@1agh/maude 0.55.0 → 0.56.0

package/apps/studio/collab/persistence.ts

@@ -8,6 +8,9 @@ import * as Y from 'yjs';
 
 import type { Api } from '../api.ts';
 import type { Context } from '../context.ts';
+// From the LEAF, never from `sync/codec.ts` — codec imports `Y_TYPES` from this
+// file, so reaching for it here would close a cycle (see sync/limits.ts).
+import { MAX_ANNOTATIONS_BYTES, MAX_COMMENTS_BYTES, withinByteCap } from '../sync/limits.ts';
 import { ensureStateDir, type RoomCallbacks } from './room.ts';
 
 /**
@@ -55,6 +58,26 @@ export interface PersistenceDeps {
  * skipped when the Y type is empty / unset — the JSON file stays whatever
  * the prior legacy write produced.
  */
+/**
+ * DDR-064 pre-cutover checklist — cap the doc→disk lane for comments and
+ * annotations.
+ *
+ * The codec's `MAX_*_BYTES` guard the FILE→DOC direction. This is the other
+ * one, and until shared-doc it barely mattered: the room's doc was populated
+ * only by browsers on this machine. Under a shared doc it is populated by the
+ * hub, so an oversized array pushed by a peer (or by a hostile hub — DDR-054's
+ * threat model, §2d) would be materialized to this disk unbounded. Same ceiling
+ * as the import lane, so a value that could never be imported can never be
+ * written either.
+ *
+ * Refuses the WRITE, not the sync: the doc keeps the value and the peers keep
+ * converging. What is withheld is turning somebody else's blob into our disk.
+ * Shared with `sync/projection.ts`'s equivalent guard via `sync/limits.ts`.
+ */
+function withinCap(slug: string, lane: string, value: string, max: number): boolean {
+  return withinByteCap(`collab/${slug}`, lane, Buffer.byteLength(value, 'utf8'), max);
+}
+
 export function createPersistence(deps: PersistenceDeps): RoomCallbacks {
   const { ctx, api, fileForSlug } = deps;
   const stateDir = ensureStateDir(ctx.paths.designRoot);
@@ -135,14 +158,18 @@ export function createPersistence(deps: PersistenceDeps): RoomCallbacks {
     const list = arr.toArray() as Parameters<Api['saveCommentsForFile']>[1];
     if (list.length > 0) seenComments.add(slug);
     if (list.length > 0 || seenComments.has(slug)) {
-      await api.saveCommentsForFile(file, list);
+      if (withinCap(slug, 'comments', JSON.stringify(list), MAX_COMMENTS_BYTES)) {
+        await api.saveCommentsForFile(file, list);
+      }
     }
 
     // Annotations — Y.Map.svg → annotations.svg file. Task 5.
     const map = doc.getMap<unknown>(Y_TYPES.annotations);
     const svg = map.get('svg');
     if (typeof svg === 'string' && svg) {
-      await api.saveAnnotations(file, svg);
+      if (withinCap(slug, 'annotations', svg, MAX_ANNOTATIONS_BYTES)) {
+        await api.saveAnnotations(file, svg);
+      }
     }
   }
 

package/apps/studio/config.schema.json

@@ -259,12 +259,12 @@
         },
         "transcription": {
           "type": "object",
-          "description": "Speech-to-text / subtitle engine preference (Task 2.6, DDR-164). The engine is an EXPLICIT user choice, never an automatic fallback: a chosen-but-unavailable engine errors clearly and Maude never silently switches to another. `maude design transcribe --provider` overrides this per-call.",
+          "description": "Speech-to-text / subtitle engine preference (Task 2.6, DDR-164). The engine is never switched behind your back: a chosen-but-unavailable engine errors clearly, and `auto` — a mode you SELECT — resolves to the best engine this machine is set up for while stating which one it picked. `maude design transcribe --provider` overrides this per-call.",
           "properties": {
             "provider": {
               "type": "string",
-              "enum": ["whisper", "elevenlabs", "groq"],
-              "description": "Which engine transcribes when no --provider flag is given. `whisper` = local whisper.cpp (free, offline, no key); `elevenlabs` = ElevenLabs Scribe (cloud, key); `groq` = Groq Whisper (cloud, key). Absent ⇒ whisper.",
+              "enum": ["auto", "whisper", "elevenlabs", "groq"],
+              "description": "Which engine transcribes when no --provider flag is given. `auto` = use the cloud engine whose key is set (ElevenLabs Scribe first), else local whisper — the UI and the CLI both state what it resolved to; `whisper` = local whisper.cpp (free, offline, no key); `elevenlabs` = ElevenLabs Scribe (cloud, key, audio leaves the machine); `groq` = Groq Whisper (cloud, key). Absent ⇒ whisper.",
               "default": "whisper"
             },
             "model": {

package/apps/studio/context.ts

@@ -182,6 +182,22 @@ export interface Context {
    * gates behavior starting in Phase B.
    */
   sharedDoc?: boolean;
+  /**
+   * The live sync runtime's owner, set by server.ts once it exists. Present so
+   * the cloud attach lane can START SYNCING the moment a person links a
+   * project, instead of leaving them holding a "restart the studio server"
+   * note with no button behind it. Structural type (not the SyncSupervisor
+   * import) so context.ts stays free of the sync module graph — tests and the
+   * non-serving entry points construct a Context without one.
+   */
+  syncControl?: {
+    restart(linkedHub?: LinkedHub): Promise<{
+      syncing: boolean;
+      canvases: number;
+      reason?: string;
+      detail?: string;
+    }>;
+  };
 }
 
 function resolveRepoRoot(): string {
@@ -364,6 +380,12 @@ export function reloadConfig(ctx: Context): boolean {
   // (syncTsx gating) drift out of step with the hub the socket is actually
   // attached to — and a poisoned config must never re-point sync without a
   // restart (DDR-149 fan-out review).
+  //
+  // This is a rule about the FILE, and it stays. The one path that may change
+  // the live link is `adoptLinkedHub` below: a person pressing Connect in
+  // trusted app chrome, whose hub credential this same process just stored.
+  // That path cycles the runtime itself (sync/supervisor.ts) instead of hoping
+  // a watcher notices.
   if (JSON.stringify(next.linkedHub) !== JSON.stringify(ctx.cfg.linkedHub)) {
     console.warn('  warn: linkedHub changed — not hot-reloadable, restart the server to apply.');
     if (ctx.cfg.linkedHub === undefined) delete next.linkedHub;
@@ -389,3 +411,22 @@ export function reloadConfig(ctx: Context): boolean {
     ctx.cfg.canvasGroups.find((g) => /system/i.test(g.path))?.path ?? 'system';
   return true;
 }
+
+/**
+ * Adopt a link the person just authorized — the ONE way `cfg.linkedHub` may
+ * change on a running server.
+ *
+ * The value is passed BY VALUE from the attach lane (cloud/endpoints.ts), which
+ * exchanged it against the configured cloud address and stored the matching hub
+ * credential moments earlier. It is deliberately NOT re-read from
+ * `.design/config.json`: that file is committed, shared, and writable by
+ * anything else on the machine, and re-reading it here would hand the
+ * file-watcher's refused capability (reloadConfig above) back through a side
+ * door. What the person consented to is what gets applied.
+ *
+ * Callers must cycle the sync runtime afterwards — `createSyncSupervisor`
+ * (sync/supervisor.ts) does both in one step, and is the only intended caller.
+ */
+export function adoptLinkedHub(ctx: Context, linkedHub: LinkedHub): void {
+  ctx.cfg.linkedHub = linkedHub;
+}