@1agh/maude 0.42.0 → 0.44.0

package/apps/studio/use-chrome-visibility.tsx

@@ -42,9 +42,15 @@ export function ChromeVisibilityProvider({
   children: ReactNode;
   initial?: Partial<ChromeVisibilityState>;
 }) {
+  // Defaults MUST match the app-shell's own default view-prefs (app.jsx
+  // MINIMAP_STORE / ZOOMCTL_STORE both default false) — otherwise a freshly
+  // loaded canvas shows the minimap/zoom before (or instead of, when the seed
+  // races the early inline-script `dgn:'loaded'`) the shell's OFF state is
+  // applied, so a user with both toggled off still sees them. `present` is a
+  // transient overlay, never persisted, so it stays false.
   const [state, setState] = useState<ChromeVisibilityState>({
-    minimap: initial?.minimap ?? true,
-    zoom: initial?.zoom ?? true,
+    minimap: initial?.minimap ?? false,
+    zoom: initial?.zoom ?? false,
     present: initial?.present ?? false,
   });
   const setChrome = useCallback((patch: Partial<ChromeVisibilityState>) => {

package/apps/studio/use-selection-set.tsx

@@ -84,6 +84,27 @@ export interface Selection {
    *  block child. Absent for a detached node / no parent. */
   parentDisplay?: string;
   parentFlexDirection?: string;
+  /** feature-photo-editor (Task 14) — set at selection resolution when the hit is
+   *  a content-addressed photo. `artboard-img` = an `<img src="assets/<sha8>.<ext>">`
+   *  authored in artboard TSX; `annotation-image` is threaded separately (the
+   *  annotation model has no data-cd-id, so it never rides this DOM-selection
+   *  path — see app.jsx's `edit-annotation-photo-request` handler). Absent for a
+   *  non-photo element or an `<img>` whose src isn't content-addressed. */
+  photoKind?: 'artboard-img' | 'annotation-image';
+  /** The resolved `assets/<sha8>.<ext>` source, when `photoKind` is set — the key
+   *  the Photo tab passes to `/_api/photo-edit`. */
+  photoAsset?: string;
+}
+
+/** feature-photo-editor — pull the content-addressed `assets/<sha8>.<ext>` out of
+ *  an image src (relative, absolute, or embedded in an outerHTML excerpt). Returns
+ *  null for a non-content-addressed src (external URL, SVG icon, data: URI) — those
+ *  aren't editable by the sidecar-keyed photo pipeline. Exported so both the
+ *  selection resolver and the Inspector's fallback derivation share one regex. */
+export function photoAssetFromString(s: string | null | undefined): string | null {
+  if (!s) return null;
+  const m = /assets\/[0-9a-f]{8}\.[a-z0-9]+/i.exec(s);
+  return m ? m[0] : null;
 }
 
 interface SelectionSetValue {

package/apps/studio/video-comp.tsx

@@ -116,6 +116,18 @@ function registry(): Map<string, CompEntry> {
   return w.__maudeVideoComps;
 }
 
