@1agh/maude 0.40.0 → 0.41.0

package/apps/studio/whats-new.json

@@ -1,6 +1,34 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "desktop-intel-mac-support",
+      "version": "0.41.0",
+      "date": "2026-07-08",
+      "kind": "improvement",
+      "title": "Desktop app now runs on Intel Macs",
+      "summary": "The macOS desktop app was Apple-Silicon-only — it now ships as a universal binary, so Intel Mac users can download and run it natively too, no Rosetta workaround needed.",
+      "learnMore": "https://maude.sh/desktop",
+      "surface": "design-ui"
+    },
+    {
+      "id": "element-editing-robustness",
+      "version": "0.41.0",
+      "date": "2026-07-08",
+      "kind": "feature",
+      "title": "Edit elements like Figma or Webflow",
+      "summary": "Selecting an element now opens the Inspector automatically, and drag handles let you resize it directly on the canvas (corner + edge, Shift to lock aspect, Alt to resize from center) — artboards get free-hand resize too. Delete an element with the Del key or the right-click menu, or insert a new div, text, or image straight into the artboard; add a whole new empty artboard from a Desktop/Laptop/Tablet/Mobile preset. The Inspector gained Position (with a constraints-style inset box), Transform, and Media sections (object-fit, aspect ratio), plus on-canvas dragging for padding and gaps. Swap a photo or video (or a background image) from a built-in asset picker. Editing now works on design-system specimens too, not just your UI canvases. A shared component always tells you plainly whether an edit is local to this artboard or shared across every place it's used, and moving one instance never drags the others along. Rounding it out: keyboard nudge + tree navigation, Cmd+D duplicate, copy/paste style, align and distribute a multi-selection, deep-select + \"Select layer\" for nested/overlapping elements, Alt-hover distance measurement, a free-hand rotate handle, and a proper Fixed/Hug/Fill sizing control for flex layouts. Every one of these is undoable with Cmd+Z.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "whiteboard-ai-toolkit",
+      "version": "0.41.0",
+      "date": "2026-07-08",
+      "kind": "feature",
+      "title": "The Assistant now reads and draws on your whiteboard",
+      "summary": "Sketch stickies, shapes, and arrows on a canvas and the Assistant understands not just which artboard a note sits on, but which button or element it's pointing at. Ask it to pin a note next to something specific, and it'll drop it right there with an arrow pointing at it — no guessing coordinates. It can also lay out a whole tidy board for you: a sprint retro, a kanban, a week of social posts, a roadmap, a brainstorm, a user-flow diagram — just ask.",
+      "surface": "design-ui"
+    },
     {
       "id": "timeline-clip-editing",
       "version": "0.40.0",

package/cli/commands/design.mjs

@@ -43,8 +43,10 @@ const BIN_VERBS = new Set([
   'to-lottie',
   'read-annotations',
   'annotate',
+  'canvas-rects',
   'chat-open',
   'ensure-browser',
+  'fetch-asset',
 ]);
 
 // Bin verbs that boot the dev-server (directly, or by shelling into server-up.sh).
@@ -136,8 +138,9 @@ Lifecycle:
 
 Dev-tooling (dispatch to the dev-server bash helpers — DDR-062):
   screenshot · server-up · prep · slug · bootstrap-check · runtime-health
-  smoke · canvas-edit · handoff · asset-sweep · visual-sanity
+  smoke · canvas-edit · handoff · asset-sweep · visual-sanity · fetch-asset
   draw-build · draw-proof · svg-optimize · to-lottie · read-annotations · annotate
+  canvas-rects
         Invoke the bundled helper of the same name. maude resolves it from its
         own package root and sets CLAUDE_PLUGIN_ROOT for the child; stdout,
         stderr, and exit code pass straight through (so command-substitution
@@ -147,6 +150,8 @@ Dev-tooling (dispatch to the dev-server bash helpers — DDR-062):
           PORT=$(maude design server-up --root "$REPO")
           eval "$(maude design prep --shell-export --shape edit --root "$REPO")"
           maude design smoke --changed-only
+          REF=$(maude design fetch-asset "$URL" --root "$REPO")   # download-first image
+          maude design canvas-rects "ui/Foo.tsx"                  # geometry manifest (whiteboard toolkit)
 
