@1agh/maude 1.2.0 → 1.3.1

package/apps/studio/sync/source-recovery.ts

@@ -0,0 +1,70 @@
+// Bounded recovery slots, outside the rolling snapshot queue: a corrupt peer
+// cannot evict the last valid source by flooding rejected updates (#121).
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { atomicWrite } from './atomic-write.ts';
+import { MAX_HTML_BYTES } from './limits.ts';
+import { sourceError } from './source-validation.ts';
+
+/**
+ * `base` is the body disk and doc last agreed on — the merge base a restart
+ * needs, since the journal keeps only its hash (audit 2026-09-13 P0 #1).
+ */
+export type RecoverySlot = 'last-valid' | 'local' | 'incoming' | 'base';
+
+export function saveRecoveryBody(
+  historyDir: string,
+  file: string,
+  slot: RecoverySlot,
+  body: string
+): string {
+  if (Buffer.byteLength(body, 'utf8') > MAX_HTML_BYTES)
+    throw new Error('Recovery source exceeds size limit');
+  const target = path.join(historyDir, 'sync-recovery', `${slot}${path.extname(file)}`);
+  if (!existsSync(target) || readFileSync(target, 'utf8') !== body) atomicWrite(target, body);
+  return target;
+}
+
+/** One recovery slot's body, or null when absent/unreadable/oversized. */
+export function readRecoveryBody(
+  historyDir: string,
+  file: string,
+  slot: RecoverySlot
+): string | null {
+  const target = path.join(historyDir, 'sync-recovery', `${slot}${path.extname(file)}`);
+  try {
+    if (statSync(target).size > MAX_HTML_BYTES) return null;
+    return readFileSync(target, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export function lastValidSource(historyDir: string, file: string): string | null {
+  const ext = path.extname(file);
+  const retained = path.join(historyDir, 'sync-recovery', `last-valid${ext}`);
+  let candidates = [retained];
+  try {
+    candidates = candidates.concat(
+      readdirSync(historyDir, { withFileTypes: true })
+        .filter((e) => e.isFile() && e.name.endsWith(ext))
+        .map((e) => e.name)
+        .sort()
+        .reverse()
+        .slice(0, 300)
+        .map((name) => path.join(historyDir, name))
+    );
+  } catch {
+    /* no older history */
+  }
+  for (const candidate of candidates) {
+    try {
+      if (statSync(candidate).size > MAX_HTML_BYTES) continue;
+      const body = readFileSync(candidate, 'utf8');
+      if (body.trim() && sourceError(file, body) === null) return body;
+    } catch {
+      /* try the next snapshot */
+    }
+  }
+  return null;
+}

package/apps/studio/sync/source-validation.ts

@@ -0,0 +1,56 @@
+// #121: parser success alone does not rule out duplicate source declarations.
+import { parseSync } from 'oxc-parser';
+import { MAX_HTML_BYTES } from './limits.ts';
+
+/** Null means safe source syntax; never resolves imports or executes code. */
+export function sourceError(file: string, body: string): string | null {
+  if (!/\.[jt]sx?$/i.test(file)) return null;
+  if (Buffer.byteLength(body, 'utf8') > MAX_HTML_BYTES) return 'Source exceeds the size limit';
+  try {
+    const parsed = parseSync(file, body, { sourceType: 'module', showSemanticErrors: true });
+    if (parsed.errors.length) return 'Source has syntax errors or duplicate bindings';
+    const functions = new Set<string>();
+    for (const statement of parsed.program.body) {
+      const node =
+        statement.type === 'ExportNamedDeclaration' || statement.type === 'ExportDefaultDeclaration'
+          ? statement.declaration
+          : statement;
+      // TS overload signatures and interface merging are valid. Only multiple
+      // implementations collide; OXC currently accepts those even in modules.
+      if (node?.type === 'FunctionDeclaration' && node.body && node.id) {
+        if (functions.has(node.id.name)) return 'Source has duplicate function implementations';
+        functions.add(node.id.name);
+      }
+    }
+    // Overload/type-only declarations may share an exported name. Exclude
+    // their own entries, not every later export with that name (#121).
+    const typeOnlyExports = new Set(
+      parsed.program.body
+        .filter(
+          (statement) =>
+            statement.type === 'ExportNamedDeclaration' &&
+            statement.declaration &&
+            ['TSDeclareFunction', 'TSInterfaceDeclaration', 'TSTypeAliasDeclaration'].includes(
+              statement.declaration.type
+            )
+        )
+        .map((statement) => statement.start)
+    );
+    const exports = new Set<string>();
+    for (const statement of parsed.module.staticExports) {
+      if (typeOnlyExports.has(statement.start)) continue;
+      for (const entry of statement.entries) {
+        if (entry.isType) continue;
+        const name = entry.exportName.kind === 'Default' ? 'default' : entry.exportName.name;
+        if (name === null) continue;
+        if (exports.has(name)) {
+          return 'Source has duplicate exports';
+        }
+        exports.add(name);
+      }
+    }
+    return null;
+  } catch {
+    return 'Source could not be validated';
+  }
+}