+// rca/issue-video-artboard-frame-reset-on-edit — the LAST live-preview frame
+// per comp, hoisted above every remount boundary (module scope, mirrors
+// canvas-lib.tsx's `liveViewport`). A canvas edit (ACP/agent/inspector/text)
+// remounts the canvas subtree (canvas-comment-mount.tsx `key={attempt}`), and
+// video-comp.tsx's own module survives that remount — so a fresh VideoComp
+// mount can read the Timeline's last position here instead of always opening
+// on the static `posterFrame`. A full page load clears it — correct; the
+// shell re-seeds via the `timeline-comps` re-announce (app.jsx) once the new
+// Player registers. Never touched during capture (`hideChrome()` forces the
+// deterministic frame 0 / render-shim frame regardless of this mirror).
+const liveTimelineFrame = new Map<string, number>();
+
 function clamp(n: number, lo: number, hi: number): number {
   return Math.max(lo, Math.min(hi, n));
 }
@@ -226,7 +238,7 @@ export interface VideoCompProps extends VideoCompMeta {
   /** Show the Player's own transport chrome in PREVIEW. Auto-hidden during
    *  capture/export (the `?hide-chrome=1` shell flag). Default true. */
   controls?: boolean;
-  /** Loop preview playback. Default true. */
+  /** Loop preview playback. Default false — the user opts in via the Timeline. */
   loop?: boolean;
   /**
    * Autoplay in preview. Default: play unless the viewer prefers reduced motion
@@ -281,7 +293,7 @@ export function VideoComp({
   id,
   inputProps,
   controls,
-  loop = true,
+  loop = false,
   autoPlay,
 }: VideoCompProps) {
   const ref = useRef<PlayerRef | null>(null);
@@ -301,9 +313,15 @@ export function VideoComp({
   // autoplay; capture never autoplays (the shim drives frames). Opens on a
   // poster frame ~35% in so a paused comp shows content, not an empty frame 0.
   const play = (autoPlay ?? false) && !capturing;
-  const posterFrame = capturing
+  const maxFrame = Math.max(0, durationInFrames - 1);
+  const posterFrame = capturing ? 0 : Math.min(maxFrame, Math.round(durationInFrames * 0.35));
+  // rca/issue-video-artboard-frame-reset-on-edit — reopen on the Timeline's
+  // last known frame for this comp (survives the remount that tore this
+  // instance down), not the fixed poster-frame formula. Falls back to
+  // posterFrame on a genuinely first-ever mount (nothing recorded yet).
+  const initialFrame = capturing
     ? 0
-    : Math.min(Math.max(0, durationInFrames - 1), Math.round(durationInFrames * 0.35));
+    : clamp(liveTimelineFrame.get(compId) ?? posterFrame, 0, maxFrame);
 
   // Register with the seek bridge for the lifetime of this mount.
   useEffect(() => {
@@ -353,8 +371,10 @@ export function VideoComp({
       if (!p) return;
       try {
         if (m.dgn === 'timeline-seek' && typeof m.frame === 'number') {
+          const f = clamp(Math.round(m.frame), 0, Math.max(0, durationInFrames - 1));
           p.pause();
-          p.seekTo(clamp(Math.round(m.frame), 0, Math.max(0, durationInFrames - 1)));
+          p.seekTo(f);
+          liveTimelineFrame.set(compId, f);
         } else if (m.dgn === 'timeline-play') {
           p.play();
         } else if (m.dgn === 'timeline-pause') {
@@ -382,7 +402,9 @@ export function VideoComp({
     if (!p) return;
     const onFrame = () => {
       try {
-        postToShell({ dgn: 'timeline-frame', id: compId, frame: p.getCurrentFrame() });
+        const f = p.getCurrentFrame();
+        liveTimelineFrame.set(compId, f);
+        postToShell({ dgn: 'timeline-frame', id: compId, frame: f });
       } catch {
         /* ignore */
       }
@@ -397,6 +419,25 @@ export function VideoComp({
     };
   }, [compId]);
 
+  // iframe → shell: with loop off (now the default), the Player stops itself
+  // at the last frame — nothing else tells the Timeline panel's Play/Pause
+  // button to flip back to Play, so it reads "still playing" forever. Mirror
+  // the Player's own `ended` event so the shell can resync (rca/issue-video-
+  // artboard-loop-defaults-on).
+  useEffect(() => {
+    const p = ref.current;
+    if (!p) return;
+    const onEnded = () => postToShell({ dgn: 'timeline-ended', id: compId });
+    p.addEventListener('ended', onEnded);
+    return () => {
+      try {
+        p.removeEventListener('ended', onEnded);
+      } catch {
+        /* ignore */
+      }
+    };
+  }, [compId]);
+
   const style = useMemo(() => ({ width: '100%', height: '100%', display: 'block' as const }), []);
 
