@1agh/maude 0.43.0 → 0.45.0

package/apps/studio/use-chrome-visibility.tsx

@@ -42,9 +42,15 @@ export function ChromeVisibilityProvider({
   children: ReactNode;
   initial?: Partial<ChromeVisibilityState>;
 }) {
+  // Defaults MUST match the app-shell's own default view-prefs (app.jsx
+  // MINIMAP_STORE / ZOOMCTL_STORE both default false) — otherwise a freshly
+  // loaded canvas shows the minimap/zoom before (or instead of, when the seed
+  // races the early inline-script `dgn:'loaded'`) the shell's OFF state is
+  // applied, so a user with both toggled off still sees them. `present` is a
+  // transient overlay, never persisted, so it stays false.
   const [state, setState] = useState<ChromeVisibilityState>({
-    minimap: initial?.minimap ?? true,
-    zoom: initial?.zoom ?? true,
+    minimap: initial?.minimap ?? false,
+    zoom: initial?.zoom ?? false,
     present: initial?.present ?? false,
   });
   const setChrome = useCallback((patch: Partial<ChromeVisibilityState>) => {

package/apps/studio/whats-new.json

@@ -1,6 +1,102 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "bring-your-brand",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Bring your existing brand into Maude",
+      "summary": "Have a logo already? Upload it from the Quick setup checklist and Maude pulls out its color palette (and any recognizable font names) to seed a new design system — nothing is applied automatically, you confirm every choice during setup. Works with SVG logos; safety-checked before anything touches your project.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-testid=\"onboarding-bring-brand\"]",
+          "title": "Bring my existing brand",
+          "body": "Upload a logo SVG to seed a new design system's colors and fonts from it."
+        }
+      ]
+    },
+    {
+      "id": "inspector-designer-mode",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "A Figma-friendly view of the CSS panel",
+      "summary": "The Inspector now speaks two languages. Advanced keeps the real CSS property names; Designer regroups the exact same controls into Figma-familiar sections — Fill, Stroke, Corner radius, Auto layout, Effects, Opacity, Text — and relabels the rows, so you can style without thinking in CSS. Flip between them from the small toggle in the panel's top-right corner, or set a default in Settings → Appearance. Same live edits underneath, and a value set in one view reads back correctly in the other. New in both views: Blur and Blend controls, plus a single 9-point pad for auto-layout alignment.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-tour=\"cp-mode\"]",
+          "title": "Advanced or Designer",
+          "body": "Toggle the CSS panel between raw property names and Figma-style vocabulary. Your choice is remembered — you can also set it in Settings → Appearance.",
+          "placement": "left",
+          "inspector": true,
+          "tab": "css",
+          "requireSelection": true
+        }
+      ]
+    },
+    {
+      "id": "watch-the-intro",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Watch the intro, right inside Maude",
+      "summary": "There's now a short product showreel (about a minute and a half) you can watch without leaving the app — Help → Watch the intro, or the same button on the welcome screen the first time you open Maude. It walks through the whole loop: a design system built from a conversation, the infinite canvas, pointing and commenting to direct an AI edit, live multiplayer, and shipping the result. Also lands as its own canvas (Maude Explainer) if you want to open it in the canvas browser like anything else.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-tour=\"help\"]",
+          "title": "Watch the intro",
+          "body": "Help → Watch the intro plays the full showreel without leaving Maude."
+        }
+      ]
+    },
+    {
+      "id": "bulk-media-insert",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Insert several photos at once",
+      "summary": "The media picker now supports multi-select — pick several photos (or a mix of photos, videos, and audio) in one go instead of one at a time. Choose whether they land inside your artboard or float on the canvas as annotations; the picker figures out the sensible default (video and audio always go on the canvas, since only images can drop into an artboard) and lets you switch. Dragging several files from Finder onto the canvas at once is also more reliable now — every dropped file lands, even in a large batch.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "ai-video-generation",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Generate video clips for your reels",
+      "summary": "The BYOK generator now makes video. Bring your own Google key and generate a clip with Veo — a text prompt (\"slow drone push over an alpine lake at dawn\"), or seed it from a still you already generated so the clip matches your hero's look. The clip lands in your assets like any other footage, and Maude treats it as first-class: when you build a reel it watches the generated clip alongside your real footage and places it as a beat, so you can fill a missing shot without hand-sourcing one. Video takes a few minutes and runs in the background — you'll get the finished clip when it's ready. Add your key under File → Settings — AI generation (⌘,); it stays on your machine.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "ai-audio-generation",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Generate music, voiceover & subtitles",
+      "summary": "The BYOK generator now does audio. Bring your own ElevenLabs key and generate a music bed, sound effects, or a text-to-speech voiceover — one key covers the whole stack — and the track lands in your assets ready to drop under a reel. Before you spend credits on a music or SFX track, Maude searches audio you've already made (and your own ElevenLabs history — re-downloading it costs nothing) and offers a match to reuse. Subtitles are free and need no key at all: `maude design transcribe` runs whisper.cpp locally on any clip and writes word-timed SRT/VTT captions. Local setup is one click — Settings → Subtitles → Download model — and Maude auto-converts video containers (no ffmpeg wrangling) and picks the model for you. You pick the subtitle engine — local whisper, ElevenLabs Scribe, or Groq — in Settings; it's an explicit choice, so Maude never silently switches to a paid cloud engine behind your back. In a reel, generated music/voiceover become layered audio tracks (the music ducks under the voice) and the subtitles become a caption track that renders right on the video. Add your keys under File → Settings — AI generation (⌘,); they're stored only on your machine.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "ai-media-generation",
+      "version": "0.44.0",
+      "date": "2026-07-14",
+      "kind": "feature",
+      "title": "Generate images with your own AI key",
+      "summary": "Bring your own Google (Nano Banana) API key and generate images right inside Maude — and the image lands straight on your canvas, not in a dead-end dialog. Use the Generate action (⌘K → \"Generate with AI\"), the command line, or just ask in the chat panel (\"generate a hero image of a mountain lake\"); the finished picture drops onto the artboard you're looking at. Add your key under File → Settings — AI generation (⌘,); it's stored only on your machine, sent straight to the provider, and never touches a canvas or your git history. Want to change a generated image? Ask to edit it (\"make the sky purple\") for a fresh AI-edited version, or fine-tune it in the Photo tab — every result is a normal asset you can place, edit, and export. Audio and video generation are on the way.",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-tour=\"menubar-file\"]",
+          "title": "AI generation settings",
+          "body": "Open File → Settings — AI generation (⌘,) to add your provider key, then Generate with AI from the ⌘K palette.",
+          "placement": "bottom"
+        }
+      ]
+    },
     {
       "id": "photo-editor",
       "version": "0.43.0",

