@1agh/maude 0.60.6 → 1.0.2

package/apps/studio/sync/asset-pull.ts

@@ -1,210 +0,0 @@
-// Cell→desktop asset pull — the downward half of the asset lane.
-//
-// THE BUG THIS EXISTS TO END. `asset-push.ts` is, in its own words, a
-// "Desktop→cell asset push", and the cell never runs it at all (the
-// `cellPairing` guard on `scheduleAssetSweep`). That is correct as designed —
-// the desktop is the peer that HAS the bytes — but nothing was ever built for
-// the other direction, so an image dropped onto a canvas IN THE BROWSER had its
-// bytes stranded on the cell forever.
-//
-// The text lanes hid how total that was. `<slug>.annotations.svg` syncs, so the
-// image stroke arrives on the desktop with its position, its size and its alt
-// text intact, and renders as a broken-image glyph: a canvas that is visibly
-// there and permanently empty. Confirmed on alligators — `assets/c0fa9c7f.png`
-// referenced by a synced annotation, absent from every local disk.
-//
-// WHAT IT WANTS IS DERIVED LOCALLY, NOT DICTATED. The hub is untrusted to peers
-// (DDR-054), so this never asks "what should I download" — it reads the files
-// this peer ALREADY HOLDS, collects the `assets/…` references in them, and asks
-// only for the ones missing from its own disk. A hostile hub cannot use this to
-// place a file nobody referenced.
-//
-// AND THE REFERENCES THEMSELVES ARE UNTRUSTED. An annotation can have arrived
-// from the hub, so a name found inside one is hub-controlled input. Every
-// candidate is re-validated against `ASSET_NAME_RE` before it becomes a path:
-// one segment, no scheme, no traversal, allowlisted extension — the same shape
-// `ASSET_IMAGE_HREF_RE` enforces on the way in.
-//
-// MISSING-ONLY AND IDEMPOTENT, so a whole machine costs one directory scan and
-// no requests, and a failed pull is retried for free on the next pass.
-
-import {
-  type Dirent,
-  existsSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  renameSync,
-  writeFileSync,
-} from 'node:fs';
-import path from 'node:path';
-
-/** How long to wait for one asset. Generous — these are photographs and clips. */
-const GET_TIMEOUT_MS = 120_000;
-
-/** Refuse an implausible body outright rather than streaming it to disk. */
-const MAX_PULL_BYTES = 512 * 1024 * 1024;
-
-/**
- * How many assets one pass will fetch.
- *
- * The same reasoning as the pull lane's `MAX_PULLS_PER_POLL`: every accepted
- * name becomes a real file in the design root, and this runs on a schedule for
- * the life of the process. A cap makes one answer unable to land thousands, and
- * the remainder is simply picked up by the next pass.
- */
-const MAX_PULLS_PER_PASS = 200;
-
-/**
- * A content-addressed asset name: ONE segment, no traversal, known extension.
- *
- * Deliberately the same shape as the annotation sanitizer's
- * `ASSET_IMAGE_HREF_RE`, widened to the media + font types the push lane already
- * carries. Anchored, so `assets/../../etc/passwd` and `assets/x.png?../` are
- * both refused before a path is built from them.
- */
-const ASSET_NAME_RE =
-  /^[A-Za-z0-9._-]+\.(?:png|jpe?g|webp|gif|avif|svg|mp4|webm|mov|m4v|mp3|wav|m4a|aac|ogg|woff2?|ttf|otf)$/i;
-
-/** Every `assets/<name>` reference in a blob of text. */
-const REFERENCE_RE = /assets\/([A-Za-z0-9._-]+\.[A-Za-z0-9]+)/g;
-
-/** Files worth reading for references — the canvas and its sidecars. */
-const SCANNED_EXT = /\.(?:annotations\.svg|tsx|jsx|css|meta\.json)$/i;
-
-/** Runtime directories that never hold a live reference (DDR-115). */
-const SKIPPED_DIRS = new Set(['_trash', '_history', '_untrusted', '_smoke', 'node_modules']);
-
-export interface AssetPullResult {
-  pulled: string[];
-  /** Referenced, missing, and the hub could not supply it. */
-  failed: { name: string; reason: string }[];
-  /** Referenced and already on disk — the steady state. */
-  present: number;
-}
-
-/**
- * Collect every `assets/<name>` this project references, validated.
