@1agh/maude 0.55.0 → 0.57.0

package/apps/studio/sync/supervisor.ts

@@ -0,0 +1,178 @@
+// Sync supervisor — one owner of the live sync runtime, so linking a project
+// can START SYNCING instead of asking a person to restart the app.
+//
+// Why this exists: `createSyncRuntime` captures `cfg.linkedHub` once, and
+// `reloadConfig` deliberately refuses to hot-swap it (a config.json is
+// committed and travels with the repo — a poisoned one must never re-point the
+// sync socket, DDR-149). That rule is about the FILE WATCHER, and it was being
+// paid for by the person: after pressing Connect in the cloud panel the whole
+// product did nothing visible and the UI said "restart the studio server to
+// start syncing" — a sentence with no button behind it, and no meaning at all
+// inside the desktop app, where there is no server the person can see.
+//
+// The supervisor separates the two paths that were conflated:
+//
+//   • a linkedHub arriving from DISK        → still boot-pinned, still refused;
+//   • a linkedHub the person JUST AUTHORIZED in trusted app chrome, whose hub
+//     credential this process itself stored one line earlier → adopted in
+//     memory and applied by a real stop() + start() cycle.
+//
+// The second path never reads the value back off disk: `restart()` takes the
+// LinkedHub object the attach lane just wrote, so nothing that happens to
+// `.design/config.json` in between can steer the socket.
+
+import { adoptLinkedHub, type Context, type LinkedHub } from '../context.ts';
+import { resolveCellPairing } from './cell-pairing.ts';
+import { getHubToken } from './hubs-config.ts';
+import {
+  type CreateSyncRuntimeOptions,
+  checkUrlScheme,
+  createSyncRuntime,
+  type SyncRuntime,
+} from './index.ts';
+
+/**
+ * What happened when the runtime was (re)started — the honest answer the cloud
+ * panel repeats back to the person. `syncing:false` is never silent: `reason`
+ * is what to say, and the caller renders it verbatim rather than guessing.
+ */
+export interface SyncStartOutcome {
+  syncing: boolean;
+  /** Canvases the runtime actually took ownership of. */
+  canvases: number;
+  /** Machine-readable cause when `syncing` is false. */
+  reason?: 'unlinked' | 'no-credential' | 'insecure-url' | 'refused' | 'nothing-syncable' | 'error';
+  /** One sentence a person can act on. Present whenever `syncing` is false. */
+  detail?: string;
+}
+
+export interface SyncSupervisor {
+  /** Boot the runtime from the config as loaded. Safe when unlinked. */
+  start(): Promise<SyncStartOutcome>;
+  /**
+   * Adopt a just-authorized link and cycle the runtime. `linkedHub` is passed
+   * BY VALUE from the attach lane on purpose — never re-read from disk.
+   */
+  restart(linkedHub?: LinkedHub): Promise<SyncStartOutcome>;
+  stop(): Promise<void>;
+  /** The live runtime, or null in solo mode. Test/inspection surface. */
+  current(): SyncRuntime | null;
+}
+
+/**
+ * Why did `createSyncRuntime` decline? It logs its refusals and returns null,
+ * which is right for a boot path and useless for a dialog. Re-derive the cause
+ * from the same inputs so the panel can say something true. Kept in this order
+ * deliberately — it mirrors the guard order in createSyncRuntime.
+ */
+function diagnose(ctx: Context): { reason: SyncStartOutcome['reason']; detail: string } {
+  // Cell pairing supplies its own hub URL + credential from the environment, so
+  // "no linkedHub on disk" is not the diagnosis there — reporting "not linked to
+  // a workspace" for a cell that IS paired would send an operator looking for a
+  // config field that has nothing to do with it. Both pairing outcomes (refused
+  // to resolve, or resolved but the runtime still declined) return here — a
+  // successfully-resolved pairing always carries a non-empty `url`
+  // (`resolveCellPairing` refuses an empty one), so there is no "unlinked"
+  // state to fall through to on this path, unlike the plain linkedHub case below.
