@1agh/maude 0.27.0 → 0.28.1

package/cli/commands/design-link.test.mjs

@@ -136,6 +136,52 @@ test('adopt subcommand is an alias of link --adopt', async () => {
   cleanup();
 });
 
+test('DDR-079: link without a flag omits syncTsx (= default ON, restore-proof)', async () => {
+  const res = await runCli(['design', 'link', URL, '--token', 'mau_test']);
+  assert.equal(res.status, 0, res.stderr);
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  // We never write syncTsx:true to encode the default — absence means on.
+  assert.equal(cfg.linkedHub.syncTsx, undefined);
+  assert.match(res.stdout, /TSX sync: on by default/);
+  cleanup();
+});
+
+test('DDR-079: link --no-sync-tsx records syncTsx:false (project opt-out)', async () => {
+  const res = await runCli(['design', 'link', URL, '--token', 'mau_test', '--no-sync-tsx']);
+  assert.equal(res.status, 0, res.stderr);
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  assert.equal(cfg.linkedHub.syncTsx, false);
+  assert.match(res.stdout, /TSX sync: off \(opted out/);
+  cleanup();
+});
+
+test('DDR-079: link --sync-tsx pins syncTsx:true explicitly', async () => {
+  const res = await runCli(['design', 'link', URL, '--token', 'mau_test', '--sync-tsx']);
+  assert.equal(res.status, 0, res.stderr);
+  const cfg = JSON.parse(readFileSync(join(workspace, '.design/config.json'), 'utf8'));
+  assert.equal(cfg.linkedHub.syncTsx, true);
+  cleanup();
+});
+
+test('DDR-079: status surfaces the migration advisory when syncTsx is unset', async () => {
+  await runCli(['design', 'link', URL, '--token', 'mau_test']);
+  const res = await runCli(['design', 'status']);
+  assert.equal(res.status, 0, res.stderr);
+  assert.match(res.stdout, /TSX sync:\s+on \(default/);
+  assert.match(res.stdout, /syncTsx is not set/);
+  cleanup();
+});
+
+test('DDR-079: status --json reports effective + explicit syncTsx', async () => {
+  await runCli(['design', 'link', URL, '--token', 'mau_test', '--no-sync-tsx']);
+  const res = await runCli(['design', 'status', '--json']);
+  assert.equal(res.status, 0, res.stderr);
+  const payload = JSON.parse(res.stdout);
+  assert.equal(payload.syncTsx, false);
+  assert.equal(payload.syncTsxExplicit, false);
+  cleanup();
+});
+
 test('link against unreachable URL exits 1 unless --force', async () => {
   const dead = 'http://127.0.0.1:1';
   const fail = await runCli(['design', 'link', dead, '--token', 'mau_test']);

package/cli/commands/design.mjs

@@ -1,6 +1,6 @@
 import { execSync, spawn, spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { chmodSync, existsSync, readFileSync } from 'node:fs';
+import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { basename, dirname, join, resolve } from 'node:path';
 import { parseArgs } from '../lib/argv.mjs';
@@ -42,6 +42,11 @@ const BIN_VERBS = new Set([
   'svg-optimize',
 ]);
 
+// Bin verbs that boot the dev-server (directly, or by shelling into server-up.sh).
+// For these we resolve the compiled platform binary and hand its path to the
+// helper via MAUDE_DEV_SERVER_BIN — see runBinDispatch + DDR-084.
+const BOOT_VERBS = new Set(['server-up', 'visual-sanity', 'smoke']);
+
 export async function run({ args, pkgRoot }) {
   const { positional } = parseArgs(args);
   const sub = positional[0];
@@ -90,9 +95,21 @@ function runBinDispatch(verb, { args, pkgRoot }) {
     process.exit(1);
   }
   const rest = args.slice(args.indexOf(verb) + 1); // everything after the verb token
+  const childEnv = { ...process.env, CLAUDE_PLUGIN_ROOT: pluginRoot };
+  // For verbs that boot the dev-server, resolve the compiled platform binary the
+  // SAME way `maude design serve` does and hand the path down. The binary embeds
+  // yjs + every runtime dep; `bun server.ts` from source does NOT (the deps live
+  // in a nested package.json the npm tarball excludes), so on a production install
+  // server.ts crashes at boot on `yjs`. server-up.sh prefers MAUDE_DEV_SERVER_BIN
+  // when set; absent ⇒ dev tree ⇒ it falls back to `bun server.ts`. Helpers that
+  // shell into server-up.sh (visual-sanity, smoke) inherit it. DDR-084.
+  if (BOOT_VERBS.has(verb) && !process.env.MAUDE_DEV_SERVER_BIN) {
+    const bin = resolveServerBinary({ pkgRoot });
+    if (bin) childEnv.MAUDE_DEV_SERVER_BIN = bin;
+  }
   const child = spawnSync('bash', [script, ...rest], {
     stdio: 'inherit',
-    env: { ...process.env, CLAUDE_PLUGIN_ROOT: pluginRoot },
+    env: childEnv,
   });
   if (child.error) {
     process.stderr.write(`maude design ${verb}: ${child.error.message}\n`);
@@ -295,6 +312,55 @@ function detectPlatformSlug() {
   return null;
 }
 
