@1agh/maude 0.50.0 → 0.51.0

package/apps/studio/http.ts

@@ -27,6 +27,7 @@ import { TranspileError } from './canvas-pipeline.ts';
 import type { AiActivity } from './collab/ai-activity.ts';
 import type { Context } from './context.ts';
 import { reloadConfig } from './context.ts';
+import { buildDebugBundle } from './debug-bundle.ts';
 import { probeSetupReadiness } from './design-setup-readiness.ts';
 import { type Format, isFormat, isScope, type Scope } from './exporters/index.ts';
 import { type ExportJobQueue, ExportQueueFullError } from './exporters/jobs.ts';
@@ -88,7 +89,7 @@ import { getRuntimeBundle, packageForSlug } from './runtime-bundle.ts';
 import { linkHub } from './sync/hub-link.ts';
 import { signInToWorkspace, workspaceDisclosure } from './sync/workspace-signin.ts';
 import { readUiPrefs, type UiPrefs, writeUiPrefs } from './ui-prefs.ts';
-import { loadWhatsNew } from './whats-new.ts';
+import { loadWhatsNew, resolveMaudeVersion } from './whats-new.ts';
 import { isLoopbackHost } from './ws.ts';
 
 // Real disk install root — never the virtual `/$bunfs/root` of compiled bins.
@@ -1170,6 +1171,84 @@ export function createHttp(
     '/_api/whats-new': () =>
       Response.json(loadWhatsNew(), { headers: { 'Cache-Control': 'no-store' } }),
 
+    // feature-bug-report-button — the scrubbed diagnostic bundle the Report-a-Bug
+    // dialog previews for consent. PRIVILEGED (logs could reveal paths pre-scrub;
+    // the scrubber runs here, server-side): MAIN-ORIGIN ONLY — absent from
+    // CANVAS_SAFE_API + startCanvasServer routes — plus the same double gate as
+    // /_api/acp/status (a drive-by page must not read logs via DNS rebinding).
+    '/_api/debug-bundle': (req: Request) => {
+      if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      return Response.json(
+        buildDebugBundle({
+          maudeVersion: resolveMaudeVersion(),
+          projectName: ctx.cfg.name ?? null,
+          activeCanvas: (inspect.state as { active?: string | null }).active ?? null,
+          repoRoot: ctx.paths.repoRoot,
+        }),
+        { headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    // feature-bug-report-button — submit proxy. The client never talks to
+    // cloud.maude.sh directly (no CORS surface to open, and the endpoint can be
+    // overridden for self-hosters/tests via MAUDE_REPORT_URL). Forwards the
+    // multipart body verbatim; the cloud route owns validation + quota.
+    // PRIVILEGED: main-origin only + double gate (it triggers outbound network).
+    '/_api/report': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const endpoint = process.env.MAUDE_REPORT_URL || 'https://cloud.maude.sh/report';
+      try {
+        const upstream = await fetch(endpoint, {
+          method: 'POST',
+          body: await req.formData(),
+          signal: AbortSignal.timeout(30_000),
+        });
+        const body = await upstream.text();
+        return new Response(body, {
+          status: upstream.status,
+          headers: { 'content-type': 'application/json', 'Cache-Control': 'no-store' },
+        });
+      } catch {
+        // Unreachable/timeout — the client falls back to the local bundle path.
+        return Response.json({ error: 'report service unreachable' }, { status: 502 });
+      }
+    },
+
+    // feature-bug-report-button — offline/declined fallback: persist the bundle
+    // locally under `<designRoot>/_reports/<ts>/` (gitignored runtime state,
+    // DDR-115 taxonomy) so the user can attach it to a hand-filed issue.
+    // PRIVILEGED: main-origin only + double gate (filesystem write).
+    '/_api/report-fallback': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req)) return new Response('cross-origin rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{ report?: unknown; screenshots?: unknown }>(req);
+      if (!body || typeof body.report !== 'object' || body.report === null) {
+        return new Response('body must include { report }', { status: 400 });
+      }
+      const shots = Array.isArray(body.screenshots) ? body.screenshots.slice(0, 3) : [];
+      const dir = join(ctx.paths.designRoot, '_reports', String(Date.now()));
+      await Bun.write(join(dir, 'report.json'), JSON.stringify(body.report, null, 2));
+      let n = 0;
+      for (const shot of shots) {
+        if (typeof shot !== 'string') continue;
+        const m = /^data:image\/(png|jpeg);base64,([A-Za-z0-9+/=]+)$/.exec(shot);
+        if (!m || m[2].length > 7_000_000) continue; // ~5 MB decoded cap
+        n += 1;
+        await Bun.write(join(dir, `screenshot-${n}.${m[1] === 'png' ? 'png' : 'jpg'}`), Buffer.from(m[2], 'base64'));
+      }
+      return Response.json(
+        { dir: relative(ctx.paths.repoRoot, dir), screenshots: n },
+        { headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_index-data': async () =>
       Response.json(await api.buildIndexData(), { headers: { 'Cache-Control': 'no-store' } }),
 
