@1agh/maude 0.43.0 → 0.44.0

package/apps/studio/media-commit-chain.ts

@@ -0,0 +1,119 @@
+/**
+ * @file       media-commit-chain.ts — serialized accumulator chain for
+ *             concurrent async media-intake commits.
+ * @scope      apps/studio/media-commit-chain.ts
+ * @purpose    Fixes the Phase-23 batch-drop data-loss bug: a Finder drop of
+ *             N files fires N independent async completions (image decode /
+ *             asset upload), each of which used to read a `strokesRef.current`
+ *             mirror and call `commitStrokes(before, after)` on its own.
+ *             `strokesRef` only catches up on the NEXT render, so two
+ *             completions landing before a render commit both compute
+ *             `before` from the same stale snapshot — the second commit's
+ *             `setStrokesState` overwrites the first's, silently dropping it.
+ *
+ *             This chain fixes it by threading the PREVIOUS link's resulting
+ *             array forward as the next link's `before` while links are
+ *             in flight (Promise-chained, mirroring `editApplyChainRef` /
+ *             `structuralWrite` in client/app.jsx). The subtle part is what
+ *             happens once the queue drains: a naive "go idle, trust a fresh
+ *             `getSnapshot()` again" reset raced in practice — `getSnapshot()`
+ *             (`strokesRef.current`) only catches up on React's NEXT render,
+ *             which can take longer than the handful of microtask ticks this
+ *             chain itself needs to settle a link, so a fast-idling chain
+ *             could hand the next link a `getSnapshot()` that hasn't caught
+ *             up yet — reproducing the same loss one level down (confirmed
+ *             empirically against a real dev server: see the Task 5 write-up).
+ *             Instead, every idle read is RECONCILED against `remembered`
+ *             (the last array this chain itself produced): for every id the
+ *             chain itself has ever touched, `remembered`'s value WINS
+ *             outright, even if the fresh snapshot also contains that id —
+ *             presence alone isn't enough, since fresh can hold a STALE
+ *             value for an id the chain already updated (see `reconcile()`
+ *             below and DDR-165). Only ids fresh has that the chain has
+ *             never touched get folded in from it, which is what still lets
+ *             an unrelated synchronous edit (pen/shape/drag, made while
+ *             idle) through.
+ *
+ *             Framework/DOM-free by design so the no-loss guarantee is
+ *             testable without React or a real image decode/upload — see
+ *             test/media-commit-chain.test.ts.
+ */
+
+export interface MediaCommitResult<T> {
+  /** The chain's new accumulator value — what the NEXT queued link builds on. */
+  after: readonly T[];
+  /**
+   * Override the `before` passed to `onCommit` (defaults to this link's
+   * accumulator `before`). Lets a caller exclude an ephemeral, never-
+   * separately-committed entry (e.g. an optimistic blob: preview) from the
+   * undo record while still folding it into the accumulator correctly.
+   */
+  commitBefore?: readonly T[];
+  label?: string;
+}
+
+export interface MediaCommitChain<T> {
+  /**
+   * Enqueue a synchronous mutation. `mutate` receives the current
+   * accumulated `before` (the previous link's `after` while a link is still
+   * in flight, or a reconciled `getSnapshot()` read once the queue has
+   * drained) and returns a result, or `null` to skip (no-op, `before` passes
+   * through unchanged). `onCommit` fires with `(before, after, label)` in
+   * strict queue order, once per non-null mutation.
+   */
+  enqueue(
+    mutate: (before: readonly T[]) => MediaCommitResult<T> | null,
+    onCommit: (before: readonly T[], after: readonly T[], label?: string) => void
+  ): Promise<readonly T[]>;
+}
+
+export function createMediaCommitChain<T>(
+  getSnapshot: () => readonly T[],
+  keyOf: (item: T) => string
+): MediaCommitChain<T> {
+  let pending: Promise<readonly T[]> | null = null;
+  // The last array this chain itself produced. Never cleared — only ever
+  // superseded by a fresh reconciled read once every id it carries shows up
+  // in `getSnapshot()` too (see reconcile()).
+  let remembered: readonly T[] | null = null;
+
+  function reconcile(): readonly T[] {
+    const fresh = getSnapshot();
+    if (!remembered) return fresh;
+    // Prefer `remembered`'s value for any id the CHAIN itself produced —
+    // not just fold in ids fresh is missing. `fresh` (getSnapshot) can
+    // contain a STALE value for an id the chain already swapped: e.g. an
+    // image stroke's optimistic (blob:) href is set via a separate, non-
+    // chain setState, and `fresh` catches up to THAT before it catches up
+    // to the chain's OWN later commit swapping it to the real href — same
+    // id, stale value. Checking "is the id present" (the previous version
+    // of this function) said "yes, already rendered" and used fresh's
+    // stale copy, silently reverting the swap — which then gets filtered
+    // out entirely as still-ephemeral at the persistence layer. `remembered`
+    // is always at least as fresh as anything the chain has itself
+    // touched, so it wins on overlap; anything fresh has that remembered
+    // doesn't (an external, non-chain edit made while idle) still comes
+    // through via the second spread.
+    const rememberedKeys = new Set(remembered.map(keyOf));
+    const notInRemembered = fresh.filter((item) => !rememberedKeys.has(keyOf(item)));
+    return [...remembered, ...notInRemembered];
+  }
+
+  const enqueue: MediaCommitChain<T>['enqueue'] = (mutate, onCommit) => {
+    const seed = pending ?? Promise.resolve(reconcile());
+    const link: Promise<readonly T[]> = seed.then((before) => {
+      const result = mutate(before);
+      if (!result) return before;
+      onCommit(result.commitBefore ?? before, result.after, result.label);
+      remembered = result.after;
+      return result.after;
+    });
+    pending = link;
+    void link.then(() => {
+      if (pending === link) pending = null;
+    });
+    return link;
+  };
+
+  return { enqueue };
+}

