@1agh/maude 0.53.2 → 0.55.0

package/apps/studio/annotations-layer.tsx

@@ -1252,7 +1252,17 @@ export function AnnotationsLayer() {
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ file, svg }),
         })
-          .then(() => undefined)
+          .then((r) => {
+            // A refused save (403 read-only, 405 at a proxy door) previously
+            // dissolved here without a trace — the user kept drawing on state
+            // that never reached disk, a peer, or a reload (the cloud
+            // canvas-writes RCA). Optimistic local state is still the right
+            // UX; a persistence failure being INVISIBLE is not.
+            if (!r.ok) {
+              console.warn(`[annotations] save refused (${r.status}) — strokes are local-only`);
+            }
+            return undefined;
+          })
           .catch(() => {
             /* swallow — user sees uncommitted state until the next stroke */
           });

package/apps/studio/api.ts

@@ -98,6 +98,7 @@ import { createHistory } from './history.ts';
 import { clearLocatorSlug, readLocator, writeLocator } from './locator.ts';
 import { STICKERS_DIR } from './paths.ts';
 import { getPaperPreset, MAX_PRINT_MM } from './print/units.ts';
+import { sessionDir } from './session-scope.ts';
 
 // Directories that never hold user-facing canvases. Exported so the
 // external-canvas watcher (`canvas-list-watch.ts`) shares one source instead of
@@ -1324,8 +1325,11 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
 
   // ---------- Canvas state ----------
 
+  // Cloud Phase 27 D3 — one member's place in the project is not another's.
+  // `sessionDir` is a no-op without an ambient session, so a desktop resolves
+  // the identical path it always did.
   function canvasStatePath(file: string): string {
-    return path.join(paths.canvasStateDir, `${fileSlug(file)}.json`);
+    return path.join(sessionDir(paths.canvasStateDir), `${fileSlug(file)}.json`);
   }
 
   async function loadCanvasState(file: string) {
@@ -1468,7 +1472,9 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
    *  canvas-ext). Returns null when `file` is not a valid canvas path. */
   function canvasViewPath(file: string): string | null {
     if (!canvasMetaPath(file)) return null; // reuse the containment + ext gate
-    return path.join(paths.canvasStateDir, `${fileSlug(file)}.view.json`);
+    // D3 again — the camera is the other per-machine singleton two members in
+    // one cell were silently sharing.
+    return path.join(sessionDir(paths.canvasStateDir), `${fileSlug(file)}.view.json`);
   }
 
   const MAX_OVERLAY_KEYS = 32;
@@ -1572,7 +1578,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     const vp = normalizeViewport(viewport);
     if (!vp) return null;
     try {
-      await mkdir(paths.canvasStateDir, { recursive: true });
+      await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
       const current = await readCanvasViewRaw(file);
       await Bun.write(viewAbs, `${JSON.stringify({ ...current, viewport: vp }, null, 2)}\n`);
       return vp;
@@ -1597,7 +1603,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     const ov = normalizeOverlays(overlays);
     if (ov === null) return null;
     try {
-      await mkdir(paths.canvasStateDir, { recursive: true });
+      await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
       const current = await readCanvasViewRaw(file);
       const prevOverlays =
         current.overlays && typeof current.overlays === 'object' && !Array.isArray(current.overlays)
@@ -1710,7 +1716,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
           try {
             const current = await readCanvasViewRaw(file);
             const { overlays: _drop, ...rest } = current;
-            await mkdir(paths.canvasStateDir, { recursive: true });
+            await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
             await Bun.write(viewAbs, `${JSON.stringify(rest, null, 2)}\n`);
           } catch {
             /* best-effort clear */
@@ -1732,12 +1738,12 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
           const current = await readCanvasViewRaw(file);
           if (patch.locked === null) {
             const { locked: _drop, ...rest } = current;
-            await mkdir(paths.canvasStateDir, { recursive: true });
+            await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
             await Bun.write(viewAbs, `${JSON.stringify(rest, null, 2)}\n`);
           } else {
             const lk = normalizeLocked(patch.locked);
             if (lk !== null) {
-              await mkdir(paths.canvasStateDir, { recursive: true });
+              await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
               await Bun.write(viewAbs, `${JSON.stringify({ ...current, locked: lk }, null, 2)}\n`);
             }
           }