package/apps/studio/ws.ts

@@ -222,6 +222,11 @@ export function createWs(
   // clients only — same privileged-data class as the rest of this feed.
   ctx.bus.on('export:job', (job: unknown) => broadcast({ type: 'export:job', payload: job }));
 
+  // feature-ai-media-generation (DDR-16x) — generation job queue state changes
+  // (queued → running → done/failed). Same privileged-data class + snapshot
+  // shape as export:job; the notification center reuses the export-center chrome.
+  ctx.bus.on('generate:job', (job: unknown) => broadcast({ type: 'generate:job', payload: job }));
+
   // HMR broadcaster — turns fs:any change events into `canvas-hmr` messages.
   // The iframe-side client (in _shell.html) decides reload strategy from `mode`.
   // Uses broadcastHmr so the segregated canvas origin's HMR-only sockets get it.

package/cli/bin/maude.mjs

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 import { readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
+import { resolve } from 'node:path';
+import { resolvePkgRoot } from '../lib/pkg-root.mjs';
 // maude — Maude CLI. Scaffold .ai workspace, run dev servers, manage config.
-import { fileURLToPath } from 'node:url';
 import { runUpdateCheck } from '../lib/update-check.mjs';
 
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-const CLI_ROOT = resolve(__dirname, '..');
-const PKG_ROOT = resolve(CLI_ROOT, '..');
+// DDR-166 T0b — real-disk resolution, safe inside a `bun build --compile`
+// standalone binary (see pkg-root.mjs's own doc comment for why the previous
+// `dirname(fileURLToPath(import.meta.url))` walk-up broke there).
+const PKG_ROOT = resolvePkgRoot();
 
