@1agh/maude 0.49.2 → 0.51.0

package/apps/studio/client/use-tree-drag.js

@@ -0,0 +1,120 @@
+// use-tree-drag.js — feature-file-tree-drag-drop-folders (Task 8).
+//
+// Drag source/target bookkeeping for the file tree's HTML5 drag & drop layer:
+// which canvas row is being dragged, which folder row is currently hovered
+// (for the highlight + spring-load-open), and a small timer for the
+// spring-load itself. Kept out of Tree/DirRow/CanvasRow so those components
+// stay about rendering, not drag bookkeeping.
+//
+// Payload MIME is a custom `application/x-maude-canvas` (not `text/plain` or
+// `Files`) so an OS file drag can't be mistaken for a tree-row drag, and the
+// existing canvas-side media-drop path (use-canvas-media-drop.tsx) — which
+// only reacts to real `DataTransfer.files` — stays unaffected.
+
+import { useCallback, useMemo, useRef, useState } from 'react';
+
+export const TREE_DRAG_MIME = 'application/x-maude-canvas';
+const SPRING_LOAD_MS = 600;
+
+/**
+ * `onMove(fromPath, toDir)` — async, called on a valid drop. The caller owns
+ * the actual fetch + tree refresh; this hook only tracks UI state and decides
+ * when a drop is valid.
+ */
+export function useTreeDrag(onMove) {
+  const [draggedPath, setDraggedPath] = useState(null);
+  const [overDir, setOverDir] = useState(null);
+  const [busyPath, setBusyPath] = useState(null);
+  const springTimer = useRef(null);
+
+  const clearSpring = useCallback(() => {
+    if (springTimer.current) {
+      clearTimeout(springTimer.current);
+      springTimer.current = null;
+    }
+  }, []);
+
+  const dragProps = useMemo(
+    () => (path, draggable) => {
+      if (!draggable) return {};
+      return {
+        draggable: true,
+        onDragStart: (e) => {
+          e.dataTransfer.effectAllowed = 'move';
+          e.dataTransfer.setData(TREE_DRAG_MIME, path);
+          // A lightweight ghost — the browser default drag image for a
+          // <button> row is poor (grabs the whole row incl. badges).
+          const ghost = document.createElement('div');
+          ghost.textContent = path.split('/').pop();
+          ghost.style.cssText =
+            'position:fixed;top:-1000px;left:-1000px;padding:4px 10px;' +
+            'background:var(--bg-2);color:var(--fg-1);border-radius:6px;' +
+            'font:12px system-ui;pointer-events:none;';
+          document.body.appendChild(ghost);
+          e.dataTransfer.setDragImage(ghost, 8, 8);
+          setTimeout(() => ghost.remove(), 0);
+          setDraggedPath(path);
+        },
+        onDragEnd: () => {
+          setDraggedPath(null);
+          setOverDir(null);
+          clearSpring();
+        },
+      };
+    },
+    [clearSpring]
+  );
+
+  /** `dirPath` is the drop target's full path; `openIfClosed` spring-loads it
+   *  open after hovering. `valid` gates whether this target accepts drops at
+   *  all (e.g. false for the design-system group). */
+  const dropProps = useMemo(
+    () => (dirPath, valid, openIfClosed) => {
+      if (!valid) return {};
+      return {
+        onDragOver: (e) => {
+          if (!e.dataTransfer.types.includes(TREE_DRAG_MIME)) return;
+          // Only preventDefault on a valid target — the cursor itself then
+          // communicates validity (no-drop glyph elsewhere).
+          e.preventDefault();
+          e.dataTransfer.dropEffect = 'move';
+          if (overDir !== dirPath) {
+            setOverDir(dirPath);
+            clearSpring();
+            if (openIfClosed) {
+              springTimer.current = setTimeout(() => {
+                openIfClosed();
+                springTimer.current = null;
+              }, SPRING_LOAD_MS);
+            }
+          }
+        },
+        onDragLeave: (e) => {
+          // Ignore bubbled leave events from child elements re-entering.
+          if (e.currentTarget.contains(e.relatedTarget)) return;
+          if (overDir === dirPath) setOverDir(null);
+          clearSpring();
+        },
+        onDrop: async (e) => {
+          e.preventDefault();
+          clearSpring();
+          setOverDir(null);
+          const fromPath = e.dataTransfer.getData(TREE_DRAG_MIME);
+          setDraggedPath(null);
+          if (!fromPath || fromPath === dirPath) return;
+          setBusyPath(fromPath);
+          try {
+            await onMove(fromPath, dirPath);
+          } finally {
+            setBusyPath(null);
+          }
+        },
+      };
+    },
+    [overDir, clearSpring, onMove]
+  );
+
+  // `move` — the raw callback, for the Task 9 keyboard path ("Move to…"),
+  // which doesn't go through a drop event at all.
+  return { draggedPath, overDir, busyPath, dragProps, dropProps, move: onMove };
+}