package/apps/studio/bin/screenshot.sh

@@ -292,6 +292,27 @@ pw_screenshot() {
 # iframe to appear. Every leg is best-effort — chrome is the point of this mode,
 # so a missing row or a slow mount degrades to "chrome, nothing open" rather
 # than failing the capture.
+# A reachable port is not a mounted app: the server can answer while the client
+# bundle is still parsing, or React can fail to mount and leave an empty #root
+# (the exact shape of the v0.51.1 blank-window bug). Wait for the studio's own
+# file list before capturing, so a broken shell fails loud instead of shipping a
+# blank PNG that looks like a real screenshot.
+await_studio_shell() {
+  [ "$ENGINE" = "agent-browser" ] || return 0
+  local poll=0
+  while [ $poll -lt "$TIMEOUT" ]; do
+    local n
+    n=$("$AB" eval "document.querySelectorAll('[data-testid^=\"canvas-row-\"]').length" 2>/dev/null | tr -d '[:space:]')
+    case "$n" in
+      ''|*[!0-9]*|0) ;;
+      *) return 0 ;;
+    esac
+    sleep 1
+    poll=$((poll + 1))
+  done
+  return 1
+}
+
 open_active_in_shell() {
   [ "$ENGINE" = "agent-browser" ] || return 0
   [ -n "$ACTIVE" ] || { echo "→ shell: no active canvas — capturing chrome as-is" >&2; return 0; }
@@ -332,11 +353,22 @@ open_active_in_shell() {
 
 navigate_once() {
   if [ "$ENGINE" = "agent-browser" ]; then
-    "$AB" open "$URL" >&2
+    # A failed navigation MUST propagate. agent-browser leaves the session on a
+    # blank page and `screenshot` then happily writes a ~4 kB white PNG, so
+    # ignoring this exit code turns "the server is down" into "here is your
+    # screenshot" — which for the Report-a-Bug shell shot means a blank image
+    # labelled "Maude window" lands in someone's bug report.
+    if ! "$AB" open "$URL" >&2; then
+      echo "✗ navigation failed: $URL" >&2
+      return 1
+    fi
     # Shell mode lands on the studio root, which has no DC mount to poll for —
     # the canvas arrives only after we click a row.
     if [ "$MODE" = "shell" ]; then
-      sleep 1
+      if ! await_studio_shell; then
+        echo "✗ the studio shell never mounted at $URL" >&2
+        return 1
+      fi
       open_active_in_shell
       apply_theme_override
       return 0
@@ -503,7 +535,15 @@ if [ $ALL_SCREENS -eq 1 ]; then
 fi
 
 # ---------- single-shot ----------
-navigate_once
+# A failed navigation is exactly the port-bounce case (DDR-094), so give
+# relive_url its one shot before giving up rather than capturing a blank page.
+if ! navigate_once; then
+  if ! relive_url || ! navigate_once; then
+    echo "✗ could not load $URL — no screenshot written" >&2
+    rm -f "$OUT"
+    exit 3
+  fi
+fi
 if capture_resilient "$CSS_SEL" "$OUT"; then
   echo "$OUT"
   exit 0

package/apps/studio/build.ts

@@ -21,6 +21,8 @@ import { fileURLToPath } from 'node:url';
 
 import { browserslistToTargets, bundle as lcssBundle } from 'lightningcss';
 
+import { cloudStubPlugin } from './cloud-build.ts';
+
 const ROOT = dirname(fileURLToPath(import.meta.url));
 const DIST = join(ROOT, 'dist');
 
@@ -32,6 +34,9 @@ const MODE: 'dev' | 'release' | 'dry' = ARGS.has('--dry-run')
     ? 'release'
     : 'dev';
 const WATCH = ARGS.has('--watch');
+/** Cloud Phase 27 D1 — build the CELL's variant (secret-bearing surfaces
+ *  removed from the binary, not merely un-routed). `--cloud` with `--release`. */
+const CLOUD = ARGS.has('--cloud');
 
 const PLATFORM_MATRIX = [
   'bun-darwin-arm64',
@@ -336,11 +341,20 @@ import ${JSON.stringify(realServerRel)};
   return entryPath;
 }
 
