@1agh/maude 0.28.0 → 0.28.1

package/cli/commands/design.mjs

@@ -1,6 +1,6 @@
 import { execSync, spawn, spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { chmodSync, existsSync, readFileSync } from 'node:fs';
+import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { basename, dirname, join, resolve } from 'node:path';
 import { parseArgs } from '../lib/argv.mjs';
@@ -42,6 +42,11 @@ const BIN_VERBS = new Set([
   'svg-optimize',
 ]);
 
+// Bin verbs that boot the dev-server (directly, or by shelling into server-up.sh).
+// For these we resolve the compiled platform binary and hand its path to the
+// helper via MAUDE_DEV_SERVER_BIN — see runBinDispatch + DDR-084.
+const BOOT_VERBS = new Set(['server-up', 'visual-sanity', 'smoke']);
+
 export async function run({ args, pkgRoot }) {
   const { positional } = parseArgs(args);
   const sub = positional[0];
@@ -90,9 +95,21 @@ function runBinDispatch(verb, { args, pkgRoot }) {
     process.exit(1);
   }
   const rest = args.slice(args.indexOf(verb) + 1); // everything after the verb token
+  const childEnv = { ...process.env, CLAUDE_PLUGIN_ROOT: pluginRoot };
+  // For verbs that boot the dev-server, resolve the compiled platform binary the
+  // SAME way `maude design serve` does and hand the path down. The binary embeds
+  // yjs + every runtime dep; `bun server.ts` from source does NOT (the deps live
+  // in a nested package.json the npm tarball excludes), so on a production install
+  // server.ts crashes at boot on `yjs`. server-up.sh prefers MAUDE_DEV_SERVER_BIN
+  // when set; absent ⇒ dev tree ⇒ it falls back to `bun server.ts`. Helpers that
+  // shell into server-up.sh (visual-sanity, smoke) inherit it. DDR-084.
+  if (BOOT_VERBS.has(verb) && !process.env.MAUDE_DEV_SERVER_BIN) {
+    const bin = resolveServerBinary({ pkgRoot });
+    if (bin) childEnv.MAUDE_DEV_SERVER_BIN = bin;
+  }
   const child = spawnSync('bash', [script, ...rest], {
     stdio: 'inherit',
-    env: { ...process.env, CLAUDE_PLUGIN_ROOT: pluginRoot },
+    env: childEnv,
   });
   if (child.error) {
     process.stderr.write(`maude design ${verb}: ${child.error.message}\n`);
@@ -295,6 +312,55 @@ function detectPlatformSlug() {
   return null;
 }
 
