@1agh/maude 0.53.1 → 0.54.0

package/apps/studio/test/session-scope.test.ts

@@ -0,0 +1,100 @@
+// Cloud Phase 27 D3 — whose runtime state is this?
+//
+// `_active.json` and `_canvas-state/<slug>.view.json` are per-MACHINE
+// singletons by design (DDR-115), which is right for a desktop and wrong for a
+// cell: one studio process serves an owner and a viewer, so a colleague opening
+// a canvas switched YOUR tab and their pan moved YOUR camera. Silently — it
+// read as flakiness, not as two people sharing one file.
+//
+// The first test is the one that matters most: OUTSIDE a cell nothing changes.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  currentSession,
+  normalizeSessionKey,
+  runInSession,
+  sessionDir,
+  sessionFile,
+} from '../session-scope.ts';
+
+describe('session scope', () => {
+  test('with no session every path is byte-for-byte what it was', () => {
+    expect(currentSession()).toBe('');
+    expect(sessionDir('/repo/.design/_canvas-state')).toBe('/repo/.design/_canvas-state');
+    expect(sessionFile('/repo/.design/_active.json')).toBe('/repo/.design/_active.json');
+  });
+
+  test('a session gives each member their own subtree and their own active file', () => {
+    runInSession('a1b2c3d4e5f60718', () => {
+      expect(currentSession()).toBe('a1b2c3d4e5f60718');
+      expect(sessionDir('/repo/.design/_canvas-state')).toBe(
+        '/repo/.design/_canvas-state/a1b2c3d4e5f60718'
+      );
+      // A SIBLING of `_active.json`, not a rename: the runtime-state taxonomy,
+      // the gitignore and `isMaudeRuntimeState` all match that stem by name,
+      // and a sibling keeps every one of them correct with no fourth list.
+      expect(sessionFile('/repo/.design/_active.json')).toBe(
+        '/repo/.design/_active.a1b2c3d4e5f60718.json'
+      );
+    });
+  });
+
+  test('the scope does not leak past the call', () => {
+    runInSession('deadbeef', () => expect(currentSession()).toBe('deadbeef'));
+    expect(currentSession()).toBe('');
+  });
+
+  test('two sessions do not see each other', () => {
+    runInSession('one', () => {
+      expect(currentSession()).toBe('one');
+      runInSession('two', () => expect(currentSession()).toBe('two'));
+      expect(currentSession()).toBe('one');
+    });
+  });
+
+  test('the scope survives an await — a request is not one tick', async () => {
+    await runInSession('async1', async () => {
+      await new Promise((r) => setTimeout(r, 5));
+      expect(currentSession()).toBe('async1');
+      await Promise.resolve();
+      expect(currentSession()).toBe('async1');
+    });
+  });
+
+  test('a key that is not proxy-shaped is refused, not sanitized', () => {
+    // The value becomes a path segment, so this is the traversal gate — and it
+    // REJECTS rather than strips, because a key we had to repair is not one
+    // whose intent we should be guessing. Falling back to the shared singleton
+    // is the same behaviour a desktop already has.
+    for (const bad of [
+      '../../etc/passwd',
+      'a/b',
+      'a\\b',
+      '.',
+      '..',
+      'has space',
+      'x'.repeat(65),
+      '',
+      null,
+      undefined,
+    ]) {
+      expect(normalizeSessionKey(bad as string)).toBe('');
+    }
+    for (const good of ['abc123', 'a1b2c3d4e5f60718', 'A_b-9']) {
+      expect(normalizeSessionKey(good)).toBe(good);
+    }
+    // …and a refused key means the shared path, never a traversed one.
+    runInSession('../../etc', () => {
+      expect(sessionDir('/repo/.design/_canvas-state')).toBe('/repo/.design/_canvas-state');
+    });
+  });
+
+  test('a file with no extension still gets a distinct per-session name', () => {
+    runInSession('k', () => {
+      expect(sessionFile('/repo/.design/_active')).toBe('/repo/.design/_active.k');
+      // A dot in a PARENT directory must not be mistaken for the extension.
+      expect(sessionFile('/repo/my.dir/_active')).toBe('/repo/my.dir/_active.k');
+    });
+  });
+});

