@1agh/maude 0.58.3 → 0.60.0

package/apps/studio/http.ts

@@ -1163,6 +1163,33 @@ export function createHttp(
         },
       };
     },
+    // `--explode` from the panel. Same lazy import and same ONE implementation
+    // as the routes above — and note what is NOT here: the raw codegen response
+    // never leaves the verb, so this route returns the same code-owned
+    // accounting an agent would see on stdout (DDR-219 D10).
+    async explode({ canvas, artboard, dryRun, confirmDocument }) {
+      const mod = await import('./bin/_import-figma.mjs');
+      const r = await mod.explodeArtboard({
+        root: ctx.paths.repoRoot,
+        designRootRel: ctx.paths.designRel,
+        canvasRel: canvas,
+        artboardId: artboard,
+        dryRun: Boolean(dryRun),
+        confirmDocument: Boolean(confirmDocument),
+      });
+      return {
+        summary: {
+          canvas: r.canvas,
+          artboard: r.artboardId,
+          route: 'codegen',
+          endpoint: 'local',
+          responseSha256: r.responseSha256,
+          written: r.written,
+          assets: r.assets ?? null,
+          dispositions: r.report.entries,
+        },
+      };
+    },
   });
   const gitJson = (r: { status: number; json: unknown }) =>
     Response.json(r.json, { status: r.status, headers: { 'Cache-Control': 'no-store' } });
@@ -2441,6 +2468,53 @@ export function createHttp(
       return gitJson(await cloudApi.detach());
     },
 
+    // ── Resync (feature-sync-resync-and-out-of-process-sweep) ───────────────
+    // MAIN-ORIGIN ONLY: absent from BOTH CANVAS_SAFE_API and startCanvasServer's
+    // `routes` map (DDR-088's two-allowlist rule). Canvas content is untrusted
+    // (DDR-054) and must not be able to command the desktop to re-push a whole
+    // project — a canvas that could would be an amplification primitive against
+    // the person's own hub, and a way to spend their rate-limit budget.
+    '/_api/sync/resync': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required', { status: 403 });
+      const control = ctx.syncControl;
+      if (!control) {
+        return gitJson({
+          status: 200,
+          json: { ok: false, reason: 'no-supervisor', detail: 'Restart Maude to start syncing.' },
+        });
+      }
+      // REFUSED, not queued — see `SyncSupervisor.busy`. A second press must
+      // not buy a second full re-link of every canvas.
+      if (control.busy?.()) {
+        return gitJson({
+          status: 409,
+          json: { ok: false, reason: 'busy', detail: 'Syncing is already restarting.' },
+        });
+      }
+      // No argument: KEEP the configured hub. Only an explicit `null` unlinks,
+      // and this route must never be able to.
+      const sync = await control.restart();
+      return gitJson({ status: 200, json: { ok: true, sync } });
+    },
+
+    '/_api/sync/cancel-assets': async (req: Request) => {
+      // Cancel is scoped to the ASSET SWEEP: killing a reconnect mid-handshake
+      // is not a meaningful gesture, killing a multi-hundred-megabyte upload
+      // is. Safe by construction — uploads are idempotent and the hub writes
+      // temp-then-rename, so no half-written asset can survive this.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required', { status: 403 });
+      const cancelled = ctx.syncControl?.current?.()?.cancelAssetSweep() ?? false;
+      return gitJson({ status: 200, json: { ok: true, cancelled } });
+    },
+
     '/_api/github/identity': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       if (!isTrustedRequestHost(req))
@@ -2548,6 +2622,26 @@ export function createHttp(
       return gitJson(await figmaApi.runImport(body));
     },
 
+    // `--explode` — one artboard, via the LOCAL Dev Mode MCP (DDR-219 D2).
+    //
+    // Same triple gate, and it needs it more than the others: this route reaches
+    // an unauthenticated loopback service that reads whatever Figma document the
+    // user has open, and then WRITES into the design root. A canvas-reachable
+    // version of it would hand the untrusted iframe (DDR-054) a primitive that
+    // reads the user's open design — so it is in NEITHER canvas allowlist, the
+    // same standing rule DDR-088 sets for every privileged route, asserted in
+    // `test/canvas-origin-gate.test.ts` and by the grep test in
+    // `cli/lib/figma-codegen-reachability.test.mjs`.
+    '/_api/figma/explode': async (req: Request) => {
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required', { status: 403 });
+      const body = await readJson<unknown>(req, 8 * 1024);
+      return gitJson(await figmaApi.explode(body));
+    },
+
     '/_api/github/create-project': async (req: Request) => {
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))

