@1agh/maude 0.22.0 → 0.23.0

package/cli/commands/design-link.test.mjs

@@ -6,7 +6,7 @@
 
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { createServer } from 'node:http';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
@@ -205,3 +205,55 @@ test('status --json emits structured payload', async () => {
   assert.equal(payload.sync.agent, 'not-implemented');
   cleanup();
 });
+
+// --------------------------------------------------- DDR-054 F2/F4 trust gate
+
+const REMOTE_URL = 'http://hub.invalid:9999'; // .invalid never resolves (RFC 6761)
+
+test('linking a non-loopback hub without --yes (non-TTY) refuses', async () => {
+  // The spawned child has no TTY on stdin, so the gate must refuse rather
+  // than silently link a remote hub in a script.
+  const res = await runCli(['design', 'link', REMOTE_URL, '--token', 'mau_x', '--force']);
+  assert.equal(res.status, 1);
+  assert.match(res.stderr, /requires confirmation/);
+  // No link written.
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  assert.equal(cfg.linkedHub, undefined);
+  cleanup();
+});
+
+test('linking a non-loopback hub with --yes records trust + links', async () => {
+  const res = await runCli(['design', 'link', REMOTE_URL, '--token', 'mau_x', '--yes', '--force']);
+  assert.equal(res.status, 0, res.stderr);
+  assert.match(res.stderr, /confirmed via --yes/);
+  assert.match(res.stderr, /experimental v1\.1 preview/); // F3 banner
+
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  assert.equal(cfg.linkedHub.url, REMOTE_URL);
+
+  // Trust is recorded PER-MACHINE (hubs.json), never in a committable repo file.
+  const hubs = JSON.parse(readFileSync(hubsConfigPath, 'utf8'));
+  assert.ok(hubs.trusted.includes(REMOTE_URL), 'hub should be trusted on this machine');
+  assert.equal(
+    existsSync(join(workspace, '.maude/trusted-hubs')),
+    false,
+    'no committable trust file'
+  );
+
+  // Re-linking the now-trusted hub no longer needs --yes.
+  const second = await runCli(['design', 'link', REMOTE_URL, '--token', 'mau_y', '--force']);
+  assert.equal(second.status, 0, second.stderr);
+  cleanup();
+});
+
+test('--adopt against a non-loopback hub lists the upload manifest in the gate', async () => {
+  writeFileSync(join(workspace, '.design/screen.html'), '<button>hi</button>', 'utf8');
+  const res = await runCli(['design', 'adopt', REMOTE_URL, '--token', 'mau_x', '--yes', '--force']);
+  assert.equal(res.status, 0, res.stderr);
+  assert.match(res.stderr, /will UPLOAD 1 local file/);
+  assert.match(res.stderr, /\.design\/screen\.html/);
+
+  const hubs = JSON.parse(readFileSync(hubsConfigPath, 'utf8'));
+  assert.equal(typeof hubs.hubs[REMOTE_URL].adoptedAt, 'number'); // F4 attestation
+  cleanup();
+});

package/cli/commands/hub.test.mjs

@@ -3,12 +3,14 @@
 
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { test } from 'node:test';
 import { fileURLToPath } from 'node:url';
 
+import { readTokens } from '../../plugins/design/hub/src/tokens.mjs';
+
 const BIN = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'maude.mjs');
 
 function runCli(args, { cwd } = {}) {
@@ -40,7 +42,7 @@ test('hub token generate without --label exits 2', () => {
   assert.match(res.stderr, /--label <name> is required/);
 });
 
-test('hub token generate writes tokens.json + prints the connect command', () => {
+test('hub token generate persists to the store + prints the connect command', () => {
   withDataDir((dataDir) => {
     const res = runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
     assert.equal(res.status, 0, res.stderr);
@@ -48,11 +50,11 @@ test('hub token generate writes tokens.json + prints the connect command', () =>
     assert.match(res.stdout, /value:\s+mau_[0-9a-f]{32}/);
     assert.match(res.stdout, /maude design link/);
 
