-string', 123],
+    ['parent traversal', '../evil'],
+    ['forward slash', 'a/b'],
+    ['back slash', 'a\\b'],
+    ['leading dot', '.hidden'],
+    ['JSX break-out chars', 'a<b>'],
+    ['double quote', 'a"b'],
+    ['too long (61)', 'x'.repeat(61)],
+  ];
+  for (const [label, value] of REJECT) {
+    test(`rejects ${label}`, () => {
+      expect(validateFolderName(value).ok).toBe(false);
+    });
+  }
+});
+
+function mkdirReq(port: number, parent: string | undefined, name: string) {
+  return fetch(`http://localhost:${port}/_api/fs-mkdir`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ parent, name }),
+  });
+}
+
+describe('/_api/fs-mkdir — POST round-trip', () => {
+  test('creates an empty folder with a .gitkeep', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await mkdirReq(port, 'ui', 'New Folder');
+      expect(r.status).toBe(201);
+      const j = (await r.json()) as { ok: boolean; dir: string };
+      expect(j.ok).toBe(true);
+      expect(j.dir).toBe('.design/ui/New Folder');
+      expect(existsSync(join(designRoot, 'ui', 'New Folder'))).toBe(true);
+      expect(existsSync(join(designRoot, 'ui', 'New Folder', '.gitkeep'))).toBe(true);
+      expect(readFileSync(join(designRoot, 'ui', 'New Folder', '.gitkeep'), 'utf8')).toBe('');
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('defaults parent to the design root when omitted', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      // "ui" IS a managed canvas group, so a folder directly under it works;
+      // an omitted parent (designRoot itself) is NOT inside any canvas group
+      // and must be refused — mirrors moveCanvas's group-membership rule.
+      const r = await mkdirReq(port, undefined, 'Root Folder');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('supports nested parents', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      await mkdirReq(port, 'ui', 'Parent');
+      const r = await mkdirReq(port, 'ui/Parent', 'Child');
+      expect(r.status).toBe(201);
+      expect(existsSync(join(designRoot, 'ui', 'Parent', 'Child', '.gitkeep'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses a parent that escapes the design root (400)', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await mkdirReq(port, '../../../../tmp', 'Escape');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('refuses a parent inside the design-system group (400)', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'system'), { recursive: true });
+      const r = await mkdirReq(port, 'system', 'NotAllowed');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('rejects an invalid name (400)', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await mkdirReq(port, 'ui', '../evil');
+      expect(r.status).toBe(400);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a collision with an existing folder returns 409', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui', 'Already'), { recursive: true });
+      const r = await mkdirReq(port, 'ui', 'Already');
+      expect(r.status).toBe(409);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('a collision with an existing FILE (not just a dir) also returns 409', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      mkdirSync(join(designRoot, 'ui'), { recursive: true });
+      // NAME_RE forbids '.', so an extension-less file is the only way a
+      // FILE can collide with a valid folder name — statp() must catch it
+      // the same as a directory collision above.
+      writeFileSync(join(designRoot, 'ui', 'Taken'), 'not a folder');
+      const r = await mkdirReq(port, 'ui', 'Taken');
+      expect(r.status).toBe(409);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('emits a canvas-list-update "mkdir" action over the inspector WS', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    let socket: WebSocket | null = null;
+    try {
+      const messages: Array<{ type: string; payload?: Record<string, unknown> }> = [];
+      const sock = new WebSocket(`ws://localhost:${port}/_ws`);
+      socket = sock;
+      await new Promise<void>((res, rej) => {
+        sock.addEventListener('open', () => res());
+        sock.addEventListener('error', () => rej(new Error('ws error')));
+        setTimeout(() => rej(new Error('ws open timeout')), 2000);
+      });
+      sock.addEventListener('message', (ev) => {
+        try {
+          messages.push(JSON.parse(String(ev.data)));
+        } catch {
+          /* ignore */
+        }
+      });
+      const r = await mkdirReq(port, 'ui', 'Live Folder');
+      expect(r.status).toBe(201);
+
+      const deadline = Date.now() + 2000;
+      let hit: (typeof messages)[number] | undefined;
+      while (Date.now() < deadline && !hit) {
+        hit = messages.find(
+          (m) => m.type === 'canvas-list-update' && m.payload?.action === 'mkdir'
+        );
+        if (!hit) await Bun.sleep(25);
+      }
+      expect(hit?.payload?.dir).toBe('.design/ui/Live Folder');
+    } finally {
+      try {
+        socket?.close();
+      } catch {
+        /* ignore */
+      }
+      await killProc(proc);
+    }
+  }, 10_000);
+
+  test('unknown method (GET) returns 405', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await fetch(`http://localhost:${port}/_api/fs-mkdir`, { method: 'GET' });
+      expect(r.status).toBe(405);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  test('rejects a cross-origin mkdir (CSRF guard)', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const r = await fetch(`http://localhost:${port}/_api/fs-mkdir`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', Origin: 'http://evil.example' },
+        body: JSON.stringify({ parent: 'ui', name: 'Forged' }),
+      });
+      expect(r.status).toBe(403);
+    } finally {
+      await killProc(proc);
+    }
+  });
+
+  // Security review finding — see the matching test in canvas-move-api.test.ts.
+  test('refuses creating a folder under a symlinked parent', async () => {
+    const { root, designRoot } = makeSandbox();
+    const outside = join(root, 'OUTSIDE');
+    mkdirSync(outside, { recursive: true });
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      symlinkSync(outside, join(designRoot, 'ui', 'link'));
+      const r = await mkdirReq(port, 'ui/link', 'Nested');
+      expect(r.status).toBe(400);
+      expect(existsSync(join(outside, 'Nested'))).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  });
+});

