@1agh/maude 0.42.0 → 0.43.0

package/apps/studio/http.ts

@@ -10,7 +10,7 @@ import { dirname, join, posix, relative, resolve, sep } from 'node:path';
 
 import { probeAcpAvailability } from './acp/probe.ts';
 import { deleteChat, listChats, readChatMessages } from './acp/transcript.ts';
-import { type Api, ASSET_MAX_VIDEO_BYTES } from './api.ts';
+import { type Api, ASSET_MAX_BYTES, ASSET_MAX_VIDEO_BYTES } from './api.ts';
 import { buildCanvasModule } from './canvas-build.ts';
 import { canvasLibPath } from './canvas-lib-resolver.ts';
 import { TranspileError } from './canvas-pipeline.ts';
@@ -19,12 +19,14 @@ import type { Context } from './context.ts';
 import { type Format, isFormat, isScope, type Scope } from './exporters/index.ts';
 import { type ExportJobQueue, ExportQueueFullError } from './exporters/jobs.ts';
 import type { ActiveJsonShape } from './exporters/scope.ts';
+import { createFootageStore, FOOTAGE_MAX_BYTES } from './footage-store.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
 import { createGitHubEndpoints } from './github/endpoints.ts';
 import type { Inspect } from './inspect.ts';
 import { canvasSlug, writeLocator } from './locator.ts';
-import { DEV_SERVER_ROOT } from './paths.ts';
+import { DEV_SERVER_ROOT, STICKERS_DIR } from './paths.ts';
+import { createPhotoStore, PHOTO_EDIT_MAX_BYTES } from './photo-store.ts';
 import { probeReadiness } from './readiness.ts';
 import { getRuntimeBundle, packageForSlug } from './runtime-bundle.ts';
 import { linkHub } from './sync/hub-link.ts';
@@ -721,6 +723,12 @@ export function createHttp(
   // `routes` map (the dual-allowlist rule), so the untrusted canvas iframe origin
   // can never reach status/commit/publish/get-latest. http.ts owns the gating;
   // git/endpoints.ts owns the orchestration.
+  const photoStore = createPhotoStore(ctx);
+  // feature-footage-analysis-director — footage-analysis + EDL sidecars.
+  // MAIN-ORIGIN ONLY (privileged): the `/_api/footage` route is intentionally
+  // absent from CANVAS_SAFE_API + startCanvasServer's `routes` map, so the
+  // untrusted canvas iframe origin can never read/write the director's analysis.
+  const footageStore = createFootageStore(ctx);
   const gitApi = createGitEndpoints(ctx);
   // Phase 28 (E3) — `/_api/github/*`. Same dual-allowlist rule: main-origin only,
   // and every route is token-bearing (server-held keychain token via the loopback
@@ -836,8 +844,8 @@ export function createHttp(
     // expands to so Claude can Read it. MAIN-ORIGIN ONLY: sameOriginWrite CSRF gate
     // on POST + deliberately absent from CANVAS_SAFE_API + startCanvasServer routes,
     // so the untrusted canvas iframe is 403'd. The disk caps live in
-    // api.saveChatAttachment (magic-byte sniff / 10 MB / content-addressed name /
-    // session write budget).
+    // api.saveChatAttachment (magic-byte sniff / ASSET_MAX_BYTES / content-
+    // addressed name / session write budget).
     //
     // GET ?name=<sha8>.<ext> serves the pasted image back to the chat feed
     // (thumbnail + lightbox). The name is regex-allowlisted in
@@ -864,9 +872,12 @@ export function createHttp(
       if (!isLoopbackHost(req.headers.get('host')))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       const declared = Number(req.headers.get('content-length') || '0');
-      if (Number.isFinite(declared) && declared > 10 * 1024 * 1024) {
+      if (Number.isFinite(declared) && declared > ASSET_MAX_BYTES) {
         return Response.json(
-          { ok: false, error: 'attachment exceeds the 10 MB cap' },
+          {
+            ok: false,
+            error: `attachment exceeds the ${Math.round(ASSET_MAX_BYTES / (1024 * 1024))} MB cap`,
+          },
           { status: 413, headers: { 'Cache-Control': 'no-store' } }
         );
       }
@@ -969,6 +980,87 @@ export function createHttp(
       return new Response('Method not allowed', { status: 405 });
     },
 