package/apps/studio/cloud/endpoints.ts

@@ -0,0 +1,284 @@
+// Maude Cloud from inside the studio — Cloud Phase 23 C3, the dev-server half.
+//
+// The desktop app (and a plain `maude design serve` in a browser) signs into
+// Maude Cloud WITHOUT any Rust and without CORS on the platform: every call to
+// cloud.maude.sh happens HERE, server-side, and the client only talks to the
+// loopback `/_api/cloud/*` routes. The personal token lives next to the hub
+// credentials the link flow already trusts (`~/.config/maude/`), mode 0600,
+// never in the repo and never in the browser.
+//
+// The lane, end to end (every hop verified live against production):
+//   sign-in   POST /auth/device/code → human approves on /activate → poll
+//   projects  GET /api/projects (Bearer personal token)
+//   attach    POST /projects/open → project token → the CELL exchanges it at
+//             POST /auth/login {token} (a POST body, never a URL) → a hub
+//             user token → saveHubCredential() + linkedHub in config.json —
+//             the exact state `maude design link` would have written by hand.
+
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+
+import { saveHubCredential } from '../sync/hub-link.ts';
+import { normalizeUrl } from '../sync/hubs-config.ts';
+
+const CLOUD_URL = (process.env.MAUDE_CLOUD_URL ?? 'https://cloud.maude.sh').replace(/\/+$/, '');
+
+export interface CloudEndpointResult {
+  status: number;
+  json: unknown;
+}
+
+interface CloudFile {
+  url: string;
+  token: string;
+  email?: string;
+  connectedAt: number;
+}
+
+function cloudConfigPath(): string {
+  return process.env.MAUDE_CLOUD_CONFIG ?? join(homedir(), '.config', 'maude', 'cloud.json');
+}
+
+function readCloudFile(): CloudFile | null {
+  const p = cloudConfigPath();
+  if (!existsSync(p)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(p, 'utf8'));
+    if (parsed && typeof parsed.token === 'string') return parsed as CloudFile;
+  } catch {
+    /* malformed → treat as signed out */
+  }
+  return null;
+}
+
+function writeCloudFile(file: CloudFile): void {
+  const p = cloudConfigPath();
+  const dir = dirname(p);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  writeFileSync(p, `${JSON.stringify(file, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+  try {
+    chmodSync(p, 0o600);
+  } catch {
+    /* windows / read-only fs — best effort */
+  }
+}
+
+async function cloudFetch(
+  path: string,
+  init: RequestInit = {},
+  { timeoutMs = 15_000 } = {}
+): Promise<{ status: number; body: any }> {
+  const ctl = new AbortController();
+  const timer = setTimeout(() => ctl.abort(), timeoutMs);
+  try {
+    const res = await fetch(`${CLOUD_URL}${path}`, { ...init, signal: ctl.signal });
+    return { status: res.status, body: await res.json().catch(() => ({})) };
+  } catch (err) {
+    return { status: 0, body: { error: (err as Error).message } };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+interface Ctx {
+  paths: { repoRoot: string; designRoot: string };
+}
+
+export function createCloudEndpoints(ctx: Ctx) {
+  return {
+    /** Signed in? Who? Cheap — reads the file, never the network. */
+    status(): CloudEndpointResult {
+      const file = readCloudFile();
+      return {
+        status: 200,
+        json: file
+          ? { connected: true, email: file.email ?? null, url: file.url }
+          : { connected: false, url: CLOUD_URL },
+      };
+    },
+
+    /** Start the device flow: hand the client the human-facing half. */
+    async signinStart(): Promise<CloudEndpointResult> {
+      const r = await cloudFetch('/auth/device/code', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ client: `Maude Studio on ${process.platform}` }),
+      });
+      if (r.status !== 200) {
+        return { status: 502, json: { ok: false, error: 'Maude Cloud could not be reached. Try again in a moment.' } };
+      }
+      return {
+        status: 200,
+        json: {
+          ok: true,
+          userCode: r.body.user_code,
+          verificationUrl: r.body.verification_url,
+          deviceCode: r.body.device_code,
+          interval: r.body.interval ?? 5,
+        },
+      };
+    },
+
+    /** One poll tick. On success the credential is stored server-side. */
+    async signinPoll(deviceCode: string): Promise<CloudEndpointResult> {
+      if (!deviceCode) return { status: 400, json: { ok: false, error: 'missing device code' } };
+      const r = await cloudFetch('/auth/device/token', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ device_code: deviceCode }),
+      });
+      if (r.status === 202) return { status: 200, json: { ok: true, pending: true } };
+      if (r.status !== 200 || !r.body?.token) {
+        return { status: 410, json: { ok: false, error: 'The code expired. Start the sign-in again.' } };
+      }
+      writeCloudFile({
+        url: CLOUD_URL,
+        token: r.body.token,
+        email: r.body.account?.email ?? undefined,
+        connectedAt: Date.now(),
+      });
+      return { status: 200, json: { ok: true, pending: false, email: r.body.account?.email ?? null } };
+    },
+
+    /** Forget the local credential. (Revocation lives on /account.) */
+    signout(): CloudEndpointResult {
+      try {
