@1agh/maude 0.60.6 → 1.0.2

package/apps/studio/git/service.ts

@@ -27,11 +27,14 @@
 import { spawn } from 'node:child_process';
 import fs, { existsSync } from 'node:fs';
 import { isAbsolute, join, relative, sep } from 'node:path';
+import { StringDecoder } from 'node:string_decoder';
 
 import git from 'isomorphic-git';
 import http from 'isomorphic-git/http/node';
 
+import { gitLogArgs, gitLogEnv, parseGitLog } from './log-format.ts';
 import { withRepoLock } from './repo-lock.ts';
+import { safeGitPrefix } from './safe-rel.ts';
 
 // Read LIVE, not as a module-load const — the same reason `noSystemGit()` below
 // is a function, and a sharper one since Cloud Phase 27 D2: a CELL now runs with
@@ -220,9 +223,27 @@ function isRepo(dir: string): boolean {
 }
 
 /** Normalize a status-matrix prefix: strip leading/trailing slashes, forward-slash. */
+/**
+ * The design-root containment prefix, normalised and VALIDATED (F-13/B12).
+ *
+ * This used to strip slashes and nothing else, so a `designRoot` of
+ * `../../..` normalised to `../../..` and `underPrefix` then matched nothing —
+ * or, on the staging side, named files outside the design root entirely. The
+ * rules live in `safe-rel.ts`; see its docblock for why containment (not argv)
+ * is the risk here.
+ *
+ * A REFUSED prefix falls back to `'.design'`, never to `''`. Empty means "no
+ * containment filter at all", so treating a hostile value as absent would
+ * WIDEN the scope to the whole repository — the opposite of what refusing it
+ * is for.
+ */
 function normPrefix(p?: string): string {
-  if (!p) return '';
-  return p.replace(/\\/g, '/').replace(/^\/+|\/+$/g, '');
+  const safe = safeGitPrefix(p);
+  if (safe !== null) return safe;
+  console.warn(
+    `[git] refusing an unsafe design-root prefix (${JSON.stringify(p)}) — falling back to '.design'`
+  );
+  return '.design';
 }
 
 function underPrefix(filepath: string, prefix: string): boolean {
@@ -345,11 +366,20 @@ function runGit(
         child.kill('SIGKILL');
       }, timeoutMs);
     }
+    // StringDecoder, NOT `d.toString()` per chunk — a pipe splits at arbitrary
+    // BYTE boundaries, so a multi-byte sequence straddling two chunks decodes
+    // to U+FFFD on each side and `git show` of a canvas with non-ASCII copy
+    // comes back silently corrupted. The hub's runner carries the identical
+    // fix: this commit's whole premise is that a cloud row and a local row
+    // cannot differ in shape, and "one of the two mangles diacritics" is
+    // exactly that kind of difference.
+    const outDec = new StringDecoder('utf8');
+    const errDec = new StringDecoder('utf8');
     child.stdout.on('data', (d) => {
-      stdout += d.toString();
+      stdout += outDec.write(d);
     });
     child.stderr.on('data', (d) => {
-      stderr += d.toString();
+      stderr += errDec.write(d);
     });
     child.on('error', (e) => {
       if (timer) clearTimeout(timer);
@@ -357,6 +387,8 @@ function runGit(
     });
     child.on('close', (code) => {
       if (timer) clearTimeout(timer);
+      stdout += outDec.end();
+      stderr += errDec.end();
       resolveRun({ code: timedOut ? 124 : (code ?? 1), stdout, stderr, timedOut });
     });
   });
@@ -884,7 +916,9 @@ async function checkoutLocked(dir: string, name: string): Promise<GitBranchResul
       } else {
         const remoteNames = await git
           .listBranches({ fs, dir, remote: DEFAULT_REMOTE })
-          .catch(() => []);
+          // Annotated: a bare `[]` infers never[], which made the `.includes`
+          // below take a `never` and rejected any real branch name.
+          .catch((): string[] => []);
         if (!remoteNames.includes(name))
           return { ok: false, error: "Couldn't find that draft — try Refresh." };
         await git.checkout({ fs, dir, ref: name, remote: DEFAULT_REMOTE, track: true });
@@ -1712,29 +1746,14 @@ async function logIso(dir: string, limit: number, filepath?: string): Promise<Gi
 }
 