   return (
@@ -416,7 +457,7 @@ export function VideoComp({
         controls={showControls}
         loop={loopState}
         autoPlay={play}
-        initialFrame={posterFrame}
+        initialFrame={initialFrame}
         // Clicking the artboard must NOT toggle playback — it selects elements
         // for editing (the whole point of a canvas). Play only via the explicit
         // transport button (Player controls / Timeline panel). Same for the

package/apps/studio/whats-new.json

@@ -1,6 +1,155 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "bring-your-brand",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Bring your existing brand into Maude",
+      "summary": "Have a logo already? Upload it from the Quick setup checklist and Maude pulls out its color palette (and any recognizable font names) to seed a new design system — nothing is applied automatically, you confirm every choice during setup. Works with SVG logos; safety-checked before anything touches your project.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-testid=\"onboarding-bring-brand\"]",
+          "title": "Bring my existing brand",
+          "body": "Upload a logo SVG to seed a new design system's colors and fonts from it."
+        }
+      ]
+    },
+    {
+      "id": "inspector-designer-mode",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "A Figma-friendly view of the CSS panel",
+      "summary": "The Inspector now speaks two languages. Advanced keeps the real CSS property names; Designer regroups the exact same controls into Figma-familiar sections — Fill, Stroke, Corner radius, Auto layout, Effects, Opacity, Text — and relabels the rows, so you can style without thinking in CSS. Flip between them from the small toggle in the panel's top-right corner, or set a default in Settings → Appearance. Same live edits underneath, and a value set in one view reads back correctly in the other. New in both views: Blur and Blend controls, plus a single 9-point pad for auto-layout alignment.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-tour=\"cp-mode\"]",
+          "title": "Advanced or Designer",
+          "body": "Toggle the CSS panel between raw property names and Figma-style vocabulary. Your choice is remembered — you can also set it in Settings → Appearance.",
+          "placement": "left",
+          "inspector": true,
+          "tab": "css",
+          "requireSelection": true
+        }
+      ]
+    },
+    {
+      "id": "watch-the-intro",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Watch the intro, right inside Maude",
+      "summary": "There's now a short product showreel (about a minute and a half) you can watch without leaving the app — Help → Watch the intro, or the same button on the welcome screen the first time you open Maude. It walks through the whole loop: a design system built from a conversation, the infinite canvas, pointing and commenting to direct an AI edit, live multiplayer, and shipping the result. Also lands as its own canvas (Maude Explainer) if you want to open it in the canvas browser like anything else.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-tour=\"help\"]",
+          "title": "Watch the intro",
+          "body": "Help → Watch the intro plays the full showreel without leaving Maude."
+        }
+      ]
+    },
+    {
+      "id": "bulk-media-insert",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Insert several photos at once",
+      "summary": "The media picker now supports multi-select — pick several photos (or a mix of photos, videos, and audio) in one go instead of one at a time. Choose whether they land inside your artboard or float on the canvas as annotations; the picker figures out the sensible default (video and audio always go on the canvas, since only images can drop into an artboard) and lets you switch. Dragging several files from Finder onto the canvas at once is also more reliable now — every dropped file lands, even in a large batch.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "ai-video-generation",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Generate video clips for your reels",
+      "summary": "The BYOK generator now makes video. Bring your own Google key and generate a clip with Veo — a text prompt (\"slow drone push over an alpine lake at dawn\"), or seed it from a still you already generated so the clip matches your hero's look. The clip lands in your assets like any other footage, and Maude treats it as first-class: when you build a reel it watches the generated clip alongside your real footage and places it as a beat, so you can fill a missing shot without hand-sourcing one. Video takes a few minutes and runs in the background — you'll get the finished clip when it's ready. Add your key under File → Settings — AI generation (⌘,); it stays on your machine.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "ai-audio-generation",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Generate music, voiceover & subtitles",
+      "summary": "The BYOK generator now does audio. Bring your own ElevenLabs key and generate a music bed, sound effects, or a text-to-speech voiceover — one key covers the whole stack — and the track lands in your assets ready to drop under a reel. Before you spend credits on a music or SFX track, Maude searches audio you've already made (and your own ElevenLabs history — re-downloading it costs nothing) and offers a match to reuse. Subtitles are free and need no key at all: `maude design transcribe` runs whisper.cpp locally on any clip and writes word-timed SRT/VTT captions. Local setup is one click — Settings → Subtitles → Download model — and Maude auto-converts video containers (no ffmpeg wrangling) and picks the model for you. You pick the subtitle engine — local whisper, ElevenLabs Scribe, or Groq — in Settings; it's an explicit choice, so Maude never silently switches to a paid cloud engine behind your back. In a reel, generated music/voiceover become layered audio tracks (the music ducks under the voice) and the subtitles become a caption track that renders right on the video. Add your keys under File → Settings — AI generation (⌘,); they're stored only on your machine.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "ai-media-generation",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Generate images with your own AI key",
