@1agh/maude 0.22.0 → 0.22.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -38,16 +38,16 @@
     "video:render": "cd scripts/video/final && pnpm run render",
     "video:studio": "cd scripts/video/final && pnpm run studio",
     "postinstall": "node cli/install.cjs",
-    "prepublishOnly": "bash scripts/check-version-parity.sh"
+    "prepublishOnly": "bash scripts/check-version-parity.sh && bash plugins/design/dev-server/bin/check-runtime-bundles.sh"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.22.0",
-    "@1agh/maude-darwin-x64": "0.22.0",
-    "@1agh/maude-linux-arm64": "0.22.0",
-    "@1agh/maude-linux-arm64-musl": "0.22.0",
-    "@1agh/maude-linux-x64": "0.22.0",
-    "@1agh/maude-linux-x64-musl": "0.22.0",
-    "@1agh/maude-win32-x64": "0.22.0"
+    "@1agh/maude-darwin-arm64": "0.22.2",
+    "@1agh/maude-darwin-x64": "0.22.2",
+    "@1agh/maude-linux-arm64": "0.22.2",
+    "@1agh/maude-linux-arm64-musl": "0.22.2",
+    "@1agh/maude-linux-x64": "0.22.2",
+    "@1agh/maude-linux-x64-musl": "0.22.2",
+    "@1agh/maude-win32-x64": "0.22.2"
   },
   "files": [
     "cli",

package/plugins/design/dev-server/bin/check-runtime-bundles.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# check-runtime-bundles.sh — pre-publish guard against shipping defective
+# /_canvas-runtime/<slug>.js bundles.
+#
+# Why: Bun.build's output for `motion` + `motion/react` is environment-sensitive
+# (Bun version, OS, transitive dep resolution). v0.22.0 shipped a 13 kB
+# motion_react.js where the working bundle is 155 kB+ — the smaller artifact
+# parses cleanly + serves HTTP 200 but throws `ReferenceError: AcceleratedAnimation
+# is not defined` at module-eval time, breaking every canvas that uses the
+# motion lib. CI build was green; the regression slipped because nothing
+# asserted bundle SIZE.
+#
+# This guard reads dist/runtime/.min-sizes.json and asserts each on-disk
+# bundle ≥ its declared floor. Run from CI before `npm publish`. Hard-fails
+# the publish job → the bad tarball never reaches npm.
+#
+# Floors are at ~70% of release-minified size (see manifest comment). Any
+# minifier improvement that drops a bundle below the floor needs an explicit
+# manifest bump + investigation — that's the point.
+#
+# Usage:
+#   check-runtime-bundles.sh [--runtime-dir <path>] [--manifest <path>]
+#
+# Defaults:
+#   --runtime-dir = <plugin>/dev-server/dist/runtime/
+#   --manifest    = <runtime-dir>/.min-sizes.json
+#
+# Exit codes:
+#   0 all bundles meet floor
+#   1 manifest or runtime dir missing
+#   2 bad args
+#   3 one or more bundles below floor
+
+set -euo pipefail
+
+RUNTIME_DIR=""
+MANIFEST=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --runtime-dir) RUNTIME_DIR="$2"; shift 2 ;;
+    --manifest)    MANIFEST="$2"; shift 2 ;;
+    --help|-h)
+      sed -n '2,30p' "$0" | sed 's/^# \?//'
+      exit 0
+      ;;
+    *)
+      echo "check-runtime-bundles.sh: unknown arg '$1' (try --help)" >&2
+      exit 2
+      ;;
+  esac
+done
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+if [ -z "$RUNTIME_DIR" ]; then
+  RUNTIME_DIR="$SCRIPT_DIR/../dist/runtime"
+fi
+if [ -z "$MANIFEST" ]; then
+  MANIFEST="$RUNTIME_DIR/.min-sizes.json"
+fi
+
+if [ ! -d "$RUNTIME_DIR" ]; then
+  echo "check-runtime-bundles.sh: runtime dir not found at $RUNTIME_DIR" >&2
+  exit 1
+fi
+if [ ! -f "$MANIFEST" ]; then
+  echo "check-runtime-bundles.sh: manifest not found at $MANIFEST" >&2
+  exit 1
+fi
+
+# Read manifest as <slug> <floor> pairs, one per line. Skip $-prefixed
+# metadata keys ($comment etc.). Prefer jq when available; fall back to
+# python3 (always present in CI runners + macOS).
+read_pairs() {
+  if command -v jq >/dev/null 2>&1; then
+    jq -r 'to_entries | map(select(.key | startswith("$") | not)) | .[] | "\(.key) \(.value)"' "$MANIFEST"
+  else
+    python3 -c '
+import json, sys
+with open("'"$MANIFEST"'") as f:
+    data = json.load(f)
+for k, v in data.items():
+    if k.startswith("$"): continue
+    print(k, v)
+'
+  fi
+}
+
+FAIL_COUNT=0
+CHECK_COUNT=0
+MISSING_COUNT=0
+
+while read -r slug floor; do
+  [ -z "$slug" ] && continue
+  CHECK_COUNT=$((CHECK_COUNT + 1))
+  PATH_JS="$RUNTIME_DIR/$slug"
+  if [ ! -f "$PATH_JS" ]; then
+    echo "✗ $slug — missing on disk (expected at $PATH_JS)" >&2
+    MISSING_COUNT=$((MISSING_COUNT + 1))
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+    continue
+  fi
+  SIZE=$(wc -c < "$PATH_JS" | tr -d ' ')
+  if [ "$SIZE" -lt "$floor" ]; then
+    echo "✗ $slug — $SIZE B < floor $floor B (likely defective bundle)" >&2
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+  else
+    echo "✓ $slug — $SIZE B ≥ floor $floor B"
+  fi
+done < <(read_pairs)
+
+if [ "$FAIL_COUNT" -eq 0 ]; then
+  echo ""
+  echo "✓ check-runtime-bundles OK — $CHECK_COUNT bundles, all above floor"
+  exit 0
+fi
+
+echo "" >&2
+echo "✗ check-runtime-bundles FAIL — $FAIL_COUNT/$CHECK_COUNT bundle(s) below floor" >&2
+if [ "$MISSING_COUNT" -gt 0 ]; then
+  echo "  ($MISSING_COUNT missing from disk — was buildRuntimeBundles() skipped?)" >&2
+fi
+echo "  Refusing to ship a tarball with defective /_canvas-runtime artifacts." >&2
+echo "  Investigate the Bun.build output for the offending package(s) before publishing." >&2
+exit 3