package/apps/studio/test/shell-importmap.test.ts

@@ -43,7 +43,14 @@ describe('_shell.html importmap agrees with RUNTIME_PACKAGES', () => {
 
   for (const pkg of RUNTIME_PACKAGES) {
     test(`"${pkg}" resolves to its /_canvas-runtime/ bundle`, () => {
-      expect(imports[pkg]).toBe(`/_canvas-runtime/${slugFor(pkg)}.js`);
+      // RELATIVE (`./`), and that leading dot is load-bearing (Cloud Phase 27).
+      // An importmap value resolves against the DOCUMENT's base URL, so a
+      // root-absolute `/_canvas-runtime/…` is correct only where the shell is
+      // served from the origin root. On the fleet's shared canvas host the
+      // shell lives under `/<project>/`, and every bundle 404'd there — the
+      // grey-canvas failure the per-project origin was introduced to end.
+      // Relative is right in BOTH shapes, so it is the one form to hold.
+      expect(imports[pkg]).toBe(`./_canvas-runtime/${slugFor(pkg)}.js`);
     });
   }
 });

package/apps/studio/test/sync-autocommit.test.ts

@@ -12,6 +12,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
+import { REPO_LOCK_FILE } from '../git/repo-lock.ts';
 import {
   commitMessage,
   createAutoCommit,
@@ -332,3 +333,78 @@ describe('mirror push — never rewrites someone else’s work', () => {
 function silent() {
   return { warn: () => {}, error: () => {}, log: () => {} };
 }
+
+describe('a contended lock must not lose the queue or the process (Phase 27 D2)', () => {
+  test('a lock timeout re-queues the files instead of dropping them', async () => {
+    // `flush()` clears `touched` BEFORE it commits, and `withRepoLock` THROWS
+    // when it cannot acquire. Without a catch, a contended autosave dropped its
+    // file list silently — the bytes stay on disk, uncommitted, with nothing to
+    // retry them — and rejected a promise the debounce timer discards, which on
+    // Node >= 15 takes the process down with it. Post-D2 the trigger is
+    // ordinary: `pull` and `checkout` hold this lock across a NETWORK call.
+    const dir = mkdtempSync(path.join(tmpdir(), 'autocommit-lock-'));
+    try {
+      mkdirSync(path.join(dir, '.git'), { recursive: true });
+      // A live holder that is not stale — every acquire attempt will time out.
+      writeFileSync(
+        path.join(dir, '.git', REPO_LOCK_FILE),
+        JSON.stringify({ pid: process.pid, holder: 'studio:pull', at: Date.now(), token: 'held' })
+      );
+
+      const ran: string[][] = [];
+      const auto = createAutoCommit({
+        repoRoot: dir,
+        debounceMs: 5,
+        log: { warn() {}, error() {}, log() {} },
+        run: async (args) => {
+          ran.push(args);
+          return { code: 0, stdout: '', stderr: '' };
+        },
+      });
+
+      auto.note('.design/ui/Home.tsx', { name: 'A', email: 'a@b.c' });
+      const outcome = await auto.flush();
+
+      expect(outcome?.ok).toBe(false);
+      // Nothing reached git — the lock was never acquired.
+      expect(ran).toEqual([]);
+      // THE POINT: the file is still queued, so the next quiescence retries it.
+      expect(auto.pending()).toEqual(['.design/ui/Home.tsx']);
+      auto.stop();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }, 30_000);
+
+  test('the debounce timer never surfaces an unhandled rejection', async () => {
+    // The timer fires unattended; a rejection it discards is a process exit.
+    const dir = mkdtempSync(path.join(tmpdir(), 'autocommit-timer-'));
+    try {
+      mkdirSync(path.join(dir, '.git'), { recursive: true });
+      writeFileSync(
+        path.join(dir, '.git', REPO_LOCK_FILE),
+        JSON.stringify({ pid: process.pid, holder: 'studio:fold', at: Date.now(), token: 'held' })
+      );
+      const rejections: unknown[] = [];
+      const onUnhandled = (err: unknown) => rejections.push(err);
+      process.on('unhandledRejection', onUnhandled);
+      try {
+        const auto = createAutoCommit({
+          repoRoot: dir,
+          debounceMs: 5,
+          log: { warn() {}, error() {}, log() {} },
+          run: async () => ({ code: 0, stdout: '', stderr: '' }),
+        });
+        auto.note('.design/ui/Home.tsx', { name: 'A', email: 'a@b.c' });
+        // Long enough for the debounce to fire AND the lock wait to expire.
+        await new Promise((r) => setTimeout(r, 1000));
+        auto.stop();
+      } finally {
+        process.off('unhandledRejection', onUnhandled);
+      }
+      expect(rejections).toEqual([]);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }, 30_000);
+});

