@1agh/maude 0.23.0 → 0.25.0

package/plugins/design/templates/_shell.html

@@ -28,6 +28,26 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width,initial-scale=1" />
     <title>Canvas</title>
+    <script>
+      // T2 (9.1 / DDR-060 F1 re-audit) — best-effort WebRTC denial in the canvas
+      // iframe. CSP `webrtc 'block'` is specified but UNIMPLEMENTED in shipping
+      // Chrome/Firefox as of 2026 (Chromium #40188662, Firefox bug 1783489), so
+      // it is currently a no-op, and `connect-src 'self'` does NOT cover WebRTC
+      // (it is not Fetch). Hub-pushed canvas JS could otherwise exfil via
+      // ICE/STUN. Locking these to undefined raises the bar against the naive
+      // case before any canvas module loads. NOT bulletproof — a nested
+      // same-origin (about:blank) frame can re-acquire them — so WebRTC exfil
+      // stays a DOCUMENTED residual of opt-in linked mode (see the linked-mode
+      // README banner). `webrtc 'block'` stays in the CSP for when browsers
+      // enforce it. The canvas runtime itself uses zero WebRTC.
+      for (var __k of ['RTCPeerConnection', 'webkitRTCPeerConnection', 'RTCDataChannel']) {
+        try {
+          Object.defineProperty(window, __k, { value: undefined, configurable: false, writable: false });
+        } catch (_) {
+          /* already locked / not present */
+        }
+      }
+    </script>
     <style>
       :root {
         color-scheme: light dark;
@@ -45,27 +65,54 @@
     </style>
     <!-- Phase 6.5 export — when the shell is loaded with `&hide-chrome=1`
          (the exporters set this), suppress every dev-server overlay so the
-         capture only carries the artboard content. The runtime chrome —
-         tool palette, mini-world-map, comment pins, draw layer, snap guides,
-         selection halos, the artboard label button — is not part of the
-         design and would otherwise show up in PNG / PDF / SVG exports. -->
+         capture only carries the artboard content. The runtime chrome — tool
+         palette, mini-map, presence avatars + cursors, comment pins, draw
+         layer, snap guides, selection halos, toolbars, the artboard label
+         button — is not part of the design and would otherwise leak into PNG /
+         PDF / SVG exports. The selector list MUST track the live class names:
+         the previous list referenced `.dc-mini-map` / `.dc-world-map`, which
+         never existed (the real minimap is `.dc-mm`), and omitted the presence
+         avatars `.dc-participants`, so both leaked — see export-pipeline-fixes
+         Task 2. The bootstrap below flips this block's `media` from `not all`
+         to `all` only when `?hide-chrome=1`, so the live editor keeps chrome. -->
     <style id="canvas-hide-chrome" media="not all">
+      /* Minimap + zoom + tool palette (and its portaled popovers) */
+      .dc-mm,
+      .dc-zoom-tb,
       .dc-tool-palette,
+      .dc-tp-popover,
+      .dc-tp-shape-popover,
+      .dc-context-menu,
+      /* Presence — avatars (top-right) + live cursors */
+      .dc-participants,
+      .dc-cursor-overlay,
+      /* Selection + manipulation chrome */
       .dc-cv-halo,
       .dc-cv-group-bbox,
-      .dc-mini-map,
-      .dc-mini-world-map,
-      .dc-world-map,
+      .dc-cv-eq-spacing-layer,
+      .dc-multi-artboard-tb,
+      .dc-elem-ctx-tb,
       .dc-snap-guide,
-      .dc-annot-overlay,
+      .dc-snap-pill,
+      /* Annotations (FigJam-style draw layer) */
       .dc-annot-svg,
-      .dc-annot-chrome,
       .dc-annot-ctx,
+      .dc-annot-resize-handle,
+      /* Comments — pins, threads, composer, @mention popup */
       .cm-layer,
       .cm-pin,
       .cm-thread,
       .cm-composer,
+      .cm-mention-popup,
+      /* Inspector pin overlay injected into every served shell (inspect.ts) */
+      .dgn-pin,
+      #dgn-pin-layer,
+      /* HUDs + banners */
+      .dc-ai-banner,
+      .dc-undo-hud,
+      /* Artboard title/label button (editor affordance, not design content) */
       .dc-artboard-label,
+      /* Generic opt-in hooks for any future floating overlay */
       [data-dc-overlay],
       [data-mdcc-annotations] { display: none !important; }
     </style>
@@ -150,13 +197,28 @@
               const v = msg.version || Date.now();
               // Match by exact filename when we have one; otherwise refresh all.
               const targetFile = (msg.file || '').split('/').pop();
+              let matched = false;
               for (const link of document.querySelectorAll('link[rel="stylesheet"]')) {
                 const href = link.getAttribute('href') || '';
                 if (!targetFile || href.includes(targetFile)) {
                   const base = href.split('?')[0];
                   link.setAttribute('href', base + '?v=' + v);
+                  matched = true;
                 }
               }
+              // A per-canvas `<slug>.css` imported by the TSX is INLINED into the
+              // canvas module as a <style> by Bun.build — there is no <link> to
+              // swap, so the loop above matches nothing and the edit is silently
+              // dropped until a manual hard-reload (RCA hmr-inlined-css-dropped).
+              // When nothing matched AND the changed CSS lives in THIS canvas's
+              // directory, reload so the rebuilt module re-inlines the fresh CSS.
+              // Scoped to same-dir so an unrelated specimen's CSS write doesn't
+              // reload every open tab.
+              if (!matched && msg.file && canvasRel) {
+                const cssDir = msg.file.replace(/[^/]+$/, '');
+                const canvasDir = canvasRel.replace(/[^/]+$/, '');
+                if (cssDir === canvasDir) location.reload();
+              }
             } else if (msg.mode === 'module' || msg.mode === 'hard') {
               // Only reload when the change touches *this* canvas (or `_lib`).
               if (msg.mode === 'hard' || !msg.file || (canvasRel && msg.file === canvasRel)) {
@@ -253,11 +315,24 @@
               'Canvas module at ' + canvasUrl + ' has no default export (or it is not a component).'
             );
           }
+          const rootEl = document.getElementById('canvas-root');
           mountCanvas(Canvas, {
-            rootEl: document.getElementById('canvas-root'),
+            rootEl,
             file: designRel + '/' + canvasRel,
             commentsEnabled,
           });
+          // T2 (9.1-A) diagnostic — tell the parent the canvas mounted + how many
+          // root children it rendered. Lets the shell (and tooling) confirm a
+          // cross-origin canvas actually rendered, which a parent-page screenshot
+          // of an OOPIF cannot show. Harmless heartbeat; ignored if unhandled.
+          setTimeout(() => {
+            try {
+              window.parent.postMessage(
+                { dgn: 'canvas-mounted', file: designRel + '/' + canvasRel, children: rootEl ? rootEl.children.length : 0 },
+                '*'
+              );
+            } catch (e) { /* parent gone */ }
+          }, 800);
         } catch (err) {
           showError((err && err.stack) || String(err));
         }

