@1agh/maude 0.53.1 → 0.54.0

package/apps/studio/api.ts

@@ -98,6 +98,7 @@ import { createHistory } from './history.ts';
 import { clearLocatorSlug, readLocator, writeLocator } from './locator.ts';
 import { STICKERS_DIR } from './paths.ts';
 import { getPaperPreset, MAX_PRINT_MM } from './print/units.ts';
+import { sessionDir } from './session-scope.ts';
 
 // Directories that never hold user-facing canvases. Exported so the
 // external-canvas watcher (`canvas-list-watch.ts`) shares one source instead of
@@ -1324,8 +1325,11 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
 
   // ---------- Canvas state ----------
 
+  // Cloud Phase 27 D3 — one member's place in the project is not another's.
+  // `sessionDir` is a no-op without an ambient session, so a desktop resolves
+  // the identical path it always did.
   function canvasStatePath(file: string): string {
-    return path.join(paths.canvasStateDir, `${fileSlug(file)}.json`);
+    return path.join(sessionDir(paths.canvasStateDir), `${fileSlug(file)}.json`);
   }
 
   async function loadCanvasState(file: string) {
@@ -1468,7 +1472,9 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
    *  canvas-ext). Returns null when `file` is not a valid canvas path. */
   function canvasViewPath(file: string): string | null {
     if (!canvasMetaPath(file)) return null; // reuse the containment + ext gate
-    return path.join(paths.canvasStateDir, `${fileSlug(file)}.view.json`);
+    // D3 again — the camera is the other per-machine singleton two members in
+    // one cell were silently sharing.
+    return path.join(sessionDir(paths.canvasStateDir), `${fileSlug(file)}.view.json`);
   }
 
   const MAX_OVERLAY_KEYS = 32;
@@ -1572,7 +1578,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     const vp = normalizeViewport(viewport);
     if (!vp) return null;
     try {
-      await mkdir(paths.canvasStateDir, { recursive: true });
+      await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
       const current = await readCanvasViewRaw(file);
       await Bun.write(viewAbs, `${JSON.stringify({ ...current, viewport: vp }, null, 2)}\n`);
       return vp;
@@ -1597,7 +1603,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     const ov = normalizeOverlays(overlays);
     if (ov === null) return null;
     try {
-      await mkdir(paths.canvasStateDir, { recursive: true });
+      await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
       const current = await readCanvasViewRaw(file);
       const prevOverlays =
         current.overlays && typeof current.overlays === 'object' && !Array.isArray(current.overlays)
@@ -1710,7 +1716,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
           try {
             const current = await readCanvasViewRaw(file);
             const { overlays: _drop, ...rest } = current;
-            await mkdir(paths.canvasStateDir, { recursive: true });
+            await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
             await Bun.write(viewAbs, `${JSON.stringify(rest, null, 2)}\n`);
           } catch {
             /* best-effort clear */
@@ -1732,12 +1738,12 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
           const current = await readCanvasViewRaw(file);
           if (patch.locked === null) {
             const { locked: _drop, ...rest } = current;
-            await mkdir(paths.canvasStateDir, { recursive: true });
+            await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
             await Bun.write(viewAbs, `${JSON.stringify(rest, null, 2)}\n`);
           } else {
             const lk = normalizeLocked(patch.locked);
             if (lk !== null) {
-              await mkdir(paths.canvasStateDir, { recursive: true });
+              await mkdir(sessionDir(paths.canvasStateDir), { recursive: true });
               await Bun.write(viewAbs, `${JSON.stringify({ ...current, locked: lk }, null, 2)}\n`);
             }
           }

