@1agh/maude 0.59.0 → 0.60.0

package/apps/studio/test/sync-asset-sweep.test.ts

@@ -0,0 +1,243 @@
+// The PARENT half of the out-of-process asset sweep.
+//
+// The child's own contract is `sync-asset-push-worker.test.ts`; here the child
+// is a stand-in script, because what needs pinning is the parent's behaviour
+// when that child misbehaves — and a real sweep cannot be made to segfault on
+// demand. Every case below is a way the sweep can end, and the property under
+// test is the same one each time: the parent always produces a FINAL emit, so
+// the panel can never sit at "92 of 182" forever.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import type { AssetPushProgress } from '../sync/asset-push.ts';
+import { assetWorkerScript, runAssetSweep } from '../sync/asset-sweep.ts';
+
+const dirs: string[] = [];
+
+/** Write a stand-in child and return its path. */
+function fakeChild(body: string): string {
+  const dir = mkdtempSync(join(tmpdir(), 'sweep-parent-'));
+  dirs.push(dir);
+  const p = join(dir, 'child.ts');
+  writeFileSync(p, body);
+  return p;
+}
+
+function progressLine(over: Partial<AssetPushProgress> = {}): string {
+  const base = {
+    t: 'progress',
+    total: 3,
+    done: 1,
+    pushed: 1,
+    skipped: 0,
+    failedCount: 0,
+    failures: [],
+    active: 'system/ds/assets/logos/a.svg',
+    finished: false,
+  };
+  return JSON.stringify({ ...base, ...over });
+}
+
+function sweep(script: string, onProgress: (p: AssetPushProgress) => void) {
+  const designRoot = mkdtempSync(join(tmpdir(), 'sweep-root-'));
+  dirs.push(designRoot);
+  return runAssetSweep({
+    designRoot,
+    hubUrl: 'https://hub.example',
+    token: () => 'secret-token',
+    onProgress,
+    script,
+    log: { log: () => {}, warn: () => {} },
+  });
+}
+
+describe('a sweep that finishes', () => {
+  test('progress reaches the panel and the result comes back', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(${JSON.stringify(`${progressLine()}\n`)});
+      process.stdout.write(${JSON.stringify(`${progressLine({ done: 3, pushed: 3, active: null, finished: true })}\n`)});
+      process.stdout.write(JSON.stringify({ t: 'result', pushed: ['a', 'b', 'c'], skipped: 0, failed: [] }) + '\\n');
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toEqual({ pushed: ['a', 'b', 'c'], skipped: 0, failed: [] });
+    expect(seen.length).toBe(2);
+    expect(seen[1].finished).toBe(true);
+  });
+
+  test('unparseable output is dropped, not fatal', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write('a stray console.log from an import\\n');
+      process.stdout.write(${JSON.stringify(`${progressLine()}\n`)});
+      process.stdout.write('{ half a li');
+      process.stdout.write('ne }\\n');
+      process.stdout.write(JSON.stringify({ t: 'result', pushed: [], skipped: 1, failed: [] }) + '\\n');
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toEqual({ pushed: [], skipped: 1, failed: [] });
+    expect(seen.length).toBe(1);
+  });
+});
+
+describe('a sweep that dies is a REPORTED failure, never a stall', () => {
+  test('a signalled child names the signal in the final emit', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(${JSON.stringify(`${progressLine({ done: 92, total: 182, pushed: 92 })}\n`)});
+      await Bun.sleep(20);
+      process.kill(process.pid, 'SIGKILL');
+      await new Promise(() => {});
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toBeNull();
+    const final = seen[seen.length - 1];
+    expect(final.finished).toBe(true);
+    // The counts it got to are KEPT — the person is told where it stopped.
+    expect(final.done).toBe(92);
+    expect(final.total).toBe(182);
+    expect(final.failedCount).toBe(1);
+    expect(final.failures[0].reason).toContain('SIGKILL');
+    expect(final.active).toBeNull();
+  });
+
+  test('a child that reports an error carries the message through', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(JSON.stringify({ t: 'error', message: 'the design root vanished' }) + '\\n');
+      process.exit(1);
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toBeNull();
+    expect(seen[seen.length - 1].failures[0].reason).toContain('the design root vanished');
+  });
+
+  test('a missing worker script is reported — never a silent in-process fallback', async () => {
+    const seen: AssetPushProgress[] = [];
+    const result = await sweep(join(tmpdir(), 'no-such-worker-xyz.ts'), (p) => seen.push(p)).done;
+
+    expect(result).toBeNull();
+    expect(seen.length).toBe(1);
+    expect(seen[0].finished).toBe(true);
+    expect(seen[0].failedCount).toBe(1);