+    '/_api/photo-edit': async (req: Request) => {
+      // feature-photo-editor (Stage C, Task 8) — non-destructive PhotoEdit sidecar.
+      //   GET ?asset=<sha8 | assets/<sha8>.<ext>>  → stored PhotoEdit or {}
+      //   PUT/POST ?asset=<...> body { …PhotoEdit } → validated + persisted
+      // CANVAS-SAFE (listed in BOTH CANVAS_SAFE_API below AND startCanvasServer's
+      // `routes` map — Bun matches `routes` before `fetch`, so a one-list entry
+      // 404s from the canvas iframe, the DDR-088 rollout bug). Reached from the
+      // canvas origin by <PhotoLayer> (GET) and the headless bg-remove harness
+      // (PUT), so NO sameOriginWrite (it would block the legit canvas origin);
+      // the photo-store cap stack (sha8 validate + containment + validatePhotoEdit
+      // + size cap) is the load-bearing mitigation. loopback-Host gates DNS-
+      // rebinding on every method.
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const asset = new URL(req.url).searchParams.get('asset');
+      if (req.method === 'GET') {
+        const edit = await photoStore.getPhotoEdit(asset);
+        return Response.json(edit ?? {}, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      if (req.method === 'PUT' || req.method === 'POST') {
+        const body = await readJson<unknown>(req, PHOTO_EDIT_MAX_BYTES + 1024);
+        if (body == null) return new Response('body required', { status: 400 });
+        const result = await photoStore.savePhotoEdit(asset, body);
+        if (!result.ok) {
+          return Response.json(
+            { ok: false, error: result.error },
+            { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+          );
+        }
+        return Response.json(
+          { ok: true, path: result.path, edit: result.edit },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return new Response('Method not allowed', { status: 405 });
+    },
+
+    '/_api/footage': async (req: Request) => {
+      // feature-footage-analysis-director (Task 2) — FootageAnalysis + EDL sidecars.
+      //   GET  ?asset=<sha8|assets/…>          → stored FootageAnalysis or {}
+      //   GET  ?slug=<cut-slug>                → stored Edl or {}
+      //   PUT/POST ?asset=<…> body {FootageAnalysis} → validated + persisted
+      //   PUT/POST ?slug=<…>  body {Edl}             → validated + persisted
+      // MAIN-ORIGIN ONLY (privileged — NOT in CANVAS_SAFE_API / startCanvasServer
+      // routes): written by the footage-analyst / footage-director agents over
+      // loopback, never the untrusted canvas iframe. A GET from the canvas origin
+      // 403s at the gate (canvas-origin-gate.test.ts). loopback-Host gates
+      // DNS-rebinding on every method; the footage-store cap stack (sha8/slug
+      // validate + containment + validate{FootageAnalysis,Edl} + size cap) is the
+      // load-bearing mitigation for the caller-derived write path.
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const params = new URL(req.url).searchParams;
+      const asset = params.get('asset');
+      const slug = params.get('slug');
+      if (!asset && !slug) return new Response('asset or slug required', { status: 400 });
+      const isEdl = !asset && !!slug;
+
+      if (req.method === 'GET') {
+        const data = isEdl
+          ? await footageStore.getEdl(slug)
+          : await footageStore.getAnalysis(asset);
+        return Response.json(data ?? {}, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      if (req.method === 'PUT' || req.method === 'POST') {
+        const body = await readJson<unknown>(req, FOOTAGE_MAX_BYTES + 1024);
+        if (body == null) return new Response('body required', { status: 400 });
+        const result = isEdl
+          ? await footageStore.saveEdl(slug, body)
+          : await footageStore.saveAnalysis(asset, body);
+        if (!result.ok) {
+          return Response.json(
+            { ok: false, error: result.error },
+            { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+          );
+        }
+        return Response.json({ ok: true, ...result }, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      return new Response('Method not allowed', { status: 405 });
+    },
+
     '/_api/canvas-source': async (req: Request) => {
       // DDR-148 — read-only raw .tsx source for the Timeline panel's sequence/
       // keyframe parser. GET ?file=<canvas rel or slug> → { source }.
@@ -1475,10 +1567,13 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isLoopbackHost(req.headers.get('host')))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
-      const body = await readJson<{ canvas?: unknown; id?: unknown; text?: unknown }>(
-        req,
-        16 * 1024
-      );
+      const body = await readJson<{
+        canvas?: unknown;
+        id?: unknown;
+        text?: unknown;
+        occurrence?: unknown;
+        before?: unknown;
+      }>(req, 16 * 1024);
       if (!body) return new Response('body required', { status: 400 });
       const result = await api.editText(body);
       if (!result.ok) {
@@ -1852,9 +1947,11 @@ export function createHttp(
     },
 