-    const raw = readFileSync(join(dataDir, 'tokens.json'), 'utf8');
-    const parsed = JSON.parse(raw);
-    assert.equal(parsed.tokens.length, 1);
-    assert.equal(parsed.tokens[0].label, 'alice');
-    assert.match(parsed.tokens[0].value, /^mau_[0-9a-f]{32}$/);
+    const { tokens } = readTokens(dataDir);
+    assert.equal(tokens.length, 1);
+    assert.equal(tokens[0].label, 'alice');
+    // The raw value is never persisted — only labels/metadata are listable.
+    assert.equal(tokens[0].value, undefined);
   });
 });
 
@@ -61,8 +63,7 @@ test('hub token generate --label is idempotent (overwrites in place)', () => {
     runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
     runCli(['hub', 'token', 'generate', '--label', 'alice', '--data', dataDir]);
 
-    const parsed = JSON.parse(readFileSync(join(dataDir, 'tokens.json'), 'utf8'));
-    assert.equal(parsed.tokens.length, 1);
+    assert.equal(readTokens(dataDir).tokens.length, 1);
   });
 });
 

package/cli/lib/design-link.mjs

@@ -10,19 +10,21 @@
 //
 // Token NEVER lands in .design/config.json — that's git-committed.
 
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
+import { createInterface } from 'node:readline';
 
 import { parseArgs } from './argv.mjs';
-import { addHub, getHub, normalizeUrl, removeHub } from './hubs-config.mjs';
+import { addHub, getHub, isHubTrusted, normalizeUrl, removeHub, trustHub } from './hubs-config.mjs';
 
 const DESIGN_CONFIG_PATH = '.design/config.json';
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
 
 // ---------------------------------------------------------------- link
 
 export async function runLink({ args, cwd = process.cwd(), forceAdopt = false }) {
   const tail = args.slice(args.indexOf(forceAdopt ? 'adopt' : 'link') + 1);
-  const { flags, positional } = parseArgs(tail, { booleans: ['adopt', 'force'] });
+  const { flags, positional } = parseArgs(tail, { booleans: ['adopt', 'force', 'yes'] });
   const url = positional[0];
   const token = flags.token;
 
@@ -52,6 +54,46 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
     process.exit(2);
   }
 
+  const cfg = readDesignConfig(designConfigPath);
+
+  // DDR-054 F2/F4: linking to a non-loopback hub grants a remote actor the same
+  // write access to .design/ as the local user (hub-pushed content lands on
+  // disk verbatim, like `git pull` from a stranger). Require explicit trust for
+  // a new remote hub. Trust is checked PER-MACHINE (`isHubTrusted`), never from
+  // a committable repo file — a committed allowlist (or the committed
+  // `linkedHub.url` itself) would let a malicious PR pre-seed trust and bypass
+  // this gate (trust laundering). Loopback dev hubs are exempt.
+  const loopback = isLoopbackUrl(normUrl);
+  const alreadyTrusted = loopback || isHubTrusted(normUrl);
+  const manifest = adopt ? collectAdoptManifest(cwd) : [];
+
+  if (!alreadyTrusted) {
+    process.stderr.write(trustGateText(normUrl, adopt, manifest));
+    if (flags.yes) {
+      process.stderr.write('  → confirmed via --yes\n');
+    } else if (process.stdin.isTTY) {
+      const question = adopt
+        ? `Link this repo to ${normUrl} AND push local design state up to it? [y/N] `
+        : `Link this repo to ${normUrl}? [y/N] `;
+      const ok = await promptYesNo(question);
+      if (!ok) {
+        process.stderr.write('maude design link: aborted — hub not trusted.\n');
+        process.exit(1);
+      }
+    } else {
+      process.stderr.write(
+        `maude design link: linking to a non-local hub (${normUrl}) requires confirmation.\n  Re-run in an interactive terminal, or pass --yes to confirm non-interactively.\n`
+      );
+      process.exit(1);
+    }
+    // NOTE: trust is recorded AFTER the link succeeds (below), not here — an
+    // aborted link (probe fail without --force, config write throws) must not
+    // leave a persisted trust that silently skips the gate on a later re-link.
+  } else if (adopt && manifest.length > 0) {
+    // Trusted (e.g. localhost) adopt — surface the manifest informationally.
+    process.stdout.write(adoptManifestText(normUrl, manifest));
+  }
+
   // Reachability probe — best-effort. Hub auth happens on WS upgrade (Task 4),
   // so a successful /health response only tells us the hub is up + reachable.
   // Token validity is verified when the sync agent connects for real.
@@ -63,11 +105,10 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
     process.exit(1);
   }
 