 async function logSystem(dir: string, limit: number, filepath?: string): Promise<GitLogEntry[]> {
-  // Unit-separator field delimiter, record-separator line delimiter — survives
-  // any message punctuation.
-  const fmt = '%H%x1f%s%x1f%an%x1f%ae%x1f%aI%x1e';
-  const args = ['log', `-n${limit}`, `--pretty=format:${fmt}`];
-  // `--` makes `filepath` strictly positional — git can't read it as an option
-  // (no argument injection even if it began with a dash, which containment
-  // validation already rejects upstream).
-  if (filepath) args.push('--', filepath);
-  // GIT_LITERAL_PATHSPECS — match `filepath` VERBATIM, never as pathspec magic
-  // (`:(top)`, `:(exclude)`, globs). The endpoint already restricts it to the
-  // design tree; this makes the system-git engine treat it as a plain path
-  // regardless, closing the pathspec-magic surface the `--` terminator alone
-  // doesn't (security re-review, phase-27.1).
-  const r = await runGit(dir, args, filepath ? { GIT_LITERAL_PATHSPECS: '1' } : undefined);
+  // The format, the argv (including the `--` terminator) and the parser all
+  // live in `log-format.ts` — the cloud cell's `/api/history` reads its own
+  // repo through the SAME three, so a cloud row and a local row cannot drift
+  // into different shapes behind one renderer. `gitLogEnv` carries the
+  // GIT_LITERAL_PATHSPECS hardening that must travel with a scoped argv.
+  const r = await runGit(dir, gitLogArgs(limit, filepath), gitLogEnv(filepath));
   if (r.code !== 0) return [];
-  return r.stdout
-    .split('\x1e')
-    .map((rec) => rec.replace(/^\n/, '').trim())
-    .filter(Boolean)
-    .map((rec) => {
-      const [sha, message, author, email, date] = rec.split('\x1f');
-      return { sha, message, author, email, date };
-    });
+  return parseGitLog(r.stdout);
 }
 
 // ── diff (visual before/after) ─────────────────────────────────────────────

package/apps/studio/hmr-broadcast.ts

@@ -165,6 +165,16 @@ export function classifyChange(
     }
     return { type: 'canvas-hmr', mode: 'css', file: rel, version, scope: 'canvas' };
   }
+  // The PhotoEdit sidecar (`assets/<sha8>.photo.json`) — a peer's photo
+  // adjustment arriving over the file plane. Ride the existing `asset` mode:
+  // the shell recognises the `.photo.json` shape and, instead of re-pointing
+  // an <img> (nothing references the sidecar), tells the canvas to re-fetch
+  // the edit and re-bake (`maude:photo-edit-refreshed`). Without this the
+  // sidecar changed on disk and no open canvas ever heard — a photo edit from
+  // another machine appeared only after a manual reload.
+  if (rel.endsWith('.photo.json') && /(^|\/)assets\//.test(rel)) {
+    return { type: 'canvas-hmr', mode: 'asset', file: rel, version, scope: 'canvas' };
+  }
   // Phase 8 — canvas-meta sidecar (`<base>.meta.json`) carries the
   // artboard layout / viewport. Emit a `meta` mode so foreign tabs can
   // re-fetch + re-apply the layout WITHOUT a full reload (which would

