@hienlh/ppm 0.23.10 → 0.23.11

package/src/services/design/export/design-zip-export.ts

@@ -1,13 +1,19 @@
-import { join } from "node:path";
+import { extname, join } from "node:path";
 import archiver from "archiver";
 import { isCredentialPath } from "../../fs-path-guard.service.ts";
 import { DesignError } from "../design-error.ts";
+import { DEFAULT_SYSTEM_ID, isValidSystemId, SYSTEM_FILE, systemFilesDir } from "../design-systems-paths.ts";
 import { lstatOrNull, resolveDesignDir, resolveDesignsRoot } from "../design-paths.ts";
 import { readDesignFileSafe, safeWalkDesignTree } from "../design-safe-walk.ts";
 
 /**
- * A design as a zip: `<slug>/**` plus the project's `tokens.css` and `DESIGN.md`, rooted at
- * `designs/` so every `../tokens.css` link still resolves after unzipping.
+ * A design as a zip: `<slug>/**` plus the project's `tokens.css` and `DESIGN.md` (kept for
+ * old designs that still link the legacy `../tokens.css`), and, for every app the design
+ * actually references, that app's `systems/<id>/**` folder, all rooted at `designs/` so a
+ * `../tokens.css` or `../systems/<id>/…` link still resolves after unzipping. For the
+ * `default` app, whose real files live at the `designs/` root rather than
+ * `designs/systems/default/`, the zip re-roots them under `systems/default/` so the literal
+ * relative link in the exported HTML keeps working with no server-side alias to resolve it.
  *
  * Every file comes from the shared safe walker and is read through `readDesignFileSafe`: no
  * symlink (a link to `ppm.db` or a key is never packed), no FIFO or device, nothing whose
@@ -20,12 +26,28 @@ import { readDesignFileSafe, safeWalkDesignTree } from "../design-safe-walk.ts";
 export const MAX_ZIP_FILES = 5000;
 export const MAX_ZIP_BYTES = 512 * 1024 * 1024;
 const SHARED_FILES = ["tokens.css", "DESIGN.md"];
+/** Text files worth scanning for a `../systems/<id>/` reference; a byte pattern, not a parse. */
+const SYSTEMS_REF_EXTENSIONS = new Set([".html", ".htm", ".css", ".js", ".mjs"]);
+const SYSTEMS_REF_SCAN_BYTES = 512 * 1024;
+const SYSTEMS_REF_RE = /\.\.\/systems\/([a-z0-9][a-z0-9-]{0,62})\//g;
 
 interface ZipEntry {
   name: string;
   abs: string;
 }
 
+/** Every app id the design's own text files reference via `../systems/<id>/`. */
+async function referencedSystemIds(designDir: string): Promise<Set<string>> {
+  const ids = new Set<string>();
+  for await (const entry of safeWalkDesignTree(designDir)) {
+    if (entry.rel.split("/").some((part) => part.startsWith("."))) continue;
+    if (!SYSTEMS_REF_EXTENSIONS.has(extname(entry.rel).toLowerCase()) || entry.size > SYSTEMS_REF_SCAN_BYTES) continue;
+    const text = (await readDesignFileSafe(entry.abs, SYSTEMS_REF_SCAN_BYTES)).toString("utf8");
+    for (const m of text.matchAll(SYSTEMS_REF_RE)) if (isValidSystemId(m[1])) ids.add(m[1]!);
+  }
+  return ids;
+}
+
 async function listZipEntries(projectPath: string, slug: string): Promise<ZipEntry[]> {
   const designDir = await resolveDesignDir(projectPath, slug);
   const root = await resolveDesignsRoot(projectPath);
@@ -49,6 +71,32 @@ async function listZipEntries(projectPath: string, slug: string): Promise<ZipEnt
     if (!st || st.isSymbolicLink() || !st.isFile() || isCredentialPath(abs)) continue;
     add(name, abs, st.size);
   }
+  if (root) {
+    for (const id of await referencedSystemIds(designDir)) {
+      if (id === DEFAULT_SYSTEM_ID) {
+        for (const name of SHARED_FILES) {
+          const abs = join(root, name);
+          const st = await lstatOrNull(abs);
+          if (!st || st.isSymbolicLink() || !st.isFile() || isCredentialPath(abs)) continue;
+          add(`systems/${id}/${name}`, abs, st.size);
+        }
+        const kitDir = join(root, "kit");
+        if ((await lstatOrNull(kitDir))?.isDirectory()) {
+          for await (const entry of safeWalkDesignTree(kitDir)) {
+            if (entry.rel.split("/").some((p) => p.startsWith("."))) continue;
+            add(`systems/${id}/kit/${entry.rel}`, entry.abs, entry.size);
+          }
+        }
+        continue;
+      }
+      const dir = systemFilesDir(root, id);
+      if (!(await lstatOrNull(dir))?.isDirectory()) continue;
+      for await (const entry of safeWalkDesignTree(dir)) {
+        if (entry.rel === SYSTEM_FILE || entry.rel.split("/").some((p) => p.startsWith("."))) continue;
+        add(`systems/${id}/${entry.rel}`, entry.abs, entry.size);
+      }
+    }
+  }
   return entries;
 }
 