+// Read-only resolution of the compiled platform binary the dev-server should
+// boot as in a production install (it embeds yjs + every runtime dep). Mirrors
+// runServe's order — side-channel cache (postinstall) → lazy resolve of the
+// @1agh/maude-<slug> sibling/nested package — but performs NO caching and NEVER
+// hard-fails: returns the path, or null when none is found. A null result means
+// "fall back to `bun server.ts` from source" (correct in the local dev tree).
+// Honors MAUDE_FORCE_SOURCE=1 so maintainers hacking on the dev-server source
+// still boot their working copy. Used by runBinDispatch to hand the path to
+// server-up.sh; runServe keeps its own inline copy (it also caches + hard-fails).
+// Structural allowlist for a path we're about to spawn (DDR-084 hardening). The
+// compiled binary is ALWAYS named `maude` / `maude.exe` inside a `maude-<slug>/`
+// dir (the @1agh/maude-<slug> package, or the dev-tree `packages/maude-<slug>/`).
+// The side-channel file's content is the one attacker-influenceable input in a
+// shared-prefix / poisoned-clone layout — a path outside this shape is ignored
+// (caller falls back to source), so the file can only DENY the binary, never
+// redirect the spawn to an arbitrary executable. Paths `lazyResolveBinary`
+// constructs always conform, so this never rejects a legit resolve.
+export function isPlausiblePlatformBinary(p) {
+  if (!p) return false;
+  const b = basename(p);
+  if (b !== 'maude' && b !== 'maude.exe') return false;
+  return /^maude-[a-z0-9-]+$/.test(basename(dirname(p)));
+}
+
+export function resolveServerBinary({ pkgRoot }) {
+  if (process.env.MAUDE_FORCE_SOURCE === '1') return null;
+  // In the local source checkout, return null so server-up.sh boots
+  // `bun server.ts` from source — the maintainer is editing the dev-server and
+  // needs their working copy live, not a stale compiled binary that happens to
+  // be installed via pnpm. A production install has no `packages/` dir, so this
+  // never short-circuits there. (Preserves server-up's historic dev-tree
+  // behavior — it always ran source before DDR-084.)
+  if (isLocalDevTree(pkgRoot, { existsSync })) return null;
+  const sideChannel = resolve(pkgRoot, 'cli', '.platform-binary-path');
+  try {
+    if (existsSync(sideChannel)) {
+      const candidate = readFileSync(sideChannel, 'utf8').trim();
+      // Existence AND the structural allowlist — a poisoned side-channel pointing
+      // at an arbitrary executable is ignored (falls through to lazy resolve).
+      if (candidate && existsSync(candidate) && isPlausiblePlatformBinary(candidate)) {
+        return candidate;
+      }
+    }
+  } catch {
+    /* fall through to lazy resolve */
+  }
+  return lazyResolveBinary({ pkgRoot, fs: { existsSync, chmodSync } }).binPath;
+}
+
 function lazyResolveBinary({ pkgRoot, fs }) {
   const slug = detectPlatformSlug();
   if (!slug) return { binPath: null, slug: null };

package/cli/commands/design.test.mjs

@@ -8,11 +8,12 @@
 
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { mkdtempSync, rmSync } from 'node:fs';
+import { chmodSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { test } from 'node:test';
 import { fileURLToPath } from 'node:url';
+import { isPlausiblePlatformBinary, resolveServerBinary } from './design.mjs';
 
 const BIN = resolve(dirname(fileURLToPath(import.meta.url)), '..', 'bin', 'maude.mjs');
 
