@1agh/maude 0.60.6 → 1.0.2

package/apps/studio/client/panels/GitPanel.jsx

@@ -174,8 +174,20 @@ export default function GitPanel({
   // PRESENTATION, NOT A CONTROL — `.git` is untouched, a terminal `git` works
   // exactly as before, and Disconnect (CloudBar) restores the panel live.
   cloudManaged = false,
+  // WHOSE HISTORY THESE ROWS ARE (feature-cloud-managed-git-posture).
+  //
+  // Decided by App, at the one place the posture is named, and handed down —
+  // the panel must NOT re-derive it from `cloudManaged`, because the whole
+  // point of the constant is that this rule has exactly one spelling. `loadLog`
+  // is swapped at the same call site; this prop is only how the panel knows
+  // which repo the rows it just received describe, so it can name it.
+  historySource = 'local',
+  // `{ branch, project, hubHost }` — what the cell reported alongside the log.
+  // Null until the first successful cloud load.
+  cloudHistory = null,
 }) {
   const withdrawn = historyOnly || cloudManaged;
+  const cloudHistorySource = historySource === 'cloud';
   const [tab, setTab] = useState(withdrawn ? 'history' : 'changes');
   // `cloudManaged` flips at runtime (connect/disconnect) — the initial tab
   // state alone would leave a freshly-linked panel sitting on Changes.
@@ -193,6 +205,13 @@ export default function GitPanel({
   // versions are click-to-preview), '' → repo-wide read-only list. `undefined`
   // = nothing loaded yet. (phase-27.1)
   const [logScope, setLogScope] = useState(undefined);
+  // A FAILED LOAD IS NOT AN EMPTY HISTORY. The local reader could only ever
+  // succeed (it reads a repo on this disk), so `log === []` meant one thing.
+  // The cloud reader can fail, and reporting that as "No saved versions yet"
+  // would reproduce — over the network this time — the exact false reassurance
+  // this feature exists to delete. `loadLog` answers `null` for "could not
+  // reach", `[]` for "nothing saved yet".
+  const [logFailed, setLogFailed] = useState(false);
   const selectAllRef = useRef(null);
 
   // History is scoped to the open canvas/specimen so each row previews THAT
@@ -417,9 +436,10 @@ export default function GitPanel({
     let cancelled = false;
     setLogLoading(true);
     (async () => {
-      const entries = (await loadLog(historyScope || undefined)) || [];
+      const entries = await loadLog(historyScope || undefined);
       if (cancelled) return;
-      setLog(entries);
+      setLogFailed(entries == null);
+      setLog(entries ?? []);
       setLogScope(historyScope);
       setLogLoading(false);
     })();
@@ -428,12 +448,38 @@ export default function GitPanel({
     };
   }, [tab, historyScope, logScope, loadLog]);
 
+  // Retry, and re-read on a posture flip. Dropping the cached scope is the
+  // panel's existing "reload History" gesture (`run()` already uses it), so
+  // Retry needs no second mechanism — and Connect/Disconnect swaps `loadLog`
+  // under us, which must re-ask rather than keep showing the other repo's rows.
+  const reloadHistory = () => {
+    setLogFailed(false);
+    setLogScope(undefined);
+  };
+  // eslint-disable-next-line react-hooks/exhaustive-deps
+  useEffect(() => {
+    setLogFailed(false);
+    setLogScope(undefined);
+  }, [historySource]);
+
   function toggleAll() {
     setUnchecked((prev) => (prev.size === 0 ? new Set(files.map((f) => f.path)) : new Set()));
   }
 