package/src/services/design/preview/design-preview-scope.ts

@@ -2,22 +2,30 @@ import { realpath } from "node:fs/promises";
 import { join, relative, resolve, sep } from "node:path";
 import { guardPreviewAsset, isInsideRoot, previewDenied } from "../../../server/helpers/preview-asset-guard.ts";
 import { resolveDesignDir, resolveDesignsRoot } from "../design-paths.ts";
+import { systemFilesDir } from "../design-systems-paths.ts";
+import { parseSystemsAliasTail } from "./design-systems-alias.ts";
 import type { DesignRef } from "./design-preview-tokens.ts";
 
 /**
  * Which file a preview request under one token may read.
  *
- * A token covers `designs/<slug>/**` and exactly one alias, `tokens.css`, which is the
- * shared `designs/tokens.css` (a design links it as `../tokens.css`, and from
- * `/content/<token>/<slug>/index.html` that resolves to `/content/<token>/tokens.css`).
- * Everything else — another design, `DESIGN.md`, anything under a dot-directory such as
- * the design's own `.design/` — is a 403.
+ * A token covers `designs/<slug>/**` and two aliases: `tokens.css`, the shared
+ * `designs/tokens.css` (a design links it as `../tokens.css`), and `systems/<id>/**`, one
+ * app's read-only design-system folder (a design links `../systems/<id>/tokens.css`,
+ * `../systems/<id>/kit/app.css`, `../systems/<id>/kit/icons/<name>.svg`…) — for the `default`
+ * app this remaps to the legacy `designs/` root rather than `designs/systems/default/`, since
+ * those files are never moved. From `/content/<token>/<slug>/index.html` those resolve to
+ * `/content/<token>/tokens.css` and `/content/<token>/systems/<id>/…`. Everything else —
+ * another design, `DESIGN.md`, anything under a dot-directory such as the design's own
+ * `.design/` — is a 403.
  *
  * The design folder is re-resolved on every request rather than remembered from mint, so a
  * design deleted or swapped for a symlink after the token was issued stops being served.
  */
 
 export const TOKENS_CSS_ALIAS = "tokens.css";
+/** Bare alias prefix; a request under it is `systems/<id>/<rest>`, never the directory itself. */
+export const SYSTEMS_DIR_ALIAS = "systems";
 
 export interface ScopedAsset {
   abs: string;
@@ -58,6 +66,20 @@ export async function resolveScopedPath(design: DesignRef, path: string): Promis
     if (!root) previewDenied();
     return { abs: await containedFile(root, join(root, TOKENS_CSS_ALIAS)), rel: `../${TOKENS_CSS_ALIAS}`, designDir };
   }
+  if (path === SYSTEMS_DIR_ALIAS || path.startsWith(`${SYSTEMS_DIR_ALIAS}/`)) {
+    const root = await resolveDesignsRoot(design.projectPath);
+    if (!root) previewDenied();
+    // "" for bare "systems", else "<id>/sub/path"
+    const tail = path.slice(SYSTEMS_DIR_ALIAS.length + 1);
+    const parsed = tail ? parseSystemsAliasTail(tail) : null;
+    if (!parsed || !parsed.rest) previewDenied();
+    const segments = parsed.rest.split("/");
+    if (segments.some((s) => s === "" || s === ".." || s.startsWith("."))) previewDenied();
+    const base = systemFilesDir(root, parsed.id);
+    const candidate = resolve(base, ...segments);
+    const abs = await containedFile(base, candidate);
+    return { abs, rel: `../${path}`, designDir };
+  }
   const prefix = `${design.slug}/`;
   if (!path.startsWith(prefix) || path.length === prefix.length) previewDenied();
   const candidate = resolve(designDir, path.slice(prefix.length));

