@1agh/maude 0.26.0 → 0.28.0

package/cli/commands/design-link.test.mjs

@@ -136,6 +136,52 @@ test('adopt subcommand is an alias of link --adopt', async () => {
   cleanup();
 });
 
+test('DDR-079: link without a flag omits syncTsx (= default ON, restore-proof)', async () => {
+  const res = await runCli(['design', 'link', URL, '--token', 'mau_test']);
+  assert.equal(res.status, 0, res.stderr);
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  // We never write syncTsx:true to encode the default — absence means on.
+  assert.equal(cfg.linkedHub.syncTsx, undefined);
+  assert.match(res.stdout, /TSX sync: on by default/);
+  cleanup();
+});
+
+test('DDR-079: link --no-sync-tsx records syncTsx:false (project opt-out)', async () => {
+  const res = await runCli(['design', 'link', URL, '--token', 'mau_test', '--no-sync-tsx']);
+  assert.equal(res.status, 0, res.stderr);
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  assert.equal(cfg.linkedHub.syncTsx, false);
+  assert.match(res.stdout, /TSX sync: off \(opted out/);
+  cleanup();
+});
+
+test('DDR-079: link --sync-tsx pins syncTsx:true explicitly', async () => {
+  const res = await runCli(['design', 'link', URL, '--token', 'mau_test', '--sync-tsx']);
+  assert.equal(res.status, 0, res.stderr);
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  assert.equal(cfg.linkedHub.syncTsx, true);
+  cleanup();
+});
+
+test('DDR-079: status surfaces the migration advisory when syncTsx is unset', async () => {
+  await runCli(['design', 'link', URL, '--token', 'mau_test']);
+  const res = await runCli(['design', 'status']);
+  assert.equal(res.status, 0, res.stderr);
+  assert.match(res.stdout, /TSX sync:\s+on \(default/);
+  assert.match(res.stdout, /syncTsx is not set/);
+  cleanup();
+});
+
+test('DDR-079: status --json reports effective + explicit syncTsx', async () => {
+  await runCli(['design', 'link', URL, '--token', 'mau_test', '--no-sync-tsx']);
+  const res = await runCli(['design', 'status', '--json']);
+  assert.equal(res.status, 0, res.stderr);
+  const payload = JSON.parse(res.stdout);
+  assert.equal(payload.syncTsx, false);
+  assert.equal(payload.syncTsxExplicit, false);
+  cleanup();
+});
+
 test('link against unreachable URL exits 1 unless --force', async () => {
   const dead = 'http://127.0.0.1:1';
   const fail = await runCli(['design', 'link', dead, '--token', 'mau_test']);

package/cli/commands/doctor.mjs

@@ -1,6 +1,8 @@
 // `maude doctor` — unified workspace diagnostic.
 // Combines (1) plugin dependency preflight, (2) workflows.config.json schema
-// validation, (3) stack drift, (4) quality-gate additions into one report.
+// validation, (3) stack drift, (4) quality-gate additions, and (5) linked
+// design-hub / TSX-sync health (report-only, local signals — no network) into
+// one report.
 //
 // Flags:
 //   --plugin <name>   Scope deps section to one plugin. Config section is
@@ -23,6 +25,7 @@ import { stdin, stdout } from 'node:process';
 import { createInterface } from 'node:readline/promises';
 import { parseArgs } from '../lib/argv.mjs';
 import { lintConfig } from '../lib/config-lint.mjs';
+import { getHub } from '../lib/hubs-config.mjs';
 import { checkAll } from '../lib/preflight.mjs';
 import { detectQualityGates, detectStack } from '../lib/stack-detect.mjs';
 