package/apps/studio/http.ts

@@ -7,7 +7,8 @@
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync, unlinkSync, watch } from 'node:fs';
 import { dirname, join, posix, relative, resolve, sep } from 'node:path';
-
+// Ownership mutations live with the CLI on purpose — see /_api/sync/ownership.
+import { adoptToHub, detachToRepo, ownershipState } from '../../cli/lib/design-ownership.mjs';
 import {
   cancelSignin,
   getClaudeAuthStatus,
@@ -105,12 +106,15 @@ import { createPhotoStore, PHOTO_EDIT_MAX_BYTES } from './photo-store.ts';
 import { probeReadiness } from './readiness.ts';
 import { getRuntimeBundle, packageForSlug } from './runtime-bundle.ts';
 import { currentSession } from './session-scope.ts';
+import { sanitizeForLog } from './sync/cell-pairing.ts';
 import { linkHub } from './sync/hub-link.ts';
 import { isHubReadOnly } from './sync/hubs-config.ts';
+import { isFirstAnchorMode, readSyncSettings, writeSyncSettings } from './sync/settings.ts';
+import { listTrash, pruneTrash, restoreFromTrash } from './sync/trash.ts';
 import { signInToWorkspace, workspaceDisclosure } from './sync/workspace-signin.ts';
 import { readUiPrefs, type UiPrefs, writeUiPrefs } from './ui-prefs.ts';
 import { loadWhatsNew, resolveMaudeVersion } from './whats-new.ts';
-import { isWorkspaceMode } from './workspace-mode.ts';
+import { isWorkspaceMode, resolveRenderLane } from './workspace-mode.ts';
 import { isLoopbackHost } from './ws.ts';
 
