@1agh/maude 0.54.0 → 0.55.0

package/apps/studio/annotations-layer.tsx

@@ -1252,7 +1252,17 @@ export function AnnotationsLayer() {
           headers: { 'Content-Type': 'application/json' },
           body: JSON.stringify({ file, svg }),
         })
-          .then(() => undefined)
+          .then((r) => {
+            // A refused save (403 read-only, 405 at a proxy door) previously
+            // dissolved here without a trace — the user kept drawing on state
+            // that never reached disk, a peer, or a reload (the cloud
+            // canvas-writes RCA). Optimistic local state is still the right
+            // UX; a persistence failure being INVISIBLE is not.
+            if (!r.ok) {
+              console.warn(`[annotations] save refused (${r.status}) — strokes are local-only`);
+            }
+            return undefined;
+          })
           .catch(() => {
             /* swallow — user sees uncommitted state until the next stroke */
           });

package/apps/studio/canvas-build-sandbox.ts

@@ -43,9 +43,21 @@ export interface SandboxBuildFail {
   ok: false;
   error: string;
   kind: 'build' | 'timeout' | 'memory' | 'runtime';
+  /** How many imports the allowlist refused. A COUNT — never the specifiers. */
+  rejectedImports?: number;
 }
 export type SandboxBuildResult = SandboxBuildOk | SandboxBuildFail;
 
+/**
+ * How much history the counters hold — Cloud Phase 26 Stage 4.
+ *
+ * A ROLLING WINDOW, not a lifetime total: the sweep reads this hourly, and a
+ * monotonic counter read at intervals turns every "how busy was the last hour"
+ * question into a subtraction the reader has to get right. An hour of history
+ * answers it directly.
+ */
+export const STATS_WINDOW_MS = Number(process.env.MAUDE_CANVAS_STATS_WINDOW_MS ?? 3_600_000);
+
 const counters = {
   builds: 0,
   cacheHits: 0,
@@ -53,12 +65,58 @@ const counters = {
   failures: 0,
   timeouts: 0,
   memoryKills: 0,
+  /** Imports the allowlist refused. The COUNT only — see buildStats(). */
+  rejectedImports: 0,
+  /** Summed wall-clock of completed builds, the closest thing to Active-CPU
+   *  this side of the boundary can honestly report. */
+  cpuMsTotal: 0,
+  /** The biggest import graph any build had to read, in bytes. */
+  largestGraphBytes: 0,
   /** Every completed build's wall-clock, newest last, capped. */
   durationsMs: [] as number[],
+  /** When this window started. THE FIELD THAT MAKES A ZERO READABLE. */
+  windowStartedAt: Date.now(),
 };
 
-/** A snapshot for the operator surface + the cost lane. */
+/** Start a fresh window, keeping the cache (which is not a counter). */
+function rollWindow(now: number): void {
+  counters.builds = 0;
+  counters.cacheHits = 0;
+  counters.cacheMisses = 0;
+  counters.failures = 0;
+  counters.timeouts = 0;
+  counters.memoryKills = 0;
+  counters.rejectedImports = 0;
+  counters.cpuMsTotal = 0;
+  counters.largestGraphBytes = 0;
+  counters.durationsMs = [];
+  counters.windowStartedAt = now;
+}
+
+function maybeRoll(now = Date.now()): void {
+  if (now - counters.windowStartedAt >= STATS_WINDOW_MS) rollWindow(now);
+}
+
+/**
+ * A snapshot for the operator surface + the cost lane.
+ *
+ * COUNTS AND DURATIONS ONLY. Never a canvas name, never a path, and never the
+ * text of a rejected import specifier — that specifier is written by the
+ * tenant, so it is their content; the operational fact is that a rejection
+ * happened, not what it said.
+ *
+ * `windowStartedAt` travels with the counters and is load-bearing. The window
+ * lives in memory, so a cell restart resets it — and without the start time a
+ * row of zeroes from a cell that rebooted a minute ago is indistinguishable
+ * from a genuinely quiet hour. One of those is nothing to do; the other is a
+ * crash loop.
+ *
+ * `cacheHitRatio` is offered for a human reading this payload directly, but
+ * the two COUNTS are what travel to the operator board, which divides at read
+ * time. A ratio computed over a window that reset is a confident lie.
+ */
 export function buildStats() {
+  maybeRoll();
   const d = [...counters.durationsMs].sort((a, b) => a - b);
   const p = (q: number) =>
     d.length === 0 ? null : d[Math.min(d.length - 1, Math.floor(d.length * q))];
@@ -71,20 +129,26 @@ export function buildStats() {
     failures: counters.failures,
     timeouts: counters.timeouts,
     memoryKills: counters.memoryKills,
+    rejectedImports: counters.rejectedImports,
+    cpuMsTotal: counters.cpuMsTotal,
+    largestGraphBytes: counters.largestGraphBytes,
     p50Ms: p(0.5),
     p95Ms: p(0.95),
+    maxMs: d.length === 0 ? null : d[d.length - 1],
+    windowMs: STATS_WINDOW_MS,
+    windowStartedAt: counters.windowStartedAt,
   };
 }
 
