@1agh/maude 0.47.0 → 0.48.0

package/README.md

@@ -82,7 +82,7 @@ maude doctor --json   # machine-readable envelope
 
 ### Sidecar cache — `maude cache`
 
-Flow + design commands reuse expensive cross-session work through a small sidecar cache at `.ai/cache/` ([DDR-061](.ai/decisions/DDR-061-sidecar-cache-monitor-background-orchestration.md)): domain research (skips 30–90 s of WebSearch on a same-domain brief), codebase-intelligence scans (skips rescan when the tree is unchanged), parsed design-system vocabulary, and security-review reuse (one shared 1-hour window across `/flow:validate`, `/flow:done`, `/flow:validate-security`). Correctness comes first — most layers are content-addressed (a changed input changes the key → guaranteed miss), and a stale entry is never served speculatively.
+Flow + design commands reuse expensive cross-session work through a small sidecar cache at `.ai/cache/` ([DDR-061](.ai/archive/decisions/DDR-061-sidecar-cache-monitor-background-orchestration.md)): domain research (skips 30–90 s of WebSearch on a same-domain brief), codebase-intelligence scans (skips rescan when the tree is unchanged), parsed design-system vocabulary, and security-review reuse (one shared 1-hour window across `/flow:validate`, `/flow:done`, `/flow:validate-security`). Correctness comes first — most layers are content-addressed (a changed input changes the key → guaranteed miss), and a stale entry is never served speculatively.
 
 ```sh
 maude cache list              # layers, entry counts, sizes, last-write time
@@ -95,7 +95,7 @@ The `research/domain` and `codebase-intelligence` layers are **committed** (dete
 
 ### Plugins call `maude` for executable logic
 
-Plugin slash-commands reach all executable logic through the on-PATH `maude` binary — never a relative `cli/lib/*.mjs` path or a raw `$CLAUDE_PLUGIN_ROOT/dev-server/bin/*.sh` invocation ([DDR-062](.ai/decisions/DDR-062-plugins-reach-executable-logic-via-maude.md)). The marketplace copies each plugin alone (no sibling `cli/`, no `dev-server/`), and a flow command's `$CLAUDE_PLUGIN_ROOT` points at the flow plugin (which has no dev-server at all) — so the only contract that holds across every install shape is `maude`, which resolves bundled helpers from its own package root. Cache/preflight go via `maude cache …` / `maude preflight …`; the design dev-server's bash helpers go via **`maude design <verb>`** (`screenshot`, `server-up`, `prep`, `slug`, `smoke`, `runtime-health`, …) — see `maude design help`. Keep the global `maude` current; a stale binary means stale helpers.
+Plugin slash-commands reach all executable logic through the on-PATH `maude` binary — never a relative `cli/lib/*.mjs` path or a raw `$CLAUDE_PLUGIN_ROOT/dev-server/bin/*.sh` invocation ([DDR-062](.ai/archive/decisions/DDR-062-plugins-reach-executable-logic-via-maude.md)). The marketplace copies each plugin alone (no sibling `cli/`, no `dev-server/`), and a flow command's `$CLAUDE_PLUGIN_ROOT` points at the flow plugin (which has no dev-server at all) — so the only contract that holds across every install shape is `maude`, which resolves bundled helpers from its own package root. Cache/preflight go via `maude cache …` / `maude preflight …`; the design dev-server's bash helpers go via **`maude design <verb>`** (`screenshot`, `server-up`, `prep`, `slug`, `smoke`, `runtime-health`, …) — see `maude design help`. Keep the global `maude` current; a stale binary means stale helpers.
 
 ## Runtime requirements
 
@@ -105,10 +105,10 @@ Plugin slash-commands reach all executable logic through the on-PATH `maude` bin
 
 ## Collaboration model
 
-Two clean paths, no middle ground ([DDR-047](.ai/decisions/DDR-047-collab-scope-cut-no-lan-mode-hub-admin-ui.md)):
+Two clean paths, no middle ground ([DDR-047](.ai/archive/decisions/DDR-047-collab-scope-cut-no-lan-mode-hub-admin-ui.md)):
 
 - **v1.0 — git handoff OR loopback multi-tab.** Push / pull is the cross-machine story. On a single machine, two browser tabs (or two Claude Code instances editing the same repo) sync cursors, comments, and annotations live over loopback WebSocket. The dev server refuses any non-loopback `host` header on the collab WS endpoint.
-- **v1.1 — deploy a hub** (Phase 9, in-flight). Cross-machine live collab needs a hub binary you deploy yourself. No tunnel mode; no shared cloud. **Boot order can't eat your work** ([DDR-102](.ai/decisions/DDR-102-cold-start-divergence-resolution.md)): a per-machine journal tells clean catch-ups apart from genuine divergence; diverged canvases snapshot **both** versions to `_history/` before the newer one wins, so the loser is one `/design:rollback` away — and `maude design status` reports per-canvas sync state honestly (synced / pending / auth-rejected).