@@ -115,6 +118,60 @@ export async function run({ args, pkgRoot }) {
     };
   }
 
+  // ── Design config: linked-hub + TSX-sync health (report-only) ────────────
+  // doctor's primary domain is .ai/workflows.config.json, but a linked design
+  // project's .design/config.json carries the one knob that has bitten users
+  // repeatedly — `linkedHub.syncTsx`. Surface it here so doctor is the one-stop
+  // health check. Report-only: under DDR-079 (default ON) every state is valid,
+  // so there is nothing to --fix and we NEVER impose an opt-out.
+  let designReport = { exists: false };
+  const designFsPath = resolve(repoRoot, '.design/config.json');
+  if (existsSync(designFsPath)) {
+    try {
+      const dcfg = JSON.parse(readFileSync(designFsPath, 'utf8'));
+      const linkedHub = dcfg.linkedHub;
+      if (!linkedHub) {
+        designReport = { exists: true, linked: false };
+      } else {
+        const syncTsx = linkedHub.syncTsx;
+        const tsxSync =
+          syncTsx === false
+            ? 'off (opted out)'
+            : syncTsx === true
+              ? 'on (explicit)'
+              : 'on (default)';
+        // Local-only signals — no network. `getHub` reads ~/.config/maude/
+        // hubs.json; the sync-agent state comes from the serve-written
+        // `_sync.json`. We deliberately DO NOT probe the hub's /health here:
+        // doctor must stay fast + offline (it runs in the release pre-flight),
+        // so live hub reachability stays in `maude design status`.
+        let tokenStored = false;
+        try {
+          tokenStored = !!getHub(linkedHub.url);
+        } catch {
+          /* hubs.json absent/unreadable on this machine → no token */
+        }
+        designReport = {
+          exists: true,
+          linked: true,
+          hubUrl: linkedHub.url,
+          adopt: !!linkedHub.adopt,
+          tsxSync,
+          tokenStored,
+          syncAgent: readSyncAgentState(resolve(repoRoot, '.design', '_sync.json')),
+          // DDR-079 migration advisory: a linked config with no explicit
+          // syncTsx rides the default, which flipped off→on in maude 0.27→0.28.
+          advisory:
+            syncTsx === undefined
+              ? 'TSX sync defaults ON (DDR-079) — every .tsx syncs to this hub. Opt out with linkedHub.syncTsx:false or `maude design link … --no-sync-tsx`.'
+              : null,
+        };
+      }
+    } catch (err) {
+      designReport = { exists: true, error: `invalid JSON: ${err.message}` };
+    }
+  }
+
   // ── Summary ─────────────────────────────────────────────────────────────
   const hardDepsMissing = Object.values(depsByPlugin)
     .filter((r) => r.summary)
@@ -132,12 +189,12 @@ export async function run({ args, pkgRoot }) {
 
   if (jsonMode) {
     process.stdout.write(
-      `${JSON.stringify({ deps: depsByPlugin, config: configReport, summary }, null, 2)}\n`
+      `${JSON.stringify({ deps: depsByPlugin, config: configReport, design: designReport, summary }, null, 2)}\n`
     );
     process.exit(summary.healthy ? 0 : 1);
   }
 
-  printReport({ depsByPlugin, configReport, summary });
+  printReport({ depsByPlugin, configReport, designReport, summary });
 
   // ── Fix path ────────────────────────────────────────────────────────────
   if (fix) {
@@ -151,11 +208,33 @@ export async function run({ args, pkgRoot }) {
   process.exit(summary.healthy ? 0 : 1);
 }
 
+// Read the serve-written `.design/_sync.json` and condense it to one line.
+// Local file only — never network. Returns null when the agent hasn't run.
+function readSyncAgentState(p) {
+  if (!existsSync(p)) return null;
+  try {
+    const s = JSON.parse(readFileSync(p, 'utf8'));
+    if (s.notSyncable) return `0 syncable — ${s.reason || 'see `maude design status`'}`;
+    if (s.state) {
+      const bits = [String(s.state), `${s.canvases ?? 0} canvas(es)`];
+      if (s.queuedOps) bits.push(`${s.queuedOps} queued`);
+      if (s.conflicts?.length) bits.push(`${s.conflicts.length} conflict notice(s)`);
+      return bits.join(', ');
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 function usage() {
   return `maude doctor [--plugin <name>] [--fix] [--json]
 
   Unified workspace diagnostic. Reports missing dependencies, config schema
-  errors, stack drift, and missing quality-gate declarations in one shot.
+  errors, stack drift, missing quality-gate declarations, and — when a
+  .design/config.json is linked — design-hub + TSX-sync health, in one shot.
+  (The design section is report-only and local; live hub reachability is
+  \`maude design status\`.)
 