+// Read-only resolution of the compiled platform binary the dev-server should
+// boot as in a production install (it embeds yjs + every runtime dep). Mirrors
+// runServe's order — side-channel cache (postinstall) → lazy resolve of the
+// @1agh/maude-<slug> sibling/nested package — but performs NO caching and NEVER
+// hard-fails: returns the path, or null when none is found. A null result means
+// "fall back to `bun server.ts` from source" (correct in the local dev tree).
+// Honors MAUDE_FORCE_SOURCE=1 so maintainers hacking on the dev-server source
+// still boot their working copy. Used by runBinDispatch to hand the path to
+// server-up.sh; runServe keeps its own inline copy (it also caches + hard-fails).
+// Structural allowlist for a path we're about to spawn (DDR-084 hardening). The
+// compiled binary is ALWAYS named `maude` / `maude.exe` inside a `maude-<slug>/`
+// dir (the @1agh/maude-<slug> package, or the dev-tree `packages/maude-<slug>/`).
+// The side-channel file's content is the one attacker-influenceable input in a
+// shared-prefix / poisoned-clone layout — a path outside this shape is ignored
+// (caller falls back to source), so the file can only DENY the binary, never
+// redirect the spawn to an arbitrary executable. Paths `lazyResolveBinary`
+// constructs always conform, so this never rejects a legit resolve.
+export function isPlausiblePlatformBinary(p) {
+  if (!p) return false;
+  const b = basename(p);
+  if (b !== 'maude' && b !== 'maude.exe') return false;
+  return /^maude-[a-z0-9-]+$/.test(basename(dirname(p)));
+}
+
+export function resolveServerBinary({ pkgRoot }) {
+  if (process.env.MAUDE_FORCE_SOURCE === '1') return null;
+  // In the local source checkout, return null so server-up.sh boots
+  // `bun server.ts` from source — the maintainer is editing the dev-server and
+  // needs their working copy live, not a stale compiled binary that happens to
+  // be installed via pnpm. A production install has no `packages/` dir, so this
+  // never short-circuits there. (Preserves server-up's historic dev-tree
+  // behavior — it always ran source before DDR-084.)
+  if (isLocalDevTree(pkgRoot, { existsSync })) return null;
+  const sideChannel = resolve(pkgRoot, 'cli', '.platform-binary-path');
+  try {
+    if (existsSync(sideChannel)) {
+      const candidate = readFileSync(sideChannel, 'utf8').trim();
+      // Existence AND the structural allowlist — a poisoned side-channel pointing
+      // at an arbitrary executable is ignored (falls through to lazy resolve).
+      if (candidate && existsSync(candidate) && isPlausiblePlatformBinary(candidate)) {
+        return candidate;
+      }
+    }
+  } catch {
+    /* fall through to lazy resolve */
+  }
+  return lazyResolveBinary({ pkgRoot, fs: { existsSync, chmodSync } }).binPath;
+}
+
 function lazyResolveBinary({ pkgRoot, fs }) {
   const slug = detectPlatformSlug();
   if (!slug) return { binPath: null, slug: null };

package/cli/commands/design.test.mjs

@@ -8,11 +8,12 @@
 
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { test } from 'node:test';
 import { fileURLToPath } from 'node:url';
+import { isPlausiblePlatformBinary, resolveServerBinary } from './design.mjs';
 
 const BIN = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'maude.mjs');
 