@@ -54,3 +55,98 @@ test('design help lists the dev-tooling verbs', () => {
     assert.match(res.stdout, new RegExp(verb), `usage should mention ${verb}`);
   }
 });
+
+// resolveServerBinary — the dev-server boot-runtime resolver (DDR-084). server-up
+// must boot the compiled platform binary on a production install (it embeds yjs +
+// every dep; `bun server.ts` from source can't resolve them — the historic
+// yjs-at-boot crash), but keep using SOURCE in the local dev tree so a maintainer's
+// edits are live.
+function fakePkgRoot({ devTree = false, sideChannelBin = null } = {}) {
+  const root = mkdtempSync(join(tmpdir(), 'maude-pkgroot-'));
+  if (devTree) {
+    mkdirSync(join(root, 'packages', 'maude-darwin-arm64'), { recursive: true });
+    writeFileSync(join(root, 'packages', 'maude-darwin-arm64', 'package.json'), '{}');
+  }
+  if (sideChannelBin) {
+    mkdirSync(join(root, 'cli'), { recursive: true });
+    writeFileSync(join(root, 'cli', '.platform-binary-path'), sideChannelBin);
+  }
+  return root;
+}
+
+test('resolveServerBinary → null in the local dev tree (packages/ present) — boots source', () => {
+  const root = fakePkgRoot({ devTree: true });
+  try {
+    delete process.env.MAUDE_FORCE_SOURCE;
+    assert.equal(resolveServerBinary({ pkgRoot: root }), null);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+// Build an executable in a layout the allowlist accepts (`maude-<slug>/maude`)
+// or rejects (anything else), under a throwaway dir.
+function fakeBinary({ conforming = true } = {}) {
+  const home = mkdtempSync(join(tmpdir(), 'maude-bin-'));
+  const dir = join(home, conforming ? 'maude-darwin-arm64' : 'evil');
+  mkdirSync(dir, { recursive: true });
+  const bin = join(dir, 'maude');
+  writeFileSync(bin, '#!/bin/sh\n');
+  chmodSync(bin, 0o755);
+  return { home, bin };
+}
+
+test('resolveServerBinary → null when MAUDE_FORCE_SOURCE=1 (maintainer override)', () => {
+  const { home, bin } = fakeBinary();
+  const root = fakePkgRoot({ sideChannelBin: bin }); // NOT a dev tree
+  const prev = process.env.MAUDE_FORCE_SOURCE;
+  try {
+    process.env.MAUDE_FORCE_SOURCE = '1';
+    assert.equal(resolveServerBinary({ pkgRoot: root }), null);
+  } finally {
+    if (prev === undefined) delete process.env.MAUDE_FORCE_SOURCE;
+    else process.env.MAUDE_FORCE_SOURCE = prev;
+    rmSync(root, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('resolveServerBinary → side-channel path on a production install (no packages/)', () => {
+  const { home, bin } = fakeBinary(); // conforming maude-<slug>/maude layout
+  const root = fakePkgRoot({ sideChannelBin: bin }); // production shape
+  const prev = process.env.MAUDE_FORCE_SOURCE;
+  try {
+    delete process.env.MAUDE_FORCE_SOURCE;
+    assert.equal(resolveServerBinary({ pkgRoot: root }), bin);
+  } finally {
+    if (prev !== undefined) process.env.MAUDE_FORCE_SOURCE = prev;
+    rmSync(root, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('resolveServerBinary → REJECTS a side-channel pointing outside the maude-<slug>/ layout (DDR-084 allowlist)', () => {
+  const { home, bin } = fakeBinary({ conforming: false }); // <tmp>/evil/maude
+  const root = fakePkgRoot({ sideChannelBin: bin }); // production shape, no real platform pkg
+  const prev = process.env.MAUDE_FORCE_SOURCE;
+  try {
+    delete process.env.MAUDE_FORCE_SOURCE;
+    // Poisoned side-channel is ignored → falls through to lazyResolve, which finds
+    // nothing in the fake root → null (server-up then boots source, not the planted bin).
+    assert.equal(resolveServerBinary({ pkgRoot: root }), null);
+  } finally {
+    if (prev !== undefined) process.env.MAUDE_FORCE_SOURCE = prev;
+    rmSync(root, { recursive: true, force: true });
+    rmSync(home, { recursive: true, force: true });
+  }
+});
+
+test('isPlausiblePlatformBinary — accepts maude-<slug>/maude, rejects everything else', () => {
+  assert.equal(isPlausiblePlatformBinary('/x/node_modules/@1agh/maude-darwin-arm64/maude'), true);
+  assert.equal(isPlausiblePlatformBinary('/x/packages/maude-linux-x64-musl/maude'), true);
+  assert.equal(isPlausiblePlatformBinary('/x/maude-win32-x64/maude.exe'), true);
+  assert.equal(isPlausiblePlatformBinary('/tmp/evil/maude'), false); // parent not maude-<slug>
+  assert.equal(isPlausiblePlatformBinary('/x/maude-darwin-arm64/evil'), false); // basename not maude
+  assert.equal(isPlausiblePlatformBinary(''), false);
+  assert.equal(isPlausiblePlatformBinary(null), false);
+});

package/cli/lib/cache.mjs

@@ -49,8 +49,8 @@ import { spawnSync } from 'node:child_process';
 import {
   existsSync,
   mkdirSync,
-  readFileSync,
   readdirSync,
+  readFileSync,
   renameSync,
   rmSync,
   statSync,

package/cli/lib/config-lint.mjs

@@ -16,8 +16,8 @@
 
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
-import addFormats from 'ajv-formats';
 import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
 
 function levenshtein(a, b) {
   if (a === b) return 0;

package/cli/lib/copy-tree.mjs

@@ -1,4 +1,4 @@
-import { copyFile, mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { copyFile, mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises';
 import { basename, join, relative } from 'node:path';
 