   Flags:
     --plugin <name>   Scope dependency section to one plugin (design | flow).
@@ -170,7 +249,7 @@ function usage() {
 `;
 }
 
-function printReport({ depsByPlugin, configReport, summary }) {
+function printReport({ depsByPlugin, configReport, designReport, summary }) {
   process.stdout.write('maude doctor\n\n');
   for (const [name, env] of Object.entries(depsByPlugin)) {
     process.stdout.write(`  Dependencies (plugins/${name}):\n`);
@@ -235,6 +314,32 @@ function printReport({ depsByPlugin, configReport, summary }) {
     }
   }
 
+  // Design / linked-hub health — report-only, local signals only (no network).
+  if (designReport?.exists) {
+    process.stdout.write('  Design hub (.design/config.json):\n');
+    if (designReport.error) {
+      process.stdout.write(`    ✗ ${designReport.error}\n`);
+    } else if (!designReport.linked) {
+      process.stdout.write('    solo — not linked to a hub.\n');
+    } else {
+      process.stdout.write(`    ✓ linked: ${designReport.hubUrl}\n`);
+      process.stdout.write(
+        `      token stored: ${designReport.tokenStored ? 'yes' : 'NO — run `maude design link`'}\n`
+      );
+      process.stdout.write(`      TSX sync:     ${designReport.tsxSync}\n`);
+      if (designReport.adopt)
+        process.stdout.write('      adopt mode:   yes (push-on-first-sync)\n');
+      process.stdout.write(
+        `      sync agent:   ${designReport.syncAgent || 'idle (start `maude design serve`)'}\n`
+      );
+      if (designReport.advisory) process.stdout.write(`    ℹ  ${designReport.advisory}\n`);
+      process.stdout.write(
+        '    (live hub reachability + full sync detail: `maude design status`)\n'
+      );
+    }
+    process.stdout.write('\n');
+  }
+
   const parts = [];
   if (summary.hardDepsMissing) parts.push(`${summary.hardDepsMissing} hard dep missing`);
   if (summary.schemaErrors)

package/cli/commands/doctor.test.mjs

@@ -183,3 +183,55 @@ test('summary line reflects counts (drift/additions tracked via package.json)',
   const lintAdd = env.config.qualityAdditions.find((a) => a.gate === 'lint');
   assert.ok(lintAdd);
 });
+
+// ── DDR-079: design-hub / TSX-sync section (report-only, local) ──────────────
+function writeDesign(root, linkedHub) {
+  mkdirSync(join(root, '.design'), { recursive: true });
+  writeFileSync(
+    join(root, '.design/config.json'),
+    JSON.stringify({ name: 't', designRoot: '.design', ...(linkedHub ? { linkedHub } : {}) })
+  );
+}
+
+test('DDR-079: linked design config with no syncTsx → on (default) + advisory', () => {
+  const root = makeTempRepo();
+  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify({ name: 'x' })}\n`);
+  writeDesign(root, { url: 'https://hub.example.com', linkedAt: 1 });
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.linked, true);
+  assert.equal(env.design.hubUrl, 'https://hub.example.com');
+  assert.equal(env.design.tsxSync, 'on (default)');
+  assert.match(env.design.advisory, /defaults ON/);
+});
+
+test('DDR-079: syncTsx:false → off (opted out), no advisory', () => {
+  const root = makeTempRepo();
+  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify({ name: 'x' })}\n`);
+  writeDesign(root, { url: 'https://hub.example.com', linkedAt: 1, syncTsx: false });
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.tsxSync, 'off (opted out)');
+  assert.equal(env.design.advisory, null);
+});
+
+test('DDR-079: syncTsx:true → on (explicit), no advisory', () => {
+  const root = makeTempRepo();
+  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify({ name: 'x' })}\n`);
+  writeDesign(root, { url: 'https://hub.example.com', linkedAt: 1, syncTsx: true });
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.tsxSync, 'on (explicit)');
+  assert.equal(env.design.advisory, null);
+});
+
+test('design section reports solo when .design/config.json has no linkedHub', () => {
+  const root = makeTempRepo();
+  writeDesign(root, null);
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.exists, true);
+  assert.equal(env.design.linked, false);
+});
+
+test('design section absent when no .design/config.json', () => {
+  const root = makeTempRepo();
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.exists, false);
+});