package/apps/studio/sync/status.ts

@@ -19,7 +19,11 @@ import type { SeedProgress } from './seed-progress.ts';
 // `cold-start-hub-wins` stays in the union for OLD payload readers (additive
 // evolution — the NoSyncablePayload discriminator pattern); new conflicts are
 // recorded as `cold-start-diverged` with the DDR-102 winner + snapshot refs.
-export type ConflictKind = 'cold-start-hub-wins' | 'cold-start-diverged' | 'git-pull';
+export type ConflictKind =
+  | 'cold-start-hub-wins'
+  | 'cold-start-diverged'
+  | 'git-pull'
+  | 'body-rejected';
 
 export interface SyncConflict {
   slug: string;
@@ -33,6 +37,8 @@ export interface SyncConflict {
   /** DDR-102 fail-closed (F1) — the local snapshot didn't land, so a hub-wins
    *  overwrite was refused (local kept). Surfaces the degraded `_history/` write. */
   snapshotFailed?: boolean;
+  /** #121 — source refused before materializing or importing. */
+  reason?: 'invalid-source' | 'local-edit' | 'history-failed' | 'merge-budget';
 }
 
 export interface SyncStatusPayload extends SyncStatusSnapshot {
@@ -75,6 +81,30 @@ export interface SyncStatusPayload extends SyncStatusSnapshot {
    * panel and keeps a machine-local dismiss ack keyed on (id, hub url).
    */
   notices?: SyncNotice[];
+  /**
+   * Plan T29 — accepted revisions: what a person is waiting on. Additive;
+   * absent until the project saves through accepted revisions.
+   */
+  accepted?: AcceptedSaveStatus;
+  /**
+   * Plan T29 — cold open: ms from the runtime's start until every canvas was
+   * in step, and until the file plane first converged (media complete).
+   * Additive; each appears once it happens.
+   */
+  coldOpen?: { canvasesMs?: number; filesMs?: number };
+  /** Plan T29 — the newest accepted revision this checkout has written (vs the hub's head). */
+  appliedRevision?: number;
+  /** Plan T16 — an AI action open or held (unfinished). Absent when none. */
+  aiAction?: { state: 'open' | 'held'; label: string; canvases: string[]; since: number };
+}
+
+export interface AcceptedSaveStatus {
+  pending: number;
+  oldestPendingAt: number | null;
+  ackMs: { last: number | null; p95: number | null; n: number };
+  rejected: number;
+  /** The project refuses this sign-in — changes wait for signing in again. */
+  credentialRefused?: boolean;
 }
 