   serve [--port N] [--root PATH]
         Start the design plugin's dev server in the current repo. Equivalent

package/cli/commands/design.test.mjs

@@ -51,11 +51,59 @@ test('unknown verb exits 2', () => {
 test('design help lists the dev-tooling verbs', () => {
   const res = runDesign(['help']);
   assert.equal(res.status, 0, res.stderr);
-  for (const verb of ['screenshot', 'server-up', 'prep', 'slug', 'smoke', 'visual-sanity']) {
+  for (const verb of [
+    'screenshot',
+    'server-up',
+    'prep',
+    'slug',
+    'smoke',
+    'visual-sanity',
+    'canvas-rects',
+  ]) {
     assert.match(res.stdout, new RegExp(verb), `usage should mention ${verb}`);
   }
 });
 
+// canvas-rects needs an explicit --root pinned to an isolated temp dir (not
+// runDesign's ambient cwd) — its server-detection reads $CLAUDE_PROJECT_DIR /
+// `git rev-parse` when --root is absent, which would escape the temp dir in
+// an environment where either is set.
+function runCanvasRects(args, root) {
+  const env = { ...process.env };
+  env.CLAUDE_PLUGIN_ROOT = undefined;
+  return spawnSync(process.execPath, [BIN, 'design', 'canvas-rects', ...args, '--root', root], {
+    cwd: root,
+    encoding: 'utf8',
+    env,
+  });
+}
+
+test('canvas-rects dispatches to the bundled helper (--help)', () => {
+  const root = mkdtempSync(join(tmpdir(), 'maude-canvas-rects-'));
+  try {
+    const res = runCanvasRects(['--help'], root);
+    assert.equal(res.status, 0, res.stderr);
+    assert.match(res.stdout, /canvas-rects\.sh/);
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test('canvas-rects with no live server falls back to the static lane', () => {
+  // No .design/_server.json under --root → static fallback, no browser
+  // needed. A missing canvas still emits a valid empty manifest (exit 0).
+  const root = mkdtempSync(join(tmpdir(), 'maude-canvas-rects-'));
+  try {
+    const res = runCanvasRects(['ui/Nonexistent.tsx'], root);
+    assert.equal(res.status, 0, res.stderr);
+    assert.match(res.stderr, /static/);
+    const manifest = JSON.parse(res.stdout.trim());
+    assert.deepEqual(manifest, { artboards: [], elements: [], elementsTruncated: false });
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 // resolveServerBinary — the dev-server boot-runtime resolver (DDR-084). server-up
 // must boot the compiled platform binary on a production install (it embeds yjs +
 // every dep; `bun server.ts` from source can't resolve them — the historic