+      "summary": "Bring your own Google (Nano Banana) API key and generate images right inside Maude — and the image lands straight on your canvas, not in a dead-end dialog. Use the Generate action (⌘K → \"Generate with AI\"), the command line, or just ask in the chat panel (\"generate a hero image of a mountain lake\"); the finished picture drops onto the artboard you're looking at. Add your key under File → Settings — AI generation (⌘,); it's stored only on your machine, sent straight to the provider, and never touches a canvas or your git history. Want to change a generated image? Ask to edit it (\"make the sky purple\") for a fresh AI-edited version, or fine-tune it in the Photo tab — every result is a normal asset you can place, edit, and export. Audio and video generation are on the way.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-tour=\"menubar-file\"]",
+          "title": "AI generation settings",
+          "body": "Open File → Settings — AI generation (⌘,) to add your provider key, then Generate with AI from the ⌘K palette.",
+          "placement": "bottom"
+        }
+      ]
+    },
+    {
+      "id": "photo-editor",
+      "version": "0.43.0",
+      "date": "2026-07-10",
+      "kind": "feature",
+      "title": "Edit photos right on the canvas",
+      "summary": "A new Photo tab in the Inspector lets you tune any photo on your canvas — brightness, contrast, saturation, exposure, hue, sepia, grayscale, duotone, grain, pattern overlays, and vignette/reveal masks — with a live preview, whether it's an image you placed in an artboard or one you dropped/pasted onto the canvas. One click removes the background entirely (runs in your browser, no upload). Reach it from the Inspector's Photo tab or right-click \"Edit Photo…\". Every edit is also scriptable headlessly via /design:photo, so an agent can tune a photo without touching a slider.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-tour=\"inspector-tabs\"]",
+          "title": "Photo tab",
+          "body": "Select any photo on the canvas and a Photo tab appears here — adjustments, duotone, grain, pattern, masks, and one-click background removal.",
+          "placement": "bottom"
+        }
+      ]
+    },
+    {
+      "id": "footage-analysis-director-reel",
+      "version": "0.43.0",
+      "date": "2026-07-10",
+      "kind": "feature",
+      "title": "Turn a folder of clips into a cut — Maude watches your footage first",
+      "summary": "New /design:reel: point Maude at a folder of raw video (or the clips already on your canvas) and it actually WATCHES the footage first — pulling keyframes from each clip to find the good shots and read its character — then directs them like an editor into a graphics-laden cut with titles and transitions, ready to scrub on the Timeline and export to MP4. It can use several moments from one clip, orders them so they tell a story, and needs no extra install (frames are decoded in the browser, no ffmpeg). Analysis is vision-only; drop in a music track and it rides under the finished cut.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "ssh-remote-publish-and-pr-flow",
+      "version": "0.43.0",
+      "date": "2026-07-10",
+      "kind": "feature",
+      "title": "Share to a protected branch — via a pull request",
+      "summary": "On a GitHub project, \"Add to Shared version\" now pushes your draft and opens a pull request into main, so it works even when main is protected and a direct push would be rejected — the pull-request link opens right from the dialog. Publishing and getting the latest now work on SSH remotes too, and a blue \"Get latest\" button appears in the dock the moment a teammate's work is ahead, so you're nudged to pull without hunting for it.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "unified-text-editing",
+      "version": "0.43.0",
+      "date": "2026-07-10",
+      "kind": "feature",
+      "title": "Edit any text on the canvas, inline",
+      "summary": "Every kind of text on the canvas now edits the same predictable way — click to place a blinking caret, type, Enter to confirm, Shift+Enter for a new line — across an element's copy, shape and sticky labels, standalone text, and section titles. Text that's filled in from a list or variable (like cards built from data) is now editable in place too: double-click and change the words directly, and it's traced back to the right source. Only genuinely computed text still sends you to chat or /design:edit.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "whiteboard-annotation-improvements",
+      "version": "0.43.0",
+      "date": "2026-07-10",
+      "kind": "feature",
+      "title": "Bulk resize, sticky authors & fun stickers",
+      "summary": "Select several stickies, shapes or images together and resize the whole group proportionally with live corner handles, instead of one at a time. Sticky notes now show who drew them with a name badge. Text editing got a real pass: a visible blinking caret everywhere you edit text, double-click places the caret where you clicked instead of selecting everything, hovering text shows a text cursor, and a new shape or sticky auto-focuses so you can start typing immediately. Also new: a searchable, FigJam-style sticker picker with genuinely fun (not emoji) bundled sticker packs, and /design:board now understands generation requests like \"make me a team sprint retro\" directly.",
+      "surface": "design-ui"
+    },
     {
       "id": "background-export-notification-center",
       "version": "0.42.0",