@@ -1775,6 +1854,18 @@ export function createHttp(
       const body = (await req.json().catch(() => ({}))) as { project?: string };
       return gitJson(await cloudApi.attach(String(body.project ?? '')));
     },
+    '/_api/cloud/attach/code': async (req: Request) => {
+      // The maude:// lane (Phase 17): a one-time handoff code from a deep
+      // link. Same gates as attach; the code is exchanged only against the
+      // CONFIGURED cloud address, never one the link named.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required', { status: 403 });
+      const body = (await req.json().catch(() => ({}))) as { code?: string };
+      return gitJson(await cloudApi.attachCode(String(body.code ?? '')));
+    },
 
     '/_api/github/identity': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });

package/apps/studio/sync/workspace-signin.ts

@@ -53,6 +53,7 @@ export type SignInFailure =
   | 'unreachable'
   | 'not-a-maude-workspace'
   | 'bad-credentials'
+  | 'cloud-identity'
   | 'rate-limited'
   | 'save-failed'
   | 'server-error';
@@ -148,6 +149,20 @@ export async function signInToWorkspace(
   if (res.status === 429) {
     return fail(429, 'Too many attempts. Wait a minute and try again.', 'rate-limited');
   }
+  if (res.status === 400) {
+    // The ONE refusal that comes with directions (Phase 23 B3): a cloud
+    // workspace saying "this door signs in through Maude Cloud" — or a viewer
+    // being told what viewing needs. Swallowing it into "try again shortly"
+    // turned the most actionable message on this path into a shrug.
+    let message = 'The workspace refused the sign-in.';
+    try {
+      const body = (await res.json()) as { error?: unknown };
+      if (typeof body.error === 'string' && body.error) message = body.error;
+    } catch {
+      /* keep the generic sentence */
+    }
+    return fail(400, message, 'cloud-identity');
+  }
   if (!res.ok) {
     return fail(502, 'The workspace refused the sign-in. Try again shortly.', 'server-error');
   }

