@1agh/maude 0.21.0 → 0.22.2

package/cli/commands/doctor.mjs

@@ -252,96 +252,107 @@ function printReport({ depsByPlugin, configReport, summary }) {
 async function applyFixes({ repoRoot, configFsPath, depsByPlugin, configReport }) {
   let configChanged = false;
 
-  // ── Dependency installs ────────────────────────────────────────────────
-  const installable = [];
-  for (const env of Object.values(depsByPlugin)) {
-    if (!env.results) continue;
-    for (const r of env.results) {
-      if (r.status !== 'missing') continue;
-      // Find the original dep entry to read autoInstall + install commands.
-      // checkAll dropped the manifest entry but kept r.install — we use that.
-      installable.push(r);
-    }
-  }
-  // Per-dep prompt — no silent installs.
-  if (installable.length > 0) {
-    process.stdout.write('\n--- Dependency installs (per-dep prompt) ---\n');
-    const rl = createInterface({ input: stdin, output: stdout });
-    for (const r of installable) {
-      const cmd = (r.install && (r.install[process.platform] || r.install.preferred)) || null;
-      if (!cmd) {
-        process.stdout.write(`  skip ${r.id} — no install command declared\n`);
-        continue;
-      }
-      // eslint-disable-next-line no-await-in-loop
-      const ans = await rl.question(`  Install ${r.id} via \`${cmd}\`? [y/N] `);
-      if (ans.trim().toLowerCase() === 'y' || ans.trim().toLowerCase() === 'yes') {
-        process.stdout.write(`  running: ${cmd}\n`);
-        const res = spawnSync('bash', ['-c', cmd], { stdio: 'inherit' });
-        if (res.status !== 0) process.stdout.write(`  ✗ install failed (exit ${res.status})\n`);
-      } else {
-        process.stdout.write(`  skipped ${r.id}\n`);
+  // ── Config edits ───────────────────────────────────────────────────────
+  // Run FIRST — deterministic (filesystem only) and must not be blocked by
+  // an interactive prompt that may never resolve on a non-TTY stdin (CI,
+  // scripted spawns with empty input). Dep prompts come AFTER.
+  if (configReport.exists) {
+    const config = JSON.parse(readFileSync(configFsPath, 'utf8'));
+
+    // Drop unknown additionalProperties errors.
+    for (const e of configReport.schema.errors) {
+      if (e.message.startsWith('unknown property')) {
+        const parts = e.path.split('/').filter(Boolean);
+        let cur = config;
+        for (let i = 0; i < parts.length - 1; i++) cur = cur?.[parts[i]];
+        if (cur && parts.length > 0) {
+          delete cur[parts[parts.length - 1]];
+          configChanged = true;
+        }
       }
     }
-    rl.close();
-  }
 
-  // ── Config edits ────────────────────────────────────────────────────────
-  if (!configReport.exists) return;
-  const config = JSON.parse(readFileSync(configFsPath, 'utf8'));
-
-  // Drop unknown additionalProperties errors.
-  for (const e of configReport.schema.errors) {
-    if (e.message.startsWith('unknown property')) {
-      const parts = e.path.split('/').filter(Boolean);
-      let cur = config;
-      for (let i = 0; i < parts.length - 1; i++) cur = cur?.[parts[i]];
-      if (cur && parts.length > 0) {
-        delete cur[parts[parts.length - 1]];
+    // Apply drift — silent (detector returned a concrete value, so we know
+    // declared is wrong or stale).
+    if (configReport.drift.length > 0) {
+      if (!config.stack) config.stack = {};
+      for (const d of configReport.drift) {
+        config.stack[d.key] = d.detected;
         configChanged = true;
       }
     }
-  }
 
-  // Apply drift — silent (detector returned a concrete value, so we know
-  // declared is wrong or stale).
-  if (configReport.drift.length > 0) {
-    if (!config.stack) config.stack = {};
-    for (const d of configReport.drift) {
-      config.stack[d.key] = d.detected;
-      configChanged = true;
+    // Add missing quality gates — silent additive merge.
+    if (configReport.qualityAdditions.length > 0) {
+      if (!config.quality) config.quality = {};
+      for (const a of configReport.qualityAdditions) {
+        if (!config.quality[a.gate]) {
+          config.quality[a.gate] = a.command;
+          configChanged = true;
+        }
+      }
     }
-  }
 