package/plugins/design/dev-server/bin/runtime-health.sh

@@ -8,9 +8,14 @@
 # server returns HTTP 200, but the iframe throws at module-eval time with
 # `ReferenceError: AcceleratedAnimation is not defined` (or similar).
 #
-# Parse-clean ≠ run-clean. This helper closes that gap: probe every URL the
-# canvas-lib pulls in, compare byte-count to the disk pre-built, fail loud
-# when the served body is suspiciously small.
+# Parse-clean ≠ run-clean. This helper closes that gap with TWO checks:
+#   1. Per-bundle absolute floor — served body MUST clear the size declared
+#      in dist/runtime/.min-sizes.json. This catches the v0.22.0 regression
+#      class where the installed bundle on disk is ITSELF defective (so
+#      compare-to-disk would trivially pass).
+#   2. Compare-to-disk ratio — served body MUST be ≥ threshold × on-disk
+#      size. Catches the original case where disk is good but the running
+#      dev-server returned a defective dynamic Bun.build cached in memory.
 #
 # Usage:
 #   runtime-health.sh [--port N] [--root <repo>] [--threshold 0.5]
@@ -67,6 +72,26 @@ if [ ! -d "$PREBUILT_DIR" ]; then
   exit 1
 fi
 
+# Absolute-floor manifest. Optional — if missing we fall back to the
+# disk-ratio check alone (older installs from before .min-sizes.json shipped).
+MIN_SIZES_MANIFEST="$PREBUILT_DIR/.min-sizes.json"
+floor_for() {
+  local slug="$1"
+  [ -f "$MIN_SIZES_MANIFEST" ] || { echo ""; return; }
+  if command -v jq >/dev/null 2>&1; then
+    jq -r --arg k "$slug" '.[$k] // empty' "$MIN_SIZES_MANIFEST" 2>/dev/null
+  else
+    python3 -c '
+import json, sys
+try:
+  with open("'"$MIN_SIZES_MANIFEST"'") as f: data = json.load(f)
+  v = data.get("'"$slug"'")
+  print(v if v is not None else "")
+except Exception: print("")
+' 2>/dev/null
+  fi
+}
+
 # ---------- resolve port from _server.json if not given ----------
 DESIGN_ROOT="$REPO/.design"
 STATE="$DESIGN_ROOT/_server.json"
@@ -101,11 +126,19 @@ probe_one() {
     echo "✗ $slug — served HTTP error (curl failed for $url)" >&2
     return 1
   }
-  # Floor at 256 bytes — any working ESM bundle is bigger than that.
+  # Hard floor at 256 bytes — any working ESM bundle is bigger than that.
   if [ "$served" -lt 256 ]; then
     echo "✗ $slug — served body $served B < 256 B floor (server returned empty)" >&2
     return 1
   fi
+  # Absolute floor from .min-sizes.json (independent of disk — catches the
+  # case where the SHIPPED bundle is itself defective, like v0.22.0 motion_react).
+  local abs_floor
+  abs_floor=$(floor_for "$slug")
+  if [ -n "$abs_floor" ] && [ "$served" -lt "$abs_floor" ]; then
+    echo "✗ $slug — served $served B < absolute floor $abs_floor B (declared in .min-sizes.json — defective bundle in install)" >&2
+    return 1
+  fi
   # Threshold ratio: served must be ≥ threshold × disk.
   # awk handles the fractional math without bc dependency.
   local ratio
@@ -113,7 +146,7 @@ probe_one() {
   local ok
   ok=$(awk -v r="$ratio" -v t="$THRESHOLD" 'BEGIN{print (r >= t) ? 1 : 0}')