+  });
+
+  test('a result line with a non-zero exit is NOT trusted as success', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(JSON.stringify({ t: 'result', pushed: ['a'], skipped: 0, failed: [] }) + '\\n');
+      process.exit(3);
+    `);
+    const result = await sweep(child, (p) => seen.push(p)).done;
+
+    expect(result).toBeNull();
+    expect(seen[seen.length - 1].failures[0].reason).toContain('3');
+  });
+});
+
+describe('cancel ends the sweep, and says that is what happened', () => {
+  test('a wedged child is killed and the lane closes as cancelled', async () => {
+    const seen: AssetPushProgress[] = [];
+    const child = fakeChild(`
+      process.stdout.write(${JSON.stringify(`${progressLine()}\n`)});
+      await new Promise(() => {});
+    `);
+    const handle = sweep(child, (p) => seen.push(p));
+    // Wait for the first emit so the child is definitely alive — BOUNDED, so a
+    // machine that cannot spawn fails this test instead of hanging the suite.
+    for (let i = 0; seen.length === 0 && i < 500; i++) await Bun.sleep(10);
+    expect(seen.length).toBeGreaterThan(0);
+    handle.cancel();
+    const result = await handle.done;
+
+    expect(result).toBeNull();
+    const final = seen[seen.length - 1];
+    expect(final.finished).toBe(true);
+    expect(final.failures[0].reason).toBe('cancelled');
+  });
+
+  test('cancel is idempotent and safe after the sweep already ended', async () => {
+    const child = fakeChild(
+      `process.stdout.write(JSON.stringify({ t: 'result', pushed: [], skipped: 0, failed: [] }) + '\\n');`
+    );
+    const handle = sweep(child, () => {});
+    await handle.done;
+    expect(() => {
+      handle.cancel();
+      handle.cancel();
+    }).not.toThrow();
+  });
+});
+
+describe('the credential never touches argv', () => {
+  test('the token goes to a 0600 file that is gone when the sweep ends', async () => {
+    let sawArgv = '';
+    let sawToken = '';
+    let sawMode = '';
+    const child = fakeChild(`
+      const { readFileSync, statSync } = await import('node:fs');
+      const tokenFile = process.argv[4];
+      process.stdout.write(JSON.stringify({
+        t: 'result', pushed: [], skipped: 0,
+        failed: [
+          { key: 'argv', reason: process.argv.slice(2).join(' ') },
+          { key: 'token', reason: readFileSync(tokenFile, 'utf8') },
+          { key: 'mode', reason: (statSync(tokenFile).mode & 0o777).toString(8) },
+          { key: 'file', reason: tokenFile },
+        ],
+      }) + '\\n');
+    `);
+    const result = await sweep(child, () => {});
+    const failed = (await result.done)?.failed ?? [];
+    sawArgv = failed.find((f) => f.key === 'argv')?.reason ?? '';
+    sawToken = failed.find((f) => f.key === 'token')?.reason ?? '';
+    sawMode = failed.find((f) => f.key === 'mode')?.reason ?? '';
+    const tokenFile = failed.find((f) => f.key === 'file')?.reason ?? '';
+
+    expect(sawToken).toBe('secret-token');
+    // `ps` shows argv to every user on the machine.
+    expect(sawArgv).not.toContain('secret-token');
+    expect(sawMode).toBe('600');
+    expect(existsSync(tokenFile)).toBe(false);
+  });
+});
+
+describe('the credential stays current across the boundary', () => {
+  test('the token file is written atomically — the child can never read half of it', async () => {
+    // The child re-reads this file per request; a plain overwrite is observable
+    // half-done, and half a bearer token is a 401 on every remaining upload.
+    const src = readFileSync(join(import.meta.dir, '..', 'sync', 'asset-sweep.ts'), 'utf8');
+    expect(src).toContain('renameSync(tmp, tokenFile)');
+    // And the parent keeps it current: a renewal mid-sweep must reach the child,
+    // which is why `token` is a GETTER and not the string it resolved to.
+    expect(src).toMatch(/token: \(\) => string/);
+    expect(src).toMatch(/setInterval\(/);
+  });
+});
+
+describe('the worker ships where the server can find it', () => {
+  test('the resolved script is a real file on disk (DDR-045, not a bunfs path)', () => {
+    const script = assetWorkerScript();
+    expect(script.endsWith(join('sync', 'asset-push-worker.ts'))).toBe(true);
+    expect(existsSync(script)).toBe(true);
+  });
+});
+
+// Temp roots outlive individual tests (the token-file case reads one back), so
+// they are swept once at the end rather than per-test.
+process.on('exit', () => {
+  for (const d of dirs) {
+    try {
+      if (existsSync(d) && readdirSync(d)) rmSync(d, { recursive: true, force: true });
+    } catch {
+      /* best-effort */
+    }
+  }
+});