 // Real disk install root — never the virtual `/$bunfs/root` of compiled bins.
@@ -742,6 +746,49 @@ const HIST_WINDOW_MS = 10_000;
 const HIST_MAX_BUILDS = 24;
 let histWindowStart = Date.now();
 let histBuilds = 0;
+
+// Shas neither git NOR the linked cell could resolve (feature-cloud-managed-git-
+// posture). Without it, every re-request of a bad sha costs a git lookup AND a
+// network round trip to the hub — and the sha is attacker-influenceable from the
+// untrusted canvas origin (DDR-054), so "it will fail again" must be cheap to
+// say. Bounded like the positive cache; a miss is only ever a wasted retry.
+const historicalMissCache = new Set<string>();
+const HIST_MISS_MAX = 256;
+
+/**
+ * The linked cell's blob reader, or null when this project is not
+ * cloud-managed.
+ *
+ * `createCloudEndpoints` is a pure closure factory (it touches disk only when a
+ * method is CALLED), and `historyFile` already answers null unless the folder
+ * is linked AND credentialed — which is exactly the cloud-managed condition.
+ * So the posture is not re-derived here; it is asked of the module that owns
+ * it. Memoized per repo root because a process serves one.
+ */
+let cloudHistoryFor: { root: string; api: ReturnType<typeof createCloudEndpoints> } | null = null;
+
+/**
+ * Forget every historical build and every remembered absence.
+ *
+ * Called when the project's LINK changes (Connect / Disconnect). Both caches
+ * are keyed by `(path, sha)` and neither mentions which repo answered, so a
+ * cloud-sourced entry — and, more importantly, an absence the CELL was
+ * authoritative about — would otherwise outlive the link and be served to a
+ * now-local project that may well have the object. (Security re-review of
+ * 8134ca8f, finding F5.)
+ */
+export function clearHistoricalCaches(): void {
+  historicalCanvasCache.clear();
+  historicalMissCache.clear();
+  cloudHistoryFor = null;
+}
+function cloudHistoryApi(ctx: Context): ReturnType<typeof createCloudEndpoints> {
+  if (cloudHistoryFor?.root !== ctx.paths.repoRoot) {
+    cloudHistoryFor = { root: ctx.paths.repoRoot, api: createCloudEndpoints(ctx) };
+  }
+  return cloudHistoryFor.api;
+}
+
 function historicalBuildAllowed(): boolean {
   const now = Date.now();
   if (now - histWindowStart >= HIST_WINDOW_MS) {
@@ -772,7 +819,51 @@ async function serveHistoricalCanvas(
         headers: { 'Retry-After': '10', 'Cache-Control': 'no-store' },
       });
     }
-    const source = await gitShowFile(ctx.paths.repoRoot, sha, repoRel);
+    // LOCAL FIRST, THEN THE CLOUD. In cloud-managed posture the History rows
+    // come from the cell, so the sha the user clicked may exist ONLY there —
+    // the local repo has no commits at all. Local still goes first: it is a
+    // disk read against a repo that may well have the object (a folder that was
+    // committed to before it was linked), and it costs nothing to try.
+    //
+    // Everything downstream is unchanged — same build, same CSP, same LRU, same
+    // DiffView. Historical content is immutable, so a cloud-sourced build
+    // caches under the identical `(path, sha)` key.
+    //
+    // The sha is validated on BOTH sides: `/^[0-9a-f]{7,40}$/` here (via
+    // `historyFile`) and again on the hub. It arrives from the untrusted canvas
+    // origin, and "the other end checks it" is how a guard ends up on neither.
+    // A sha that already failed AUTHORITATIVELY fails again — say so without
+    // spending the git process or the round trip.
+    if (historicalMissCache.has(key)) {
+      return new Response('No saved version of this canvas', { status: 404 });
+    }
+    let source = await gitShowFile(ctx.paths.repoRoot, sha, repoRel);
+    if (source == null) {
+      const fromCloud = await cloudHistoryApi(ctx).historyFile(sha, repoRel);
+      source = fromCloud.ok ? fromCloud.source : null;
+      // ONLY AN AUTHORITATIVE ABSENCE IS REMEMBERED (security re-review of
+      // 8134ca8f, finding F1). Two things must never be cached here:
+      //
+      //   1. A TRANSIENT failure. `unreachable` / `not-linked` mean the cell
+      //      could not answer, not that the version is absent — remembering
+      //      that outlives the outage and makes a real version permanently
+      //      unpreviewable, with no way to clear it but a restart.
+      //   2. A MUTABLE ref. The local engine's positional guard admits `HEAD`,
+      //      branch and tag names, and DiffView's own "compare with saved"
+      //      opens `?sha=HEAD`. Caching a miss for a moving name is a bug by
+      //      construction: diff an as-yet-uncommitted canvas, commit it, and
+      //      `HEAD` now resolves — but the cached miss short-circuits before
+      //      `gitShowFile` is ever asked again. That is exactly the "read
+      //      failure rendered as absence" this feature exists to delete.
+      const authoritative = !fromCloud.ok && fromCloud.reason === 'not-found';
+      if (source == null && authoritative && /^[0-9a-f]{7,40}$/.test(sha)) {
+        historicalMissCache.add(key);
+        if (historicalMissCache.size > HIST_MISS_MAX) {
+          const oldest = historicalMissCache.values().next().value;
+          if (oldest !== undefined) historicalMissCache.delete(oldest);
+        }
+      }
+    }
     if (source == null) return new Response('No saved version of this canvas', { status: 404 });
     try {
       const result = await buildCanvasModule(absPath, source, {
@@ -1122,7 +1213,11 @@ export function createHttp(
   // GitHub routes: MAIN-ORIGIN ONLY (absent from CANVAS_SAFE_API +
   // startCanvasServer) and loopback-Host gated — every route either bears or
   // stores the cloud credential.
-  const cloudApi = createCloudEndpoints(ctx);
+  const cloudApi = createCloudEndpoints({
+    ...ctx,
+    // Connect and Disconnect both change WHO can answer for a past version.
+    onLinkChanged: clearHistoricalCaches,
+  });
   // Figma import (DDR-216). Same dual-allowlist rule as the GitHub + cloud
   // routes: MAIN-ORIGIN ONLY, plus loopback-Host and same-origin gating on
   // every one of them — each either stores or spends the user's Figma PAT.
@@ -1256,6 +1351,23 @@ export function createHttp(
         // blank. See canvasShellUrl().
         tokensCssRel: ctx.cfg.designSystems?.[0]?.tokensCssRel ?? ctx.cfg.tokensCssRel,
       },
+      // DDR-230 — how the render service reaches this project's canvas when
+      // the job dispatches remotely (workspace `remote` lane): the PUBLIC
+      // canvas origin the member's own iframes load from, plus the member's
+      // render token forwarded from THIS request. On a desktop both are
+      // absent/loopback and the lane is `local`, so this is never read.
+      remoteCanvas: {
+        // MAUDE_RENDER_CANVAS_BASE overrides for deployments where the render
+        // service reaches the canvas on a different address than the member's
+        // browser does (the self-hosted sidecar fetches the hub over the
+        // compose network, not the public domain).
+        origin: process.env.MAUDE_RENDER_CANVAS_BASE ?? ctx.canvasOrigin ?? '',
+        // The VIEWER-scoped render token (DDR-230 §c) the hub proxy injects —
+        // NOT `x-maude-canvas-token`, which carries the member's own (up to
+        // write-capable) role. The worker only reads, so it holds only read.
+        token: req.headers.get('x-maude-render-token') ?? undefined,
+        tokensCssRel: ctx.cfg.designSystems?.[0]?.tokensCssRel ?? ctx.cfg.tokensCssRel,
+      },
     };
   }
 