 const COMMANDS = {
   init: () => import('../commands/init.mjs'),

package/cli/commands/design.mjs

@@ -47,6 +47,23 @@ const BIN_VERBS = new Set([
   'chat-open',
   'ensure-browser',
   'fetch-asset',
+  // DDR-167 (Phase 3 / T10). `import-asset` is the LOCAL-file sibling of the
+  // URL-only `fetch-asset`: hardened SVG ingestion (allowlist DOM-sanitize +
+  // a real-browser execution canary). PDF import is wired but not yet
+  // available — see the DDR's addendum on why the planned rasterization
+  // mechanism doesn't work under browser automation.
+  'import-asset',
+  // DDR-172 (Phase 3 / T11). `import-tokens` is the token-file sibling of
+  // `import-asset`: parses W3C design-tokens / Style-Dictionary JSON or raw
+  // CSS custom properties, maps recognized tokens onto the DS CSS-variable
+  // contract, and patches (theme-block-scoped) or scaffolds the target
+  // design system. CLI-only — no HTTP route, no in-app panel.
+  'import-tokens',
+  // DDR-173 (Phase 3 / T12). `import-brand` extracts typed palette/font
+  // cues + a hardened logo asset from an already-DDR-167-sanitized SVG for
+  // `/design:setup-ds --from-brand` — never re-reads or re-sanitizes the
+  // original brand file (Decision 2: no parallel, ungated read path).
+  'import-brand',
   // feature-photo-editor (Stage G). `photo-adjust` is the thin non-browser
   // parametric verb (curl → /_api/photo-edit). `photo-bg-remove` is the
   // client-side @imgly ML harness (throwaway proof canvas + agent-browser
@@ -60,6 +77,21 @@ const BIN_VERBS = new Set([
   // reads the clip as a file:// resource).
   'ingest-footage',
   'probe-footage',
+  // feature-ai-media-generation (Phase 0, DDR-16x). `generate` is the thin
+  // non-browser BYOK verb (curl → /_api/generate-jobs → poll → print the
+  // produced /assets/<sha8>.<ext>). The provider call happens server-side (the
+  // sidecar resolves the key from the keychain / ~/.config/maude/keys.json).
+  'generate',
+  // feature-ai-media-generation (Phase 2, DDR-164). `transcribe` is the local,
+  // no-key subtitle verb: spawn whisper.cpp on an audio/video file → SRT/VTT via
+  // the shared captions.ts reflow. No dev server; whisper.cpp is a SOFT dep with
+  // ElevenLabs Scribe / Groq Whisper as the cloud fallback.
+  'transcribe',
+  // feature-ai-media-generation (Task 2.5, DDR-164). `audio-search` is the
+  // reuse-before-you-pay verb: search the project's own generated audio + the
+  // user's ElevenLabs history before spending credits on a new music/SFX/VO
+  // track. Runs server-side (key resolved by the sidecar); needs a dev server.
+  'audio-search',
 ]);
 
 // Bin verbs that boot the dev-server (directly, or by shelling into server-up.sh).
@@ -154,6 +186,7 @@ Dev-tooling (dispatch to the dev-server bash helpers — DDR-062):
   smoke · canvas-edit · handoff · asset-sweep · visual-sanity · fetch-asset
   draw-build · draw-proof · svg-optimize · to-lottie · read-annotations · annotate
   canvas-rects · ingest-footage · probe-footage
+  generate · transcribe · audio-search
         Invoke the bundled helper of the same name. maude resolves it from its
         own package root and sets CLAUDE_PLUGIN_ROOT for the child; stdout,
         stderr, and exit code pass straight through (so command-substitution

package/cli/commands/init.mjs

@@ -6,7 +6,13 @@ import { copyTree } from '../lib/copy-tree.mjs';
 const PLACEHOLDER = 'PROJECT_NAME';
 // Files in the skeleton that contain the project-name placeholder and should
 // be templated on copy.
-const TEMPLATED = ['workflows.config.json', 'README.md', 'INDEX.md', 'release-guide.md'];
+const TEMPLATED = [
+  'workflows.config.json',
+  'README.md',
+  'INDEX.md',
+  'release-guide.md',
+  'scenario-guide.md',
+];
 
 // Per-provider command substitutions for release-guide.md. Keys map to the
 // `# CHANGELOG_PROVIDER_*_CMD` placeholders inside the skeleton's bash blocks.