package/cli/lib/fetch-asset.test.mjs

@@ -0,0 +1,213 @@
+// DDR-147 § Security follow-up item 1 — the hardened `maude design fetch-asset`
+// helper (apps/studio/bin/_fetch-asset.mjs). This suite locks the SECURITY CORE
+// that the untrusted-fetch rails promise: the resolved-IP SSRF classifier
+// (reject loopback / link-local / RFC-1918 / CGNAT / multicast / reserved, v4 +
+// v6 incl. IPv4-mapped + NAT64), https-only URL parsing, the png/jpg/gif/webp
+// magic sniff (SVG/HTML rejected), the content-addressed name contract, and the
+// realpath containment assertion. Runs under `pnpm test` (node --test cli/**).
+//
+// The network path (curl) is exercised by the manual smoke in the RCA/PR; these
+// are the offline, deterministic guards a regression would trip.
+
+import assert from 'node:assert/strict';
+import { existsSync, readFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { test } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const REPO = resolve(HERE, '..', '..');
+const MOD = resolve(REPO, 'apps', 'studio', 'bin', '_fetch-asset.mjs');
+
+const {
+  classifyAddress,
+  parseIPv4,
+  parseIPv6,
+  parseHttpsTarget,
+  sniffImageExt,
+  assetName,
+  containedAssetPath,
+  FetchAssetError,
+} = await import(MOD);
+
+// ── SSRF classifier: BLOCKED addresses ───────────────────────────────────────
+test('classifyAddress blocks private / loopback / link-local / reserved IPv4', () => {
+  const blocked = [
+    '127.0.0.1',
+    '127.9.9.9',
+    '10.0.0.1',
+    '10.255.255.255',
+    '172.16.0.1',
+    '172.31.255.255',
+    '192.168.1.1',
+    '169.254.169.254', // AWS/GCP IMDS
+    '169.254.0.1',
+    '100.64.0.1', // CGNAT
+    '100.127.255.255',
+    '0.0.0.0',
+    '224.0.0.1', // multicast
+    '239.255.255.255',
+    '240.0.0.1', // reserved
+    '255.255.255.255',
+    '198.18.0.1', // benchmark
+    '192.0.2.5', // TEST-NET-1
+    '192.0.0.1', // IETF
+  ];
+  for (const ip of blocked) {
+    assert.ok(classifyAddress(ip), `expected ${ip} to be BLOCKED but it was allowed`);
+  }
+});
+
+test('classifyAddress allows genuine public IPv4 (incl. just-outside-range boundaries)', () => {
+  const allowed = [
+    '8.8.8.8',
+    '1.1.1.1',
+    '93.184.216.34', // example.com
+    '172.15.255.255', // just below 172.16/12
+    '172.32.0.1', // just above 172.31
+    '100.63.255.255', // just below CGNAT
+    '100.128.0.1', // just above CGNAT
+    '169.253.255.255', // just below link-local
+    '11.0.0.1',
+    '192.167.255.255',
+    '192.169.0.1',
+    '223.255.255.255', // just below multicast
+  ];
+  for (const ip of allowed) {
+    assert.equal(classifyAddress(ip), null, `expected ${ip} to be ALLOWED but it was blocked`);
+  }
+});
+
+test('classifyAddress blocks loopback / link-local / ULA / multicast + embedded-v4 IPv6', () => {
+  const blocked = [
+    '::1', // loopback
+    '::', // unspecified
+    'fe80::1', // link-local
+    'fe80::abcd:1234',
+    'fc00::1', // ULA
+    'fd12:3456::1', // ULA
+    'ff02::1', // multicast
+    '::ffff:127.0.0.1', // IPv4-mapped loopback
+    '::ffff:10.0.0.1', // IPv4-mapped private
+    '::ffff:169.254.169.254', // IPv4-mapped IMDS
+    '64:ff9b::127.0.0.1', // NAT64 → loopback
+    '64:ff9b::192.168.0.1', // NAT64 → private
+  ];
+  for (const ip of blocked) {
+    assert.ok(classifyAddress(ip), `expected ${ip} to be BLOCKED but it was allowed`);
+  }
+});
+
+test('classifyAddress allows genuine public IPv6 (incl. IPv4-mapped public)', () => {
+  const allowed = [
+    '2001:4860:4860::8888', // Google DNS
+    '2606:4700:4700::1111', // Cloudflare DNS
+    '::ffff:8.8.8.8', // IPv4-mapped PUBLIC → allowed via embedded classify
+    '2a00:1450:4001:81b::200e',
+  ];
+  for (const ip of allowed) {
+    assert.equal(classifyAddress(ip), null, `expected ${ip} to be ALLOWED but it was blocked`);
+  }
+});
+
+test('classifyAddress fail-closes on non-IP / garbage input', () => {
+  for (const bad of ['not-an-ip', 'example.com', '', '999.999.999.999', 'gggg::1']) {
+    assert.ok(classifyAddress(bad), `expected ${JSON.stringify(bad)} to be treated as blocked`);
+  }
+});
+
+// ── IP parsers ───────────────────────────────────────────────────────────────
+test('parseIPv4 rejects malformed dotted-quads', () => {
+  for (const bad of ['1.2.3', '1.2.3.4.5', '256.1.1.1', '01.2.3.4', '1.2.3.a', '', '-1.2.3.4']) {
+    assert.equal(parseIPv4(bad), null, `expected ${JSON.stringify(bad)} to fail parse`);
+  }
+  assert.deepEqual([...parseIPv4('1.2.3.4')], [1, 2, 3, 4]);
+  assert.deepEqual([...parseIPv4('255.255.255.255')], [255, 255, 255, 255]);
+});
+
+test('parseIPv6 handles ::, embedded IPv4, zone id; rejects malformed', () => {
