@1agh/maude 0.53.2 → 0.55.0

package/apps/studio/test/session-runtime-state.test.ts

@@ -0,0 +1,226 @@
+// Cloud Phase 27 D3, end to end: two members of one cell keep their own place.
+//
+// The unit test next door proves the path helpers; this proves the wiring — a
+// real server in workspace mode, two vouched sessions, and the two files the
+// plan names by hand: `_active.json` (selection, open tabs) and
+// `_canvas-state/<slug>.view.json` (the camera).
+//
+// The last test is the one that must never go red for the desktop: with no
+// session header the server writes exactly the paths it always wrote.
+
+import { describe, expect, test } from 'bun:test';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+import { isMaudeRuntimeState } from '../git/service.ts';
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+/** The proxy's vouched headers for one member (studio-proxy.mjs injects these). */
+function asMember(session: string, role = 'owner') {
+  return {
+    'x-maude-session': session,
+    'x-maude-role': role,
+    'x-maude-readonly': '0',
+  };
+}
+
+const CANVAS = '.design/ui/fixture.html';
+
+describe('two members, one cell', () => {
+  test('the camera is per member, and the desktop path is untouched', async () => {
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, {
+      MAUDE_WORKSPACE_MODE: '1',
+      // A dev checkout resolves Playwright, a legitimate devDependency that
+      // would otherwise fail the module half of the containment assert before
+      // workspace mode could be tested at all.
+      MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+    });
+    try {
+      const base = `http://localhost:${port}`;
+      const patch = (session: string | null, zoom: number) =>
+        fetch(`${base}/_api/canvas-meta`, {
+          method: 'PATCH',
+          headers: {
+            'content-type': 'application/json',
+            ...(session ? asMember(session) : {}),
+          },
+          body: JSON.stringify({
+            file: CANVAS,
+            patch: { viewport: { x: zoom * 10, y: 0, zoom } },
+          }),
+        });
+
+      const alice = await patch('aaaaaaaaaaaaaaaa', 2);
+      const bob = await patch('bbbbbbbbbbbbbbbb', 3);
+      expect(alice.status).toBe(200);
+      expect(bob.status).toBe(200);
+
+      // Each member's camera is its own FILE — the whole point.
+      const aliceView = join(
+        designRoot,
+        '_canvas-state',
+        'aaaaaaaaaaaaaaaa',
+        'ui-fixture.view.json'
+      );
+      const bobView = join(designRoot, '_canvas-state', 'bbbbbbbbbbbbbbbb', 'ui-fixture.view.json');
+      expect(existsSync(aliceView)).toBe(true);
+      expect(existsSync(bobView)).toBe(true);
+      expect((await Bun.file(aliceView).json()).viewport.zoom).toBe(2);
+      expect((await Bun.file(bobView).json()).viewport.zoom).toBe(3);
+
+      // And each reads back their OWN camera, not the last writer's.
+      const read = async (session: string) => {
+        const r = await fetch(`${base}/_api/canvas-meta?file=${encodeURIComponent(CANVAS)}`, {
+          headers: asMember(session),
+        });
+        return (await r.json()) as { viewport?: { zoom?: number } };
+      };
+      expect((await read('aaaaaaaaaaaaaaaa')).viewport?.zoom).toBe(2);
+      expect((await read('bbbbbbbbbbbbbbbb')).viewport?.zoom).toBe(3);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+
+  test('with no session header the camera lands where it always did', async () => {
+    // The desktop regression gate. A `_canvas-state/<slug>.view.json` at the
+    // top level, no subdirectory, byte-for-byte the pre-D3 layout.
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port);
+    try {
+      const res = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ file: CANVAS, patch: { viewport: { x: 1, y: 2, zoom: 1.5 } } }),
+      });
+      expect(res.status).toBe(200);
+      expect(existsSync(join(designRoot, '_canvas-state', 'ui-fixture.view.json'))).toBe(true);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+
+  test('a forged session key cannot escape the canvas-state directory', async () => {
+    // The key becomes a path segment, so it is a traversal surface. The proxy
+    // strips inbound `x-maude-*` before injecting its own, which is the real
+    // defence; this is the second one.
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, {
+      MAUDE_WORKSPACE_MODE: '1',
+      // A dev checkout resolves Playwright, a legitimate devDependency that
+      // would otherwise fail the module half of the containment assert before
+      // workspace mode could be tested at all.
+      MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+    });
+    try {
+      const res = await fetch(`http://localhost:${port}/_api/canvas-meta`, {
+        method: 'PATCH',