package/cli/lib/design-link.mjs

@@ -25,7 +25,9 @@ const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
 
 export async function runLink({ args, cwd = process.cwd(), forceAdopt = false }) {
   const tail = args.slice(args.indexOf(forceAdopt ? 'adopt' : 'link') + 1);
-  const { flags, positional } = parseArgs(tail, { booleans: ['adopt', 'force', 'yes'] });
+  const { flags, positional } = parseArgs(tail, {
+    booleans: ['adopt', 'force', 'yes', 'sync-tsx', 'no-sync-tsx'],
+  });
   const url = positional[0];
   const token = flags.token;
 
@@ -116,15 +118,27 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
       `[design link] note: replacing existing link to ${existing.url} (was added ${new Date(existing.linkedAt).toISOString()}).\n`
     );
   }
-  // DDR-072 — preserve the project-level TSX opt-in only when re-linking to the
-  // SAME hub. Changing the hub URL drops it: a new hub is a fresh trust decision
-  // and must not silently inherit "sync all my TSX" (the DDR-054 F2 lesson).
-  const keepSyncTsx = existing?.syncTsx === true && existing.url === normUrl;
+  // DDR-079 — TSX sync defaults ON, so we only PERSIST `syncTsx` when it's an
+  // explicit choice; absence means "the default", and we never write
+  // `syncTsx: true` just to encode the default (that's what bit us — a value
+  // that git-restore could wipe to silently flip behavior). Precedence:
+  //   --no-sync-tsx → false (project-wide opt-out)
+  //   --sync-tsx    → true  (explicit, == default; useful to pin against a future
+  //                          default change or to self-document)
+  //   else, re-link to the SAME hub → carry the existing explicit value forward
+  //         (a NEW hub URL is a fresh trust decision — don't inherit, DDR-054 F2)
+  //   else          → omit (= on by default)
+  let syncTsx;
+  if (flags['no-sync-tsx']) syncTsx = false;
+  else if (flags['sync-tsx']) syncTsx = true;
+  else if (existing && existing.url === normUrl && typeof existing.syncTsx === 'boolean') {
+    syncTsx = existing.syncTsx;
+  }
   cfg.linkedHub = {
     url: normUrl,
     linkedAt: hubRecord.linkedAt,
     ...(adopt ? { adopt: true } : {}),
-    ...(keepSyncTsx ? { syncTsx: true } : {}),
+    ...(syncTsx !== undefined ? { syncTsx } : {}),
   };
   writeDesignConfig(designConfigPath, cfg);
 
@@ -140,8 +154,12 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
     await maybeWriteGitignoreBlock(cwd, !!flags.yes);
   }
 