package/plugins/design/templates/canvas.tsx.template

@@ -29,6 +29,19 @@
  * server (canvas-pipeline.ts pass 1). Don't author them by hand — they'd be
  * stripped + replaced. `/design:handoff` strips them again before the registry
  * sidecar leaves dev (production has no business with dev-time scaffolding).
+ *
+ * Theme model (two ISOLATED layers — system-review D9):
+ *   • Canvas-shell CHROME (workspace plane, floating toolbar, minimap, zoom
+ *     HUD, halos) auto-follows the Maude dev-server theme via `data-maude-theme`
+ *     on the iframe <html> — the dev-server sets it; never theme the chrome
+ *     from canvas code.
+ *   • ARTBOARDS keep THEIR design system's theme. The `data-theme` on the
+ *     `{{ROOT_CLASS}}` wrapper pins this artboard to a specific DS theme block;
+ *     leave it at the DS default ({{THEME_DEFAULT}}). Do NOT hardcode a theme
+ *     the DS doesn't intend — a reviewer flips an individual artboard at will
+ *     via right-click → Theme ▸ Light / Dark / Follow chrome (enabled when the
+ *     DS ships both light + dark token blocks). Only pin a non-default theme
+ *     when the canvas is intentionally single-theme.
  */
 
 import { useState } from "react";

package/plugins/design/templates/design-system-inspiration/SUB-AGENT-PROMPTS.md

@@ -25,9 +25,9 @@ The three MANDATORY safety blocks (ANIMATION SAFETY, RELATIVE-URL SAFETY, PLACEH
 ### RELATIVE-URL SAFETY (mandatory — applies to any specimen referencing assets, logos, glyphs)
 