package/apps/studio/test/sync-hardening.test.ts

@@ -137,6 +137,81 @@ describe('DDR-054 §2a — CI environment gate', () => {
   });
 });
 
+/* ------------------------------------------- Phase 27 D2 — a cell owns its history */
+
+describe('Cloud Phase 27 D2 — a workspace cell ignores the tenant´s linkedHub', () => {
+  let saved: string | undefined;
+
+  beforeEach(() => {
+    saved = process.env.MAUDE_WORKSPACE_MODE;
+  });
+  afterEach(() => {
+    if (saved === undefined) {
+      delete process.env.MAUDE_WORKSPACE_MODE;
+    } else process.env.MAUDE_WORKSPACE_MODE = saved;
+  });
+
+  function linkedCtx() {
+    const designRoot = join(dir, 'design');
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    return {
+      cfg: {
+        name: 't',
+        projectLabel: null,
+        designRoot: 'design',
+        canvasGroups: [{ label: 'Canvases', path: 'ui' }],
+        rootClass: 'app',
+        themeDefault: 'dark' as const,
+        tokensCssRel: 'system/x.css',
+        teamAccentDefault: null,
+        handoffTargets: [],
+        newCanvasDir: 'ui',
+        newComponentDir: 'ui/components',
+        // The TENANT's committed config, carrying whatever hub their desktop
+        // was linked to. It is versioned, so it arrives in the cell with the
+        // checkout.
+        linkedHub: { url: 'https://someone-elses-hub.example.com', linkedAt: 1 },
+        _source: 'defaults' as const,
+      },
+      projectLabel: 't',
+      paths: {
+        repoRoot: dir,
+        designRel: 'design',
+        designRoot,
+        serverInfoFile: '',
+        activeFile: '',
+        commentsDir: join(designRoot, '_comments'),
+        canvasStateDir: '',
+        historyDir: '',
+        tokensUrlRel: '',
+        systemDirRel: 'system',
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: minimal bus stub
+      bus: { on: () => () => {}, emit: () => {} } as any,
+    };
+  }
+
+  test('in a cell it refuses, and says which authority won', () => {
+    // Honouring the tenant's `linkedHub` inside a cell would dial OUT to a
+    // third-party hub carrying their canvases, and start a SECOND autocommit
+    // over the tree the hub is already committing. Both were unreachable by
+    // accident (no `~/.config/maude/hubs.json` in a cell), and an accident is
+    // not an invariant.
+    const warned: string[] = [];
+    const original = console.warn;
+    console.warn = (...args: unknown[]) => warned.push(args.map(String).join(' '));
+    process.env.MAUDE_WORKSPACE_MODE = '1';
+    try {
+      expect(createSyncRuntime(linkedCtx())).toBeNull();
+      // Not just null — null for THIS reason. Without the message this test
+      // would pass on the missing-token path it is meant to precede.
+      expect(warned.join(' ')).toContain('the hub owns history');
+    } finally {
+      console.warn = original;
+    }
+  });
+});
+
 /* ---------------------------------------------------------------- §2b .tsx refusal */
 
