@1agh/maude 0.53.1 → 0.54.0

package/plugins/design/templates/_shell.html

@@ -133,30 +133,30 @@
     <script type="importmap">
       {
         "imports": {
-          "react": "/_canvas-runtime/react.js",
-          "react-dom": "/_canvas-runtime/react-dom.js",
-          "react-dom/client": "/_canvas-runtime/react-dom_client.js",
-          "react/jsx-runtime": "/_canvas-runtime/react_jsx-runtime.js",
-          "react/jsx-dev-runtime": "/_canvas-runtime/react_jsx-dev-runtime.js",
-          "pixi.js": "/_canvas-runtime/pixi-js.js",
-          "@imgly/background-removal": "/_canvas-runtime/@imgly_background-removal.js",
-          "motion": "/_canvas-runtime/motion.js",
-          "motion/react": "/_canvas-runtime/motion_react.js",
-          "yjs": "/_canvas-runtime/yjs.js",
-          "y-protocols/sync": "/_canvas-runtime/y-protocols_sync.js",
-          "y-protocols/awareness": "/_canvas-runtime/y-protocols_awareness.js",
-          "lib0/decoding": "/_canvas-runtime/lib0_decoding.js",
-          "lib0/encoding": "/_canvas-runtime/lib0_encoding.js",
-          "remotion": "/_canvas-runtime/remotion.js",
-          "@remotion/media": "/_canvas-runtime/@remotion_media.js",
-          "@remotion/player": "/_canvas-runtime/@remotion_player.js",
-          "@remotion/transitions": "/_canvas-runtime/@remotion_transitions.js",
-          "@remotion/transitions/fade": "/_canvas-runtime/@remotion_transitions_fade.js",
-          "@remotion/transitions/slide": "/_canvas-runtime/@remotion_transitions_slide.js",
-          "@remotion/transitions/wipe": "/_canvas-runtime/@remotion_transitions_wipe.js",
-          "@remotion/transitions/flip": "/_canvas-runtime/@remotion_transitions_flip.js",
-          "@remotion/transitions/clock-wipe": "/_canvas-runtime/@remotion_transitions_clock-wipe.js",
-          "@remotion/transitions/none": "/_canvas-runtime/@remotion_transitions_none.js"
+          "react": "./_canvas-runtime/react.js",
+          "react-dom": "./_canvas-runtime/react-dom.js",
+          "react-dom/client": "./_canvas-runtime/react-dom_client.js",
+          "react/jsx-runtime": "./_canvas-runtime/react_jsx-runtime.js",
+          "react/jsx-dev-runtime": "./_canvas-runtime/react_jsx-dev-runtime.js",
+          "pixi.js": "./_canvas-runtime/pixi-js.js",
+          "@imgly/background-removal": "./_canvas-runtime/@imgly_background-removal.js",
+          "motion": "./_canvas-runtime/motion.js",
+          "motion/react": "./_canvas-runtime/motion_react.js",
+          "yjs": "./_canvas-runtime/yjs.js",
+          "y-protocols/sync": "./_canvas-runtime/y-protocols_sync.js",
+          "y-protocols/awareness": "./_canvas-runtime/y-protocols_awareness.js",
+          "lib0/decoding": "./_canvas-runtime/lib0_decoding.js",
+          "lib0/encoding": "./_canvas-runtime/lib0_encoding.js",
+          "remotion": "./_canvas-runtime/remotion.js",
+          "@remotion/media": "./_canvas-runtime/@remotion_media.js",
+          "@remotion/player": "./_canvas-runtime/@remotion_player.js",
+          "@remotion/transitions": "./_canvas-runtime/@remotion_transitions.js",
+          "@remotion/transitions/fade": "./_canvas-runtime/@remotion_transitions_fade.js",
+          "@remotion/transitions/slide": "./_canvas-runtime/@remotion_transitions_slide.js",
+          "@remotion/transitions/wipe": "./_canvas-runtime/@remotion_transitions_wipe.js",
+          "@remotion/transitions/flip": "./_canvas-runtime/@remotion_transitions_flip.js",
+          "@remotion/transitions/clock-wipe": "./_canvas-runtime/@remotion_transitions_clock-wipe.js",
+          "@remotion/transitions/none": "./_canvas-runtime/@remotion_transitions_none.js"
         }
       }
     </script>
@@ -190,8 +190,38 @@
       // `git show <sha>:<path>`). Baked into the module URL so both the initial
       // import and the HMR soft-reload carry it.
       const shaParam = params.get('sha');
+      // Cloud Phase 27 (DDR-209) — THE CAPABILITY TRAVELS WITH EVERY REQUEST.
+      //
+      // On a desktop the canvas origin is loopback and needs none, so `cap` is
+      // empty and every URL below is byte-identical to what it has always been.
+      //
+      // In the cloud the canvas origin is a cookieless hostname on the public
+      // internet: a cookie able to reach it would be readable by the canvas
+      // content itself, which is exactly what the DDR-054 split exists to
+      // prevent. So the capability rides in the URL — and it has to ride in
+      // EVERY url, not just this document's, because the shell then fetches its
+      // module, its tokens, its components CSS and its meta as separate
+      // requests. Getting the document through and nothing else is what
+      // "refused to connect" looks like from the outside.
+      const cap = params.get('t') || '';