package/apps/studio/bin/screenshot.sh

@@ -6,14 +6,29 @@
 #
 # Usage:
 #   screenshot.sh [--port N | --url URL]
-#                 [--screen <id> | --element <id> | --selector <css> | --full]
+#                 [--screen <id> | --element <id> | --selector <css> | --full | --shell]
 #                 [--all-screens] [--out <path>] [--out-dir <dir>]
 #                 [--timeout 8] [--engine auto|agent-browser|playwright]
-#                 [--theme <name>] [--root <repo>]
+#                 [--theme <name>] [--root <repo>] [--canvas <rel|"">]
 #
 # Notes:
-#   - Exactly one of --screen / --element / --selector / --full is required
-#     (or --all-screens which loops over every [data-dc-screen]/[data-dc-slot]).
+#   - Exactly one of --screen / --element / --selector / --full / --shell is
+#     required (or --all-screens, which loops over every
+#     [data-dc-screen]/[data-dc-slot]).
+#   - --shell captures the STUDIO ITSELF, not a canvas: it points at the server
+#     root (`/`) instead of `_canvas-shell.html`, so Maude's own chrome —
+#     menubar, sidebar, status bar, toasts — is in frame. That chrome is where
+#     most reported UI bugs actually live, and no canvas-scoped capture can ever
+#     show it. Open tabs are `useState([])` in the client (never restored from
+#     `_active.json` or localStorage), so a bare load lands on "Nothing open
+#     yet"; shell mode therefore clicks the active canvas's file-tree row first
+#     to bring the shot back in line with what the user is looking at.
+#   - --canvas says WHICH canvas shell mode opens, overriding `_active.json`.
+#     Passing it EMPTY means "open nothing" — that's not the same as omitting
+#     it. `_active.json` is global and sticky (it outlives every closed tab and
+#     any session can write it), so a caller that knows the truth — the studio
+#     client knows its own open tab — must be able to say "nothing is open"
+#     instead of having a stale path resolved behind its back.
 #   - --out required for single-shot modes; --out-dir required for --all-screens.
 #   - --theme <name> forces every `[data-theme]` element (DS artboard wrappers)
 #     to that value BEFORE capture, via a DOM eval — does not touch the actual
@@ -37,6 +52,11 @@ ENGINE="auto"
 ALL_SCREENS=0
 ROOT=""
 THEME=""
+ACTIVE=""
+# Tri-state for --canvas: unset → resolve from _active.json (the CLI default);
+# set to a path → open that; set to "" → open nothing. The empty case is
+# load-bearing, so it can't collapse into "unset".
+CANVAS_SET=0
 
 while [ $# -gt 0 ]; do
   case "$1" in
@@ -44,6 +64,8 @@ while [ $# -gt 0 ]; do
     --element)  MODE="element";  SEL="$2"; shift 2 ;;
     --selector) MODE="selector"; SEL="$2"; shift 2 ;;
     --full)     MODE="full"; shift ;;
+    --shell)    MODE="shell"; shift ;;
+    --canvas)   CANVAS_SET=1; ACTIVE="$2"; shift 2 ;;
     --all-screens) ALL_SCREENS=1; shift ;;
     --url)      URL="$2"; shift 2 ;;
     --port)     PORT="$2"; shift 2 ;;
@@ -82,7 +104,7 @@ fi
 if [ $ALL_SCREENS -eq 1 ]; then
   [ -z "$OUT_DIR" ] && { echo "screenshot.sh: --all-screens needs --out-dir" >&2; exit 2; }
 else
-  [ -z "$MODE" ]    && { echo "screenshot.sh: pick one of --full/--screen/--element/--selector or --all-screens" >&2; exit 2; }
+  [ -z "$MODE" ]    && { echo "screenshot.sh: pick one of --full/--shell/--screen/--element/--selector or --all-screens" >&2; exit 2; }
   [ -z "$OUT" ]     && { echo "screenshot.sh: --out required for single-shot modes" >&2; exit 2; }
 fi
 
@@ -125,26 +147,58 @@ if [ -z "$URL" ]; then
   fi
   [ -z "$PORT" ] && { echo "screenshot.sh: no --url/--port given and _server.json not found (run server-up.sh)" >&2; exit 1; }
 
-  if [ -f "$ACTIVE_JSON" ] && command -v jq >/dev/null 2>&1; then
+  if [ $CANVAS_SET -eq 0 ] && [ -f "$ACTIVE_JSON" ] && command -v jq >/dev/null 2>&1; then
     ACTIVE=$(jq -r '.active // empty' "$ACTIVE_JSON" 2>/dev/null)
   fi
-  [ -z "$ACTIVE" ] && { echo "screenshot.sh: no active canvas in _active.json (open one in browser first)" >&2; exit 1; }
 