- *
- * Reads the canvas bodies and their sidecars. A reference that does not survive
- * `ASSET_NAME_RE` is dropped silently: it is either not an asset or not a name
- * this peer will ever turn into a path.
- */
-export function referencedAssets(designRoot: string): string[] {
-  const out = new Set<string>();
-  const walk = (dir: string, depth: number): void => {
-    if (depth > 8) return;
-    let entries: Dirent[];
-    try {
-      entries = readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const entry of entries) {
-      const abs = path.join(dir, entry.name);
-      if (entry.isDirectory()) {
-        // `assets/` itself is the destination, not a source of references.
-        if (SKIPPED_DIRS.has(entry.name) || entry.name === 'assets') continue;
-        walk(abs, depth + 1);
-        continue;
-      }
-      if (!SCANNED_EXT.test(entry.name)) continue;
-      let text: string;
-      try {
-        text = readFileSync(abs, 'utf8');
-      } catch {
-        continue;
-      }
-      for (const match of text.matchAll(REFERENCE_RE)) {
-        const name = match[1];
-        if (name && ASSET_NAME_RE.test(name)) out.add(name);
-      }
-    }
-  };
-  walk(designRoot, 0);
-  return [...out].sort();
-}
-
-/**
- * Fetch the referenced assets this machine does not have.
- *
- * Sequential on purpose, exactly like `pushAssets`: these run to videos, and
- * saturating a link the sync is also using would starve the handshakes. Never
- * throws — a failure is a line in `failed` and a free retry next pass.
- */
-export async function pullAssets(opts: {
-  designRoot: string;
-  hubUrl: string;
-  /** Read at call time — silent renewal swaps the credential in place. */
-  token: () => string;
-  fetchImpl?: typeof fetch;
-  log?: Pick<Console, 'log' | 'warn'>;
-}): Promise<AssetPullResult> {
-  const { designRoot, hubUrl } = opts;
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const log = opts.log ?? console;
-  const base = hubUrl.replace(/\/+$/, '');
-  const assetsDir = path.join(designRoot, 'assets');
-  const out: AssetPullResult = { pulled: [], failed: [], present: 0 };
-
-  const wanted: string[] = [];
-  for (const name of referencedAssets(designRoot)) {
-    if (existsSync(path.join(assetsDir, name))) out.present += 1;
-    else wanted.push(name);
-  }
-  if (wanted.length === 0) return out;
-
-  // A peer that has never held an asset has no `assets/` yet — the first pull
-  // is exactly when that is true.
-  try {
-    mkdirSync(assetsDir, { recursive: true });
-  } catch (err) {
-    log.warn(`[sync/assets] cannot create ${assetsDir}: ${(err as Error).message}`);
-    return out;
-  }
-
-  const batch = wanted.slice(0, MAX_PULLS_PER_PASS);
-  if (batch.length < wanted.length) {
-    // Named loudly, for the same reason the pull lane names its cap: a silent
-    // truncation reads as "sync is broken" with no cause.
-    log.warn(
-      `[sync/assets] ${wanted.length} referenced assets are missing here; taking ${batch.length} this pass.`
-    );
-  }
-
-  for (const name of batch) {
-    try {
-      const res = await fetchImpl(`${base}/assets/${encodeURIComponent(name)}`, {
-        headers: { authorization: `Bearer ${opts.token()}` },
-        signal: AbortSignal.timeout(GET_TIMEOUT_MS),
-      });
-      if (!res.ok) {
-        // A 404 is ordinary: the other peer has not pushed it yet. It costs a
-        // line here and is retried next pass, when it may well be there.