-  // Add missing quality gates — silent additive merge.
-  if (configReport.qualityAdditions.length > 0) {
-    if (!config.quality) config.quality = {};
-    for (const a of configReport.qualityAdditions) {
-      if (!config.quality[a.gate]) {
-        config.quality[a.gate] = a.command;
-        configChanged = true;
+    if (configChanged) {
+      writeFileSync(configFsPath, `${JSON.stringify(config, null, 2)}\n`);
+      process.stdout.write(`\n  ✓ wrote ${CONFIG_PATH}\n`);
+    } else {
+      process.stdout.write('\n  (no config edits applied)\n');
+    }
+
+    // Note: invalid-enum errors (e.g. tests: "node-test") are NEVER auto-
+    // fixed — the user picks the migration target. Surface the leftover.
+    const remaining = configReport.schema.errors.filter(
+      (e) => !e.message.startsWith('unknown property')
+    );
+    if (remaining.length > 0) {
+      process.stdout.write(
+        `\n  ⚠ ${remaining.length} schema error${remaining.length === 1 ? '' : 's'} not auto-fixed — user decision required:\n`
+      );
+      for (const e of remaining) {
+        process.stdout.write(`    ${e.path}: ${e.message}\n`);
       }
     }
   }
 
-  if (configChanged) {
-    writeFileSync(configFsPath, `${JSON.stringify(config, null, 2)}\n`);
-    process.stdout.write(`\n  ✓ wrote ${CONFIG_PATH}\n`);
-  } else {
-    process.stdout.write('\n  (no config edits applied)\n');
+  // ── Dependency installs ────────────────────────────────────────────────
+  const installable = [];
+  for (const env of Object.values(depsByPlugin)) {
+    if (!env.results) continue;
+    for (const r of env.results) {
+      if (r.status !== 'missing') continue;
+      installable.push(r);
+    }
   }
-
-  // Note: invalid-enum errors (e.g. tests: "node-test") are NEVER auto-
-  // fixed — the user picks the migration target. Surface the leftover.
-  const remaining = configReport.schema.errors.filter(
-    (e) => !e.message.startsWith('unknown property')
-  );
-  if (remaining.length > 0) {
-    process.stdout.write(
-      `\n  ⚠ ${remaining.length} schema error${remaining.length === 1 ? '' : 's'} not auto-fixed — user decision required:\n`
-    );
-    for (const e of remaining) {
-      process.stdout.write(`    ${e.path}: ${e.message}\n`);
+  // Per-dep prompt — no silent installs. Skip when stdin is not a TTY
+  // (CI runners, scripted spawns) so config edits above are never bypassed
+  // by a never-resolving readline prompt against closed stdin.
+  if (installable.length > 0) {
+    if (!stdin.isTTY) {
+      process.stdout.write(
+        `\n--- Dependency installs skipped (non-interactive stdin; ${installable.length} missing) ---\n`
+      );
+    } else {
+      process.stdout.write('\n--- Dependency installs (per-dep prompt) ---\n');
+      const rl = createInterface({ input: stdin, output: stdout });
+      for (const r of installable) {
+        const cmd = (r.install && (r.install[process.platform] || r.install.preferred)) || null;
+        if (!cmd) {
+          process.stdout.write(`  skip ${r.id} — no install command declared\n`);
+          continue;
+        }
+        // eslint-disable-next-line no-await-in-loop
+        const ans = await rl.question(`  Install ${r.id} via \`${cmd}\`? [y/N] `);
+        const norm = (ans || '').trim().toLowerCase();
+        if (norm === 'y' || norm === 'yes') {
+          process.stdout.write(`  running: ${cmd}\n`);
+          const res = spawnSync('bash', ['-c', cmd], { stdio: 'inherit' });
+          if (res.status !== 0) process.stdout.write(`  ✗ install failed (exit ${res.status})\n`);
+        } else {
+          process.stdout.write(`  skipped ${r.id}\n`);
+        }
+      }
+      rl.close();
     }
   }
 