package/src/services/design/preview/design-systems-alias.ts

@@ -0,0 +1,20 @@
+import { isValidSystemId } from "../design-systems-paths.ts";
+
+/**
+ * Splits the tail of a `systems/<id>/<rest>` (or `../systems/<id>/<rest>`) reference into the
+ * app id and the path under its design-system folder. Shared by the preview scope (which
+ * serves the live canvas) and the export readers (zip, standalone HTML), so both agree on
+ * exactly the same shape.
+ */
+export interface SystemsAliasTail {
+  id: string;
+  /** "" for the bare `systems/<id>`, which every caller must still refuse to serve. */
+  rest: string;
+}
+
+export function parseSystemsAliasTail(tail: string): SystemsAliasTail | null {
+  const slash = tail.indexOf("/");
+  const id = slash < 0 ? tail : tail.slice(0, slash);
+  const rest = slash < 0 ? "" : tail.slice(slash + 1);
+  return isValidSystemId(id) ? { id, rest } : null;
+}

package/src/services/design/source/design-style-sources.ts

@@ -1,5 +1,6 @@
 import { posix } from "node:path";
-import { resolveScopedPath, TOKENS_CSS_ALIAS } from "../preview/design-preview-scope.ts";
+import { resolveScopedPath, SYSTEMS_DIR_ALIAS, TOKENS_CSS_ALIAS } from "../preview/design-preview-scope.ts";
+import { parseSystemsAliasTail } from "../preview/design-systems-alias.ts";
 import type { DesignRef } from "../preview/design-preview-tokens.ts";
 import { readDesignSource, type DesignSource } from "./design-source-file.ts";
 import { htmlStyleNodes } from "./html-style-blocks.ts";
@@ -10,12 +11,19 @@ import { htmlStyleNodes } from "./html-style-blocks.ts";
  * Inline `<style>` blocks and local `<link rel=stylesheet>` files, in document order —
  * which is the order in which a later `:root` declaration beats an earlier one. CDN sheets
  * are skipped (not ours to read or write), as are links the canvas cannot load either:
- * missing files, anything outside the design folder except the shared `tokens.css`, and
- * non-`.css` targets. `tokens.css` stays in the list, marked `outside`, because a variable
- * it sets last really does win on screen — the tweak commit refuses that case rather than
- * patching a declaration that would lose to it.
+ * missing files, anything outside the design folder except the shared `tokens.css` and the
+ * read-only `systems/<id>/**`, and non-`.css` targets. Both shared aliases stay in the list,
+ * marked `outside`, because a variable one of them sets last really does win on screen — the
+ * tweak commit refuses that case rather than patching a declaration that would lose to it.
  */
 
+/** A design-relative ref that climbs out to one of the shared, read-only aliases. */
+function isSharedAliasRef(rel: string): boolean {
+  if (rel === `../${TOKENS_CSS_ALIAS}`) return true;
+  const prefix = `../${SYSTEMS_DIR_ALIAS}/`;
+  return rel.startsWith(prefix) && parseSystemsAliasTail(rel.slice(prefix.length)) !== null;
+}
+
 /** Local stylesheets considered per page; the preview reports gens for the same number. */
 export const MAX_LINKED_STYLE_SOURCES = 32;
 
@@ -54,7 +62,7 @@ export function linkedStylePath(entryRel: string, href: string): string | null {
     return null;
   }
   if (!/\.css$/i.test(rel)) return null;
-  if (rel === `../${TOKENS_CSS_ALIAS}`) return rel;
+  if (isSharedAliasRef(rel)) return rel;
   if (rel === ".." || rel.startsWith("../") || rel.startsWith("/")) return null;
   return rel;
 }
@@ -63,7 +71,8 @@ async function readLinked(design: DesignRef, rel: string): Promise<{ rel: string
   const outside = rel.startsWith("../");
   let asset: { abs: string; rel: string };
   try {
-    asset = await resolveScopedPath(design, outside ? TOKENS_CSS_ALIAS : `${design.slug}/${rel}`);
+    // Strip the leading "../" to get the scope's own path shape: "tokens.css" or "kit/…".
+    asset = await resolveScopedPath(design, outside ? rel.slice(3) : `${design.slug}/${rel}`);
   } catch {
     // Missing, or refused by the preview's own guard: the canvas does not load it, so it is not in the cascade.
     return null;

