@1agh/maude 0.50.0 → 0.51.1

package/apps/studio/cloud/endpoints.ts

@@ -189,48 +189,96 @@ export function createCloudEndpoints(ctx: Ctx) {
       if (opened.status !== 200 || !opened.body?.token) {
         return { status: 502, json: { ok: false, error: 'The project could not be opened with this account.' } };
       }
+      return linkToWorkspace({ workspaceUrl: opened.body.url, projectToken: opened.body.token, role: opened.body.role });
+    },
 
-      const workspaceUrl: string = opened.body.url;
-      // The cell is a different host than the control plane — one direct call.
-      let hubToken: string | null = null;
-      try {
-        const res = await fetch(`${workspaceUrl}/auth/login`, {
-          method: 'POST',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify({ token: opened.body.token }),
-        });
-        const body: any = await res.json().catch(() => ({}));
-        if (res.ok && body?.token) hubToken = body.token;
-      } catch {
-        /* handled below */
+    /**
+     * Attach via a one-time handoff code — the maude:// lane (Phase 17). The
+     * code came from an untrusted URL, so it is exchanged ONLY against the
+     * configured Maude Cloud address (never one the link names), and the
+     * workspace we then link is the one THAT exchange returns. Needs no
+     * personal token: the code itself proves the dashboard session.
+     */
+    async attachCode(code: string): Promise<CloudEndpointResult> {
+      if (typeof code !== 'string' || !/^mhc_[0-9a-f]{16,128}$/.test(code)) {
+        return { status: 400, json: { ok: false, error: 'That link is not valid.' } };
       }
-      if (!hubToken) {
-        return { status: 502, json: { ok: false, error: 'The workspace did not accept the sign-in. Try again in a minute.' } };
+      const exchanged = await cloudFetch('/auth/handoff/exchange', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ code }),
+      });
+      if (exchanged.status !== 200 || !exchanged.body?.token) {
+        return {
+          status: 410,
+          json: {
+            ok: false,
+            error:
+              'That link expired — it works once, for two minutes. Press “Open in Maude” on the project page again.',
+          },
+        };
       }
+      return linkToWorkspace({
+        workspaceUrl: exchanged.body.url,
+        projectToken: exchanged.body.token,
+        role: exchanged.body.role,
+        project: exchanged.body.project,
+      });
+    },
+  };
 
-      const norm = normalizeUrl(workspaceUrl);
-      saveHubCredential(norm, hubToken);
+  /** The shared tail of every attach: cell exchange → credential + linkedHub. */
+  async function linkToWorkspace({
+    workspaceUrl,
+    projectToken,
+    role,
+    project,
+  }: {
+    workspaceUrl: string;
+    projectToken: string;
+    role?: string;
+    project?: string;
+  }): Promise<CloudEndpointResult> {
+    // The cell is a different host than the control plane — one direct call.
+    let hubToken: string | null = null;
+    try {
+      const res = await fetch(`${workspaceUrl}/auth/login`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ token: projectToken }),
+      });
+      const body: any = await res.json().catch(() => ({}));
+      if (res.ok && body?.token) hubToken = body.token;
+    } catch {
+      /* handled below */
+    }
+    if (!hubToken) {
+      return { status: 502, json: { ok: false, error: 'The workspace did not accept the sign-in. Try again in a minute.' } };
+    }
 
-      // Project side — linkedHub in .design/config.json (committed; no token).
-      const cfgPath = join(ctx.paths.designRoot, 'config.json');
-      let cfg: any = {};
-      try {
-        cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
-      } catch {
-        /* absent/malformed → start minimal */
-      }
-      cfg.linkedHub = { url: norm, linkedAt: Date.now() };
-      writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}\n`, 'utf8');
+    const norm = normalizeUrl(workspaceUrl);
+    saveHubCredential(norm, hubToken);
 
-      return {
-        status: 200,
-        json: {
-          ok: true,
-          url: norm,
-          role: opened.body.role,
-          note: 'Linked. Restart the studio server to start syncing.',
-        },
-      };
-    },
-  };
+    // Project side — linkedHub in .design/config.json (committed; no token).
+    const cfgPath = join(ctx.paths.designRoot, 'config.json');
+    let cfg: any = {};
+    try {
+      cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
+    } catch {
+      /* absent/malformed → start minimal */
+    }
+    cfg.linkedHub = { url: norm, linkedAt: Date.now() };
+    writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}\n`, 'utf8');
+
+    return {
+      status: 200,
+      json: {
+        ok: true,
+        url: norm,
+        role: role ?? null,
+        project: project ?? null,
+        note: 'Linked. Restart the studio server to start syncing.',
+      },
+    };
+  }
 }