 // Coverage moved to sync-runtime.test.ts > discoverCanvases >

package/apps/studio/test/workspace-containment.test.ts

@@ -18,8 +18,10 @@ import {
   FORBIDDEN_ROUTE_PREFIXES,
   formatContainmentFailure,
   isForbiddenRoute,
+  isSandboxedRoute,
   isWorkspaceMode,
   pruneForWorkspace,
+  SANDBOXED_ROUTE_PREFIXES,
 } from '../workspace-mode.ts';
 
 const CELL = { MAUDE_WORKSPACE_MODE: '1' } as NodeJS.ProcessEnv;
@@ -73,8 +75,8 @@ describe('checkContainment — what a cell may serve', () => {
     for (const route of [
       '/_api/export-jobs',
       '/_api/export/png',
-      '/_canvas-shell.html',
-      '/_canvas-runtime/react.js',
+      '/_api/github/repos',
+      '/_api/claude/signin',
       '/_ws/acp',
     ]) {
       const report = checkContainment([...ALLOWED_ROUTES, route]);
@@ -145,18 +147,67 @@ describe('assertContainment — the boot gate', () => {
   test('the failure message names the surface, the reason, and the way out', () => {
     let message = '';
     try {
-      assertContainment([...ALLOWED_ROUTES, '/_canvas-shell.html'], { env: CELL });
+      assertContainment([...ALLOWED_ROUTES, '/_api/export'], { env: CELL });
     } catch (err) {
       message = (err as Error).message;
     }
-    expect(message).toContain('/_canvas-shell.html');
+    expect(message).toContain('/_api/export');
     expect(message).toContain('DDR-193');
-    expect(message).toContain('executes a canvas module');
+    expect(message).toContain('headless browser');
     // The escape hatch is named so the next engineer doesn't invent a flag.
     expect(message).toContain('Direction B');
     expect(message).toContain('HARD PREREQUISITE');
   });
 
+  // ---- DDR-209 A′1: the sandboxed lane -----------------------------------
+  //
+  // `/_canvas-shell` and `/_canvas-runtime` used to be on the forbidden list.
+  // They are not forbidden and they are not free: a cell may serve them ONLY
+  // while the out-of-process build sandbox is armed. These three tests are the
+  // difference between a reclassification and a loosening.
+
+  test('a canvas surface is REFUSED when the build sandbox is not armed', () => {
+    const report = checkContainment([...ALLOWED_ROUTES, '/_canvas-shell.html'], {
+      sandboxArmed: false,
+    });
+    expect(report.ok).toBe(false);
+    expect(report.unattested[0]?.route).toBe('/_canvas-shell.html');
+    // And it is NOT reported as forbidden — the two failures have different
+    // fixes, and collapsing them would send someone to delete a route that is
+    // supposed to be there.
+    expect(report.routes).toEqual([]);
+  });
+
+  test('a canvas surface is PERMITTED once the sandbox is armed', () => {
+    const report = checkContainment(
+      [...ALLOWED_ROUTES, '/_canvas-shell.html', '/_canvas-runtime/react.js'],
+      { sandboxArmed: true }
+    );
+    expect(report.ok).toBe(true);
+  });
+
+  test('the attestation defaults to UNMET — an unstated contract is not a contract', () => {
+    expect(checkContainment(['/_canvas-shell.html']).ok).toBe(false);
+  });
+
+  test('arming the sandbox does not permit anything on the FORBIDDEN list', () => {
+    // The failure this rules out: `sandboxArmed: true` becoming a master key.
+    const report = checkContainment([...ALLOWED_ROUTES, '/_api/export', '/_ws/acp'], {
+      sandboxArmed: true,
+    });
+    expect(report.ok).toBe(false);
+    expect(report.routes.map((r) => r.route).sort()).toEqual(['/_api/export', '/_ws/acp']);
+  });
+
+  test('the unattested message explains the contract rather than just refusing', () => {
+    const message = formatContainmentFailure(
+      checkContainment(['/_canvas-shell.html'], { sandboxArmed: false })
+    );
+    expect(message).toContain('BUILD SANDBOX is not armed');
+    expect(message).toContain('EMPTY environment');
+    expect(message).toContain('DDR-209');
+  });
+
   test('formatContainmentFailure reports routes and modules together', () => {
     const report = checkContainment([...ALLOWED_ROUTES, '/_api/export'], {
       resolveModule: (s) => s === 'puppeteer',
@@ -175,13 +226,34 @@ describe('the vocabulary itself', () => {
     // quietly dropping an entry while every other test stays green. Changing
     // this list should require changing this test, on purpose.
     expect(FORBIDDEN_ROUTE_PREFIXES.map((f) => f.prefix).sort()).toEqual([
+      // Surfaces that EVALUATE tenant content on our compute…
+      '/_api/acp',
+      '/_api/claude',
+      '/_api/cloud',
+      '/_api/debug-bundle',
+      '/_api/design',
       '/_api/export',
       '/_api/generate',
+      '/_api/github',
+      '/_api/hub',
       '/_api/photo-edit',
+      // Spawns a headless browser against the studio — same evaluation as
+      // `/_api/export`, and there is no browser in a cell image.
+      '/_api/shell-shot',
+      '/_ws/acp',
+    ]);
+    // …and the two that a cell SERVES, under an asserted contract (DDR-209 A′1).
+    // They moved lists; they did not stop being checked. See the sandbox tests
+    // above for what "under contract" is worth.
+    expect(SANDBOXED_ROUTE_PREFIXES.map((f) => f.prefix).sort()).toEqual([
       '/_canvas-runtime',
       '/_canvas-shell',
-      '/_ws/acp',
     ]);
+    // Nothing may be on both lists — that would make the weaker one decorative.
+    const forbidden = new Set(FORBIDDEN_ROUTE_PREFIXES.map((f) => f.prefix));
+    for (const { prefix } of SANDBOXED_ROUTE_PREFIXES) {
+      expect(forbidden.has(prefix)).toBe(false);
+    }
     expect([...FORBIDDEN_MODULES].sort()).toEqual([
       'playwright',
       'playwright-core',
@@ -245,14 +317,21 @@ describe('pruneForWorkspace — how a cell can boot at all', () => {
   });
 