 // Recursively copy `src` → `dest`. Returns { created, skipped, replaced }.

package/cli/lib/design-link.mjs

@@ -10,7 +10,7 @@
 //
 // Token NEVER lands in .design/config.json — that's git-committed.
 
-import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 

package/cli/lib/flow-design-integration.test.mjs

@@ -19,8 +19,8 @@ import assert from 'node:assert/strict';
 import { readFileSync } from 'node:fs';
 import { resolve } from 'node:path';
 import { test } from 'node:test';
-import addFormats from 'ajv-formats';
 import Ajv2020 from 'ajv/dist/2020.js';
+import addFormats from 'ajv-formats';
 import { lintConfig } from './config-lint.mjs';
 
 const read = (p) => readFileSync(resolve(p), 'utf8');

package/cli/lib/gitignore-block.test.mjs

@@ -7,10 +7,10 @@ import { join } from 'node:path';
 import { test } from 'node:test';
 
 import {
-  BEGIN_MARKER,
-  END_MARKER,
   applyBlock,
+  BEGIN_MARKER,
   buildBlock,
+  END_MARKER,
   hasBlock,
   writeGitignoreBlock,
 } from './gitignore-block.mjs';

package/cli/lib/stack-detect.mjs

@@ -10,7 +10,7 @@
 //
 // Consumers: cli/commands/doctor.mjs and the drift-aware /flow:init re-run.
 
-import { readFile, readdir, stat } from 'node:fs/promises';
+import { readdir, readFile, stat } from 'node:fs/promises';
 import { join } from 'node:path';
 
 async function fileExists(path) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -41,13 +41,13 @@
     "prepublishOnly": "bash scripts/check-version-parity.sh && bash plugins/design/dev-server/bin/check-runtime-bundles.sh"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.28.0",
-    "@1agh/maude-darwin-x64": "0.28.0",
-    "@1agh/maude-linux-arm64": "0.28.0",
-    "@1agh/maude-linux-arm64-musl": "0.28.0",
-    "@1agh/maude-linux-x64": "0.28.0",
-    "@1agh/maude-linux-x64-musl": "0.28.0",
-    "@1agh/maude-win32-x64": "0.28.0"
+    "@1agh/maude-darwin-arm64": "0.28.1",
+    "@1agh/maude-darwin-x64": "0.28.1",
+    "@1agh/maude-linux-arm64": "0.28.1",
+    "@1agh/maude-linux-arm64-musl": "0.28.1",
+    "@1agh/maude-linux-x64": "0.28.1",
+    "@1agh/maude-linux-x64-musl": "0.28.1",
+    "@1agh/maude-win32-x64": "0.28.1"
   },
   "files": [
     "cli",
@@ -85,7 +85,7 @@
     "scaffold"
   ],
   "devDependencies": {
-    "@biomejs/biome": "^1.9.4",
+    "@biomejs/biome": "^2.4.16",
     "@changesets/cli": "^2.27.10",
     "@playwright/test": "^1.60.0"
   },

package/plugins/design/dev-server/annotations-context-toolbar.tsx

@@ -36,12 +36,12 @@ import {
   IconAlignCenter,
   IconAlignLeft,
   IconAlignRight,
-  IconArrowNone,
   IconArrowheadCircle,
   IconArrowheadDiamond,
   IconArrowheadLine,
   IconArrowheadTriangle,
   IconArrowheadTriangleOutline,
+  IconArrowNone,
   IconBold,
   IconChevronDown,
   IconCornerPill,