   const count = files.length;
-  const branch = status?.branch || 'main';
+  // WHICH REPO THE HEADER NAMES. `status` is LOCAL git, and in cloud-managed
+  // posture the app stops fetching it entirely — so a header built from it
+  // would name the desktop folder and the desktop's branch while the rows
+  // underneath list the cell's commits. That mismatch (`desktop-side / main`
+  // over the cloud's versions) is half of the reported confusion.
+  //
+  // The cell reports its own project and branch with the log. The hub host is
+  // the fallback: it names SOMETHING true about where these versions live,
+  // which the local folder name does not.
+  const headerProject = cloudHistorySource
+    ? (cloudHistory?.project ?? cloudHistory?.hubHost ?? null)
+    : project;
+  const branch = cloudHistorySource ? (cloudHistory?.branch ?? '') : status?.branch || 'main';
   const unpushed = status?.unpushed || 0;
   const canSave = message.trim().length > 0 && checkedPaths.length > 0 && !busy;
   const notRepo = status && status.repo === false;
@@ -476,12 +522,20 @@ export default function GitPanel({
           <span className="gp-panel-title">{withdrawn ? 'History' : 'Changes'}</span>
           {!withdrawn && count > 0 && <span className="gp-count">{count} unsaved</span>}
           <span className="gp-spacer" />
-          <span className="gp-draft" title="Your project and shared draft">
+          <span
+            className="gp-draft"
+            data-testid="git-panel-repo"
+            title={
+              cloudHistorySource
+                ? 'The cloud project these versions belong to'
+                : 'Your project and shared draft'
+            }
+          >
             <Icon name="folder" size={12} />
-            {project ? (
+            {headerProject ? (
               <>
-                <b>{project}</b>
-                <span className="gp-sep">/</span>
+                <b>{headerProject}</b>
+                {branch ? <span className="gp-sep">/</span> : null}
               </>
             ) : null}
             {branch}
@@ -756,17 +810,71 @@ export default function GitPanel({
             <div className="gp-empty">
               <p>Loading history…</p>
             </div>
+          ) : logFailed ? (
+            // A READ FAILURE, SAID AS ONE. Reuses the `callout--warning`
+            // vocabulary the banner above already uses, so this is copy and a
+            // Retry action rather than a new component.
+            <div className="gp-pad">
+              <div
+                className="callout callout--warning"
+                role="status"
+                aria-live="polite"
+                data-testid="git-history-unreachable"
+              >
+                <div className="gp-callout-col">
+                  <span>
+                    <strong
+                      style={{
+                        display: 'block',
+                        marginBottom: 'var(--space-1)',
+                        color: 'var(--fg-0)',
+                      }}
+                    >
+                      Couldn’t reach the cloud history.
+                    </strong>
+                    Your work is still being saved — this is only the list of versions.
+                  </span>
+                  <div className="gp-callout-actions">
+                    <button
+                      type="button"
+                      className="btn btn--sm"
+                      data-testid="git-history-retry"
+                      onClick={reloadHistory}
+                    >
+                      Retry
+                    </button>
+                  </div>
+                </div>
+              </div>
+            </div>
           ) : !log || log.length === 0 ? (
             <div className="gp-empty">
               <span className="gp-empty-glyph">
                 <Icon name="history" size={24} />
               </span>
-              <h3>No saved versions yet</h3>
-              <p>
-                {previewable
-                  ? `Save a version of ${activeName} and it'll show up here.`
-                  : "Save a version and it'll show up here."}
-              </p>
+              {cloudHistorySource ? (
+                // NEVER OFFER THE SAVE THIS POSTURE HAS WITHDRAWN. The old copy
+                // ("Save a version and it'll show up here") sat directly under a
+                // "Cloud is saving" note and told the reader to do a thing the
+                // panel had just removed the button for — which is how "No saved
+                // versions yet" came to read as "nothing is being saved".
+                <>
+                  <h3>No versions yet</h3>
+                  <p>
+                    The cloud is saving this project
+                    {previewable ? `. Versions of ${activeName} appear here as you work.` : '. Versions appear here as you work.'}
+                  </p>
+                </>
+              ) : (
+                <>
+                  <h3>No saved versions yet</h3>
+                  <p>
+                    {previewable
+                      ? `Save a version of ${activeName} and it'll show up here.`
+                      : "Save a version and it'll show up here."}
+                  </p>
+                </>
+              )}
             </div>
           ) : (
             log.map((c) => {

package/apps/studio/client/panels/SettingsPanel.jsx

@@ -1182,7 +1182,7 @@ function AppearanceTab({ theme, onSetTheme, cpMode, onSetCpMode }) {
 }
 
 export default function SettingsPanel({
-  /** `{ dashboardUrl, projectName }` when this is a cloud tab, else null. */
+  /** `{ dashboardUrl?, projectName }` when this is a cloud tab, else null. */
   // Tri-state (see the note where this value is created): `undefined` until
   // the server config answers, `null` for the desktop, an object for a cloud
   // tab. Defaulting it to `null` here is what re-broke the boot 404 after the