+  const tsxSyncLine =
+    syncTsx === false
+      ? 'off (opted out — linkedHub.syncTsx: false)'
+      : 'on by default (DDR-079) — every .tsx body syncs; opt out with --no-sync-tsx or a canvas .meta.json "syncable": false';
   process.stdout.write(
-    `[design link] linked ${cwd} to ${normUrl}.\n  token:   stored in ~/.config/maude/hubs.json (per-machine, never committed)\n  config:  .design/config.json.linkedHub = { url, linkedAt${adopt ? ', adopt: true' : ''} }\n  hub:     ${probe.ok ? `v${probe.version}, uptime ${Math.round((probe.uptimeMs ?? 0) / 1000)}s, ${probe.tokenCount} token(s) (${probe.authMode})` : 'NOT REACHED — linked anyway (--force)'}\n\nNext step: start 'maude design serve' — the linked sync agent ${adopt ? 'will push local state up to the hub on first connect' : 'will mirror hub state to disk on first connect'}.\n`
+    `[design link] linked ${cwd} to ${normUrl}.\n  token:    stored in ~/.config/maude/hubs.json (per-machine, never committed)\n  config:   .design/config.json.linkedHub = { url, linkedAt${adopt ? ', adopt: true' : ''}${syncTsx !== undefined ? `, syncTsx: ${syncTsx}` : ''} }\n  TSX sync: ${tsxSyncLine}\n  hub:      ${probe.ok ? `v${probe.version}, uptime ${Math.round((probe.uptimeMs ?? 0) / 1000)}s, ${probe.tokenCount} token(s) (${probe.authMode})` : 'NOT REACHED — linked anyway (--force)'}\n\nNext step: start 'maude design serve' — the linked sync agent ${adopt ? 'will push local state up to the hub on first connect' : 'will mirror hub state to disk on first connect'}.\n`
   );
   if (!loopback) process.stderr.write(linkedModeBanner());
 }
@@ -220,6 +238,9 @@ export async function runStatus({ args, cwd = process.cwd() }) {
     url,
     linkedAt: cfg.linkedHub.linkedAt,
     adopt: !!cfg.linkedHub.adopt,
+    // DDR-079 — effective TSX-sync state: on unless explicitly opted out.
+    syncTsx: cfg.linkedHub.syncTsx !== false,
+    syncTsxExplicit: typeof cfg.linkedHub.syncTsx === 'boolean' ? cfg.linkedHub.syncTsx : null,
     tokenStored: !!hubRecord,
     hub: probe.ok
       ? {
@@ -249,8 +270,17 @@ export async function runStatus({ args, cwd = process.cwd() }) {
         }${sync.conflicts?.length ? `, ${sync.conflicts.length} conflict notice(s)` : ''}`
       : 'idle (start `maude design serve` in linked mode)';
   process.stdout.write(
-    `Maude design — linked mode\n  hub URL:      ${url}\n  linked at:    ${new Date(cfg.linkedHub.linkedAt).toISOString()}\n  adopt mode:   ${cfg.linkedHub.adopt ? 'yes (push-on-first-sync)' : 'no (hub-wins)'}\n  token stored: ${hubRecord ? 'yes (~/.config/maude/hubs.json)' : "NO — re-run 'maude design link'"}\n  hub status:   ${probe.ok ? `up — v${probe.version}, ${uptimeS}s uptime, ${probe.tokenCount} token(s), ${probe.authMode}` : `UNREACHABLE — ${probe.error}`}\n  sync agent:   ${syncLine}\n`
+    `Maude design — linked mode\n  hub URL:      ${url}\n  linked at:    ${new Date(cfg.linkedHub.linkedAt).toISOString()}\n  adopt mode:   ${cfg.linkedHub.adopt ? 'yes (push-on-first-sync)' : 'no (hub-wins)'}\n  TSX sync:     ${cfg.linkedHub.syncTsx === false ? 'off (opted out — linkedHub.syncTsx: false)' : 'on (default — DDR-079)'}\n  token stored: ${hubRecord ? 'yes (~/.config/maude/hubs.json)' : "NO — re-run 'maude design link'"}\n  hub status:   ${probe.ok ? `up — v${probe.version}, ${uptimeS}s uptime, ${probe.tokenCount} token(s), ${probe.authMode}` : `UNREACHABLE — ${probe.error}`}\n  sync agent:   ${syncLine}\n`
   );
+  // DDR-079 migration advisory: a config with no explicit `syncTsx` rides the
+  // default, which FLIPPED from off→on in maude 0.27. Surface it so an upgrader
+  // who relied on the old "TSX never syncs" behavior isn't surprised that every
+  // .tsx now goes to the hub.
+  if (cfg.linkedHub.syncTsx === undefined) {
+    process.stdout.write(
+      '\n  ℹ  syncTsx is not set, so it uses the DEFAULT — which is now ON (DDR-079, maude ≥ 0.27): every .tsx syncs to this hub.\n     Upgraded from an older maude and want the pre-0.27 behavior (no TSX sync)? Set  .design/config.json → linkedHub.syncTsx: false  (or  maude design link <url> --token … --no-sync-tsx).\n'
+    );
+  }
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -41,13 +41,13 @@
     "prepublishOnly": "bash scripts/check-version-parity.sh && bash plugins/design/dev-server/bin/check-runtime-bundles.sh"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.26.0",
-    "@1agh/maude-darwin-x64": "0.26.0",
-    "@1agh/maude-linux-arm64": "0.26.0",
-    "@1agh/maude-linux-arm64-musl": "0.26.0",
-    "@1agh/maude-linux-x64": "0.26.0",
-    "@1agh/maude-linux-x64-musl": "0.26.0",
-    "@1agh/maude-win32-x64": "0.26.0"
+    "@1agh/maude-darwin-arm64": "0.28.0",
+    "@1agh/maude-darwin-x64": "0.28.0",
+    "@1agh/maude-linux-arm64": "0.28.0",
+    "@1agh/maude-linux-arm64-musl": "0.28.0",
+    "@1agh/maude-linux-x64": "0.28.0",
+    "@1agh/maude-linux-x64-musl": "0.28.0",
+    "@1agh/maude-win32-x64": "0.28.0"
   },
   "files": [
     "cli",

