@1agh/maude 0.53.0 → 0.53.1

package/apps/studio/http.ts

@@ -1263,7 +1263,13 @@ export function createHttp(
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const endpoint = process.env.MAUDE_REPORT_URL || 'https://cloud.maude.sh/report';
       try {
-        const upstream = await fetch(endpoint, {
+        // `globalThis.fetch` — NOT bare `fetch`: this module declares its own
+        // `async function fetch(req: Request)` (the server fall-through handler)
+        // in the same scope, which shadows the global. A bare call re-entered the
+        // fall-through with a URL string, so `new URL(req.url)` threw
+        // `"undefined" cannot be parsed as a URL` and every report died with a
+        // plain-text HTTP 500 without ever leaving the machine.
+        const upstream = await globalThis.fetch(endpoint, {
           method: 'POST',
           body: await req.formData(),
           signal: AbortSignal.timeout(30_000),
@@ -3948,7 +3954,11 @@ export function createHttp(
     '/index.html': () => serveFile(join(CLIENT_DIR, 'index.html')),
   } satisfies Record<string, (req: Request) => Response | Promise<Response>>;
 
-  async function fetch(req: Request): Promise<Response> {
+  // Named `handleFallthrough`, not `fetch` — a same-named local function shadows
+  // the global `fetch` for every call site in this module's scope, which is how
+  // the `/_api/report` route ended up calling itself instead of the network (see
+  // the `globalThis.fetch` comment on that route; RCA issue-report-a-bug-http-500).
+  async function handleFallthrough(req: Request): Promise<Response> {
     try {
       const url = new URL(req.url);
       const pathname = url.pathname;
@@ -4342,7 +4352,7 @@ export function createHttp(
   ) as typeof routes;
 
   async function guardedFetch(req: Request): Promise<Response> {
-    return readOnlyRefusal(req) ?? fetch(req);
+    return readOnlyRefusal(req) ?? handleFallthrough(req);
   }
 
   return { routes: guardedRoutes, fetch: guardedFetch, serveCanvasShell, isCanvasSafeRoute };