@@ -54,3 +55,98 @@ test('design help lists the dev-tooling verbs', () => {
     assert.match(res.stdout, new RegExp(verb), `usage should mention ${verb}`);
   }
 });
+
+// resolveServerBinary — the dev-server boot-runtime resolver (DDR-084). server-up
+// must boot the compiled platform binary on a production install (it embeds yjs +
+// every dep; `bun server.ts` from source can't resolve them — the historic
+// yjs-at-boot crash), but keep using SOURCE in the local dev tree so a maintainer's
+// edits are live.
+function fakePkgRoot({ devTree = false, sideChannelBin = null } = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'maude-pkgroot-'));
+  if (devTree) {
+    mkdirSync(join(root, 'packages', 'maude-darwin-arm64'), { recursive: true });
+    writeFileSync(join(root, 'packages', 'maude-darwin-arm64', 'package.json'), '{}');
+  }
+  if (sideChannelBin) {
+    mkdirSync(join(root, 'cli'), { recursive: true });
+    writeFileSync(join(root, 'cli', '.platform-binary-path'), sideChannelBin);
+  }
+  return root;
+}
+
+test('resolveServerBinary → null in the local dev tree (packages/ present) — boots source', () => {
+  const root = fakePkgRoot({ devTree: true });
+  try {
+    delete process.env.MAUDE_FORCE_SOURCE;
+    assert.equal(resolveServerBinary({ pkgRoot: root }), null);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// Build an executable in a layout the allowlist accepts (`maude-<slug>/maude`)
+// or rejects (anything else), under a throwaway dir.
+function fakeBinary({ conforming = true } = {}) {
+  const home = mkdtempSync(join(tmpdir(), 'maude-bin-'));
+  const dir = join(home, conforming ? 'maude-darwin-arm64' : 'evil');
+  mkdirSync(dir, { recursive: true });
+  const bin = join(dir, 'maude');
+  writeFileSync(bin, '#!/bin/sh\n');
+  chmodSync(bin, 0o755);
+  return { home, bin };
+}
+
+test('resolveServerBinary → null when MAUDE_FORCE_SOURCE=1 (maintainer override)', () => {
+  const { home, bin } = fakeBinary();
+  const root = fakePkgRoot({ sideChannelBin: bin }); // NOT a dev tree
+  const prev = process.env.MAUDE_FORCE_SOURCE;
+  try {
+    process.env.MAUDE_FORCE_SOURCE = '1';
+    assert.equal(resolveServerBinary({ pkgRoot: root }), null);
+  } finally {
+    if (prev === undefined) delete process.env.MAUDE_FORCE_SOURCE;
+    else process.env.MAUDE_FORCE_SOURCE = prev;
+    rmSync(root, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('resolveServerBinary → side-channel path on a production install (no packages/)', () => {
+  const { home, bin } = fakeBinary(); // conforming maude-<slug>/maude layout
+  const root = fakePkgRoot({ sideChannelBin: bin }); // production shape
+  const prev = process.env.MAUDE_FORCE_SOURCE;
+  try {
+    delete process.env.MAUDE_FORCE_SOURCE;
+    assert.equal(resolveServerBinary({ pkgRoot: root }), bin);
+  } finally {
+    if (prev !== undefined) process.env.MAUDE_FORCE_SOURCE = prev;
+    rmSync(root, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('resolveServerBinary → REJECTS a side-channel pointing outside the maude-<slug>/ layout (DDR-084 allowlist)', () => {
+  const { home, bin } = fakeBinary({ conforming: false }); // <tmp>/evil/maude
+  const root = fakePkgRoot({ sideChannelBin: bin }); // production shape, no real platform pkg
+  const prev = process.env.MAUDE_FORCE_SOURCE;
+  try {
+    delete process.env.MAUDE_FORCE_SOURCE;
+    // Poisoned side-channel is ignored → falls through to lazyResolve, which finds
+    // nothing in the fake root → null (server-up then boots source, not the planted bin).
+    assert.equal(resolveServerBinary({ pkgRoot: root }), null);
+  } finally {
+    if (prev !== undefined) process.env.MAUDE_FORCE_SOURCE = prev;
+    rmSync(root, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('isPlausiblePlatformBinary — accepts maude-<slug>/maude, rejects everything else', () => {
+  assert.equal(isPlausiblePlatformBinary('/x/node_modules/@1agh/maude-darwin-arm64/maude'), true);
+  assert.equal(isPlausiblePlatformBinary('/x/packages/maude-linux-x64-musl/maude'), true);
+  assert.equal(isPlausiblePlatformBinary('/x/maude-win32-x64/maude.exe'), true);
+  assert.equal(isPlausiblePlatformBinary('/tmp/evil/maude'), false); // parent not maude-<slug>
+  assert.equal(isPlausiblePlatformBinary('/x/maude-darwin-arm64/evil'), false); // basename not maude
+  assert.equal(isPlausiblePlatformBinary(''), false);
+  assert.equal(isPlausiblePlatformBinary(null), false);
+});

