@1agh/maude 0.54.0 → 0.56.0

package/apps/studio/cloud/endpoints.ts

@@ -17,10 +17,10 @@
 
 import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { dirname, join } from 'node:path';
+import { basename, dirname, join } from 'node:path';
 
 import { saveHubCredential } from '../sync/hub-link.ts';
-import { normalizeUrl } from '../sync/hubs-config.ts';
+import { getHubToken, normalizeUrl } from '../sync/hubs-config.ts';
 
 /**
  * Where Maude Cloud lives, resolved PER CALL rather than at module load.
@@ -109,18 +109,45 @@ async function cloudFetch(
 
 interface Ctx {
   paths: { repoRoot: string; designRoot: string };
+  /**
+   * The live sync runtime's owner (server.ts → sync/supervisor.ts). Optional:
+   * unit tests and any non-serving embedder construct a Ctx without one, and a
+   * missing supervisor degrades to exactly the old behaviour — linked on disk,
+   * syncing after the next start.
+   */
+  syncControl?: {
+    restart(linkedHub?: {
+      url: string;
+      linkedAt: number;
+      syncTsx?: boolean;
+    }): Promise<{ syncing: boolean; canvases: number; reason?: string; detail?: string }>;
+  };
 }
 
 export function createCloudEndpoints(ctx: Ctx) {
   return {
-    /** Signed in? Who? Cheap — reads the file, never the network. */
+    /**
+     * Signed in? Who? And WHICH folder is asking? Cheap — reads two files,
+     * never the network.
+     *
+     * `project` + `linkedHub` are the local half of the answer, and they exist
+     * for one reason: a maude:// link names a CLOUD project, and the person
+     * confirming it deserves to see which LOCAL folder is about to be attached
+     * to it. Both are already-public facts (a directory name, and the
+     * token-free `linkedHub` this same module writes into a committed
+     * config.json) — no credential material widens by being reported here.
+     */
     status(): CloudEndpointResult {
       const file = readCloudFile();
       return {
         status: 200,
-        json: file
-          ? { connected: true, email: file.email ?? null, url: file.url }
-          : { connected: false, url: cloudUrl() },
+        json: {
+          connected: !!file,
+          email: file?.email ?? null,
+          url: file ? file.url : cloudUrl(),
+          project: basename(ctx.paths.repoRoot),
+          linkedHub: readLinkedHub(),
+        },
       };
     },
 
@@ -211,7 +238,9 @@ export function createCloudEndpoints(ctx: Ctx) {
     /**
      * Attach THIS project to a cloud workspace: open → exchange at the cell →
      * store the hub credential + linkedHub, exactly as `maude design link`
-     * would. The sync agent picks the link up on the next server start.
+     * would — and then START SYNCING (linkToWorkspace cycles the live runtime
+     * through ctx.syncControl). Connecting is the whole gesture; there is no
+     * second step for the person to discover.
      */
     async attach(projectId: string): Promise<CloudEndpointResult> {
       const file = readCloudFile();
@@ -292,6 +321,34 @@ export function createCloudEndpoints(ctx: Ctx) {
     },
   };
 
+  /**
+   * The workspace this folder already answers to, if any. Address only.
+   *
+   * `credentialed` is the half that can be trusted. `config.json` is COMMITTED
+   * and travels with the repo, so a `linkedHub` in it is attacker-authorable:
+   * publish a template pointing at your own cell and the connect dialog would
+   * cheerfully print "this folder is already linked to <you>" — the strongest
+   * reassurance it can give, produced entirely by content the person merely
+   * opened (attacker pass 2026-08-04, B2). A stored hub credential for that
+   * address is the corroboration, because only a real sign-in writes one.
+   */
+  function readLinkedHub(): { url: string; credentialed: boolean } | null {
+    try {
+      const cfg = JSON.parse(readFileSync(join(ctx.paths.designRoot, 'config.json'), 'utf8'));
+      const url = cfg?.linkedHub?.url;
+      if (typeof url !== 'string' || !url) return null;
+      let credentialed = false;
+      try {
+        credentialed = !!getHubToken(normalizeUrl(url));
+      } catch {
+        /* unreadable credential store → treat as uncorroborated */
+      }
+      return { url, credentialed };
+    } catch {
+      return null; // absent/malformed → simply not linked
+    }
+  }
+
   /** The shared tail of every attach: cell exchange → credential + linkedHub. */
   async function linkToWorkspace({
     workspaceUrl,
@@ -338,9 +395,42 @@ export function createCloudEndpoints(ctx: Ctx) {
     } catch {
       /* absent/malformed → start minimal */
     }
-    cfg.linkedHub = { url: norm, linkedAt: Date.now() };
+    const linkedHub: { url: string; linkedAt: number; syncTsx?: boolean } = {
+      url: norm,
+      linkedAt: Date.now(),
+    };
+    // Carry a project-wide TSX opt-out across the re-link. Only the RESTRICTIVE
+    // direction is carried (`false`, never `true`): somebody who turned canvas
+    // BODIES off (DDR-072/DDR-079) did so deliberately, and silently re-enabling
+    // them on the next Connect would start uploading source they opted out of.
+    // It never mattered while nothing synced until a restart; it does now.
+    const prior = (cfg as { linkedHub?: { syncTsx?: boolean } }).linkedHub;
+    if (prior?.syncTsx === false) linkedHub.syncTsx = false;
+    cfg.linkedHub = linkedHub;
     writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}\n`, 'utf8');
 