 - The dev-server serves canvases via `/_canvas-shell.html?canvas=<rel-path>`. **Relative URLs (`../foo.svg`, `./assets/logo.svg`) resolve against the SHELL's URL, not the canvas file's location.** Result: 404 / broken-image icon. Studyfi imprint retro D-4 was caught by the user mid-flow because of exactly this.
-- **Always inline SVGs** in JSX. Use `useId()` for any `<filter id>` / `<linearGradient id>` so multiple instances of the same component don't collide on a single page. OR
-- **Always use absolute paths rooted at `/assets/...`** served from the dev-server's static mount. The `system/<ds>/assets/` directory is mounted at `/assets/<ds>/` in production-handoff mode.
-- **Forbidden:** `<img src="../foo.svg">`, `<image href="./logo.svg">`, `url('../bg.png')` inside inline `<style>` blocks. Any of these surviving in a specimen is a graphic-design-critic blocker.
+- **Always inline SVGs** in JSX. Use `useId()` for any `<filter id>` / `<linearGradient id>` so multiple instances of the same component don't collide on a single page. This is the **strongly-preferred** default. OR
+- **Use an absolute path that mirrors the real on-disk location under the repo root** — the ONE correct form is `/<designRoot>/system/<ds>/assets/<file>`, e.g. `/.design/system/<ds>/assets/logo.svg` (with the default `designRoot` of `.design`). The dev-server's fall-through serves any file by its real path under the repo root (`http.ts` `safePathUnderRoot`); there is **no `/assets/<ds>/` alias** — that earlier wording was wrong and 404s. Substitute the project's actual `designRoot` (read `config.json` `designRoot`) if it isn't `.design`.
+- **Forbidden:** `<img src="../foo.svg">`, `<image href="./logo.svg">`, `url('../bg.png')` inside inline `<style>` blocks, AND the bogus `/assets/<ds>/…` alias. Any of these surviving in a specimen is a graphic-design-critic blocker.
 
 ### PLACEHOLDER POLICY (mandatory — applies to logo / mark / wordmark / mascot / glyph / illustration claims)
 
@@ -134,7 +134,8 @@ SAFETY BLOCKS — apply to every file in your slice:
   + compositor-only + reduced-motion + no-bouncy-springs.
 - **RELATIVE-URL SAFETY** (see SUB-AGENT-PROMPTS.md). Mandatory if your slice
   references ANY asset (logo, glyph, illustration, background image). Inline
-  SVG with `useId()`, OR absolute `/assets/<ds>/...` path. NEVER relative.
+  SVG with `useId()`, OR absolute `/<designRoot>/system/<ds>/assets/...` path
+  (e.g. `/.design/system/<ds>/assets/...`). NEVER relative, NEVER `/assets/<ds>/`.
 - **PLACEHOLDER POLICY** (see SUB-AGENT-PROMPTS.md). Mandatory if your slice
   scaffolds the `logo` / `empty-state` specimen or any brand-asset surface.
   Read the roster `assets:` block FIRST. If `source:` is populated, copy the
@@ -212,13 +213,17 @@ The base template above applies to every slice. Each slice gets a small addendum
 
 **Apply RELATIVE-URL SAFETY in full.** The `iconography` specimen tends to reference glyph SVGs; the `focus` specimen sometimes references focus-ring fixtures. Inline ALL SVGs.
 