-  # URL-encode spaces (rough); leave other chars alone.
-  ACTIVE_ENC=$(printf '%s' "$ACTIVE" | sed 's/ /%20/g')
-  # Canvases mount through the canvas shell. The bare `/<rel>` route 404s when
-  # the canvas-origin sandbox is on (default since phase-9.1); only
-  # `/_canvas-shell.html?canvas=<rel>` renders the canvas (valid in both
-  # split-on and legacy same-origin modes).
-  URL="http://localhost:${PORT}/_canvas-shell.html?canvas=${ACTIVE_ENC}"
+  # Shell mode targets the studio root, and an active canvas is a NICE-TO-HAVE
+  # (it decides which file-tree row we click) rather than a precondition — a
+  # chrome bug is worth capturing even with nothing open.
+  if [ "$MODE" = "shell" ]; then
+    URL="http://localhost:${PORT}/"
+  else
+    [ -z "$ACTIVE" ] && { echo "screenshot.sh: no active canvas in _active.json (open one in browser first)" >&2; exit 1; }
+
+    # URL-encode spaces (rough); leave other chars alone.
+    ACTIVE_ENC=$(printf '%s' "$ACTIVE" | sed 's/ /%20/g')
+    # Canvases mount through the canvas shell. The bare `/<rel>` route 404s when
+    # the canvas-origin sandbox is on (default since phase-9.1); only
+    # `/_canvas-shell.html?canvas=<rel>` renders the canvas (valid in both
+    # split-on and legacy same-origin modes).
+    URL="http://localhost:${PORT}/_canvas-shell.html?canvas=${ACTIVE_ENC}"
+  fi
 fi
 
+# Shell mode still wants the active canvas even when the caller passed --url
+# outright (the URL says WHERE to look; the active canvas says WHAT to open).
+if [ "$MODE" = "shell" ] && [ $CANVAS_SET -eq 0 ] && [ -z "$ACTIVE" ]; then
+  SHELL_REPO="${ROOT:-${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}}"
+  if [ -f "$SHELL_REPO/.design/_active.json" ] && command -v jq >/dev/null 2>&1; then
+    ACTIVE=$(jq -r '.active // empty' "$SHELL_REPO/.design/_active.json" 2>/dev/null)
+  fi
+fi
+
+# The file-tree row testid the client stamps (app.jsx `pathTestIdSlug`):
+# designRoot dot-folder stripped, extension stripped, non-alphanumerics folded
+# to single dashes, lowercased, dashes trimmed. Lowercasing happens BEFORE the
+# extension strip so we don't need sed's non-portable `I` flag for `.TSX`.
+# Output is [a-z0-9-] only, which is what makes it safe to splice into the JS
+# selector string eval'd below.
+shell_row_testid() {
+  printf '%s' "$1" \
+    | sed -E 's#^\.[^/]+/##' \
+    | tr '[:upper:]' '[:lower:]' \
+    | sed -E 's/\.(tsx|html?)$//' \
+    | sed -E 's/[^a-z0-9]+/-/g' \
+    | sed -E 's/^-+//; s/-+$//'
+}
+
 # ---------- selector mapping ----------
 case "$MODE" in
   screen)   CSS_SEL="[data-dc-screen=\"$SEL\"], [data-dc-slot=\"$SEL\"]" ;;
   element)  CSS_SEL="[data-dc-element=\"$SEL\"]" ;;
   selector) CSS_SEL="$SEL" ;;
-  full|"")  CSS_SEL="" ;;
+  full|shell|"")  CSS_SEL="" ;;
 esac
 
 # ---------- engine resolution ----------
@@ -153,6 +207,15 @@ esac
 # would let a same-user attacker shadow node/chrome in the app dir), else the one
 # on PATH.
 AB="${MAUDE_AGENT_BROWSER:-agent-browser}"
+
+# agent-browser sessions are SHARED by name (default: "default"). Shell mode is
+# fired automatically by the Report-a-Bug dialog, so on the shared session it
+# would navigate whatever browser an agent has mid-task out from under it. Pin
+# it to its own session; the canvas modes keep the shared one deliberately, so
+# an agent's `/design:*` captures stay in the session it is already driving.
+if [ "$MODE" = "shell" ] && [ -z "$AGENT_BROWSER_SESSION" ]; then
+  export AGENT_BROWSER_SESSION="maude-shell-shot"
+fi
 if [ "$ENGINE" = "auto" ]; then
   if command -v "$AB" >/dev/null 2>&1; then
     ENGINE="agent-browser"
@@ -222,9 +285,94 @@ pw_screenshot() {
   return 0
 }
 