package/apps/studio/paths.ts

@@ -58,6 +58,16 @@ export const RUNTIME_BUNDLES_DIR: string = join(DIST_DIR, 'runtime');
  */
 export const STICKERS_DIR: string = join(DEV_SERVER_ROOT, 'stickers');
 
+/**
+ * `<DEV_SERVER_ROOT>/media/` — bundled Maude-product media (the intro
+ * showreel, DDR-166 Phase 1 T2). Same shape as `STICKERS_DIR`: ships with the
+ * `@1agh/maude` tarball (a subdir of `apps/studio`, already covered by the
+ * existing `files` entry), resolved from DEV_SERVER_ROOT per DDR-045 — this is
+ * MAUDE's OWN asset store, never the served project's `.design/assets/`, so
+ * every user sees the same intro regardless of which project is open.
+ */
+export const MEDIA_DIR: string = join(DEV_SERVER_ROOT, 'media');
+
 /**
  * Absolute path to a bundled plugin's loadable tree (`commands/`, `agents/`,
  * `skills/`, `hooks/`, `.claude-plugin/plugin.json`), or `null` when this layout

package/apps/studio/readiness.ts

@@ -14,6 +14,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { getClaudeAuthStatus } from './acp/login-state.ts';
 import { isNativePluginContext } from './acp/plugin-bootstrap.ts';
 import { resolveAdapterEntry, resolveClaudePath } from './acp/probe.ts';
 import { resolveBrowser } from './bin/_ensure-browser.mjs';
@@ -32,6 +33,19 @@ export interface ReadinessItem {
   detail: string;
   /** Copy-paste-able fix, present only when the item is not satisfied. */
   remediation?: string;
+  /** Verbatim shell command for a dedicated code-block + Copy affordance (DDR-166 T0c) — kept separate from the prose `remediation`. */
+  installCommand?: string;
+  /** UI action hint (DDR-166): 'install' renders a "Set up AI editing" button that runs the official installer then auto-chains to sign-in; 'signin' renders a "Sign in to Claude" button alone. */
+  action?: 'install' | 'signin';
+  /**
+   * DDR-166 Decision 3 (binding — a security-review-mandated control, not
+   * cosmetic): the resolved absolute path of the binary a Sign-in click is
+   * about to spawn, shown BEFORE the button so a pre-existing PATH-hijacked
+   * `claude` isn't invisible to the one human capable of noticing it's wrong.
+   */
+  resolvedPath?: string;
+  /** True when `resolvedPath` is the binary Maude itself just installed (content-pinned — see probe.ts `setTrustedClaudeBin`), not something already on the user's PATH. */
+  resolvedViaMaude?: boolean;
 }
 
 export interface ReadinessReport {
@@ -164,37 +178,101 @@ export function scanPlugins(): PluginScan {
  * (DDR-128 hardening) so this can't be turned into a spawn-storm from a drive-by page.
  */
 export async function probeReadiness(): Promise<ReadinessReport> {
-  const [claude, maude, agentBrowser] = await Promise.all([
+  let [claude, maude, agentBrowser] = await Promise.all([
     (async () => resolveClaudePath() ?? (await resolveOnPath('claude')))(),
     resolveOnPath('maude'),
     resolveOnPath('agent-browser'),
   ]);
 