package/cli/lib/gitignore-block.mjs

@@ -38,6 +38,7 @@ export function buildBlock(designRel = '.design') {
     `${root}/_preflight.json`,
     `${root}/_locator.json`, // regenerable slug→path index
     `${root}/_export-history.json`,
+    `${root}/_generate-history.json`, // AI-media generation job ledger (regenerable — feature-ai-media-generation, DDR-16x)
     // Per-machine / per-user dirs.
     `${root}/_export-jobs/`, // background-export job byte store (regenerable — feature-background-export-notification-center)
     `${root}/_state/`, // binary CRDT logs (regenerable from hub)

package/cli/lib/pkg-root.mjs

@@ -0,0 +1,107 @@
+// pkg-root.mjs — real-disk `maude` package-root resolution, safe inside a
+// `bun build --compile` standalone binary (DDR-166 T0b).
+//
+// `cli/bin/maude.mjs` originally computed PKG_ROOT via
+// `dirname(fileURLToPath(import.meta.url))` walk-up — correct for the plain
+// npm/node install, but the exact DDR-045 trap: inside a compiled binary,
+// `import.meta.url` resolves to Bun's virtual filesystem (`/$bunfs/root` on
+// POSIX, `B:/~BUN/root` on Windows), not the real on-disk location. Two
+// dev-server releases (v0.18.0/v0.18.1) shipped broken because of this exact
+// bug class before DDR-045 fixed it there. This module mirrors that fix
+// (`apps/studio/paths.ts` `resolveDevServerRoot`) for the CLI, independently
+// — not by importing paths.ts directly, to keep the CLI's compiled binary
+// decoupled from the dev-server's module graph.
+
+import { existsSync, realpathSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+function isVirtualBunfsPath(p) {
+  return p !== null && (p.startsWith('/$bunfs') || p.startsWith('B:/~BUN'));
+}
+
+/** True inside a `bun build --compile` standalone binary. Mirrors `apps/studio/paths.ts`'s `IS_COMPILED_BINARY`. */
+export function isCompiledBinary() {
+  return isVirtualBunfsPath(getImportMetaDir());
+}
+
+function getImportMetaDir() {
+  try {
+    return dirname(fileURLToPath(import.meta.url));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Anchor: `apps/studio/bin/screenshot.sh` is present in every real maude
+ * package root (dev tree, npm tarball, and the Tauri desktop `Resources/`
+ * bundle all ship it) and nowhere else — unique enough to identify the
+ * package root without also requiring `package.json` (npm tarballs can drop
+ * nested workspace `package.json` files, the exact false-negative DDR-045's
+ * own retro already documents for the dev-server's analogous check).
+ */
+export function isPkgRoot(dir) {
+  // Both anchors, not just one: `apps/studio/bin/screenshot.sh` ALONE is a
+  // false-positive inside the Tauri desktop build — `stage-resources.mjs`
+  // stages a full working copy of `apps/studio` (dev-server + bin scripts)
+  // into `target/debug/apps/studio/` for the sidecar's own runtime
+  // resolution, but that staged copy has no `cli/` — walking up from a
+  // compiled `maude` binary placed at `target/debug/maude` matched THAT
+  // copy first and stopped one level too early (caught by live testing
+  // against the real Tauri build, not a synthetic path). `cli/commands/
+  // design.mjs` only exists in a genuine package root.
+  return (
+    existsSync(join(dir, 'apps', 'studio', 'bin', 'screenshot.sh')) &&
+    existsSync(join(dir, 'cli', 'commands', 'design.mjs'))
+  );
+}
+
+/**
+ * Resolve maude's own package root — real disk path, safe inside a compiled
+ * binary. Priority: (0) explicit override, (1) dev-mode `import.meta.url`
+ * (plain `node`/`bun run cli/bin/maude.mjs`), (2) compiled-binary walk-up
+ * from `process.execPath` (matches the npm-install layout: binary at
+ * `@1agh/maude-<platform>/maude` walks up to `@1agh/maude/`, which ships
+ * `apps/studio/` via `package.json` `files`; matches the Tauri desktop layout
+ * too, where the bundled `maude` binary and the `Resources/apps/studio`
+ * bundle share a common ancestor within the walk-up depth).
+ */
+export function resolvePkgRoot() {
+  const override = process.env.MAUDE_PKG_ROOT;
+  if (override && !isVirtualBunfsPath(override) && isPkgRoot(override)) return override;
+
+  const importDir = getImportMetaDir();
+  if (importDir && !isVirtualBunfsPath(importDir)) {
+    // Dev-mode: cli/bin/maude.mjs is 2 levels under the package root.
+    const candidate = join(importDir, '..', '..');
+    if (isPkgRoot(candidate)) return candidate;
+  }
+
+  // `process.execPath` is the path AS INVOKED — when launched through a
+  // symlink (DDR-166 T0b stages exactly this: sidecar.rs's narrow bin-link
+  // dir), it's the symlink's own path, not the real target, and walking up
+  // from there (e.g. ~/Library/Caches/…/bin-link/) never reaches the repo
+  // root. Dereference first. Falls back to the raw path if the file somehow
+  // doesn't exist (shouldn't happen — we ARE that running process).
+  let cur;
+  try {
+    cur = dirname(realpathSync(process.execPath));
+  } catch {
+    cur = dirname(process.execPath);
+  }
+  for (let i = 0; i < 10; i++) {
+    if (isPkgRoot(cur)) return cur;
+    const parent = dirname(cur);
+    if (parent === cur) break;
+    cur = parent;
+  }
+
+  // Final fallback for unanchored test contexts — callers should expect
+  // existsSync-based lookups to fail and surface a clear error, same
+  // contract as paths.ts's own resolver. Never join a VIRTUAL importDir here
+  // (`/$bunfs/root/../..` collapses to `/` via path.join — a real bug an
+  // earlier draft of this function had, caught by testing against an
+  // unanchored compile output before wiring this into Tauri).
+  return dirname(process.execPath);
+}