package/plugins/design/dev-server/annotations-layer.tsx

@@ -23,8 +23,8 @@
 
 import {
   type CSSProperties,
-  type PointerEvent as ReactPointerEvent,
   createContext,
+  type PointerEvent as ReactPointerEvent,
   useCallback,
   useContext,
   useEffect,
@@ -39,13 +39,13 @@ import {
   ARROW_HEADS,
   type ArrowHead,
   type ArrowLineType,
-  type SvgPrimitive,
   arrowPrimitives,
+  type SvgPrimitive,
 } from './canvas-arrowheads.ts';
 import { IconLineThick, IconLineThin } from './canvas-icons.tsx';
 import { useViewportControllerContext, useWorldRefContext } from './canvas-lib.tsx';
 import { buildAnnotationStrokesRecord } from './commands/annotation-strokes-command.ts';
-import { type Tool, crossedDragThreshold } from './input-router.tsx';
+import { crossedDragThreshold, type Tool } from './input-router.tsx';
 import { AnnotationResizeOverlay } from './use-annotation-resize.tsx';
 import { useAnnotationSelectionOptional } from './use-annotation-selection.tsx';
 import { useAnnotationsVisibility } from './use-annotations-visibility.tsx';

package/plugins/design/dev-server/api.ts

@@ -3,7 +3,7 @@
 
 import crypto from 'node:crypto';
 import type { Dirent } from 'node:fs';
-import { readFile, readdir, stat as statp } from 'node:fs/promises';
+import { readdir, readFile, stat as statp } from 'node:fs/promises';
 import path from 'node:path';
 
 import type { Context } from './context.ts';

package/plugins/design/dev-server/bin/scenario-report.mjs

@@ -21,7 +21,7 @@
 //
 // Output: <run-dir>/report.md (or --out), zero external dependencies (node:fs only).
 
-import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
 import { basename, join } from 'node:path';
 
 const PLATFORM_ORDER = ['web-desktop', 'web-mobile', 'ios-phone', 'ios-tablet', 'android-phone'];

package/plugins/design/dev-server/bin/server-up.sh

@@ -9,13 +9,17 @@
 #   $DESIGN_ROOT/_server.json   (PID + port the running server wrote)
 #   $DESIGN_ROOT/_server.log    (stdout/stderr of the spawned server)
 #
-# Runtime selection (DDR-020):
-#   - Default: bun + server.ts. Hard-fails when bun is not on $PATH.
-#   - --allow-legacy: opt-in fallback to node + server.mjs (debug only;
-#     no TSX canvas pipeline, no HMR). Sunset in DDR-020 Phase B.
+# Runtime selection (DDR-020 / DDR-009 / DDR-084), in priority order:
+#   - --allow-legacy: opt-in node + server.mjs (debug only; no TSX pipeline, no HMR).
+#   - compiled platform binary: the PRODUCTION runtime — embeds yjs + every dep, so
+#     it boots on a global @1agh/maude install where `bun server.ts` from source
+#     cannot. Path comes from MAUDE_DEV_SERVER_BIN (set by `maude design <verb>`) or
+#     the postinstall side-channel <pkgRoot>/cli/.platform-binary-path.
+#   - bun + server.ts: dev tree / fallback. MAUDE_FORCE_SOURCE=1 forces this.
 #
 # Output: prints the port on stdout. Diagnostic lines go to stderr.
-# Exit:   0 = server ready / 1 = start timeout or missing runtime / 2 = bad args.
+# Exit:   0 = server ready / 1 = start timeout or missing runtime / 2 = bad args /
+#         3 = dev-server runtime deps missing (yjs/y-protocols/lib0 — see preflight).
 