+# ---------- shell mode: open the active canvas in the studio ----------
+# The studio root always boots to "Nothing open yet" (tabs are `useState([])`,
+# never rehydrated), so a bare shell shot would show chrome over an empty
+# canvas area. Click the active canvas's file-tree row and wait for the canvas
+# iframe to appear. Every leg is best-effort — chrome is the point of this mode,
+# so a missing row or a slow mount degrades to "chrome, nothing open" rather
+# than failing the capture.
+# A reachable port is not a mounted app: the server can answer while the client
+# bundle is still parsing, or React can fail to mount and leave an empty #root
+# (the exact shape of the v0.51.1 blank-window bug). Wait for the studio's own
+# file list before capturing, so a broken shell fails loud instead of shipping a
+# blank PNG that looks like a real screenshot.
+await_studio_shell() {
+  [ "$ENGINE" = "agent-browser" ] || return 0
+  local poll=0
+  while [ $poll -lt "$TIMEOUT" ]; do
+    local n
+    n=$("$AB" eval "document.querySelectorAll('[data-testid^=\"canvas-row-\"]').length" 2>/dev/null | tr -d '[:space:]')
+    case "$n" in
+      ''|*[!0-9]*|0) ;;
+      *) return 0 ;;
+    esac
+    sleep 1
+    poll=$((poll + 1))
+  done
+  return 1
+}
+
+open_active_in_shell() {
+  [ "$ENGINE" = "agent-browser" ] || return 0
+  [ -n "$ACTIVE" ] || { echo "→ shell: no active canvas — capturing chrome as-is" >&2; return 0; }
+  local slug
+  slug=$(shell_row_testid "$ACTIVE")
+  [ -n "$slug" ] || return 0
+  # The file tree is React-rendered, so the row does not exist at load — poll
+  # for it (a single probe 1 s after navigate reliably misses) and click the
+  # moment it appears.
+  local clicked=""
+  local wait=0
+  while [ $wait -lt "$TIMEOUT" ]; do
+    clicked=$("$AB" eval "(function(){var r=document.querySelector('[data-testid=\"canvas-row-$slug\"]');if(!r)return 'miss';r.click();return 'hit'})()" 2>/dev/null | tr -d '[:space:]"')
+    [ "$clicked" = "hit" ] && break
+    sleep 1
+    wait=$((wait + 1))
+  done
+  if [ "$clicked" != "hit" ]; then
+    echo "→ shell: no file-tree row for '$slug' after ${TIMEOUT}s — capturing chrome as-is" >&2
+    return 0
+  fi
+  # Wait for the canvas iframe to attach; it renders cross-origin, so the parent
+  # can only observe the element, never its contents. A short settle follows so
+  # the iframe has painted before we capture.
+  local poll=0
+  while [ $poll -lt "$TIMEOUT" ]; do
+    sleep 1
+    poll=$((poll + 1))
+    local n
+    n=$("$AB" eval "document.querySelectorAll('iframe').length" 2>/dev/null | tr -d '[:space:]')
+    case "$n" in
+      ''|*[!0-9]*|0) continue ;;
+      *) sleep 2; echo "→ shell: opened '$ACTIVE'" >&2; return 0 ;;
+    esac
+  done
+  echo "→ shell: canvas iframe never attached after ${TIMEOUT}s — capturing chrome as-is" >&2
+}
+
 navigate_once() {
   if [ "$ENGINE" = "agent-browser" ]; then
-    "$AB" open "$URL" >&2
+    # A failed navigation MUST propagate. agent-browser leaves the session on a
+    # blank page and `screenshot` then happily writes a ~4 kB white PNG, so
+    # ignoring this exit code turns "the server is down" into "here is your
+    # screenshot" — which for the Report-a-Bug shell shot means a blank image
+    # labelled "Maude window" lands in someone's bug report.
+    if ! "$AB" open "$URL" >&2; then
+      echo "✗ navigation failed: $URL" >&2
+      return 1
+    fi
+    # Shell mode lands on the studio root, which has no DC mount to poll for —
+    # the canvas arrives only after we click a row.
+    if [ "$MODE" = "shell" ]; then
+      if ! await_studio_shell; then
+        echo "✗ the studio shell never mounted at $URL" >&2
+        return 1
+      fi
+      open_active_in_shell
+      apply_theme_override
+      return 0
+    fi
     # Wait for canvas to mount — Babel/React canvases take 2–4s to settle.
     # Poll for [data-dc-screen] or [data-dc-slot] up to $TIMEOUT seconds; fall
     # through to a fixed sleep when the page isn't a DC canvas.
@@ -387,7 +535,15 @@ if [ $ALL_SCREENS -eq 1 ]; then
 fi
 