-async function buildServerBinary(target: PlatformTarget): Promise<{ outPath: string }> {
+async function buildServerBinary(
+  target: PlatformTarget,
+  /**
+   * Cloud Phase 27 D1 — the variant a CELL runs, with the secret-bearing
+   * surfaces removed from the binary rather than merely un-routed. Named
+   * separately (`maude-cloud-<slug>`) so a desktop release can never pick one
+   * up by accident, and so both can be built from one checkout.
+   */
+  { cloud = false }: { cloud?: boolean } = {}
+): Promise<{ outPath: string }> {
   ensureDist();
   const slug = platformSlug(target);
   const ext = slug.startsWith('win32') ? '.exe' : '';
-  const outPath = join(DIST, `maude-${slug}${ext}`);
+  const outPath = join(DIST, `maude-${cloud ? 'cloud-' : ''}${slug}${ext}`);
   const realEntry = join(ROOT, 'server.ts');
   if (!existsSync(realEntry)) {
     // Legacy fallback — pre-DDR-009 .mjs path. Doesn't use oxc-parser, so the
@@ -369,6 +383,26 @@ async function buildServerBinary(target: PlatformTarget): Promise<{ outPath: str
   // filter skipped it (cross-compile case — see ensureBindingForTarget docs).
   await ensureBindingForTarget(oxcBindingSlug(slug));
   const entry = writeCompileEntry(target);
+
+  // The CLOUD variant goes through the Bun.build API rather than the CLI,
+  // because that is the only path that takes a plugin — and a plugin is what
+  // makes D1 elimination rather than un-routing. `--define` + dead-code
+  // elimination was tried first and does not do it: Bun inlines the
+  // dynamically-imported module and keeps the branch, so the bytes stay.
+  if (cloud) {
+    const result = await Bun.build({
+      entrypoints: [entry],
+      target: 'bun',
+      minify: true,
+      plugins: [cloudStubPlugin(ROOT)],
+      compile: { target, outfile: outPath },
+    } as Parameters<typeof Bun.build>[0]);
+    if (!result.success) {
+      throw new Error(`cloud compile failed for ${target}:\n${result.logs.map(String).join('\n')}`);
+    }
+    return { outPath };
+  }
+
   const proc = Bun.spawn(
     [
       'bun',
@@ -538,7 +572,7 @@ async function main() {
       : [currentTarget()];
     for (const target of targets) {
       const t = performance.now();
-      const bin = await buildServerBinary(target);
+      const bin = await buildServerBinary(target, { cloud: CLOUD });
       console.log(`[build] ${bin.outPath}  (${(performance.now() - t).toFixed(0)} ms)`);
     }
   }

package/apps/studio/canvas-build-sandbox.ts

@@ -43,9 +43,21 @@ export interface SandboxBuildFail {
   ok: false;
   error: string;
   kind: 'build' | 'timeout' | 'memory' | 'runtime';
+  /** How many imports the allowlist refused. A COUNT — never the specifiers. */
+  rejectedImports?: number;
 }
 export type SandboxBuildResult = SandboxBuildOk | SandboxBuildFail;
 
