@1agh/maude 0.45.2 → 0.47.0

package/apps/studio/http.ts

@@ -40,6 +40,12 @@ import {
   sanitizeReuseText,
 } from './generation/audio-library.ts';
 import { localizeGenAsset } from './generation/download.ts';
+import {
+  downloadGemmaModel,
+  ffmpegAvailable,
+  listGemmaModels,
+  mlxVlmAvailable,
+} from './generation/gemma-models.ts';
 import { type GenerationJobQueue, GenerationQueueFullError } from './generation/jobs.ts';
 import {
   configuredProviders,
@@ -49,8 +55,11 @@ import {
   setProviderKey,
 } from './generation/keys.ts';
 import {
+  isKeyframeEngine,
   isTranscriptionProvider,
+  readKeyframeEngine,
   readTranscriptionProvider,
+  writeKeyframeEngine,
   writeTranscriptionProvider,
 } from './generation/prefs.ts';
 import {
@@ -691,6 +700,12 @@ export function createHttp(
     error?: string;
   } | null = null;
 
+  // feature-scene-aware-keyframes — in-flight Gemma-model download state, polled by
+  // the Settings "Scene-aware keyframes" card via GET /_api/generate/keyframe-model.
+  // Closure-scoped: one server, one download.
+  let keyframeDownload: { id: string; received: number; total: number; error?: string } | null =
+    null;
+
   // Cache invalidation — when canvas-lib changes, every cached canvas bundle
   // is stale because canvas-lib is inlined into each one via the resolver
   // plugin. Drop the whole cache so the next request rebuilds with the fresh
@@ -2206,6 +2221,70 @@ export function createHttp(
       );
     },
 
+    '/_api/convert-to-absolute': async (req: Request) => {
+      // feature-4 T8 (convert-to-absolute, DDR-188) — "Remove auto layout": POST
+      // { canvas, containerId, containerIdIndex?, containerSetRelative,
+      //   children: [{ id, idIndex?, left, top, width, height }] } →
+      // api.convertChildrenToAbsoluteOp. ONE whole-file undo seq. MAIN-ORIGIN
+      // ONLY (absent from both allowlists); sameOriginWrite + loopback-Host gated
+      // — same DDR-054 posture as /_api/insert-element.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{
+        canvas?: unknown;
+        containerId?: unknown;
+        containerIdIndex?: unknown;
+        containerSetRelative?: unknown;
+        allowShared?: unknown;
+        children?: unknown;
+        containers?: unknown;
+        dissolve?: unknown;
+      }>(req, 256 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.convertChildrenToAbsoluteOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    '/_api/detach-component': async (req: Request) => {
+      // feature-4 detach-component (2026-07-19) — POST { canvas, id, idIndex? }
+      // → api.detachComponentOp (clone definition + repoint this usage; one
+      // whole-file undo seq). MAIN-ORIGIN ONLY; sameOriginWrite + loopback-Host
+      // gated — same DDR-054 posture as the other structural writes.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{ canvas?: unknown; id?: unknown; idIndex?: unknown }>(
+        req,
+        8 * 1024
+      );
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.detachComponentOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, detachedName: result.detachedName, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_api/duplicate-element': async (req: Request) => {
       // Cmd+D (Task L3) — duplicate an element (a copy as the next sibling). POST
       // { canvas, id, idIndex? } → api.duplicateElementOp. Whole-file undo seq.
@@ -2265,6 +2344,38 @@ export function createHttp(
       );
     },
 
+    '/_api/duplicate-artboard': async (req: Request) => {
+      // feature-3-web-artboards T3 — "Duplicate at width…". POST
+      // { canvas, artboardId, width } → api.duplicateArtboardOp (clones the
+      // artboard as the next sibling with a suffixed id/label + the new
+      // width; every other prop, incl. kind/guides/print, carries over
+      // verbatim). Whole-file undo seq. MAIN-ORIGIN ONLY (absent from both
+      // allowlists); sameOriginWrite + loopback-Host gated, same posture as
+      // /_api/insert-artboard above.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{
+        canvas?: unknown;
+        artboardId?: unknown;
+        width?: unknown;
+      }>(req, 8 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.duplicateArtboardOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, artboardId: result.artboardId, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_api/assets': async (req: Request) => {
       // Stage F1 (feature-element-editing-robustness) — list content-addressed
       // image/video assets under <designRoot>/assets/ for the AssetPicker (Replace
@@ -2325,6 +2436,28 @@ export function createHttp(
       return Response.json(result, { headers: { 'Cache-Control': 'no-store' } });
     },
 
