@1agh/maude 0.51.0 → 0.52.0

package/apps/studio/cloud/endpoints.ts

@@ -22,13 +22,39 @@ import { dirname, join } from 'node:path';
 import { saveHubCredential } from '../sync/hub-link.ts';
 import { normalizeUrl } from '../sync/hubs-config.ts';
 
-const CLOUD_URL = (process.env.MAUDE_CLOUD_URL ?? 'https://cloud.maude.sh').replace(/\/+$/, '');
+/**
+ * Where Maude Cloud lives, resolved PER CALL rather than at module load.
+ *
+ * A module-level read baked whatever `MAUDE_CLOUD_URL` happened to be at
+ * import time — so in a shared test process the first importer decided the
+ * address for everyone (the e2e/unit stub silently talked to production and
+ * the assertion failed 410), and the desktop shell could not set the env
+ * after the module graph was already warm.
+ */
+function cloudUrl(): string {
+  return (process.env.MAUDE_CLOUD_URL ?? 'https://cloud.maude.sh').replace(/\/+$/, '');
+}
 
 export interface CloudEndpointResult {
   status: number;
   json: unknown;
 }
 
+/** Whatever the control plane answered. Read defensively at every use. */
+type CloudBody = Record<string, unknown> & {
+  token?: string;
+  url?: string;
+  role?: string;
+  project?: string;
+  user_code?: string;
+  device_code?: string;
+  verification_url?: string;
+  interval?: number;
+  projects?: unknown[];
+  account?: { email?: string };
+  error?: string;
+};
+
 interface CloudFile {
   url: string;
   token: string;
@@ -68,11 +94,11 @@ async function cloudFetch(
   path: string,
   init: RequestInit = {},
   { timeoutMs = 15_000 } = {}
-): Promise<{ status: number; body: any }> {
+): Promise<{ status: number; body: CloudBody }> {
   const ctl = new AbortController();
   const timer = setTimeout(() => ctl.abort(), timeoutMs);
   try {
-    const res = await fetch(`${CLOUD_URL}${path}`, { ...init, signal: ctl.signal });
+    const res = await fetch(`${cloudUrl()}${path}`, { ...init, signal: ctl.signal });
     return { status: res.status, body: await res.json().catch(() => ({})) };
   } catch (err) {
     return { status: 0, body: { error: (err as Error).message } };
@@ -94,7 +120,7 @@ export function createCloudEndpoints(ctx: Ctx) {
         status: 200,
         json: file
           ? { connected: true, email: file.email ?? null, url: file.url }
-          : { connected: false, url: CLOUD_URL },
+          : { connected: false, url: cloudUrl() },
       };
     },
 
@@ -106,7 +132,10 @@ export function createCloudEndpoints(ctx: Ctx) {
         body: JSON.stringify({ client: `Maude Studio on ${process.platform}` }),
       });
       if (r.status !== 200) {
-        return { status: 502, json: { ok: false, error: 'Maude Cloud could not be reached. Try again in a moment.' } };
+        return {
+          status: 502,
+          json: { ok: false, error: 'Maude Cloud could not be reached. Try again in a moment.' },
+        };
       }
       return {
         status: 200,
@@ -130,15 +159,21 @@ export function createCloudEndpoints(ctx: Ctx) {
       });
       if (r.status === 202) return { status: 200, json: { ok: true, pending: true } };
       if (r.status !== 200 || !r.body?.token) {
-        return { status: 410, json: { ok: false, error: 'The code expired. Start the sign-in again.' } };
+        return {
+          status: 410,
+          json: { ok: false, error: 'The code expired. Start the sign-in again.' },
+        };
       }
       writeCloudFile({
-        url: CLOUD_URL,
+        url: cloudUrl(),
         token: r.body.token,
         email: r.body.account?.email ?? undefined,
         connectedAt: Date.now(),
       });
-      return { status: 200, json: { ok: true, pending: false, email: r.body.account?.email ?? null } };
+      return {
+        status: 200,
+        json: { ok: true, pending: false, email: r.body.account?.email ?? null },
+      };
     },
 