package/cli/commands/hub.mjs

@@ -37,13 +37,18 @@ function usage() {
         Start the self-hostable Yjs sync hub in the current process tree.
         --port           listen port (default 1234, env PORT)
         --data           hub.db + tokens.json dir (default ./data, env DATA_DIR)
-        --secret         HUB_SECRET escape-hatch token (env HUB_SECRET)
+        --secret         HUB_SECRET escape-hatch token (env HUB_SECRET).
+                         If unset on an empty hub, a one-time bootstrap link is
+                         printed to logs — open it in a browser to claim admin.
         --insecure-http  cosmetic log-only flag for non-TLS dev
         --dev            generate a one-shot mau_dev_<hex> token, print the
                          connect command, then run the hub. Convenience for
                          contributor onboarding — drops tokens.json on exit
                          is NOT performed (tokens persist; clean by hand).
 
+        On boot the hub prints its /admin URL. The admin UI generates invite
+        tokens, lists peers, and rotates tokens without shelling into the host.
+
   token generate --label NAME [--data PATH] [--dev]
         Generate a new mau_<32hex> token and append it to
         <data>/tokens.json with the given label. Prints the raw token ONCE,
@@ -51,9 +56,12 @@ function usage() {
 
         --dev produces a mau_dev_<hex> token (convention only — same auth).
 
+        Equivalent to the "Generate invite" button in the /admin UI — use
+        whichever is more convenient for the deploy.
+
   status [URL] [--json]
-        HTTP GET <url>/health, print uptime/version/token-count. URL defaults
-        to http://localhost:1234. --json emits the raw response.
+        HTTP GET <url>/health, print uptime/version/token-count/peers. URL
+        defaults to http://localhost:1234. --json emits the raw response.
 
 NOTES
   Local dev only in v1.1 Task 2 slice — production-install packaging
@@ -64,6 +72,12 @@ EXAMPLES
   maude hub serve --port 4400
   maude hub token generate --label alice
   maude hub status http://localhost:4400
+
+  # Recommended flow on a fresh deploy:
+  #   1. maude hub serve            → copy bootstrap link from logs
+  #   2. open the link in browser   → first-run wizard, mint admin secret
+  #   3. click "Generate invite"    → copy 'maude design link …' command
+  #   4. paste on the peer machine  → linked
 `;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.21.0",
+  "version": "0.22.2",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -38,16 +38,16 @@
     "video:render": "cd scripts/video/final && pnpm run render",
     "video:studio": "cd scripts/video/final && pnpm run studio",
     "postinstall": "node cli/install.cjs",
-    "prepublishOnly": "bash scripts/check-version-parity.sh"
+    "prepublishOnly": "bash scripts/check-version-parity.sh && bash plugins/design/dev-server/bin/check-runtime-bundles.sh"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.21.0",
-    "@1agh/maude-darwin-x64": "0.21.0",
-    "@1agh/maude-linux-arm64": "0.21.0",
-    "@1agh/maude-linux-arm64-musl": "0.21.0",
-    "@1agh/maude-linux-x64": "0.21.0",
-    "@1agh/maude-linux-x64-musl": "0.21.0",
-    "@1agh/maude-win32-x64": "0.21.0"
+    "@1agh/maude-darwin-arm64": "0.22.2",
+    "@1agh/maude-darwin-x64": "0.22.2",
+    "@1agh/maude-linux-arm64": "0.22.2",
+    "@1agh/maude-linux-arm64-musl": "0.22.2",
+    "@1agh/maude-linux-x64": "0.22.2",
+    "@1agh/maude-linux-x64-musl": "0.22.2",
+    "@1agh/maude-win32-x64": "0.22.2"
   },
   "files": [
     "cli",

