@1agh/maude 0.55.0 → 0.57.0

package/apps/studio/client/styles/6-acp-chat.css

@@ -880,6 +880,57 @@
     gap: var(--space-2);
   }
 
+  /* feature-acp-write-path-scope Task 4 — the out-of-project WRITE variant.
+     Distinguished from an ordinary permission card because the two ask
+     materially different questions: the ordinary one is "do you want this
+     tool to run", this one is "do you want a file written somewhere your
+     project's history stack cannot roll back". The danger tint is the whole
+     point — a card that looks identical to the routine one gets clicked
+     through at the same rate. */
+  .chat-perm--outside {
+    border-color: var(--danger, #d9534f);
+  }
+  .chat-perm--outside .chat-perm-hd b {
+    color: var(--danger, #d9534f);
+  }
+  .chat-perm-outside {
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-1);
+  }
+  /* The resolved absolute paths. Monospaced + wrapping at any character: these
+     are the one string on the card the user actually has to READ, and a path
+     that overflows or ellipsizes is a path whose dangerous tail is hidden —
+     the same failure the .chat-perm-hd b clamp above exists to prevent, but
+     with the opposite fix, because here truncation is what would be unsafe. */
+  .chat-perm-paths {
+    margin: 0;
+    padding: 0;
+    list-style: none;
+    display: flex;
+    flex-direction: column;
+    gap: var(--space-1);
+  }
+  .chat-perm-path {
+    padding: var(--space-1) var(--space-2);
+    border-radius: var(--radius-xs);
+    background: var(--bg-1);
+    color: var(--fg-0);
+    font-family: var(--font-mono);
+    font-size: var(--type-xs);
+    overflow-wrap: anywhere;
+  }
+  .chat-perm-scope,
+  .chat-perm-note {
+    margin: 0;
+    font-size: var(--type-xs);
+    color: var(--fg-3);
+  }
+  .chat-perm-root {
+    font-family: var(--font-mono);
+    overflow-wrap: anywhere;
+  }
+
   /* Form-elicitation card (feature-acp-ask-user-question — AskUserQuestion +
      generic MCP form input). Same slot + shape as .chat-perm, mutually
      exclusive with it — see the mount site in ChatPanel.jsx. */

package/apps/studio/cloud/endpoints.ts

@@ -109,6 +109,19 @@ async function cloudFetch(
 
 interface Ctx {
   paths: { repoRoot: string; designRoot: string };
+  /**
+   * The live sync runtime's owner (server.ts → sync/supervisor.ts). Optional:
+   * unit tests and any non-serving embedder construct a Ctx without one, and a
+   * missing supervisor degrades to exactly the old behaviour — linked on disk,
+   * syncing after the next start.
+   */
+  syncControl?: {
+    restart(linkedHub?: {
+      url: string;
+      linkedAt: number;
+      syncTsx?: boolean;
+    }): Promise<{ syncing: boolean; canvases: number; reason?: string; detail?: string }>;
+  };
 }
 
 export function createCloudEndpoints(ctx: Ctx) {
@@ -225,7 +238,9 @@ export function createCloudEndpoints(ctx: Ctx) {
     /**
      * Attach THIS project to a cloud workspace: open → exchange at the cell →
      * store the hub credential + linkedHub, exactly as `maude design link`
-     * would. The sync agent picks the link up on the next server start.
+     * would — and then START SYNCING (linkToWorkspace cycles the live runtime
+     * through ctx.syncControl). Connecting is the whole gesture; there is no
+     * second step for the person to discover.
      */
     async attach(projectId: string): Promise<CloudEndpointResult> {
       const file = readCloudFile();
@@ -380,9 +395,42 @@ export function createCloudEndpoints(ctx: Ctx) {
     } catch {
       /* absent/malformed → start minimal */
     }
-    cfg.linkedHub = { url: norm, linkedAt: Date.now() };
+    const linkedHub: { url: string; linkedAt: number; syncTsx?: boolean } = {
+      url: norm,
+      linkedAt: Date.now(),
+    };
+    // Carry a project-wide TSX opt-out across the re-link. Only the RESTRICTIVE
+    // direction is carried (`false`, never `true`): somebody who turned canvas
+    // BODIES off (DDR-072/DDR-079) did so deliberately, and silently re-enabling
+    // them on the next Connect would start uploading source they opted out of.
+    // It never mattered while nothing synced until a restart; it does now.
+    const prior = (cfg as { linkedHub?: { syncTsx?: boolean } }).linkedHub;
+    if (prior?.syncTsx === false) linkedHub.syncTsx = false;
+    cfg.linkedHub = linkedHub;
     writeFileSync(cfgPath, `${JSON.stringify(cfg, null, 2)}\n`, 'utf8');
 