+    '/_api/component-map': async (req: Request) => {
+      // feature-4 T7a — Layers-panel purple instance rows. GET ?canvas →
+      // { ok, map: { [cdId]: { component, root, usages } } }. READ-only parse
+      // (same posture as /_api/edit-scope). MAIN-ORIGIN ONLY: absent from
+      // CANVAS_SAFE_API + startCanvasServer routes (DDR-054); loopback-Host
+      // gated; no sameOriginWrite (GET).
+      if (req.method !== 'GET') return new Response('Method not allowed', { status: 405 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const url = new URL(req.url);
+      const result = await api.componentMapOp({
+        canvas: url.searchParams.get('canvas') ?? undefined,
+      });
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(result, { headers: { 'Cache-Control': 'no-store' } });
+    },
+
     '/_api/resize-artboard': async (req: Request) => {
       // Stage D4 — free-hand artboard resize. POST { canvas, artboardId, width?,
       // height? } → api.resizeArtboardOp (writes the NUMERIC width/height props on
@@ -2421,6 +2554,98 @@ export function createHttp(
       );
     },
 
+    '/_api/set-artboard-kind': async (req: Request) => {
+      // feature-1-artboard-kinds-foundation, T8. POST { canvas, artboardId,
+      // kind: 'digital'|'print'|'web'|'video'|null } → api.setArtboardKindOp.
+      // `null` clears the explicit prop back to the implicit default. Whole-
+      // file undo seq. MAIN-ORIGIN ONLY; same gate pair as set-artboard-style
+      // (the kind-switch surfaces — context menu, Inspector — are shell UI,
+      // never reachable from the untrusted canvas origin).
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{
+        canvas?: unknown;
+        artboardId?: unknown;
+        kind?: unknown;
+      }>(req, 2 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.setArtboardKindOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    '/_api/set-artboard-guides': async (req: Request) => {
+      // feature-1-artboard-kinds-foundation, T5. POST { canvas, artboardId,
+      // guides: {...}|null } → api.setArtboardGuidesOp. REPLACE-whole-prop
+      // (see applySetArtboardGuides doc comment) — the caller sends the full
+      // merged object, not a delta. MAIN-ORIGIN ONLY; same gate pair as
+      // set-artboard-style.
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{
+        canvas?: unknown;
+        artboardId?: unknown;
+        guides?: unknown;
+      }>(req, 8 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.setArtboardGuidesOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
+    '/_api/set-artboard-print': async (req: Request) => {
+      // feature-2-print-artboards T2. POST { canvas, artboardId, print:
+      // {paper, orientation?, bleedMm?, marginsMm?}|null } → api.setArtboardPrintOp.
+      // REPLACE-whole-prop (see applySetArtboardPrint's own doc comment) — the
+      // caller sends the full merged object, not a delta. MAIN-ORIGIN ONLY;
+      // same gate pair as set-artboard-guides (Inspector picker is shell UI,
+      // never reachable from the untrusted canvas origin).
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const body = await readJson<{
+        canvas?: unknown;
+        artboardId?: unknown;
+        print?: unknown;
+      }>(req, 2 * 1024);
+      if (!body) return new Response('body required', { status: 400 });
+      const result = await api.setArtboardPrintOp(body);
+      if (!result.ok) {
+        return Response.json(
+          { ok: false, error: result.error },
+          { status: result.status, headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      return Response.json(
+        { ok: true, seq: result.seq },
+        { status: 200, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_api/delete-artboard': async (req: Request) => {
       // Delete an artboard by its `id` prop (Backspace / context-menu on a frame).
       // POST { canvas, artboardId } → api.deleteArtboardOp (removes the
@@ -2942,20 +3167,38 @@ export function createHttp(
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
       if (req.method === 'GET') {
         return Response.json(
-          { transcriptionProvider: readTranscriptionProvider(ctx.paths.repoRoot) },
+          {
+            transcriptionProvider: readTranscriptionProvider(ctx.paths.repoRoot),
+            keyframeEngine: readKeyframeEngine(ctx.paths.repoRoot),
+          },
           { headers: { 'Cache-Control': 'no-store' } }
         );
       }
       if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
       if (!sameOriginWrite(req))
         return new Response('cross-origin write rejected', { status: 403 });
-      const body = await readJson<{ transcriptionProvider?: unknown }>(req, 4 * 1024);
-      const provider = body?.transcriptionProvider;
-      if (!isTranscriptionProvider(provider))
-        return new Response('transcriptionProvider must be whisper|elevenlabs|groq', {
-          status: 400,
-        });
+      const body = await readJson<{ transcriptionProvider?: unknown; keyframeEngine?: unknown }>(
+        req,
+        4 * 1024
+      );
+      // The panel POSTs ONE pref at a time (transcription engine OR keyframe engine).
       try {
+        if ('keyframeEngine' in (body ?? {})) {
+          const engine = body?.keyframeEngine;
+          if (!isKeyframeEngine(engine))
+            return new Response('keyframeEngine must be auto|gemma|ffmpeg|blind', { status: 400 });
+          await writeKeyframeEngine(ctx.paths.repoRoot, engine);
+          reloadConfig(ctx);
+          return Response.json(
+            { keyframeEngine: engine },
+            { headers: { 'Cache-Control': 'no-store' } }
+          );
+        }
+        const provider = body?.transcriptionProvider;
+        if (!isTranscriptionProvider(provider))
+          return new Response('transcriptionProvider must be whisper|elevenlabs|groq', {
+            status: 400,
+          });
         await writeTranscriptionProvider(ctx.paths.repoRoot, provider);
         reloadConfig(ctx);
         return Response.json(
@@ -3177,6 +3420,87 @@ export function createHttp(
       );
     },
 