package/apps/studio/test/cloud-endpoints.test.ts

@@ -0,0 +1,130 @@
+// The dev-server's Maude Cloud lane — Cloud Phase 23 C3 + the maude:// code
+// attach (Phase 17). The control plane AND the cell are stubbed on one local
+// server; the assertions are about custody and trust posture, not transport:
+// the code is exchanged only against the CONFIGURED cloud address, the hub
+// token lands in the credential store, and linkedHub is written token-free.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { parseDeepLink, shareViewUrl } from '../client/panels/CloudBar.jsx';
+
+let stub: ReturnType<typeof Bun.serve> | null = null;
+let scratch = '';
+const seen: string[] = [];
+
+beforeAll(() => {
+  scratch = mkdtempSync(join(tmpdir(), 'maude-cloud-test-'));
+  stub = Bun.serve({
+    port: 0,
+    hostname: '127.0.0.1',
+    fetch: async (req) => {
+      const url = new URL(req.url);
+      seen.push(`${req.method} ${url.pathname}`);
+      const json = (b: unknown, status = 200) =>
+        new Response(JSON.stringify(b), { status, headers: { 'content-type': 'application/json' } });
+      if (url.pathname === '/auth/handoff/exchange') {
+        const body: any = await req.json();
+        if (body.code === 'mhc_' + 'a'.repeat(64)) {
+          return json({
+            token: 'x.y',
+            role: 'owner',
+            project: 'stub-project',
+            // The "cell" is this same stub server.
+            url: `http://127.0.0.1:${stub!.port}`,
+            expiresAt: Date.now() + 3600_000,
+          });
+        }
+        return json({ error: 'that code is not valid or has expired' }, 400);
+      }
+      if (url.pathname === '/auth/login') {
+        const body: any = await req.json();
+        return body?.token === 'x.y'
+          ? json({ token: 'mau_stub_hub_token', user: { email: 'e@example.com', role: 'owner' } })
+          : json({ error: 'no' }, 401);
+      }
+      return json({ error: 'not stubbed' }, 404);
+    },
+  });
+  process.env.MAUDE_CLOUD_URL = `http://127.0.0.1:${stub.port}`;
+  process.env.MAUDE_CLOUD_CONFIG = join(scratch, 'cloud.json');
+  process.env.HUBS_CONFIG_PATH = join(scratch, 'hubs.json');
+});
+
+afterAll(() => {
+  stub?.stop(true);
+  rmSync(scratch, { recursive: true, force: true });
+  delete process.env.MAUDE_CLOUD_URL;
+  delete process.env.MAUDE_CLOUD_CONFIG;
+  delete process.env.HUBS_CONFIG_PATH;
+});
+
+describe('parseDeepLink — untrusted input, strict shape', () => {
+  test('accepts exactly the minted shape', () => {
+    const p = parseDeepLink(`maude://open/alligators?code=mhc_${'a'.repeat(64)}&origin=https://cloud.maude.sh`);
+    expect(p).toEqual({ project: 'alligators', code: `mhc_${'a'.repeat(64)}` });
+  });
+  test('refuses everything else', () => {
+    for (const bad of [
+      'maude://open/alligators', // no code
+      'maude://open/Alligators?code=mhc_' + 'a'.repeat(64), // bad slug
+      'maude://open/x?code=nothex', // bad code
+      'https://evil.example/?code=mhc_' + 'a'.repeat(64), // not maude://
+      'maude://join/x/y', // join is not the open shape
+    ]) {
+      expect(parseDeepLink(bad)).toBeNull();
+    }
+  });
+});
+
+describe('shareViewUrl — the viewer’s browser home', () => {
+  test('derives view-<host> from the project url', () => {
+    expect(shareViewUrl('https://alligators.cloud.maude.sh', 'alligators')).toBe(
+      'https://view-alligators.cloud.maude.sh'
+    );
+  });
+  test('falls back to the platform zone on garbage', () => {
+    expect(shareViewUrl('nonsense', 'p1')).toBe('https://view-p1.cloud.maude.sh');
+  });
+});
+
+describe('attachCode — the maude:// lane end to end (stubbed)', () => {
+  test('a valid code links: hub credential stored, linkedHub written token-free', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const designRoot = join(scratch, '.design');
+    const { mkdirSync } = await import('node:fs');
+    mkdirSync(designRoot, { recursive: true });
+    writeFileSync(join(designRoot, 'config.json'), '{}\n');
+
+    const apiEndpoints = createCloudEndpoints({ paths: { repoRoot: scratch, designRoot } });
+    const r = await apiEndpoints.attachCode(`mhc_${'a'.repeat(64)}`);
+    expect(r.status).toBe(200);
+    expect((r.json as any).ok).toBe(true);
+    expect((r.json as any).project).toBe('stub-project');
+
+    const cfg = JSON.parse(readFileSync(join(designRoot, 'config.json'), 'utf8'));
+    expect(cfg.linkedHub?.url).toContain('127.0.0.1');
+    expect(JSON.stringify(cfg)).not.toContain('mau_stub_hub_token');
+
+    // The exchange went to the CONFIGURED cloud address (this stub) — the
+    // only /auth/handoff/exchange call seen is ours.
+    expect(seen.filter((s) => s.includes('/auth/handoff/exchange')).length).toBe(1);
+  });
+
+  test('a malformed or dead code never reaches the network', async () => {
+    const { createCloudEndpoints } = await import('../cloud/endpoints.ts');
+    const apiEndpoints = createCloudEndpoints({
+      paths: { repoRoot: scratch, designRoot: join(scratch, '.design') },
+    });
+    const before = seen.length;
+    const r = await apiEndpoints.attachCode('not-a-code');
+    expect(r.status).toBe(400);
+    expect(seen.length).toBe(before);
+
+    const dead = await apiEndpoints.attachCode(`mhc_${'b'.repeat(64)}`);
+    expect(dead.status).toBe(410);
+    expect((dead.json as any).error).toMatch(/works once/);
+  });
+});

