@1agh/maude 0.53.1 → 0.54.0

package/apps/studio/inspect.ts

@@ -4,6 +4,7 @@
 import path from 'node:path';
 
 import type { Context } from './context.ts';
+import { normalizeSessionKey, sessionFile } from './session-scope.ts';
 
 export interface SelectedElement {
   file: string;
@@ -96,6 +97,8 @@ type SetSelectedInput =
   | null;
 
 export interface Inspect {
+  /** Whose state this is — `''` for the shared singleton (D3). */
+  sessionKey: string;
   state: ActiveState;
   load(): Promise<void>;
   setActive(file: string): void;
@@ -126,9 +129,16 @@ const NEW = (): ActiveState => ({
 
 export function createInspect(
   ctx: Context,
-  loadActiveComments: (file: string) => Promise<unknown[]>
+  loadActiveComments: (file: string) => Promise<unknown[]>,
+  /**
+   * Whose state this is — Cloud Phase 27 D3. `''` is the shared singleton every
+   * desktop has always had; a non-empty key gives one member of a cell their
+   * own selection, their own open tab, and their own `_active.<key>.json`.
+   */
+  sessionKey = ''
 ): Inspect {
   const state: ActiveState = NEW();
+  const activeFile = sessionFile(ctx.paths.activeFile, sessionKey);
   let saveQueued = false;
 
   async function save() {
@@ -144,7 +154,7 @@ export function createInspect(
         }
       }
       const enriched = { ...state, active_comments };
-      await Bun.write(ctx.paths.activeFile, JSON.stringify(enriched, null, 2));
+      await Bun.write(activeFile, JSON.stringify(enriched, null, 2));
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       console.error('  warn: failed to save _active.json:', msg);
@@ -159,7 +169,7 @@ export function createInspect(
 
   async function load() {
     try {
-      const raw = await Bun.file(ctx.paths.activeFile).text();
+      const raw = await Bun.file(activeFile).text();
       const prev = JSON.parse(raw);
       Object.assign(state, prev, { session_started: new Date().toISOString() });
       // Pre-selections _active.json (or a hand-edited one) → keep the invariant.
@@ -222,10 +232,10 @@ export function createInspect(
     state.selected = file ? restoreFor(file) : null;
     state.last_change = new Date().toISOString();
     scheduleSave();
-    ctx.bus.emit('active', state.active);
+    ctx.bus.emit('active', state.active, { session: sessionKey });
     // Clients (StatusBar, shell halo, chat context chip) must see the restored
     // selection, not assume the pre-switch null.
-    ctx.bus.emit('selected', state.selected);
+    ctx.bus.emit('selected', state.selected, { session: sessionKey });
   }
 
   function setOpenTabs(tabs: string[]) {
@@ -320,7 +330,7 @@ export function createInspect(
     }
     state.last_change = new Date().toISOString();
     scheduleSave();
-    ctx.bus.emit('selected', state.selected);
+    ctx.bus.emit('selected', state.selected, { session: sessionKey });
   }
 
   function retarget(fromFile: string, toFile: string): boolean {
@@ -379,6 +389,7 @@ export function createInspect(
   }
 
   return {
+    sessionKey,
     state,
     load,
     setActive,
@@ -390,6 +401,55 @@ export function createInspect(
   };
 }
 