+    // feature-scene-aware-keyframes — managed local Gemma-4 MLX scout models: GET
+    // lists the registry + which are downloaded + any in-flight download + the two
+    // availability signals (mlx-vlm runtime, ffmpeg) the Settings card needs to say
+    // which tier will run; POST {id} downloads one via huggingface_hub (gated on
+    // mlx-vlm being installed — the model is useless without it). MAIN-ORIGIN ONLY.
+    '/_api/generate/keyframe-model': async (req: Request) => {
+      if (!isLoopbackHost(req.headers.get('host')))
+        return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      if (req.method === 'GET') {
+        // The GET builds availability by spawning subprocesses (import mlx_vlm is
+        // heavy). Gate it same-origin so a cross-origin no-cors flood can't drive a
+        // spawn-storm against the loopback server (DDR-183 security finding — the
+        // sibling audio-search GET added this guard for the same reason). The probes
+        // are also TTL-cached in gemma-models.ts as defence-in-depth.
+        if (!sameOriginRead(req))
+          return new Response('cross-origin read rejected', { status: 403 });
+        return Response.json(
+          {
+            models: listGemmaModels(),
+            downloading: keyframeDownload,
+            mlxVlmAvailable: mlxVlmAvailable(),
+            ffmpegAvailable: ffmpegAvailable(),
+          },
+          { headers: { 'Cache-Control': 'no-store' } }
+        );
+      }
+      if (req.method === 'DELETE') {
+        // Free a wedged download slot (a stalled HF connection) without waiting out
+        // the 60-min abort timeout (DDR-183 F4). Same-origin write-gated.
+        if (!sameOriginWrite(req))
+          return new Response('cross-origin write rejected', { status: 403 });
+        keyframeDownload = null;
+        return Response.json({ cancelled: true }, { headers: { 'Cache-Control': 'no-store' } });
+      }
+      if (req.method !== 'POST') return new Response('Method not allowed', { status: 405 });
+      if (!sameOriginWrite(req))
+        return new Response('cross-origin write rejected', { status: 403 });
+      if (!mlxVlmAvailable())
+        return new Response(
+          'mlx-vlm not installed — the Gemma scout needs an Apple-Silicon Mac + `pip install mlx-vlm`.',
+          {
+            status: 400,
+          }
+        );
+      const body = await readJson<{ id?: unknown }>(req, 4 * 1024);
+      const id = typeof body?.id === 'string' ? body.id : '';
+      if (!listGemmaModels().some((m) => m.id === id))
+        return new Response('unknown model id', { status: 400 });
+      if (keyframeDownload && !keyframeDownload.error)
+        return new Response(`a download is already in progress (${keyframeDownload.id})`, {
+          status: 409,
+        });
+      keyframeDownload = { id, received: 0, total: 0 };
+      void downloadGemmaModel(
+        id,
+        (received, total) => {
+          if (keyframeDownload && keyframeDownload.id === id) {
+            keyframeDownload.received = received;
+            keyframeDownload.total = total;
+          }
+        },
+        AbortSignal.timeout(60 * 60_000) // multi-GB snapshots on a slow link
+      )
+        .then(() => {
+          if (keyframeDownload?.id === id) keyframeDownload = null;
+        })
+        .catch((err) => {
+          if (keyframeDownload?.id === id)
+            keyframeDownload = {
+              id,
+              received: keyframeDownload.received,
+              total: keyframeDownload.total,
+              error: err instanceof Error ? err.message : 'download failed',
+            };
+        });
+      return Response.json(
+        { started: id },
+        { status: 202, headers: { 'Cache-Control': 'no-store' } }
+      );
+    },
+
     '/_canvas-state': async (req: Request) => {
       const url = new URL(req.url);
       if (req.method === 'GET') {