package/cli/commands/doctor.mjs

@@ -1,6 +1,8 @@
 // `maude doctor` — unified workspace diagnostic.
 // Combines (1) plugin dependency preflight, (2) workflows.config.json schema
-// validation, (3) stack drift, (4) quality-gate additions into one report.
+// validation, (3) stack drift, (4) quality-gate additions, and (5) linked
+// design-hub / TSX-sync health (report-only, local signals — no network) into
+// one report.
 //
 // Flags:
 //   --plugin <name>   Scope deps section to one plugin. Config section is
@@ -23,6 +25,7 @@ import { stdin, stdout } from 'node:process';
 import { createInterface } from 'node:readline/promises';
 import { parseArgs } from '../lib/argv.mjs';
 import { lintConfig } from '../lib/config-lint.mjs';
+import { getHub } from '../lib/hubs-config.mjs';
 import { checkAll } from '../lib/preflight.mjs';
 import { detectQualityGates, detectStack } from '../lib/stack-detect.mjs';
 
@@ -115,6 +118,60 @@ export async function run({ args, pkgRoot }) {
     };
   }
 
+  // ── Design config: linked-hub + TSX-sync health (report-only) ────────────
+  // doctor's primary domain is .ai/workflows.config.json, but a linked design
+  // project's .design/config.json carries the one knob that has bitten users
+  // repeatedly — `linkedHub.syncTsx`. Surface it here so doctor is the one-stop
+  // health check. Report-only: under DDR-079 (default ON) every state is valid,
+  // so there is nothing to --fix and we NEVER impose an opt-out.
+  let designReport = { exists: false };
+  const designFsPath = resolve(repoRoot, '.design/config.json');
+  if (existsSync(designFsPath)) {
+    try {
+      const dcfg = JSON.parse(readFileSync(designFsPath, 'utf8'));
+      const linkedHub = dcfg.linkedHub;
+      if (!linkedHub) {
+        designReport = { exists: true, linked: false };
+      } else {
+        const syncTsx = linkedHub.syncTsx;
+        const tsxSync =
+          syncTsx === false
+            ? 'off (opted out)'
+            : syncTsx === true
+              ? 'on (explicit)'
+              : 'on (default)';
+        // Local-only signals — no network. `getHub` reads ~/.config/maude/
+        // hubs.json; the sync-agent state comes from the serve-written
+        // `_sync.json`. We deliberately DO NOT probe the hub's /health here:
+        // doctor must stay fast + offline (it runs in the release pre-flight),
+        // so live hub reachability stays in `maude design status`.
+        let tokenStored = false;
+        try {
+          tokenStored = !!getHub(linkedHub.url);
+        } catch {
+          /* hubs.json absent/unreadable on this machine → no token */
+        }
+        designReport = {
+          exists: true,
+          linked: true,
+          hubUrl: linkedHub.url,
+          adopt: !!linkedHub.adopt,
+          tsxSync,
+          tokenStored,
+          syncAgent: readSyncAgentState(resolve(repoRoot, '.design', '_sync.json')),
+          // DDR-079 migration advisory: a linked config with no explicit
+          // syncTsx rides the default, which flipped off→on in maude 0.27→0.28.
+          advisory:
+            syncTsx === undefined
+              ? 'TSX sync defaults ON (DDR-079) — every .tsx syncs to this hub. Opt out with linkedHub.syncTsx:false or `maude design link … --no-sync-tsx`.'
+              : null,
+        };
+      }
+    } catch (err) {
+      designReport = { exists: true, error: `invalid JSON: ${err.message}` };
+    }
+  }
+
   // ── Summary ─────────────────────────────────────────────────────────────
   const hardDepsMissing = Object.values(depsByPlugin)
     .filter((r) => r.summary)
@@ -132,12 +189,12 @@ export async function run({ args, pkgRoot }) {
 