+**Restraint-default type ladder (D-8).** The `type-scale` specimen demonstrates the scale the tokens already encode — do NOT reintroduce drama the tokens deliberately held back. The default ceiling is **type-scale ratio ≤ 1.2, optical-size ≤ 72, display weight ≤ semibold, tracking ≥ -0.02em**. If `colors_and_type.css` already carries a more dramatic ladder (a high-confidence research recommendation explicitly asked for maximalism), mirror what the tokens declare — never push *beyond* the tokens on your own initiative. Restraint is the default; the user opts UP via `/design:edit`, not the sub-agent.
+
+**Research type-fidelity (D-7).** Read the research payload's type recommendation (in the discovery payload / DS README). **Mirror its PRIMARY display-face ROLE exactly.** A "grotesque" direction yields a grotesque display face even when an open-source serif is more convenient to wire up — do NOT let font availability flip the role. Distinguish the **display role** from the **body-accent role**: a recommendation like `display-grotesque-editorial-serif` means a grotesque sans for the DISPLAY face *with* an editorial serif for BODY accents — it does NOT mean the serif is the display face. If the named face is unavailable, substitute within the SAME classification (grotesque → grotesque, not grotesque → serif) and note the substitution so it lands in the bypass-log. (Studyfi read "serif" off `display-grotesque-editorial-serif` and picked Fraunces as the display face — inverting the roles.)
+
 ### Slice: `brand + voice` (empty-state, logo)
 
 **Apply PLACEHOLDER POLICY in full.** This slice is the highest-risk for placeholder-bleed. The `logo` specimen MUST start by reading the roster's `assets:` block:
 - If `assets.logo.source` is a real path, the specimen `<img>`s / inlines the real asset.
 - If `assets.logo.source` is empty, fall back to a `-placeholder` SVG with the rationale in the JSX comment block. Set `source: placeholder` on roster update.
 
-**Apply RELATIVE-URL SAFETY in full.** Logo specimens are 100% asset-bound. Inline SVG is the default; absolute `/assets/<ds>/logo.svg` is the alternative.
+**Apply RELATIVE-URL SAFETY in full.** Logo specimens are 100% asset-bound. Inline SVG is the default; absolute `/<designRoot>/system/<ds>/assets/logo.svg` (e.g. `/.design/system/<ds>/assets/logo.svg`) is the alternative — never the bogus `/assets/<ds>/` alias.
 
 ### Slice: `core components` (components-buttons, components-cards, components-inputs)
 
@@ -230,6 +235,8 @@ No slice-specific addenda — the base template covers them.
 
 ### Slice: `ui_kits-*-showcase` (main agent OR signature sub-agent)
 
+**Showcase-from-real-app (D-6) — read the real layout BEFORE composing, for existing products.** If the prompt injects real layout paths (the orchestrator passes the app's `AppLayout` + primary-nav component paths when the DS is for a shipped product), you MUST **read those files first and mirror that UX, restyling only** — apply the DS tokens + signature treatment to the *real* screen anatomy. Do NOT invent a plausible-but-fictional product UX when a real one was handed to you; inventing it is the studyfi D-6 regression that forced a ~5500-LOC rebuild. If NO real layout paths are injected (greenfield DS), compose a project-specific mock from `domain_nouns` per the creativity rubric — that path is unchanged.
+
 **Apply ANIMATION SAFETY.** Showcase is the highest-density "DS in use" artifact; presence cursors, route transitions, and panel slides all show up here. Every animation must be bounded + reduced-motion-safe + token-derived.
 
 **Apply RELATIVE-URL SAFETY.** Showcase often references domain product imagery. Inline SVG mocks, never `<img src="../assets/...">`.
@@ -242,5 +249,5 @@ No slice-specific addenda — the base template covers them.
 - Discovery probe templates (sibling): `plugins/design/skills/design-system/_pastier-probe-templates.md`
 - Motion library decision: `.ai/decisions/DDR-049-motion-one-as-canonical-motion-library.md`
 - Imprint-bootstrap retro (source of D-1 … D-5): `.ai/logs/system-reviews/imprint-bootstrap-review-2026-05-26.md`
-- Asset sweep helper: `plugins/design/dev-server/bin/asset-sweep.sh`
-- Visual sanity helper: `plugins/design/dev-server/bin/visual-sanity.sh`
+- Asset sweep helper: `maude design asset-sweep` (on-PATH `maude` dispatches to the bundled helper — DDR-062)
+- Visual sanity helper: `maude design visual-sanity` (on-PATH `maude` dispatches to the bundled helper — DDR-062)