package/apps/studio/ws.ts

@@ -222,6 +222,11 @@ export function createWs(
   // clients only — same privileged-data class as the rest of this feed.
   ctx.bus.on('export:job', (job: unknown) => broadcast({ type: 'export:job', payload: job }));
 
+  // feature-ai-media-generation (DDR-16x) — generation job queue state changes
+  // (queued → running → done/failed). Same privileged-data class + snapshot
+  // shape as export:job; the notification center reuses the export-center chrome.
+  ctx.bus.on('generate:job', (job: unknown) => broadcast({ type: 'generate:job', payload: job }));
+
   // HMR broadcaster — turns fs:any change events into `canvas-hmr` messages.
   // The iframe-side client (in _shell.html) decides reload strategy from `mode`.
   // Uses broadcastHmr so the segregated canvas origin's HMR-only sockets get it.

package/cli/bin/maude.mjs

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
+import { resolve } from 'node:path';
+import { resolvePkgRoot } from '../lib/pkg-root.mjs';
 // maude — Maude CLI. Scaffold .ai workspace, run dev servers, manage config.
-import { fileURLToPath } from 'node:url';
 import { runUpdateCheck } from '../lib/update-check.mjs';
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const CLI_ROOT = resolve(__dirname, '..');
-const PKG_ROOT = resolve(CLI_ROOT, '..');
+// DDR-166 T0b — real-disk resolution, safe inside a `bun build --compile`
+// standalone binary (see pkg-root.mjs's own doc comment for why the previous
+// `dirname(fileURLToPath(import.meta.url))` walk-up broke there).
+const PKG_ROOT = resolvePkgRoot();
 
