@1agh/maude 0.50.0 → 0.51.0

package/apps/studio/client/panels/CloudBar.jsx

@@ -14,12 +14,38 @@
 
 import { useEffect, useRef, useState } from 'react';
 
+import { invoke, isNativeApp, listen } from '../github.js';
+
 const api = async (path, init) => {
   const res = await fetch(path, init);
   const json = await res.json().catch(() => ({}));
   return { ok: res.ok, status: res.status, json };
 };
 
+/**
+ * Parse a maude://open/<project>?code=mhc_… deep link. Untrusted input — a
+ * drive-by page can navigate to maude:// — so nothing here is acted on
+ * without the person pressing Connect, and the code is only ever exchanged
+ * against the app's own configured Maude Cloud address.
+ */
+export function parseDeepLink(url) {
+  const m = /^maude:\/\/open\/([a-z0-9]+(?:-[a-z0-9]+)*)\/?\?(.*)$/.exec(String(url ?? ''));
+  if (!m) return null;
+  const code = new URLSearchParams(m[2]).get('code') ?? '';
+  if (!/^mhc_[0-9a-f]{16,128}$/.test(code)) return null;
+  return { project: m[1], code };
+}
+
+/** The share view's address for a project cell URL (viewer's browser home). */
+export function shareViewUrl(projectUrl, projectId) {
+  try {
+    const u = new URL(projectUrl);
+    return `${u.protocol}//view-${u.host}`;
+  } catch {
+    return `https://view-${projectId}.cloud.maude.sh`;
+  }
+}
+
 function Spark({ size = 15 }) {
   return (
     <svg width={size} height={size} viewBox="0 0 32 32" fill="currentColor" aria-hidden="true">
@@ -76,6 +102,7 @@ export default function CloudBar() {
   const [note, setNote] = useState('');
   const [error, setError] = useState('');
   const [copied, setCopied] = useState(false);
+  const [pending, setPending] = useState(null); // { project, code } from maude://
   const railRef = useRef(null);
   const pollRef = useRef(null);
 
@@ -89,6 +116,43 @@ export default function CloudBar() {
     return () => clearInterval(pollRef.current);
   }, []);
 
+  // maude:// deep links (Phase 17) — native shell only. The link that LAUNCHED
+  // the app is parked in the shell (take once); links while running arrive as
+  // events. Either way: ask, never auto-connect.
+  useEffect(() => {
+    if (!isNativeApp()) return undefined;
+    const consume = (url) => {
+      const parsed = parseDeepLink(url);
+      if (parsed) setPending(parsed);
+    };
+    invoke('take_pending_deep_link')
+      .then((url) => url && consume(url))
+      .catch(() => {});
+    let unlisten = null;
+    listen('maude://deep-link', consume).then((fn) => {
+      unlisten = fn;
+    });
+    return () => unlisten?.();
+  }, []);
+
+  async function connectPending() {
+    if (!pending) return;
+    setBusy('deeplink');
+    setError('');
+    const r = await api('/_api/cloud/attach/code', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ code: pending.code }),
+    });
+    setBusy('');
+    setPending(null);
+    if (r.ok && r.json?.ok) {
+      setNote(`Linked to ${r.json.project ?? pending.project} — restart the studio server to start syncing.`);
+    } else {
+      setError(r.json?.error || 'The workspace could not be connected.');
+    }
+  }
+
   useEffect(() => {
     if (!menuOpen) return undefined;
     const onDoc = (e) => {
@@ -186,6 +250,28 @@ export default function CloudBar() {
 