 REPO=""
 TIMEOUT=10
@@ -41,9 +45,15 @@ if [ -z "$REPO" ]; then
   REPO="${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"
 fi
 
-# Resolve plugin root + pick a server runtime. DDR-020: bun + server.ts is
-# authoritative. Legacy node + server.mjs is sunset; available only behind
-# --allow-legacy (debug-only — no TSX canvas pipeline, no HMR).
+# Resolve plugin root + pick a server runtime.
+#   --allow-legacy → node + server.mjs (debug-only — no TSX pipeline, no HMR).
+#   compiled platform binary → the PRODUCTION runtime (DDR-009/DDR-084). It embeds
+#     yjs + every dev-server dep, so it boots on a global `@1agh/maude` install
+#     where `bun server.ts` from source CANNOT (the deps live in a nested
+#     package.json the npm tarball excludes — the historic yjs-at-boot crash).
+#     `maude design <verb>` resolves it and passes MAUDE_DEV_SERVER_BIN; a direct
+#     `bash server-up.sh` falls back to the postinstall side-channel.
+#   bun + server.ts → dev tree / fallback (DDR-020 made bun authoritative for source).
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
 SERVER_TS="$PLUGIN_ROOT/dev-server/server.ts"
@@ -51,6 +61,37 @@ SERVER_MJS="$PLUGIN_ROOT/dev-server/server.mjs"
 if [ ! -f "$SERVER_TS" ]; then SERVER_TS="$SCRIPT_DIR/../server.ts"; fi
 if [ ! -f "$SERVER_MJS" ]; then SERVER_MJS="$SCRIPT_DIR/../server.mjs"; fi
 
+# Resolve the compiled binary: env (set by `maude design <verb>`) wins; else the
+# postinstall side-channel at <pkgRoot>/cli/.platform-binary-path (covers a direct
+# `bash server-up.sh` on a production install). MAUDE_FORCE_SOURCE=1 forces source.
+SERVER_BIN="${MAUDE_DEV_SERVER_BIN:-}"
+if [ -z "$SERVER_BIN" ] && [ "${MAUDE_FORCE_SOURCE:-0}" != "1" ]; then
+  # PLUGIN_ROOT=<pkgRoot>/plugins/design, so the side-channel is ../../cli.
+  # `head -n1` (parity with the Node readers' `.trim()`) tolerates a trailing newline.
+  SC="$PLUGIN_ROOT/../../cli/.platform-binary-path"
+  if [ -f "$SC" ]; then
+    CAND="$(head -n1 "$SC" 2>/dev/null)"
+    [ -n "$CAND" ] && [ -x "$CAND" ] && SERVER_BIN="$CAND"
+  fi
+fi
+# Structural allowlist (DDR-084 hardening): only spawn a path that LOOKS like the
+# compiled platform binary — basename `maude`/`maude.exe` inside a `maude-<slug>/`
+# dir. A poisoned side-channel file or an injected MAUDE_DEV_SERVER_BIN pointing
+# elsewhere is ignored (fall back to source), so the env/file can only DENY the
+# binary, never redirect the spawn to an arbitrary executable. Mirrors
+# isPlausiblePlatformBinary() in cli/commands/design.mjs.
+if [ -n "$SERVER_BIN" ]; then
+  _sbase="$(basename "$SERVER_BIN")"
+  _sparent="$(basename "$(dirname "$SERVER_BIN")")"
+  case "$_sbase:$_sparent" in
+    maude:maude-* | maude.exe:maude-*) : ;;
+    *)
+      echo "server-up.sh: ignoring dev-server binary outside the expected maude-<slug>/ layout ($SERVER_BIN) — falling back to source" >&2
+      SERVER_BIN=""
+      ;;
+  esac
+fi
+
 RUNTIME=""
 RUNTIME_CMD=""
 if [ $ALLOW_LEGACY -eq 1 ]; then
@@ -61,6 +102,10 @@ if [ $ALLOW_LEGACY -eq 1 ]; then
   RUNTIME="node"
   RUNTIME_CMD="node $SERVER_MJS"
   echo "server-up.sh: WARNING — running legacy server.mjs (no TSX canvas pipeline, no HMR). DDR-020 sunsets this in Phase B." >&2
+elif [ -n "$SERVER_BIN" ] && [ -x "$SERVER_BIN" ] && [ "${MAUDE_FORCE_SOURCE:-0}" != "1" ]; then
+  RUNTIME="binary"
+  RUNTIME_CMD="$SERVER_BIN"
+  echo "server-up.sh: using compiled dev-server binary ($SERVER_BIN)" >&2
 elif command -v bun >/dev/null 2>&1 && [ -f "$SERVER_TS" ]; then
   RUNTIME="bun"
   RUNTIME_CMD="bun $SERVER_TS"
@@ -106,10 +151,58 @@ if [ -f "$STATE" ]; then
   fi
 fi
 