+        unlinkSync(cloudConfigPath());
+      } catch {
+        /* already gone */
+      }
+      return { status: 200, json: { ok: true } };
+    },
+
+    /** The signed-in account's projects, states included. */
+    async projects(): Promise<CloudEndpointResult> {
+      const file = readCloudFile();
+      if (!file) return { status: 401, json: { ok: false, error: 'Sign in to Maude Cloud first.' } };
+      const r = await cloudFetch('/api/projects', {
+        headers: { authorization: `Bearer ${file.token}` },
+      });
+      if (r.status === 401) {
+        // Revoked from the dashboard — honor it locally too.
+        this.signout();
+        return { status: 401, json: { ok: false, error: 'This device was disconnected. Sign in again.' } };
+      }
+      if (r.status !== 200) {
+        return { status: 502, json: { ok: false, error: 'Maude Cloud could not be reached.' } };
+      }
+      return { status: 200, json: { ok: true, projects: r.body.projects ?? [] } };
+    },
+
+    /**
+     * Attach THIS project to a cloud workspace: open → exchange at the cell →
+     * store the hub credential + linkedHub, exactly as `maude design link`
+     * would. The sync agent picks the link up on the next server start.
+     */
+    async attach(projectId: string): Promise<CloudEndpointResult> {
+      const file = readCloudFile();
+      if (!file) return { status: 401, json: { ok: false, error: 'Sign in to Maude Cloud first.' } };
+      if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(String(projectId ?? ''))) {
+        return { status: 400, json: { ok: false, error: 'unknown project' } };
+      }
+
+      const opened = await cloudFetch('/projects/open', {
+        method: 'POST',
+        headers: { authorization: `Bearer ${file.token}`, 'content-type': 'application/json' },
+        body: JSON.stringify({ project: projectId }),
+      });
+      if (opened.status !== 200 || !opened.body?.token) {
+        return { status: 502, json: { ok: false, error: 'The project could not be opened with this account.' } };
+      }
+      return linkToWorkspace({ workspaceUrl: opened.body.url, projectToken: opened.body.token, role: opened.body.role });
+    },
+
+    /**
+     * Attach via a one-time handoff code — the maude:// lane (Phase 17). The
+     * code came from an untrusted URL, so it is exchanged ONLY against the
+     * configured Maude Cloud address (never one the link names), and the
+     * workspace we then link is the one THAT exchange returns. Needs no
+     * personal token: the code itself proves the dashboard session.
+     */
+    async attachCode(code: string): Promise<CloudEndpointResult> {
+      if (typeof code !== 'string' || !/^mhc_[0-9a-f]{16,128}$/.test(code)) {
+        return { status: 400, json: { ok: false, error: 'That link is not valid.' } };
+      }
+      const exchanged = await cloudFetch('/auth/handoff/exchange', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ code }),
+      });
+      if (exchanged.status !== 200 || !exchanged.body?.token) {
+        return {
+          status: 410,
+          json: {
+            ok: false,
+            error:
+              'That link expired — it works once, for two minutes. Press “Open in Maude” on the project page again.',
+          },
+        };
+      }
+      return linkToWorkspace({
+        workspaceUrl: exchanged.body.url,
+        projectToken: exchanged.body.token,
+        role: exchanged.body.role,
+        project: exchanged.body.project,
+      });
+    },
+  };
+
+  /** The shared tail of every attach: cell exchange → credential + linkedHub. */
+  async function linkToWorkspace({
+    workspaceUrl,
+    projectToken,
+    role,
+    project,
+  }: {
+    workspaceUrl: string;
+    projectToken: string;
+    role?: string;
+    project?: string;
+  }): Promise<CloudEndpointResult> {
+    // The cell is a different host than the control plane — one direct call.
+    let hubToken: string | null = null;
+    try {
+      const res = await fetch(`${workspaceUrl}/auth/login`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ token: projectToken }),
+      });
+      const body: any = await res.json().catch(() => ({}));
+      if (res.ok && body?.token) hubToken = body.token;
+    } catch {
+      /* handled below */
+    }
+    if (!hubToken) {
+      return { status: 502, json: { ok: false, error: 'The workspace did not accept the sign-in. Try again in a minute.' } };
+    }
+
+    const norm = normalizeUrl(workspaceUrl);
+    saveHubCredential(norm, hubToken);
+
+    // Project side — linkedHub in .design/config.json (committed; no token).
+    const cfgPath = join(ctx.paths.designRoot, 'config.json');
+    let cfg: any = {};
+    try {
+      cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
+    } catch {
+      /* absent/malformed → start minimal */
+    }
+    cfg.linkedHub = { url: norm, linkedAt: Date.now() };
+    writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}\n`, 'utf8');
+
+    return {
+      status: 200,
+      json: {
+        ok: true,
+        url: norm,
+        role: role ?? null,
+        project: project ?? null,
+        note: 'Linked. Restart the studio server to start syncing.',
+      },
+    };
+  }
+}