   return (
     <div className="gi-rail cb-rail" ref={railRef} data-testid="cloud-bar">
+      {pending && (
+        <div className="gi-rail-confirm" data-testid="cloud-deeplink">
+          <span className="gi-rail-hint">Connect this project to {pending.project}?</span>
+          <button
+            type="button"
+            className="btn btn--sm"
+            disabled={busy === 'deeplink'}
+            onClick={connectPending}
+            data-testid="cloud-deeplink-connect"
+          >
+            {busy === 'deeplink' ? 'Connecting…' : 'Connect'}
+          </button>
+          <button
+            type="button"
+            className="btn btn--ghost btn--sm"
+            onClick={() => setPending(null)}
+            data-testid="cloud-deeplink-dismiss"
+          >
+            Not now
+          </button>
+        </div>
+      )}
       {state === 'out' && (
         <>
           <button type="button" className="btn btn--ghost btn--sm gi-rail-signin" onClick={startSignIn} data-testid="cloud-signin">
@@ -226,21 +312,39 @@ export default function CloudBar() {
                 <div className="gi-menu-item" aria-disabled="true">No projects yet — start one on the dashboard.</div>
               )}
               {Array.isArray(projects) &&
-                projects.map((p) => (
-                  <button
-                    key={p.id}
-                    type="button"
-                    className="gi-menu-item"
-                    role="menuitem"
-                    disabled={busy === p.id}
-                    onClick={() => connect(p.id)}
-                    title={`Connect this project to ${p.url} (${p.role})`}
-                    data-testid={`cloud-project-${p.id}`}
-                  >
-                    <Icon name="link" size={15} /> {busy === p.id ? 'Connecting…' : `Connect ${p.name || p.id}`}
-                    <span className="gi-menu-login" style={{ marginLeft: 'auto' }}>{p.stateLabel}</span>
-                  </button>
-                ))}
+                projects.map((p) =>
+                  p.role === 'viewer' ? (
+                    // Viewer dignity (Phase 17 T4): no dead Connect that would
+                    // 403 at the workspace — viewing has a first-class home in
+                    // the browser, and the label says why.
+                    <button
+                      key={p.id}
+                      type="button"
+                      className="gi-menu-item"
+                      role="menuitem"
+                      onClick={() => window.open(shareViewUrl(p.url, p.id), '_blank', 'noopener')}
+                      title="Viewing works in the browser. Editing in the app needs the member role — ask whoever runs the project."
+                      data-testid={`cloud-project-${p.id}`}
+                    >
+                      <Icon name="external" size={15} /> View {p.name || p.id} in the browser
+                      <span className="gi-menu-login" style={{ marginLeft: 'auto' }}>viewer</span>
+                    </button>
+                  ) : (
+                    <button
+                      key={p.id}
+                      type="button"
+                      className="gi-menu-item"
+                      role="menuitem"
+                      disabled={busy === p.id}
+                      onClick={() => connect(p.id)}
+                      title={`Connect this project to ${p.url} (${p.role})`}
+                      data-testid={`cloud-project-${p.id}`}
+                    >
+                      <Icon name="link" size={15} /> {busy === p.id ? 'Connecting…' : `Connect ${p.name || p.id}`}
+                      <span className="gi-menu-login" style={{ marginLeft: 'auto' }}>{p.stateLabel}</span>
+                    </button>
+                  )
+                )}
               <div className="gi-menu-sep" />
               <button type="button" className="gi-menu-item" role="menuitem" onClick={() => window.open('https://cloud.maude.sh', '_blank', 'noopener')}>
                 <Icon name="external" size={15} /> Open the dashboard

package/apps/studio/client/styles/3-shell-maude.css

@@ -1993,6 +1993,8 @@ body.st-scrubbing, body.st-scrubbing * { cursor: ew-resize !important; user-sele
 .gi-rail { position: relative; flex: 0 0 auto; margin-top: auto; padding: var(--space-2) var(--space-3); border-top: 1px solid var(--border-default); display: flex; flex-direction: column; gap: var(--space-2); }
 .gi-rail-hint { font-size: var(--type-xs); color: var(--fg-2); padding: var(--space-1) var(--space-1); }
 .gi-rail-signin { width: 100%; justify-content: center; }
+.gi-rail-confirm { display: flex; align-items: center; gap: var(--space-2); flex-wrap: wrap; padding: var(--space-2); border: 1px solid var(--border-default); border-radius: var(--radius-md); background: var(--bg-2); }
+.gi-rail-confirm .gi-rail-hint { flex: 1 1 100%; padding: 0; }
 .gi-rail-err { font-size: var(--type-xs); color: var(--status-error); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .gi-avatar { border-radius: var(--radius-pill); display: grid; place-items: center; font-family: var(--font-mono); font-size: 10px; font-weight: 600; color: var(--accent-fg); background: var(--accent); flex: 0 0 auto; }
 .gi-rail-account { display: flex; align-items: center; gap: var(--space-2); width: 100%; padding: var(--space-1) var(--space-2); border: 1px solid transparent; border-radius: var(--radius-md); background: transparent; color: var(--fg-0); cursor: pointer; text-align: left; }

package/apps/studio/cloud/endpoints.ts

@@ -189,48 +189,96 @@ export function createCloudEndpoints(ctx: Ctx) {
       if (opened.status !== 200 || !opened.body?.token) {
         return { status: 502, json: { ok: false, error: 'The project could not be opened with this account.' } };
       }
+      return linkToWorkspace({ workspaceUrl: opened.body.url, projectToken: opened.body.token, role: opened.body.role });
+    },
 