-        out.failed.push({ name, reason: `HTTP ${res.status}` });
-        continue;
-      }
-      const body = new Uint8Array(await res.arrayBuffer());
-      if (body.byteLength === 0 || body.byteLength > MAX_PULL_BYTES) {
-        out.failed.push({ name, reason: `implausible size (${body.byteLength} B)` });
-        continue;
-      }
-      // Write beside the target and rename, so a reader (the dev server serving
-      // this very path) never sees a half-written image.
-      const finalAbs = path.join(assetsDir, name);
-      const tmpAbs = `${finalAbs}.part`;
-      writeFileSync(tmpAbs, body);
-      renameSync(tmpAbs, finalAbs);
-      out.pulled.push(name);
-    } catch (err) {
-      out.failed.push({ name, reason: (err as Error).message });
-    }
-  }
-
-  if (out.pulled.length > 0) {
-    log.log(
-      `[sync/assets] pulled ${out.pulled.length} asset(s) down from the project (${out.failed.length} still missing).`
-    );
-  }
-  return out;
-}

package/apps/studio/sync/asset-push-worker.ts

@@ -1,84 +0,0 @@
-// The asset sweep, in its own process — feature-sync-resync-and-out-of-process-sweep.
-//
-// WHY A SEPARATE PROCESS.
-//
-// The sweep crashes Bun 1.3.3 *when it runs alongside the dev server*, proven by
-// isolation: the identical sweep against the same live hub completes standalone
-// (182/182, 0 failures) and crash-loops in-process (three `Segmentation fault at
-// address 0x0` plus a bus error, then the supervisor gave up after 3 restarts).
-// Nobody has a fix for the fault itself, so the boundary is the fix: a fault
-// here costs the sweep, and the editor — canvases, browser UI, ACP panel —
-// stays up. The parent reports the dead child as a failed sweep.
-//
-// It is also what makes a Resync button safe to offer at all: pressing it
-// re-runs this, and a button that can kill the person's dev server is not a
-// button.
-//
-// PROTOCOL. argv gives the design root, the hub URL and a file holding the
-// credential. stdout carries NDJSON — one tagged JSON object per line:
-//
-//   {"t":"progress", …AssetPushProgress}   many, throttled by pushAssets
-//   {"t":"result",   …AssetPushResult}     exactly one, on a clean finish
-//   {"t":"error", "message": "…"}          exactly one, on a thrown sweep
-//
-// Tagged rather than positional ("the last line is the result") so a parent
-// reading a truncated stream can still tell a final answer from a progress
-// tick. Nothing else may reach stdout — one stray `console.log` from an import
-// would land mid-stream — so diagnostics go to stderr, which the parent logs.
-//
-// THE CREDENTIAL ARRIVES IN A FILE, NEVER IN ARGV. `ps` is world-readable on
-// every platform this ships to; a hub token on a command line is a hub token
-// handed to every other user on the machine. The file is written 0600 by the
-// parent and unlinked when the sweep ends. It is re-read per call, not cached,
-// so a parent that rewrites it after a silent renewal is picked up mid-sweep.
-
-import { readFileSync } from 'node:fs';
-
-import { type AssetPushProgress, type AssetPushResult, pushAssets } from './asset-push.ts';
-
-const [, , designRoot, hubUrl, tokenFile] = process.argv;
-
-/** One NDJSON line. Synchronous — ordering with the result line is the contract. */
-function emit(line: { t: 'progress' | 'result' | 'error' } & Record<string, unknown>): void {
-  process.stdout.write(`${JSON.stringify(line)}\n`);
-}
-
-async function main(): Promise<void> {
-  if (!designRoot || !hubUrl || !tokenFile) {
-    emit({ t: 'error', message: 'usage: <designRoot> <hubUrl> <tokenFile>' });
-    process.exit(2);
-  }
-
-  // Read at call time — `pushAssets` asks per request, and a renewal mid-sweep
-  // rewrites the file underneath us. A read that fails (the parent unlinked it
-  // during teardown) falls back to the last value we saw rather than sending an
-  // empty Authorization, which the hub would answer 401 for every remaining
-  // file and report as 182 failures instead of one dead sweep.