package/apps/studio/debug-bundle.ts

@@ -0,0 +1,144 @@
+// debug-bundle.ts — scrubbed diagnostic bundle for the Report-a-Bug dialog
+// (feature-bug-report-button). Three pieces:
+//
+//   1. a 500-line in-memory log ring fed by a console tap (installLogRing) —
+//      the dev-server has no persistent log of its own, so the ring is what
+//      gives a report something to attach;
+//   2. scrub() — the DETERMINISTIC redaction pass every log line goes through
+//      before it can leave the process. Privacy invariant (docs/report-schema.md):
+//      the scrubber runs server-side, has red/green tests, and is extended
+//      test-first — never "best-effort";
+//   3. buildDebugBundle() — assembles the `maude-report/v1` server-side fields.
+//
+// The consuming route (`GET /_api/debug-bundle`, http.ts) is PRIVILEGED:
+// main-origin only, absent from CANVAS_SAFE_API + startCanvasServer's routes
+// (dual-allowlist rule, DDR-088) — a hub-pushed canvas must never read logs.
+
+import { homedir } from 'node:os';
+
+const RING_MAX = 500;
+const ring: string[] = [];
+let tapInstalled = false;
+
+/** Append one line to the ring (public for tests + non-console callers). */
+export function recordLogLine(line: string): void {
+  ring.push(line);
+  if (ring.length > RING_MAX) ring.splice(0, ring.length - RING_MAX);
+}
+
+/** Last `n` raw (UNSCRUBBED — caller must scrub) ring lines, oldest first. */
+export function logRingLines(n = 200): string[] {
+  return ring.slice(-n);
+}
+
+function fmt(args: unknown[]): string {
+  return args
+    .map((a) => {
+      if (typeof a === 'string') return a;
+      if (a instanceof Error) return a.stack ?? a.message;
+      try {
+        return JSON.stringify(a);
+      } catch {
+        return String(a);
+      }
+    })
+    .join(' ');
+}
+
+/**
+ * Mirror console.log/warn/error into the ring. Original behavior preserved
+ * (stdout/stderr still get every line). Idempotent — safe to call from both
+ * the server boot and tests.
+ */
+export function installLogRing(): void {
+  if (tapInstalled) return;
+  tapInstalled = true;
+  for (const level of ['log', 'warn', 'error'] as const) {
+    const original = console[level].bind(console);
+    console[level] = (...args: unknown[]) => {
+      recordLogLine(`[${level}] ${fmt(args)}`);
+      original(...args);
+    };
+  }
+}
+
+export interface ScrubOptions {
+  /** Absolute repo root → rewritten to `<project>/`. */
+  repoRoot?: string;
+  /** Home dir → rewritten to `~`. Defaults to os.homedir(). */
+  home?: string;
+}
+
+/**
+ * Deterministic redaction. Order matters: repoRoot first (it usually lives
+ * under home — scrubbing home first would leave `~/git/repo` variants that
+ * the repoRoot rule no longer matches), then home, then secret material,
+ * then emails.
+ */
+export function scrub(text: string, opts: ScrubOptions = {}): string {
+  let out = text;
+
+  const repoRoot = opts.repoRoot?.replace(/\/+$/, '');
+  if (repoRoot) out = out.replaceAll(repoRoot, '<project>');
+
+  const home = (opts.home ?? homedir()).replace(/\/+$/, '');
+  if (home) out = out.replaceAll(home, '~');
+
+  // Known token shapes first (GitHub classic + fine-grained, Anthropic, JWTs).
+  out = out.replace(/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{8,}\b/g, '[redacted]');
+  out = out.replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]');
+  out = out.replace(
+    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\b/g,
+    '[redacted]'
+  );
+  // Bearer headers, however they were logged.
+  out = out.replace(/\b(Bearer)\s+[^\s"']+/gi, '$1 [redacted]');
+  // key=value / "key": "value" forms for secret-shaped keys — keep the key,
+  // redact the value.
+  out = out.replace(
+    /\b(token|secret|password|passwd|api[_-]?key|authorization|access[_-]?key)("?\s*[:=]\s*"?)[^\s"',}]+/gi,
+    '$1$2[redacted]'
+  );
+
+  out = out.replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, '[email]');
+
+  return out;
+}
+
+export interface DebugBundle {
+  app: { maudeVersion: string; platform: string; arch: string };
+  context: { projectName: string | null; activeCanvas: string | null };
+  logs: { serverLogTail: string };
+}
+
+/**
+ * Assemble the server-side half of a `maude-report/v1` payload. Everything
+ * here is ALREADY scrubbed — the client treats the bundle as display+consent
+ * material and must not need to re-clean it. Canvas CONTENT never enters the
+ * bundle: `activeCanvas` is the relative path only.
+ */
+export function buildDebugBundle(args: {
+  maudeVersion: string;
+  projectName: string | null;
+  activeCanvas: string | null;
+  repoRoot: string;
+  tailLines?: number;
+}): DebugBundle {
+  const scrubOpts: ScrubOptions = { repoRoot: args.repoRoot };
+  return {
+    app: {
+      maudeVersion: args.maudeVersion,
+      platform: process.platform,
+      arch: process.arch,
+    },
+    context: {
+      projectName: args.projectName,
+      activeCanvas: args.activeCanvas ? scrub(args.activeCanvas, scrubOpts) : null,
+    },
+    logs: {
+      serverLogTail: logRingLines(args.tailLines ?? 200)
+        .map((l) => scrub(l, scrubOpts))
+        .join('\n'),
+    },
+  };
+}