+/** Record one import the allowlist refused. The specifier is NOT passed in. */
+export function noteRejectedImport(): void {
+  maybeRoll();
+  counters.rejectedImports++;
+}
+
 /** Test seam. */
 export function _resetBuildStats(): void {
-  counters.builds = 0;
-  counters.cacheHits = 0;
-  counters.cacheMisses = 0;
-  counters.failures = 0;
-  counters.timeouts = 0;
-  counters.memoryKills = 0;
-  counters.durationsMs = [];
+  rollWindow(Date.now());
   cache.clear();
 }
 
@@ -154,6 +218,19 @@ function resolveCandidates(fromDir: string, spec: string): string[] {
   ];
 }
 
+/** Total bytes of every source a build could have to read. Sizes only. */
+function graphBytes(designRoot: string, canvasAbs: string): number {
+  let total = 0;
+  for (const file of relevantSources(designRoot, canvasAbs)) {
+    try {
+      total += statSync(file).size;
+    } catch {
+      /* a file that vanished contributes nothing rather than failing a build */
+    }
+  }
+  return total;
+}
+
 function remember(key: string, value: { js: string; locator: unknown; etag: string }): void {
   cache.set(key, value);
   while (cache.size > CACHE_MAX_ENTRIES) {
@@ -258,6 +335,7 @@ export async function buildCanvasSandboxed({
   canvasAbs: string;
   env?: NodeJS.ProcessEnv;
 }): Promise<SandboxBuildResult> {
+  maybeRoll();
   const key = cacheKeyFor(designRoot, canvasAbs);
   const hit = cache.get(key);
   if (hit) {
@@ -265,10 +343,18 @@ export async function buildCanvasSandboxed({
     return { ...hit, ok: true, cached: true };
   }
   counters.cacheMisses++;
+  // The pathological-canvas signal, measured rather than argued: a huge import
+  // graph burns our Active-CPU while the tenant pays a flat rate. Bytes, never
+  // filenames.
+  counters.largestGraphBytes = Math.max(
+    counters.largestGraphBytes,
+    graphBytes(designRoot, canvasAbs)
+  );
 
   const started = Date.now();
   const result = await runWorker({ designRoot, canvasAbs, env });
   const elapsed = Date.now() - started;
+  counters.cpuMsTotal += elapsed;
   counters.durationsMs.push(elapsed);
   if (counters.durationsMs.length > 200) counters.durationsMs.shift();
 
@@ -281,6 +367,7 @@ export async function buildCanvasSandboxed({
   counters.failures++;
   if (result.kind === 'timeout') counters.timeouts++;
   if (result.kind === 'memory') counters.memoryKills++;
+  counters.rejectedImports += result.rejectedImports ?? 0;
   return result;
 }
 