-  let lastToken = '';
-  const token = (): string => {
-    try {
-      lastToken = readFileSync(tokenFile, 'utf8').trim() || lastToken;
-    } catch {
-      /* keep the last good one */
-    }
-    return lastToken;
-  };
-
-  const result: AssetPushResult = await pushAssets({
-    designRoot,
-    hubUrl,
-    token,
-    // stderr, never stdout — stdout is the protocol.
-    log: {
-      log: (...a: unknown[]) => process.stderr.write(`${a.join(' ')}\n`),
-      warn: (...a: unknown[]) => process.stderr.write(`${a.join(' ')}\n`),
-    },
-    onProgress: (p: AssetPushProgress) => emit({ t: 'progress', ...p }),
-  });
-  emit({ t: 'result', ...result });
-}
-
-main().catch((err) => {
-  emit({ t: 'error', message: String((err as Error)?.message ?? err).slice(0, 2000) });
-  process.exit(1);
-});

package/apps/studio/sync/asset-sweep.ts

@@ -1,262 +0,0 @@
-// The parent half of the out-of-process asset sweep — feature-sync-resync-and-
-// out-of-process-sweep. The child is `asset-push-worker.ts`; read its header
-// first, it carries the protocol and the reason the boundary exists at all.
-//
-// What this module owns:
-//
-//   • spawning the child the way the packaged app can actually run it (DDR-177 —
-//     the compiled sidecar re-entered as a JS runtime, never a user-installed
-//     `bun`), reusing the sandbox's own resolver so the two cannot drift;
-//   • handing over the credential through a 0600 file that is unlinked when the
-//     sweep ends, because argv is world-readable via `ps`;
-//   • turning NDJSON lines back into the `AssetPushProgress` the panel already
-//     consumes, so `_sync.json`, the WS fanout and the Sync panel are untouched;
-//   • making a DEAD CHILD a reported failure instead of a silent stall. Before
-//     the boundary, a fault took the dev server with it; after it, the sweep is
-//     the only casualty and the panel has to say so — an asset lane frozen at
-//     "92 of 182" forever is the failure mode this whole change is about.
-
-import { mkdtempSync, renameSync, rmSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-
-import { resolveBunPath, workerEnv } from '../canvas-build-sandbox.ts';
-import { DEV_SERVER_ROOT } from '../paths.ts';
-import type { AssetPushProgress, AssetPushResult } from './asset-push.ts';
-
-/** A stray unterminated flood must not grow the parent's heap. */
-const MAX_LINE_BYTES = 1024 * 1024;
-
-/** How much of the child's stderr is kept for the failure message. */
-const STDERR_KEEP = 2000;
-
-/** Grace between SIGTERM and SIGKILL when a sweep is cancelled. */
-const KILL_GRACE_MS = 2000;
-
-/**
- * How often the parent checks whether the credential has been renewed.
- *
- * A sweep can run for minutes; `scheduleRenewal` can swap the runtime's token
- * underneath it. In-process that was free (the old call read `() => token` per
- * request). Across the boundary the child re-reads its file per request, so the
- * PARENT has to keep that file current or a renewal mid-sweep turns every
- * remaining upload into a 401.