package/apps/studio/test/debug-bundle.test.ts

@@ -0,0 +1,105 @@
+// debug-bundle scrubber + ring — feature-bug-report-button.
+//
+// The scrubber is a PRIVACY GATE, not tidiness: docs/report-schema.md promises
+// every log line is deterministically cleaned server-side before it can enter
+// a report. Extend these tests FIRST when extending the scrubber.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  buildDebugBundle,
+  installLogRing,
+  logRingLines,
+  recordLogLine,
+  scrub,
+} from '../debug-bundle.ts';
+
+describe('scrub()', () => {
+  test('repo-absolute paths collapse to <project>/ BEFORE home collapses to ~', () => {
+    const out = scrub('error at /Users/jane/git/acme/src/app.ts and /Users/jane/notes.txt', {
+      home: '/Users/jane',
+      repoRoot: '/Users/jane/git/acme',
+    });
+    expect(out).toBe('error at <project>/src/app.ts and ~/notes.txt');
+  });
+
+  test('GitHub tokens (classic + fine-grained) are redacted', () => {
+    const out = scrub('using ghp_AbC123xyzAbC123xyz and github_pat_11ABCDEF0abcdef', {
+      home: '/h',
+    });
+    expect(out).not.toContain('ghp_');
+    expect(out).not.toContain('github_pat_');
+    expect(out).toContain('[redacted]');
+  });
+
+  test('bearer headers, sk- keys and JWTs are redacted', () => {
+    const out = scrub(
+      'sent Bearer abc.def.ghi then sk-ant-api03-longsecretvalue then eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig-part',
+      { home: '/h' }
+    );
+    expect(out).toContain('Bearer [redacted]');
+    expect(out).not.toContain('sk-ant-api03');
+    expect(out).not.toContain('eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0');
+    // An `Authorization:` header form over-redacts (key rule wins) — that is
+    // acceptable: privacy failures here are leaks, never extra redaction.
+    const hdr = scrub('Authorization: Bearer abc.def.ghi', { home: '/h' });
+    expect(hdr).not.toContain('abc.def.ghi');
+  });
+
+  test('secret-shaped key=value keeps the key, redacts the value', () => {
+    const out = scrub('token=abc123secret api_key: "xyz789" password=hunter2', { home: '/h' });
+    expect(out).toContain('token=[redacted]');
+    expect(out).toContain('password=[redacted]');
+    expect(out).not.toContain('abc123secret');
+    expect(out).not.toContain('hunter2');
+  });
+
+  test('emails are redacted', () => {
+    expect(scrub('reported by jane.doe+test@example.co.uk', { home: '/h' })).toBe(
+      'reported by [email]'
+    );
+  });
+
+  test('clean text passes through untouched', () => {
+    const line = '[log] canvas ui/Dashboard.tsx rebuilt in 43ms';
+    expect(scrub(line, { home: '/h', repoRoot: '/r' })).toBe(line);
+  });
+});
+
+describe('log ring', () => {
+  test('caps at 500 lines, keeps the newest, tail selects the last N', () => {
+    for (let i = 0; i < 620; i++) recordLogLine(`line ${i}`);
+    const all = logRingLines(500);
+    expect(all.length).toBe(500);
+    expect(all[0]).toBe('line 120');
+    expect(all[all.length - 1]).toBe('line 619');
+    expect(logRingLines(3)).toEqual(['line 617', 'line 618', 'line 619']);
+  });
+
+  test('console tap mirrors into the ring and is idempotent', () => {
+    installLogRing();
+    installLogRing(); // second call must not double-wrap (no duplicate lines)
+    console.log('tap-check', { a: 1 });
+    const tail = logRingLines(5);
+    expect(tail.filter((l) => l.includes('tap-check')).length).toBe(1);
+    expect(tail.some((l) => l.includes('[log] tap-check {"a":1}'))).toBe(true);
+  });
+});
+
+describe('buildDebugBundle()', () => {
+  test('assembles scrubbed fields; canvas path scrubbed; no content leaks', () => {
+    recordLogLine('boot at /Users/jane/git/acme with token=verysecret');
+    const bundle = buildDebugBundle({
+      maudeVersion: '9.9.9',
+      projectName: 'acme',
+      activeCanvas: 'ui/Dashboard.tsx',
+      repoRoot: '/Users/jane/git/acme',
+    });
+    expect(bundle.app.maudeVersion).toBe('9.9.9');
+    expect(bundle.app.platform).toBe(process.platform);
+    expect(bundle.context.activeCanvas).toBe('ui/Dashboard.tsx');
+    expect(bundle.logs.serverLogTail).toContain('<project>');
+    expect(bundle.logs.serverLogTail).not.toContain('verysecret');
+    expect(bundle.logs.serverLogTail).not.toContain('/Users/jane/git/acme');
+  });
+});