package/src/services/fs-credential-path-guard.ts

@@ -1,9 +1,9 @@
-import { resolve, sep } from "node:path";
+import { join, relative, resolve, sep } from "node:path";
 import { homedir } from "node:os";
 import { getPpmDir } from "./ppm-dir.ts";
 import { getUploadsDir } from "./chat-upload-storage.service.ts";
 import { getBackupsDir } from "./db-backup/db-backup-paths.ts";
-import { realPathOrSelf } from "./fs-ops/fs-real-path.ts";
+import { realPathOrSelf, realPathOrSelfSync } from "./fs-ops/fs-real-path.ts";
 
 /**
  * Every path a generic filesystem route (read, write, copy, move, upload,
@@ -25,9 +25,44 @@ function isInside(child: string, parent: string): boolean {
   return c === p || c.startsWith(p.endsWith(sep) ? p : p + sep);
 }
 
+/** Each root's real path, keyed by the root as configured. */
+const realRoots = new Map<string, string>();
+
+/**
+ * The spellings a root is reached by: as configured, and as the filesystem has it.
+ * Every door checks a path *and* its real path, and a real path never spells a
+ * root through a symlink — on macOS `/tmp` and `/var` are links into `/private`,
+ * so a PPM directory under either matched only the first check, and a symlink
+ * to `ppm.db` read as an ordinary file. Resolved once per root, because the
+ * design walk asks per entry: the real spelling only adds refusals, so one that
+ * goes stale refuses no less than the configured spelling alone did.
+ */
+function rootSpellings(root: string): string[] {
+  let real = realRoots.get(root);
+  if (real === undefined) {
+    real = realPathOrSelfSync(root);
+    realRoots.set(root, real);
+  }
+  return real === root ? [root] : [root, real];
+}
+
+const isUnderRoot = (child: string, root: string) => rootSpellings(root).some((spelling) => isInside(child, spelling));
+
+/**
+ * A directory inside the PPM directory, spelled under each of the PPM directory's
+ * own spellings and never at its own real path. The two exceptions below are holes
+ * in the PPM-dir refusal: were `uploads` itself a link, its real path would carry
+ * the hole to wherever the link points — the snapshot directory, or the PPM
+ * directory itself.
+ */
+function ppmSubdirSpellings(dir: string): string[] {
+  const rel = relative(getPpmDir(), dir);
+  return rootSpellings(getPpmDir()).map((spelling) => join(spelling, rel));
+}
+
 /** True when the path is the PPM directory or anything inside it. */
 export function isPpmDirPath(resolved: string): boolean {
-  return isInside(resolved, getPpmDir());
+  return isUnderRoot(resolved, getPpmDir());
 }
 
 /**
@@ -37,7 +72,7 @@ export function isPpmDirPath(resolved: string): boolean {
  * the very image the assistant just read back from that directory.
  */
 export function isChatUploadPath(resolved: string): boolean {
-  return isInside(resolved, getUploadsDir());
+  return ppmSubdirSpellings(getUploadsDir()).some((spelling) => isInside(resolved, spelling));
 }
 
 /**
@@ -55,11 +90,12 @@ export function isChatUploadPath(resolved: string): boolean {
  * pass an already-resolved path, so `..` cannot walk back out of the subtree.
  */
 export function isCodexGeneratedImagePath(resolved: string): boolean {
-  const root = resolve(getPpmDir(), "codex-accounts");
-  if (!isInside(resolved, root) || resolved === root) return false;
-  const rel = resolved.slice(root.length + 1).split(sep);
-  // [accountId, "generated_images", …at least one file segment]
-  return rel.length >= 3 && rel[1] === "generated_images";
+  return ppmSubdirSpellings(resolve(getPpmDir(), "codex-accounts")).some((root) => {
+    if (!isInside(resolved, root) || resolved === root) return false;
+    const rel = resolved.slice(root.length + 1).split(sep);
+    // [accountId, "generated_images", …at least one file segment]
+    return rel.length >= 3 && rel[1] === "generated_images";
+  });
 }
 