+# Step 1.5 — dependency preflight (source `bun server.ts` path ONLY; runs on cold
+# start). The compiled binary embeds its deps, so this is skipped when RUNTIME=binary
+# — it only guards the source fallback. The dev-server's runtime deps live in a
+# NESTED package.json (plugins/design/dev-server/) that a global `@1agh/maude` npm
+# install or a fresh `git worktree` does NOT populate; a missing `yjs` (imported at
+# boot by sync/index.ts) crashes `bun server.ts` AFTER spawn → without this guard we
+# poll the full ${TIMEOUT}s and report a generic "start timeout", burying the cause
+# in _server.log and silently degrading the mandatory visual-sanity gate. Fail loud
+# NOW with a context-correct hint. No auto-install: boot-self-heal.ts (DDR-044)
+# dropped that, and the durable production fix is booting the compiled binary
+# (DDR-009/DDR-084), not a boot-time install. setup-ds Round-2 / DDR-083 + DDR-084.
+if [ "$RUNTIME" = "bun" ]; then
+  DEV_SERVER_DIR="$(cd "$(dirname "$SERVER_TS")" && pwd)"
+  _resolve_dep() {
+    # Mirror node/bun bare-specifier resolution: walk node_modules up to /.
+    # Handles both the dev-server-local install and a workspace-hoisted one.
+    local dep="$1" d="$DEV_SERVER_DIR"
+    while [ -n "$d" ] && [ "$d" != "/" ]; do
+      [ -e "$d/node_modules/$dep/package.json" ] && return 0
+      d="$(dirname "$d")"
+    done
+    return 1
+  }
+  MISSING_DEPS=""
+  for dep in yjs y-protocols lib0; do
+    _resolve_dep "$dep" || MISSING_DEPS="$MISSING_DEPS $dep"
+  done
+  if [ -n "$MISSING_DEPS" ]; then
+    {
+      echo "✗ dev-server runtime deps not installed:$MISSING_DEPS"
+      if [ -f "$DEV_SERVER_DIR/package.json" ]; then
+        # A manifest is present (local dev tree / checkout) — install resolves it.
+        echo "  → run: (cd \"$DEV_SERVER_DIR\" && bun install)   # or: pnpm install at the repo root"
+      else
+        # No manifest beside server.ts AND no compiled binary resolved → the
+        # '@1agh/maude' install is incomplete. The platform binary (which embeds
+        # these deps) is the production runtime — reinstall to get it.
+        echo "  (no dev-server package.json here and no compiled binary resolved — the"
+        echo "   '@1agh/maude' install is incomplete; the platform binary embeds these deps)"
+        echo "  → reinstall:  npm i -g @1agh/maude     (or: npm rebuild -g @1agh/maude)"
+      fi
+    } >&2
+    exit 3
+  fi
+fi
+
 # Step 2 — spawn.
 mkdir -p "$DESIGN_ROOT"
 echo "→ starting dev server: $RUNTIME_CMD --root $REPO" >&2
-if [ "$RUNTIME" = "bun" ]; then
+if [ "$RUNTIME" = "binary" ]; then
+  nohup "$SERVER_BIN" --root "$REPO" > "$DESIGN_ROOT/_server.log" 2>&1 &
+elif [ "$RUNTIME" = "bun" ]; then
   nohup bun "$SERVER_TS" --root "$REPO" > "$DESIGN_ROOT/_server.log" 2>&1 &
 elif [ "$RUNTIME" = "node" ]; then
   nohup node "$SERVER_MJS" --root "$REPO" > "$DESIGN_ROOT/_server.log" 2>&1 &