- */
-const TOKEN_REFRESH_MS = 30_000;
-
-export interface AssetSweepHandle {
-  /** The sweep's result, or `null` when it did not finish (crash / cancel). */
-  done: Promise<AssetPushResult | null>;
-  /** Stop the sweep. Idempotent; safe after completion. */
-  cancel(): void;
-}
-
-/** Absolute path to the child entry, resolved per DDR-045 (never a bunfs path). */
-export function assetWorkerScript(): string {
-  return join(DEV_SERVER_ROOT, 'sync', 'asset-push-worker.ts');
-}
-
-export function runAssetSweep(opts: {
-  designRoot: string;
-  hubUrl: string;
-  /**
-   * Read at call time — silent renewal swaps the credential in place, exactly
-   * as the in-process sweep's `() => token` did. The value is written 0600 to a
-   * temp file the child re-reads, and re-written when it changes.
-   */
-  token: () => string;
-  onProgress?: (p: AssetPushProgress) => void;
-  env?: NodeJS.ProcessEnv;
-  log?: Pick<Console, 'log' | 'warn'>;
-  /** Test injection — the spawn and the script path. */
-  spawn?: typeof Bun.spawn;
-  script?: string;
-}): AssetSweepHandle {
-  const log = opts.log ?? console;
-  const spawn = opts.spawn ?? Bun.spawn;
-  const env = opts.env ?? process.env;
-
-  let cancelled = false;
-  let child: Bun.Subprocess<'ignore', 'pipe', 'pipe'> | null = null;
-  let killTimer: ReturnType<typeof setTimeout> | null = null;
-  // The last thing the child told us — the base for the final emit we have to
-  // synthesize ourselves when it never gets to send one.
-  let last: AssetPushProgress | null = null;
-
-  const emit = (p: AssetPushProgress): void => {
-    last = p;
-    try {
-      opts.onProgress?.(p);
-    } catch (err) {
-      log.warn(`[sync/assets] progress listener threw: ${(err as Error).message}`);
-    }
-  };
-
-  /**
-   * The sweep stopped without finishing. Say so ONCE, in the payload the panel
-   * already reads, keeping whatever counts we had — a lane that stops at "92 of
-   * 182" and stays there is the exact lie this replaces.
-   */
-  const emitStopped = (reason: string): void => {
-    const base = last;
-    const failures = (base?.failures ?? []).slice();
-    failures.push({ key: '(sweep)', reason });
-    emit({
-      total: base?.total ?? 0,
-      done: base?.done ?? 0,
-      pushed: base?.pushed ?? 0,
-      skipped: base?.skipped ?? 0,
-      failedCount: (base?.failedCount ?? 0) + 1,
-      failures,
-      active: null,
-      finished: true,
-    });
-  };
-
-  const done = (async (): Promise<AssetPushResult | null> => {
-    // A temp DIRECTORY, so the 0600 file is also inside a 0700 dir — the file
-    // mode alone is enough on every platform we ship to, but a private parent
-    // costs nothing and closes the window between create and chmod.
-    const dir = mkdtempSync(join(tmpdir(), 'maude-sweep-'));
-    const tokenFile = join(dir, 'hub-token');
-    let refresh: ReturnType<typeof setInterval> | null = null;
-    try {
-      // Temp-then-rename on every write, including the first: the child reads
-      // this file per request, and a plain overwrite can be observed half-done.
-      let written = '';
-      const putToken = (value: string): void => {
-        if (!value || value === written) return;
-        const tmp = `${tokenFile}.tmp`;
-        writeFileSync(tmp, value, { mode: 0o600 });
-        renameSync(tmp, tokenFile);
-        written = value;
-      };
-      putToken(opts.token());
-      refresh = setInterval(() => {
-        try {
-          putToken(opts.token());
-        } catch (err) {
-          log.warn(
-            `[sync/assets] could not refresh the sweep credential: ${(err as Error).message}`
-          );
-        }
-      }, TOKEN_REFRESH_MS);
-      refresh.unref?.();
-
-      const script = opts.script ?? assetWorkerScript();
-      try {
-        child = spawn([resolveBunPath(env), script, opts.designRoot, opts.hubUrl, tokenFile], {
-          env: workerEnv(env),
-          cwd: opts.designRoot,
-          stdin: 'ignore',
-          stdout: 'pipe',
-          stderr: 'pipe',
-        }) as Bun.Subprocess<'ignore', 'pipe', 'pipe'>;
-      } catch (err) {
-        // Never fall back to sweeping in-process: that is the crash this whole
-        // boundary exists to survive, and it would come back invisibly.