package/apps/studio/test/report-proxy.test.ts

@@ -0,0 +1,125 @@
+// Regression test for issue-report-a-bug-http-500 (RCA:
+// .ai/logs/rca/issue-report-a-bug-http-500.md). `/_api/report` proxies the
+// dialog's multipart body to `MAUDE_REPORT_URL`. A bare `fetch(endpoint, …)`
+// call inside http.ts silently resolved to this module's OWN same-named
+// fall-through handler instead of the global `fetch` — the request never left
+// the machine, and the route mirrored a bogus local 500 back to the client.
+// These tests boot a real server pointed at a real stub upstream, so a
+// reintroduced shadow (or any other break in the proxy hop) fails loudly
+// instead of only being caught by a mocked-upstream unit test.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+async function bootStubUpstream(
+  handler: (req: Request) => Response | Promise<Response>
+): Promise<{ url: string; stop: () => void; received: () => number }> {
+  let received = 0;
+  const server = Bun.serve({
+    port: 0,
+    fetch: async (req) => {
+      received += 1;
+      return handler(req);
+    },
+  });
+  return {
+    url: `http://127.0.0.1:${server.port}`,
+    stop: () => server.stop(true),
+    received: () => received,
+  };
+}
+
+describe('/_api/report proxy hop', () => {
+  test('forwards the multipart body verbatim and mirrors a successful upstream response', async () => {
+    const { root } = makeSandbox();
+    let capturedBytes = 0;
+    let capturedHasReportPart = false;
+    const upstream = await bootStubUpstream(async (req) => {
+      const form = await req.formData();
+      capturedHasReportPart = typeof form.get('report') === 'string';
+      // Multipart parsing consumed the body — approximate "did real bytes
+      // arrive" by re-serializing what FormData kept.
+      capturedBytes = [...form.values()].reduce(
+        (n, v) => n + (typeof v === 'string' ? v.length : (v as Blob).size),
+        0
+      );
+      return Response.json({ ok: true, issueNumber: 1, issueUrl: 'https://example.com/issues/1' });
+    });
+
+    const port = nextPort();
+    const proc = await bootServer(root, port, { MAUDE_REPORT_URL: `${upstream.url}/report` });
+    try {
+      const form = new FormData();
+      form.set(
+        'report',
+        JSON.stringify({ schema: 'maude-report/v1', description: 'test', reportId: 'r-0123abcd' })
+      );
+      form.append('screenshot', new Blob([new Uint8Array([1, 2, 3, 4])]), 'shot.png');
+
+      const res = await fetch(`http://localhost:${port}/_api/report`, {
+        method: 'POST',
+        body: form,
+      });
+      expect(res.status).toBe(200);
+      const json = await res.json();
+      expect(json).toEqual({ ok: true, issueNumber: 1, issueUrl: 'https://example.com/issues/1' });
+
+      expect(upstream.received()).toBe(1);
+      expect(capturedHasReportPart).toBe(true);
+      expect(capturedBytes).toBeGreaterThan(0);
+    } finally {
+      await killProc(proc);
+      upstream.stop();
+    }
+  });
+
+  test('an unreachable upstream yields 502 with a JSON error, not a bare 500', async () => {
+    const { root } = makeSandbox();
+    const port = nextPort();
+    // Nothing listens on this port — the fetch itself must fail/timeout.
+    const proc = await bootServer(root, port, { MAUDE_REPORT_URL: 'http://127.0.0.1:1/report' });
+    try {
+      const form = new FormData();
+      form.set(
+        'report',
+        JSON.stringify({ schema: 'maude-report/v1', description: 'test', reportId: 'r-0123abcd' })
+      );
+      const res = await fetch(`http://localhost:${port}/_api/report`, {
+        method: 'POST',
+        body: form,
+      });
+      expect(res.status).toBe(502);
+      const json = await res.json();
+      expect(json).toEqual({ error: 'report service unreachable' });
+    } finally {
+      await killProc(proc);
+    }
+  });
+});
+
+describe('no bare `fetch(` call sites in http.ts', () => {
+  test('every fetch call is either the global fetch (qualified) or a local handler name', () => {
+    const src = readFileSync(new URL('../http.ts', import.meta.url), 'utf8');
+    // A bare `fetch(` immediately preceded by a word-boundary and NOT preceded
+    // by a `.` (member access) or `function ` (declaration) would silently
+    // resolve to this file's own same-named fall-through handler instead of
+    // the global — exactly the bug this test guards against. `handleFallthrough`
+    // is the current, unambiguous name; this assertion also fails if the
+    // handler is ever renamed back to something call-site-ambiguous.
+    const bareFetchCalls = [...src.matchAll(/(?<![.\w])fetch\(/g)];
+    const lines = src.split('\n');
+    // Skip: comment lines (mentioning `fetch(` in prose is fine) and the one
+    // legitimate bare occurrence — the type-signature parameter name
+    // `fetch(req: Request): Promise<Response>;` in the `Api`-shaped interface,
+    // which is a declaration, not a call.
+    const offendingLines = bareFetchCalls
+      .map((m) => src.slice(0, m.index).split('\n').length)
+      .map((line) => ({ line, text: lines[line - 1] ?? '' }))
+      .filter(({ text }) => !/^\s*(\/\/|\*)/.test(text))
+      .filter(({ text }) => !/^\s*fetch\(req: Request\): Promise<Response>;/.test(text));
+
+    expect(offendingLines).toEqual([]);
+  });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.53.0",
+  "version": "0.53.1",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -52,13 +52,13 @@
     "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.53.0",
-    "@1agh/maude-darwin-x64": "0.53.0",
-    "@1agh/maude-linux-arm64": "0.53.0",
-    "@1agh/maude-linux-arm64-musl": "0.53.0",
-    "@1agh/maude-linux-x64": "0.53.0",
-    "@1agh/maude-linux-x64-musl": "0.53.0",
-    "@1agh/maude-win32-x64": "0.53.0"
+    "@1agh/maude-darwin-arm64": "0.53.1",
+    "@1agh/maude-darwin-x64": "0.53.1",
+    "@1agh/maude-linux-arm64": "0.53.1",
+    "@1agh/maude-linux-arm64-musl": "0.53.1",
+    "@1agh/maude-linux-x64": "0.53.1",
+    "@1agh/maude-linux-x64-musl": "0.53.1",
+    "@1agh/maude-win32-x64": "0.53.1"
   },
   "files": [
     "cli",