+  const { pairing, detail: pairingRefusal } = resolveCellPairing();
+  if (pairingRefusal) {
+    return { reason: 'refused', detail: pairingRefusal };
+  }
+  if (pairing) {
+    return {
+      reason: 'refused',
+      detail: 'Cell pairing is on but syncing did not start — see the server log for why.',
+    };
+  }
+  const linked = ctx.cfg.linkedHub;
+  if (!linked) {
+    return { reason: 'unlinked', detail: 'This project is not linked to a workspace.' };
+  }
+  const scheme = checkUrlScheme(linked.url);
+  if (scheme) {
+    return { reason: 'insecure-url', detail: scheme };
+  }
+  if (!getHubToken(linked.url)) {
+    return {
+      reason: 'no-credential',
+      detail: 'No sign-in for this workspace is stored on this machine yet.',
+    };
+  }
+  return {
+    reason: 'refused',
+    detail: 'Syncing is switched off in this environment — see the server log for why.',
+  };
+}
+
+export function createSyncSupervisor(
+  ctx: Context,
+  opts: CreateSyncRuntimeOptions = {},
+  factory: (c: Context, o: CreateSyncRuntimeOptions) => SyncRuntime | null = createSyncRuntime
+): SyncSupervisor {
+  let runtime: SyncRuntime | null = null;
+  // Two Connects pressed in quick succession must not interleave a stop() with
+  // another cycle's start() — the second would attach providers the first is
+  // still tearing down. One chain, in order.
+  let chain: Promise<unknown> = Promise.resolve();
+
+  async function boot(): Promise<SyncStartOutcome> {
+    runtime = factory(ctx, opts);
+    if (!runtime) return { syncing: false, canvases: 0, ...diagnose(ctx) };
+    try {
+      await runtime.start();
+    } catch (err) {
+      // Same posture as the boot path: a failed sync start never takes the
+      // server (or the attach response) down with it — solo mode continues.
+      console.error('[sync] start failed — continuing in solo mode:', err);
+      return {
+        syncing: false,
+        canvases: 0,
+        reason: 'error',
+        detail: `Syncing could not start: ${(err as Error).message}`,
+      };
+    }
+    const canvases = runtime.size();
+    if (canvases === 0) {
+      // Linked and authenticated, but nothing on disk qualifies. The runtime
+      // already wrote the full reason into `_sync.json` (9.1-D); reuse it
+      // rather than inventing a second explanation that can drift from it.
+      const status = runtime.status() as { reason?: string } | null;
+      return {
+        syncing: false,
+        canvases: 0,
+        reason: 'nothing-syncable',
+        detail: status?.reason ?? 'No canvases in this project are syncable yet.',
+      };
+    }
+    return { syncing: true, canvases };
+  }
+
+  function serialize<T>(work: () => Promise<T>): Promise<T> {
+    const next = chain.then(work, work);
+    // Keep the chain alive even when a link fails — the NEXT attach must still
+    // be able to run. (A rejected chain would poison every later restart.)
+    chain = next.catch(() => {});
+    return next;
+  }
+
+  return {
+    start: () => serialize(boot),
+    restart: (linkedHub) =>
+      serialize(async () => {
+        try {
+          await runtime?.stop();
+        } catch (err) {
+          console.error('[sync] stop before restart failed:', err);
+        }
+        runtime = null;
+        if (linkedHub) adoptLinkedHub(ctx, linkedHub);
+        return boot();
+      }),
+    stop: () =>
+      serialize(async () => {
+        await runtime?.stop();
+        runtime = null;
+      }),
+    current: () => runtime,
+  };
+}

package/apps/studio/test/acp-activity-endpoint.test.ts

@@ -0,0 +1,183 @@
+// feature-acp-turn-notifications Task 2/3 — the activity snapshot the native
+// shell's poller reads (notify.rs Task 5) to decide whether to fire an OS
+// notification for a project that isn't the visible one. Covers:
+//   • activitySnapshot() shape + monotonic seq (bumps only on real change).
+//   • AcpBridge.awaitingInputCount reflects pending permission requests.
+//   • The Acp manager's registered probe reports 'awaiting-input', not
+//     'running', for a chat blocked on a permission prompt — the ordering
+//     Task 2's gotcha calls out explicitly.
+//   • /_api/acp/activity is absent from both canvas-origin allowlists
+//     (Decision: NEITHER, like /_api/acp/running today).
