@1agh/maude 0.60.7 → 1.0.2

package/apps/studio/sync/file-pull.ts

@@ -2,9 +2,10 @@
 // project file the canvas lanes do not own (feature-sync-file-plane, binding
 // decision maude/sync-two-plane-manifest-architecture).
 //
-// WHAT THIS REPLACES, AND WHY THE HEADER OF `asset-pull.ts` STILL MATTERS.
-// The asset pull derives its wants LOCALLY (it fetches only names its own
-// files reference), so a hostile hub can never place a file nobody asked for.
+// WHAT THIS REPLACES, AND WHY THE DELETED `asset-pull.ts`'s INVARIANT STILL
+// MATTERS. The reference-derived asset pull (deleted in Sync v2 Increment 5)
+// derived its wants LOCALLY (it fetched only names its own files reference),
+// so a hostile hub could never place a file nobody asked for.
 // That invariant is exactly what made the 103-file gap unfixable: a fresh
 // link REFERENCES nothing, so it can want nothing, so the design system that
 // makes the canvases render never arrives (RCA
@@ -52,6 +53,7 @@ import {
   type FileClass,
   isFilePlaneClass,
 } from './file-membership.ts';
+import { createPullBudget } from './pull-budget.ts';
 import { quarantineFile } from './tombstone-apply.ts';
 
 /** How long to wait for the manifest. Same figure as the doc listing. */
@@ -93,6 +95,9 @@ export interface FilePullResult {
   /** Refused by re-classification or per-class admission. */
   dropped: { rel: string; reason: string }[];
   failed: { rel: string; reason: string }[];
+  /** F6 — the pass stopped on the aggregate byte budget rather than the count
+   *  cap. The remainder is the next pass's work. */
+  budgetExhausted?: true;
 }
 
 /**
@@ -153,6 +158,8 @@ export interface PullFilesOptions {
   fetchImpl?: typeof fetch;
   log?: Pick<Console, 'log' | 'warn'>;
   now?: () => number;
+  /** F6 — override the aggregate per-pass byte ceiling (tests). */
+  maxPassBytes?: number;
 }
 
 /**
@@ -255,8 +262,26 @@ export async function pullFiles(opts: PullFilesOptions): Promise<FilePullResult>
     );
   }
 
+  // F6 (DDR-226 §9) — the per-file cap and the count cap multiply, and the hub
+  // picks both factors. One aggregate ceiling per pass closes that. This lane
+  // has the manifest, so the charge lands BEFORE the request: an oversize batch
+  // costs no transfer at all.
+  const budget = createPullBudget({
+    label: 'sync/files',
+    log,
+    ...(opts.maxPassBytes !== undefined ? { maxBytes: opts.maxPassBytes } : {}),
+  });
+
   for (const { entry, abs, conflict } of batch) {
     const rel = entry.path;
+    if (budget.exhausted()) break;
+    // The manifest size is hub-supplied and therefore a hint — it reserves the
+    // budget; the ACTUAL bytes are re-charged below, so an understated size
+    // cannot buy a bigger transfer.
+    if (!budget.take(entry.size)) {
+      out.budgetExhausted = true;
+      break;
+    }
     try {
       const res = await fetchImpl(
         `${base}/_project-file/${rel.split('/').map(encodeURIComponent).join('/')}`,
@@ -274,6 +299,16 @@ export async function pullFiles(opts: PullFilesOptions): Promise<FilePullResult>
         out.failed.push({ rel, reason: `implausible size (${body.byteLength} B)` });
         continue;
       }
+      // Charge the overrun: the manifest's size was a hint, the wire is the
+      // fact. A body larger than declared must not slip past the ceiling.
+      if (body.byteLength > entry.size && !budget.take(body.byteLength - entry.size)) {
+        out.failed.push({
+          rel,
+          reason: `pass byte budget reached (declared ${entry.size} B, sent ${body.byteLength} B)`,
+        });
+        out.budgetExhausted = true;
+        break;
+      }
       // The manifest named a hash; the bytes must BE that hash. A mismatch is
       // usually a write racing the poll — a free retry, never a landing.
       const gotSha = createHash('sha256').update(body).digest('hex');
@@ -311,7 +346,9 @@ export async function pullFiles(opts: PullFilesOptions): Promise<FilePullResult>
 
   if (out.pulled.length > 0 || out.conflicts.length > 0) {
     log.log(
-      `[sync/files] pulled ${out.pulled.length} project file(s) down (${out.skipped} already here, ${out.conflicts.length} conflict(s), ${out.failed.length} failed).`
+      `[sync/files] pulled ${out.pulled.length} project file(s) down (${out.skipped} already here, ${out.conflicts.length} conflict(s), ${out.failed.length} failed${
+        out.budgetExhausted ? ', pass byte budget reached — resuming next pass' : ''
+      }).`
     );
   }
   return out;

package/apps/studio/sync/hub-link.ts

@@ -35,7 +35,17 @@ export interface HubLinkResult {
 const HUB_PROBE_TIMEOUT_MS = 4000;
 
 interface HubsFile {
-  hubs: Record<string, { token: string; linkedAt: number; role?: string; expiresAt?: number }>;
+  hubs: Record<
+    string,
+    {
+      token: string;
+      linkedAt: number;
+      role?: string;
+      expiresAt?: number;
+      /** Local consent — see `HubRecord.codeModulesAllowed` in hubs-config.ts. */
+      codeModulesAllowed?: boolean;
+    }
+  >;
   trusted?: string[];
 }
 