 const COMMANDS = {
   init: () => import('../commands/init.mjs'),

package/cli/commands/design.mjs

@@ -47,6 +47,51 @@ const BIN_VERBS = new Set([
   'chat-open',
   'ensure-browser',
   'fetch-asset',
+  // DDR-167 (Phase 3 / T10). `import-asset` is the LOCAL-file sibling of the
+  // URL-only `fetch-asset`: hardened SVG ingestion (allowlist DOM-sanitize +
+  // a real-browser execution canary). PDF import is wired but not yet
+  // available — see the DDR's addendum on why the planned rasterization
+  // mechanism doesn't work under browser automation.
+  'import-asset',
+  // DDR-172 (Phase 3 / T11). `import-tokens` is the token-file sibling of
+  // `import-asset`: parses W3C design-tokens / Style-Dictionary JSON or raw
+  // CSS custom properties, maps recognized tokens onto the DS CSS-variable
+  // contract, and patches (theme-block-scoped) or scaffolds the target
+  // design system. CLI-only — no HTTP route, no in-app panel.
+  'import-tokens',
+  // DDR-173 (Phase 3 / T12). `import-brand` extracts typed palette/font
+  // cues + a hardened logo asset from an already-DDR-167-sanitized SVG for
+  // `/design:setup-ds --from-brand` — never re-reads or re-sanitizes the
+  // original brand file (Decision 2: no parallel, ungated read path).
+  'import-brand',
+  // feature-photo-editor (Stage G). `photo-adjust` is the thin non-browser
+  // parametric verb (curl → /_api/photo-edit). `photo-bg-remove` is the
+  // client-side @imgly ML harness (throwaway proof canvas + agent-browser
+  // attribute poll — see photo-bg-remove.sh's header for why).
+  'photo-adjust',
+  'photo-bg-remove',
+  // feature-footage-analysis-director. `ingest-footage` copies a folder of raw
+  // clips into assets/ (content-addressed, magic-byte sniffed). `probe-footage`
+  // decodes ONE clip in headless Chromium → keyframe PNGs for the footage-analyst's
+  // vision pass. Neither boots the dev server (probe is server-independent — it
+  // reads the clip as a file:// resource).
+  'ingest-footage',
+  'probe-footage',
+  // feature-ai-media-generation (Phase 0, DDR-16x). `generate` is the thin
+  // non-browser BYOK verb (curl → /_api/generate-jobs → poll → print the
+  // produced /assets/<sha8>.<ext>). The provider call happens server-side (the
+  // sidecar resolves the key from the keychain / ~/.config/maude/keys.json).
+  'generate',
+  // feature-ai-media-generation (Phase 2, DDR-164). `transcribe` is the local,
+  // no-key subtitle verb: spawn whisper.cpp on an audio/video file → SRT/VTT via
+  // the shared captions.ts reflow. No dev server; whisper.cpp is a SOFT dep with
+  // ElevenLabs Scribe / Groq Whisper as the cloud fallback.
+  'transcribe',
+  // feature-ai-media-generation (Task 2.5, DDR-164). `audio-search` is the
+  // reuse-before-you-pay verb: search the project's own generated audio + the
+  // user's ElevenLabs history before spending credits on a new music/SFX/VO
+  // track. Runs server-side (key resolved by the sidecar); needs a dev server.
+  'audio-search',
 ]);
 
 // Bin verbs that boot the dev-server (directly, or by shelling into server-up.sh).
@@ -140,7 +185,8 @@ Dev-tooling (dispatch to the dev-server bash helpers — DDR-062):
   screenshot · server-up · prep · slug · bootstrap-check · runtime-health
   smoke · canvas-edit · handoff · asset-sweep · visual-sanity · fetch-asset
   draw-build · draw-proof · svg-optimize · to-lottie · read-annotations · annotate
-  canvas-rects
+  canvas-rects · ingest-footage · probe-footage
+  generate · transcribe · audio-search
         Invoke the bundled helper of the same name. maude resolves it from its
         own package root and sets CLAUDE_PLUGIN_ROOT for the child; stdout,
         stderr, and exit code pass straight through (so command-substitution
@@ -453,7 +499,22 @@ async function runExport({ args }) {
   }
 