+/**
+ * How much history the counters hold — Cloud Phase 26 Stage 4.
+ *
+ * A ROLLING WINDOW, not a lifetime total: the sweep reads this hourly, and a
+ * monotonic counter read at intervals turns every "how busy was the last hour"
+ * question into a subtraction the reader has to get right. An hour of history
+ * answers it directly.
+ */
+export const STATS_WINDOW_MS = Number(process.env.MAUDE_CANVAS_STATS_WINDOW_MS ?? 3_600_000);
+
 const counters = {
   builds: 0,
   cacheHits: 0,
@@ -53,12 +65,58 @@ const counters = {
   failures: 0,
   timeouts: 0,
   memoryKills: 0,
+  /** Imports the allowlist refused. The COUNT only — see buildStats(). */
+  rejectedImports: 0,
+  /** Summed wall-clock of completed builds, the closest thing to Active-CPU
+   *  this side of the boundary can honestly report. */
+  cpuMsTotal: 0,
+  /** The biggest import graph any build had to read, in bytes. */
+  largestGraphBytes: 0,
   /** Every completed build's wall-clock, newest last, capped. */
   durationsMs: [] as number[],
+  /** When this window started. THE FIELD THAT MAKES A ZERO READABLE. */
+  windowStartedAt: Date.now(),
 };
 
-/** A snapshot for the operator surface + the cost lane. */
+/** Start a fresh window, keeping the cache (which is not a counter). */
+function rollWindow(now: number): void {
+  counters.builds = 0;
+  counters.cacheHits = 0;
+  counters.cacheMisses = 0;
+  counters.failures = 0;
+  counters.timeouts = 0;
+  counters.memoryKills = 0;
+  counters.rejectedImports = 0;
+  counters.cpuMsTotal = 0;
+  counters.largestGraphBytes = 0;
+  counters.durationsMs = [];
+  counters.windowStartedAt = now;
+}
+
+function maybeRoll(now = Date.now()): void {
+  if (now - counters.windowStartedAt >= STATS_WINDOW_MS) rollWindow(now);
+}
+
+/**
+ * A snapshot for the operator surface + the cost lane.
+ *
+ * COUNTS AND DURATIONS ONLY. Never a canvas name, never a path, and never the
+ * text of a rejected import specifier — that specifier is written by the
+ * tenant, so it is their content; the operational fact is that a rejection
+ * happened, not what it said.
+ *
+ * `windowStartedAt` travels with the counters and is load-bearing. The window
+ * lives in memory, so a cell restart resets it — and without the start time a
+ * row of zeroes from a cell that rebooted a minute ago is indistinguishable
+ * from a genuinely quiet hour. One of those is nothing to do; the other is a
+ * crash loop.
+ *
+ * `cacheHitRatio` is offered for a human reading this payload directly, but
+ * the two COUNTS are what travel to the operator board, which divides at read
+ * time. A ratio computed over a window that reset is a confident lie.
+ */
 export function buildStats() {
+  maybeRoll();
   const d = [...counters.durationsMs].sort((a, b) => a - b);
   const p = (q: number) =>
     d.length === 0 ? null : d[Math.min(d.length - 1, Math.floor(d.length * q))];
@@ -71,20 +129,26 @@ export function buildStats() {
     failures: counters.failures,
     timeouts: counters.timeouts,
     memoryKills: counters.memoryKills,
+    rejectedImports: counters.rejectedImports,
+    cpuMsTotal: counters.cpuMsTotal,
+    largestGraphBytes: counters.largestGraphBytes,
     p50Ms: p(0.5),
     p95Ms: p(0.95),
+    maxMs: d.length === 0 ? null : d[d.length - 1],
+    windowMs: STATS_WINDOW_MS,
+    windowStartedAt: counters.windowStartedAt,
   };
 }
 
+/** Record one import the allowlist refused. The specifier is NOT passed in. */
+export function noteRejectedImport(): void {
+  maybeRoll();
+  counters.rejectedImports++;
+}
+
 /** Test seam. */
 export function _resetBuildStats(): void {
-  counters.builds = 0;
-  counters.cacheHits = 0;
-  counters.cacheMisses = 0;
-  counters.failures = 0;
-  counters.timeouts = 0;
-  counters.memoryKills = 0;
-  counters.durationsMs = [];
+  rollWindow(Date.now());
   cache.clear();
 }
 
@@ -154,6 +218,19 @@ function resolveCandidates(fromDir: string, spec: string): string[] {
   ];
 }
 