-  // Write hub side: tokens.json next to the user's other config.
-  const hubRecord = addHub(normUrl, token);
+  // Write hub side: token (+ adopt attestation) in ~/.config/maude/hubs.json.
+  const hubRecord = addHub(normUrl, token, adopt ? { adoptedAt: Date.now() } : {});
 
   // Write project side: linkedHub field on .design/config.json.
-  const cfg = readDesignConfig(designConfigPath);
   const existing = cfg.linkedHub;
   if (existing && !flags.force) {
     process.stdout.write(
@@ -81,9 +122,15 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
   };
   writeDesignConfig(designConfigPath, cfg);
 
+  // Record per-machine trust only now that the link fully succeeded, so a
+  // later re-link to this hub won't re-prompt. Skipped for loopback + hubs
+  // already trusted on this machine.
+  if (!alreadyTrusted) trustHub(normUrl);
+
   process.stdout.write(
-    `[design link] linked ${cwd} to ${normUrl}.\n  token:   stored in ~/.config/maude/hubs.json (per-machine, never committed)\n  config:  .design/config.json.linkedHub = { url, linkedAt${adopt ? ', adopt: true' : ''} }\n  hub:     ${probe.ok ? `v${probe.version}, uptime ${Math.round((probe.uptimeMs ?? 0) / 1000)}s, ${probe.tokenCount} token(s) (${probe.authMode})` : 'NOT REACHED — linked anyway (--force)'}\n\nNext step: start 'maude design serve' — the linked sync agent ${adopt ? 'will push local state up to the hub on first connect' : 'will mirror hub state to disk on first connect'}.\n  (Sync agent lands in Phase 9 Task 4.)\n`
+    `[design link] linked ${cwd} to ${normUrl}.\n  token:   stored in ~/.config/maude/hubs.json (per-machine, never committed)\n  config:  .design/config.json.linkedHub = { url, linkedAt${adopt ? ', adopt: true' : ''} }\n  hub:     ${probe.ok ? `v${probe.version}, uptime ${Math.round((probe.uptimeMs ?? 0) / 1000)}s, ${probe.tokenCount} token(s) (${probe.authMode})` : 'NOT REACHED — linked anyway (--force)'}\n\nNext step: start 'maude design serve' — the linked sync agent ${adopt ? 'will push local state up to the hub on first connect' : 'will mirror hub state to disk on first connect'}.\n`
   );
+  if (!loopback) process.stderr.write(linkedModeBanner());
 }
 