package/plugins/design/dev-server/activity.ts

@@ -0,0 +1,256 @@
+// Canvas activity tracker (Phase 13 / DDR-029).
+//
+// Subscribes to the existing `fs:any` bus event, filters for canvas-shaped
+// files under <designRoot>, and maintains a per-file `active | idle` status with
+// a debounce: rapid saves stay `active`, ACTIVITY_IDLE_MS of fs silence flips a
+// file to `idle`. Every transition emits `activity:change` on the bus, which
+// ws.ts forwards to canvas iframes as `{ type: 'activity', … }`. The injected
+// canvas runtime (use-canvas-activity.tsx) turns that into a live "agent works
+// here" overlay on the affected artboards.
+//
+// Bun-native (DDR-009): setTimeout/clearTimeout + Bun.file for the Task 7 diff;
+// no node:fs reads where Bun.file works. Pure, fs-injected helpers (isCanvasFile
+// / diffArtboardIds) unit-test without touching disk.
+
+import path from 'node:path';
+
+import type { Context } from './context.ts';
+
+/** Idle debounce — fs silence longer than this flips a file `active` → `idle`. */
+export const ACTIVITY_IDLE_MS = 3000;
+
+/** LRU cap on the per-file text stash used by the Task 7 region diff. */
+const STASH_CAP = 50;
+
+// Mirrors api.ts SKIP_DIRS — directories that never hold user-facing canvases.
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  '.next',
+  '.turbo',
+  'dist',
+  'build',
+  '.expo',
+  'coverage',
+  'dev-server',
+  '_history',
+]);
+
+/**
+ * True when a design-root-relative path is a user-facing canvas the overlay
+ * should light up. `.tsx` / `.html` only, minus:
+ *   - runtime artifacts + any `_`-prefixed file or directory (`_history/`,
+ *     `_draw/`, `_smoke/`, `_locator.json`, …),
+ *   - SKIP_DIRS segments (node_modules, dist, …),
+ *   - DS preview specimens under `system/<ds>/preview/**` — a critic editing a
+ *     preview emits a real `fs:any`, but those aren't canvases the user is
+ *     iterating on, so an overlay there is a false positive (plan Task 1 gotcha;
+ *     extended to `.tsx` specimens, not just the `.html` the plan named, because
+ *     the rationale is identical).
+ *
+ * Pure — no disk access. Accepts back-slash or forward-slash input.
+ */
+export function isCanvasFile(rel: string): boolean {
+  if (typeof rel !== 'string') return false;
+  const p = rel.replace(/\\/g, '/').replace(/^\/+/, '');
+  if (!p) return false;
+  const segs = p.split('/');
+  const base = segs[segs.length - 1] ?? '';
+  const dot = base.lastIndexOf('.');
+  const ext = dot >= 0 ? base.slice(dot).toLowerCase() : '';
+  if (ext !== '.tsx' && ext !== '.html') return false;
+  for (const s of segs) {
+    if (SKIP_DIRS.has(s)) return false;
+    if (s.startsWith('_')) return false;
+  }
+  if (/(^|\/)system\/[^/]+\/preview\//.test(p)) return false;
+  return true;
+}
+
+export interface ActivityEntry {
+  status: 'active' | 'idle';
+  /** ISO timestamp of the last transition. */
+  ts: string;
+  /**
+   * Artboard ids the change was scoped to (Task 7), or null when the change is
+   * file-level (every artboard in the file lights up). Always null on the first
+   * sight of a file (no baseline to diff against).
+   */
+  artboardIds: string[] | null;
+}
+
+export interface ActivityChange {
+  file: string;
+  status: 'active' | 'idle';
+  artboard_ids: string[] | null;
+  ts: string;
+}
+
+export interface Activity {
+  /** WS-open snapshot — keyed by design-root-relative canvas path. */
+  state: Record<string, ActivityEntry>;
+  /**
+   * Test seam — synchronously mark a file `active` (file-level) and schedule its