+  assert.ok(parseIPv6('::1'));
+  assert.ok(parseIPv6('::'));
+  assert.ok(parseIPv6('fe80::1%en0')); // zone id stripped
+  assert.ok(parseIPv6('2001:db8::1'));
+  assert.ok(parseIPv6('::ffff:1.2.3.4'));
+  for (const bad of ['gggg::', '1::2::3', '12345::', '1.2.3.4', '']) {
+    assert.equal(parseIPv6(bad), null, `expected ${JSON.stringify(bad)} to fail parse`);
+  }
+});
+
+// ── URL target ───────────────────────────────────────────────────────────────
+test('parseHttpsTarget accepts https and extracts host/port', () => {
+  assert.deepEqual(parseHttpsTarget('https://example.com/a.png'), {
+    host: 'example.com',
+    port: 443,
+  });
+  assert.deepEqual(parseHttpsTarget('https://cdn.example.com:8443/x'), {
+    host: 'cdn.example.com',
+    port: 8443,
+  });
+});
+
+test('parseHttpsTarget rejects non-https, credentials, and hostless URLs', () => {
+  const bad = [
+    'http://example.com/a.png',
+    'ftp://example.com/a.png',
+    'file:///etc/passwd',
+    'https://user:pass@example.com/a.png',
+    'not a url',
+  ];
+  for (const u of bad) {
+    assert.throws(() => parseHttpsTarget(u), FetchAssetError, `expected ${u} to throw`);
+  }
+});
+
+// ── image sniff ──────────────────────────────────────────────────────────────
+test('sniffImageExt recognises png/jpg/gif/webp and rejects SVG/HTML/empty', () => {
+  const png = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0]);
+  const jpg = Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0, 0]);
+  const gif = Buffer.from([0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0, 0]);
+  const webp = Buffer.from([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x45, 0x42, 0x50]);
+  assert.equal(sniffImageExt(png), 'png');
+  assert.equal(sniffImageExt(jpg), 'jpg');
+  assert.equal(sniffImageExt(gif), 'gif');
+  assert.equal(sniffImageExt(webp), 'webp');
+  assert.equal(sniffImageExt(Buffer.from('<svg xmlns="...')), null);
+  assert.equal(sniffImageExt(Buffer.from('<!DOCTYPE html>')), null);
+  assert.equal(sniffImageExt(Buffer.from([])), null);
+  // RIFF that is NOT webp (e.g. wav) must not sniff as an image.
+  assert.equal(
+    sniffImageExt(Buffer.from([0x52, 0x49, 0x46, 0x46, 0, 0, 0, 0, 0x57, 0x41, 0x56, 0x45])),
+    null
+  );
+});
+
+// ── naming + containment ─────────────────────────────────────────────────────
+test('assetName is content-addressed <sha8>.<ext> and deterministic', () => {
+  const bytes = Buffer.from('hello world');
+  const n1 = assetName(bytes, 'png');
+  const n2 = assetName(bytes, 'png');
+  assert.equal(n1, n2);
+  assert.match(n1, /^[a-f0-9]{8}\.png$/);
+  assert.notEqual(assetName(Buffer.from('other'), 'jpg'), n1);
+});
+
+test('containedAssetPath resolves under <root>/<designRoot>/assets and rejects escape', () => {
+  const { assetsDir, fileAbs } = containedAssetPath('/repo', '.design', 'a1b2c3d4.png');
+  assert.equal(assetsDir, resolve('/repo/.design/assets'));
+  assert.equal(fileAbs, resolve('/repo/.design/assets/a1b2c3d4.png'));
+  // A traversal name escapes → throws.
+  assert.throws(() => containedAssetPath('/repo', '.design', '../../etc/passwd'), FetchAssetError);
+  // A design-root that climbs out of the repo → throws.
+  assert.throws(() => containedAssetPath('/repo', '../../etc', 'a1b2c3d4.png'), FetchAssetError);
+});
+
+// ── wiring: verb registered + helper files ship ──────────────────────────────
+test('fetch-asset is a registered `maude design` bin verb with both helper files present', () => {
+  assert.ok(existsSync(resolve(REPO, 'apps/studio/bin/fetch-asset.sh')), 'fetch-asset.sh missing');
+  assert.ok(
+    existsSync(resolve(REPO, 'apps/studio/bin/_fetch-asset.mjs')),
+    '_fetch-asset.mjs missing'
+  );
+  const design = readFileSync(resolve(REPO, 'cli/commands/design.mjs'), 'utf8');
+  assert.match(design, /'fetch-asset'/, "'fetch-asset' not in design.mjs BIN_VERBS");
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -50,13 +50,13 @@
     "test:e2e:desktop:onboarding": "pnpm --filter @maude/desktop-e2e e2e:onboarding"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.40.0",
-    "@1agh/maude-darwin-x64": "0.40.0",
-    "@1agh/maude-linux-arm64": "0.40.0",
-    "@1agh/maude-linux-arm64-musl": "0.40.0",
-    "@1agh/maude-linux-x64": "0.40.0",
-    "@1agh/maude-linux-x64-musl": "0.40.0",
-    "@1agh/maude-win32-x64": "0.40.0"
+    "@1agh/maude-darwin-arm64": "0.41.0",
+    "@1agh/maude-darwin-x64": "0.41.0",
+    "@1agh/maude-linux-arm64": "0.41.0",
+    "@1agh/maude-linux-arm64-musl": "0.41.0",
+    "@1agh/maude-linux-x64": "0.41.0",
+    "@1agh/maude-linux-x64-musl": "0.41.0",
+    "@1agh/maude-win32-x64": "0.41.0"
   },
   "files": [
     "cli",