+/** Total bytes of every source a build could have to read. Sizes only. */
+function graphBytes(designRoot: string, canvasAbs: string): number {
+  let total = 0;
+  for (const file of relevantSources(designRoot, canvasAbs)) {
+    try {
+      total += statSync(file).size;
+    } catch {
+      /* a file that vanished contributes nothing rather than failing a build */
+    }
+  }
+  return total;
+}
+
 function remember(key: string, value: { js: string; locator: unknown; etag: string }): void {
   cache.set(key, value);
   while (cache.size > CACHE_MAX_ENTRIES) {
@@ -258,6 +335,7 @@ export async function buildCanvasSandboxed({
   canvasAbs: string;
   env?: NodeJS.ProcessEnv;
 }): Promise<SandboxBuildResult> {
+  maybeRoll();
   const key = cacheKeyFor(designRoot, canvasAbs);
   const hit = cache.get(key);
   if (hit) {
@@ -265,10 +343,18 @@ export async function buildCanvasSandboxed({
     return { ...hit, ok: true, cached: true };
   }
   counters.cacheMisses++;
+  // The pathological-canvas signal, measured rather than argued: a huge import
+  // graph burns our Active-CPU while the tenant pays a flat rate. Bytes, never
+  // filenames.
+  counters.largestGraphBytes = Math.max(
+    counters.largestGraphBytes,
+    graphBytes(designRoot, canvasAbs)
+  );
 
   const started = Date.now();
   const result = await runWorker({ designRoot, canvasAbs, env });
   const elapsed = Date.now() - started;
+  counters.cpuMsTotal += elapsed;
   counters.durationsMs.push(elapsed);
   if (counters.durationsMs.length > 200) counters.durationsMs.shift();
 
@@ -281,6 +367,7 @@ export async function buildCanvasSandboxed({
   counters.failures++;
   if (result.kind === 'timeout') counters.timeouts++;
   if (result.kind === 'memory') counters.memoryKills++;
+  counters.rejectedImports += result.rejectedImports ?? 0;
   return result;
 }
 
@@ -362,7 +449,12 @@ async function runWorker({
     if (parsed.ok) {
       return { ok: true, js: parsed.js, locator: parsed.locator, etag: parsed.etag, cached: false };
     }
-    return { ok: false, kind: 'build', error: String(parsed.error) };
+    return {
+      ok: false,
+      kind: 'build',
+      error: String(parsed.error),
+      rejectedImports: Number(parsed.rejectedImports ?? 0) || 0,
+    };
   } catch {
     return {
       ok: false,

package/apps/studio/canvas-build-worker.ts

@@ -79,7 +79,13 @@ main().catch((err) => {
   // the one who has to act on it. Bun collapses plugin throws into the build
   // log, so the allowlist's own wording survives in `err.message`.
   process.stdout.write(
-    JSON.stringify({ ok: false, error: String(err?.message ?? err).slice(0, 4000) })
+    JSON.stringify({
+      ok: false,
+      error: String(err?.message ?? err).slice(0, 4000),
+      // A NUMBER, never the specifiers. The host counts these; the strings
+      // stay between the canvas and the person who wrote it.
+      rejectedImports: Number(err?.rejectedImports ?? 0) || 0,
+    })
   );
   process.exit(1);
 });

package/apps/studio/canvas-build.ts

@@ -187,7 +187,15 @@ export async function buildCanvasModule(
     // "Bundle failed" log, so the allowlist records its own reasons and they
     // win here — the person who wrote the canvas has to be able to act on it,
     // and "Bundle failed" tells them nothing.
-    if (denials.length > 0) throw new Error(denials.map((d) => d.reason).join('\n'));
+    if (denials.length > 0) {
+      // The COUNT of denials travels with the error, so the cost lane can
+      // record that imports were refused without ever seeing the specifier —
+      // that string is tenant-authored content (Cloud Phase 26 Stage 4). The
+      // reasons still go to the person who wrote the canvas, unchanged.
+      const err = new Error(denials.map((d) => d.reason).join('\n'));
+      (err as Error & { rejectedImports?: number }).rejectedImports = denials.length;
+      throw err;
+    }
     const msg = built.logs.map((l) => l.message).join('\n');
     throw new Error(`Bun.build failed on ${canvasAbsPath}:\n${msg}`);
   }