 // ---------------------------------------------------------------- adopt
@@ -214,3 +261,103 @@ async function probeHealth(url) {
     return { ok: false, error: err.message };
   }
 }
+
+// ----------------------------------------------------- trust gate (DDR-054 F2/F4)
+
+/** True when the hub URL points at the local machine (no remote-write risk). */
+function isLoopbackUrl(normUrl) {
+  try {
+    return LOOPBACK_HOSTS.has(new URL(normUrl).hostname);
+  } catch {
+    return false;
+  }
+}
+
+/** Promise-resolving [y/N] prompt. Prompt + echo go to stderr (stdout is data). */
+function promptYesNo(question) {
+  return new Promise((res) => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    rl.question(question, (answer) => {
+      rl.close();
+      res(/^y(es)?$/i.test(answer.trim()));
+    });
+  });
+}
+
+/**
+ * Files `--adopt` would push up to the hub: top-level canvases + annotation
+ * SVGs + comment JSON snapshots (the git-tracked sync surface per Task 9).
+ */
+function collectAdoptManifest(cwd) {
+  const base = resolve(cwd, '.design');
+  const files = [];
+  try {
+    for (const f of readdirSync(base)) {
+      if (f.endsWith('.html') || f.endsWith('.annotations.svg')) {
+        try {
+          files.push({ rel: `.design/${f}`, bytes: statSync(resolve(base, f)).size });
+        } catch {
+          /* skip unreadable */
+        }
+      }
+    }
+  } catch {
+    /* no .design — manifest stays empty */
+  }
+  const commentsDir = resolve(base, '_comments');
+  try {
+    for (const f of readdirSync(commentsDir)) {
+      if (!f.endsWith('.json')) continue;
+      try {
+        files.push({
+          rel: `.design/_comments/${f}`,
+          bytes: statSync(resolve(commentsDir, f)).size,
+        });
+      } catch {
+        /* skip unreadable */
+      }
+    }
+  } catch {
+    /* no comments dir */
+  }
+  return files;
+}
+
+function adoptManifestText(normUrl, manifest) {
+  const lines = manifest.map((f) => `    ${f.rel} (${f.bytes} B)`).join('\n');
+  return `[design link] --adopt will push ${manifest.length} local file(s) up to ${normUrl}:\n${lines}\n`;
+}
+
+function trustGateText(normUrl, adopt, manifest) {
+  let url;
+  try {
+    url = new URL(normUrl);
+  } catch {
+    url = { protocol: '?', hostname: normUrl };
+  }
+  const scheme = `${url.protocol.replace(':', '')}${url.protocol === 'http:' ? ' (NOT encrypted — token + edits travel in cleartext)' : ''}`;
+  let out = `
+⚠ Linking to a NON-LOCAL hub.
+    URL:    ${normUrl}
+    scheme: ${scheme}
+    host:   ${url.hostname}
+  A linked hub can write to your .design/ files (treat like \`git pull\` from a stranger).
+  Only link to hubs you operate or fully trust. See DDR-054 for the trust model.
+`;
+  if (adopt) {
+    const list = manifest.map((f) => `    ${f.rel} (${f.bytes} B)`).join('\n');
+    out +=
+      manifest.length > 0
+        ? `\n  --adopt will UPLOAD ${manifest.length} local file(s) to this hub:\n${list}\n`
+        : '\n  --adopt is set but no local canvases/comments/annotations were found to upload.\n';
+  }
+  return out;
+}
+
+function linkedModeBanner() {
+  return `
+⚠ Linked mode is an experimental v1.1 preview. Hub-pushed content is written
+  to your .design/ files as untrusted input. Only link to hubs you operate or
+  fully trust. See DDR-054 for the trust model.
+`;
+}

package/cli/lib/hubs-config.mjs

@@ -12,8 +12,15 @@
 //         "linkedAt": 1716800000000
 //       },
 //       ...
-//     }
+//     },
+//     "trusted": ["https://maude-hub-foo.fly.dev", ...]
 //   }
+//
+// `trusted` is the per-machine trust allowlist for non-loopback hubs (the
+// `maude design link` confirmation, DDR-054 F2). It lives here — NOT in a
+// committable repo file — on purpose: a committable allowlist would let an
+// attacker pre-seed trust via a PR and bypass the link-time confirmation
+// (trust laundering). Trust is a per-machine decision, like `~/.ssh/known_hosts`.
 
 import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
@@ -68,11 +75,20 @@ export function saveHubsConfig(config) {
   }
 }
 
-/** Upsert a hub entry. Same URL replaces the existing record. */
-export function addHub(url, token) {
+/**
+ * Upsert a hub entry. Same URL replaces the existing record. `extra` merges
+ * additional per-machine attestations (e.g. `adoptedAt` — the timestamp this
+ * machine pushed its local state up via `--adopt`, used by the sync runtime to
+ * avoid re-adopting; DDR-054 F4).
+ *
+ * @param {string} url
+ * @param {string} token
+ * @param {{ adoptedAt?: number }} [extra]
+ */
+export function addHub(url, token, extra = {}) {
   const norm = normalizeUrl(url);
   const cfg = loadHubsConfig();
-  cfg.hubs[norm] = { token, linkedAt: Date.now() };
+  cfg.hubs[norm] = { token, linkedAt: Date.now(), ...extra };
   saveHubsConfig(cfg);
   return cfg.hubs[norm];
 }
@@ -98,6 +114,28 @@ export function getHub(url) {
   return cfg.hubs[norm] ?? null;
 }
 