package/apps/studio/sync/asset-push-worker.ts

@@ -0,0 +1,84 @@
+// The asset sweep, in its own process — feature-sync-resync-and-out-of-process-sweep.
+//
+// WHY A SEPARATE PROCESS.
+//
+// The sweep crashes Bun 1.3.3 *when it runs alongside the dev server*, proven by
+// isolation: the identical sweep against the same live hub completes standalone
+// (182/182, 0 failures) and crash-loops in-process (three `Segmentation fault at
+// address 0x0` plus a bus error, then the supervisor gave up after 3 restarts).
+// Nobody has a fix for the fault itself, so the boundary is the fix: a fault
+// here costs the sweep, and the editor — canvases, browser UI, ACP panel —
+// stays up. The parent reports the dead child as a failed sweep.
+//
+// It is also what makes a Resync button safe to offer at all: pressing it
+// re-runs this, and a button that can kill the person's dev server is not a
+// button.
+//
+// PROTOCOL. argv gives the design root, the hub URL and a file holding the
+// credential. stdout carries NDJSON — one tagged JSON object per line:
+//
+//   {"t":"progress", …AssetPushProgress}   many, throttled by pushAssets
+//   {"t":"result",   …AssetPushResult}     exactly one, on a clean finish
+//   {"t":"error", "message": "…"}          exactly one, on a thrown sweep
+//
+// Tagged rather than positional ("the last line is the result") so a parent
+// reading a truncated stream can still tell a final answer from a progress
+// tick. Nothing else may reach stdout — one stray `console.log` from an import
+// would land mid-stream — so diagnostics go to stderr, which the parent logs.
+//
+// THE CREDENTIAL ARRIVES IN A FILE, NEVER IN ARGV. `ps` is world-readable on
+// every platform this ships to; a hub token on a command line is a hub token
+// handed to every other user on the machine. The file is written 0600 by the
+// parent and unlinked when the sweep ends. It is re-read per call, not cached,
+// so a parent that rewrites it after a silent renewal is picked up mid-sweep.
+
+import { readFileSync } from 'node:fs';
+
+import { type AssetPushProgress, type AssetPushResult, pushAssets } from './asset-push.ts';
+
+const [, , designRoot, hubUrl, tokenFile] = process.argv;
+
+/** One NDJSON line. Synchronous — ordering with the result line is the contract. */
+function emit(line: { t: 'progress' | 'result' | 'error' } & Record<string, unknown>): void {
+  process.stdout.write(`${JSON.stringify(line)}\n`);
+}
+
+async function main(): Promise<void> {
+  if (!designRoot || !hubUrl || !tokenFile) {
+    emit({ t: 'error', message: 'usage: <designRoot> <hubUrl> <tokenFile>' });
+    process.exit(2);
+  }
+
+  // Read at call time — `pushAssets` asks per request, and a renewal mid-sweep
+  // rewrites the file underneath us. A read that fails (the parent unlinked it
+  // during teardown) falls back to the last value we saw rather than sending an
+  // empty Authorization, which the hub would answer 401 for every remaining
+  // file and report as 182 failures instead of one dead sweep.
+  let lastToken = '';
+  const token = (): string => {
+    try {
+      lastToken = readFileSync(tokenFile, 'utf8').trim() || lastToken;
+    } catch {
+      /* keep the last good one */
+    }
+    return lastToken;
+  };
+
+  const result: AssetPushResult = await pushAssets({
+    designRoot,
+    hubUrl,
+    token,
+    // stderr, never stdout — stdout is the protocol.
+    log: {
+      log: (...a: unknown[]) => process.stderr.write(`${a.join(' ')}\n`),
+      warn: (...a: unknown[]) => process.stderr.write(`${a.join(' ')}\n`),
+    },
+    onProgress: (p: AssetPushProgress) => emit({ t: 'progress', ...p }),
+  });
+  emit({ t: 'result', ...result });
+}
+
+main().catch((err) => {
+  emit({ t: 'error', message: String((err as Error)?.message ?? err).slice(0, 2000) });
+  process.exit(1);
+});