+/**
+ * One `Inspect` per member — Cloud Phase 27 D3.
+ *
+ * A desktop asks for `for('')` forever and gets the single instance it always
+ * had. A cell asks with the proxy's vouched session key and gets one per
+ * member, so an owner and a viewer stop overwriting each other's open tab and
+ * selection.
+ *
+ * Instances are created on demand and kept: they are small (one state object),
+ * a member reconnects to the same key across reloads, and evicting one would
+ * lose exactly the state this exists to preserve. The key space is bounded by
+ * the project's membership, not by anything a client can invent —
+ * `normalizeSessionKey` rejects a value that is not proxy-shaped, and the proxy
+ * strips inbound `x-maude-*` before injecting its own.
+ */
+export interface InspectRegistry {
+  /** The instance for this session key, created on first use. */
+  for(sessionKey?: string | null): Inspect;
+  /** Every live instance. */
+  all(): Inspect[];
+}
+
+export function createInspectRegistry(
+  ctx: Context,
+  loadActiveComments: (file: string) => Promise<unknown[]>
+): InspectRegistry {
+  const instances = new Map<string, Inspect>();
+
+  function get(sessionKey?: string | null): Inspect {
+    const key = normalizeSessionKey(sessionKey);
+    let found = instances.get(key);
+    if (!found) {
+      found = createInspect(ctx, loadActiveComments, key);
+      instances.set(key, found);
+      // A member returning after a reload picks their own place back up. Fire
+      // and forget: `load()` is a best-effort read of a file that usually does
+      // not exist yet, and blocking a request on it would trade a correctness
+      // nicety for latency on every first touch.
+      if (key) void found.load();
+    }
+    return found;
+  }
+
+  return {
+    for: get,
+    all: () => [...instances.values()],
+  };
+}
+
 // ---------- Inspector script injection ----------
 
 function injectInspector(html: string): string {

package/apps/studio/paths.ts

@@ -48,6 +48,14 @@ export const CLIENT_DIR: string = join(DEV_SERVER_ROOT, 'client');
 /** `<DEV_SERVER_ROOT>/dist/runtime/` — pre-built /_canvas-runtime/*.js bundles. */
 export const RUNTIME_BUNDLES_DIR: string = join(DIST_DIR, 'runtime');
 
+/**
+ * `<DEV_SERVER_ROOT>/bin/` — the shell helpers behind `maude design <verb>`.
+ * Resolved here rather than locally per DDR-045: inside a `bun --compile`
+ * binary a local `dirname(fileURLToPath(import.meta.url))` yields the virtual
+ * `/$bunfs/root`, and every `existsSync` against it silently returns false.
+ */
+export const BIN_DIR: string = join(DEV_SERVER_ROOT, 'bin');
+
 /**
  * `<DEV_SERVER_ROOT>/stickers/` — bundled whiteboard sticker packs
  * (feature-whiteboard-annotation-improvements, Phase 4). Ships with the

package/apps/studio/server.ts

@@ -14,13 +14,12 @@
 // else binds to a port. The orchestrator (slash commands) reads _server.json
 // to detect a live instance and avoid duplicate boots.
 
-import { spawn } from 'node:child_process';
-
 import { createAcp } from './acp/index.ts';
 import { cancelInstall, cancelSignin } from './acp/login-state.ts';
 import { createActivity } from './activity.ts';
 import { ASSET_MAX_VIDEO_BYTES, createApi } from './api.ts';
 import { bootSelfHeal } from './boot-self-heal.ts';
+import { isSandboxArmed } from './canvas-build-sandbox.ts';
 import { createCanvasListWatch } from './canvas-list-watch.ts';
 import { type AiActivityEntry, createAiActivity } from './collab/ai-activity.ts';
 import { createGitLifecycle } from './collab/git-lifecycle.ts';
@@ -32,8 +31,9 @@ import { createFsWatch } from './fs-watch.ts';
 import { createGenerationJobQueue } from './generation/jobs.ts';
 import { createGitWatch } from './git/watch.ts';
 import { createHttp } from './http.ts';
-import { createInspect } from './inspect.ts';
+import { createInspectRegistry } from './inspect.ts';
 import { startHeapWatch } from './mem.ts';
+import { normalizeSessionKey, runInSession, SESSION_HEADER } from './session-scope.ts';
 import { createSyncRuntime } from './sync/index.ts';
 import {
   assertContainment,
@@ -72,7 +72,7 @@ let collab: ReturnType<typeof createCollab> | null = null;
 // Forward-declared for the same reason — moveCanvas (feature-file-tree-
 // drag-drop-folders, Task 3) retargets `_active.json` through the live
 // Inspect instance, which is constructed after `api`.
-let inspectHandle: ReturnType<typeof createInspect> | null = null;
+let inspectHandle: ReturnType<typeof createInspectRegistry> | null = null;
 
 const api = createApi(ctx, {
   onCommentsChanged: async (file) => {
@@ -101,13 +101,17 @@ const api = createApi(ctx, {
     if (collab) await collab.registry.forceDrop(slug);
   },
   retargetActive: (fromFile, toFile) => {
-    inspectHandle?.retarget(fromFile, toFile);
+    // D3 — a canvas moved on disk moved for EVERY member, so every member's
+    // state is retargeted, not just the one whose request did it.
+    for (const one of inspectHandle?.all() ?? []) one.retarget(fromFile, toFile);
   },
 });
 