+  // Deterministic E2E stub for the two claude-readiness states that are
+  // otherwise near-impossible to reproduce on a real, already-set-up dev
+  // machine (mirrors MAUDE_E2E_FAKE_GITHUB_LOGIN in oauth.rs — same problem,
+  // same shape of fix: a real state that needs a pristine/logged-out machine
+  // to occur naturally gets a narrow, explicitly-named override instead of a
+  // hand-rolled sandbox that fights the OS's own PATH resolution). Never
+  // affects real users — unset in every normal launch.
+  const e2eForce = process.env.MAUDE_E2E_FORCE_CLAUDE_STATUS;
+  // A verified, explicitly-provisioned MAUDE_CLAUDE_BIN override (T0c's
+  // install flow, once its freshness+hash check passes) must never be
+  // clobbered back to "missing"/"signed-out" by this coarser stub — mirrors
+  // the same precedence fix in probe.ts's resolveClaudePath(). Without this,
+  // the acp-cold-start scenario could never observe its OWN install actually
+  // taking effect after starting from a forced-missing state.
+  const hasVerifiedOverride =
+    !!process.env.MAUDE_CLAUDE_BIN && claude === process.env.MAUDE_CLAUDE_BIN;
+  if (e2eForce === 'missing' && !hasVerifiedOverride) claude = null;
+  else if (e2eForce === 'signed-out' && !hasVerifiedOverride) claude = claude || '/usr/bin/claude'; // present, but auth probe below is also stubbed
+
   const items: ReadinessItem[] = [];
 
+  // DDR-166 T0d — honest 3-state instead of presence-only: not installed (an
+  // "install" action, T0c — runs the same verbatim official one-liner a user
+  // would type themselves, live-verified 2026-07-13 against
+  // code.claude.com/docs/en/quickstart.md; the copy-paste command below stays
+  // as the fallback/opt-out path) / installed-but-signed-out (a "Sign in"
+  // action, T0d) / signed-in-on-subscription.
+  const authStatus =
+    e2eForce === 'signed-out' ? { loggedIn: false } : claude ? await getClaudeAuthStatus() : null;
+  const signedIn = !!authStatus?.loggedIn;
+  const offSubscription =
+    signedIn && authStatus?.apiProvider && authStatus.apiProvider !== 'firstParty';
+  // DDR-166 Decision 5 — the settings-UI opt-out (prefs.rs `claude_auto_setup`,
+  // DEFAULT ON) reaches the dev-server as an env var set fresh at each sidecar
+  // spawn. Disabled → fall back to guide-only: no automated action offered,
+  // same posture as before T0c/T0d existed (still shows the copy-paste
+  // command below, just no button).
+  const autoSetupEnabled = process.env.MAUDE_CLAUDE_AUTOSETUP_ENABLED !== '0';
   items.push({
     id: 'claude',
     label: 'Claude Code (the `claude` CLI)',
     required: true,
-    status: claude ? 'present' : 'missing',
-    detail: claude
-      ? 'Installed — AI editing drives it on your own Pro/Max subscription.'
-      : 'Not found on PATH.',
-    remediation: claude
-      ? undefined
-      : 'Install Claude Code, then run `claude` and `/login` once. AI editing runs on your own Pro/Max subscription — never API billing.',
+    status: claude && signedIn ? 'present' : 'missing',
+    detail: !claude
+      ? 'Not found on PATH.'
+      : signedIn
+        ? offSubscription
+          ? `Signed in, but not on a Claude subscription (${authStatus?.apiProvider}) — AI editing may bill metered API usage.`
+          : `Signed in${authStatus?.subscriptionType ? ` · ${authStatus.subscriptionType}` : ''} — AI editing runs on your own Pro/Max subscription.`
+        : 'Installed, but not signed in.',
+    remediation: !claude
+      ? 'Install Claude Code, then sign in. AI editing runs on your own Pro/Max subscription — never API billing.'
+      : signedIn
+        ? undefined
+        : 'Sign in to connect it to your Pro/Max subscription.',
+    installCommand: !claude ? 'curl -fsSL https://claude.ai/install.sh | bash' : undefined,
+    action: !autoSetupEnabled ? undefined : !claude ? 'install' : !signedIn ? 'signin' : undefined,
+    resolvedPath: claude ?? undefined,
+    resolvedViaMaude: !!claude && claude === process.env.MAUDE_CLAUDE_BIN,
   });
 