+
+import { afterEach, describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import type { ServerWebSocket } from 'bun';
+
+import { AcpBridge } from '../acp/bridge.ts';
+import { createAcp } from '../acp/index.ts';
+import { activitySnapshot, registerActivityProbe } from '../acp/running.ts';
+import type { Context } from '../context.ts';
+import type { WsData } from '../ws.ts';
+
+const FIXTURE = join(import.meta.dir, 'fixtures', 'mock-acp-agent-permission.mjs');
+const TEST_ENV_KEYS = ['MAUDE_ACP_ADAPTER_ENTRY', 'MAUDE_ACP_RUNTIME', 'MAUDE_CLAUDE_BIN'];
+
+function useMockAgent() {
+  process.env.MAUDE_ACP_ADAPTER_ENTRY = FIXTURE;
+  process.env.MAUDE_ACP_RUNTIME = process.execPath;
+  process.env.MAUDE_CLAUDE_BIN = process.execPath;
+}
+
+afterEach(() => {
+  for (const key of TEST_ENV_KEYS) delete process.env[key];
+  // Restore a no-op probe so a later file's `registerRunningChatsProbe`-style
+  // module-level state doesn't leak a stale closure across test files.
+  registerActivityProbe(() => []);
+});
+
+async function until<T>(fn: () => T | undefined, timeoutMs = 12000): Promise<T> {
+  const start = performance.now();
+  for (;;) {
+    const v = fn();
+    if (v !== undefined) return v;
+    if (performance.now() - start > timeoutMs) throw new Error('timeout waiting for condition');
+    await new Promise((r) => setTimeout(r, 25));
+  }
+}
+
+function fakeWs(id: string) {
+  const frames: Array<Record<string, unknown>> = [];
+  const ws = {
+    data: { id } as WsData,
+    send: (raw: string) => {
+      frames.push(JSON.parse(raw));
+    },
+  } as unknown as ServerWebSocket<WsData>;
+  return { ws, frames };
+}
+
+describe('activitySnapshot (running.ts)', () => {
+  test('reflects the registered probe and never throws on a bad one', () => {
+    registerActivityProbe(() => [{ chatId: 'a', state: 'running' }]);
+    expect(activitySnapshot().chats).toEqual([{ chatId: 'a', state: 'running' }]);
+
+    registerActivityProbe(() => {
+      throw new Error('boom');
+    });
+    expect(activitySnapshot().chats).toEqual([]);
+  });
+
+  test('seq bumps only when the (chatId, state) set actually changes', () => {
+    registerActivityProbe(() => [{ chatId: 'a', state: 'idle' }]);
+    const first = activitySnapshot().seq;
+    const second = activitySnapshot().seq; // same state — no bump
+    expect(second).toBe(first);
+
+    registerActivityProbe(() => [{ chatId: 'a', state: 'running' }]);
+    const third = activitySnapshot().seq; // real transition — bumps
+    expect(third).toBe(first + 1);
+
+    // Enumeration-order shuffle with the SAME states must NOT bump.
+    registerActivityProbe(() => [
+      { chatId: 'b', state: 'idle' },
+      { chatId: 'a', state: 'running' },
+    ]);
+    activitySnapshot();
+    registerActivityProbe(() => [
+      { chatId: 'a', state: 'running' },
+      { chatId: 'b', state: 'idle' },
+    ]);
+    const fourth = activitySnapshot().seq;
+    const fifth = activitySnapshot().seq;
+    expect(fifth).toBe(fourth);
+  });
+});
+
+describe('AcpBridge.awaitingInputCount + the manager probe (Task 2 gotcha: awaiting-input wins over running)', () => {
+  test('a pending permission request reports awaiting-input, not running', async () => {
+    useMockAgent();
+    const ctx = {
+      paths: { repoRoot: process.cwd(), designRoot: '/tmp/does-not-matter-activity' },
+    } as unknown as Context;
+    const acp = createAcp(ctx);
+
+    const a = fakeWs('activity-ws-a');
+    try {
+      acp.onOpen(a.ws);
+      acp.onMessage(a.ws, JSON.stringify({ t: 'prompt', text: 'hi', chat: 'activity-chat' }));
+      const reqFrame = await until(() => a.frames.find((f) => f.t === 'permission-request'));
+
+      const snap = activitySnapshot();
+      expect(snap.chats).toContainEqual({ chatId: 'activity-chat', state: 'awaiting-input' });
+
+      acp.onMessage(
+        a.ws,
+        JSON.stringify({ t: 'permission-response', id: reqFrame.id, decision: 'allow-once' })
+      );
+      await until(() => a.frames.find((f) => f.t === 'turn-end'));
+
+      // Turn settled — no longer awaiting-input (running or idle, never stuck).