-const inspect = createInspect(ctx, (file) => api.loadCommentsForFile(file));
-inspectHandle = inspect;
-await inspect.load();
+const inspects = createInspectRegistry(ctx, (file) => api.loadCommentsForFile(file));
+inspectHandle = inspects;
+// The shared instance is the desktop's, and a cell's fallback for anything that
+// arrives without a vouched session.
+await inspects.for('').load();
 
 collab = createCollab(ctx, api);
 const aiActivity = createAiActivity(ctx);
@@ -135,11 +139,11 @@ const activity = createActivity(ctx);
 // editing" banner + presence as /design:edit (RC5,
 // rca/issue-canvas-hmr-optimistic-update-consistency).
 const acp = createAcp(ctx, aiActivity);
-const ws = createWs(ctx, api, inspect, collab, activity, acp);
+const ws = createWs(ctx, api, inspects, collab, activity, acp);
 const exportJobs = createExportJobQueue(ctx.bus, ctx.paths.designRoot);
 // feature-ai-media-generation (DDR-16x) — background AI-media generation queue.
 const generateJobs = createGenerationJobQueue(ctx.bus, ctx.paths.designRoot);
-const http = createHttp(ctx, api, inspect, aiActivity, exportJobs, generateJobs);
+const http = createHttp(ctx, api, inspects, aiActivity, exportJobs, generateJobs);
 const fsWatch = createFsWatch(ctx);
 