package/apps/studio/test/sync-panel-surface.test.ts

@@ -58,7 +58,7 @@ describe('the Sync panel speaks the presentation vocabulary, safely', () => {
   test('every name that reaches the DOM goes through safeName', () => {
     // Slugs and asset keys are local, but the payload is read back off disk —
     // bounded text-only rendering is the house rule (DDR-054).
-    expect(PANEL).toContain('import { safeName, syncPresentation }');
+    expect(PANEL).toContain('import { safeDetail, safeName, syncPresentation }');
     expect(PANEL).not.toMatch(/dangerouslySetInnerHTML/);
   });
 
@@ -88,3 +88,36 @@ describe('the panel reads the off-disk payload fail-closed (DDR-102 discipline)'
     );
   });
 });
+
+// feature-sync-resync-and-out-of-process-sweep — the panel gained the one
+// control the whole feature exists for. What is pinned here is not that a
+// button renders, but the three properties that make it safe to press: it
+// re-runs the WHOLE sync (not just assets), it cannot be spammed, and cancel
+// reaches only the sweep.
+describe('the Resync control', () => {
+  test('it calls the whole-sync route, not an asset-only one', () => {
+    expect(PANEL).toContain("fetch('/_api/sync/resync'");
+    expect(PANEL).toContain('data-testid="sync-resync"');
+  });
+
+  test('it disables itself while running AND during the cooldown', () => {
+    // A resync re-authenticates every document against the DDR-102 600/min
+    // bucket; without the cooldown an impatient person pins their own hub.
+    expect(PANEL).toContain('disabled={resyncing || cooling}');
+    expect(PANEL).toMatch(/RESYNC_COOLDOWN_MS = [\d_]+/);
+  });
+
+  test('a 409 reads as "already restarting", never as a failure', () => {
+    expect(PANEL).toMatch(/res\.status === 409/);
+  });
+
+  test('cancel is scoped to the sweep and only offered while one runs', () => {
+    expect(PANEL).toContain("fetch('/_api/sync/cancel-assets'");
+    expect(PANEL).toContain('data-testid="sync-assets-cancel"');
+    expect(PANEL).toMatch(/!assets\.finished && \(/);
+  });
+
+  test('the note is sanitized too — server detail is still bounded text', () => {
+    expect(PANEL).toContain("safeDetail(note, '')");
+  });
+});