package/apps/studio/test/workspace-signin.test.ts

@@ -164,6 +164,25 @@ describe('failure modes are distinguishable and actionable', () => {
     expect((res.json as { error: string }).error).toMatch(/wait a minute/i);
   });
 
+  test("a cloud workspace's 400 message reaches the person verbatim (Phase 23 B3)", async () => {
+    // The hub's cloud-identity refusal comes WITH directions ("sign in through
+    // Maude Cloud" / what viewing needs). Swallowing it into "try again
+    // shortly" turned the most actionable message on this path into a shrug.
+    const { impl } = scriptedFetch({
+      '/health': HEALTHY,
+      '/auth/login': () =>
+        json(
+          { error: 'This workspace signs in through Maude Cloud — use Sign in to Maude Cloud in the app.' },
+          400
+        ),
+    });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    expect(res.status).toBe(400);
+    expect((res.json as { reason: string }).reason).toBe('cloud-identity');
+    expect((res.json as { error: string }).error).toMatch(/signs in through Maude Cloud/);
+    expect((res.json as { error: string }).error).not.toMatch(/try again shortly/i);
+  });
+
   test('a failed save is reported instead of pretending success', async () => {
     const { impl } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
     const res = await signInToWorkspace(CREDS, {

package/apps/studio/whats-new.json

@@ -1,6 +1,33 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "maude-deeplink-open-in-app",
+      "version": "0.51.0",
+      "date": "2026-07-30",
+      "kind": "feature",
+      "title": "Open a cloud project straight from the browser",
+      "summary": "Press “Open in Maude” on your project’s page and the app opens it signed in — a one-time link, nothing to copy. The app always asks before connecting, and viewers get a working “View in the browser” door instead of a dead button.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "maude-cloud-signin-attach",
+      "version": "0.50.0",
+      "date": "2026-07-30",
+      "kind": "feature",
+      "title": "Sign in to Maude Cloud from the studio",
+      "summary": "The sidebar footer now signs you into Maude Cloud with a short code — no pasted addresses or keys — and connects this project to your cloud workspace in one click.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "file-tree-move-and-folders",
+      "version": "0.50.0",
+      "date": "2026-07-30",
+      "kind": "feature",
+      "title": "Organize your files — folders, drag & drop, move",
+      "summary": "The file tree is a real file explorer now. Create folders from the header or right-click a canvas or folder for Move to… / New folder here / Delete folder — or just drag a canvas (or a whole folder) onto another folder, including back out to the top level. Every history, comment, annotation, and camera position moves with it, and every move shows an Undo toast.",
+      "surface": "design-ui"
+    },
     {
       "id": "figma-smart-select",
       "version": "0.47.0",

package/cli/bin/maude.mjs

@@ -21,6 +21,7 @@ const COMMANDS = {
   kg: () => import('../commands/kg.mjs'),
   help: () => import('../commands/help.mjs'),
   hub: () => import('../commands/hub.mjs'),
+  share: () => import('../commands/share.mjs'),
   version: () => import('../commands/version.mjs'),
 };