@@ -1629,6 +1741,11 @@ export function createHttp(
         // New feed uses: one answer, so the chip in the status bar and the feed
         // can never name different versions.
         version: resolveMaudeVersion(),
+        // feature-cloud-export-render-workers — which export lane this server
+        // holds (`local` | `remote` | `none`). The client gates the export
+        // dialogs on it so a cell without a render service says WHY a format
+        // is unavailable instead of firing a request the proxy 404s.
+        exportLane: resolveRenderLane(),
         // Cloud Phase 27 (DDR-209) — the capability that opens the cookieless
         // canvas origin, minted per session by the proxy. Absent on a desktop,
         // where the canvas origin is loopback and needs none. `canvasUrl()`
@@ -1645,7 +1762,20 @@ export function createHttp(
         ...(isWorkspaceMode()
           ? {
               cloud: {
-                dashboardUrl: process.env.HUB_DASHBOARD_URL ?? 'https://cloud.maude.sh',
+                // PRESENCE IS THE SWITCH — never a default. `HUB_DASHBOARD_URL`
+                // is written only by the managed fleet (cli/lib/cell-plan.mjs);
+                // a self-hosted `maude hub workspace` never sets it and has no
+                // multi-project dashboard to return to. Defaulting it to the
+                // SaaS put a `← Dashboard` link in every self-hoster's menubar
+                // that walked them off their own deployment onto cloud.maude.sh
+                // — a dead end for an account most of them do not have. Same
+                // rule the hub landing already keeps (server.mjs `isPlatform`)
+                // and the auth pages already keep (browser-auth.mjs): no URL,
+                // no link. Absent, not null, so the client's own check is the
+                // single one — exactly like `canvasToken` two fields down.
+                ...(process.env.HUB_DASHBOARD_URL
+                  ? { dashboardUrl: process.env.HUB_DASHBOARD_URL }
+                  : {}),
                 projectName: process.env.MAUDE_PROJECT_NAME ?? ctx.cfg.name ?? null,
                 // WHO the tab is signed in as, and WHAT that makes them —
                 // per REQUEST, from the proxy's injected headers, never from
@@ -1979,7 +2109,10 @@ export function createHttp(
             { status: result.status, headers: { 'Cache-Control': 'no-store' } }
           );
         }
-        return Response.json({ ok: true, ...result }, { headers: { 'Cache-Control': 'no-store' } });
+        // Spread FIRST: `result` carries its own `ok`, so the old ordering made
+        // the literal dead. Same value either way (this branch is past the
+        // `!result.ok` return), but the guarantee now reads as one.
+        return Response.json({ ...result, ok: true }, { headers: { 'Cache-Control': 'no-store' } });
       }
       return new Response('Method not allowed', { status: 405 });
     },
@@ -2233,6 +2366,22 @@ export function createHttp(
           { status: result.status, headers: { 'Cache-Control': 'no-store' } }
         );
       }
+      // WHO moved this file. A move is the one file-tree op that can make a
+      // canvas seem to vanish, and the receiving side's log only ever names the
+      // retirement — never the request that caused it. The caller (browser
+      // webview vs. a script) is the fact that separates "the sync runtime did
+      // something" from "someone asked for this".
+      // SCRUBBED, ALL THREE VALUES. The User-Agent is caller-controlled and this
+      // line's whole job is answering "who moved this canvas" — an unscrubbed
+      // one lets a caller forge a second, convincing `[fs-move]` line and defeat
+      // the record at exactly its own purpose (ANSI/ESC survives even where a
+      // header parser rejects CR/LF). `fromRel`/`toRel` are CONTAINED but not
+      // renderable: `moveCanvas` checks traversal and group membership, never
+      // control characters.
+      console.log(
+        `[fs-move] ${sanitizeForLog(result.fromRel)} → ${sanitizeForLog(result.toRel)} ` +
+          `(ua=${sanitizeForLog(req.headers.get('user-agent') || 'none').slice(0, 60)})`
+      );
       return Response.json(
         {
           ok: true,
@@ -2455,6 +2604,25 @@ export function createHttp(
         return new Response('local request required', { status: 403 });
       return gitJson(cloudApi.signout());
     },
+    // feature-cloud-managed-git-posture — the history the cell is actually
+    // writing. MAIN-ORIGIN ONLY (absent from CANVAS_SAFE_API + startCanvasServer
+    // routes, DDR-088): the request is proxied onward under the stored hub
+    // credential, which is exactly the shape the untrusted canvas origin must
+    // never reach. `sameOriginRead` is the CSRF guard, `isTrustedRequestHost`
+    // the DNS-rebind one — both mandatory on a token-bearing route.
+    //
+    // A hub 401 here is a plain read failure. It must NOT take the
+    // `/_api/cloud/status` path that deletes the stored credential (F6): a cell
+    // restarting mid-renewal would otherwise silently unlink a working project
+    // because History polled at the wrong second.
+    '/_api/cloud/history': async (req: Request) => {
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required', { status: 403 });
+      const u = new URL(req.url).searchParams;
+      return gitJson(await cloudApi.history(u.get('path'), u.get('limit')));
+    },
     '/_api/cloud/projects': async (req: Request) => {
       if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginRead(req)) return new Response('cross-origin rejected', { status: 403 });
@@ -2543,6 +2711,216 @@ export function createHttp(
       return gitJson({ status: 200, json: { ok: true, sync } });
     },
 