+        headers: {
+          'content-type': 'application/json',
+          'x-maude-session': '../../../../tmp/pwned',
+          'x-maude-role': 'owner',
+          'x-maude-readonly': '0',
+        },
+        body: JSON.stringify({ file: CANVAS, patch: { viewport: { x: 0, y: 0, zoom: 1 } } }),
+      });
+      expect(res.status).toBe(200);
+      // Refused, not sanitized — so it lands on the shared singleton, exactly
+      // where a request with no session at all would.
+      expect(existsSync(join(designRoot, '_canvas-state', 'ui-fixture.view.json'))).toBe(true);
+      expect(existsSync('/tmp/pwned')).toBe(false);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+
+  test('`_active.json` is per member too', async () => {
+    // Selection + open tabs travel over the inspector WebSocket, so this drives
+    // the socket the way the client does — including the handshake, which is
+    // where the session is stamped (a role, and now an identity, is per session
+    // and a handshake is the one moment it is unambiguous).
+    const { root, designRoot } = makeSandbox();
+    const port = nextPort();
+    const proc = await bootServer(root, port, {
+      MAUDE_WORKSPACE_MODE: '1',
+      // A dev checkout resolves Playwright, a legitimate devDependency that
+      // would otherwise fail the module half of the containment assert before
+      // workspace mode could be tested at all.
+      MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+    });
+    try {
+      const openAs = (session: string, file: string) =>
+        new Promise<void>((resolve, reject) => {
+          const ws = new WebSocket(`ws://localhost:${port}/_ws`, {
+            headers: asMember(session),
+          } as unknown as string[]);
+          const timer = setTimeout(() => reject(new Error('socket timeout')), 8000);
+          ws.onopen = () => {
+            ws.send(JSON.stringify({ type: 'active', file }));
+            ws.send(JSON.stringify({ type: 'tabs', tabs: [file] }));
+            setTimeout(() => {
+              clearTimeout(timer);
+              ws.close();
+              resolve();
+            }, 400);
+          };
+          ws.onerror = (e) => {
+            clearTimeout(timer);
+            reject(e);
+          };
+        });
+
+      await openAs('aaaaaaaaaaaaaaaa', '.design/ui/alice.tsx');
+      await openAs('bbbbbbbbbbbbbbbb', '.design/ui/bob.tsx');
+      await Bun.sleep(300);
+
+      const aliceState = await Bun.file(join(designRoot, '_active.aaaaaaaaaaaaaaaa.json')).json();
+      const bobState = await Bun.file(join(designRoot, '_active.bbbbbbbbbbbbbbbb.json')).json();
+      expect(aliceState.active).toBe('.design/ui/alice.tsx');
+      expect(bobState.active).toBe('.design/ui/bob.tsx');
+      // Neither clobbered the other, which before D3 is exactly what happened.
+      expect(aliceState.open_tabs).toEqual(['.design/ui/alice.tsx']);
+      expect(bobState.open_tabs).toEqual(['.design/ui/bob.tsx']);
+    } finally {
+      await killProc(proc);
+    }
+  }, 30_000);
+});
+
+describe('per-member runtime state is runtime state to git', () => {
+  test('all three matchers agree that `_active.<session>.json` is not a commit', () => {
+    // The comment in session-scope.ts CLAIMED a sibling kept every matcher
+    // correct. It did not: `.gitignore`, the CLI's ignore block and the
+    // studio's own `isMaudeRuntimeState` all matched `_active.json` by NAME, so
+    // each member's file showed as untracked to EVERYONE, "Save all" staged it,
+    // and a push published one person's open tabs, active canvas and selection
+    // into the tenant's remote.
+    const key = 'a1b2c3d4e5f60718';
+
+    // 1. the studio's own matcher — what the Changes panel filters by
+    expect(isMaudeRuntimeState(`.design/_active.${key}.json`)).toBe(true);
+    expect(isMaudeRuntimeState('.design/_active.json')).toBe(true);
+    expect(isMaudeRuntimeState(`.design/_canvas-state/${key}/ui-home.view.json`)).toBe(true);
+    // …and it must not have widened into ordinary files on the way.
+    expect(isMaudeRuntimeState('.design/ui/Home.tsx')).toBe(false);
+    expect(isMaudeRuntimeState('.design/ui/Home.meta.json')).toBe(false);
+    expect(isMaudeRuntimeState('.design/_activeXjson')).toBe(false);
+
+    // 2. this repo's own .gitignore
+    const ignored = (rel: string) =>
+      Bun.spawnSync(['git', 'check-ignore', '-q', rel], {
+        cwd: join(import.meta.dir, '..', '..', '..'),
+      }).exitCode === 0;
+    expect(ignored(`.design/_active.${key}.json`)).toBe(true);
+
+    // 3. the block the CLI writes into a downstream project
+    const block = readFileSync(
+      join(import.meta.dir, '..', '..', '..', 'cli', 'lib', 'gitignore-block.mjs'),
+      'utf8'
+    );
+    expect(block).toContain('_active.*.json');
+  });
+});