package/apps/studio/test/sync-resync-routes.test.ts

@@ -0,0 +1,125 @@
+// `/_api/sync/resync` + `/_api/sync/cancel-assets` — the MAIN-origin half.
+//
+// `canvas-origin-gate.test.ts` already asserts both routes are unreachable from
+// the segregated canvas origin. That alone proves the wrong property: the main
+// origin is reachable from any website the user happens to visit while the dev
+// server is up. A cross-site POST that lands here would re-authenticate every
+// document against the person's own hub and re-run a whole-project upload — an
+// amplification primitive against their own DDR-102 rate-limit budget, with an
+// opaque response and a very real side effect.
+//
+// So this file asserts the complementary half — the same posture the Figma
+// routes carry (DDR-216 D3): cross-origin write → 403, foreign Host → 403,
+// wrong method → 405. Both halves are required; neither is sufficient.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import type { Subprocess } from 'bun';
+
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+const HTTP = readFileSync(join(import.meta.dir, '..', 'http.ts'), 'utf8');
+
+let proc: Subprocess;
+let base: string;
+
+const ROUTES = ['/_api/sync/resync', '/_api/sync/cancel-assets'];
+
+beforeAll(async () => {
+  const { root } = makeSandbox();
+  const port = nextPort();
+  base = `http://localhost:${port}`;
+  proc = await bootServer(root, port);
+});
+
+afterAll(async () => {
+  await killProc(proc);
+});
+
+describe('cross-origin writes are refused (the CSRF guard)', () => {
+  for (const route of ROUTES) {
+    test(`POST ${route} from another origin is 403`, async () => {
+      const res = await fetch(`${base}${route}`, {
+        method: 'POST',
+        headers: { Origin: 'https://evil.example' },
+      });
+      expect(res.status).toBe(403);
+    });
+
+    test(`a CORS-simple POST to ${route} is still refused`, async () => {
+      // No preflight, unreadable response — but the side effect would land.
+      const res = await fetch(`${base}${route}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'text/plain', Origin: 'https://evil.example' },
+        body: '{}',
+      });
+      expect(res.status).toBe(403);
+    });
+  }
+});
+
+describe('a foreign Host header is refused (the DNS-rebinding guard)', () => {
+  for (const route of ROUTES) {
+    test(`POST ${route} with a rebinding Host is 403`, async () => {
+      const res = await fetch(`${base}${route}`, {
+        method: 'POST',
+        headers: { Host: 'sync.127.0.0.1.nip.io' },
+      });
+      expect(res.status).toBe(403);
+    });
+  }
+});
+
+describe('method gating', () => {
+  for (const route of ROUTES) {
+    test(`GET ${route} is 405 — resync is a write`, async () => {
+      expect((await fetch(`${base}${route}`)).status).toBe(405);
+    });
+  }
+});
+
+// Source-level, because these two properties only show up on a LINKED project
+// with a live hub — a state a booted sandbox cannot reach — and they are
+// exactly the two that would be silently wrong.
+describe('the route is wired to the whole-sync restart, and refuses rather than queues', () => {
+  test('restart() is called with NO argument — this route can never unlink', () => {
+    // `restart(null)` is the DETACH lane: it clears the in-memory link and
+    // cycles to solo. A resync that passed a falsy value through would
+    // disconnect the person's project instead of re-checking it.
+    expect(HTTP).toContain('const sync = await control.restart();');
+    expect(HTTP).not.toMatch(/sync\/resync[\s\S]{0,900}restart\(null\)/);
+  });
+
+  test('a cycle in flight is a 409, not a second full re-link', () => {
+    expect(HTTP).toMatch(/control\.busy\?\.\(\)/);
+    expect(HTTP).toMatch(/status: 409[\s\S]{0,120}'busy'/);
+  });
+
+  test('cancel reaches the sweep through the live runtime, not the supervisor', () => {
+    expect(HTTP).toContain('ctx.syncControl?.current?.()?.cancelAssetSweep() ?? false');
+  });
+});
+
+describe('same-origin behaviour on an unlinked project', () => {
+  test('resync answers honestly rather than pretending it synced', async () => {
+    // The sandbox project has no linkedHub, so the supervisor is present but
+    // declines. The panel hides the control in this state; the ROUTE still has
+    // to give a truthful answer to anything that reaches it.
+    const res = await fetch(`${base}/_api/sync/resync`, { method: 'POST' });
+    expect(res.status).toBe(200);
+    const json = (await res.json()) as {
+      ok: boolean;
+      sync?: { syncing: boolean; reason?: string };
+    };
+    expect(json.ok).toBe(true);
+    expect(json.sync?.syncing).toBe(false);
+    expect(json.sync?.reason).toBe('unlinked');
+  });
+
+  test('cancelling with no sweep in flight says so instead of erroring', async () => {
+    const res = await fetch(`${base}/_api/sync/cancel-assets`, { method: 'POST' });
+    expect(res.status).toBe(200);
+    expect(await res.json()).toEqual({ ok: true, cancelled: false });
+  });
+});

package/apps/studio/test/sync-supervisor.test.ts

@@ -77,6 +77,7 @@ function fakeRuntime(log: string[], id: string, size = 3): SyncRuntime {
     size: () => size,
     agentFor: () => undefined,
     status: () => null,
+    cancelAssetSweep: () => false,
   };
 }
 
@@ -188,6 +189,50 @@ describe('createSyncSupervisor', () => {
     rmSync(ctx.paths.repoRoot, { recursive: true, force: true });
   });
 