   if (jsonMode) {
     process.stdout.write(
-      `${JSON.stringify({ deps: depsByPlugin, config: configReport, summary }, null, 2)}\n`
+      `${JSON.stringify({ deps: depsByPlugin, config: configReport, design: designReport, summary }, null, 2)}\n`
     );
     process.exit(summary.healthy ? 0 : 1);
   }
 
-  printReport({ depsByPlugin, configReport, summary });
+  printReport({ depsByPlugin, configReport, designReport, summary });
 
   // ── Fix path ────────────────────────────────────────────────────────────
   if (fix) {
@@ -151,11 +208,33 @@ export async function run({ args, pkgRoot }) {
   process.exit(summary.healthy ? 0 : 1);
 }
 
+// Read the serve-written `.design/_sync.json` and condense it to one line.
+// Local file only — never network. Returns null when the agent hasn't run.
+function readSyncAgentState(p) {
+  if (!existsSync(p)) return null;
+  try {
+    const s = JSON.parse(readFileSync(p, 'utf8'));
+    if (s.notSyncable) return `0 syncable — ${s.reason || 'see `maude design status`'}`;
+    if (s.state) {
+      const bits = [String(s.state), `${s.canvases ?? 0} canvas(es)`];
+      if (s.queuedOps) bits.push(`${s.queuedOps} queued`);
+      if (s.conflicts?.length) bits.push(`${s.conflicts.length} conflict notice(s)`);
+      return bits.join(', ');
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 function usage() {
   return `maude doctor [--plugin <name>] [--fix] [--json]
 
   Unified workspace diagnostic. Reports missing dependencies, config schema
-  errors, stack drift, and missing quality-gate declarations in one shot.
+  errors, stack drift, missing quality-gate declarations, and — when a
+  .design/config.json is linked — design-hub + TSX-sync health, in one shot.
+  (The design section is report-only and local; live hub reachability is
+  \`maude design status\`.)
 
   Flags:
     --plugin <name>   Scope dependency section to one plugin (design | flow).
@@ -170,7 +249,7 @@ function usage() {
 `;
 }
 
-function printReport({ depsByPlugin, configReport, summary }) {
+function printReport({ depsByPlugin, configReport, designReport, summary }) {
   process.stdout.write('maude doctor\n\n');
   for (const [name, env] of Object.entries(depsByPlugin)) {
     process.stdout.write(`  Dependencies (plugins/${name}):\n`);
@@ -235,6 +314,32 @@ function printReport({ depsByPlugin, configReport, summary }) {
     }
   }
 
+  // Design / linked-hub health — report-only, local signals only (no network).
+  if (designReport?.exists) {
+    process.stdout.write('  Design hub (.design/config.json):\n');
+    if (designReport.error) {
+      process.stdout.write(`    ✗ ${designReport.error}\n`);
+    } else if (!designReport.linked) {
+      process.stdout.write('    solo — not linked to a hub.\n');
+    } else {
+      process.stdout.write(`    ✓ linked: ${designReport.hubUrl}\n`);
+      process.stdout.write(
+        `      token stored: ${designReport.tokenStored ? 'yes' : 'NO — run `maude design link`'}\n`
+      );
+      process.stdout.write(`      TSX sync:     ${designReport.tsxSync}\n`);
+      if (designReport.adopt)
+        process.stdout.write('      adopt mode:   yes (push-on-first-sync)\n');
+      process.stdout.write(
+        `      sync agent:   ${designReport.syncAgent || 'idle (start `maude design serve`)'}\n`
+      );
+      if (designReport.advisory) process.stdout.write(`    ℹ  ${designReport.advisory}\n`);
+      process.stdout.write(
+        '    (live hub reachability + full sync detail: `maude design status`)\n'
+      );
+    }
+    process.stdout.write('\n');
+  }
+
   const parts = [];
   if (summary.hardDepsMissing) parts.push(`${summary.hardDepsMissing} hard dep missing`);
   if (summary.schemaErrors)