package/cli/lib/pkg-root.test.mjs

@@ -0,0 +1,79 @@
+// pkg-root.mjs tests (DDR-166 T0b).
+//
+// The regression this locks down: a naive single-anchor check
+// (`apps/studio/bin/screenshot.sh` alone) false-positives inside the Tauri
+// desktop build, because `stage-resources.mjs` stages a full working copy of
+// `apps/studio` into `target/debug/apps/studio/` for the sidecar's own
+// runtime resolution — that staged copy has no `cli/`, so a compiled `maude`
+// binary walking up from `target/debug/maude` matched it and stopped one
+// level too early, resolving PKG_ROOT to `target/debug` instead of the real
+// repo root. Caught by live testing against the real Tauri build (not a
+// synthetic path), not by static review — worth a regression test.
+
+import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+
+import { isPkgRoot, resolvePkgRoot } from './pkg-root.mjs';
+
+function makeRealRoot(base) {
+  mkdirSync(join(base, 'apps', 'studio', 'bin'), { recursive: true });
+  writeFileSync(join(base, 'apps', 'studio', 'bin', 'screenshot.sh'), '#!/bin/sh\n');
+  mkdirSync(join(base, 'cli', 'commands'), { recursive: true });
+  writeFileSync(join(base, 'cli', 'commands', 'design.mjs'), 'export const run = () => {};\n');
+}
+
+test('isPkgRoot requires BOTH anchors — the staged-resources false-positive is rejected', () => {
+  const tmp = mkdtempSync(join(tmpdir(), 'maude-pkgroot-'));
+  try {
+    // The exact shape of the bug: apps/studio/bin/screenshot.sh present
+    // (mirrors stage-resources.mjs's staged copy), no cli/ at all.
+    mkdirSync(join(tmp, 'apps', 'studio', 'bin'), { recursive: true });
+    writeFileSync(join(tmp, 'apps', 'studio', 'bin', 'screenshot.sh'), '#!/bin/sh\n');
+    assert.equal(isPkgRoot(tmp), false);
+
+    // cli/ alone, no apps/studio — also not a real root.
+    const tmp2 = mkdtempSync(join(tmpdir(), 'maude-pkgroot-'));
+    try {
+      mkdirSync(join(tmp2, 'cli', 'commands'), { recursive: true });
+      writeFileSync(join(tmp2, 'cli', 'commands', 'design.mjs'), '');
+      assert.equal(isPkgRoot(tmp2), false);
+    } finally {
+      rmSync(tmp2, { recursive: true, force: true });
+    }
+
+    // Both anchors together — a genuine package root.
+    makeRealRoot(tmp);
+    assert.equal(isPkgRoot(tmp), true);
+  } finally {
+    rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+test('resolvePkgRoot honors MAUDE_PKG_ROOT only when it actually satisfies both anchors', () => {
+  const real = mkdtempSync(join(tmpdir(), 'maude-pkgroot-real-'));
+  const fake = mkdtempSync(join(tmpdir(), 'maude-pkgroot-fake-'));
+  const prevOverride = process.env.MAUDE_PKG_ROOT;
+  try {
+    makeRealRoot(real);
+    // Fake: only the staged-resources-shaped anchor, same false-positive shape.
+    mkdirSync(join(fake, 'apps', 'studio', 'bin'), { recursive: true });
+    writeFileSync(join(fake, 'apps', 'studio', 'bin', 'screenshot.sh'), '#!/bin/sh\n');
+
+    process.env.MAUDE_PKG_ROOT = real;
+    assert.equal(resolvePkgRoot(), real);
+
+    process.env.MAUDE_PKG_ROOT = fake;
+    // Falls through past the (rejected) override to whatever the real
+    // walk-up finds in THIS test process — just assert it's NOT the fake
+    // dir, since accepting it would be exactly the regression.
+    assert.notEqual(resolvePkgRoot(), fake);
+  } finally {
+    if (prevOverride === undefined) delete process.env.MAUDE_PKG_ROOT;
+    else process.env.MAUDE_PKG_ROOT = prevOverride;
+    rmSync(real, { recursive: true, force: true });
+    rmSync(fake, { recursive: true, force: true });
+  }
+});