package/apps/studio/test/session-scope.test.ts

@@ -0,0 +1,100 @@
+// Cloud Phase 27 D3 — whose runtime state is this?
+//
+// `_active.json` and `_canvas-state/<slug>.view.json` are per-MACHINE
+// singletons by design (DDR-115), which is right for a desktop and wrong for a
+// cell: one studio process serves an owner and a viewer, so a colleague opening
+// a canvas switched YOUR tab and their pan moved YOUR camera. Silently — it
+// read as flakiness, not as two people sharing one file.
+//
+// The first test is the one that matters most: OUTSIDE a cell nothing changes.
+
+import { describe, expect, test } from 'bun:test';
+
+import {
+  currentSession,
+  normalizeSessionKey,
+  runInSession,
+  sessionDir,
+  sessionFile,
+} from '../session-scope.ts';
+
+describe('session scope', () => {
+  test('with no session every path is byte-for-byte what it was', () => {
+    expect(currentSession()).toBe('');
+    expect(sessionDir('/repo/.design/_canvas-state')).toBe('/repo/.design/_canvas-state');
+    expect(sessionFile('/repo/.design/_active.json')).toBe('/repo/.design/_active.json');
+  });
+
+  test('a session gives each member their own subtree and their own active file', () => {
+    runInSession('a1b2c3d4e5f60718', () => {
+      expect(currentSession()).toBe('a1b2c3d4e5f60718');
+      expect(sessionDir('/repo/.design/_canvas-state')).toBe(
+        '/repo/.design/_canvas-state/a1b2c3d4e5f60718'
+      );
+      // A SIBLING of `_active.json`, not a rename: the runtime-state taxonomy,
+      // the gitignore and `isMaudeRuntimeState` all match that stem by name,
+      // and a sibling keeps every one of them correct with no fourth list.
+      expect(sessionFile('/repo/.design/_active.json')).toBe(
+        '/repo/.design/_active.a1b2c3d4e5f60718.json'
+      );
+    });
+  });
+
+  test('the scope does not leak past the call', () => {
+    runInSession('deadbeef', () => expect(currentSession()).toBe('deadbeef'));
+    expect(currentSession()).toBe('');
+  });
+
+  test('two sessions do not see each other', () => {
+    runInSession('one', () => {
+      expect(currentSession()).toBe('one');
+      runInSession('two', () => expect(currentSession()).toBe('two'));
+      expect(currentSession()).toBe('one');
+    });
+  });
+
+  test('the scope survives an await — a request is not one tick', async () => {
+    await runInSession('async1', async () => {
+      await new Promise((r) => setTimeout(r, 5));
+      expect(currentSession()).toBe('async1');
+      await Promise.resolve();
+      expect(currentSession()).toBe('async1');
+    });
+  });
+
+  test('a key that is not proxy-shaped is refused, not sanitized', () => {
+    // The value becomes a path segment, so this is the traversal gate — and it
+    // REJECTS rather than strips, because a key we had to repair is not one
+    // whose intent we should be guessing. Falling back to the shared singleton
+    // is the same behaviour a desktop already has.
+    for (const bad of [
+      '../../etc/passwd',
+      'a/b',
+      'a\\b',
+      '.',
+      '..',
+      'has space',
+      'x'.repeat(65),
+      '',
+      null,
+      undefined,
+    ]) {
+      expect(normalizeSessionKey(bad as string)).toBe('');
+    }
+    for (const good of ['abc123', 'a1b2c3d4e5f60718', 'A_b-9']) {
+      expect(normalizeSessionKey(good)).toBe(good);
+    }
+    // …and a refused key means the shared path, never a traversed one.
+    runInSession('../../etc', () => {
+      expect(sessionDir('/repo/.design/_canvas-state')).toBe('/repo/.design/_canvas-state');
+    });
+  });
+
+  test('a file with no extension still gets a distinct per-session name', () => {
+    runInSession('k', () => {
+      expect(sessionFile('/repo/.design/_active')).toBe('/repo/.design/_active.k');
+      // A dot in a PARENT directory must not be mistaken for the extension.
+      expect(sessionFile('/repo/my.dir/_active')).toBe('/repo/my.dir/_active.k');
+    });
+  });
+});