+/**
+ * Per-machine trust check for a non-loopback hub (DDR-054 F2). Trust is stored
+ * here, not in a committable repo file, so a malicious PR cannot pre-seed it.
+ */
+export function isHubTrusted(url) {
+  const norm = normalizeUrl(url);
+  const cfg = loadHubsConfig();
+  return Array.isArray(cfg.trusted) && cfg.trusted.includes(norm);
+}
+
+/** Record a hub as trusted on THIS machine. Idempotent. */
+export function trustHub(url) {
+  const norm = normalizeUrl(url);
+  const cfg = loadHubsConfig();
+  if (!Array.isArray(cfg.trusted)) cfg.trusted = [];
+  if (!cfg.trusted.includes(norm)) {
+    cfg.trusted.push(norm);
+    saveHubsConfig(cfg);
+  }
+  return norm;
+}
+
 /**
  * Normalize a hub URL so different spellings resolve to the same key:
  * - Trim trailing slash.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -38,16 +38,16 @@
     "video:render": "cd scripts/video/final && pnpm run render",
     "video:studio": "cd scripts/video/final && pnpm run studio",
     "postinstall": "node cli/install.cjs",
-    "prepublishOnly": "bash scripts/check-version-parity.sh"
+    "prepublishOnly": "bash scripts/check-version-parity.sh && bash plugins/design/dev-server/bin/check-runtime-bundles.sh"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.22.0",
-    "@1agh/maude-darwin-x64": "0.22.0",
-    "@1agh/maude-linux-arm64": "0.22.0",
-    "@1agh/maude-linux-arm64-musl": "0.22.0",
-    "@1agh/maude-linux-x64": "0.22.0",
-    "@1agh/maude-linux-x64-musl": "0.22.0",
-    "@1agh/maude-win32-x64": "0.22.0"
+    "@1agh/maude-darwin-arm64": "0.23.0",
+    "@1agh/maude-darwin-x64": "0.23.0",
+    "@1agh/maude-linux-arm64": "0.23.0",
+    "@1agh/maude-linux-arm64-musl": "0.23.0",
+    "@1agh/maude-linux-x64": "0.23.0",
+    "@1agh/maude-linux-x64-musl": "0.23.0",
+    "@1agh/maude-win32-x64": "0.23.0"
   },
   "files": [
     "cli",