-  items.push({
-    id: 'maude',
-    label: 'maude CLI',
-    required: true,
-    status: maude ? 'present' : 'missing',
-    detail: maude ? 'On PATH — `/design:edit` can reach its helpers.' : 'Not found on PATH.',
-    remediation: maude
-      ? undefined
-      : 'Install it: `npm i -g @1agh/maude`. `/design:edit` shells out to `maude design …`, so it must be on PATH.',
-  });
+  // DDR-166 T0b / DDR-168 — `maude` is bundled into the packaged app (compiled
+  // via apps/desktop/scripts/build-cli-binary.mjs, shipped as `externalBin`
+  // `binaries/maude`; sidecar.rs stages it into its own narrow, single-binary
+  // PATH directory, PREPENDS that directory ahead of the rest of PATH, and sets
+  // MAUDE_BUNDLED_CLI_PATH to that exact path). Prepending makes this
+  // deterministic, not a best-effort fallback: inside the sidecar's own spawned
+  // children the bundled copy always wins PATH resolution, so `maude === bundledCliPath`
+  // is the normal case on the desktop path, not merely one possible outcome. This
+  // row disappears entirely for the end user rather than surfacing an
+  // `npm i -g` instruction for something already shipped — it's an internal
+  // plumbing detail, not a recognizable capability like the agent-browser/
+  // adapter rows below. In dev contexts where the bundling step hasn't run
+  // (a bare `bun run server.ts`, `maude design serve`), MAUDE_BUNDLED_CLI_PATH
+  // is unset and this falls through to the pre-T0b behavior unchanged.
+  const bundledCliPath = process.env.MAUDE_BUNDLED_CLI_PATH || null;
+  const maudeIsBundled = !!bundledCliPath && maude === bundledCliPath;
+  if (!maudeIsBundled) {
+    items.push({
+      id: 'maude',
+      label: 'maude CLI',
+      required: true,
+      status: maude ? 'present' : 'missing',
+      detail: maude ? 'On PATH — `/design:edit` can reach its helpers.' : 'Not found on PATH.',
+      remediation: maude
+        ? undefined
+        : 'Install it: `npm i -g @1agh/maude`. `/design:edit` shells out to `maude design …`, so it must be on PATH.',
+    });
+  }
 
   const scan = scanPlugins();
   // DDR-143 — on the native/desktop path the ACP chat session AUTO-LOADS the
@@ -206,8 +284,18 @@ export async function probeReadiness(): Promise<ReadinessReport> {
   // `design` alone — demanding a plugin the chat doesn't use would be a false red.
   // The web `maude design serve` path ships no bundle (native=false, dir null) →
   // the manual marketplace remediation still shows there.
+  //
+  // DDR-168 — `designAutoloaded` no longer requires `!scan.design`: the bundled
+  // copy is injected unconditionally now (plugin-bootstrap.ts), regardless of
+  // whether a marketplace copy is ALSO installed at the user level (the
+  // double-registration risk that used to gate this is closed structurally in
+  // bridge.ts's `options.settings.enabledPlugins` override instead). So this row
+  // reads "auto-loaded" even on a machine that separately has design@maude
+  // installed — that's the whole point: the bundled, release-matched copy is
+  // what actually runs in the chat, so the UI should say so rather than imply
+  // "ready because you already had it."
   const native = isNativePluginContext();
-  const designAutoloaded = native && DESIGN_PLUGIN_DIR !== null && !scan.design;
+  const designAutoloaded = native && DESIGN_PLUGIN_DIR !== null;
   const designReady = scan.design || designAutoloaded;
   const pluginStatus: ReadinessStatus = designReady
     ? 'present'
@@ -221,7 +309,7 @@ export async function probeReadiness(): Promise<ReadinessReport> {
     status: pluginStatus,
     detail: designReady
       ? designAutoloaded
-        ? 'Auto-loaded in the Maude chat session — nothing to install.'
+        ? 'Bundled with this app — loads automatically in the chat session.'
         : 'design@maude is installed.'
       : scan.status === 'unknown'
         ? "Couldn't read Claude Code's plugin registry — check it manually."