+  // feature-sync-resync-and-out-of-process-sweep — `busy()` is what lets the
+  // Resync route answer 409 instead of quietly queueing a second full re-link
+  // of every canvas. It reports the chain; it must never BE the chain.
+  test('busy() reports a cycle in flight and clears when it settles', async () => {
+    const ctx = makeCtx({ url: 'https://hub.example', linkedAt: 1 });
+    let release: () => void = () => {};
+    const held = new Promise<void>((r) => {
+      release = r;
+    });
+    const sup = createSyncSupervisor(ctx, {}, () => ({
+      start: () => held,
+      stop: async () => {},
+      size: () => 1,
+      agentFor: () => undefined,
+      status: () => null,
+      cancelAssetSweep: () => false,
+    }));
+
+    expect(sup.busy()).toBe(false);
+    const cycle = sup.start();
+    expect(sup.busy()).toBe(true);
+    release();
+    await cycle;
+    expect(sup.busy()).toBe(false);
+    rmSync(ctx.paths.repoRoot, { recursive: true, force: true });
+  });
+
+  test('busy() clears after a cycle that THREW — Resync never wedges shut', async () => {
+    const ctx = makeCtx({ url: 'https://hub.example', linkedAt: 1 });
+    const sup = createSyncSupervisor(ctx, {}, () => ({
+      start: async () => {
+        throw new Error('nope');
+      },
+      stop: async () => {},
+      size: () => 0,
+      agentFor: () => undefined,
+      status: () => null,
+      cancelAssetSweep: () => false,
+    }));
+    await sup.start();
+    expect(sup.busy()).toBe(false);
+    rmSync(ctx.paths.repoRoot, { recursive: true, force: true });
+  });
+
   test('a throwing start leaves the server up and answers with the reason', async () => {
     const ctx = makeCtx({ url: 'https://hub.example', linkedAt: 1 });
     const sup = createSyncSupervisor(ctx, {}, () => ({
@@ -198,6 +243,7 @@ describe('createSyncSupervisor', () => {
       size: () => 0,
       agentFor: () => undefined,
       status: () => null,
+      cancelAssetSweep: () => false,
     }));
     const out = await sup.start();
     expect(out.syncing).toBe(false);

package/apps/studio/whats-new.json

@@ -1,6 +1,22 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "sync-resync-button",
+      "version": "0.60.0",
+      "date": "2026-08-12",
+      "kind": "feature",
+      "title": "Resync your project without restarting Maude",
+      "summary": "The Sync panel has a Resync button: one press re-checks everything against the cloud — every canvas and every file — instead of quitting and reopening. Uploads now run on their own too, so a failed upload stays a failed upload: Maude keeps working, the panel says what happened, and you can stop one part-way without leaving anything half-sent."
+    },
+    {
+      "id": "figma-offline-fig-import",
+      "version": "0.60.0",
+      "date": "2026-08-12",
+      "kind": "feature",
+      "title": "Import a Figma file with no Figma account",
+      "summary": "Drag in a .fig or .jam you exported and Maude reads it entirely offline — no token, no network, no seat. Images travel inside the file, so nothing expires and nothing is rate-limited. If the export is from a Figma version Maude does not recognise, it says so rather than guessing at the geometry."
+    },
     {
       "id": "cloud-asset-push-completes",
       "version": "0.59.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.59.0",
+  "version": "0.60.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -54,13 +54,13 @@
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.59.0",
-    "@1agh/maude-darwin-x64": "0.59.0",
-    "@1agh/maude-linux-arm64": "0.59.0",
-    "@1agh/maude-linux-arm64-musl": "0.59.0",
-    "@1agh/maude-linux-x64": "0.59.0",
-    "@1agh/maude-linux-x64-musl": "0.59.0",
-    "@1agh/maude-win32-x64": "0.59.0"
+    "@1agh/maude-darwin-arm64": "0.60.0",
+    "@1agh/maude-darwin-x64": "0.60.0",
+    "@1agh/maude-linux-arm64": "0.60.0",
+    "@1agh/maude-linux-arm64-musl": "0.60.0",
+    "@1agh/maude-linux-x64": "0.60.0",
+    "@1agh/maude-linux-x64-musl": "0.60.0",
+    "@1agh/maude-win32-x64": "0.60.0"
   },
   "files": [
     "cli",