+- **v1.1 — deploy a hub** (Phase 9, in-flight). Cross-machine live collab needs a hub binary you deploy yourself. No tunnel mode; no shared cloud. **Boot order can't eat your work** ([DDR-102](.ai/archive/decisions/DDR-102-cold-start-divergence-resolution.md)): a per-machine journal tells clean catch-ups apart from genuine divergence; diverged canvases snapshot **both** versions to `_history/` before the newer one wins, so the loser is one `/design:rollback` away — and `maude design status` reports per-canvas sync state honestly (synced / pending / auth-rejected).
 
 ## Security
 
@@ -118,7 +118,8 @@ Solo mode (the default) is fully local — no accounts, no telemetry, no network
 
 User-facing docs live in two places — the README points you the right way:
 
-- **Reference** (every command, every config key, recipes for Next.js / Expo / monorepo) → [`site/content/docs/`](./site/content/docs/) (served at https://maude.sh once Vercel is wired — see [DDR-005](.ai/decisions/DDR-005-docs-site-stack-and-hosting.md)).
+- **Reference** (every command, every config key, recipes for Next.js / Expo / monorepo) → [`site/content/docs/`](./site/content/docs/) (served at https://maude.sh once Vercel is wired — see [DDR-005](.ai/archive/decisions/DDR-005-docs-site-stack-and-hosting.md)).
+- **kgai knowledge-graph backend** (opt-in shared decision memory across repos) → [`docs/kgai-onboarding.md`](./docs/kgai-onboarding.md) (per user) + [`docs/kgai-company-setup.md`](./docs/kgai-company-setup.md) (one-time admin). Off by default — absent `kg`, every command runs its classic `.ai/` path.
 - **Quickstart** + **contributor info** → this README.
 
 The docs site auto-generates per-command pages from `plugins/{flow,design}/commands/*.md` frontmatter and a typed schema reference from `plugins/flow/.claude-plugin/config.schema.json`. Adding a new command → docs update on next build.
@@ -130,7 +131,7 @@ The repo is a **pnpm workspace monorepo** with one published npm package (`@1agh
 | Workspace | Purpose |
 | --------- | ------- |
 | `.` (root) | The single npm publisher — CLI, dev-server entry, plugin templates that ship to npm. |
-| `site/` | Docs site — Fumadocs + Next.js, deployed to Vercel ([DDR-005](.ai/decisions/DDR-005-docs-site-stack-and-hosting.md)). |
+| `site/` | Docs site — Fumadocs + Next.js, deployed to Vercel ([DDR-005](.ai/archive/decisions/DDR-005-docs-site-stack-and-hosting.md)). |
 | `apps/studio/` | Zero-dep Node dev server + browser client. Bundled output (`dist/`) is the only thing in the npm tarball. |
 | `apps/hub/` | Reserved for the v1.1 federated hub (Phase 9). |
 

package/apps/studio/acp/bridge.ts

@@ -396,7 +396,14 @@ export function newSessionParams(
     // gets it double-loaded with zero suppression (the exact double-
     // registration risk this override exists to close). No test currently
     // catches this drift.
-    options.settings = { enabledPlugins: { 'design@maude': false } };
+    // `kgai` is the third-party autonomous-capture plugin the desktop bundle
+    // injects (plugin-bootstrap.ts). Suppressing its natively-installed copy is
+    // MORE load-bearing than for our own plugins: a user-installed kgai would
+    // run its own SessionStart `install.sh` (Go/network) and point at a
+    // different engine version than the pinned, signed sidecar we ship. Its id
+    // has no `@marketplace` suffix — it's injected as a bare local plugin dir
+    // whose manifest `name` is `kgai`.
+    options.settings = { enabledPlugins: { 'design@maude': false, kgai: false } };
   }
   meta.claudeCode = { options };
   return {

package/apps/studio/acp/plugin-bootstrap.ts

@@ -38,7 +38,7 @@
 // id via the SDK's documented `flag > user` settings precedence — so the
 // bundled copy injected here is the ONLY one that ever loads.
 
-import { DESIGN_PLUGIN_DIR, FLOW_PLUGIN_DIR } from '../paths.ts';
+import { DESIGN_PLUGIN_DIR, FLOW_PLUGIN_DIR, KGAI_PLUGIN_DIR } from '../paths.ts';
 
 /**
  * SDK plugin-load config (`@anthropic-ai/claude-agent-sdk` `SdkPluginConfig`).
