@1agh/maude 1.0.7 → 1.0.8

package/apps/studio/exporters/video.ts

@@ -15,7 +15,7 @@
 // Scope is always `artboard`. No native binaries; the capture Chromium is the
 // same one every other exporter already uses (DDR-041).
 
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { mkdtempSync, readFileSync, realpathSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
@@ -30,7 +30,45 @@ import {
   type ExportResult,
 } from './index.ts';
 import type { Target } from './scope.ts';
-import { audioRefusalMessage, scanUnsupportedMedia } from './unsupported-media.ts';
+import {
+  audioRefusalMessage,
+  scanUnsupportedMedia,
+  type UnsupportedFinding,
+} from './unsupported-media.ts';
+
+/** Resolve a client-influenced canvas `file` to an absolute path inside the
+ * design root, following symlinks — .tsx/.html only. Mirrors jobs.ts's guard
+ * (security review F2). Returns null on any failure. */
+function safeCanvasAbs(repoRoot: string, designRoot: string, file: string): string | null {
+  if (!/\.(tsx|html)$/i.test(file)) return null;
+  try {
+    const designReal = realpathSync(path.resolve(designRoot));
+    // `file` is repo-relative (carries the `.design/` prefix) — resolve against
+    // repoRoot, require the realpath under designRoot.
+    const abs = realpathSync(path.resolve(repoRoot, file));
+    return abs === designReal || abs.startsWith(designReal + path.sep) ? abs : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * `options.unsupportedMedia` — the cell's pre-resolved `scanUnsupportedMedia`
+ * findings for a remote job, or null when absent (local lane: scan the disk).
+ * Shape-checked: it crosses the cell→worker HTTP boundary.
+ */
+function shippedUnsupportedMedia(options: ExportOptions): UnsupportedFinding[] | null {
+  const raw = (options as { unsupportedMedia?: unknown }).unsupportedMedia;
+  if (!Array.isArray(raw)) return null;
+  return raw.filter(
+    (f): f is UnsupportedFinding =>
+      !!f &&
+      typeof f === 'object' &&
+      ((f as UnsupportedFinding).element === 'Audio' ||
+        (f as UnsupportedFinding).element === 'OffthreadVideo') &&
+      typeof (f as UnsupportedFinding).sourceFile === 'string'
+  );
+}
 
 // DDR-045: resolve via DEV_SERVER_ROOT, never `import.meta.dir`. See _runtime.ts.
 const VIDEO_PLAYWRIGHT = exportShimPath('_video-playwright.mjs');
@@ -75,8 +113,21 @@ async function runVideo(
   // via a muted file is pure waste. GIF is silent by format, so it is exempt.
   let preStamped: ExportDegradation | undefined;
   if (format !== 'gif' && options.allowUnsupportedMedia !== true) {
-    const canvasAbs = path.resolve(ctx.repoRoot, el.file);
-    for (const finding of scanUnsupportedMedia(canvasAbs)) {
+    // The scan reads the canvas SOURCE, which only the process holding the
+    // checkout has. On the render worker (DDR-230: no tenant files) the read
+    // fails quietly — an empty finding list — and the export went on to do
+    // EXACTLY what this guard exists to prevent: renderMediaOnWeb rejected
+    // <Audio>, the frame-step fallback ran ~40× slower and shipped a muted
+    // file. So the cell resolves the findings up front and ships them in the
+    // job (`options.unsupportedMedia`, exporters/jobs.ts), same as printProps.
+    // `el.file` is client-influenced (canvasFile / selection.file). On the
+    // local/in-cell lane we scan it off disk — bound to the DESIGN root,
+    // realpath-checked (a `startsWith` prefix alone is escaped by an
+    // in-checkout symlink), .tsx/.html only (defender W1 / attacker F2).
+    const canvasAbs = safeCanvasAbs(ctx.repoRoot, ctx.designRoot, el.file);
+    const findings =
+      shippedUnsupportedMedia(options) ?? (canvasAbs ? scanUnsupportedMedia(canvasAbs) : []);
+    for (const finding of findings) {
       if (finding.element === 'Audio' && options.audio !== false) {
         // Refuse. A vanished music bed is worse than an export that did not run.
         throw new Error(audioRefusalMessage(finding, el.file));
@@ -97,10 +148,26 @@ async function runVideo(
   // silent format), so it never needs the render-lib bundle; mp4/webm build it
   // alongside the frame-step encode-lib (the shim decides per-target at runtime
   // whether the artboard has a registered comp to hand the renderer).
-  const [lib, renderLib] = await Promise.all([
-    getEncodeLibBundle(),
-    format === 'gif' ? Promise.resolve(null) : getWebRendererBundle(),
-  ]);
+  // These Bun.build calls happen BEFORE the render shim spawns. On the headless
+  // render worker a mp4 job hung here in total silence (no shim ever launched,
+  // so the shim's own hard-kill never fired) — bound it so a stuck bundle build
+  // FAILS with a named reason instead of eating the whole render budget.
+  console.error(`[video] building bundles (format=${format})…`);
+  const bundleStart = Date.now();
+  const withTimeout = (p: Promise<unknown>, label: string, ms: number) =>
+    Promise.race([
+      p,
+      new Promise((_, reject) =>
+        setTimeout(() => reject(new Error(`${label} did not finish within ${ms}ms`)), ms)
+      ),
+    ]);
+  const [lib, renderLib] = (await Promise.all([
+    withTimeout(getEncodeLibBundle(), 'encode-lib bundle', 90_000),
+    format === 'gif'
+      ? Promise.resolve(null)
+      : withTimeout(getWebRendererBundle(), 'web-renderer bundle', 90_000),
+  ])) as [string, string | null];
+  console.error(`[video] bundles ready in ${Date.now() - bundleStart}ms`);
   const tmp = mkdtempSync(path.join(tmpdir(), 'maude-video-'));
   const outPath = path.join(tmp, `export.${format}`);
 