package/plugins/design/dev-server/bin/visual-sanity.sh

@@ -41,6 +41,9 @@
 #   2  bad args
 #   3  one or more specimen screenshots failed
 #   4  no specimens existed on disk (DS not scaffolded? typo?)
+#   5  dev-server runtime deps missing (yjs/y-protocols/lib0) — recovery is
+#      `bun install`, NOT skip-or-retry; distinct from a generic boot failure
+#      so the caller routes to the right hint (server-up.sh exit 3). DDR-083.
 
 DS=""
 SPECIMENS=""
@@ -142,18 +145,31 @@ echo "→ booting dev-server (timeout ${BOOT_TIMEOUT}s)" >&2
 PORT=$(bash "$SCRIPT_DIR/server-up.sh" --root "$ROOT_ABS" --timeout "$BOOT_TIMEOUT")
 SERVER_RC=$?
 if [ $SERVER_RC -ne 0 ] || [ -z "$PORT" ]; then
-  echo "✗ dev-server boot failed (server-up.sh exit $SERVER_RC); see $DESIGN_ROOT/_server.log" >&2
+  # server-up.sh exit 3 = the dev-server's runtime deps aren't installed. That's
+  # a distinct failure from a generic boot crash/timeout: the fix is `bun install`,
+  # not "skip or retry". Surface a dedicated status + exit code (5) so the caller
+  # routes to the right remediation instead of the boot-failed AskUserQuestion.
+  # The actionable hint already went to stderr from server-up.sh. DDR-083.
+  if [ $SERVER_RC -eq 3 ]; then
+    echo "✗ dev-server runtime deps missing — run \`bun install\` in the dev-server dir (see hint above)" >&2
+    VS_STATUS="server-deps-missing"
+    VS_EXIT=5
+  else
+    echo "✗ dev-server boot failed (server-up.sh exit $SERVER_RC); see $DESIGN_ROOT/_server.log" >&2
+    VS_STATUS="server-boot-failed"
+    VS_EXIT=1
+  fi
   cat > "$OUT_DIR/_manifest.json" <<EOF
 {
   "ds": "$DS",
   "ts": "$TS",
-  "status": "server-boot-failed",
+  "status": "$VS_STATUS",
   "server_up_rc": $SERVER_RC,
   "specimens_requested": $(printf '%s\n' "${SPEC_ARR[@]}" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | sed '/^$/d' | sed 's/.*/"&"/' | paste -sd, -),
   "specimens_captured": []
 }
 EOF
-  exit 1
+  exit $VS_EXIT
 fi
 echo "✓ dev-server on port $PORT" >&2
 

package/plugins/design/dev-server/canvas-comment-mount.tsx

@@ -29,9 +29,9 @@
 import {
   Component,
   type ComponentType,
+  createElement,
   Fragment,
   type ReactNode,
-  createElement,
   useCallback,
   useEffect,
   useMemo,

package/plugins/design/dev-server/canvas-cursors.ts

@@ -168,6 +168,6 @@ export const TOOL_CURSORS: Record<Tool, string> = Object.freeze({
  */
 export function resolveToolCursor(token: unknown): string | null {
   if (typeof token !== 'string' || !/^[a-z-]+$/.test(token)) return null;
-  if (!Object.prototype.hasOwnProperty.call(TOOL_CURSORS, token)) return null;
+  if (!Object.hasOwn(TOOL_CURSORS, token)) return null;
   return TOOL_CURSORS[token as Tool];
 }