@@ -61,6 +61,8 @@ export interface SessionPluginDeps {
   designDir: string | null;
   /** Bundled `flow` plugin dir, or null (npm/web layout). */
   flowDir: string | null;
+  /** Bundled third-party `kgai` plugin dir, or null (only staged in the .app). */
+  kgaiDir?: string | null;
 }
 
 /**
@@ -81,6 +83,17 @@ export function computeSessionPlugins(deps: SessionPluginDeps): SdkPluginConfig[
   // `/flow` auto-load is intentionally OFF for now (2026-07-03) — the chat ships
   // design-only. `deps.flowDir` stays resolved (harmless) so restoring it is a
   // one-liner: re-add `add(deps.flowDir)`.
+  //
+  // kgai (third-party, MIT) — injected so its `Stop` hook loads and autonomous
+  // decision capture actually fires in the ACP panel. Without this the packaged
+  // app captures NOTHING: the session is built with settingSources:['user']
+  // (DDR-144) and a terminal-less DDR-177 user never marketplace-installs it.
+  // Non-null only in the desktop bundle (sync-kg.mjs stages a pinned release).
+  //
+  // ⚠ DRIFT TRAP — adding an id here REQUIRES a matching `'<id>': false` entry in
+  // bridge.ts's hand-maintained `enabledPlugins` suppression literal, or a user
+  // who ALSO has it natively enabled gets it double-loaded (see that comment).
+  add(deps.kgaiDir ?? null);
   return out;
 }
 
@@ -117,5 +130,6 @@ export function resolveSessionPlugins(): SdkPluginConfig[] {
     native: isNativePluginContext(),
     designDir: DESIGN_PLUGIN_DIR,
     flowDir: FLOW_PLUGIN_DIR,
+    kgaiDir: KGAI_PLUGIN_DIR,
   });
 }

package/apps/studio/build.ts

@@ -317,7 +317,7 @@ export function writeCompileEntry(target: PlatformTarget): string {
   const bindingSpec = `@oxc-parser/binding-${oxcSlug}/parser.${oxcSlug}.node`;
   const initContent = `// AUTO-GENERATED by build.ts — do not edit by hand.
 // Per-target oxc-parser binding embed (Bun 1.3.4+ --compile NAPI regression
-// workaround — see .ai/decisions/DDR-042-oxc-parser-bun-compile-workaround.md).
+// workaround — see .ai/archive/decisions/DDR-042-oxc-parser-bun-compile-workaround.md).
 // Side-effect module: must be imported BEFORE any oxc-parser usage.
 import bindingPath from ${JSON.stringify(bindingSpec)} with { type: 'file' };
 process.env.NAPI_RS_NATIVE_LIBRARY_PATH = bindingPath;

package/apps/studio/client/export-center.jsx

@@ -56,12 +56,13 @@ async function autoDownloadBlob(id, fallbackName) {
   URL.revokeObjectURL(url);
 }
 
-async function saveNative(id, fallbackName) {
-  const got = await fetchJobBytes(id);
-  if (!got) return null;
-  const filename = got.filename || fallbackName || 'export';
-  const bytes = Array.from(new Uint8Array(await got.blob.arrayBuffer()));
-  return saveExport(filename, bytes);
+// Native "Save…" — unlike the web `download()` path, this does NOT fetch the
+// job's bytes into the renderer first. `save_export` fetches them itself
+// (RCA issue-desktop-print-pdf-save-as-hang-large-payload: routing a
+// hundreds-of-MB export through a JS Uint8Array + Tauri's JSON IPC froze the
+// app), so all this needs is the filename already carried on the job record.
+async function saveNative(id, filename) {
+  return saveExport(filename || 'export', id);
 }
 
 export function useExportCenter() {

package/apps/studio/client/github.js

@@ -93,11 +93,18 @@ export const pickDirectory = () => invoke('pick_directory');
 export const openLocalProject = (path) => invoke('open_local_project', { path });
 /**
  * Native "Save As…" for an export — opens an OS save dialog seeded with
- * `filename`, writes `bytes` (a plain number array from a Uint8Array) to the
- * chosen path, and resolves to that path (or null if cancelled). Only callable in
- * the native app; the browser build uses the `<a download>` blob instead.
+ * `filename`, then has the Rust side fetch the finished `jobId`'s bytes
+ * directly from the local dev-server and stream them to the chosen path, and
+ * resolves to that path (or null if cancelled). Only callable in the native
+ * app; the browser build uses the `<a download>` blob instead.
+ *
+ * Deliberately does NOT take the bytes as an argument (it used to — RCA
+ * issue-desktop-print-pdf-save-as-hang-large-payload): shipping a large export
+ * (a print-ready PDF can be hundreds of MB) through Tauri's JSON-serialized
+ * IPC as `Array.from(new Uint8Array(...))` froze the renderer. Rust fetches
+ * the bytes itself now; the webview never sees the payload.
  */
-export const saveExport = (filename, bytes) => invoke('save_export', { filename, bytes });
+export const saveExport = (filename, jobId) => invoke('save_export', { filename, jobId });
 
 /**
  * Native "open file" for media upload — the read counterpart to saveExport.