     '/_api/insert-element': async (req: Request) => {
-      // Stage I — insert a synthesized div/text/image relative to `refId`. POST
-      // { canvas, refId, position, kind, src?, refIndex? } → api.insertElementOp.
-      // Returns the new element's post-transpile id so the shell can select it.
+      // Stage I — insert a synthesized div/text/image relative to `refId`, OR —
+      // empty-artboard fallback — as a direct child of `artboardId` (exactly one
+      // of the two). POST { canvas, refId|artboardId, position, kind, src?,
+      // refIndex? } → api.insertElementOp. Returns the new element's
+      // post-transpile id so the shell can select it.
       // Whole-file undo seq. MAIN-ORIGIN ONLY (absent from both allowlists);
       // sameOriginWrite + loopback-Host gated. An `image` src is contained to
       // assets/ in the engine (no remote hotlink / ../ / scheme).
@@ -1866,6 +1963,7 @@ export function createHttp(
       const body = await readJson<{
         canvas?: unknown;
         refId?: unknown;
+        artboardId?: unknown;
         position?: unknown;
         kind?: unknown;
         src?: unknown;
@@ -1961,6 +2059,24 @@ export function createHttp(
       );
     },
 
+    '/_api/stickers': async (req: Request) => {
+      // Phase 4 (feature-whiteboard-annotation-improvements) — the bundled
+      // sticker catalogue for the StickerPicker. GET → { packs:[{slug, name,
+      // author, attributionUrl, license, stickers:[{file,keywords,url}]}] }.
+      // MAIN-ORIGIN ONLY: the picker is a shell dialog, same posture as
+      // /_api/assets above — absent from CANVAS_SAFE_API + startCanvasServer
+      // routes (dual-allowlist, DDR-054). Loopback-Host gated (DNS-rebinding);
+      // read-only, so no sameOriginWrite (GET).
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const r = await api.listStickers();
+      return Response.json(
+        { ok: true, packs: r.packs },
+        { headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_api/edit-scope': async (req: Request) => {
       // Stage H (feature-element-editing-robustness) — the INV-3 predictability
       // verdict. GET ?canvas&id&rendered → { ok, scope:'local'|'shared',
@@ -2367,6 +2483,48 @@ export function createHttp(
         }
       }
 
+      // Phase 4 (feature-whiteboard-annotation-improvements) — bundled sticker
+      // PNGs, served from MAUDE's OWN STICKERS_DIR (paths.ts, DDR-045), never
+      // the served project's designRoot (unlike /assets/ above). MAIN-ORIGIN
+      // ONLY: absent from CANVAS_SAFE_API + startCanvasServer's own routes
+      // object (server.ts) — a canvas-origin request 404s via isCanvasSafeRoute
+      // before ever reaching here (dual-allowlist, DDR-054/DDR-088).
+      if (pathname.startsWith('/_stickers/')) {
+        const rest = pathname.slice('/_stickers/'.length);
+        let decoded = '';
+        try {
+          decoded = decodeURIComponent(rest);
+        } catch {
+          return new Response('Bad request', { status: 400 });
+        }
+        const parts = decoded.split('/');
+        const [pack, name] = parts;
+        if (
+          parts.length === 2 &&
+          pack &&
+          name &&
+          /^[a-z0-9-]+$/.test(pack) &&
+          !name.includes('..') &&
+          !name.includes('/') &&
+          !name.includes('\\') &&
+          ext(name) === '.png'
+        ) {
+          const abs = join(STICKERS_DIR, pack, name);
+          const f = Bun.file(abs);
+          if (await f.exists()) {
+            return new Response(f, {
+              headers: {
+                'Content-Type': 'image/png',
+                'Cache-Control': 'public, max-age=31536000, immutable', // bundled with this maude version, never changes at this URL
+                'X-Content-Type-Options': 'nosniff',
+              },
+            });
+          }
+          return new Response('Not found', { status: 404 });
+        }
+        return new Response('Not found', { status: 404 });
+      }
+
       // Fall-through: serve user repo files (designRoot + everything under repoRoot).
       const fp = safePathUnderRoot(req.url, ctx.paths.repoRoot);
       if (!fp) return new Response('Forbidden', { status: 403 });
@@ -2458,7 +2616,8 @@ export function createHttp(
     '/_api/git-user', // presence display name
     '/_api/canvas-meta', // layout/viewport sidecar (GET + PATCH)
     '/_api/annotations', // annotation SVG (GET + PUT) — drives the collab bridge
-    '/_api/asset', // Phase 23 — capped binary image upload (sniff+10MB+sha8 name+no-SVG)
+    '/_api/asset', // Phase 23 — capped binary image upload (sniff+category cap+sha8 name+no-SVG)
+    '/_api/photo-edit', // feature-photo-editor — PhotoEdit sidecar GET/PUT (cap-stack gated). MIRROR in server.ts routes.
     '/_api/git-committers', // @mention autocomplete
     '/_api/ai', // AI-activity banner
     '/_comments', // per-file comment list (renders pins)