+      // THE BASE THIS DOCUMENT WAS SERVED FROM, not the origin root.
+      //
+      // The fleet's canvas origin puts the project in the PATH
+      // (`canvas.<zone>/<project>/…`), so an absolute `/…` URL built here
+      // resolves against the origin and loses the project — the browser then
+      // asks for `canvas.<zone>/.design/…`, the data plane reads `.design` as a
+      // project name, and every dynamic import fails. Derived from where this
+      // document actually is rather than passed in, so it is right by
+      // construction in all three shells: on a desktop the shell is served at
+      // `/_canvas-shell.html` and the base is empty, leaving every URL below
+      // byte-identical to what it has always been.
+      const base = location.pathname.replace(/\/_canvas-shell(\.html)?$/, '');
+      const withCap = (u) => {
+        const abs = u.startsWith('/') ? base + u : u;
+        return cap ? abs + (abs.includes('?') ? '&' : '?') + 't=' + encodeURIComponent(cap) : abs;
+      };
       const canvasQuery = shaParam ? ('?sha=' + encodeURIComponent(shaParam)) : '';
-      const canvasUrl = canvasRel ? ('/' + designRel + '/' + canvasRel + canvasQuery) : null;
+      const canvasUrl = canvasRel ? withCap('/' + designRel + '/' + canvasRel + canvasQuery) : null;
       const myFileKey = canvasRel ? (designRel + '/' + canvasRel) : null;
       // True while an `ai-activity` entry is live for THIS canvas (an agent is
       // running /design:edit|new on it). Mirrors ai-banner's gate: parent relays
@@ -274,7 +304,11 @@
       // The WS connection retries on close (dev-server restart resilience).
       function connectHmr() {
         const proto = location.protocol === 'https:' ? 'wss' : 'ws';
-        const ws = new WebSocket(proto + '://' + location.host + '/_ws');
+        // `base` for the same reason every other URL here carries it: on the
+        // fleet's canvas origin the project is in the path. (A cell's HMR socket
+        // is a separate matter — it has no cookie to authenticate with, so it
+        // simply does not connect there; a canvas still renders.)
+        const ws = new WebSocket(proto + '://' + location.host + base + '/_ws');
         ws.addEventListener('message', (ev) => {
           try {
             const msg = JSON.parse(ev.data);
@@ -417,7 +451,7 @@
               // listens for `maude:meta-refreshed` and re-applies layout +
               // viewport in-place (no full reload — preserves tool / undo state).
               const metaFileParam = encodeURIComponent(designRel + '/' + canvasRel);
-              fetch('/_api/canvas-meta?file=' + metaFileParam, {
+              fetch(withCap('/_api/canvas-meta?file=' + metaFileParam), {
                 headers: { 'Cache-Control': 'no-store' },
               })
                 .then((r) => (r.ok ? r.json() : null))
@@ -444,13 +478,13 @@
       if (!canvasRel) {
         showError('Missing ?canvas= query parameter. Add ?canvas=ui/<slug>.tsx.');
       } else {
-        if (tokensRel) document.getElementById('canvas-tokens').href = '/' + designRel + '/' + tokensRel;
-        if (componentsRel) document.getElementById('canvas-components').href = '/' + designRel + '/' + componentsRel;
+        if (tokensRel) document.getElementById('canvas-tokens').href = withCap('/' + designRel + '/' + tokensRel);
+        if (componentsRel) document.getElementById('canvas-components').href = withCap('/' + designRel + '/' + componentsRel);
         if (layoutRel) {
           // Inject a third <link> for the DS layout chrome (specimens load this).
           const layoutLink = document.createElement('link');
           layoutLink.rel = 'stylesheet';
-          layoutLink.href = '/' + designRel + '/' + layoutRel;
+          layoutLink.href = withCap('/' + designRel + '/' + layoutRel);
           layoutLink.dataset.canvasCss = 'layout';
           document.head.appendChild(layoutLink);
         }
@@ -466,7 +500,7 @@
         // server-side api.fileSlug (which trims paths.designRel).
         window.__canvas_design_rel__ = designRel;
         window.__canvas_rel__ = canvasRel;
-        const metaFetch = fetch('/_api/canvas-meta?file=' + metaFileParam, {
+        const metaFetch = fetch(withCap('/_api/canvas-meta?file=' + metaFileParam), {
           headers: { 'Cache-Control': 'no-store' },
         })
           .then((r) => (r.ok ? r.json() : null))
@@ -484,7 +518,7 @@
           // the importmap so the canvas module and the comment layer share one
           // React singleton (inlining a second React would break hooks).
           const [{ mountCanvas }, mod] = await Promise.all([
-            import('/_client/comment-mount.js'),
+            import(withCap('/_client/comment-mount.js')),
             import(canvasUrl),
             metaFetch,
           ]);