-        emitStopped(`the asset sweep could not start: ${(err as Error).message}`);
-        return null;
-      }
-
-      // Cancel may have been called between the handle being returned and the
-      // spawn landing — honour it rather than letting a doomed sweep run.
-      if (cancelled) child.kill('SIGTERM');
-
-      let result: AssetPushResult | null = null;
-      let childError: string | null = null;
-      let stderr = '';
-
-      const drainErr = (async () => {
-        try {
-          stderr = (await new Response(child?.stderr).text()).slice(-STDERR_KEEP);
-        } catch {
-          /* the stream died with the process — nothing to keep */
-        }
-      })();
-
-      let buf = '';
-      const decoder = new TextDecoder();
-      try {
-        for await (const chunk of child.stdout as ReadableStream<Uint8Array>) {
-          buf += decoder.decode(chunk, { stream: true });
-          let nl = buf.indexOf('\n');
-          while (nl !== -1) {
-            const line = buf.slice(0, nl);
-            buf = buf.slice(nl + 1);
-            nl = buf.indexOf('\n');
-            if (!line.trim()) continue;
-            let parsed: { t?: string; message?: unknown } & Record<string, unknown>;
-            try {
-              parsed = JSON.parse(line);
-            } catch {
-              // Defensive: a stray write from an import would land mid-stream.
-              // Dropping the line keeps the sweep readable instead of ending it.
-              continue;
-            }
-            // The tag is transport, not payload — `progress` lands in
-            // `_sync.json` and every open tab, so it goes out the way the
-            // in-process sweep used to emit it, with no extra field.
-            const { t, ...payload } = parsed;
-            if (t === 'progress') emit(payload as unknown as AssetPushProgress);
-            else if (t === 'result') result = payload as unknown as AssetPushResult;
-            else if (t === 'error') childError = String(parsed.message ?? 'unknown');
-          }
-          if (buf.length > MAX_LINE_BYTES) buf = '';
-        }
-      } catch (err) {
-        childError ??= `the sweep's output could not be read: ${(err as Error).message}`;
-      }
-
-      await child.exited;
-      await drainErr;
-      if (killTimer) clearTimeout(killTimer);
-
-      const code = child.exitCode;
-      const signal = child.signalCode;
-
-      if (cancelled) {
-        emitStopped('cancelled');
-        return null;
-      }
-      if (result && code === 0) return result;
-
-      // Everything below is a sweep that did not finish. Name WHY as concretely
-      // as the child let us — a signal is the segfault class this boundary was
-      // built for, and the panel saying "stopped unexpectedly (SIGSEGV)" is what
-      // turns an invisible stall into a bug report.
-      const why = childError
-        ? `the asset sweep failed: ${childError}`
-        : signal
-          ? `the asset sweep stopped unexpectedly (${signal})`
-          : `the asset sweep exited with code ${code}`;
-      log.warn(`[sync/assets] ${why}${stderr ? `\n${stderr.trim()}` : ''}`);
-      emitStopped(why);
-      return null;
-    } finally {
-      if (refresh) clearInterval(refresh);
-      child = null;
-      rmSync(dir, { recursive: true, force: true });
-    }
-  })();
-
-  return {
-    done,
-    cancel(): void {
-      if (cancelled) return;
-      cancelled = true;
-      if (!child) return;
-      child.kill('SIGTERM');
-      // A child wedged inside a socket read will not notice SIGTERM; the whole
-      // point of cancel is that it always ends.
-      killTimer = setTimeout(() => {
-        try {
-          child?.kill('SIGKILL');
-        } catch {
-          /* already gone */
-        }
-      }, KILL_GRACE_MS);
-      killTimer.unref?.();
-    },
-  };
-}