package/apps/studio/client/panels/SyncConsentDialog.jsx

@@ -0,0 +1,182 @@
+// feature-before-first-external-users Task 2 — the first-upgrade consent
+// dialog. `sharedDoc` / `syncFiles` / `propagateDeletes` all default ON, so a
+// person who links (or upgrades into) a hub gets file mirroring and delete
+// propagation without ever having said yes to either — the round-4 ADVOCATE
+// finding. This asks ONCE per (hub, machine), the first time a sync payload
+// for that hub arrives, and records the answer.
+//
+// Deliberately NOT inside the Sync panel: a consent that only appears if you
+// happen to open a panel is not consent. It mounts with the global banners in
+// app.jsx and renders over everything (st-dialog anatomy).
+//
+// The answer is machine-local (localStorage, like the notice acks) — consent
+// is per human per machine, not a project setting to sync around. "Keep
+// syncing" records acceptance and changes nothing; "Limit sync" turns
+// `syncFiles` + `propagateDeletes` off through the same `/_api/sync/settings`
+// route the panel's toggles use, so the limited state is inspectable and
+// reversible in Settings, not a hidden third mode.
+
+import { useCallback, useEffect, useState } from 'react';
+
+const CONSENT_KEY = 'maude-sync-consent';
+
+function readConsent(url) {
+  try {
+    const all = JSON.parse(localStorage.getItem(CONSENT_KEY) || '{}');
+    const c = all[url];
+    return c && typeof c === 'object' ? c : null;
+  } catch {
+    return null;
+  }
+}
+
+function writeConsent(url, choice) {
+  try {
+    const all = JSON.parse(localStorage.getItem(CONSENT_KEY) || '{}');
+    all[url] = { choice, at: Date.now() };
+    localStorage.setItem(CONSENT_KEY, JSON.stringify(all));
+  } catch {
+    /* private mode — the dialog will simply ask again next boot */
+  }
+}
+
+/** Loopback hubs (local dev, a cell's own hub) are consent-by-configuration —
+ *  nothing leaves the machine, and nagging every dev boot trains people to
+ *  click through the one dialog that matters. Mirrors isLoopbackHubUrl. */
+function isLoopback(url) {
+  try {
+    const h = new URL(url).hostname;
+    return h === 'localhost' || h === '::1' || /^127\./.test(h) || h === '[::1]';
+  } catch {
+    return false;
+  }
+}
+
+export default function SyncConsentDialog({ status, cloud }) {
+  const url = typeof status?.url === 'string' ? status.url : null;
+  // `answered` only forces the re-render after a click — the record itself
+  // lives in localStorage so a reload cannot re-ask.
+  const [answered, setAnswered] = useState(false);
+  const [busy, setBusy] = useState(false);
+  const [note, setNote] = useState('');
+
+  // Never on a cell (a member browsing someone's hosted project is not the
+  // machine whose files sync), never for loopback, never before sync speaks.
+  const due = !cloud && url && !isLoopback(url) && !answered && !readConsent(url);
+
+  // The dialog steals the screen, so say so to assistive tech the same way
+  // the other modals do — but only while actually shown.
+  useEffect(() => {
+    if (!due) return undefined;
+    const onKey = (e) => {
+      // No Escape-to-dismiss: an unanswered consent must not be dismissable
+      // into the accepted-by-silence state. Tab stays inside via the two
+      // buttons being the only tabbables in the sheet.
+      if (e.key === 'Escape') e.preventDefault();
+    };
+    window.addEventListener('keydown', onKey, true);
+    return () => window.removeEventListener('keydown', onKey, true);
+  }, [due]);
+
+  const accept = useCallback(() => {
+    if (url) writeConsent(url, 'accepted');
+    setAnswered(true);
+  }, [url]);
+
+  const limit = useCallback(async () => {
+    setBusy(true);
+    setNote('');
+    let ok = false;
+    try {
+      const res = await fetch('/_api/sync/settings', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ syncFiles: false, propagateDeletes: false }),
+      });
+      const json = await res.json().catch(() => null);
+      ok = json?.ok === true;
+      if (!ok) setNote(json?.detail || 'The limited mode could not be saved — try again.');
+    } catch {
+      setNote('Maude could not reach the sync service — try again.');
+    }
+    setBusy(false);
+    if (ok) {
+      if (url) writeConsent(url, 'limited');
+      setAnswered(true);
+    }
+  }, [url]);
+
+  if (!due) return null;
+
+  let host = url;
+  try {
+    host = new URL(url).host;
+  } catch {
+    /* keep the raw string */
+  }
+
+  return (
+    <div className="st-scrim" data-testid="sync-consent">
+      <div
+        className="st-dialog st-consent"
+        role="dialog"
+        aria-modal="true"
+        aria-labelledby="sync-consent-title"
+      >
+        <div className="st-dialog-hd">
+          <span className="st-dialog-title" id="sync-consent-title">
+            This project syncs with {host}
+          </span>
+        </div>
+        <div className="st-dialog-bd">
+          <p>Since your last update, syncing covers more than canvases. With this workspace:</p>
+          <ul className="st-consent-list">
+            <li>
+              <strong>The whole design folder mirrors both ways</strong> — stylesheets, docs and
+              code modules, not only canvases.
+            </li>
+            <li>
+              <strong>Deleting a file here deletes it there</strong> (and the other way round).
+              Replaced copies are kept in the Sync panel's Trash, and bulk removals pause for confirmation.
+            </li>
+            {status?.sharedDoc && (
+              <li>
+                <strong>Your live editing buffer is the shared object</strong> — edits stream to
+                the workspace as you type, not as saved copies.
+              </li>
+            )}
+          </ul>
+          <p className="st-consent-fine">
+            You can change either choice any time in the Sync panel's Settings. Only sync with
+            workspaces you operate or trust.
+          </p>
+          {note && (
+            <p className="st-consent-note" role="status" aria-live="polite">
+              {note}
+            </p>
+          )}
+        </div>
+        <div className="st-dialog-ft">
+          <button
+            type="button"
+            className="btn btn--ghost"
+            data-testid="sync-consent-limit"
+            disabled={busy}
+            onClick={limit}
+          >
+            {busy ? 'Saving…' : 'Sync canvases only'}
+          </button>
+          <button
+            type="button"
+            className="btn btn--primary"
+            data-testid="sync-consent-accept"
+            disabled={busy}
+            onClick={accept}
+          >
+            Keep syncing everything
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}