package/plugins/design/dev-server/bin/check-runtime-bundles.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# check-runtime-bundles.sh — pre-publish guard against shipping defective
+# /_canvas-runtime/<slug>.js bundles.
+#
+# Why: Bun.build's output for `motion` + `motion/react` is environment-sensitive
+# (Bun version, OS, transitive dep resolution). v0.22.0 shipped a 13 kB
+# motion_react.js where the working bundle is 155 kB+ — the smaller artifact
+# parses cleanly + serves HTTP 200 but throws `ReferenceError: AcceleratedAnimation
+# is not defined` at module-eval time, breaking every canvas that uses the
+# motion lib. CI build was green; the regression slipped because nothing
+# asserted bundle SIZE.
+#
+# This guard reads dist/runtime/.min-sizes.json and asserts each on-disk
+# bundle ≥ its declared floor. Run from CI before `npm publish`. Hard-fails
+# the publish job → the bad tarball never reaches npm.
+#
+# Floors are at ~70% of release-minified size (see manifest comment). Any
+# minifier improvement that drops a bundle below the floor needs an explicit
+# manifest bump + investigation — that's the point.
+#
+# Usage:
+#   check-runtime-bundles.sh [--runtime-dir <path>] [--manifest <path>]
+#
+# Defaults:
+#   --runtime-dir = <plugin>/dev-server/dist/runtime/
+#   --manifest    = <runtime-dir>/.min-sizes.json
+#
+# Exit codes:
+#   0 all bundles meet floor
+#   1 manifest or runtime dir missing
+#   2 bad args
+#   3 one or more bundles below floor
+
+set -euo pipefail
+
+RUNTIME_DIR=""
+MANIFEST=""
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --runtime-dir) RUNTIME_DIR="$2"; shift 2 ;;
+    --manifest)    MANIFEST="$2"; shift 2 ;;
+    --help|-h)
+      sed -n '2,30p' "$0" | sed 's/^# \?//'
+      exit 0
+      ;;
+    *)
+      echo "check-runtime-bundles.sh: unknown arg '$1' (try --help)" >&2
+      exit 2
+      ;;
+  esac
+done
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+if [ -z "$RUNTIME_DIR" ]; then
+  RUNTIME_DIR="$SCRIPT_DIR/../dist/runtime"
+fi
+if [ -z "$MANIFEST" ]; then
+  MANIFEST="$RUNTIME_DIR/.min-sizes.json"
+fi
+
+if [ ! -d "$RUNTIME_DIR" ]; then
+  echo "check-runtime-bundles.sh: runtime dir not found at $RUNTIME_DIR" >&2
+  exit 1
+fi
+if [ ! -f "$MANIFEST" ]; then
+  echo "check-runtime-bundles.sh: manifest not found at $MANIFEST" >&2
+  exit 1
+fi
+
+# Read manifest as <slug> <floor> pairs, one per line. Skip $-prefixed
+# metadata keys ($comment etc.). Prefer jq when available; fall back to
+# python3 (always present in CI runners + macOS).
+read_pairs() {
+  if command -v jq >/dev/null 2>&1; then
+    jq -r 'to_entries | map(select(.key | startswith("$") | not)) | .[] | "\(.key) \(.value)"' "$MANIFEST"
+  else
+    python3 -c '
+import json, sys
+with open("'"$MANIFEST"'") as f:
+    data = json.load(f)
+for k, v in data.items():
+    if k.startswith("$"): continue
+    print(k, v)
+'
+  fi
+}
+
+FAIL_COUNT=0
+CHECK_COUNT=0
+MISSING_COUNT=0
+
+while read -r slug floor; do
+  [ -z "$slug" ] && continue
+  CHECK_COUNT=$((CHECK_COUNT + 1))
+  PATH_JS="$RUNTIME_DIR/$slug"
+  if [ ! -f "$PATH_JS" ]; then
+    echo "✗ $slug — missing on disk (expected at $PATH_JS)" >&2
+    MISSING_COUNT=$((MISSING_COUNT + 1))
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+    continue
+  fi
+  SIZE=$(wc -c < "$PATH_JS" | tr -d ' ')
+  if [ "$SIZE" -lt "$floor" ]; then
+    echo "✗ $slug — $SIZE B < floor $floor B (likely defective bundle)" >&2
+    FAIL_COUNT=$((FAIL_COUNT + 1))
+  else
+    echo "✓ $slug — $SIZE B ≥ floor $floor B"
+  fi
+done < <(read_pairs)
+
+if [ "$FAIL_COUNT" -eq 0 ]; then
+  echo ""
+  echo "✓ check-runtime-bundles OK — $CHECK_COUNT bundles, all above floor"
+  exit 0
+fi
+
+echo "" >&2
+echo "✗ check-runtime-bundles FAIL — $FAIL_COUNT/$CHECK_COUNT bundle(s) below floor" >&2
+if [ "$MISSING_COUNT" -gt 0 ]; then
+  echo "  ($MISSING_COUNT missing from disk — was buildRuntimeBundles() skipped?)" >&2
+fi
+echo "  Refusing to ship a tarball with defective /_canvas-runtime artifacts." >&2
+echo "  Investigate the Bun.build output for the offending package(s) before publishing." >&2
+exit 3

package/plugins/design/dev-server/bin/runtime-health.sh

@@ -8,9 +8,14 @@
 # server returns HTTP 200, but the iframe throws at module-eval time with
 # `ReferenceError: AcceleratedAnimation is not defined` (or similar).
 #
-# Parse-clean ≠ run-clean. This helper closes that gap: probe every URL the
-# canvas-lib pulls in, compare byte-count to the disk pre-built, fail loud
-# when the served body is suspiciously small.
+# Parse-clean ≠ run-clean. This helper closes that gap with TWO checks:
+#   1. Per-bundle absolute floor — served body MUST clear the size declared
+#      in dist/runtime/.min-sizes.json. This catches the v0.22.0 regression
+#      class where the installed bundle on disk is ITSELF defective (so
+#      compare-to-disk would trivially pass).
+#   2. Compare-to-disk ratio — served body MUST be ≥ threshold × on-disk
+#      size. Catches the original case where disk is good but the running
+#      dev-server returned a defective dynamic Bun.build cached in memory.
 #
 # Usage:
 #   runtime-health.sh [--port N] [--root <repo>] [--threshold 0.5]
@@ -67,6 +72,26 @@ if [ ! -d "$PREBUILT_DIR" ]; then
   exit 1
 fi
 