   const format = positional[0];
-  const VALID_FORMATS = new Set(['png', 'pdf', 'svg', 'html', 'pptx', 'canva', 'zip']);
+  // Includes the temporal formats (DDR-148): mp4/webm/gif render through the
+  // capture spine, same POST /_api/export the UI ⌘E dialog uses. Video export
+  // is always artboard-scoped (the comp's registered meta drives fps/duration).
+  const VALID_FORMATS = new Set([
+    'png',
+    'pdf',
+    'svg',
+    'html',
+    'pptx',
+    'canva',
+    'zip',
+    'mp4',
+    'webm',
+    'gif',
+  ]);
+  const VIDEO_FORMATS = new Set(['mp4', 'webm', 'gif']);
   if (!format || !VALID_FORMATS.has(format)) {
     process.stderr.write(
       `maude design export: missing or unknown <format>. Try one of: ${Array.from(VALID_FORMATS).join(', ')}\n`
@@ -461,7 +522,10 @@ async function runExport({ args }) {
     process.exit(2);
   }
 
-  const scope = flags.scope ?? 'canvas-as-separate';
+  // Video formats default to artboard scope (the only scope video supports —
+  // scope.ts resolves the artboard under the active canvas); other formats keep
+  // the canvas-as-separate default.
+  const scope = flags.scope ?? (VIDEO_FORMATS.has(format) ? 'artboard' : 'canvas-as-separate');
   const VALID_SCOPES = new Set(['selection', 'artboard', 'canvas-as-separate', 'project-raw']);
   if (!VALID_SCOPES.has(scope)) {
     process.stderr.write(`maude design export: unknown --scope "${scope}"\n`);

package/cli/lib/gitignore-block.mjs

@@ -38,12 +38,14 @@ export function buildBlock(designRel = '.design') {
     `${root}/_preflight.json`,
     `${root}/_locator.json`, // regenerable slug→path index
     `${root}/_export-history.json`,
+    `${root}/_generate-history.json`, // AI-media generation job ledger (regenerable — feature-ai-media-generation, DDR-16x)
     // Per-machine / per-user dirs.
     `${root}/_export-jobs/`, // background-export job byte store (regenerable — feature-background-export-notification-center)
     `${root}/_state/`, // binary CRDT logs (regenerable from hub)
     `${root}/_history/`,
     `${root}/_trash/`, // soft-deleted canvases (recoverable locally — Phase 22 delete)
     `${root}/_draw/`, // draw-agent proof canvases (regenerable — Phase 25)
+    `${root}/_photo/`, // photo-bg-remove headless proof canvases (regenerable — feature-photo-editor)
     `${root}/_smoke/`, // batch-screenshot output (regenerable — DDR-021)
     `${root}/_canvas-state/`, // per-machine canvas scratch + camera (`*.view.json`, DDR-115)
     `${root}/_chat/`, // ACP transcripts (per-machine)