 /**
@@ -73,7 +109,7 @@ export function isCodexGeneratedImagePath(resolved: string): boolean {
  * elsewhere does not match.
  */
 export function isCloudflaredDirPath(resolved: string): boolean {
-  return isInside(resolved, resolve(homedir(), ".cloudflared"));
+  return isUnderRoot(resolved, resolve(homedir(), ".cloudflared"));
 }
 
 /**
@@ -87,7 +123,7 @@ export function isCloudflaredDirPath(resolved: string): boolean {
  * a credential-read hole through the generic file routes.
  */
 export function isDbBackupsDirPath(resolved: string): boolean {
-  return isInside(resolved, getBackupsDir());
+  return isUnderRoot(resolved, getBackupsDir());
 }
 
 /** True when the path holds credential material a generic file route must never serve or relocate. */
@@ -101,21 +137,22 @@ export function isCredentialPath(resolved: string): boolean {
  * tokens; the latter stores the Cloudflare login cert. Neither may be
  * downloadable through a generic file route.
  *
- * Chat uploads and codex-generated images are the exceptions, and only for the
- * PPM-dir branch — both always live under `getPpmDir()`, never under
- * `~/.cloudflared`, so the exceptions are a no-op for the cloudflared branch.
- * Every caller applies this to the requested path *and* to its real path, so a
- * symlink parked in the uploads directory still fails on the second call and
- * cannot reach the rest of the PPM dir through the exception, and a symlink
- * pointing at `~/.cloudflared/cert.pem` fails the same way.
+ * Chat uploads and codex-generated images are the exceptions, and they lift only
+ * the PPM-dir refusal: `~/.cloudflared` and the snapshot directory are refused
+ * whatever path reaches them. Every caller applies this to the requested path
+ * *and* to its real path, so a symlink parked in the uploads directory still
+ * fails on the second call and cannot reach the rest of the PPM dir through the
+ * exception, and a symlink pointing at `~/.cloudflared/cert.pem` fails the same
+ * way — as does a link put in place of the uploads directory itself, since the
+ * exceptions are spelled from the PPM directory's own spellings.
  *
  * Both exceptions are read-only on purpose: they are absent from
  * `assertNotPpmSubtree`, so nothing can be copied, moved, or written INTO
  * those directories through a generic file route.
  */
 export function assertNotPpmDir(resolved: string): void {
-  const allowed = isChatUploadPath(resolved) || isCodexGeneratedImagePath(resolved);
-  if (isCredentialPath(resolved) && !allowed) {
+  const excepted = isChatUploadPath(resolved) || isCodexGeneratedImagePath(resolved);
+  if (isCloudflaredDirPath(resolved) || isDbBackupsDirPath(resolved) || (isPpmDirPath(resolved) && !excepted)) {
     throw Object.assign(new Error("Access denied"), { status: 403, code: "EDENIED" });
   }
 }