+    // START SYNCING — do not hand the person a "restart the server" note and
+    // call the job done. The runtime captures linkedHub once at boot, so this
+    // cycles it in place, with the value we JUST wrote (never re-read from the
+    // committed config file). Best-effort: a supervisor-less embedder, or a
+    // runtime that declines, still leaves a correctly linked project behind.
+    let sync: { syncing: boolean; canvases: number; reason?: string; detail?: string } = {
+      syncing: false,
+      canvases: 0,
+      reason: 'no-supervisor',
+      detail: 'Restart Maude to start syncing.',
+    };
+    try {
+      sync = (await ctx.syncControl?.restart(linkedHub)) ?? sync;
+    } catch (err) {
+      sync = {
+        syncing: false,
+        canvases: 0,
+        reason: 'error',
+        detail: `Linked, but syncing could not start: ${(err as Error).message}`,
+      };
+    }
+
     return {
       status: 200,
       json: {
@@ -390,7 +438,12 @@ export function createCloudEndpoints(ctx: Ctx) {
         url: norm,
         role: role ?? null,
         project: project ?? null,
-        note: 'Linked. Restart the studio server to start syncing.',
+        sync,
+        // Kept for older clients (and the CLI) that read `note` — now it
+        // reports what actually happened instead of assigning homework.
+        note: sync.syncing
+          ? `Linked — syncing ${sync.canvases} canvas${sync.canvases === 1 ? '' : 'es'}.`
+          : `Linked. ${sync.detail ?? 'Restart Maude to start syncing.'}`,
       },
     };
   }

package/apps/studio/collab/persistence.ts

@@ -8,6 +8,9 @@ import * as Y from 'yjs';
 
 import type { Api } from '../api.ts';
 import type { Context } from '../context.ts';
+// From the LEAF, never from `sync/codec.ts` — codec imports `Y_TYPES` from this
+// file, so reaching for it here would close a cycle (see sync/limits.ts).
+import { MAX_ANNOTATIONS_BYTES, MAX_COMMENTS_BYTES, withinByteCap } from '../sync/limits.ts';
 import { ensureStateDir, type RoomCallbacks } from './room.ts';
 
 /**
@@ -55,6 +58,26 @@ export interface PersistenceDeps {
  * skipped when the Y type is empty / unset — the JSON file stays whatever
  * the prior legacy write produced.
  */
+/**
+ * DDR-064 pre-cutover checklist — cap the doc→disk lane for comments and
+ * annotations.
+ *
+ * The codec's `MAX_*_BYTES` guard the FILE→DOC direction. This is the other
+ * one, and until shared-doc it barely mattered: the room's doc was populated
+ * only by browsers on this machine. Under a shared doc it is populated by the
+ * hub, so an oversized array pushed by a peer (or by a hostile hub — DDR-054's
+ * threat model, §2d) would be materialized to this disk unbounded. Same ceiling
+ * as the import lane, so a value that could never be imported can never be
+ * written either.
+ *
+ * Refuses the WRITE, not the sync: the doc keeps the value and the peers keep
+ * converging. What is withheld is turning somebody else's blob into our disk.
+ * Shared with `sync/projection.ts`'s equivalent guard via `sync/limits.ts`.
+ */
+function withinCap(slug: string, lane: string, value: string, max: number): boolean {
+  return withinByteCap(`collab/${slug}`, lane, Buffer.byteLength(value, 'utf8'), max);
+}
+
 export function createPersistence(deps: PersistenceDeps): RoomCallbacks {
   const { ctx, api, fileForSlug } = deps;
   const stateDir = ensureStateDir(ctx.paths.designRoot);
@@ -135,14 +158,18 @@ export function createPersistence(deps: PersistenceDeps): RoomCallbacks {
     const list = arr.toArray() as Parameters<Api['saveCommentsForFile']>[1];
     if (list.length > 0) seenComments.add(slug);
     if (list.length > 0 || seenComments.has(slug)) {
-      await api.saveCommentsForFile(file, list);
+      if (withinCap(slug, 'comments', JSON.stringify(list), MAX_COMMENTS_BYTES)) {
+        await api.saveCommentsForFile(file, list);
+      }
     }
 