+   * idle flip. The live path calls this from the `fs:any` handler, then refines
+   * `artboardIds` asynchronously via the Task 7 diff.
+   */
+  mark(file: string): void;
+  /** Unsubscribe from the bus and clear all pending idle timers. */
+  stop(): void;
+}
+
+export interface ActivityOptions {
+  /** Override the idle debounce (tests pass a small value). */
+  idleMs?: number;
+  /** Disable the Task 7 per-artboard diff (file-level only). Default: enabled. */
+  diff?: boolean;
+}
+
+export function createActivity(ctx: Context, opts: ActivityOptions = {}): Activity {
+  const idleMs = opts.idleMs ?? ACTIVITY_IDLE_MS;
+  const diffEnabled = opts.diff !== false;
+
+  const state: Record<string, ActivityEntry> = {};
+  const idleTimers = new Map<string, ReturnType<typeof setTimeout>>();
+  // Last-seen file text, for the Task 7 region diff. Insertion-ordered Map = LRU.
+  const lastText = new Map<string, string>();
+
+  function emit(file: string) {
+    const e = state[file];
+    if (!e) return;
+    const change: ActivityChange = {
+      file,
+      status: e.status,
+      artboard_ids: e.artboardIds,
+      ts: e.ts,
+    };
+    ctx.bus.emit('activity:change', change);
+  }
+
+  function scheduleIdle(file: string) {
+    const prev = idleTimers.get(file);
+    if (prev) clearTimeout(prev);
+    const t = setTimeout(() => {
+      idleTimers.delete(file);
+      const e = state[file];
+      if (!e || e.status === 'idle') return;
+      e.status = 'idle';
+      e.ts = new Date().toISOString();
+      // Idle carries no artboard scope — the whole file cross-fades out.
+      e.artboardIds = null;
+      emit(file);
+    }, idleMs);
+    idleTimers.set(file, t);
+  }
+
+  // Public + internal entry. Marks the file `active` file-level (preserving any
+  // artboardIds already refined this active window), refreshes the idle timer,
+  // and emits. Emits on the idle→active transition AND on every refresh-while-
+  // active (plan Task 2) — idempotent for the client, which only fades on idle.
+  function mark(file: string) {
+    const prev = state[file];
+    const carryIds = prev && prev.status === 'active' ? prev.artboardIds : null;
+    state[file] = { status: 'active', ts: new Date().toISOString(), artboardIds: carryIds };
+    scheduleIdle(file);
+    emit(file);
+  }
+
+  // Task 7 — refine the active file's artboardIds via a cheap region diff of the
+  // previous vs current file text. Best-effort: any read race / parse ambiguity
+  // leaves the file-level highlight in place. Runs at most once per fs:any (which
+  // fs-watch already debounces 50 ms), and never blocks the synchronous mark().
+  async function refineArtboards(file: string) {
+    if (!ctx.paths?.designRoot) return;
+    try {
+      const abs = path.join(ctx.paths.designRoot, file);
+      const next = await Bun.file(abs).text();
+      const prev = lastText.get(file);
+      stash(file, next);
+      if (prev == null) return; // first sight — no baseline, stay file-level
+      const ids = diffArtboardIds(prev, next);
+      if (!ids || ids.length === 0) return; // ambiguous / outside-region change
+      const e = state[file];
+      if (e && e.status === 'active') {
+        e.artboardIds = ids;
+        emit(file);
+      }
+    } catch {
+      /* read race, file gone, or designRoot unset in tests — stay file-level */
+    }
+  }
+
+  function stash(file: string, text: string) {
+    if (lastText.has(file)) lastText.delete(file);
+    lastText.set(file, text);