package/cli/lib/reconstruct-toolset.test.mjs

@@ -0,0 +1,194 @@
+// DDR-174 regression guard (T15).
+//
+// The whole security architecture of `/design:import --reconstruct` rests on
+// ONE fact: every agent turn that ever reads the untrusted source image —
+// `reconstruct-agent` (authoring) AND `reconstruct-critic` (the reality-check
+// comparator) — has `tools: Read, Write, Glob, Grep` and NEVER `Bash`,
+// `WebSearch`, or `WebFetch`. DDR-174's own Consequences section calls for
+// exactly this test: "a targeted grep-based test mirroring
+// plugin-cli-reachability.test.mjs's pattern should assert BOTH the authoring
+// agent's AND the comparator agent's frontmatter never gain
+// Bash/WebSearch/WebFetch, not just this DDR's prose." A future maintainer
+// "helpfully" widening either agent's toolset (e.g. "just give it Bash so it
+// can screenshot itself") would silently reopen DDR-174's entire closure —
+// this fails loudly instead.
+
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { test } from 'node:test';
+
+const AGENTS = [
+  'plugins/design/agents/reconstruct-agent.md',
+  'plugins/design/agents/reconstruct-critic.md',
+];
+
+const FRONTMATTER_RE = /^---\n([\s\S]*?)\n---/;
+
+function readFrontmatter(path) {
+  const text = readFileSync(path, 'utf8');
+  const fm = FRONTMATTER_RE.exec(text);
+  assert.ok(fm, `${path}: no frontmatter block found`);
+  return fm[1];
+}
+
+function readToolsLine(path) {
+  const fm = readFrontmatter(path);
+  const toolsLine = fm.split('\n').find((l) => l.startsWith('tools:'));
+  assert.ok(toolsLine, `${path}: frontmatter has no tools: line`);
+  return toolsLine;
+}
+
+for (const path of AGENTS) {
+  test(`${path}: tools: line never grants Bash`, () => {
+    const line = readToolsLine(path);
+    assert.ok(
+      !/\bBash\b/.test(line),
+      `${path} declares Bash — this reopens DDR-174's core closure (the agent reads an untrusted image and must never hold a shell). Line: ${line}`
+    );
+  });
+
+  test(`${path}: tools: line never grants WebSearch or WebFetch`, () => {
+    const line = readToolsLine(path);
+    assert.ok(
+      !/\bWebSearch\b/.test(line) && !/\bWebFetch\b/.test(line),
+      `${path} declares WebSearch/WebFetch — DDR-174 requires these agents have no tool call that reaches the network. Line: ${line}`
+    );
+  });
+
+  test(`${path}: tools: line is exactly Read, Write, Glob, Grep`, () => {
+    const line = readToolsLine(path);
+    const tools = line
+      .replace(/^tools:\s*/, '')
+      .split(',')
+      .map((t) => t.trim())
+      .filter(Boolean);
+    assert.deepEqual(
+      [...tools].sort(),
+      ['Glob', 'Grep', 'Read', 'Write'],
+      `${path}: expected exactly Read/Write/Glob/Grep per DDR-174 Decision 1, got: ${line}`
+    );
+  });
+
+  // DDR-174 Addendum (post-implementation adversarial review) — Write has no
+  // path restriction (Claude Code has no per-subagent path-scoping mechanism,
+  // verified authoritatively, not assumed) and the only real closure for a
+  // non-bypassPermissions session is a human approval prompt on any write.
+  // `permissionMode: default` is what makes that prompt happen instead of
+  // silently inheriting the parent session's (possibly bypassPermissions)
+  // mode. A future maintainer removing this line silently re-widens the
+  // agent's effective write reach for every downstream consumer NOT running
+  // bypassPermissions.
+  test(`${path}: frontmatter declares permissionMode: default (DDR-174 Addendum)`, () => {
+    const fm = readFrontmatter(path);
+    const line = fm.split('\n').find((l) => l.startsWith('permissionMode:'));
+    assert.ok(
+      line,