package/src/services/system-metrics/core-foundation-darwin.ts

@@ -0,0 +1,98 @@
+/**
+ * CoreFoundation over bun:ffi, for the frameworks that answer in CF objects —
+ * IOReport and the HID event system. Only what those two readers need is bound.
+ *
+ * Every CF reference is a `bigint` (declared `u64`), never bun's `ptr`. A `ptr`
+ * crosses into JS as a number, i.e. a double, and CoreFoundation hands out TAGGED
+ * pointers for small immutable objects: on arm64 a short ASCII CFString is a value
+ * with the top bit set, far above 2^53, which a double silently rounds. The next
+ * call then receives a different "pointer". Measured: `CFStringCreateWithCString`
+ * gave "Energy Model" a heap address that crossed intact and "CPU Stats" a tagged
+ * value that did not, and releasing the rounded one crashed the process with a
+ * segfault at 0x10. A u64 crosses exactly, so a tagged reference survives the trip.
+ */
+import { dlopen, FFIType as T } from "bun:ffi";
+
+const CORE_FOUNDATION = "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation";
+/** kCFStringEncodingUTF8. */
+const UTF8 = 0x08000100;
+/** Longest string `text` reads back: a channel, state or sensor name is a few dozen bytes. */
+const TEXT_BUFFER_BYTES = 1024;
+
+/** A CF object reference; `0n` is NULL. */
+export type CfRef = bigint;
+
+export interface CoreFoundation {
+  /** A new CFString that the caller owns: release it, or keep it for the process. */
+  string(value: string): CfRef;
+  /** A CFString's text. Undefined for NULL, for an object that is not a string,
+   *  and for text too long to read back whole. */
+  text(ref: CfRef): string | undefined;
+  /** No-op for NULL: `CFRelease(NULL)` is a crash, not an error. */
+  release(ref: CfRef): void;
+  dictGet(dict: CfRef, key: CfRef): CfRef;
+  dictMutableCopy(dict: CfRef): CfRef;
+  dictSet(dict: CfRef, key: CfRef, value: CfRef): void;
+  arrayCount(array: CfRef): number;
+  arrayAt(array: CfRef, index: number): CfRef;
+  arrayMutableCopy(array: CfRef): CfRef;
+  arrayRemoveAt(array: CfRef, index: number): void;
+}
+
+const R = T.u64;
+
+function open(): CoreFoundation | null {
+  if (process.platform !== "darwin") return null;
+  let cf;
+  try {
+    cf = dlopen(CORE_FOUNDATION, {
+      CFStringCreateWithCString: { args: [R, T.ptr, T.u32], returns: R },
+      CFStringGetCString: { args: [R, T.ptr, T.i64, T.u32], returns: T.bool },
+      CFStringGetTypeID: { args: [], returns: T.u64 },
+      CFGetTypeID: { args: [R], returns: T.u64 },
+      CFRelease: { args: [R], returns: T.void },
+      CFDictionaryGetValue: { args: [R, R], returns: R },
+      CFDictionaryCreateMutableCopy: { args: [R, T.i64, R], returns: R },
+      CFDictionarySetValue: { args: [R, R, R], returns: T.void },
+      CFArrayGetCount: { args: [R], returns: T.i64 },
+      CFArrayGetValueAtIndex: { args: [R, T.i64], returns: R },
+      CFArrayCreateMutableCopy: { args: [R, T.i64, R], returns: R },
+      CFArrayRemoveValueAtIndex: { args: [R, T.i64], returns: T.void },
+    }).symbols;
+  } catch {
+    return null;
+  }
+  const encoder = new TextEncoder();
+  const decoder = new TextDecoder();
+  const buffer = new Uint8Array(TEXT_BUFFER_BYTES);
+  const stringType = cf.CFStringGetTypeID() as bigint;
+  const ref = (value: unknown): CfRef => (typeof value === "bigint" ? value : BigInt(value as number));
+
+  return {
+    string: (value) => ref(cf.CFStringCreateWithCString(0n, encoder.encode(`${value}\0`), UTF8)),
+    text(r) {
+      if (r === 0n || ref(cf.CFGetTypeID(r)) !== stringType) return undefined;
+      if (!cf.CFStringGetCString(r, buffer, buffer.length, UTF8)) return undefined;
+      const end = buffer.indexOf(0);
+      return decoder.decode(buffer.subarray(0, end < 0 ? buffer.length : end));
+    },
+    release(r) {
+      if (r !== 0n) cf.CFRelease(r);
+    },
+    dictGet: (dict, key) => ref(cf.CFDictionaryGetValue(dict, key)),
+    dictMutableCopy: (dict) => ref(cf.CFDictionaryCreateMutableCopy(0n, 0, dict)),
+    dictSet: (dict, key, value) => cf.CFDictionarySetValue(dict, key, value),
+    arrayCount: (array) => Number(cf.CFArrayGetCount(array)),
+    arrayAt: (array, index) => ref(cf.CFArrayGetValueAtIndex(array, index)),
+    arrayMutableCopy: (array) => ref(cf.CFArrayCreateMutableCopy(0n, 0, array)),
+    arrayRemoveAt: (array, index) => cf.CFArrayRemoveValueAtIndex(array, index),
+  };
+}
+
+/** `undefined` until first asked for; `null` off darwin or where the framework will not load. */
+let shared: CoreFoundation | null | undefined;
+
+export function darwinCoreFoundation(): CoreFoundation | null {
+  if (shared === undefined) shared = open();
+  return shared;
+}