package/cli/commands/doctor.test.mjs

@@ -183,3 +183,55 @@ test('summary line reflects counts (drift/additions tracked via package.json)',
   const lintAdd = env.config.qualityAdditions.find((a) => a.gate === 'lint');
   assert.ok(lintAdd);
 });
+
+// ── DDR-079: design-hub / TSX-sync section (report-only, local) ──────────────
+function writeDesign(root, linkedHub) {
+  mkdirSync(join(root, '.design'), { recursive: true });
+  writeFileSync(
+    join(root, '.design/config.json'),
+    JSON.stringify({ name: 't', designRoot: '.design', ...(linkedHub ? { linkedHub } : {}) })
+  );
+}
+
+test('DDR-079: linked design config with no syncTsx → on (default) + advisory', () => {
+  const root = makeTempRepo();
+  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify({ name: 'x' })}\n`);
+  writeDesign(root, { url: 'https://hub.example.com', linkedAt: 1 });
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.linked, true);
+  assert.equal(env.design.hubUrl, 'https://hub.example.com');
+  assert.equal(env.design.tsxSync, 'on (default)');
+  assert.match(env.design.advisory, /defaults ON/);
+});
+
+test('DDR-079: syncTsx:false → off (opted out), no advisory', () => {
+  const root = makeTempRepo();
+  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify({ name: 'x' })}\n`);
+  writeDesign(root, { url: 'https://hub.example.com', linkedAt: 1, syncTsx: false });
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.tsxSync, 'off (opted out)');
+  assert.equal(env.design.advisory, null);
+});
+
+test('DDR-079: syncTsx:true → on (explicit), no advisory', () => {
+  const root = makeTempRepo();
+  writeFileSync(join(root, '.ai/workflows.config.json'), `${JSON.stringify({ name: 'x' })}\n`);
+  writeDesign(root, { url: 'https://hub.example.com', linkedAt: 1, syncTsx: true });
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.tsxSync, 'on (explicit)');
+  assert.equal(env.design.advisory, null);
+});
+
+test('design section reports solo when .design/config.json has no linkedHub', () => {
+  const root = makeTempRepo();
+  writeDesign(root, null);
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.exists, true);
+  assert.equal(env.design.linked, false);
+});
+
+test('design section absent when no .design/config.json', () => {
+  const root = makeTempRepo();
+  const env = JSON.parse(spawnDoctor(['--json'], root).stdout);
+  assert.equal(env.design.exists, false);
+});

package/cli/lib/cache.mjs

@@ -49,8 +49,8 @@ import { spawnSync } from 'node:child_process';
 import {
   existsSync,
   mkdirSync,
-  readFileSync,
   readdirSync,
+  readFileSync,
   renameSync,
   rmSync,
   statSync,

package/cli/lib/config-lint.mjs

@@ -16,8 +16,8 @@
 
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
-import addFormats from 'ajv-formats';
 import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
 
 function levenshtein(a, b) {
   if (a === b) return 0;

package/cli/lib/copy-tree.mjs

@@ -1,4 +1,4 @@
-import { copyFile, mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { copyFile, mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { basename, join, relative } from 'node:path';
 
 // Recursively copy `src` → `dest`. Returns { created, skipped, replaced }.

package/cli/lib/design-link.mjs

@@ -10,7 +10,7 @@
 //
 // Token NEVER lands in .design/config.json — that's git-committed.
 