 // Port: --port arg > $PORT > $MDCC_DEV_PORT > 4399.
@@ -177,13 +181,71 @@ const MAX_REQUEST_BODY = ASSET_MAX_VIDEO_BYTES + 8 * 1024 * 1024;
 // Checked against the ACTUAL route table (`http.routes` keys plus the paths the
 // `fetch` fall-through owns), not a hand-maintained list, so a future route can
 // only escape it by being invisible to both.
-const WORKSPACE_FETCH_ROUTES = ['/_ws/acp', '/_canvas-shell.html', '/_canvas-runtime/'];
+//
+// Split by verdict (DDR-209 A′1), because the two halves are asserted
+// differently. `/_ws/acp` is FORBIDDEN and the fall-through 404s it in a cell,
+// so it is only asserted outside workspace mode (where it is genuinely
+// reachable). The canvas surfaces are SANDBOXED — a cell serves them — so they
+// are asserted ALWAYS, which is what makes the sandbox attestation load-bearing
+// rather than decorative.
+const FETCH_ROUTES_FORBIDDEN_IN_WORKSPACE = ['/_ws/acp'];
+const FETCH_ROUTES_SANDBOXED = ['/_canvas-shell.html', '/_canvas-runtime/'];
 const WORKSPACE = isWorkspaceMode();
+// DDR-209 A′1 — the contract that lets a cell serve `/_canvas-shell` +
+// `/_canvas-runtime` at all: the canvas build runs out of process, with an empty
+// environment, an import allowlist and ceilings. Computed here rather than
+// inside workspace-mode.ts, which has no business importing the build host —
+// and passed in, so an unstated contract reads as an unmet one.
+const SANDBOX_ARMED = isSandboxArmed();
 // PRUNE first, then assert over what survived — so the assert is a
 // post-condition on the pruning rather than a second, driftable opinion. A
 // prefix added to the vocabulary then both prunes and is verified, together.
 const pruned = WORKSPACE ? pruneForWorkspace(http.routes) : { routes: http.routes, removed: [] };
-const SERVER_ROUTES = pruned.routes as typeof http.routes;
+/**
+ * Establish WHOSE request this is, once, at the only place every request passes
+ * through — Cloud Phase 27 D3.
+ *
+ * Bun matches `routes` BEFORE `fetch`, so a wrapper on the fall-through alone
+ * would miss the entire route table (the same asymmetry that made a
+ * canvas-origin route 404 in Phase 23). Wrapping here covers both halves, and
+ * the leaves — `canvasViewPath`, `canvasStatePath` — read the ambient key
+ * instead of every function between here and there growing a parameter.
+ *
+ * Outside workspace mode this resolves to `''` on every request, which
+ * `runInSession` treats as "no scope at all" and skips.
+ */
+function withSession<T extends unknown[]>(
+  handler: (req: Request, ...rest: T) => Response | Promise<Response>
+): (req: Request, ...rest: T) => Response | Promise<Response> {
+  return (req, ...rest) =>
+    runInSession(WORKSPACE ? normalizeSessionKey(req.headers.get(SESSION_HEADER)) : '', () =>
+      handler(req, ...rest)
+    );
+}
+
+/** Bun route entries are either a handler or a `{ GET, POST, … }` map. */
+function scopeRoutes<R extends Record<string, unknown>>(routes: R): R {
+  const out: Record<string, unknown> = {};
+  for (const [path, entry] of Object.entries(routes)) {
+    if (typeof entry === 'function') {
+      out[path] = withSession(entry as (req: Request) => Response | Promise<Response>);
+    } else if (entry && typeof entry === 'object') {
+      const byMethod: Record<string, unknown> = {};
+      for (const [method, fn] of Object.entries(entry as Record<string, unknown>)) {
+        byMethod[method] =
+          typeof fn === 'function'
+            ? withSession(fn as (req: Request) => Response | Promise<Response>)
+            : fn;
+      }
+      out[path] = byMethod;
+    } else {
+      out[path] = entry;
+    }
+  }
+  return out as R;
+}
+
+const SERVER_ROUTES = scopeRoutes(pruned.routes) as typeof http.routes;
 if (WORKSPACE && pruned.removed.length > 0) {
   console.log(
     `[studio] workspace mode — withheld ${pruned.removed.length} route(s) that would evaluate ` +
@@ -191,24 +253,32 @@ if (WORKSPACE && pruned.removed.length > 0) {
   );
 }
 try {
-  assertContainment([...Object.keys(SERVER_ROUTES), ...(WORKSPACE ? [] : WORKSPACE_FETCH_ROUTES)], {
-    // Presence of the dependency is the signal: a cell image that ships
-    // Playwright is one import() away from rendering tenant content. Skippable
-    // in a dev checkout, where Playwright is a legitimate devDependency of the
-    // E2E harness and would otherwise make workspace mode untestable locally.
-    // A BUILT cell image has no such escape — scripts/check-containment.sh
-    // enforces the runtime-dependency half at build time.
-    resolveModule:
-      process.env.MAUDE_WORKSPACE_ALLOW_DEV_MODULES === '1'
-        ? undefined
-        : (specifier) => {
-            try {
-              return !!import.meta.resolveSync?.(specifier);
-            } catch {
-              return false;
-            }
-          },
-  });
+  assertContainment(
+    [
+      ...Object.keys(SERVER_ROUTES),
+      ...FETCH_ROUTES_SANDBOXED,
+      ...(WORKSPACE ? [] : FETCH_ROUTES_FORBIDDEN_IN_WORKSPACE),
+    ],
+    {
+      sandboxArmed: SANDBOX_ARMED,
+      // Presence of the dependency is the signal: a cell image that ships
+      // Playwright is one import() away from rendering tenant content. Skippable
+      // in a dev checkout, where Playwright is a legitimate devDependency of the
+      // E2E harness and would otherwise make workspace mode untestable locally.
+      // A BUILT cell image has no such escape — scripts/check-containment.sh
+      // enforces the runtime-dependency half at build time.
+      resolveModule:
+        process.env.MAUDE_WORKSPACE_ALLOW_DEV_MODULES === '1'
+          ? undefined
+          : (specifier) => {
+              try {
+                return !!import.meta.resolveSync?.(specifier);
+              } catch {
+                return false;
+              }
+            },
+    }
+  );
 } catch (err) {
   console.error(`\n${(err as Error).message}\n`);
   process.exit(1);
@@ -228,10 +298,15 @@ function startServer(port: number): BunServer {
       const pathname = new URL(req.url).pathname;
 