package/apps/studio/input-router.tsx

@@ -330,6 +330,16 @@ export function isEditableTarget(t: EventTarget | null): boolean {
   const tag = el.tagName;
   if (tag === 'INPUT' || tag === 'TEXTAREA' || tag === 'SELECT') return true;
   if (el.isContentEditable) return true;
+  // Dogfood fix — `.isContentEditable` is a computed/inherited property whose
+  // handling of the `contenteditable="plaintext-only"` token (the value the
+  // element-text-edit system uses, canvas-shell.tsx) has had cross-engine/
+  // version inconsistencies. Check the raw attribute too so a tool-letter
+  // shortcut (R, T, N, …) can never fire while that editor has focus,
+  // regardless of whether isContentEditable correctly reflects it in a given
+  // runtime — this was the reported bug (typing "R" while editing in-canvas
+  // text switched to the Rectangle tool).
+  const raw = el.getAttribute?.('contenteditable');
+  if (raw === 'true' || raw === 'plaintext-only' || raw === '') return true;
   return false;
 }
 

package/apps/studio/inspect.ts

@@ -47,6 +47,19 @@ export interface SelectedElement {
    * degrade to canvas-wide — never trust the positional id when stale.
    */
   stale?: boolean;
+  /**
+   * feature-photo-editor (Task 14) — which photo-editing context this
+   * selection is (an artboard `<img>` vs. an annotation `ImageStroke`), and
+   * the resolved `assets/<sha8>.<ext>` source. Client-derived (dom-selection.ts
+   * re-reads the live DOM, including a `data-photo-asset` tag stamped after an
+   * edit bakes) — round-tripped here (not dropped like the OTHER client-only
+   * fields such as `authored`/`computed`/`attrs`) because, unlike those, there
+   * is no cheap way to re-derive it from a plain server-side restore: losing it
+   * silently drops the Inspector's Photo tab on every canvas switch / reconnect
+   * until a fresh click re-selects the element.
+   */
+  photoKind?: 'artboard-img' | 'annotation-image';
+  photoAsset?: string;
 }
 
 /**
@@ -240,6 +253,19 @@ export function createInspect(
       v,
       canvas_mtime: mtimeFor(file),
       ...(id ? { id, canvas: deriveCanvasSlug(file) } : {}),
+      ...(() => {
+        if (sel.photoKind !== 'artboard-img' && sel.photoKind !== 'annotation-image') return {};
+        // `photoAsset` traces back to client-derived DOM state (a
+        // `data-photo-asset` attribute inside the untrusted canvas iframe,
+        // DDR-054) — unlike the sibling `text` field it had no shape/length
+        // constraint before persisting to `_active.json` and broadcasting to
+        // every connected WS peer (security review finding). It's always a
+        // fixed-shape `assets/<sha8>.<ext>` reference, so an unshaped value
+        // is dropped outright rather than merely truncated.
+        const asset = String(sel.photoAsset || '');
+        if (!/^assets\/[0-9a-f]{8}\.[a-z0-9]+$/i.test(asset)) return {};
+        return { photoKind: sel.photoKind, photoAsset: asset };
+      })(),
     };
   }
 