package/cli/lib/pkg-root.mjs

@@ -0,0 +1,107 @@
+// pkg-root.mjs — real-disk `maude` package-root resolution, safe inside a
+// `bun build --compile` standalone binary (DDR-166 T0b).
+//
+// `cli/bin/maude.mjs` originally computed PKG_ROOT via
+// `dirname(fileURLToPath(import.meta.url))` walk-up — correct for the plain
+// npm/node install, but the exact DDR-045 trap: inside a compiled binary,
+// `import.meta.url` resolves to Bun's virtual filesystem (`/$bunfs/root` on
+// POSIX, `B:/~BUN/root` on Windows), not the real on-disk location. Two
+// dev-server releases (v0.18.0/v0.18.1) shipped broken because of this exact
+// bug class before DDR-045 fixed it there. This module mirrors that fix
+// (`apps/studio/paths.ts` `resolveDevServerRoot`) for the CLI, independently
+// — not by importing paths.ts directly, to keep the CLI's compiled binary
+// decoupled from the dev-server's module graph.
+
+import { existsSync, realpathSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+function isVirtualBunfsPath(p) {
+  return p !== null && (p.startsWith('/$bunfs') || p.startsWith('B:/~BUN'));
+}
+
+/** True inside a `bun build --compile` standalone binary. Mirrors `apps/studio/paths.ts`'s `IS_COMPILED_BINARY`. */
+export function isCompiledBinary() {
+  return isVirtualBunfsPath(getImportMetaDir());
+}
+
+function getImportMetaDir() {
+  try {
+    return dirname(fileURLToPath(import.meta.url));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Anchor: `apps/studio/bin/screenshot.sh` is present in every real maude
+ * package root (dev tree, npm tarball, and the Tauri desktop `Resources/`
+ * bundle all ship it) and nowhere else — unique enough to identify the
+ * package root without also requiring `package.json` (npm tarballs can drop
+ * nested workspace `package.json` files, the exact false-negative DDR-045's
+ * own retro already documents for the dev-server's analogous check).
+ */
+export function isPkgRoot(dir) {
+  // Both anchors, not just one: `apps/studio/bin/screenshot.sh` ALONE is a
+  // false-positive inside the Tauri desktop build — `stage-resources.mjs`
+  // stages a full working copy of `apps/studio` (dev-server + bin scripts)
+  // into `target/debug/apps/studio/` for the sidecar's own runtime
+  // resolution, but that staged copy has no `cli/` — walking up from a
+  // compiled `maude` binary placed at `target/debug/maude` matched THAT
+  // copy first and stopped one level too early (caught by live testing
+  // against the real Tauri build, not a synthetic path). `cli/commands/
+  // design.mjs` only exists in a genuine package root.
+  return (
+    existsSync(join(dir, 'apps', 'studio', 'bin', 'screenshot.sh')) &&
+    existsSync(join(dir, 'cli', 'commands', 'design.mjs'))
+  );
+}
+
+/**
+ * Resolve maude's own package root — real disk path, safe inside a compiled
+ * binary. Priority: (0) explicit override, (1) dev-mode `import.meta.url`
+ * (plain `node`/`bun run cli/bin/maude.mjs`), (2) compiled-binary walk-up
+ * from `process.execPath` (matches the npm-install layout: binary at
+ * `@1agh/maude-<platform>/maude` walks up to `@1agh/maude/`, which ships
+ * `apps/studio/` via `package.json` `files`; matches the Tauri desktop layout
+ * too, where the bundled `maude` binary and the `Resources/apps/studio`
+ * bundle share a common ancestor within the walk-up depth).
+ */
+export function resolvePkgRoot() {
+  const override = process.env.MAUDE_PKG_ROOT;
+  if (override && !isVirtualBunfsPath(override) && isPkgRoot(override)) return override;
+
+  const importDir = getImportMetaDir();
+  if (importDir && !isVirtualBunfsPath(importDir)) {
+    // Dev-mode: cli/bin/maude.mjs is 2 levels under the package root.
+    const candidate = join(importDir, '..', '..');
+    if (isPkgRoot(candidate)) return candidate;
+  }
+
+  // `process.execPath` is the path AS INVOKED — when launched through a
+  // symlink (DDR-166 T0b stages exactly this: sidecar.rs's narrow bin-link
+  // dir), it's the symlink's own path, not the real target, and walking up
+  // from there (e.g. ~/Library/Caches/…/bin-link/) never reaches the repo
+  // root. Dereference first. Falls back to the raw path if the file somehow
+  // doesn't exist (shouldn't happen — we ARE that running process).
+  let cur;
+  try {
+    cur = dirname(realpathSync(process.execPath));
+  } catch {
+    cur = dirname(process.execPath);
+  }
+  for (let i = 0; i < 10; i++) {
+    if (isPkgRoot(cur)) return cur;
+    const parent = dirname(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+
+  // Final fallback for unanchored test contexts — callers should expect
+  // existsSync-based lookups to fail and surface a clear error, same
+  // contract as paths.ts's own resolver. Never join a VIRTUAL importDir here
+  // (`/$bunfs/root/../..` collapses to `/` via path.join — a real bug an
+  // earlier draft of this function had, caught by testing against an
+  // unanchored compile output before wiring this into Tauri).
+  return dirname(process.execPath);
+}