package/apps/studio/http.ts

@@ -6,7 +6,7 @@
 
 import { createHash } from 'node:crypto';
 import { existsSync, readFileSync, realpathSync, unlinkSync, watch } from 'node:fs';
-import { dirname, join, posix, relative, resolve, sep } from 'node:path';
+import { basename, dirname, join, posix, relative, resolve, sep } from 'node:path';
 // Ownership mutations live with the CLI on purpose — see /_api/sync/ownership.
 import { adoptToHub, detachToRepo, ownershipState } from '../../cli/lib/design-ownership.mjs';
 import {
@@ -39,6 +39,7 @@ import type { Context } from './context.ts';
 import { reloadConfig } from './context.ts';
 import { buildDebugBundle } from './debug-bundle.ts';
 import { probeSetupReadiness } from './design-setup-readiness.ts';
+import { isScopeValidForFormat, scopeRefusalMessage } from './exporters/format-scopes.ts';
 import { type Format, isFormat, isScope, type Scope } from './exporters/index.ts';
 import { type ExportJobQueue, ExportQueueFullError } from './exporters/jobs.ts';
 import type { ActiveJsonShape } from './exporters/scope.ts';
@@ -399,6 +400,19 @@ export const READ_ONLY_ALLOWED_WRITES = new Set([
   '/_api/export', // "look, comment and download" — the cell allows /api/export too
   '/_api/export-jobs',
   '/_api/export-jobs/download',
+  // DDR-231 Phase 2 T6 — the browser lane's ledger row. A viewer may already
+  // EXPORT (the two entries above), so recording that they did is the same
+  // class of write: it touches no project state, only the recent-exports list.
+  // Refusing it here while allowing the export produced exactly the reported
+  // symptom for viewers — a file downloads and nothing anywhere says so.
+  '/_api/export-history',
+  // …and the deck's composition half. The member's own browser captured the
+  // PNGs; this route only packs bytes they already hold into a .pptx and hands
+  // it back — it writes no project state. Missing from this list, a VIEWER's
+  // PPTX export captured every artboard and then died on a 403 with the dialog
+  // still saying "Capturing 10/10" (found by the T7 export E2E, which runs
+  // unauthenticated and therefore as a viewer).
+  '/_api/export-assemble',
   '/_api/report', // bug reports are about Maude, not the project
   '/_api/report-fallback',
   // Cloud Phase 27 — COMMENT IS THE ONE WRITE A VIEWER HOLDS. The role matrix
@@ -4292,12 +4306,49 @@ export function createHttp(
     },
 
     '/_api/export-history': async (req: Request) => {
-      // Phase 6.5 T10 — read-only recent-exports feed for the dialog's
-      // Recent tab. Writes happen as a side-effect of job completion
-      // (exporters/jobs.ts persistAndEvict) rather than this handler.
-      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
-      const history = exportJobs.loadHistory();
-      return Response.json({ history }, { headers: { 'Cache-Control': 'no-store' } });
+      // Phase 6.5 T10 — recent-exports feed for the dialog's Recent tab. For a
+      // JOB, the write happens as a side-effect of completion (exporters/
+      // jobs.ts persistAndEvict), not here.
+      //
+      // DDR-231 Phase 2 T6 — the browser lane has no job: the member's own
+      // browser captures the artboard and saves the file, and this process
+      // never sees the bytes. Phase 1 therefore left those exports INVISIBLE —
+      // "v exports dialog nic nevidim" — so the POST exists to record one in
+      // the same ledger. It stores a name and a timestamp, never a payload.
+      if (req.method === 'GET') {
+        const history = exportJobs.loadHistory();
+        return Response.json({ history }, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      // Same gates as every other write here: CSRF + DNS-rebinding. This route
+      // is MAIN-ORIGIN only (absent from CANVAS_SAFE_API + the canvas server's
+      // routes map) — the canvas iframe reaches it through the shell bridge.
+      if (!isTrustedRequestHost(req))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      const body = await readJson<{ format?: unknown; scope?: unknown; filename?: unknown }>(
+        req,
+        4 * 1024
+      );
+      if (!body) return new Response('body required', { status: 400 });
+      if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
+      if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
+      // The name is chosen in the browser, where tenant TSX shares the window
+      // (DDR-231 F1) — reduce it to a bare, charset-limited basename before it
+      // reaches the ledger that agents and future sessions read back.
+      const raw = typeof body.filename === 'string' ? body.filename : '';
+      const filename = basename(raw)
+        .replace(/[^A-Za-z0-9._-]/g, '')
+        .slice(0, 255);
+      if (!filename || /^\.+$/.test(filename))
+        return new Response('filename required', { status: 400 });
+      const entry = exportJobs.recordBrowserExport({
+        format: body.format,
+        scope: body.scope,
+        filename,
+      });
+      return Response.json(entry, { status: 201, headers: { 'Cache-Control': 'no-store' } });
     },
 