@@ -366,6 +392,26 @@ const INSPECTOR_SCRIPT = `
     '@keyframes dc-activity-glow { 0%, 100% { opacity: 0.4; } 50% { opacity: 0.85; } }',
     '@keyframes dc-activity-wave { from { transform: translateY(-100%); } to { transform: translateY(100%); } }',
     '@media (prefers-reduced-motion: reduce) { html .dc-activity-rim { transition: none; } html .dc-activity-rim::after { animation: none; opacity: 0.55; } html .dc-activity-scan { display: none; } }',
+    /* feature-photo-editor — background-removal busy reveal. A data-photo-busy
+       attribute toggle on the real img/image element (set by canvas-lib.tsx's
+       PhotoPreviewBridge on a photo-busy postMessage from the shell), styled
+       here at the same single injection point as the .dc-activity-* agent-edit
+       chrome above — same "something is actively happening" rim + pulse
+       language. Deliberately NOT a floating tracked overlay: that's the exact
+       architecture DDR-161's addendum removed from the live-edit preview
+       (z-index/resize/hit-testing bugs) — an attribute on the element itself
+       moves for free with pan/zoom/resize, no separate rect sync needed.
+       Deliberately opacity-only (not a moving mask-position sweep, tried
+       first): the ML pass runs single-threaded WASM on the main thread
+       (confirmed live — env.wasm.numThreads falls back without
+       crossOriginIsolated), which blocks per-frame style/paint work for the
+       ENTIRE inference; a mask-position animation froze mid-sweep for that
+       whole window. opacity is one of the few properties browsers composite
+       off the main thread unconditionally, so the pulse keeps animating
+       exactly when the page is busiest — the one moment it needs to. */
+    'html [data-photo-busy] { outline: 2px solid var(--mdcc-activity, hsl(210 90% 58%)); outline-offset: 2px; animation: dc-photo-busy-pulse 1100ms ease-in-out infinite; will-change: opacity; }',
+    '@keyframes dc-photo-busy-pulse { 0%, 100% { opacity: 1; } 50% { opacity: 0.5; } }',
+    '@media (prefers-reduced-motion: reduce) { html [data-photo-busy] { animation: none; opacity: 0.75; } }',
     /* Phase 13.1 / DDR-077 — "holding last good render" toast, shown when an
        agent edit produced a broken intermediate (build/render error) and the
        canvas is held instead of flashing white. Amber = warn, distinct from the
@@ -482,7 +528,13 @@ const INSPECTOR_SCRIPT = `
       return;
     }
     if (e.shiftKey) {
-      var id = k === 'i' ? 'inspector' : k === 'm' ? 'comments' : k === 'e' ? 'export' : k === 'h' ? 'handoff' : null;
+      // ⌘⇧T (timeline) + ⌘⇧G (changes) were missing here, so with focus inside
+      // the canvas iframe they never reached the shell — opening the Timeline
+      // (and its Space/arrow transport, which needs the dock focused) silently
+      // stopped working after a canvas interaction moved focus into the iframe.
+      // ⌘⇧T is also the browser "reopen closed tab" chord, so the preventDefault
+      // below is doubly load-bearing.
+      var id = k === 'i' ? 'inspector' : k === 'm' ? 'comments' : k === 'e' ? 'export' : k === 'h' ? 'handoff' : k === 't' ? 'timeline' : k === 'g' ? 'changes' : null;
       if (id) {
         e.preventDefault();
         try { window.parent.postMessage({ dgn: 'shell-shortcut', id: id }, '*'); } catch (err) {}

package/apps/studio/paths.ts

@@ -48,6 +48,16 @@ export const CLIENT_DIR: string = join(DEV_SERVER_ROOT, 'client');
 /** `<DEV_SERVER_ROOT>/dist/runtime/` — pre-built /_canvas-runtime/*.js bundles. */
 export const RUNTIME_BUNDLES_DIR: string = join(DIST_DIR, 'runtime');
 
+/**
+ * `<DEV_SERVER_ROOT>/stickers/` — bundled whiteboard sticker packs
+ * (feature-whiteboard-annotation-improvements, Phase 4). Ships with the
+ * `@1agh/maude` tarball (a subdir of `apps/studio`, already covered by the
+ * existing `files` entry — no separate packaging step). Resolved from
+ * DEV_SERVER_ROOT per DDR-045 — this is MAUDE's own bundled asset store, never
+ * the served project's.
+ */
+export const STICKERS_DIR: string = join(DEV_SERVER_ROOT, 'stickers');
+
 /**
  * Absolute path to a bundled plugin's loadable tree (`commands/`, `agents/`,
  * `skills/`, `hooks/`, `.claude-plugin/plugin.json`), or `null` when this layout