+    while (lastText.size > STASH_CAP) {
+      const oldest = lastText.keys().next().value;
+      if (oldest === undefined) break;
+      lastText.delete(oldest);
+    }
+  }
+
+  const off = ctx.bus.on('fs:any', (rel: string) => {
+    if (!isCanvasFile(rel)) return;
+    mark(rel);
+    if (diffEnabled) void refineArtboards(rel);
+  });
+
+  function stop() {
+    off();
+    for (const t of idleTimers.values()) clearTimeout(t);
+    idleTimers.clear();
+    lastText.clear();
+  }
+
+  return { state, mark, stop };
+}
+
+// ---------------------------------------------------------------------------
+// Task 7 helpers — pure, regex-bounded region diff. Exported for unit tests.
+
+/**
+ * Map each `<DCArtboard id="X">…</DCArtboard>` to its inner body text. Returns
+ * `null` when no artboard markers are found (the file can't be region-scoped, so
+ * the caller falls back to a file-level highlight). DCArtboards aren't nested in
+ * practice, so a non-greedy body match is sufficient — deliberately not AST-
+ * based (a TSX parser would mean a new dep, against DDR-009's zero-dep spirit).
+ */
+function extractArtboardRegions(src: string): Map<string, string> | null {
+  const re = /<DCArtboard\b[^>]*\bid=["']([^"']+)["'][^>]*>([\s\S]*?)<\/DCArtboard>/g;
+  const map = new Map<string, string>();
+  let m: RegExpExecArray | null;
+  // biome-ignore lint/suspicious/noAssignInExpressions: canonical regex-exec loop.
+  while ((m = re.exec(src)) !== null) {
+    map.set(m[1] as string, m[2] as string);
+  }
+  return map.size === 0 ? null : map;
+}
+
+/** The file with every artboard BODY stripped — what's left is the "shell". */
+function artboardSkeleton(src: string): string {
+  return src.replace(
+    /(<DCArtboard\b[^>]*\bid=["'][^"']+["'][^>]*>)[\s\S]*?(<\/DCArtboard>)/g,
+    '$1$2'
+  );
+}
+
+/**
+ * Ids of the `<DCArtboard>` blocks whose body changed between two file
+ * revisions, or `null` to signal "fall back to file-level" when:
+ *   - either revision has no parseable artboard markers, OR
+ *   - anything outside the artboard bodies changed (imports, opening-tag attrs,
+ *     artboard added/removed → the shell differs), OR
+ *   - nothing inside any artboard body changed.
+ */
+export function diffArtboardIds(prev: string, next: string): string[] | null {
+  const prevRegions = extractArtboardRegions(prev);
+  const nextRegions = extractArtboardRegions(next);
+  if (!prevRegions || !nextRegions) return null;
+  if (artboardSkeleton(prev) !== artboardSkeleton(next)) return null;
+  const ids = new Set([...prevRegions.keys(), ...nextRegions.keys()]);
+  const changed: string[] = [];
+  for (const id of ids) {
+    if (prevRegions.get(id) !== nextRegions.get(id)) changed.push(id);
+  }
+  return changed.length ? changed : null;
+}

package/plugins/design/dev-server/ai-banner.tsx

@@ -125,6 +125,10 @@ export function AiBanner(): JSX.Element | null {
 
     // postMessage relay path — parent sends `ai-activity` events.
     const onMessage = (e: MessageEvent) => {
+      // DDR-078 security follow-up: only the trusted embedding parent relays
+      // ai-activity. Reject canvas self-posts faking a "Claude is editing"
+      // banner. Standalone (no parent) uses the own-WS path below instead.
+      if (e.source !== window.parent || window.parent === window) return;
       const m = e.data as { dgn?: string; file?: string; entry?: AiEntry | null } | null;
       if (!m || typeof m !== 'object') return;
       if (m.dgn !== 'ai-activity') return;