package/plugins/design/dev-server/bin/check-runtime-bundles.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# check-runtime-bundles.sh — pre-publish guard against shipping defective
+# /_canvas-runtime/<slug>.js bundles.
+#
+# Why: Bun.build's output for `motion` + `motion/react` is environment-sensitive
+# (Bun version, OS, transitive dep resolution). v0.22.0 shipped a 13 kB
+# motion_react.js where the working bundle is 155 kB+ — the smaller artifact
+# parses cleanly + serves HTTP 200 but throws `ReferenceError: AcceleratedAnimation
+# is not defined` at module-eval time, breaking every canvas that uses the
+# motion lib. CI build was green; the regression slipped because nothing
+# asserted bundle SIZE.
+#
+# This guard reads dist/runtime/.min-sizes.json and asserts each on-disk
+# bundle ≥ its declared floor. Run from CI before `npm publish`. Hard-fails
+# the publish job → the bad tarball never reaches npm.
+#
+# Floors are at ~70% of release-minified size (see manifest comment). Any
+# minifier improvement that drops a bundle below the floor needs an explicit
+# manifest bump + investigation — that's the point.
+#
+# Usage:
+#   check-runtime-bundles.sh [--runtime-dir <path>] [--manifest <path>]
+#
+# Defaults:
+#   --runtime-dir = <plugin>/dev-server/dist/runtime/
+#   --manifest    = <runtime-dir>/.min-sizes.json
+#
+# Exit codes:
+#   0 all bundles meet floor
+#   1 manifest or runtime dir missing
+#   2 bad args
+#   3 one or more bundles below floor
+
+set -euo pipefail
+
+RUNTIME_DIR=""
+MANIFEST=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --runtime-dir) RUNTIME_DIR="$2"; shift 2 ;;
+    --manifest)    MANIFEST="$2"; shift 2 ;;
+    --help|-h)
+      sed -n '2,30p' "$0" | sed 's/^# \?//'
+      exit 0
+      ;;
+    *)
+      echo "check-runtime-bundles.sh: unknown arg '$1' (try --help)" >&2
+      exit 2
+      ;;
+  esac
+done
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+if [ -z "$RUNTIME_DIR" ]; then
+  RUNTIME_DIR="$SCRIPT_DIR/../dist/runtime"
+fi
+if [ -z "$MANIFEST" ]; then
+  MANIFEST="$RUNTIME_DIR/.min-sizes.json"
+fi
+
+if [ ! -d "$RUNTIME_DIR" ]; then
+  echo "check-runtime-bundles.sh: runtime dir not found at $RUNTIME_DIR" >&2
+  exit 1
+fi
+if [ ! -f "$MANIFEST" ]; then
+  echo "check-runtime-bundles.sh: manifest not found at $MANIFEST" >&2
+  exit 1
+fi
+
+# Read manifest as <slug> <floor> pairs, one per line. Skip $-prefixed
+# metadata keys ($comment etc.). Prefer jq when available; fall back to
+# python3 (always present in CI runners + macOS).
+read_pairs() {
+  if command -v jq >/dev/null 2>&1; then
+    jq -r 'to_entries | map(select(.key | startswith("$") | not)) | .[] | "\(.key) \(.value)"' "$MANIFEST"
+  else
+    python3 -c '
+import json, sys
+with open("'"$MANIFEST"'") as f:
+    data = json.load(f)
+for k, v in data.items():
+    if k.startswith("$"): continue
+    print(k, v)
+'
+  fi
+}
+
+FAIL_COUNT=0
+CHECK_COUNT=0
+MISSING_COUNT=0
+
+while read -r slug floor; do
+  [ -z "$slug" ] && continue
+  CHECK_COUNT=$((CHECK_COUNT + 1))
+  PATH_JS="$RUNTIME_DIR/$slug"
+  if [ ! -f "$PATH_JS" ]; then
+    echo "✗ $slug — missing on disk (expected at $PATH_JS)" >&2
+    MISSING_COUNT=$((MISSING_COUNT + 1))
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+    continue
+  fi
+  SIZE=$(wc -c < "$PATH_JS" | tr -d ' ')
+  if [ "$SIZE" -lt "$floor" ]; then
+    echo "✗ $slug — $SIZE B < floor $floor B (likely defective bundle)" >&2
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+  else
+    echo "✓ $slug — $SIZE B ≥ floor $floor B"
+  fi
+done < <(read_pairs)
+
+if [ "$FAIL_COUNT" -eq 0 ]; then
+  echo ""
+  echo "✓ check-runtime-bundles OK — $CHECK_COUNT bundles, all above floor"
+  exit 0
+fi
+
+echo "" >&2
+echo "✗ check-runtime-bundles FAIL — $FAIL_COUNT/$CHECK_COUNT bundle(s) below floor" >&2
+if [ "$MISSING_COUNT" -gt 0 ]; then
+  echo "  ($MISSING_COUNT missing from disk — was buildRuntimeBundles() skipped?)" >&2
+fi
+echo "  Refusing to ship a tarball with defective /_canvas-runtime artifacts." >&2
+echo "  Investigate the Bun.build output for the offending package(s) before publishing." >&2
+exit 3