     // Annotations — Y.Map.svg → annotations.svg file. Task 5.
     const map = doc.getMap<unknown>(Y_TYPES.annotations);
     const svg = map.get('svg');
     if (typeof svg === 'string' && svg) {
-      await api.saveAnnotations(file, svg);
+      if (withinCap(slug, 'annotations', svg, MAX_ANNOTATIONS_BYTES)) {
+        await api.saveAnnotations(file, svg);
+      }
     }
   }
 

package/apps/studio/config.schema.json

@@ -259,12 +259,12 @@
         },
         "transcription": {
           "type": "object",
-          "description": "Speech-to-text / subtitle engine preference (Task 2.6, DDR-164). The engine is an EXPLICIT user choice, never an automatic fallback: a chosen-but-unavailable engine errors clearly and Maude never silently switches to another. `maude design transcribe --provider` overrides this per-call.",
+          "description": "Speech-to-text / subtitle engine preference (Task 2.6, DDR-164). The engine is never switched behind your back: a chosen-but-unavailable engine errors clearly, and `auto` — a mode you SELECT — resolves to the best engine this machine is set up for while stating which one it picked. `maude design transcribe --provider` overrides this per-call.",
           "properties": {
             "provider": {
               "type": "string",
-              "enum": ["whisper", "elevenlabs", "groq"],
-              "description": "Which engine transcribes when no --provider flag is given. `whisper` = local whisper.cpp (free, offline, no key); `elevenlabs` = ElevenLabs Scribe (cloud, key); `groq` = Groq Whisper (cloud, key). Absent ⇒ whisper.",
+              "enum": ["auto", "whisper", "elevenlabs", "groq"],
+              "description": "Which engine transcribes when no --provider flag is given. `auto` = use the cloud engine whose key is set (ElevenLabs Scribe first), else local whisper — the UI and the CLI both state what it resolved to; `whisper` = local whisper.cpp (free, offline, no key); `elevenlabs` = ElevenLabs Scribe (cloud, key, audio leaves the machine); `groq` = Groq Whisper (cloud, key). Absent ⇒ whisper.",
               "default": "whisper"
             },
             "model": {

package/apps/studio/context.ts

@@ -182,6 +182,22 @@ export interface Context {
    * gates behavior starting in Phase B.
    */
   sharedDoc?: boolean;
+  /**
+   * The live sync runtime's owner, set by server.ts once it exists. Present so
+   * the cloud attach lane can START SYNCING the moment a person links a
+   * project, instead of leaving them holding a "restart the studio server"
+   * note with no button behind it. Structural type (not the SyncSupervisor
+   * import) so context.ts stays free of the sync module graph — tests and the
+   * non-serving entry points construct a Context without one.
+   */
+  syncControl?: {
+    restart(linkedHub?: LinkedHub): Promise<{
+      syncing: boolean;
+      canvases: number;
+      reason?: string;
+      detail?: string;
+    }>;
+  };
 }
 
 function resolveRepoRoot(): string {
@@ -364,6 +380,12 @@ export function reloadConfig(ctx: Context): boolean {
   // (syncTsx gating) drift out of step with the hub the socket is actually
   // attached to — and a poisoned config must never re-point sync without a
   // restart (DDR-149 fan-out review).
+  //
+  // This is a rule about the FILE, and it stays. The one path that may change
+  // the live link is `adoptLinkedHub` below: a person pressing Connect in
+  // trusted app chrome, whose hub credential this same process just stored.
+  // That path cycles the runtime itself (sync/supervisor.ts) instead of hoping
+  // a watcher notices.
   if (JSON.stringify(next.linkedHub) !== JSON.stringify(ctx.cfg.linkedHub)) {
     console.warn('  warn: linkedHub changed — not hot-reloadable, restart the server to apply.');
     if (ctx.cfg.linkedHub === undefined) delete next.linkedHub;
@@ -389,3 +411,22 @@ export function reloadConfig(ctx: Context): boolean {
     ctx.cfg.canvasGroups.find((g) => /system/i.test(g.path))?.path ?? 'system';
   return true;
 }
+
+/**
+ * Adopt a link the person just authorized — the ONE way `cfg.linkedHub` may
+ * change on a running server.
+ *
+ * The value is passed BY VALUE from the attach lane (cloud/endpoints.ts), which
+ * exchanged it against the configured cloud address and stored the matching hub
+ * credential moments earlier. It is deliberately NOT re-read from
+ * `.design/config.json`: that file is committed, shared, and writable by
+ * anything else on the machine, and re-reading it here would hand the
+ * file-watcher's refused capability (reloadConfig above) back through a side
+ * door. What the person consented to is what gets applied.
+ *
+ * Callers must cycle the sync runtime afterwards — `createSyncSupervisor`
+ * (sync/supervisor.ts) does both in one step, and is the only intended caller.
+ */
+export function adoptLinkedHub(ctx: Context, linkedHub: LinkedHub): void {
+  ctx.cfg.linkedHub = linkedHub;
+}