     /** Forget the local credential. (Revocation lives on /account.) */
@@ -154,14 +189,18 @@ export function createCloudEndpoints(ctx: Ctx) {
     /** The signed-in account's projects, states included. */
     async projects(): Promise<CloudEndpointResult> {
       const file = readCloudFile();
-      if (!file) return { status: 401, json: { ok: false, error: 'Sign in to Maude Cloud first.' } };
+      if (!file)
+        return { status: 401, json: { ok: false, error: 'Sign in to Maude Cloud first.' } };
       const r = await cloudFetch('/api/projects', {
         headers: { authorization: `Bearer ${file.token}` },
       });
       if (r.status === 401) {
         // Revoked from the dashboard — honor it locally too.
         this.signout();
-        return { status: 401, json: { ok: false, error: 'This device was disconnected. Sign in again.' } };
+        return {
+          status: 401,
+          json: { ok: false, error: 'This device was disconnected. Sign in again.' },
+        };
       }
       if (r.status !== 200) {
         return { status: 502, json: { ok: false, error: 'Maude Cloud could not be reached.' } };
@@ -176,7 +215,8 @@ export function createCloudEndpoints(ctx: Ctx) {
      */
     async attach(projectId: string): Promise<CloudEndpointResult> {
       const file = readCloudFile();
-      if (!file) return { status: 401, json: { ok: false, error: 'Sign in to Maude Cloud first.' } };
+      if (!file)
+        return { status: 401, json: { ok: false, error: 'Sign in to Maude Cloud first.' } };
       if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(String(projectId ?? ''))) {
         return { status: 400, json: { ok: false, error: 'unknown project' } };
       }
@@ -187,9 +227,16 @@ export function createCloudEndpoints(ctx: Ctx) {
         body: JSON.stringify({ project: projectId }),
       });
       if (opened.status !== 200 || !opened.body?.token) {
-        return { status: 502, json: { ok: false, error: 'The project could not be opened with this account.' } };
+        return {
+          status: 502,
+          json: { ok: false, error: 'The project could not be opened with this account.' },
+        };
       }
-      return linkToWorkspace({ workspaceUrl: opened.body.url, projectToken: opened.body.token, role: opened.body.role });
+      return linkToWorkspace({
+        workspaceUrl: opened.body.url,
+        projectToken: opened.body.token,
+        role: opened.body.role,
+      });
     },
 
     /**
@@ -199,7 +246,7 @@ export function createCloudEndpoints(ctx: Ctx) {
      * workspace we then link is the one THAT exchange returns. Needs no
      * personal token: the code itself proves the dashboard session.
      */
-    async attachCode(code: string): Promise<CloudEndpointResult> {
+    async attachCode(code: string, claimedProject?: string): Promise<CloudEndpointResult> {
       if (typeof code !== 'string' || !/^mhc_[0-9a-f]{16,128}$/.test(code)) {
         return { status: 400, json: { ok: false, error: 'That link is not valid.' } };
       }
@@ -218,6 +265,24 @@ export function createCloudEndpoints(ctx: Ctx) {
           },
         };
       }
+
+      // The link CLAIMED a project name and the person confirmed THAT name.
+      // The exchange is the only authority on which project the code really
+      // opens, so the two must agree — otherwise a code minted for the
+      // attacker's own project, wrapped in a link naming something familiar,
+      // would be confirmed by a victim and then linked, sending their local
+      // work to the attacker's workspace. Refuse rather than silently link
+      // something the person did not agree to.
+      if (claimedProject && exchanged.body.project && claimedProject !== exchanged.body.project) {
+        return {
+          status: 409,
+          json: {
+            ok: false,
+            error: `That link said ${claimedProject} but it opens ${exchanged.body.project}. Nothing was connected — open the project from its own page instead.`,
+          },
+        };
+      }
+
       return linkToWorkspace({
         workspaceUrl: exchanged.body.url,
         projectToken: exchanged.body.token,
@@ -247,13 +312,19 @@ export function createCloudEndpoints(ctx: Ctx) {
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({ token: projectToken }),
       });
-      const body: any = await res.json().catch(() => ({}));
+      const body = (await res.json().catch(() => ({}))) as CloudBody;
       if (res.ok && body?.token) hubToken = body.token;
     } catch {
       /* handled below */
     }
     if (!hubToken) {
-      return { status: 502, json: { ok: false, error: 'The workspace did not accept the sign-in. Try again in a minute.' } };
+      return {
+        status: 502,
+        json: {
+          ok: false,
+          error: 'The workspace did not accept the sign-in. Try again in a minute.',
+        },
+      };
     }
 
     const norm = normalizeUrl(workspaceUrl);
@@ -261,7 +332,7 @@ export function createCloudEndpoints(ctx: Ctx) {
 
     // Project side — linkedHub in .design/config.json (committed; no token).
     const cfgPath = join(ctx.paths.designRoot, 'config.json');
-    let cfg: any = {};
+    let cfg: Record<string, unknown> = {};
     try {
       cfg = JSON.parse(readFileSync(cfgPath, 'utf8'));
     } catch {