package/plugins/flow/.claude-plugin/config.schema.json

@@ -324,7 +324,7 @@
         },
         "engineVersion": {
           "type": "string",
-          "default": "v0.1.9",
+          "default": "v1.0.0",
           "description": "PINNED kgai release the CLI + desktop bundle target. Advance deliberately (harness-verified via `maude kg check-upstream`), never float — auto-tracking `latest` would let an upstream change silently alter behavior mid-rollout and is a supply-chain surface (DDR-054/056 reasoning: the bundled `kg` is third-party)."
         },
         "store": {

package/plugins/flow/dependencies.json

@@ -105,7 +105,7 @@
       },
       "install": {
         "preferred": "See docs/kgai-onboarding.md — download the pinned kgai release binary (kgai is capability-gated + opt-out; nothing to install to use classic .ai/ mode)",
-        "darwin": "curl -fsSL https://github.com/kgaidev/kgai/releases/download/v0.1.9/kg-darwin-arm64 -o /usr/local/bin/kg && chmod +x /usr/local/bin/kg"
+        "darwin": "curl -fsSL https://github.com/kgaidev/kgai/releases/download/v1.0.0/kg-darwin-arm64 -o /usr/local/bin/kg && chmod +x /usr/local/bin/kg"
       },
       "autoInstall": false,
       "fallbackBehavior": "flow/design fall back to the classic .ai/decisions/ + STATE.md file path (no regression). The kgai knowledge-graph backend (kg context/ingest/sync, cross-repo company memory) is inactive.",