 export interface SyncNotice {
@@ -201,10 +231,18 @@ export interface SyncStatusStore {
   /** feature-sync-file-plane — merge Plane B counts + persist + broadcast.
    *  Same reasoning as `updateAssets`: a lane, not a connection. */
   updateFiles(files: FilePlaneStatus): void;
+  /** Plan T29 — accepted-revisions save counters. */
+  updateAccepted(next: AcceptedSaveStatus): void;
+  /** Plan T29 — the newest accepted revision written to this checkout. */
+  noteAppliedRevision(revision: number): void;
+  /** Plan T16 — the AI action stage (null clears it). */
+  updateAiAction(next: SyncStatusPayload['aiAction'] | null): void;
   /** Record a consent-class notice (A7) + persist + broadcast. Idempotent by
    *  `id` — the notice sites fire once per boot, and a repeat is a no-op
    *  rather than a duplicate row. */
   notice(notice: Omit<SyncNotice, 'at'>): void;
+  /** Remove a resolved source-sync warning; consent notices are untouched. */
+  clearSourceConflict(slug: string): void;
   /** Current payload (defensive copy). */
   get(): SyncStatusPayload;
 }
@@ -238,6 +276,11 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
 
   let assets: AssetPushProgress | undefined;
   let files: FilePlaneStatus | undefined;
+  let accepted: AcceptedSaveStatus | undefined;
+  let aiAction: SyncStatusPayload['aiAction'] | undefined;
+  const bootAt = now();
+  const coldOpen: { canvasesMs?: number; filesMs?: number } = {};
+  let appliedRevision: number | undefined;
   const notices: SyncNotice[] = [];
 
   function payload(): SyncStatusPayload {
@@ -261,6 +304,12 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
       ...(opts.sharedDoc ? { sharedDoc: true } : {}),
       ...(assets ? { assets } : {}),
       ...(files ? { files } : {}),
+      ...(accepted ? { accepted } : {}),
+      ...(aiAction ? { aiAction } : {}),
+      ...(coldOpen.canvasesMs !== undefined || coldOpen.filesMs !== undefined
+        ? { coldOpen: { ...coldOpen } }
+        : {}),
+      ...(appliedRevision !== undefined ? { appliedRevision } : {}),
       ...(notices.length ? { notices: notices.slice() } : {}),
     };
   }
@@ -329,6 +378,10 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
     update(next) {
       const changed = snapshot.state !== next.state;
       snapshot = next;
+      const d = next.docs;
+      if (coldOpen.canvasesMs === undefined && d && d.synced > 0 && d.pending === 0) {
+        coldOpen.canvasesMs = now() - bootAt;
+      }
       // A connection state CHANGE is the headline; a heartbeat is not.
       flush(changed);
     },
@@ -341,8 +394,30 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
       assets = progress;
       flush();
     },
+    noteAppliedRevision(revision) {
+      if (appliedRevision !== undefined && revision <= appliedRevision) return;
+      appliedRevision = revision;
+      flush();
+    },
+    updateAiAction(next) {
+      aiAction = next ?? undefined;
+      flush(true);
+    },
+    updateAccepted(next) {
+      const was = accepted;
+      accepted = next;
+      // Going from waiting to caught-up (or back) is news; a latency tick is not.
+      flush(
+        ((was?.pending ?? 0) === 0) !== (next.pending === 0) ||
+          next.rejected !== was?.rejected ||
+          !!next.credentialRefused !== !!was?.credentialRefused
+      );
+    },
     updateFiles(next) {
       files = next;
+      if (coldOpen.filesMs === undefined && next.progress?.phase === 'converged') {
+        coldOpen.filesMs = now() - bootAt;
+      }
       // A finished or stalled seed is what a person is waiting to see; a
       // mid-seed tick is not.
       flush(next.progress?.phase === 'converged' || next.progress?.phase === 'blocked');
@@ -352,6 +427,13 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
       notices.push({ ...next, at: now() });
       flush(true);
     },
+    clearSourceConflict(slug) {
+      const id = `source-conflict-${slug}`;
+      const index = notices.findIndex((n) => n.id === id);
+      if (index < 0) return;
+      notices.splice(index, 1);
+      flush(true);
+    },
     get: payload,
   };
 }