+      const after = activitySnapshot().chats.find((c) => c.chatId === 'activity-chat');
+      expect(after?.state).not.toBe('awaiting-input');
+    } finally {
+      acp.onClose(a.ws);
+      acp.stopAll();
+      await new Promise((r) => setTimeout(r, 50));
+    }
+  }, 20000);
+});
+
+describe('AcpBridge.awaitingInputCount — direct unit', () => {
+  test('starts at 0 and counts a pending permission before resolution', async () => {
+    useMockAgent();
+    const bridge = new AcpBridge({ repoRoot: process.cwd(), onUpdate: () => {} });
+    expect(bridge.awaitingInputCount).toBe(0);
+    try {
+      const promptPromise = bridge.prompt('hi', 'c1');
+      await until(() => (bridge.awaitingInputCount > 0 ? true : undefined));
+      expect(bridge.awaitingInputCount).toBe(1);
+      await bridge.cancel(); // denies the pending request rather than hanging
+      await promptPromise;
+      expect(bridge.awaitingInputCount).toBe(0);
+    } finally {
+      await bridge.stop();
+    }
+  }, 15000);
+});
+
+describe('/_api/acp/activity — NEITHER canvas-origin allowlist (Decision D + dual-allowlist rule)', () => {
+  const httpSrc = readFileSync(join(import.meta.dir, '..', 'http.ts'), 'utf8');
+  const serverSrc = readFileSync(join(import.meta.dir, '..', 'server.ts'), 'utf8');
+
+  test('the route exists on the main-origin route table', () => {
+    expect(httpSrc).toContain("'/_api/acp/activity'");
+  });
+
+  test('is absent from CANVAS_SAFE_API', () => {
+    const start = httpSrc.indexOf('CANVAS_SAFE_API = new Set([');
+    const end = httpSrc.indexOf(']);', start);
+    expect(start).toBeGreaterThan(-1);
+    const block = httpSrc.slice(start, end);
+    expect(block).not.toContain('/_api/acp/activity');
+  });
+
+  test("is absent from startCanvasServer's routes map", () => {
+    const start = serverSrc.indexOf('function startCanvasServer');
+    const routesEnd = serverSrc.indexOf('async fetch(req, srv)', start);
+    expect(start).toBeGreaterThan(-1);
+    const block = serverSrc.slice(start, routesEnd);
+    expect(block).not.toContain('/_api/acp/activity');
+  });
+
+  test('the payload never carries a chat title, message text, or transcript field name', () => {
+    // Grep the route handler body itself (not the whole file) for the fields
+    // Decision D forbids — a title/text field appearing HERE would mean
+    // someone widened the payload without reading the comment.
+    const start = httpSrc.indexOf("'/_api/acp/activity':");
+    const end = httpSrc.indexOf('},', start);
+    const block = httpSrc.slice(start, end);
+    expect(block).not.toMatch(/title|message|transcript|content/i);
+  });
+});

package/apps/studio/test/acp-branch-guard.test.ts

@@ -0,0 +1,123 @@
+// feature-acp-write-path-scope Addendum, Task 9 — the branch-switch warning.
+//
+// `RepoBranchSwitcher.jsx` has THREE `window.location.reload()` call sites
+// (`switchDraft`, `createDraft`, and the local-merge fold in `foldDraft`). All
+// three move the worktree, so all three need the gate; covering one and missing
+// two is the easy mistake, which is why the source-shape assertion below exists
+// alongside the copy tests.
+//
+// Why the wording matters enough to test: this is a safety prompt, and Task 8
+// changed what is TRUE about it. Before, the reload killed the running turn, so
+// "this will stop it" was accurate. Now the bridge outlives its socket, so the
+// turn keeps going — into a worktree that has moved under it. "Will stop it"
+// would now be false in the reassuring direction.
+
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { chatGuardCopy } from '../client/panels/RepoBranchSwitcher.jsx';
+
+describe('chatGuardCopy', () => {
+  const one = chatGuardCopy({ count: 1, branch: 'draft-a', verb: 'switch to “main”' });
+
+  test('names the branch, the action, and the real consequence', () => {
+    expect(one.title).toBe('A chat is working right now');
+    expect(one.body).toContain('draft-a');
+    expect(one.body).toContain('switch to “main”');
+    expect(one.body).toContain('wrong branch');
+  });
+
+  test('does NOT claim the switch stops the chat (it no longer does — Task 8)', () => {
+    const all = `${one.title} ${one.body} ${one.meta}`.toLowerCase();
+    expect(all).not.toContain('will stop it');
+    // …and it does say the thing that IS true: the agent is actively editing.