package/plugins/design/dev-server/bin/runtime-health.sh

@@ -8,9 +8,14 @@
 # server returns HTTP 200, but the iframe throws at module-eval time with
 # `ReferenceError: AcceleratedAnimation is not defined` (or similar).
 #
-# Parse-clean ≠ run-clean. This helper closes that gap: probe every URL the
-# canvas-lib pulls in, compare byte-count to the disk pre-built, fail loud
-# when the served body is suspiciously small.
+# Parse-clean ≠ run-clean. This helper closes that gap with TWO checks:
+#   1. Per-bundle absolute floor — served body MUST clear the size declared
+#      in dist/runtime/.min-sizes.json. This catches the v0.22.0 regression
+#      class where the installed bundle on disk is ITSELF defective (so
+#      compare-to-disk would trivially pass).
+#   2. Compare-to-disk ratio — served body MUST be ≥ threshold × on-disk
+#      size. Catches the original case where disk is good but the running
+#      dev-server returned a defective dynamic Bun.build cached in memory.
 #
 # Usage:
 #   runtime-health.sh [--port N] [--root <repo>] [--threshold 0.5]
@@ -67,6 +72,26 @@ if [ ! -d "$PREBUILT_DIR" ]; then
   exit 1
 fi
 
+# Absolute-floor manifest. Optional — if missing we fall back to the
+# disk-ratio check alone (older installs from before .min-sizes.json shipped).
+MIN_SIZES_MANIFEST="$PREBUILT_DIR/.min-sizes.json"
+floor_for() {
+  local slug="$1"
+  [ -f "$MIN_SIZES_MANIFEST" ] || { echo ""; return; }
+  if command -v jq >/dev/null 2>&1; then
+    jq -r --arg k "$slug" '.[$k] // empty' "$MIN_SIZES_MANIFEST" 2>/dev/null
+  else
+    python3 -c '
+import json, sys
+try:
+  with open("'"$MIN_SIZES_MANIFEST"'") as f: data = json.load(f)
+  v = data.get("'"$slug"'")
+  print(v if v is not None else "")
+except Exception: print("")
+' 2>/dev/null
+  fi
+}
+
 # ---------- resolve port from _server.json if not given ----------
 DESIGN_ROOT="$REPO/.design"
 STATE="$DESIGN_ROOT/_server.json"
@@ -101,11 +126,19 @@ probe_one() {
     echo "✗ $slug — served HTTP error (curl failed for $url)" >&2
     return 1
   }
-  # Floor at 256 bytes — any working ESM bundle is bigger than that.
+  # Hard floor at 256 bytes — any working ESM bundle is bigger than that.
   if [ "$served" -lt 256 ]; then
     echo "✗ $slug — served body $served B < 256 B floor (server returned empty)" >&2
     return 1
   fi
+  # Absolute floor from .min-sizes.json (independent of disk — catches the
+  # case where the SHIPPED bundle is itself defective, like v0.22.0 motion_react).
+  local abs_floor
+  abs_floor=$(floor_for "$slug")
+  if [ -n "$abs_floor" ] && [ "$served" -lt "$abs_floor" ]; then
+    echo "✗ $slug — served $served B < absolute floor $abs_floor B (declared in .min-sizes.json — defective bundle in install)" >&2
+    return 1
+  fi
   # Threshold ratio: served must be ≥ threshold × disk.
   # awk handles the fractional math without bc dependency.
   local ratio
@@ -113,7 +146,7 @@ probe_one() {
   local ok
   ok=$(awk -v r="$ratio" -v t="$THRESHOLD" 'BEGIN{print (r >= t) ? 1 : 0}')
   if [ "$ok" = "1" ]; then
-    [ $QUIET -eq 0 ] && echo "✓ $slug — $served B / $disk_size B disk (ratio $ratio)" >&2
+    [ $QUIET -eq 0 ] && echo "✓ $slug — $served B / $disk_size B disk (ratio $ratio${abs_floor:+, floor ${abs_floor} B})" >&2
     return 0
   fi
   echo "✗ $slug — served $served B / $disk_size B disk (ratio $ratio < $THRESHOLD) — defective dynamic build" >&2
@@ -139,8 +172,16 @@ fi
 