@@ -362,7 +449,12 @@ async function runWorker({
     if (parsed.ok) {
       return { ok: true, js: parsed.js, locator: parsed.locator, etag: parsed.etag, cached: false };
     }
-    return { ok: false, kind: 'build', error: String(parsed.error) };
+    return {
+      ok: false,
+      kind: 'build',
+      error: String(parsed.error),
+      rejectedImports: Number(parsed.rejectedImports ?? 0) || 0,
+    };
   } catch {
     return {
       ok: false,

package/apps/studio/canvas-build-worker.ts

@@ -79,7 +79,13 @@ main().catch((err) => {
   // the one who has to act on it. Bun collapses plugin throws into the build
   // log, so the allowlist's own wording survives in `err.message`.
   process.stdout.write(
-    JSON.stringify({ ok: false, error: String(err?.message ?? err).slice(0, 4000) })
+    JSON.stringify({
+      ok: false,
+      error: String(err?.message ?? err).slice(0, 4000),
+      // A NUMBER, never the specifiers. The host counts these; the strings
+      // stay between the canvas and the person who wrote it.
+      rejectedImports: Number(err?.rejectedImports ?? 0) || 0,
+    })
   );
   process.exit(1);
 });

package/apps/studio/canvas-build.ts

@@ -187,7 +187,15 @@ export async function buildCanvasModule(
     // "Bundle failed" log, so the allowlist records its own reasons and they
     // win here — the person who wrote the canvas has to be able to act on it,
     // and "Bundle failed" tells them nothing.
-    if (denials.length > 0) throw new Error(denials.map((d) => d.reason).join('\n'));
+    if (denials.length > 0) {
+      // The COUNT of denials travels with the error, so the cost lane can
+      // record that imports were refused without ever seeing the specifier —
+      // that string is tenant-authored content (Cloud Phase 26 Stage 4). The
+      // reasons still go to the person who wrote the canvas, unchanged.
+      const err = new Error(denials.map((d) => d.reason).join('\n'));
+      (err as Error & { rejectedImports?: number }).rejectedImports = denials.length;
+      throw err;
+    }
     const msg = built.logs.map((l) => l.message).join('\n');
     throw new Error(`Bun.build failed on ${canvasAbsPath}:\n${msg}`);
   }

package/apps/studio/client/app.jsx

@@ -628,6 +628,14 @@ const STICONS = {
       <path d="M4.3 9.5v2.3a1.2 1.2 0 0 0 2.4 0v-1.7" />
     </>
   ),
+  bug: (
+    <>
+      <circle cx="8" cy="9" r="3.6" />
+      <circle cx="8" cy="4.4" r="1.3" />
+      <path d="M6.2 3.4 5.2 2M9.8 3.4l1-1.4" />
+      <path d="M4.6 7.6H2.2M4.6 9H2.2M4.6 10.6H2.5M11.4 7.6h2.4M11.4 9h2.4M11.4 10.6h2.3" />
+    </>
+  ),
   'panel-left': (
     <>
       <rect x="2.5" y="3" width="11" height="10" rx="1.5" />
@@ -4115,6 +4123,16 @@ function Menubar({
           </button>
         )}
         {exportCenter && <ExportBadge center={exportCenter} />}
+        <button
+          type="button"
+          className="st-reportbug"
+          data-testid="report-bug-toggle"
+          aria-label="Report a bug"
+          data-tip="Report a bug"
+          onClick={onReportBug}
+        >
+          <StIcon name="bug" size={15} />
+        </button>
         <button
           type="button"
           className="st-whatsnew"

package/apps/studio/client/github.js

@@ -39,6 +39,13 @@ export const openVerification = () =>
  *  Rust side host-locks it to github.com. Throws on an older desktop build without
  *  the command — callers fall back to copy-to-clipboard. */
 export const openGitHubUrl = (url) => invoke('open_github_url', { url });
+/** Open a Maude Cloud URL (device activation, share view, dashboard) in the OS
+ *  browser. Native only — `window.open` is a silent no-op in WKWebView, which is
+ *  what stranded people mid-sign-in. The Rust side zone-locks it against the
+ *  address it resolves per call, so this argument can't widen where it goes.
+ *  Throws on an older desktop build without the command — every caller must keep
+ *  a visible link the person can use by hand. */
+export const openCloudUrl = (url) => invoke('open_cloud_url', { url });
 /** Show the device code as soon as the shell has it. Returns an unlisten promise. */
 export const onDeviceCode = (cb) => listen('github://device-code', cb);
 /** Fire when sign-in completes (any surface) so other surfaces can flip live. cb(login). */