   if [ "$ok" = "1" ]; then
-    [ $QUIET -eq 0 ] && echo "✓ $slug — $served B / $disk_size B disk (ratio $ratio)" >&2
+    [ $QUIET -eq 0 ] && echo "✓ $slug — $served B / $disk_size B disk (ratio $ratio${abs_floor:+, floor ${abs_floor} B})" >&2
     return 0
   fi
   echo "✗ $slug — served $served B / $disk_size B disk (ratio $ratio < $THRESHOLD) — defective dynamic build" >&2
@@ -139,8 +172,16 @@ fi
 
 echo "" >&2
 echo "✗ runtime-health FAIL — $FAIL_COUNT bundle(s) below threshold:$FAIL_LIST" >&2
-echo "  These bundles look like defective dynamic Bun.build output." >&2
+echo "  These bundles look defective." >&2
 echo "  The canvas TSX will parse + serve cleanly, but the iframe will throw at runtime." >&2
+echo "" >&2
+echo "  If the failure was from the 'absolute floor' check (see lines above):" >&2
+echo "    → the SHIPPED bundle on disk is itself defective (rare release-time regression)." >&2
+echo "    → --restart will NOT help; upgrade the package: \`npm i -g @1agh/maude@latest\`" >&2
+echo "      (or for marketplace installs: \`/plugin marketplace update maude\`)." >&2
+echo "  If the failure was from the 'ratio < threshold' check:" >&2
+echo "    → the running server cached a defective dynamic Bun.build output." >&2
+echo "    → --restart will respawn the server and load the (good) disk pre-built." >&2
 
 if [ "$RESTART" -eq 1 ]; then
   echo "→ --restart given; killing server and respawning via server-up.sh" >&2

package/plugins/design/dev-server/build.ts

@@ -405,11 +405,25 @@ async function main() {
   // Pre-built runtime bundles — ship to disk so /_canvas-runtime/* never
   // needs a runtime Bun.build (which would need disk node_modules/react,
   // absent in compiled binaries + npm installs). Phase 19.1 / v0.18.1.
-  const runtime = await buildRuntimeBundles();
-  const t2b = performance.now();
-  console.log(
-    `[build] dist/runtime/*.js ${runtime.bytes.toLocaleString()} B in ${runtime.count} files  (${(t2b - t2).toFixed(0)} ms)`
-  );
+  //
+  // MAUDE_SKIP_RUNTIME_BUILD=1 — skip the regen and trust the committed
+  // dist/runtime/*.js. Set in CI publish-main so the npm tarball ships
+  // exactly what was committed in git (platform-agnostic). v0.22.0 shipped
+  // a broken Ubuntu-CI motion_react.js because the on-disk authoritative
+  // bundle got overwritten by `pnpm build`; this flag prevents that class
+  // of regression. The check-runtime-bundles.sh step still validates the
+  // on-disk artifacts against .min-sizes.json after the build.
+  if (process.env.MAUDE_SKIP_RUNTIME_BUILD === '1') {
+    console.log(
+      `[build] dist/runtime/*.js SKIPPED (MAUDE_SKIP_RUNTIME_BUILD=1 — using committed pre-built)`
+    );
+  } else {
+    const runtime = await buildRuntimeBundles();
+    const t2b = performance.now();
+    console.log(
+      `[build] dist/runtime/*.js ${runtime.bytes.toLocaleString()} B in ${runtime.count} files  (${(t2b - t2).toFixed(0)} ms)`
+    );
+  }
 
   if (MODE === 'release') {
     const targets: PlatformTarget[] = FLAG_TARGET