 echo "" >&2
 echo "✗ runtime-health FAIL — $FAIL_COUNT bundle(s) below threshold:$FAIL_LIST" >&2
-echo "  These bundles look like defective dynamic Bun.build output." >&2
+echo "  These bundles look defective." >&2
 echo "  The canvas TSX will parse + serve cleanly, but the iframe will throw at runtime." >&2
+echo "" >&2
+echo "  If the failure was from the 'absolute floor' check (see lines above):" >&2
+echo "    → the SHIPPED bundle on disk is itself defective (rare release-time regression)." >&2
+echo "    → --restart will NOT help; upgrade the package: \`npm i -g @1agh/maude@latest\`" >&2
+echo "      (or for marketplace installs: \`/plugin marketplace update maude\`)." >&2
+echo "  If the failure was from the 'ratio < threshold' check:" >&2
+echo "    → the running server cached a defective dynamic Bun.build output." >&2
+echo "    → --restart will respawn the server and load the (good) disk pre-built." >&2
 
 if [ "$RESTART" -eq 1 ]; then
   echo "→ --restart given; killing server and respawning via server-up.sh" >&2

package/plugins/design/dev-server/build.ts

@@ -405,11 +405,25 @@ async function main() {
   // Pre-built runtime bundles — ship to disk so /_canvas-runtime/* never
   // needs a runtime Bun.build (which would need disk node_modules/react,
   // absent in compiled binaries + npm installs). Phase 19.1 / v0.18.1.
-  const runtime = await buildRuntimeBundles();
-  const t2b = performance.now();
-  console.log(
-    `[build] dist/runtime/*.js ${runtime.bytes.toLocaleString()} B in ${runtime.count} files  (${(t2b - t2).toFixed(0)} ms)`
-  );
+  //
+  // MAUDE_SKIP_RUNTIME_BUILD=1 — skip the regen and trust the committed
+  // dist/runtime/*.js. Set in CI publish-main so the npm tarball ships
+  // exactly what was committed in git (platform-agnostic). v0.22.0 shipped
+  // a broken Ubuntu-CI motion_react.js because the on-disk authoritative
+  // bundle got overwritten by `pnpm build`; this flag prevents that class
+  // of regression. The check-runtime-bundles.sh step still validates the
+  // on-disk artifacts against .min-sizes.json after the build.
+  if (process.env.MAUDE_SKIP_RUNTIME_BUILD === '1') {
+    console.log(
+      `[build] dist/runtime/*.js SKIPPED (MAUDE_SKIP_RUNTIME_BUILD=1 — using committed pre-built)`
+    );
+  } else {
+    const runtime = await buildRuntimeBundles();
+    const t2b = performance.now();
+    console.log(
+      `[build] dist/runtime/*.js ${runtime.bytes.toLocaleString()} B in ${runtime.count} files  (${(t2b - t2).toFixed(0)} ms)`
+    );
+  }
 
   if (MODE === 'release') {
     const targets: PlatformTarget[] = FLAG_TARGET