@1agh/maude 0.34.0 → 0.36.0

package/apps/studio/test/remote-ahead-behind-cache.test.ts

@@ -0,0 +1,89 @@
+// DDR-132 — remote ahead/behind probe: in-memory TTL cache + in-flight dedupe.
+//
+// Verifies the cache WRAPPER (TTL-serve / invalidate / in-flight coalesce) fully
+// offline, with no network and no git spawn. Trick: the probe's DDR-131 transport
+// gate classifies a bare local-path remote as `unsafe`, so `remoteAheadBehind`
+// returns a FRESH `{ahead:0,behind:0}` object on every *uncached* evaluation
+// without touching the network. Object IDENTITY (`Object.is`) therefore tells a
+// cache-serve (same reference) apart from a re-run (new reference) — a stronger
+// signal than value equality, and one the security hardening can't invalidate.
+//
+// (The real fetch/count path needs a reachable github.com remote and is covered
+// by the manual native dogfood — same offline ceiling DDR-131 records for
+// `gitFetchRemote`. This file owns the wrapper semantics only.)
+//
+// This file deliberately does NOT set MAUDE_USE_SYSTEM_GIT (it would leak into the
+// shared bun-test process and flip other files' iso-engine expectations).
+
+import { afterEach, beforeEach, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { invalidateRemoteProbe, remoteAheadBehind } from '../git/service.ts';
+
+function git(cwd: string, args: string[]): void {
+  const p = Bun.spawnSync(['git', ...args], {
+    cwd,
+    env: { ...process.env, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_SYSTEM: '/dev/null' },
+  });
+  if (p.exitCode !== 0) throw new Error(`git ${args.join(' ')}: ${p.stderr.toString()}`);
+}
+
+let work: string;
+
+beforeEach(() => {
+  work = mkdtempSync(join(tmpdir(), 'maude-ab-work-'));
+  git(work, ['init', '-q', '-b', 'main']);
+  git(work, ['config', 'user.email', 't@t.dev']);
+  git(work, ['config', 'user.name', 'Tester']);
+  writeFileSync(join(work, 'a.txt'), 'hello\n');
+  git(work, ['add', '.']);
+  git(work, ['commit', '-q', '-m', 'init']);
+  // A bare local path → DDR-131 transport gate classifies it `unsafe` → the probe
+  // returns {0,0} with no spawn. (Any value is fine; we assert on identity.)
+  git(work, ['remote', 'add', 'origin', '/var/empty/maude-test-remote']);
+});
+
+afterEach(() => {
+  invalidateRemoteProbe(work);
+  rmSync(work, { recursive: true, force: true });
+});
+
+test('a second call within the TTL serves the cached object (no re-run)', async () => {
+  const a = await remoteAheadBehind(work, undefined);
+  expect(a).toEqual({ ahead: 0, behind: 0 });
+  const b = await remoteAheadBehind(work, undefined);
+  expect(Object.is(a, b)).toBe(true); // same reference ⇒ served from cache
+});
+
+test('invalidateRemoteProbe forces a fresh evaluation (new object)', async () => {
+  const a = await remoteAheadBehind(work, undefined);
+  invalidateRemoteProbe(work);
+  const c = await remoteAheadBehind(work, undefined);
+  expect(c).toEqual({ ahead: 0, behind: 0 });
+  expect(Object.is(a, c)).toBe(false); // new reference ⇒ re-ran after invalidation
+});
+
+test('SECURITY (DDR-133 F1): the unattended probe never fetches a non-github HTTP remote', async () => {
+  // Repoint origin to a non-github HTTPS host (a poisoned `.git/config` riding a clone).
+  // With system git auto-preferred (DDR-133), the host-allowlist must gate this probe
+  // BEFORE the engine branch — otherwise an http transport reached `git fetch` against
+  // ANY host on the unattended 45s poll (SSRF / presence beacon). The guard returns
+  // {0,0} with NO spawn; a regression would attempt the fetch and reject/hang here.
+  git(work, ['remote', 'set-url', 'origin', 'https://evil.example.invalid/repo.git']);
+  invalidateRemoteProbe(work);
+  const r = await remoteAheadBehind(work, 'tok_must_never_be_sent');
+  expect(r).toEqual({ ahead: 0, behind: 0 });
+});
+
+test('concurrent callers coalesce onto one shared in-flight result', async () => {
+  const [a, b, c] = await Promise.all([
+    remoteAheadBehind(work, undefined),
+    remoteAheadBehind(work, undefined),
+    remoteAheadBehind(work, undefined),
+  ]);
+  // One shared in-flight promise (or the just-written cache) ⇒ identical reference,
+  // never three independent evaluations.
+  expect(Object.is(a, b)).toBe(true);
+  expect(Object.is(b, c)).toBe(true);
+});