+    // feature-before-first-external-users Task 2 — the three user-facing sync
+    // toggles (syncFiles / propagateDeletes / resolveFirstAnchor), so the
+    // breaker remediation stops meaning "edit JSON by hand" (DDR-177: the
+    // target user has no terminal). MAIN-ORIGIN ONLY: absent from BOTH
+    // CANVAS_SAFE_API and startCanvasServer's `routes` map (DDR-088) —
+    // untrusted canvas content must not be able to turn delete-propagation on
+    // or resolve a first-anchor hold against the user.
+    '/_api/sync/settings': async (req: Request) => {
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (req.method === 'GET') {
+        return Response.json(
+          { settings: readSyncSettings(ctx.paths.repoRoot) },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req)) return syncRefusal('cross-origin', 'Settings must be changed');
+      const body = await readJson<{
+        syncFiles?: unknown;
+        propagateDeletes?: unknown;
+        resolveFirstAnchor?: unknown;
+      }>(req, 4 * 1024);
+      const patch: Record<string, unknown> = {};
+      if ('syncFiles' in (body ?? {})) {
+        if (typeof body?.syncFiles !== 'boolean')
+          return new Response('syncFiles must be a boolean', { status: 400 });
+        patch.syncFiles = body.syncFiles;
+      }
+      if ('propagateDeletes' in (body ?? {})) {
+        if (typeof body?.propagateDeletes !== 'boolean')
+          return new Response('propagateDeletes must be a boolean', { status: 400 });
+        patch.propagateDeletes = body.propagateDeletes;
+      }
+      if ('resolveFirstAnchor' in (body ?? {})) {
+        if (!isFirstAnchorMode(body?.resolveFirstAnchor))
+          return new Response('resolveFirstAnchor must be ask|keep-local|keep-cloud', {
+            status: 400,
+          });
+        patch.resolveFirstAnchor = body.resolveFirstAnchor;
+      }
+      if (Object.keys(patch).length === 0)
+        return new Response('nothing to change', { status: 400 });
+      try {
+        const settings = await writeSyncSettings(ctx.paths.repoRoot, patch);
+        reloadConfig(ctx);
+        // The toggles apply at sync boot, so a saved change asks the
+        // supervisor for a restart — same refusal semantics as Resync: when a
+        // cycle is already running the setting is SAVED and applies on the
+        // next restart, and the response says which of the two happened.
+        let applied = false;
+        const control = ctx.syncControl;
+        if (control && !control.busy?.()) {
+          await control.restart();
+          applied = true;
+        }
+        return Response.json(
+          { ok: true, settings, applied },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      } catch (err) {
+        return gitJson({
+          status: 400,
+          json: {
+            ok: false,
+            detail: err instanceof Error ? err.message : 'settings write failed',
+          },
+        });
+      }
+    },
+
+    // feature-before-first-external-users Task 2 — ownership (repo-owned vs
+    // hub-owned) from the UI. `maude design adopt`/`detach` were CLI-only,
+    // against DDR-177's own posture (the target user never opens a terminal),
+    // and B11 flagged settleOwnership mutating `.gitignore`/index without
+    // asking in non-TTY — here the dialog IS the asking: this route only ever
+    // acts on an explicit user click. MAIN-ORIGIN ONLY, both allowlists absent
+    // (it mutates `.gitignore` + the git index and can drop the hub link).
+    //
+    // Imports cli/lib/design-ownership.mjs DIRECTLY — deliberately not the
+    // hubs-config.ts read-only-mirror pattern: these are MUTATIONS with safety
+    // rules (narrow staging, refuse-on-malformed-gitignore, --cached only),
+    // and two owners of that logic would drift exactly where drift is loss.
+    // Both trees ship together (npm `files`, desktop resources), so the
+    // relative import resolves in every install shape.
+    '/_api/sync/ownership': async (req: Request) => {
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const linked = !!ctx.cfg.linkedHub?.url;
+      if (req.method === 'GET') {
+        const st = ownershipState(ctx.paths.repoRoot, { linked });
+        return Response.json(
+          {
+            mode: st.mode,
+            git: st.git,
+            trackedCount: st.trackedCount,
+            linked,
+            hubUrl: ctx.cfg.linkedHub?.url ?? null,
+            syncthingRoot: st.syncthingRoot ?? null,
+            ...(st.stignoreLine ? { stignoreLine: st.stignoreLine } : {}),
+          },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req)) return syncRefusal('cross-origin', 'Ownership must be changed');