+# Absolute-floor manifest. Optional — if missing we fall back to the
+# disk-ratio check alone (older installs from before .min-sizes.json shipped).
+MIN_SIZES_MANIFEST="$PREBUILT_DIR/.min-sizes.json"
+floor_for() {
+  local slug="$1"
+  [ -f "$MIN_SIZES_MANIFEST" ] || { echo ""; return; }
+  if command -v jq >/dev/null 2>&1; then
+    jq -r --arg k "$slug" '.[$k] // empty' "$MIN_SIZES_MANIFEST" 2>/dev/null
+  else
+    python3 -c '
+import json, sys
+try:
+  with open("'"$MIN_SIZES_MANIFEST"'") as f: data = json.load(f)
+  v = data.get("'"$slug"'")
+  print(v if v is not None else "")
+except Exception: print("")
+' 2>/dev/null
+  fi
+}
+
 # ---------- resolve port from _server.json if not given ----------
 DESIGN_ROOT="$REPO/.design"
 STATE="$DESIGN_ROOT/_server.json"
@@ -101,11 +126,19 @@ probe_one() {
     echo "✗ $slug — served HTTP error (curl failed for $url)" >&2
     return 1
   }
-  # Floor at 256 bytes — any working ESM bundle is bigger than that.
+  # Hard floor at 256 bytes — any working ESM bundle is bigger than that.
   if [ "$served" -lt 256 ]; then
     echo "✗ $slug — served body $served B < 256 B floor (server returned empty)" >&2
     return 1
   fi
+  # Absolute floor from .min-sizes.json (independent of disk — catches the
+  # case where the SHIPPED bundle is itself defective, like v0.22.0 motion_react).
+  local abs_floor
+  abs_floor=$(floor_for "$slug")
+  if [ -n "$abs_floor" ] && [ "$served" -lt "$abs_floor" ]; then
+    echo "✗ $slug — served $served B < absolute floor $abs_floor B (declared in .min-sizes.json — defective bundle in install)" >&2
+    return 1
+  fi
   # Threshold ratio: served must be ≥ threshold × disk.
   # awk handles the fractional math without bc dependency.
   local ratio
@@ -113,7 +146,7 @@ probe_one() {
   local ok
   ok=$(awk -v r="$ratio" -v t="$THRESHOLD" 'BEGIN{print (r >= t) ? 1 : 0}')
   if [ "$ok" = "1" ]; then
-    [ $QUIET -eq 0 ] && echo "✓ $slug — $served B / $disk_size B disk (ratio $ratio)" >&2
+    [ $QUIET -eq 0 ] && echo "✓ $slug — $served B / $disk_size B disk (ratio $ratio${abs_floor:+, floor ${abs_floor} B})" >&2
     return 0
   fi
   echo "✗ $slug — served $served B / $disk_size B disk (ratio $ratio < $THRESHOLD) — defective dynamic build" >&2
@@ -139,8 +172,16 @@ fi
 
 echo "" >&2
 echo "✗ runtime-health FAIL — $FAIL_COUNT bundle(s) below threshold:$FAIL_LIST" >&2
-echo "  These bundles look like defective dynamic Bun.build output." >&2
+echo "  These bundles look defective." >&2
 echo "  The canvas TSX will parse + serve cleanly, but the iframe will throw at runtime." >&2
+echo "" >&2
+echo "  If the failure was from the 'absolute floor' check (see lines above):" >&2
+echo "    → the SHIPPED bundle on disk is itself defective (rare release-time regression)." >&2
+echo "    → --restart will NOT help; upgrade the package: \`npm i -g @1agh/maude@latest\`" >&2
+echo "      (or for marketplace installs: \`/plugin marketplace update maude\`)." >&2
+echo "  If the failure was from the 'ratio < threshold' check:" >&2
+echo "    → the running server cached a defective dynamic Bun.build output." >&2
+echo "    → --restart will respawn the server and load the (good) disk pre-built." >&2
 
 if [ "$RESTART" -eq 1 ]; then
   echo "→ --restart given; killing server and respawning via server-up.sh" >&2