package/apps/studio/whats-new.json

@@ -1,6 +1,24 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "git-native-switcher",
+      "version": "0.36.0",
+      "date": "2026-06-30",
+      "kind": "feature",
+      "title": "The version switcher now speaks Git",
+      "summary": "The bottom-left switcher uses plain Git names now — your branches by name, main as the default branch everyone shares, and a one-click “Merge this branch → main.” It opens instantly even on repos with hundreds of branches (it uses your installed Git when you have it), and “Pull a local copy” lists every repo you can reach on GitHub — including ones shared through your team or organization.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "remote-drafts-in-switcher",
+      "version": "0.36.0",
+      "date": "2026-06-30",
+      "kind": "feature",
+      "title": "Open any draft, including your team's",
+      "summary": "The version switcher now shows drafts that live on your team's shared remote — not only the ones already on this computer. They're marked “from your team,” and picking one downloads it for you. Hit Refresh to pull in a draft someone just made, search to find one in a long list, and your most recently worked-on drafts sort to the top. Works whether your project connects over SSH or HTTPS.",
+      "surface": "design-ui"
+    },
     {
       "id": "desktop-ai-chat-fix",
       "version": "0.32.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.34.0",
+  "version": "0.36.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -22,7 +22,10 @@
     "dev:site": "pnpm --filter @maude/site dev --port 4398",
     "dev:desktop": "PATH=\"$HOME/.cargo/bin:$PATH\" pnpm --filter @maude/desktop tauri dev",
     "build:desktop": "PATH=\"$HOME/.cargo/bin:$PATH\" pnpm --filter @maude/desktop tauri build",
-    "build": "pnpm -r --if-present --filter '!@maude/desktop' run build",
+    "test:e2e:desktop:build": "PATH=\"$HOME/.cargo/bin:$PATH\" pnpm --filter @maude/desktop tauri build --debug --config src-tauri/tauri.e2e.conf.json",
+    "test:e2e:desktop": "pnpm --filter @maude/desktop-e2e e2e",
+    "test:e2e:desktop:git": "pnpm --filter @maude/desktop-e2e e2e:git",
+    "build": "pnpm -r --if-present --filter '!@maude/desktop' '!@maude/desktop-e2e' run build",
     "build:binary": "bun run apps/studio/build.ts --release",
     "test": "node --test --test-reporter=spec cli/**/*.test.mjs",
     "test:dev-server": "cd apps/studio && bun test",
@@ -40,16 +43,18 @@
     "video:render": "cd scripts/video/final && pnpm run render",
     "video:studio": "cd scripts/video/final && pnpm run studio",
     "postinstall": "node cli/install.cjs",
-    "prepublishOnly": "bash scripts/check-version-parity.sh && bash apps/studio/bin/check-runtime-bundles.sh"
+    "prepublishOnly": "bash scripts/check-version-parity.sh && bash apps/studio/bin/check-runtime-bundles.sh",
+    "test:e2e:desktop:lifecycle": "pnpm --filter @maude/desktop-e2e e2e:lifecycle",
+    "test:e2e:desktop:switchrepos": "pnpm --filter @maude/desktop-e2e e2e:switchrepos"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.34.0",
-    "@1agh/maude-darwin-x64": "0.34.0",
-    "@1agh/maude-linux-arm64": "0.34.0",
-    "@1agh/maude-linux-arm64-musl": "0.34.0",
-    "@1agh/maude-linux-x64": "0.34.0",
-    "@1agh/maude-linux-x64-musl": "0.34.0",
-    "@1agh/maude-win32-x64": "0.34.0"
+    "@1agh/maude-darwin-arm64": "0.36.0",
+    "@1agh/maude-darwin-x64": "0.36.0",
+    "@1agh/maude-linux-arm64": "0.36.0",
+    "@1agh/maude-linux-arm64-musl": "0.36.0",
+    "@1agh/maude-linux-x64": "0.36.0",
+    "@1agh/maude-linux-x64-musl": "0.36.0",
+    "@1agh/maude-win32-x64": "0.36.0"
   },
   "files": [
     "cli",