+      const body = await readJson<{ action?: unknown }>(req, 4 * 1024);
+      const action = body?.action;
+      try {
+        if (action === 'adopt') {
+          // A → B: gitignore the design root, untrack (--cached — every byte
+          // stays on disk). Only meaningful while linked: with no hub there
+          // would be no owner left at all.
+          if (!linked)
+            return gitJson({
+              status: 400,
+              json: { ok: false, detail: 'Link a workspace first — adopt hands .design/ to it.' },
+            });
+          const res = adoptToHub(ctx.paths.repoRoot);
+          if (res.action === 'refused-malformed')
+            return gitJson({
+              status: 409,
+              json: {
+                ok: false,
+                detail:
+                  '.gitignore carries an ownership block Maude did not write — fix it by hand, then retry.',
+              },
+            });
+          return gitJson({ status: 200, json: { ok: true, ...res } });
+        }
+        if (action === 'detach') {
+          // B → A: unlink (same path as the Cloud detach — credential dropped,
+          // sync stopped NOW) and un-ignore so the person can commit again.
+          // detachToRepo deliberately does NOT commit or `git add .design` —
+          // what to commit and when stays theirs.
+          const unlink = await cloudApi.detach();
+          const res = detachToRepo(ctx.paths.repoRoot);
+          if (res.action === 'refused-malformed')
+            return gitJson({
+              status: 409,
+              json: {
+                ok: false,
+                detail:
+                  'Unlinked, but .gitignore carries an ownership block Maude did not write — remove it by hand to finish.',
+              },
+            });
+          return gitJson({
+            status: 200,
+            json: {
+              ok: true,
+              unlinked: (unlink.json as { detached?: boolean } | undefined)?.detached ?? false,
+              ...res,
+            },
+          });
+        }
+        return new Response('action must be adopt|detach', { status: 400 });
+      } catch (err) {
+        return gitJson({
+          status: 500,
+          json: {
+            ok: false,
+            detail: err instanceof Error ? err.message : 'ownership change failed',
+          },
+        });
+      }
+    },
+
+    // feature-before-first-external-users Task 3 (F-6) — `_trash/` becomes
+    // discoverable, restorable and prunable. MAIN-ORIGIN ONLY, both DDR-088
+    // allowlists absent: restore MOVES files into the live project and prune
+    // DELETES quarantined copies — from the canvas origin either would let
+    // untrusted content resurrect or destroy parked user work.
+    '/_api/sync/trash': async (req: Request) => {
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (req.method === 'GET') {
+        const entries = listTrash(ctx.paths.designRoot);
+        const bytes = entries.reduce((n, e) => n + e.size, 0);
+        return Response.json(
+          // Cap the wire size; totals stay exact so the panel never lies.
+          { entries: entries.slice(0, 500), total: entries.length, bytes },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return syncRefusal('cross-origin', 'Trash actions must be started');
+      const body = await readJson<{
+        action?: unknown;
+        trashRel?: unknown;
+        olderThanDays?: unknown;
+      }>(req, 8 * 1024);
+      if (body?.action === 'restore') {
+        if (typeof body.trashRel !== 'string')
+          return new Response('trashRel must be a string', { status: 400 });
+        const res = restoreFromTrash(ctx.paths.designRoot, body.trashRel);
+        return gitJson({ status: res.ok ? 200 : 400, json: res });
+      }
+      if (body?.action === 'prune') {
+        const days = body.olderThanDays === undefined ? 30 : Number(body.olderThanDays);
+        // ≥ 1 day: a 0-day prune is "empty the trash", which deserves its own
+        // deliberate gesture, not a slider slipped to zero.
+        if (!Number.isFinite(days) || days < 1)
+          return new Response('olderThanDays must be a number ≥ 1', { status: 400 });
+        const res = pruneTrash(ctx.paths.designRoot, days);
+        return gitJson({ status: 200, json: { ok: true, ...res } });
+      }
+      return new Response('action must be restore|prune', { status: 400 });
+    },
+
     '/_api/sync/cancel-assets': async (req: Request) => {
       // Cancel is scoped to the ASSET SWEEP: killing a reconnect mid-handshake
       // is not a meaningful gesture, killing a multi-hundred-megabyte upload