 # ---------- single-shot ----------
-navigate_once
+# A failed navigation is exactly the port-bounce case (DDR-094), so give
+# relive_url its one shot before giving up rather than capturing a blank page.
+if ! navigate_once; then
+  if ! relive_url || ! navigate_once; then
+    echo "✗ could not load $URL — no screenshot written" >&2
+    rm -f "$OUT"
+    exit 3
+  fi
+fi
 if capture_resilient "$CSS_SEL" "$OUT"; then
   echo "$OUT"
   exit 0

package/apps/studio/build.ts

@@ -21,6 +21,8 @@ import { fileURLToPath } from 'node:url';
 
 import { browserslistToTargets, bundle as lcssBundle } from 'lightningcss';
 
+import { cloudStubPlugin } from './cloud-build.ts';
+
 const ROOT = dirname(fileURLToPath(import.meta.url));
 const DIST = join(ROOT, 'dist');
 
@@ -32,6 +34,9 @@ const MODE: 'dev' | 'release' | 'dry' = ARGS.has('--dry-run')
     ? 'release'
     : 'dev';
 const WATCH = ARGS.has('--watch');
+/** Cloud Phase 27 D1 — build the CELL's variant (secret-bearing surfaces
+ *  removed from the binary, not merely un-routed). `--cloud` with `--release`. */
+const CLOUD = ARGS.has('--cloud');
 
 const PLATFORM_MATRIX = [
   'bun-darwin-arm64',
@@ -336,11 +341,20 @@ import ${JSON.stringify(realServerRel)};
   return entryPath;
 }
 
-async function buildServerBinary(target: PlatformTarget): Promise<{ outPath: string }> {
+async function buildServerBinary(
+  target: PlatformTarget,
+  /**
+   * Cloud Phase 27 D1 — the variant a CELL runs, with the secret-bearing
+   * surfaces removed from the binary rather than merely un-routed. Named
+   * separately (`maude-cloud-<slug>`) so a desktop release can never pick one
+   * up by accident, and so both can be built from one checkout.
+   */
+  { cloud = false }: { cloud?: boolean } = {}
+): Promise<{ outPath: string }> {
   ensureDist();
   const slug = platformSlug(target);
   const ext = slug.startsWith('win32') ? '.exe' : '';
-  const outPath = join(DIST, `maude-${slug}${ext}`);
+  const outPath = join(DIST, `maude-${cloud ? 'cloud-' : ''}${slug}${ext}`);
   const realEntry = join(ROOT, 'server.ts');
   if (!existsSync(realEntry)) {
     // Legacy fallback — pre-DDR-009 .mjs path. Doesn't use oxc-parser, so the
@@ -369,6 +383,26 @@ async function buildServerBinary(target: PlatformTarget): Promise<{ outPath: str
   // filter skipped it (cross-compile case — see ensureBindingForTarget docs).
   await ensureBindingForTarget(oxcBindingSlug(slug));
   const entry = writeCompileEntry(target);
+
+  // The CLOUD variant goes through the Bun.build API rather than the CLI,
+  // because that is the only path that takes a plugin — and a plugin is what
+  // makes D1 elimination rather than un-routing. `--define` + dead-code
+  // elimination was tried first and does not do it: Bun inlines the
+  // dynamically-imported module and keeps the branch, so the bytes stay.
+  if (cloud) {
+    const result = await Bun.build({
+      entrypoints: [entry],
+      target: 'bun',
+      minify: true,
+      plugins: [cloudStubPlugin(ROOT)],
+      compile: { target, outfile: outPath },
+    } as Parameters<typeof Bun.build>[0]);
+    if (!result.success) {
+      throw new Error(`cloud compile failed for ${target}:\n${result.logs.map(String).join('\n')}`);
+    }
+    return { outPath };
+  }
+
   const proc = Bun.spawn(
     [
       'bun',
@@ -538,7 +572,7 @@ async function main() {
       : [currentTarget()];
     for (const target of targets) {
       const t = performance.now();
-      const bin = await buildServerBinary(target);
+      const bin = await buildServerBinary(target, { cloud: CLOUD });
       console.log(`[build] ${bin.outPath}  (${(performance.now() - t).toFixed(0)} ms)`);
     }
   }