package/plugins/flow/.claude-plugin/config.schema.json

@@ -42,6 +42,11 @@
           "type": "string",
           "description": "Living codebase snapshot. Default: `.ai/context/codebase-map.md`.",
           "default": ".ai/context/codebase-map.md"
+        },
+        "designRoot": {
+          "type": "string",
+          "description": "Root of the design plugin's canvas workspace, relative to repo root. Where flow looks for `.meta.json` sidecars + canvases when bridging to design (`/flow:plan` canvas detection, `/flow:done` handoff sweep, `codebase-intelligence` design-artifacts section). Mirrors the design plugin's own default. Flow reads this directory read-only — it never writes into the design root except the `/flow:done` handoff sweep's meta status update. Default: `.design`.",
+          "default": ".design"
         }
       }
     },

package/plugins/flow/templates/ai-skeleton/README.md

@@ -27,7 +27,7 @@ These live at the root of `.ai/` (not in subfolders) and are referenced by `work
 
 - `<name>-prd.md` — product requirements / brief
 - `<name>-design-system.md` — design system reference (look & feel, tokens, density)
-- `workflows.config.json` — config consumed by all flow commands and skills
+- `workflows.config.json` — config consumed by all flow commands and skills. The optional top-level `quality` map (lint / format / typecheck / tests / build → shell command) is **not** scaffolded here — run `maude doctor --fix` once your `package.json` scripts exist and it detects + adds them (additive, never overwrites your edits).
 
 ## Conventions
 

package/plugins/flow/templates/ai-skeleton/gitignore

@@ -0,0 +1,10 @@
+# Sidecar cache — Phase C / DDR-061 (cli/lib/cache.mjs).
+# Commit the shareable, content-addressed layers (research/domain + codebase-
+# intelligence are SHA-keyed and reusable across collaborators); keep the
+# brief/run/HEAD-specific layers (research/project, design-context, scenario,
+# security) and the local telemetry (_stats.json, README.md) out of git.
+cache/*
+!cache/codebase-intelligence/
+!cache/research/
+cache/research/*
+!cache/research/domain/

package/plugins/flow/templates/ai-skeleton/scenarios/README.md

@@ -9,6 +9,7 @@ scenarios/
 ├── _lib/                       — shared helpers (selectors, fixtures, env)
 └── <scenario-slug>/
     ├── spec.md                 — what the flow does, success criteria, platform matrix
+    ├── covers.json             — OPTIONAL: { web/native/shared git pathspecs } the scenario exercises
     └── <YYYY-MM-DD-HHMM>/
         ├── report.md           — TL;DR + per-platform pivot table + counter deltas
         ├── web-desktop/        — screenshots, logs
@@ -21,6 +22,7 @@ scenarios/
 
 - **Scenario slug:** kebab-case, action-oriented (`coach-creates-recurring-practice`, `signup-via-invite`).
 - **Run timestamp:** local time of the run start. Latest run = lexicographically last folder.
-- **Report format:** owned by the `scenario` skill — see plugin docs.
+- **Report format:** owned by the `scenario` skill — `maude scenario-report <run-dir>` generates the mechanical tables; the LLM authors only the prose sections.
+- **`covers.json`** (optional): declares the source globs the scenario exercises, split into `web` / `native` / `shared` git pathspecs. Enables the route-aware skip (re-run only when covered files changed) and the web-only scope skip (no sim boot for web-only diffs). Example: `{"web":["app/(video)/**"],"native":["expo-app/**"],"shared":["packages/api-client/**"]}`. Absent → the scenario always runs the full platform matrix.
 
 Run with `/flow:scenario <slug>` (registered scenarios) or `/flow:scenario <ad-hoc description>` (one-off).

package/plugins/flow/templates/ai-skeleton/workflows.config.json

@@ -6,7 +6,8 @@
   "paths": {
     "prd": ".ai/PROJECT_NAME-prd.md",
     "designSystem": ".ai/PROJECT_NAME-design-system.md",
-    "codebaseMap": ".ai/context/codebase-map.md"
+    "codebaseMap": ".ai/context/codebase-map.md",
+    "designRoot": ".design"
   },
   "platforms": ["web-desktop"],
   "stack": {