   test('isForbiddenRoute is the single predicate both the table and fetch use', () => {
-    // The `fetch` fall-through owns paths that are not in the route table
-    // (/_ws/acp, /_canvas-shell.html, /_canvas-runtime/*), so it gates on this
-    // same function. One predicate, so the two gates cannot disagree.
-    expect(isForbiddenRoute('/_canvas-shell.html')).toBe(true);
-    expect(isForbiddenRoute('/_canvas-runtime/react.js')).toBe(true);
+    // The `fetch` fall-through owns `/_ws/acp`, which is not in the route table,
+    // so it gates on this same function. One predicate, so the two gates cannot
+    // disagree.
     expect(isForbiddenRoute('/_ws/acp')).toBe(true);
+    expect(isForbiddenRoute('/_api/github/repos')).toBe(true);
     expect(isForbiddenRoute('/_ws')).toBe(false);
     expect(isForbiddenRoute('/_health')).toBe(false);
     expect(isForbiddenRoute('/_api/asset')).toBe(false);
+    // DDR-209 A′1 — the canvas surfaces are NOT forbidden, which is exactly why
+    // the fall-through stopped 404-ing them. `isSandboxedRoute` is where they
+    // are now accounted for.
+    expect(isForbiddenRoute('/_canvas-shell.html')).toBe(false);
+    expect(isForbiddenRoute('/_canvas-runtime/react.js')).toBe(false);
+    expect(isSandboxedRoute('/_canvas-shell.html')).toBe(true);
+    expect(isSandboxedRoute('/_canvas-runtime/react.js')).toBe(true);
+    expect(isSandboxedRoute('/_health')).toBe(false);
   });
 });

package/apps/studio/use-collab.tsx

@@ -592,6 +592,13 @@ function createSession(slug: string): CollabSession {
   let cancelled = false;
   let reconnectTimer: ReturnType<typeof setTimeout> | null = null;
   let wsRef: WebSocket | null = null;
+  // Consecutive failed connects. A server that refuses the upgrade (403/401 —
+  // e.g. a deployment whose proxy does not carry the collab lane) used to be
+  // retried every second, forever, silently — which is indistinguishable from
+  // "nobody else is here" (the cloud-collab RCA shipped invisible exactly this
+  // way). Back off exponentially and say so once.
+  let failedConnects = 0;
+  let failureWarned = false;
 