@@ -135,11 +145,16 @@ export function saveHubCredential(
       /* malformed → start fresh rather than throw */
     }
   }
+  // `codeModulesAllowed` is LOCAL consent and survives every re-save. A
+  // sign-in response can change what the hub claims your role is; it must not
+  // be able to change what you agreed this hub may deliver.
+  const priorConsent = cfg.hubs[normUrl]?.codeModulesAllowed;
   cfg.hubs[normUrl] = {
     token,
     linkedAt: Date.now(),
     ...(role ? { role } : {}),
     ...(typeof expiresAt === 'number' && Number.isFinite(expiresAt) ? { expiresAt } : {}),
+    ...(typeof priorConsent === 'boolean' ? { codeModulesAllowed: priorConsent } : {}),
   };
   if (!Array.isArray(cfg.trusted)) cfg.trusted = [];
   if (!cfg.trusted.includes(normUrl)) cfg.trusted.push(normUrl);

package/apps/studio/sync/hub-listing.ts

@@ -0,0 +1,46 @@
+// What the hub says it holds — indexed the way the rest of the runtime asks.
+//
+// THE BUG THIS MODULE EXISTS TO PREVENT. The listing was indexed by
+// `slugFromDocName`, which strips the `ws/<workspace>/<branch>/` namespace by
+// design, while the very next consumer of the same listing (`diffRemoteDocs`)
+// compares full document names. One input, two key spaces — so a `hero` on
+// `main` answered for a DIFFERENT peer's `hero` on `feat/x`, and that peer's
+// cold-start seed deferred forever while logging that the hub's state was on its
+// way. Nothing was coming, and the canvas simply never synced. A peer token is
+// commonly `scope: '*'`, so one listing spans every namespace on the hub: no
+// hostile hub is needed, one teammate naming a canvas the same thing on another
+// branch is enough.
+//
+// Keeping the index and its question in one place, with one key space, is the
+// whole point of the module.
+
+/** One row of `GET /api/documents` — names and byte counts, never content. */
+export interface HubDocRow {
+  name: string;
+  bytes?: number;
+}
+
+/**
+ * Index one listing by FULL document name.
+ *
+ * Rows without a usable name are dropped rather than coerced: this map answers
+ * a question about identity, and a blank key would answer it for everyone.
+ */
+export function indexHubDocs(docs: readonly HubDocRow[]): Map<string, number> {
+  const out = new Map<string, number>();
+  for (const d of docs) {
+    if (typeof d?.name === 'string' && d.name) out.set(d.name, Number(d.bytes ?? 0));
+  }
+  return out;
+}
+
+/**
+ * Does the hub hold STATE for this exact document?
+ *
+ * A row with zero bytes is a document that exists but carries nothing — not
+ * state, and deferring to it would leave a canvas that never syncs in either
+ * direction. An absent row is the same answer as a listing we never got.
+ */
+export function hubHolds(index: ReadonlyMap<string, number>, docName: string): boolean {
+  return (index.get(docName) ?? 0) > 0;
+}

package/apps/studio/sync/hubs-config.ts

@@ -37,6 +37,22 @@ export interface HubRecord {
    * renewal", which is exactly the old behaviour.
    */
   expiresAt?: number;
+  /**
+   * A LOCAL, user-given consent: may this hub deliver executable modules?
+   *
+   * `role` above is the hub's own claim about you, re-read from every sign-in
+   * response — a cache of what the hub said, not local knowledge. Deriving the
+   * `code-module` receive gate from it meant the gate was set by the party it
+   * defends against: a hostile hub answers `user.role: "owner"` once and every
+   * `.ts`/`.mjs` it offers lands in `.design/`, where the AGENT and the
+   * `maude design *` helpers read it — a different blast radius from a `.tsx`
+   * rendering in the sandboxed canvas origin.
+   *
+   * So it is recorded here at link time by an explicit answer and NEVER
+   * rewritten by a login response. Absent means no — the pessimistic branch,
+   * the same direction every other default in this file leans.
+   */
+  codeModulesAllowed?: boolean;
 }
 
 export interface HubsConfig {