       // Containment (DDR-193 §2) — the `fetch` fall-through owns paths that are
-      // not in the route table (`/_ws/acp`, `/_canvas-shell.html`,
-      // `/_canvas-runtime/*`), so pruning the table alone would leave them
-      // reachable. 404, not 403: a cell should look like it never had the
-      // feature, rather than like it is refusing one.
+      // not in the route table (`/_ws/acp`), so pruning the table alone would
+      // leave them reachable. 404, not 403: a cell should look like it never had
+      // the feature, rather than like it is refusing one.
+      //
+      // `/_canvas-shell.html` and `/_canvas-runtime/*` used to be caught here
+      // too. DDR-209 A′1 reclassified them: a cell SERVES them (the browser is
+      // what evaluates), attested by the build sandbox at boot. They are not in
+      // `isForbiddenRoute` any more, so they fall through to `http.fetch` — on
+      // purpose, and the boot-assert is what keeps that honest.
       if (WORKSPACE && isForbiddenRoute(pathname)) {
         return new Response('not found', { status: 404 });
       }
@@ -239,9 +314,20 @@ function startServer(port: number): BunServer {
       // Phase 8 — collab WS, binary y-websocket protocol. Loopback-only;
       // DDR-047 makes cross-machine collab a Phase 9 hub-deploy story, not
       // a `--bind 0.0.0.0` flag on this server.
+      //
+      // IN A CELL the loopback gate can never pass — the hub's authenticating
+      // proxy rewrites Host to the public URL (D4) on purpose — and it must not
+      // have to: the proxy already terminated the session and vouches the role
+      // per request with injected `x-maude-*` headers (stripped-then-injected,
+      // the Cloud Phase 27 model the inspector branch below already trusts).
+      // Without this vouched path every cloud collab upgrade 403'd here and
+      // cursors/annotations/live-sync were dead in the browser door — RCA
+      // issue-cloud-live-collaboration-dead. Outside workspace mode the DDR-047
+      // gate is verbatim unchanged.
       const collabSlug = parseCollabSlug(pathname);
       if (collabSlug !== null) {
-        if (!isLoopbackHost(req.headers.get('host'))) {
+        const vouchedRole = WORKSPACE ? req.headers.get('x-maude-role') : null;
+        if (!isLoopbackHost(req.headers.get('host')) && !vouchedRole) {
           return new Response('cross-machine collab requires Phase 9 hub deploy', {
             status: 403,
           });
@@ -252,8 +338,15 @@ function startServer(port: number): BunServer {
             remote: req.headers.get('x-forwarded-for') ?? '127.0.0.1',
             kind: 'collab',
             slug: collabSlug,
-            // Privileged shell origin — ungated (see collab/origins.ts).
-            realm: 'main',
+            // Privileged shell origin — ungated (see collab/origins.ts) —
+            // UNLESS the proxy marked this socket as canvas-realm (a cell's
+            // canvas lane forwards here when the canvas listener is the same
+            // process; defense in depth either way).
+            realm:
+              WORKSPACE && req.headers.get('x-maude-collab-realm') === 'canvas' ? 'canvas' : 'main',
+            // Same fail-closed posture as the inspector branch: in a cell an
+            // absent header is an unproven session.
+            readOnly: WORKSPACE ? req.headers.get('x-maude-readonly') !== '0' : false,
           },
         });
         if (ok) return undefined as unknown as Response;
@@ -293,12 +386,22 @@ function startServer(port: number): BunServer {
             id: crypto.randomUUID(),
             remote: req.headers.get('x-forwarded-for') ?? '127.0.0.1',
             kind: 'inspector',
+            // D3 — whose socket this is, from the proxy's vouched header. Same
+            // handshake-time reasoning as `readOnly` below; `''` on a desktop.
+            session: WORKSPACE ? normalizeSessionKey(req.headers.get(SESSION_HEADER)) : '',
+            // Cloud Phase 27 — stamp the role onto the socket at the handshake,
+            // the one moment the session is unambiguous. Fails CLOSED in a cell
+            // for the same reason the HTTP gate does: an absent header is an
+            // unproven session, and this channel can delete other people's
+            // comments.
+            readOnly: WORKSPACE ? req.headers.get('x-maude-readonly') !== '0' : false,
           },
         });
         if (ok) return undefined as unknown as Response;
         return new Response('Upgrade failed', { status: 400 });
       }
-      return http.fetch(req);
+      // D3 — the fall-through half of the same scope the route table gets above.
+      return withSession(http.fetch)(req);
     },
     websocket: ws.handler,
     error(e) {
@@ -350,10 +453,15 @@ function startCanvasServer(port: number): BunServer {
     async fetch(req, srv) {
       const pathname = new URL(req.url).pathname;
 