package/apps/studio/collab/registry.ts

@@ -98,6 +98,16 @@ export interface Registry {
   destroyAll(): Promise<void>;
   /** Tear down a single room when its last peer leaves. */
   drop(slug: string): Promise<void>;
+  /**
+   * feature-file-tree-drag-drop-folders (Task 3) — flush + tear down a room
+   * for a canvas move, REGARDLESS of live connections (unlike `drop`, which
+   * leaves an active room alone). The move already refused when
+   * `isPinned(slug)` is true (a hub provider owns the doc); this is a plain
+   * best-effort teardown so the rename doesn't leave a room keyed to a slug
+   * that no longer resolves to a file. A peer connected mid-move reconnects
+   * under the new slug via `get()`. No-op if no room is live for the slug.
+   */
+  forceDrop(slug: string): Promise<void>;
   /** Test/introspection. */
   size(): number;
 }
@@ -225,6 +235,18 @@ export function createRegistry(callbacks: RoomCallbacks): Registry {
     await room.destroy();
   }
 
+  async function forceDrop(slug: string): Promise<void> {
+    const room = rooms.get(slug);
+    if (!room) return;
+    // Safety net — the caller (moveCanvas) already refuses the move when
+    // pinned, but never yank a doc out from under an attached hub provider.
+    if (pinned.has(slug)) return;
+    await room.flush();
+    teardownBridge(slug);
+    rooms.delete(slug);
+    await room.destroy();
+  }
+
   async function destroyAll(): Promise<void> {
     for (const slug of Array.from(bridges.keys())) teardownBridge(slug);
     hubAwareness.clear();
@@ -247,6 +269,7 @@ export function createRegistry(callbacks: RoomCallbacks): Registry {
     flushAll,
     destroyAll,
     drop,
+    forceDrop,
     size: () => rooms.size,
   };
 }