-      const workspaceUrl: string = opened.body.url;
-      // The cell is a different host than the control plane — one direct call.
-      let hubToken: string | null = null;
-      try {
-        const res = await fetch(`${workspaceUrl}/auth/login`, {
-          method: 'POST',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ token: opened.body.token }),
-        });
-        const body: any = await res.json().catch(() => ({}));
-        if (res.ok && body?.token) hubToken = body.token;
-      } catch {
-        /* handled below */
+    /**
+     * Attach via a one-time handoff code — the maude:// lane (Phase 17). The
+     * code came from an untrusted URL, so it is exchanged ONLY against the
+     * configured Maude Cloud address (never one the link names), and the
+     * workspace we then link is the one THAT exchange returns. Needs no
+     * personal token: the code itself proves the dashboard session.
+     */
+    async attachCode(code: string): Promise<CloudEndpointResult> {
+      if (typeof code !== 'string' || !/^mhc_[0-9a-f]{16,128}$/.test(code)) {
+        return { status: 400, json: { ok: false, error: 'That link is not valid.' } };
       }
-      if (!hubToken) {
-        return { status: 502, json: { ok: false, error: 'The workspace did not accept the sign-in. Try again in a minute.' } };
+      const exchanged = await cloudFetch('/auth/handoff/exchange', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ code }),
+      });
+      if (exchanged.status !== 200 || !exchanged.body?.token) {
+        return {
+          status: 410,
+          json: {
+            ok: false,
+            error:
+              'That link expired — it works once, for two minutes. Press “Open in Maude” on the project page again.',
+          },
+        };
       }
+      return linkToWorkspace({
+        workspaceUrl: exchanged.body.url,
+        projectToken: exchanged.body.token,
+        role: exchanged.body.role,
+        project: exchanged.body.project,
+      });
+    },
+  };
 
-      const norm = normalizeUrl(workspaceUrl);
-      saveHubCredential(norm, hubToken);
+  /** The shared tail of every attach: cell exchange → credential + linkedHub. */
+  async function linkToWorkspace({
+    workspaceUrl,
+    projectToken,
+    role,
+    project,
+  }: {
+    workspaceUrl: string;
+    projectToken: string;
+    role?: string;
+    project?: string;
+  }): Promise<CloudEndpointResult> {
+    // The cell is a different host than the control plane — one direct call.
+    let hubToken: string | null = null;
+    try {
+      const res = await fetch(`${workspaceUrl}/auth/login`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ token: projectToken }),
+      });
+      const body: any = await res.json().catch(() => ({}));
+      if (res.ok && body?.token) hubToken = body.token;
+    } catch {
+      /* handled below */
+    }
+    if (!hubToken) {
+      return { status: 502, json: { ok: false, error: 'The workspace did not accept the sign-in. Try again in a minute.' } };
+    }
 
-      // Project side — linkedHub in .design/config.json (committed; no token).
-      const cfgPath = join(ctx.paths.designRoot, 'config.json');
-      let cfg: any = {};
-      try {
-        cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
-      } catch {
-        /* absent/malformed → start minimal */
-      }
-      cfg.linkedHub = { url: norm, linkedAt: Date.now() };
-      writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}\n`, 'utf8');
+    const norm = normalizeUrl(workspaceUrl);
+    saveHubCredential(norm, hubToken);
 
-      return {
-        status: 200,
-        json: {
-          ok: true,
-          url: norm,
-          role: opened.body.role,
-          note: 'Linked. Restart the studio server to start syncing.',
-        },
-      };
-    },
-  };
+    // Project side — linkedHub in .design/config.json (committed; no token).
+    const cfgPath = join(ctx.paths.designRoot, 'config.json');
+    let cfg: any = {};
+    try {
+      cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
+    } catch {
+      /* absent/malformed → start minimal */
+    }
+    cfg.linkedHub = { url: norm, linkedAt: Date.now() };
+    writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}\n`, 'utf8');
+
+    return {
+      status: 200,
+      json: {
+        ok: true,
+        url: norm,
+        role: role ?? null,
+        project: project ?? null,
+        note: 'Linked. Restart the studio server to start syncing.',
+      },
+    };
+  }
 }