   function sendFrame(ws: WebSocket, payload: Uint8Array) {
     try {
@@ -624,6 +631,8 @@ function createSession(slug: string): CollabSession {
     wsRef = ws;
 
     ws.addEventListener('open', () => {
+      failedConnects = 0;
+      failureWarned = false;
       session.connected = true;
       notifySession(session);
       // Sync step 1 — announce our state vector so the server can send the
@@ -637,11 +646,22 @@ function createSession(slug: string): CollabSession {
     });
 
     ws.addEventListener('close', () => {
+      const hadConnected = session.connected;
       session.connected = false;
       notifySession(session);
       wsRef = null;
       if (cancelled) return;
-      reconnectTimer = setTimeout(connect, 1000);
+      failedConnects = hadConnected ? 0 : failedConnects + 1;
+      if (failedConnects >= 5 && !failureWarned) {
+        failureWarned = true;
+        console.warn(
+          '[collab] live sync unavailable — the collab socket keeps being refused. ' +
+            'Presence, live annotations and cross-peer updates are off until it connects.'
+        );
+      }
+      // 1s → 2s → 4s → … capped at 15s; a healthy drop (was connected) retries fast.
+      const delay = Math.min(1000 * 2 ** Math.min(failedConnects, 4), 15000);
+      reconnectTimer = setTimeout(connect, delay);
     });
 
     ws.addEventListener('error', () => {

package/apps/studio/whats-new.json

@@ -1,13 +1,58 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "your-own-place-in-a-shared-project",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "improvement",
+      "title": "A shared project keeps your place",
+      "summary": "Open a cloud project and you land on a canvas, not an empty pane, with one line telling you what you can do there. Your open canvas and your pan and zoom are now yours alone — a teammate moving around no longer moves you. And reading a project no longer means reading it blind: reviewers can open the Inspector and Layers panels, which quietly refused to appear before.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "the-real-studio-in-your-browser",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "feature",
+      "title": "The full studio, in your browser",
+      "summary": "A cloud project opened in a browser now gives you the same application as the desktop — Files, Layers, Inspector, search, the toolbar and the live status — and your designs look like your designs: photographs, logos and webfonts load on the canvas. The browser tab also names the account you are signed in as, and lets you sign out.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "design-system-component-styles-load",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "fix",
+      "title": "Design-system styles render on canvases",
+      "summary": "Canvases in a project with a bootstrapped design system were drawing without their component styles — buttons, cards, inputs and the rest fell back to unstyled defaults. They render correctly again, on the desktop as well as in the browser.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "cloud-live-collaboration-connects",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "fix",
+      "title": "Live collaboration works in the browser",
+      "summary": "Opening a cloud project in two browsers now actually collaborates: you see each other's cursors with names, annotations and comments appear live for everyone, and every change is saved to the project. Before, the live channel never connected — selections crossed over anonymously and annotations silently stayed on the machine that drew them.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "bug-reports-see-the-maude-window",
+      "version": "0.53.2",
+      "kind": "improvement",
+      "title": "Bug reports now show the Maude window",
+      "summary": "Report a bug used to attach only the artboard, so anything wrong with Maude itself — the menus, the sidebar, a panel — was never in the picture. It now captures the whole window too, and you can attach your own screenshot for whatever a fresh capture can't show, like an open menu or a stuck spinner.",
+      "surface": "design-ui",
+      "date": "2026-08-03"
+    },
     {
       "id": "open-your-project-in-a-browser",
       "version": "0.53.0",
       "date": "2026-08-02",
       "kind": "feature",
-      "title": "Open your project in a browser — nothing to install",
-      "summary": "Send a teammate a link and they open the real project in their browser: the actual canvases, the actual design system. They can move things, edit text and colours, leave notes, and download the whole thing — signed in with their Maude account, with the same rights they have in the app.",
+      "title": "Open your project in a browser — early access",
+      "summary": "Send a teammate a link and they open the project in their browser, signed in with their Maude account and with the rights their role gives them. This first release shows a simplified view: the full Maude Studio — Files, Layers, Inspector, search — and your project's own images and fonts are coming next.",
       "surface": "design-ui"
     },
     {