package/plugins/design/dependencies.json

@@ -74,8 +74,10 @@
         "commands/new.md",
         "commands/edit.md",
         "commands/smoke.md",
+        "commands/board.md",
         "dev-server/bin/screenshot.sh",
         "dev-server/bin/smoke.sh",
+        "dev-server/bin/canvas-rects.sh",
         "agents/design-critic.md",
         "agents/graphic-design-critic.md",
         "agents/a11y-critic.md"
@@ -104,7 +106,9 @@
         "dev-server/bin/_html-playwright.mjs",
         "dev-server/bin/_pptx-playwright.mjs",
         "dev-server/bin/_enumerate-artboards-playwright.mjs",
-        "dev-server/bin/screenshot.sh"
+        "dev-server/bin/screenshot.sh",
+        "dev-server/bin/_canvas-rects-playwright.mjs",
+        "dev-server/bin/canvas-rects.sh"
       ],
       "docsUrl": "https://playwright.dev"
     },
@@ -157,7 +161,11 @@
       },
       "autoInstall": false,
       "fallbackBehavior": "Slash commands' bash blocks that read .ai/workflows.config.json via jq degrade to inline node one-liners; harder to read but functional.",
-      "usedBy": ["dev-server/bin/bootstrap-check.sh", "dev-server/bin/server-up.sh"]
+      "usedBy": [
+        "dev-server/bin/bootstrap-check.sh",
+        "dev-server/bin/server-up.sh",
+        "dev-server/bin/canvas-rects.sh"
+      ]
     },
     {
       "id": "askuserquestion-mcp",