+    // START SYNCING — do not hand the person a "restart the server" note and
+    // call the job done. The runtime captures linkedHub once at boot, so this
+    // cycles it in place, with the value we JUST wrote (never re-read from the
+    // committed config file). Best-effort: a supervisor-less embedder, or a
+    // runtime that declines, still leaves a correctly linked project behind.
+    let sync: { syncing: boolean; canvases: number; reason?: string; detail?: string } = {
+      syncing: false,
+      canvases: 0,
+      reason: 'no-supervisor',
+      detail: 'Restart Maude to start syncing.',
+    };
+    try {
+      sync = (await ctx.syncControl?.restart(linkedHub)) ?? sync;
+    } catch (err) {
+      sync = {
+        syncing: false,
+        canvases: 0,
+        reason: 'error',
+        detail: `Linked, but syncing could not start: ${(err as Error).message}`,
+      };
+    }
+
     return {
       status: 200,
       json: {
@@ -348,7 +438,12 @@ export function createCloudEndpoints(ctx: Ctx) {
         url: norm,
         role: role ?? null,
         project: project ?? null,
-        note: 'Linked. Restart the studio server to start syncing.',
+        sync,
+        // Kept for older clients (and the CLI) that read `note` — now it
+        // reports what actually happened instead of assigning homework.
+        note: sync.syncing
+          ? `Linked — syncing ${sync.canvases} canvas${sync.canvases === 1 ? '' : 'es'}.`
+          : `Linked. ${sync.detail ?? 'Restart Maude to start syncing.'}`,
       },
     };
   }

package/apps/studio/collab/persistence.ts

@@ -8,6 +8,9 @@ import * as Y from 'yjs';
 
 import type { Api } from '../api.ts';
 import type { Context } from '../context.ts';
+// From the LEAF, never from `sync/codec.ts` — codec imports `Y_TYPES` from this
+// file, so reaching for it here would close a cycle (see sync/limits.ts).
+import { MAX_ANNOTATIONS_BYTES, MAX_COMMENTS_BYTES, withinByteCap } from '../sync/limits.ts';
 import { ensureStateDir, type RoomCallbacks } from './room.ts';
 
 /**
@@ -55,6 +58,26 @@ export interface PersistenceDeps {
  * skipped when the Y type is empty / unset — the JSON file stays whatever
  * the prior legacy write produced.
  */
+/**
+ * DDR-064 pre-cutover checklist — cap the doc→disk lane for comments and
+ * annotations.
+ *
+ * The codec's `MAX_*_BYTES` guard the FILE→DOC direction. This is the other
+ * one, and until shared-doc it barely mattered: the room's doc was populated
+ * only by browsers on this machine. Under a shared doc it is populated by the
+ * hub, so an oversized array pushed by a peer (or by a hostile hub — DDR-054's
+ * threat model, §2d) would be materialized to this disk unbounded. Same ceiling
+ * as the import lane, so a value that could never be imported can never be
+ * written either.
+ *
+ * Refuses the WRITE, not the sync: the doc keeps the value and the peers keep
+ * converging. What is withheld is turning somebody else's blob into our disk.
+ * Shared with `sync/projection.ts`'s equivalent guard via `sync/limits.ts`.
+ */
+function withinCap(slug: string, lane: string, value: string, max: number): boolean {
+  return withinByteCap(`collab/${slug}`, lane, Buffer.byteLength(value, 'utf8'), max);
+}
+
 export function createPersistence(deps: PersistenceDeps): RoomCallbacks {
   const { ctx, api, fileForSlug } = deps;
   const stateDir = ensureStateDir(ctx.paths.designRoot);
@@ -135,14 +158,18 @@ export function createPersistence(deps: PersistenceDeps): RoomCallbacks {
     const list = arr.toArray() as Parameters<Api['saveCommentsForFile']>[1];
     if (list.length > 0) seenComments.add(slug);
     if (list.length > 0 || seenComments.has(slug)) {
-      await api.saveCommentsForFile(file, list);
+      if (withinCap(slug, 'comments', JSON.stringify(list), MAX_COMMENTS_BYTES)) {
+        await api.saveCommentsForFile(file, list);
+      }
     }
 