-      // Collab WS — shared registry, loopback-only (same gate as the main origin).
+      // Collab WS — shared registry, loopback-only (same gate as the main
+      // origin), with the same workspace-mode vouched path: in a cell the hub's
+      // canvas lane forwards the iframe's collab socket HERE, capability-
+      // authenticated, with Host rewritten to the public canvas origin (D4) —
+      // RCA issue-cloud-live-collaboration-dead.
       const collabSlug = parseCollabSlug(pathname);
       if (collabSlug !== null) {
-        if (!isLoopbackHost(req.headers.get('host'))) {
+        const vouchedRole = WORKSPACE ? req.headers.get('x-maude-role') : null;
+        if (!isLoopbackHost(req.headers.get('host')) && !vouchedRole) {
           return new Response('cross-machine collab requires Phase 9 hub deploy', { status: 403 });
         }
         const ok = srv.upgrade(req, {
@@ -364,8 +472,13 @@ function startCanvasServer(port: number): BunServer {
             slug: collabSlug,
             // UNTRUSTED canvas iframe origin (DDR-063 split). Every sync frame
             // from here goes through the origin gate and may never write a
-            // body lane — DDR-122 follow-up, collab/origins.ts.
+            // body lane — DDR-122 follow-up, collab/origins.ts. ALWAYS
+            // 'canvas' on this listener — the proxy's realm marker is not
+            // consulted, so a forged header cannot promote the socket.
             realm: 'canvas',
+            // Fail closed in a cell (absent header = unproven session);
+            // loopback desktop keeps full capability as before.
+            readOnly: WORKSPACE ? req.headers.get('x-maude-readonly') !== '0' : false,
           },
         });
         if (ok) return undefined as unknown as Response;
@@ -451,7 +564,23 @@ let server: BunServer;
 // listed: the server binds 127.0.0.1, so a user who opens the printed URL as
 // `127.0.0.1:<port>` is the same legit embedder — with only `localhost` allowed
 // the canvas iframe was silently refused (blank sad-page, no error anywhere).
-ctx.mainOrigin = `http://localhost:${server.port} http://127.0.0.1:${server.port}`;
+//
+// D4 AGAIN — the PUBLIC name, not the bound one. In a cell the parent frame is
+// `https://<project>.cloud.maude.sh`; listing only the loopback origins made the
+// browser refuse to render the canvas iframe at all ("refused to connect"),
+// which looks like a network failure and is a CSP one. The loopback spellings
+// stay for local tooling (screenshots, smoke) — a cell simply has one more legit
+// embedder, and naming it is configuration, never a Host header.
+const publicShellOrigin = (() => {
+  const url = process.env.HUB_PUBLIC_URL;
+  if (!url) return '';
+  try {
+    return ` ${new URL(url).origin}`;
+  } catch {
+    return '';
+  }
+})();
+ctx.mainOrigin = `http://localhost:${server.port} http://127.0.0.1:${server.port}${publicShellOrigin}`;
 