package/apps/studio/input-router.tsx

@@ -64,6 +64,12 @@ export function crossedDragThreshold(
  * can grab them natively.
  */
 export type Tool =
+  // feature-4 (browse/move split) — `browse` is the BOOT default: a pure
+  // native pass-through so a freshly-opened mock stays ALIVE (buttons click,
+  // links follow, inputs focus). It carries ZERO select machinery — the router
+  // returns `no-op` for every browse-tool pointer event so descendants see them
+  // untouched. Pressing V flips to `move` (the select tool). See DDR-187.
+  | 'browse'
   | 'move'
   | 'hand'
   | 'comment'
@@ -113,9 +119,12 @@ export type RouterAction =
       /**
        * `true` resolves to the deepest descendant under the cursor (Cmd-held
        * mode). `false` resolves to the topmost interesting ancestor (top mode).
-       * Phase 4.1 Move-tool selection always uses deep=true — bare clicks
-       * are passthrough (no select), and the only entry points are Cmd
-       * (replace deep) and Cmd+Shift (add deep).
+       * feature-4 (browse/move split, DDR-187) — the Move (select) tool now
+       * fires the FULL Figma ladder: a BARE click selects the TOP-level object
+       * (`deep:false`), Cmd selects the DEEPEST element (`deep:true`), Shift
+       * adds, Cmd+Shift adds-deep. (Pre-feature-4 Move-tool select was
+       * Cmd-only and always deep; bare clicks were passthrough — that role now
+       * belongs to the `browse` tool, which never selects at all.)
        */
       deep: boolean;
       clientX: number;
@@ -210,6 +219,19 @@ export function classify(input: ClassifyInput): RouterAction {
     if (isAnnotationTool(input.activeTool)) return { kind: 'no-op' };
     // Hand tool: drag pan is owned by useViewportController; no hover paint.
     if (input.activeTool === 'hand') return { kind: 'no-op' };
+    // Browse tool (feature-4 boot default): pass-through — no hover halo,
+    // native interactions flow. Cmd-held hover previews the deepest element
+    // (the escape-hatch select affordance, mirroring the old move-tool
+    // behavior); bare hover stays native.
+    if (input.activeTool === 'browse') {
+      if (!metaOrCtrl(input)) return { kind: 'no-op' };
+      return {
+        kind: 'hover',
+        deep: true,
+        clientX: input.clientX ?? 0,
+        clientY: input.clientY ?? 0,
+      };
+    }
     // Comment tool: always paint a preview halo on the deepest element under
     // cursor — that's the element the user is about to comment on. Comment
     // pin attachment is to the same element they were hovering.
@@ -221,12 +243,12 @@ export function classify(input: ClassifyInput): RouterAction {
         clientY: input.clientY ?? 0,
       };
     }
-    // Move tool: bare hover does nothing (native interactions pass through);
-    // Cmd-held hover paints a halo on the deepest element (preview).
-    if (!metaOrCtrl(input)) return { kind: 'no-op' };
+    // Move (select) tool: paint a preview halo of exactly what a click would
+    // select — the TOP-level object on a bare hover (Figma's hover outline),
+    // the DEEPEST element while Cmd is held (deep-select preview).
     return {
       kind: 'hover',
-      deep: true,
+      deep: metaOrCtrl(input),
       clientX: input.clientX ?? 0,
       clientY: input.clientY ?? 0,
     };
@@ -267,17 +289,38 @@ export function classify(input: ClassifyInput): RouterAction {
     // the controller's pointerdown listener on the same host claims the drag.
     if (input.activeTool === 'hand') return { kind: 'no-op' };
 