package/apps/studio/test/shell-importmap.test.ts

@@ -43,7 +43,14 @@ describe('_shell.html importmap agrees with RUNTIME_PACKAGES', () => {
 
   for (const pkg of RUNTIME_PACKAGES) {
     test(`"${pkg}" resolves to its /_canvas-runtime/ bundle`, () => {
-      expect(imports[pkg]).toBe(`/_canvas-runtime/${slugFor(pkg)}.js`);
+      // RELATIVE (`./`), and that leading dot is load-bearing (Cloud Phase 27).
+      // An importmap value resolves against the DOCUMENT's base URL, so a
+      // root-absolute `/_canvas-runtime/…` is correct only where the shell is
+      // served from the origin root. On the fleet's shared canvas host the
+      // shell lives under `/<project>/`, and every bundle 404'd there — the
+      // grey-canvas failure the per-project origin was introduced to end.
+      // Relative is right in BOTH shapes, so it is the one form to hold.
+      expect(imports[pkg]).toBe(`./_canvas-runtime/${slugFor(pkg)}.js`);
     });
   }
 });

package/apps/studio/test/sync-autocommit.test.ts

@@ -12,6 +12,7 @@ import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 
+import { REPO_LOCK_FILE } from '../git/repo-lock.ts';
 import {
   commitMessage,
   createAutoCommit,
@@ -332,3 +333,78 @@ describe('mirror push — never rewrites someone else’s work', () => {
 function silent() {
   return { warn: () => {}, error: () => {}, log: () => {} };
 }
+
+describe('a contended lock must not lose the queue or the process (Phase 27 D2)', () => {
+  test('a lock timeout re-queues the files instead of dropping them', async () => {
+    // `flush()` clears `touched` BEFORE it commits, and `withRepoLock` THROWS
+    // when it cannot acquire. Without a catch, a contended autosave dropped its
+    // file list silently — the bytes stay on disk, uncommitted, with nothing to
+    // retry them — and rejected a promise the debounce timer discards, which on
+    // Node >= 15 takes the process down with it. Post-D2 the trigger is
+    // ordinary: `pull` and `checkout` hold this lock across a NETWORK call.
+    const dir = mkdtempSync(path.join(tmpdir(), 'autocommit-lock-'));
+    try {
+      mkdirSync(path.join(dir, '.git'), { recursive: true });
+      // A live holder that is not stale — every acquire attempt will time out.
+      writeFileSync(
+        path.join(dir, '.git', REPO_LOCK_FILE),
+        JSON.stringify({ pid: process.pid, holder: 'studio:pull', at: Date.now(), token: 'held' })
+      );
+
+      const ran: string[][] = [];
+      const auto = createAutoCommit({
+        repoRoot: dir,
+        debounceMs: 5,
+        log: { warn() {}, error() {}, log() {} },
+        run: async (args) => {
+          ran.push(args);
+          return { code: 0, stdout: '', stderr: '' };
+        },
+      });
+
+      auto.note('.design/ui/Home.tsx', { name: 'A', email: 'a@b.c' });
+      const outcome = await auto.flush();
+
+      expect(outcome?.ok).toBe(false);
+      // Nothing reached git — the lock was never acquired.
+      expect(ran).toEqual([]);
+      // THE POINT: the file is still queued, so the next quiescence retries it.
+      expect(auto.pending()).toEqual(['.design/ui/Home.tsx']);
+      auto.stop();
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }, 30_000);
+
+  test('the debounce timer never surfaces an unhandled rejection', async () => {
+    // The timer fires unattended; a rejection it discards is a process exit.
+    const dir = mkdtempSync(path.join(tmpdir(), 'autocommit-timer-'));
+    try {
+      mkdirSync(path.join(dir, '.git'), { recursive: true });
+      writeFileSync(
+        path.join(dir, '.git', REPO_LOCK_FILE),
+        JSON.stringify({ pid: process.pid, holder: 'studio:fold', at: Date.now(), token: 'held' })
+      );
+      const rejections: unknown[] = [];
+      const onUnhandled = (err: unknown) => rejections.push(err);
+      process.on('unhandledRejection', onUnhandled);
+      try {
+        const auto = createAutoCommit({
+          repoRoot: dir,
+          debounceMs: 5,
+          log: { warn() {}, error() {}, log() {} },
+          run: async () => ({ code: 0, stdout: '', stderr: '' }),
+        });
+        auto.note('.design/ui/Home.tsx', { name: 'A', email: 'a@b.c' });
+        // Long enough for the debounce to fire AND the lock wait to expire.
+        await new Promise((r) => setTimeout(r, 1000));
+        auto.stop();
+      } finally {
+        process.off('unhandledRejection', onUnhandled);
+      }
+      expect(rejections).toEqual([]);
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }, 30_000);
+});