-import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 
@@ -25,7 +25,9 @@ const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
 
 export async function runLink({ args, cwd = process.cwd(), forceAdopt = false }) {
   const tail = args.slice(args.indexOf(forceAdopt ? 'adopt' : 'link') + 1);
-  const { flags, positional } = parseArgs(tail, { booleans: ['adopt', 'force', 'yes'] });
+  const { flags, positional } = parseArgs(tail, {
+    booleans: ['adopt', 'force', 'yes', 'sync-tsx', 'no-sync-tsx'],
+  });
   const url = positional[0];
   const token = flags.token;
 
@@ -116,15 +118,27 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
       `[design link] note: replacing existing link to ${existing.url} (was added ${new Date(existing.linkedAt).toISOString()}).\n`
     );
   }
-  // DDR-072 — preserve the project-level TSX opt-in only when re-linking to the
-  // SAME hub. Changing the hub URL drops it: a new hub is a fresh trust decision
-  // and must not silently inherit "sync all my TSX" (the DDR-054 F2 lesson).
-  const keepSyncTsx = existing?.syncTsx === true && existing.url === normUrl;
+  // DDR-079 — TSX sync defaults ON, so we only PERSIST `syncTsx` when it's an
+  // explicit choice; absence means "the default", and we never write
+  // `syncTsx: true` just to encode the default (that's what bit us — a value
+  // that git-restore could wipe to silently flip behavior). Precedence:
+  //   --no-sync-tsx → false (project-wide opt-out)
+  //   --sync-tsx    → true  (explicit, == default; useful to pin against a future
+  //                          default change or to self-document)
+  //   else, re-link to the SAME hub → carry the existing explicit value forward
+  //         (a NEW hub URL is a fresh trust decision — don't inherit, DDR-054 F2)
+  //   else          → omit (= on by default)
+  let syncTsx;
+  if (flags['no-sync-tsx']) syncTsx = false;
+  else if (flags['sync-tsx']) syncTsx = true;
+  else if (existing && existing.url === normUrl && typeof existing.syncTsx === 'boolean') {
+    syncTsx = existing.syncTsx;
+  }
   cfg.linkedHub = {
     url: normUrl,
     linkedAt: hubRecord.linkedAt,
     ...(adopt ? { adopt: true } : {}),
-    ...(keepSyncTsx ? { syncTsx: true } : {}),
+    ...(syncTsx !== undefined ? { syncTsx } : {}),
   };
   writeDesignConfig(designConfigPath, cfg);
 
@@ -140,8 +154,12 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
     await maybeWriteGitignoreBlock(cwd, !!flags.yes);
   }
 