+    expect(one.body).toContain('editing files on');
+  });
+
+  test('is honest that History cannot undo this', () => {
+    // The `_history/` snapshot stack is per-canvas-slug with NO branch
+    // awareness, so the "it's reversible" reassurance this whole feature leans
+    // on genuinely does not hold across a checkout. Promising rollback here
+    // would be the one lie that makes the confirm worse than no confirm.
+    expect(one.body).toContain("History can't undo");
+  });
+
+  test('pluralizes when several chats are running', () => {
+    expect(chatGuardCopy({ count: 3, branch: 'x', verb: 'y' }).title).toBe(
+      '3 chats are working right now'
+    );
+  });
+
+  test('the confirm is not the safe default', () => {
+    // "Wait" is the cancel; "Do it anyway" is the deliberate, phrased-as-a-risk
+    // confirm. A neutral "OK/Cancel" pair would read as routine.
+    expect(one.cancel).toBe('Wait');
+    expect(one.confirm).toBe('Do it anyway');
+  });
+});
+
+describe('all THREE reload call sites are gated', () => {
+  const src = readFileSync(
+    join(import.meta.dir, '..', 'client', 'panels', 'RepoBranchSwitcher.jsx'),
+    'utf8'
+  );
+
+  test('every reload lives in a `do*` action reached only through guardedByChat', () => {
+    // Source-shape guard rather than a render test: the failure mode is a
+    // FOURTH reload being added later without a gate, which no render test of
+    // the existing three would catch.
+    const guarded = src.match(/guardedByChat\(/g) ?? [];
+    // One definition + three call sites.
+    expect(guarded.length).toBeGreaterThanOrEqual(4);
+    for (const fn of ['doSwitchDraft', 'doCreateDraft', 'doFoldDraft']) {
+      expect(src).toContain(`function ${fn}`);
+    }
+  });
+
+  test('the gate asks the SERVER, not local chat state', () => {
+    // A bridge can be running DETACHED (post-reload, pre-re-attach) with no
+    // client that knows about it — precisely the case the warning is for. Local
+    // busy state would answer "nothing is running" exactly when it matters.
+    expect(src).toContain('/_api/acp/running');
+  });
+
+  test('a failed probe never BLOCKS a switch', () => {
+    // A switch the user asked for must not be hostage to an unrelated fetch
+    // error. The catch returns 0 (⇒ proceed), not a thrown error.
+    expect(src).toMatch(/catch\s*{[\s\S]*?return 0;/);
+  });
+});
+
+// SECURITY (security-auditor A6) — cross-PROJECT loopback adjacency.
+//
+// Before the sidecar pool (Addendum Task 10) at most one dev-server ran at a
+// time, so "another Maude instance on another loopback port" was not a state the
+// product produced. The pool makes concurrency DESIGNED-IN: projects A and B now
+// routinely run side by side on different ports, and A's canvas iframe is
+// untrusted content (DDR-054). So the question "can A's canvas reach B's
+// privileged main origin?" went from hypothetical to worth an explicit test.
+//
+// The defence is `sameOriginWrite`'s host+port compare — different instance,
+// different port, different `host`, rejected. Asserting it here so the property
+// is pinned to the pool's introduction rather than left as an inference.
+describe('cross-project origin adjacency (A6)', () => {
+  test('a request from ANOTHER instance’s origin is not same-origin', async () => {
+    const { sameOriginWrite } = await import('../http.ts');
+    const projectB = new Request('http://localhost:4400/_api/acp/running', {
+      method: 'POST',
+      // Project A's canvas/main origin, aimed at project B's server.
+      headers: { origin: 'http://localhost:4399' },
+    });
+    expect(sameOriginWrite(projectB)).toBe(false);
+  });
+
+  test('a request from the SAME instance is allowed (the pool must not break normal use)', async () => {
+    const { sameOriginWrite } = await import('../http.ts');
+    const own = new Request('http://localhost:4400/_api/acp/running', {
+      method: 'POST',
+      headers: { origin: 'http://localhost:4400' },
+    });
+    expect(sameOriginWrite(own)).toBe(true);
+  });
+});