+      `${path}: missing permissionMode: default — without it this agent silently inherits the parent session's permission mode (e.g. bypassPermissions), losing the one real per-write approval gate available for its unrestricted Write tool (DDR-174 Addendum)`
+    );
+    assert.equal(
+      line.replace(/^permissionMode:\s*/, '').trim(),
+      'default',
+      `${path}: permissionMode must be exactly "default" (prompts on every write), not a looser mode. Line: ${line}`
+    );
+  });
+}
+
+test('import.md diff-check is whole-repo scoped, not just $DESIGN_ROOT (DDR-174 Addendum)', () => {
+  // The first implementation scoped `git status --porcelain -- "$DESIGN_ROOT"`,
+  // which made a write to .claude/settings.json, CLAUDE.md, or plugins/**
+  // structurally invisible to the check — an adversarial review built a full
+  // exploit chain out of exactly that gap. Assert the pathspec was actually
+  // widened, not just documented as widened in prose.
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  assert.ok(
+    !/git -C "\$REPO" status --porcelain -- "\$DESIGN_ROOT"/.test(importMd),
+    'import.md must NOT scope the diff-check to $DESIGN_ROOT only — this was the exact gap the DDR-174 Addendum closes (a write outside $DESIGN_ROOT, e.g. to .claude/settings.json, would be invisible to a $DESIGN_ROOT-scoped check)'
+  );
+  const wholeRepoOccurrences = (importMd.match(/git -C "\$REPO" status --porcelain\b/g) || [])
+    .length;
+  assert.ok(
+    wholeRepoOccurrences >= 2,
+    `import.md must run an UNSCOPED \`git -C "$REPO" status --porcelain\` for both the BEFORE (step 4) and AFTER (step 5b) snapshots — found ${wholeRepoOccurrences} occurrence(s)`
+  );
+});
+
+test('import.md snapshots the two well-known global Claude Code config paths (DDR-174 Addendum)', () => {
+  // A repo-scoped git diff can never see $HOME/.claude/** — these are the two
+  // specific files an adversarial review named as attack targets (a planted
+  // hook, or a poisoned global CLAUDE.md loaded into every future session).
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  assert.ok(
+    importMd.includes('$HOME/.claude/settings.json') &&
+      importMd.includes('$HOME/.claude/CLAUDE.md'),
+    'import.md must snapshot $HOME/.claude/settings.json and $HOME/.claude/CLAUDE.md before/after each round and hard-fail on any change (DDR-174 Addendum) — these are outside any repo-scoped diff check'
+  );
+});
+
+test('import.md stat calls are portable (GNU-first, BSD-fallback), not BSD-only (DDR-174 Addendum confirmation pass)', () => {
+  // The first Addendum revision used BSD-only `stat -f` unconditionally — it
+  // silently no-ops on Linux (a platform this project ships a .deb for),
+  // because GNU `stat -f` means something else entirely and errors out,
+  // swallowed by the trailing `2>/dev/null`. Both empty strings compare
+  // equal, so the check trivially "passes" without ever having checked
+  // anything. Assert every stat call tries GNU syntax (`stat -c`) first.
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  // Only scan actual shell inside fenced ```bash blocks — prose elsewhere
+  // legitimately mentions `stat -f` by name when explaining the old bug.
+  const codeBlocks = [...importMd.matchAll(/```bash\n([\s\S]*?)```/g)].map((m) => m[1]).join('\n');
+  const bareStatF = codeBlocks.match(/(?<!\|\| )\bstat -f\b/g) || [];
+  assert.deepEqual(
+    bareStatF,
+    [],
+    `import.md has a \`stat -f\` call in executable shell with no \`stat -c\` GNU fallback tried first — this silently no-ops on Linux (DDR-174 Addendum confirmation-pass finding). Found ${bareStatF.length} bare occurrence(s).`
+  );
+  const statCOccurrences = (codeBlocks.match(/stat -c '/g) || []).length;