package/apps/studio/credential-grammar.ts

@@ -0,0 +1,100 @@
+// Every secret Maude itself mints, in one place.
+//
+// Written after the 2026-07-30 /flow:validate found the diagnostic scrubber
+// redacting every VENDOR's credentials — GitHub, Anthropic, JWTs, Bearer
+// headers — and none of our own. Two independently-correct decisions composed
+// into the leak:
+//
+//   • the project token deliberately is NOT a JWT (DDR-204 / cloud-identity.mjs
+//     — one algorithm, nothing to downgrade), so it has TWO dot-separated
+//     parts, and
+//   • the scrubber's JWT rule correctly requires THREE.
+//
+// So a token that looks exactly like a JWT to any reviewer sailed through a
+// bundle labelled "paths & secrets scrubbed". The `\b(token|secret|…)` rule
+// could not catch `HUB_SECRET=…` either, because `_` is a word character and
+// `\b` never fires between `HUB` and `_SECRET`.
+//
+// The fix is not another regex in the scrubber. It is a REGISTRY: whoever adds
+// a new minted grammar adds it here, and every consumer that must recognise a
+// Maude credential imports it instead of guessing. `credential-grammar.test.ts`
+// asserts the registry covers every prefix the codebase actually mints, so a
+// sixth grammar cannot be added without this file noticing.
+
+export interface CredentialGrammar {
+  /** Short id, used in test names and failure messages. */
+  id: string;
+  /** What mints it, so a reader can find the source of truth. */
+  mintedBy: string;
+  /** Matches the credential ANYWHERE in a line of text. */
+  pattern: RegExp;
+}
+
+/**
+ * The grammars. Every `pattern` must be global — the scrubber replaces all
+ * occurrences in a line, not just the first.
+ */
+export const CREDENTIAL_GRAMMARS: CredentialGrammar[] = [
+  {
+    id: 'peer-token',
+    mintedBy: 'apps/hub/src/tokens.mjs (addToken) — the workspace session token',
+    pattern: /\bmau_[A-Za-z0-9]{8,}\b/g,
+  },
+  {
+    id: 'personal-token',
+    mintedBy: 'apps/cloud/device-auth.mjs — what a signed-in device holds',
+    pattern: /\bmpt_[A-Za-z0-9]{8,}\b/g,
+  },
+  {
+    id: 'handoff-code',
+    mintedBy: 'apps/cloud/handoff.mjs — the one-time browser→app claim ticket',
+    pattern: /\bmhc_[A-Za-z0-9]{8,}\b/g,
+  },
+  {
+    id: 'device-code',
+    mintedBy: 'apps/cloud/device-auth.mjs — the poller’s half of the device flow',
+    pattern: /\bmdc_[A-Za-z0-9]{8,}\b/g,
+  },
+  {
+    id: 'grant',
+    mintedBy: 'apps/cloud/grants.mjs (mintGrant) — the project-grant capability',
+    // `mcg_<base64url payload>.<base64url mac>` — like the project token, it
+    // is deliberately not a JWT, so the three-part JWT rule cannot see it.
+    pattern: /\bmcg_[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g,
+  },
+  {
+    id: 'project-token',
+    mintedBy: 'apps/cloud/cell-token.mjs (mintProjectToken) — base64url payload.mac',
+    // TWO parts, not three. This is the one the JWT rule structurally cannot
+    // see. The payload always starts `eyJ` (a base64url-encoded `{"`), which is
+    // what keeps this from matching ordinary dotted words.
+    pattern: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{20,}\b/g,
+  },
+  {
+    id: 'derived-cell-secret',
+    mintedBy: 'apps/cloud/cell-token.mjs (deriveCellSecret) — 64 hex, HUB_SECRET and friends',
+    pattern: /\b[0-9a-f]{64}\b/g,
+  },
+];
+
+/**
+ * Redact every Maude-minted credential in a string.
+ *
+ * Deliberately separate from the vendor rules: those chase other people's
+ * formats and change when a vendor changes; this one is OURS and changes when
+ * WE mint something new.
+ */
+export function redactMaudeCredentials(text: string, marker = '[redacted]'): string {
+  let out = text;
+  for (const g of CREDENTIAL_GRAMMARS) out = out.replace(g.pattern, marker);
+  return out;
+}
+
+/**
+ * Environment variable names whose VALUE is a secret regardless of shape.
+ *
+ * `\b(token|secret)` cannot match inside `HUB_SECRET` — `_` is a word
+ * character — so the underscore-joined names need their own rule.
+ */
+export const SECRET_ENV_PATTERN =
+  /\b([A-Z][A-Z0-9]*_(?:SECRET|TOKEN|KEY|PASSWORD|MASTER)[A-Z0-9_]*)(\s*[:=]\s*"?)([^\s"',}]+)/g;

package/apps/studio/debug-bundle.ts

@@ -16,6 +16,8 @@
 
 import { homedir } from 'node:os';
 
+import { redactMaudeCredentials, SECRET_ENV_PATTERN } from './credential-grammar.ts';
+
 const RING_MAX = 500;
 const ring: string[] = [];
 let tapInstalled = false;
@@ -84,6 +86,16 @@ export function scrub(text: string, opts: ScrubOptions = {}): string {
   const home = (opts.home ?? homedir()).replace(/\/+$/, '');
   if (home) out = out.replaceAll(home, '~');
 
+  // OURS first — the grammars Maude itself mints (credential-grammar.ts).
+  // Kept separate from the vendor rules below because those chase other
+  // people's formats and change when a vendor changes; this set changes when
+  // WE mint something new, and its test fails if a new prefix is added
+  // without registering it.
+  out = redactMaudeCredentials(out);
+  // Underscore-joined secret env names — `\b(token|secret)` can never match
+  // inside `HUB_SECRET`, because `_` is a word character.
+  out = out.replace(SECRET_ENV_PATTERN, '$1$2[redacted]');
+
   // Known token shapes first (GitHub classic + fine-grained, Anthropic, JWTs).
   out = out.replace(/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{8,}\b/g, '[redacted]');
   out = out.replace(/\bsk-[A-Za-z0-9_-]{16,}\b/g, '[redacted]');