     '/_api/export': async (req: Request) => {
@@ -4323,6 +4374,14 @@ export function createHttp(
       if (!body) return new Response('body required', { status: 400 });
       if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
       if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
+      // DDR-231 Phase 2 T4 — the PAIR, not just each half. `pdf` + `project-raw`
+      // is two individually-valid values that resolve to a `file-tree` target,
+      // which the render service refuses as `invalid render job` — a refusal
+      // that named neither the field nor the remedy. Reproduced locally against
+      // a real maude-render; see test/export-format-scope-coherence.test.ts.
+      if (!isScopeValidForFormat(body.format, body.scope)) {
+        return new Response(scopeRefusalMessage(body.format, body.scope), { status: 400 });
+      }
       const format = body.format;
       const scope = body.scope;
       try {
@@ -4376,6 +4435,14 @@ export function createHttp(
       if (!body) return new Response('body required', { status: 400 });
       if (!isFormat(body.format)) return new Response('unknown or missing format', { status: 400 });
       if (!isScope(body.scope)) return new Response('unknown or missing scope', { status: 400 });
+      // DDR-231 Phase 2 T4 — the PAIR, not just each half. `pdf` + `project-raw`
+      // is two individually-valid values that resolve to a `file-tree` target,
+      // which the render service refuses as `invalid render job` — a refusal
+      // that named neither the field nor the remedy. Reproduced locally against
+      // a real maude-render; see test/export-format-scope-coherence.test.ts.
+      if (!isScopeValidForFormat(body.format, body.scope)) {
+        return new Response(scopeRefusalMessage(body.format, body.scope), { status: 400 });
+      }
       try {
         const { id, result } = exportJobs.enqueue(
           buildExportArgs(req, { format: body.format, scope: body.scope, options: body.options })

package/apps/studio/test/canvas-hide-chrome.test.ts

@@ -13,6 +13,7 @@ import { describe, expect, test } from 'bun:test';
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
+import { CAPTURE_HIDDEN_SELECTORS } from '../exporters/capture-chrome.ts';
 import { DEV_SERVER_ROOT } from '../paths.ts';
 
 const SHELL_HTML_PATH = join(
@@ -56,3 +57,32 @@ describe('_shell.html #canvas-hide-chrome covers every overlay mount class', ()
     });
   }
 });
+
+// DDR-231 Phase 2 T2 — the SECOND consumer. The browser lane captures the live
+// canvas (it never navigates to `?hide-chrome=1`), so it applies the same
+// suppression from `exporters/capture-chrome.ts`. Two copies of a selector list
+// drift; this is the tripwire that makes them fail loudly instead. Same shape
+// as the `isMaudeRuntimeState` / `isRuntimeStateRel` agreement pin.
+describe('capture-chrome.ts agrees with the _shell.html block', () => {
+  const shellHtml = readFileSync(SHELL_HTML_PATH, 'utf8');
+  const block =
+    shellHtml.match(/<style id="canvas-hide-chrome"[^>]*>([\s\S]*?)<\/style>/)?.[1] ?? '';
+
+  /** Selectors declared in the shell's style block, comments stripped. */
+  const shellSelectors = block
+    .replace(/\/\*[\s\S]*?\*\//g, '')
+    .replace(/\{[\s\S]*$/, '')
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean);
+
+  test('every shell selector is in CAPTURE_HIDDEN_SELECTORS', () => {
+    const ours = new Set(CAPTURE_HIDDEN_SELECTORS);
+    expect(shellSelectors.filter((s) => !ours.has(s))).toEqual([]);
+  });
+
+  test('every CAPTURE_HIDDEN_SELECTORS entry is in the shell block', () => {
+    const theirs = new Set(shellSelectors);
+    expect(CAPTURE_HIDDEN_SELECTORS.filter((s) => !theirs.has(s))).toEqual([]);
+  });
+});