package/apps/studio/participants-chrome.tsx

@@ -14,6 +14,7 @@
  * own avatar to release. tldraw-style.
  */
 
+import type { JSX } from 'react';
 import { useCallback, useEffect, useRef, useState } from 'react';
 
 import { useViewportControllerContext } from './canvas-lib.tsx';

package/apps/studio/photo-store.ts

@@ -144,6 +144,13 @@ export function createPhotoStore(ctx: Context): PhotoStore {
     try {
       // Bun.write creates the assets/ dir if absent.
       await Bun.write(abs, JSON.stringify(toWrite, null, 2));
+      // Say the write happened. In a cell the recursive fs.watch never fires,
+      // and `fs:any` is how (a) the HMR broadcaster tells open canvases to
+      // re-bake the photo and (b) the write-nudge tells the hub to journal the
+      // sidecar — without it a photo edit saved in the cloud reached peers
+      // only on the walk-import belt, and open canvases not at all. Locally
+      // the real watcher fires too; the broadcaster's debounce coalesces.
+      ctx.bus.emit('fs:any', path.relative(ctx.paths.designRoot, abs).split(path.sep).join('/'));
     } catch (e) {
       return { ok: false, status: 500, error: e instanceof Error ? e.message : 'write failed' };
     }

package/apps/studio/react-augment.d.ts

@@ -0,0 +1,17 @@
+// Ambient React augmentations for markup this codebase genuinely emits but
+// @types/react does not model.
+//
+// `xmlns` on an HTML element. Inside `<foreignObject>` the child div MUST carry
+// the XHTML namespace, or the serialized `.annotations.svg` (the VERSIONED
+// artifact, per DDR-115) is not valid SVG and a standalone viewer drops the
+// sticky body. React passes the attribute straight through to the DOM; only the
+// type is missing. Declared once here rather than cast at each call site, so a
+// third foreignObject child does not re-invent the workaround.
+
+import 'react';
+
+declare module 'react' {
+  interface HTMLAttributes<T> {
+    xmlns?: string;
+  }
+}