package/plugins/flow/.claude-plugin/config.schema.json

@@ -236,13 +236,13 @@
     "orchestration": {
       "type": "object",
       "additionalProperties": false,
-      "description": "Opt-in, capability-gated bookend debate (diverge→adversarial→research). Additive: with the experimental agent-teams flag off (the default for ~all users), `auto`/`reduce` degrade to today's parallel panel + a read-only reduce-pass — nothing to configure, no premium spend. No hard dependency on experimental Claude Code features. See DDR-130.",
+      "description": "Opt-OUT, capability-gated bookend debate (diverge→adversarial→research). The debate is ON by default: an absent `orchestration` block is treated as `mode:auto`, so the layer engages everywhere — a live native agent-team (`relay`) when the CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS flag is enabled, else a cheap read-only `reduce` panel. Add this block ONLY to dial it down or off. No hard dependency on experimental Claude Code features (degrades to `reduce` without the flag). See DDR-130.",
       "properties": {
         "mode": {
           "type": "string",
           "enum": ["auto", "reduce", "off"],
           "default": "auto",
-          "description": "`auto` = use a live native agent-team (relay) when the CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS capability is detected, else the read-only reduce-pass; gated further by the stakes-gate + short-circuit. `reduce` = always parallel panel + reduce-pass, never a live team. `off` = today's raw single-pass / sum-of-verdicts, byte-for-byte unchanged."
+          "description": "Opt-out default `auto` (absent block == `auto`). `auto` = live native agent-team (relay) when the CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS capability is detected, else the read-only reduce-pass; gated further by the stakes-gate + short-circuit. `reduce` = always parallel panel + reduce-pass, never a live team. `off` = disable the debate entirely; today's raw single-pass / sum-of-verdicts, byte-for-byte unchanged."
         },
         "bookends": {
           "type": "object",
@@ -292,9 +292,9 @@
         "designTeam": {
           "type": "object",
           "additionalProperties": false,
-          "description": "`/design:critic` live-team (relay) tier. Off until its measured gate clears: ≥ `minConflicts` cross-discipline conflicting blockers AND a reduce-pass demonstrably failing to break the oscillation. Until then `/design:critic` uses the read-only reduce-pass.",
+          "description": "`/design:critic` live-team (relay) tier — opt-out, ON by default. The conflicting critics convene as a native team and revise stances when the experimental flag is on AND the panel produced ≥ `minConflicts` cross-discipline conflicting blockers; otherwise the read-only reduce-pass stands. Set `enabled:false` to keep `/design:critic` on the reduce-pass only.",
           "properties": {
-            "enabled": { "type": "boolean", "default": false },
+            "enabled": { "type": "boolean", "default": true },
             "minConflicts": { "type": "integer", "minimum": 2, "default": 2 }
           }
         }