package/apps/studio/debug-bundle.ts

@@ -0,0 +1,144 @@
+// debug-bundle.ts — scrubbed diagnostic bundle for the Report-a-Bug dialog
+// (feature-bug-report-button). Three pieces:
+//
+//   1. a 500-line in-memory log ring fed by a console tap (installLogRing) —
+//      the dev-server has no persistent log of its own, so the ring is what
+//      gives a report something to attach;
+//   2. scrub() — the DETERMINISTIC redaction pass every log line goes through
+//      before it can leave the process. Privacy invariant (docs/report-schema.md):
+//      the scrubber runs server-side, has red/green tests, and is extended
+//      test-first — never "best-effort";
+//   3. buildDebugBundle() — assembles the `maude-report/v1` server-side fields.
+//
+// The consuming route (`GET /_api/debug-bundle`, http.ts) is PRIVILEGED:
+// main-origin only, absent from CANVAS_SAFE_API + startCanvasServer's routes
+// (dual-allowlist rule, DDR-088) — a hub-pushed canvas must never read logs.
+
+import { homedir } from 'node:os';
+
+const RING_MAX = 500;
+const ring: string[] = [];
+let tapInstalled = false;
+
+/** Append one line to the ring (public for tests + non-console callers). */
+export function recordLogLine(line: string): void {
+  ring.push(line);
+  if (ring.length > RING_MAX) ring.splice(0, ring.length - RING_MAX);
+}
+
+/** Last `n` raw (UNSCRUBBED — caller must scrub) ring lines, oldest first. */
+export function logRingLines(n = 200): string[] {
+  return ring.slice(-n);
+}
+
+function fmt(args: unknown[]): string {
+  return args
+    .map((a) => {
+      if (typeof a === 'string') return a;
+      if (a instanceof Error) return a.stack ?? a.message;
+      try {
+        return JSON.stringify(a);
+      } catch {
+        return String(a);
+      }
+    })
+    .join(' ');
+}
+
+/**
+ * Mirror console.log/warn/error into the ring. Original behavior preserved
+ * (stdout/stderr still get every line). Idempotent — safe to call from both
+ * the server boot and tests.
+ */
+export function installLogRing(): void {
+  if (tapInstalled) return;
+  tapInstalled = true;
+  for (const level of ['log', 'warn', 'error'] as const) {
+    const original = console[level].bind(console);
+    console[level] = (...args: unknown[]) => {
+      recordLogLine(`[${level}] ${fmt(args)}`);
+      original(...args);
+    };
+  }
+}
+
+export interface ScrubOptions {
+  /** Absolute repo root → rewritten to `<project>/`. */
+  repoRoot?: string;
+  /** Home dir → rewritten to `~`. Defaults to os.homedir(). */
+  home?: string;
+}
+
+/**
+ * Deterministic redaction. Order matters: repoRoot first (it usually lives
+ * under home — scrubbing home first would leave `~/git/repo` variants that
+ * the repoRoot rule no longer matches), then home, then secret material,
+ * then emails.
+ */
+export function scrub(text: string, opts: ScrubOptions = {}): string {
+  let out = text;
+
+  const repoRoot = opts.repoRoot?.replace(/\/+$/, '');
+  if (repoRoot) out = out.replaceAll(repoRoot, '<project>');
+
+  const home = (opts.home ?? homedir()).replace(/\/+$/, '');
+  if (home) out = out.replaceAll(home, '~');
+
+  // Known token shapes first (GitHub classic + fine-grained, Anthropic, JWTs).
+  out = out.replace(/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{8,}\b/g, '[redacted]');
+  out = out.replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]');
+  out = out.replace(
+    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g,
+    '[redacted]'
+  );
+  // Bearer headers, however they were logged.
+  out = out.replace(/\b(Bearer)\s+[^\s"']+/gi, '$1 [redacted]');
+  // key=value / "key": "value" forms for secret-shaped keys — keep the key,
+  // redact the value.
+  out = out.replace(
+    /\b(token|secret|password|passwd|api[_-]?key|authorization|access[_-]?key)("?\s*[:=]\s*"?)[^\s"',}]+/gi,
+    '$1$2[redacted]'
+  );
+
+  out = out.replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, '[email]');
+
+  return out;
+}
+
+export interface DebugBundle {
+  app: { maudeVersion: string; platform: string; arch: string };
+  context: { projectName: string | null; activeCanvas: string | null };
+  logs: { serverLogTail: string };
+}
+
+/**
+ * Assemble the server-side half of a `maude-report/v1` payload. Everything
+ * here is ALREADY scrubbed — the client treats the bundle as display+consent
+ * material and must not need to re-clean it. Canvas CONTENT never enters the
+ * bundle: `activeCanvas` is the relative path only.
+ */
+export function buildDebugBundle(args: {
+  maudeVersion: string;
+  projectName: string | null;
+  activeCanvas: string | null;
+  repoRoot: string;
+  tailLines?: number;
+}): DebugBundle {
+  const scrubOpts: ScrubOptions = { repoRoot: args.repoRoot };
+  return {
+    app: {
+      maudeVersion: args.maudeVersion,
+      platform: process.platform,
+      arch: process.arch,
+    },
+    context: {
+      projectName: args.projectName,
+      activeCanvas: args.activeCanvas ? scrub(args.activeCanvas, scrubOpts) : null,
+    },
+    logs: {
+      serverLogTail: logRingLines(args.tailLines ?? 200)
+        .map((l) => scrub(l, scrubOpts))
+        .join('\n'),
+    },
+  };
+}