+  assert.ok(
+    statCOccurrences >= 4,
+    `expected at least 4 GNU-first \`stat -c\` attempts (2 for the non-git repo-wide fallback, 2 for the global-config snapshot) — found ${statCOccurrences}`
+  );
+});
+
+test('import.md non-git fallback excludes _history/ (DDR-174 Addendum confirmation pass)', () => {
+  // The reconstruct loop writes its own screenshots/verdict files under
+  // _history/_reconstruct/<slug>/ every round. A git-repo target gets this
+  // excluded for free via .gitignore; the non-git `find`-based fallback has
+  // no such filter and would false-positive-abort on its own round-1 output
+  // the moment round 2's diff check runs, in a non-git target repo.
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  const findOccurrences = importMd.match(/find "\$REPO" -type f[^\n]*/g) || [];
+  assert.ok(
+    findOccurrences.length >= 2,
+    'expected the non-git fallback find command in both step 4 and step 5b'
+  );
+  for (const line of findOccurrences) {
+    assert.ok(
+      line.includes("-not -path '*/_history/*'"),
+      `non-git fallback find command must exclude _history/ (its own round-N artifacts) or every multi-round run in a non-git target repo false-positive-aborts: ${line}`
+    );
+  }
+});
+
+test('import.md uses mktemp for the _active.json patch, not a fixed /tmp filename (DDR-174 Addendum)', () => {
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  assert.ok(
+    !/\/tmp\/active\.json\.tmp/.test(importMd),
+    'import.md must not use a fixed, predictable /tmp filename for the _active.json patch — a symlink race target on a shared machine (DDR-174 Addendum adversarial finding)'
+  );
+  assert.ok(/mktemp/.test(importMd), 'import.md must use mktemp for its temp file(s)');
+});
+
+test('design-critic.md is never repurposed as the reconstruct comparator (DDR-174 Decision 1 Round-2)', () => {
+  // The comparator must be reconstruct-critic (Bash-free), never the default
+  // Bash-capable design-critic — assert import.md's orchestrator spawns the
+  // dedicated agent, not design-critic, for the reality-check step.
+  const importMd = readFileSync('plugins/design/commands/import.md', 'utf8');
+  const reconstructSection = importMd.slice(importMd.indexOf('## `--reconstruct'));
+  assert.ok(
+    reconstructSection.includes('design:reconstruct-critic'),
+    'import.md --reconstruct mode must spawn design:reconstruct-critic for the reality-check step'
+  );
+  assert.ok(
+    !/subagent_type:\s*"design:design-critic"/.test(reconstructSection),
+    'import.md --reconstruct mode must NOT spawn the default design-critic as its comparator (DDR-174 Decision 1 Round-2) — it is Bash-capable and reopens the trifecta this DDR closes'
+  );
+});

package/cli/lib/update-check.mjs

@@ -15,6 +15,7 @@ import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { isCompiledBinary } from './pkg-root.mjs';
 
 const PKG_NAME = '@1agh/maude';
 const REGISTRY_URL = `https://registry.npmjs.org/${PKG_NAME}/latest`;
@@ -31,6 +32,13 @@ function shouldSkip() {
   if (process.env.NO_UPDATE_NOTIFIER) return true;
   if (process.env.CI) return true;
   if (!process.stderr.isTTY) return true;
+  // DDR-166 T0b — a Tauri-bundled `maude` binary updates via the app's own
+  // auto-updater (DDR-126), not `npm i -g @1agh/maude@latest`; the notice
+  // would be actively wrong advice. Also sidesteps spawnDetachedRefresh()'s
+  // self-respawn, which re-invokes `import.meta.url` as a script path — a
+  // real file:// path in dev/node, but Bun's virtual `/$bunfs/root` inside
+  // this exact compiled binary (DDR-045-class trap).
+  if (isCompiledBinary()) return true;
   return false;
 }