 // T2 (9.1-A) — segregated canvas-content origin. ON BY DEFAULT (opt-OUT) since
 // phase-9.1: a second listener binds an OS-assigned free port, advertised as
@@ -468,12 +597,25 @@ ctx.mainOrigin = `http://localhost:${server.port} http://127.0.0.1:${server.port
 const CANVAS_ORIGIN_SPLIT = !/^(0|false|off|no)$/i.test(
   process.env.MAUDE_CANVAS_ORIGIN_SPLIT ?? ''
 );
-// The canvas origin exists to SERVE AND RENDER canvases (DDR-063). A workspace
-// cell has no business starting it — that second origin is the surface the
-// containment invariant is about. Not started here rather than started-and-
-// pruned: there would be nothing left to serve.
-const canvasServer = CANVAS_ORIGIN_SPLIT && !WORKSPACE ? startCanvasServer(0) : null;
-const canvasOrigin = canvasServer ? `http://localhost:${canvasServer.port}` : undefined;
+// The canvas origin exists to SERVE canvases into a segregated origin (DDR-063
+// / DDR-054). A workspace cell used to skip it, back when a cell was forbidden
+// to serve them at all. DDR-209 A′1 reverses that, and in a cell the split is
+// not merely protective — it is the boundary between one tenant's executing
+// canvas and everything else on that host, which is the strongest reason any
+// deployment has ever had to keep it on.
+const canvasServer = CANVAS_ORIGIN_SPLIT ? startCanvasServer(0) : null;
+// D4 — PUBLIC IDENTITY COMES FROM CONFIGURATION, NEVER FROM THE REQUEST.
+//
+// The loopback origin is what this process BINDS; behind a reverse proxy it is
+// not the address the member's browser can reach, and deriving it from the Host
+// header is exactly the bug Cloud Phase 25 shipped into production twice (a
+// member signing in was sent to an address that was not their project). So a
+// cell states its canvas origin explicitly and we use it verbatim.
+const canvasOrigin = process.env.MAUDE_PUBLIC_CANVAS_ORIGIN?.replace(/\/+$/, '')
+  ? process.env.MAUDE_PUBLIC_CANVAS_ORIGIN.replace(/\/+$/, '')
+  : canvasServer
+    ? `http://localhost:${canvasServer.port}`
+    : undefined;
 if (canvasOrigin) ctx.canvasOrigin = canvasOrigin;
 
 await Bun.write(
@@ -484,6 +626,10 @@ await Bun.write(
       port: server.port,
       url: `http://localhost:${server.port}`,
       ...(canvasOrigin ? { canvasOrigin } : {}),
+      // The port the canvas listener actually BOUND, as distinct from the
+      // public `canvasOrigin` name above. A co-located reverse proxy (the cell's
+      // hub) forwards canvas-origin traffic here; nothing else needs it.
+      ...(canvasServer ? { canvasPort: canvasServer.port } : {}),
       started: new Date().toISOString(),
       project: ctx.cfg.name,
       config_source: ctx.cfg._source,
@@ -553,11 +699,28 @@ console.log(`  Design:    ${ctx.paths.designRoot}`);
 console.log(`  Active:    ${ctx.paths.activeFile}`);
 console.log('  Press Ctrl+C to stop.\n');
 
-if (!process.env.NO_OPEN) {
-  if (process.platform === 'darwin')
-    spawn('open', [url], { stdio: 'ignore', detached: true }).unref();
-  else if (process.platform === 'linux')
-    spawn('xdg-open', [url], { stdio: 'ignore', detached: true }).unref();
+// A workspace cell has nobody at the keyboard, and no browser to open — the
+// member is already looking at this project through the proxy in front of it.
+// Attempting it there was not merely pointless: the spawn threw ENOENT on a
+// headless image and took the whole server down with it, which the supervisor
+// then dutifully restarted into the same crash. Two fixes, because they are two
+// separate mistakes: do not TRY in a cell, and do not DIE when it fails.
+if (!process.env.NO_OPEN && !WORKSPACE) {
+  const opener =
+    process.platform === 'darwin' ? 'open' : process.platform === 'linux' ? 'xdg-open' : null;
+  if (opener) {
+    // `Bun.spawn`, not `node:child_process.spawn` — it reports a missing
+    // executable SYNCHRONOUSLY, so one try/catch genuinely covers it. The node
+    // shim signals ENOENT through an async 'error' event, which a try/catch
+    // does not catch and an unhandled listener turns into a process-level
+    // throw. That is precisely how a headless image with no `xdg-open` took the
+    // whole server down. (DDR-009 also prefers Bun.* here.)
+    try {
+      Bun.spawn([opener, url], { stdin: 'ignore', stdout: 'ignore', stderr: 'ignore' }).unref();
+    } catch {
+      console.log(`  (could not open a browser automatically — visit ${url})`);
+    }
+  }
 }
 
 async function shutdown() {