+  const tsxSyncLine =
+    syncTsx === false
+      ? 'off (opted out — linkedHub.syncTsx: false)'
+      : 'on by default (DDR-079) — every .tsx body syncs; opt out with --no-sync-tsx or a canvas .meta.json "syncable": false';
   process.stdout.write(
-    `[design link] linked ${cwd} to ${normUrl}.\n  token:   stored in ~/.config/maude/hubs.json (per-machine, never committed)\n  config:  .design/config.json.linkedHub = { url, linkedAt${adopt ? ', adopt: true' : ''} }\n  hub:     ${probe.ok ? `v${probe.version}, uptime ${Math.round((probe.uptimeMs ?? 0) / 1000)}s, ${probe.tokenCount} token(s) (${probe.authMode})` : 'NOT REACHED — linked anyway (--force)'}\n\nNext step: start 'maude design serve' — the linked sync agent ${adopt ? 'will push local state up to the hub on first connect' : 'will mirror hub state to disk on first connect'}.\n`
+    `[design link] linked ${cwd} to ${normUrl}.\n  token:    stored in ~/.config/maude/hubs.json (per-machine, never committed)\n  config:   .design/config.json.linkedHub = { url, linkedAt${adopt ? ', adopt: true' : ''}${syncTsx !== undefined ? `, syncTsx: ${syncTsx}` : ''} }\n  TSX sync: ${tsxSyncLine}\n  hub:      ${probe.ok ? `v${probe.version}, uptime ${Math.round((probe.uptimeMs ?? 0) / 1000)}s, ${probe.tokenCount} token(s) (${probe.authMode})` : 'NOT REACHED — linked anyway (--force)'}\n\nNext step: start 'maude design serve' — the linked sync agent ${adopt ? 'will push local state up to the hub on first connect' : 'will mirror hub state to disk on first connect'}.\n`
   );
   if (!loopback) process.stderr.write(linkedModeBanner());
 }
@@ -220,6 +238,9 @@ export async function runStatus({ args, cwd = process.cwd() }) {
     url,
     linkedAt: cfg.linkedHub.linkedAt,
     adopt: !!cfg.linkedHub.adopt,
+    // DDR-079 — effective TSX-sync state: on unless explicitly opted out.
+    syncTsx: cfg.linkedHub.syncTsx !== false,
+    syncTsxExplicit: typeof cfg.linkedHub.syncTsx === 'boolean' ? cfg.linkedHub.syncTsx : null,
     tokenStored: !!hubRecord,
     hub: probe.ok
       ? {
@@ -249,8 +270,17 @@ export async function runStatus({ args, cwd = process.cwd() }) {
         }${sync.conflicts?.length ? `, ${sync.conflicts.length} conflict notice(s)` : ''}`
       : 'idle (start `maude design serve` in linked mode)';
   process.stdout.write(
-    `Maude design — linked mode\n  hub URL:      ${url}\n  linked at:    ${new Date(cfg.linkedHub.linkedAt).toISOString()}\n  adopt mode:   ${cfg.linkedHub.adopt ? 'yes (push-on-first-sync)' : 'no (hub-wins)'}\n  token stored: ${hubRecord ? 'yes (~/.config/maude/hubs.json)' : "NO — re-run 'maude design link'"}\n  hub status:   ${probe.ok ? `up — v${probe.version}, ${uptimeS}s uptime, ${probe.tokenCount} token(s), ${probe.authMode}` : `UNREACHABLE — ${probe.error}`}\n  sync agent:   ${syncLine}\n`
+    `Maude design — linked mode\n  hub URL:      ${url}\n  linked at:    ${new Date(cfg.linkedHub.linkedAt).toISOString()}\n  adopt mode:   ${cfg.linkedHub.adopt ? 'yes (push-on-first-sync)' : 'no (hub-wins)'}\n  TSX sync:     ${cfg.linkedHub.syncTsx === false ? 'off (opted out — linkedHub.syncTsx: false)' : 'on (default — DDR-079)'}\n  token stored: ${hubRecord ? 'yes (~/.config/maude/hubs.json)' : "NO — re-run 'maude design link'"}\n  hub status:   ${probe.ok ? `up — v${probe.version}, ${uptimeS}s uptime, ${probe.tokenCount} token(s), ${probe.authMode}` : `UNREACHABLE — ${probe.error}`}\n  sync agent:   ${syncLine}\n`
   );
+  // DDR-079 migration advisory: a config with no explicit `syncTsx` rides the
+  // default, which FLIPPED from off→on in maude 0.27. Surface it so an upgrader
+  // who relied on the old "TSX never syncs" behavior isn't surprised that every
+  // .tsx now goes to the hub.
+  if (cfg.linkedHub.syncTsx === undefined) {
+    process.stdout.write(
+      '\n  ℹ  syncTsx is not set, so it uses the DEFAULT — which is now ON (DDR-079, maude ≥ 0.27): every .tsx syncs to this hub.\n     Upgraded from an older maude and want the pre-0.27 behavior (no TSX sync)? Set  .design/config.json → linkedHub.syncTsx: false  (or  maude design link <url> --token … --no-sync-tsx).\n'
+    );
+  }
 }
 
 /**

package/cli/lib/flow-design-integration.test.mjs

@@ -19,8 +19,8 @@ import assert from 'node:assert/strict';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { test } from 'node:test';
-import addFormats from 'ajv-formats';
 import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
 import { lintConfig } from './config-lint.mjs';
 
 const read = (p) => readFileSync(resolve(p), 'utf8');

package/cli/lib/gitignore-block.test.mjs

@@ -7,10 +7,10 @@ import { join } from 'node:path';
 import { test } from 'node:test';
 
 import {
-  BEGIN_MARKER,
-  END_MARKER,
   applyBlock,
+  BEGIN_MARKER,
   buildBlock,
+  END_MARKER,
   hasBlock,
   writeGitignoreBlock,
 } from './gitignore-block.mjs';

package/cli/lib/stack-detect.mjs

@@ -10,7 +10,7 @@
 //
 // Consumers: cli/commands/doctor.mjs and the drift-aware /flow:init re-run.
 
-import { readFile, readdir, stat } from 'node:fs/promises';
+import { readdir, readFile, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 
 async function fileExists(path) {