package/apps/studio/test/workspace-signin.test.ts

@@ -164,6 +164,25 @@ describe('failure modes are distinguishable and actionable', () => {
     expect((res.json as { error: string }).error).toMatch(/wait a minute/i);
   });
 
+  test("a cloud workspace's 400 message reaches the person verbatim (Phase 23 B3)", async () => {
+    // The hub's cloud-identity refusal comes WITH directions ("sign in through
+    // Maude Cloud" / what viewing needs). Swallowing it into "try again
+    // shortly" turned the most actionable message on this path into a shrug.
+    const { impl } = scriptedFetch({
+      '/health': HEALTHY,
+      '/auth/login': () =>
+        json(
+          { error: 'This workspace signs in through Maude Cloud — use Sign in to Maude Cloud in the app.' },
+          400
+        ),
+    });
+    const res = await signInToWorkspace(CREDS, { fetchImpl: impl, save: () => {} });
+    expect(res.status).toBe(400);
+    expect((res.json as { reason: string }).reason).toBe('cloud-identity');
+    expect((res.json as { error: string }).error).toMatch(/signs in through Maude Cloud/);
+    expect((res.json as { error: string }).error).not.toMatch(/try again shortly/i);
+  });
+
   test('a failed save is reported instead of pretending success', async () => {
     const { impl } = scriptedFetch({ '/health': HEALTHY, '/auth/login': LOGGED_IN });
     const res = await signInToWorkspace(CREDS, {

package/apps/studio/whats-new.json

@@ -1,6 +1,15 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "maude-deeplink-open-in-app",
+      "version": "0.51.0",
+      "date": "2026-07-30",
+      "kind": "feature",
+      "title": "Open a cloud project straight from the browser",
+      "summary": "Press “Open in Maude” on your project’s page and the app opens it signed in — a one-time link, nothing to copy. The app always asks before connecting, and viewers get a working “View in the browser” door instead of a dead button.",
+      "surface": "design-ui"
+    },
     {
       "id": "maude-cloud-signin-attach",
       "version": "0.50.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -25,6 +25,7 @@
     "build:desktop": "PATH=\"$HOME/.cargo/bin:$PATH\" pnpm --filter @maude/desktop tauri build",
     "test:e2e:desktop:build": "PATH=\"$HOME/.cargo/bin:$PATH\" pnpm --filter @maude/desktop tauri build --debug --config src-tauri/tauri.e2e.conf.json",
     "test:e2e:desktop": "pnpm --filter @maude/desktop-e2e e2e",
+    "test:e2e:desktop:cloud": "pnpm --filter @maude/desktop-e2e e2e:cloud",
     "test:e2e:desktop:git": "pnpm --filter @maude/desktop-e2e e2e:git",
     "build": "pnpm -r --if-present --filter '!@maude/desktop' '!@maude/desktop-e2e' run build",
     "build:binary": "bun run apps/studio/build.ts --release",
@@ -51,13 +52,13 @@
     "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.50.0",
-    "@1agh/maude-darwin-x64": "0.50.0",
-    "@1agh/maude-linux-arm64": "0.50.0",
-    "@1agh/maude-linux-arm64-musl": "0.50.0",
-    "@1agh/maude-linux-x64": "0.50.0",
-    "@1agh/maude-linux-x64-musl": "0.50.0",
-    "@1agh/maude-win32-x64": "0.50.0"
+    "@1agh/maude-darwin-arm64": "0.51.0",
+    "@1agh/maude-darwin-x64": "0.51.0",
+    "@1agh/maude-linux-arm64": "0.51.0",
+    "@1agh/maude-linux-arm64-musl": "0.51.0",
+    "@1agh/maude-linux-x64": "0.51.0",
+    "@1agh/maude-linux-x64-musl": "0.51.0",
+    "@1agh/maude-win32-x64": "0.51.0"
   },
   "files": [
     "cli",