     // Annotations — Y.Map.svg → annotations.svg file. Task 5.
     const map = doc.getMap<unknown>(Y_TYPES.annotations);
     const svg = map.get('svg');
     if (typeof svg === 'string' && svg) {
-      await api.saveAnnotations(file, svg);
+      if (withinCap(slug, 'annotations', svg, MAX_ANNOTATIONS_BYTES)) {
+        await api.saveAnnotations(file, svg);
+      }
     }
   }
 

package/apps/studio/config.schema.json

@@ -259,12 +259,12 @@
         },
         "transcription": {
           "type": "object",
-          "description": "Speech-to-text / subtitle engine preference (Task 2.6, DDR-164). The engine is an EXPLICIT user choice, never an automatic fallback: a chosen-but-unavailable engine errors clearly and Maude never silently switches to another. `maude design transcribe --provider` overrides this per-call.",
+          "description": "Speech-to-text / subtitle engine preference (Task 2.6, DDR-164). The engine is never switched behind your back: a chosen-but-unavailable engine errors clearly, and `auto` — a mode you SELECT — resolves to the best engine this machine is set up for while stating which one it picked. `maude design transcribe --provider` overrides this per-call.",
           "properties": {
             "provider": {
               "type": "string",
-              "enum": ["whisper", "elevenlabs", "groq"],
-              "description": "Which engine transcribes when no --provider flag is given. `whisper` = local whisper.cpp (free, offline, no key); `elevenlabs` = ElevenLabs Scribe (cloud, key); `groq` = Groq Whisper (cloud, key). Absent ⇒ whisper.",
+              "enum": ["auto", "whisper", "elevenlabs", "groq"],
+              "description": "Which engine transcribes when no --provider flag is given. `auto` = use the cloud engine whose key is set (ElevenLabs Scribe first), else local whisper — the UI and the CLI both state what it resolved to; `whisper` = local whisper.cpp (free, offline, no key); `elevenlabs` = ElevenLabs Scribe (cloud, key, audio leaves the machine); `groq` = Groq Whisper (cloud, key). Absent ⇒ whisper.",
               "default": "whisper"
             },
             "model": {

package/apps/studio/context.ts

@@ -182,6 +182,22 @@ export interface Context {
    * gates behavior starting in Phase B.
    */
   sharedDoc?: boolean;
+  /**
+   * The live sync runtime's owner, set by server.ts once it exists. Present so
+   * the cloud attach lane can START SYNCING the moment a person links a
+   * project, instead of leaving them holding a "restart the studio server"
+   * note with no button behind it. Structural type (not the SyncSupervisor
+   * import) so context.ts stays free of the sync module graph — tests and the
+   * non-serving entry points construct a Context without one.
+   */
+  syncControl?: {
+    restart(linkedHub?: LinkedHub): Promise<{
+      syncing: boolean;
+      canvases: number;
+      reason?: string;
+      detail?: string;
+    }>;
+  };
 }
 
 function resolveRepoRoot(): string {
@@ -364,6 +380,12 @@ export function reloadConfig(ctx: Context): boolean {
   // (syncTsx gating) drift out of step with the hub the socket is actually
   // attached to — and a poisoned config must never re-point sync without a
   // restart (DDR-149 fan-out review).
+  //
+  // This is a rule about the FILE, and it stays. The one path that may change
+  // the live link is `adoptLinkedHub` below: a person pressing Connect in
+  // trusted app chrome, whose hub credential this same process just stored.
+  // That path cycles the runtime itself (sync/supervisor.ts) instead of hoping
+  // a watcher notices.
   if (JSON.stringify(next.linkedHub) !== JSON.stringify(ctx.cfg.linkedHub)) {
     console.warn('  warn: linkedHub changed — not hot-reloadable, restart the server to apply.');
     if (ctx.cfg.linkedHub === undefined) delete next.linkedHub;
@@ -389,3 +411,22 @@ export function reloadConfig(ctx: Context): boolean {
     ctx.cfg.canvasGroups.find((g) => /system/i.test(g.path))?.path ?? 'system';
   return true;
 }
+
+/**
+ * Adopt a link the person just authorized — the ONE way `cfg.linkedHub` may
+ * change on a running server.
+ *
+ * The value is passed BY VALUE from the attach lane (cloud/endpoints.ts), which
+ * exchanged it against the configured cloud address and stored the matching hub
+ * credential moments earlier. It is deliberately NOT re-read from
+ * `.design/config.json`: that file is committed, shared, and writable by
+ * anything else on the machine, and re-reading it here would hand the
+ * file-watcher's refused capability (reloadConfig above) back through a side
+ * door. What the person consented to is what gets applied.
+ *
+ * Callers must cycle the sync runtime afterwards — `createSyncSupervisor`
+ * (sync/supervisor.ts) does both in one step, and is the only intended caller.
+ */
+export function adoptLinkedHub(ctx: Context, linkedHub: LinkedHub): void {
+  ctx.cfg.linkedHub = linkedHub;
+}