package/apps/studio/debug-bundle.ts

@@ -0,0 +1,144 @@
+// debug-bundle.ts — scrubbed diagnostic bundle for the Report-a-Bug dialog
+// (feature-bug-report-button). Three pieces:
+//
+//   1. a 500-line in-memory log ring fed by a console tap (installLogRing) —
+//      the dev-server has no persistent log of its own, so the ring is what
+//      gives a report something to attach;
+//   2. scrub() — the DETERMINISTIC redaction pass every log line goes through
+//      before it can leave the process. Privacy invariant (docs/report-schema.md):
+//      the scrubber runs server-side, has red/green tests, and is extended
+//      test-first — never "best-effort";
+//   3. buildDebugBundle() — assembles the `maude-report/v1` server-side fields.
+//
+// The consuming route (`GET /_api/debug-bundle`, http.ts) is PRIVILEGED:
+// main-origin only, absent from CANVAS_SAFE_API + startCanvasServer's routes
+// (dual-allowlist rule, DDR-088) — a hub-pushed canvas must never read logs.
+
+import { homedir } from 'node:os';
+
+const RING_MAX = 500;
+const ring: string[] = [];
+let tapInstalled = false;
+
+/** Append one line to the ring (public for tests + non-console callers). */
+export function recordLogLine(line: string): void {
+  ring.push(line);
+  if (ring.length > RING_MAX) ring.splice(0, ring.length - RING_MAX);
+}
+
+/** Last `n` raw (UNSCRUBBED — caller must scrub) ring lines, oldest first. */
+export function logRingLines(n = 200): string[] {
+  return ring.slice(-n);
+}
+
+function fmt(args: unknown[]): string {
+  return args
+    .map((a) => {
+      if (typeof a === 'string') return a;
+      if (a instanceof Error) return a.stack ?? a.message;
+      try {
+        return JSON.stringify(a);
+      } catch {
+        return String(a);
+      }
+    })
+    .join(' ');
+}
+
+/**
+ * Mirror console.log/warn/error into the ring. Original behavior preserved
+ * (stdout/stderr still get every line). Idempotent — safe to call from both
+ * the server boot and tests.
+ */
+export function installLogRing(): void {
+  if (tapInstalled) return;
+  tapInstalled = true;
+  for (const level of ['log', 'warn', 'error'] as const) {
+    const original = console[level].bind(console);
+    console[level] = (...args: unknown[]) => {
+      recordLogLine(`[${level}] ${fmt(args)}`);
+      original(...args);
+    };
+  }
+}
+
+export interface ScrubOptions {
+  /** Absolute repo root → rewritten to `<project>/`. */
+  repoRoot?: string;
+  /** Home dir → rewritten to `~`. Defaults to os.homedir(). */
+  home?: string;
+}
+
+/**
+ * Deterministic redaction. Order matters: repoRoot first (it usually lives
+ * under home — scrubbing home first would leave `~/git/repo` variants that
+ * the repoRoot rule no longer matches), then home, then secret material,
+ * then emails.
+ */
+export function scrub(text: string, opts: ScrubOptions = {}): string {
+  let out = text;
+
+  const repoRoot = opts.repoRoot?.replace(/\/+$/, '');
+  if (repoRoot) out = out.replaceAll(repoRoot, '<project>');
+
+  const home = (opts.home ?? homedir()).replace(/\/+$/, '');
+  if (home) out = out.replaceAll(home, '~');
+
+  // Known token shapes first (GitHub classic + fine-grained, Anthropic, JWTs).
+  out = out.replace(/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{8,}\b/g, '[redacted]');
+  out = out.replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]');
+  out = out.replace(
+    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g,
+    '[redacted]'
+  );
+  // Bearer headers, however they were logged.
+  out = out.replace(/\b(Bearer)\s+[^\s"']+/gi, '$1 [redacted]');
+  // key=value / "key": "value" forms for secret-shaped keys — keep the key,
+  // redact the value.
+  out = out.replace(
+    /\b(token|secret|password|passwd|api[_-]?key|authorization|access[_-]?key)("?\s*[:=]\s*"?)[^\s"',}]+/gi,
+    '$1$2[redacted]'
+  );
+
+  out = out.replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, '[email]');
+
+  return out;
+}
+
+export interface DebugBundle {
+  app: { maudeVersion: string; platform: string; arch: string };
+  context: { projectName: string | null; activeCanvas: string | null };
+  logs: { serverLogTail: string };
+}
+
+/**
+ * Assemble the server-side half of a `maude-report/v1` payload. Everything
+ * here is ALREADY scrubbed — the client treats the bundle as display+consent
+ * material and must not need to re-clean it. Canvas CONTENT never enters the
+ * bundle: `activeCanvas` is the relative path only.
+ */
+export function buildDebugBundle(args: {
+  maudeVersion: string;
+  projectName: string | null;
+  activeCanvas: string | null;
+  repoRoot: string;
+  tailLines?: number;
+}): DebugBundle {
+  const scrubOpts: ScrubOptions = { repoRoot: args.repoRoot };
+  return {
+    app: {
+      maudeVersion: args.maudeVersion,
+      platform: process.platform,
+      arch: process.arch,
+    },
+    context: {
+      projectName: args.projectName,
+      activeCanvas: args.activeCanvas ? scrub(args.activeCanvas, scrubOpts) : null,
+    },
+    logs: {
+      serverLogTail: logRingLines(args.tailLines ?? 200)
+        .map((l) => scrub(l, scrubOpts))
+        .join('\n'),
+    },
+  };
+}