-    // Move tool. Selection ONLY fires with Cmd / Cmd+Shift. Bare clicks and
-    // Shift-without-Cmd pass through so native canvas interactions (button
-    // presses, link clicks, input focus) still work — exactly the same as
-    // pre-Phase-4.1 behavior for everything except Cmd-modified gestures.
+    // Browse tool (feature-4 boot default): bare/Shift left-clicks pass
+    // through so the mock stays alive (a button press fires, a link follows,
+    // an input focuses). Cmd/Ctrl+click is the ESCAPE HATCH (user steer
+    // 2026-07-19): it selects the deepest element AND the consumer flips the
+    // tool to Move — "I clicked to edit" shouldn't require pressing V first.
+    if (input.activeTool === 'browse') {
+      if (!metaOrCtrl(input)) return { kind: 'no-op' };
+      return {
+        kind: 'select',
+        mode: input.shiftKey ? 'add' : 'replace',
+        deep: true,
+        clientX: input.clientX ?? 0,
+        clientY: input.clientY ?? 0,
+      };
+    }
+
+    // Move (select) tool. feature-4 (DDR-187) — the full Figma ladder:
+    //   bare click       → select TOP-level object   (deep:false, replace)
+    //   Shift+click      → add TOP-level object        (deep:false, add)
+    //   Cmd/Ctrl+click   → select DEEPEST element      (deep:true, replace)
+    //   Cmd+Shift+click  → add DEEPEST element          (deep:true, add)
+    // Bare clicks are claimed (preventDefault) so native canvas interactions do
+    // NOT fire in select mode — that's the browse tool's job. The click-vs-drag
+    // threshold (canvas-shell.tsx ReorderDrag / marquee overlays, all still
+    // gated on `tool === 'move'`) means a press that turns into a drag reorders
+    // / marquees instead; a release-in-place is the select.
     const cmd = metaOrCtrl(input);
-    if (!cmd) return { kind: 'no-op' };
     const shift = !!input.shiftKey;
     return {
       kind: 'select',
       mode: shift ? 'add' : 'replace',
-      deep: true,
+      deep: cmd,
       clientX: input.clientX ?? 0,
       clientY: input.clientY ?? 0,
     };
@@ -434,6 +477,11 @@ export function useInputRouter(opts: UseInputRouterOptions): void {
       // their own clicks. The router is in capture phase, so we have to
       // bail HERE before classify can claim the event.
       if (isOverlayTarget(e.target)) return;
+      // feature-4 text-gestures (2026-07-20) — an ACTIVE inline text editor
+      // (contenteditable) owns its clicks natively: single click places the
+      // caret, dblclick selects a word, triple-click selects all. Claiming
+      // these as `select` killed every in-edit gesture.
+      if (isEditableTarget(e.target)) return;
       const action = claim(
         classify({
           type: 'pointerdown',
@@ -468,6 +516,7 @@ export function useInputRouter(opts: UseInputRouterOptions): void {
      */
     const onMouseDown = (e: MouseEvent): void => {
       if (isOverlayTarget(e.target)) return;
+      if (isEditableTarget(e.target)) return;
       const action = claim(
         classify({
           type: 'pointerdown',
@@ -508,19 +557,26 @@ export function useInputRouter(opts: UseInputRouterOptions): void {
      */
     const onClick = (e: MouseEvent): void => {
       if (isOverlayTarget(e.target)) return;
+      if (isEditableTarget(e.target)) return;
       const tool = getActiveTool();
       const mod = e.metaKey || e.ctrlKey;
       // Map the click to the action kind the matching pointerdown would have
       // produced, then honor the claim allowlist so a scoped router (the
       // comment mount layer) doesn't suppress clicks it never claimed.
+      // feature-4 — in the Move (select) tool EVERY bare left click is a select
+      // (not just Cmd), so its synthetic click must be swallowed too or the
+      // native handler under the just-selected element would still fire. Draw
+      // tools keep the Cmd-only escape-hatch select. Browse claims nothing.
       const wouldRouteKind: RouterAction['kind'] | null =
         tool === 'comment'
           ? 'drop-comment'
-          : tool === 'move' && mod && e.button === 0
+          : tool === 'move' && e.button === 0
             ? 'select'
-            : e.button === 2
-              ? 'context-menu'
-              : null;
+            : (isAnnotationTool(tool) || tool === 'browse') && mod && e.button === 0
+              ? 'select'
+              : e.button === 2
+                ? 'context-menu'
+                : null;
       if (wouldRouteKind && (!claimableActions || claimableActions.has(wouldRouteKind))) {
         e.preventDefault();
         e.stopImmediatePropagation();