package/apps/studio/test/sync-hardening.test.ts

@@ -137,6 +137,81 @@ describe('DDR-054 §2a — CI environment gate', () => {
   });
 });
 
+/* ------------------------------------------- Phase 27 D2 — a cell owns its history */
+
+describe('Cloud Phase 27 D2 — a workspace cell ignores the tenant´s linkedHub', () => {
+  let saved: string | undefined;
+
+  beforeEach(() => {
+    saved = process.env.MAUDE_WORKSPACE_MODE;
+  });
+  afterEach(() => {
+    if (saved === undefined) {
+      delete process.env.MAUDE_WORKSPACE_MODE;
+    } else process.env.MAUDE_WORKSPACE_MODE = saved;
+  });
+
+  function linkedCtx() {
+    const designRoot = join(dir, 'design');
+    mkdirSync(join(designRoot, 'ui'), { recursive: true });
+    return {
+      cfg: {
+        name: 't',
+        projectLabel: null,
+        designRoot: 'design',
+        canvasGroups: [{ label: 'Canvases', path: 'ui' }],
+        rootClass: 'app',
+        themeDefault: 'dark' as const,
+        tokensCssRel: 'system/x.css',
+        teamAccentDefault: null,
+        handoffTargets: [],
+        newCanvasDir: 'ui',
+        newComponentDir: 'ui/components',
+        // The TENANT's committed config, carrying whatever hub their desktop
+        // was linked to. It is versioned, so it arrives in the cell with the
+        // checkout.
+        linkedHub: { url: 'https://someone-elses-hub.example.com', linkedAt: 1 },
+        _source: 'defaults' as const,
+      },
+      projectLabel: 't',
+      paths: {
+        repoRoot: dir,
+        designRel: 'design',
+        designRoot,
+        serverInfoFile: '',
+        activeFile: '',
+        commentsDir: join(designRoot, '_comments'),
+        canvasStateDir: '',
+        historyDir: '',
+        tokensUrlRel: '',
+        systemDirRel: 'system',
+      },
+      // biome-ignore lint/suspicious/noExplicitAny: minimal bus stub
+      bus: { on: () => () => {}, emit: () => {} } as any,
+    };
+  }
+
+  test('in a cell it refuses, and says which authority won', () => {
+    // Honouring the tenant's `linkedHub` inside a cell would dial OUT to a
+    // third-party hub carrying their canvases, and start a SECOND autocommit
+    // over the tree the hub is already committing. Both were unreachable by
+    // accident (no `~/.config/maude/hubs.json` in a cell), and an accident is
+    // not an invariant.
+    const warned: string[] = [];
+    const original = console.warn;
+    console.warn = (...args: unknown[]) => warned.push(args.map(String).join(' '));
+    process.env.MAUDE_WORKSPACE_MODE = '1';
+    try {
+      expect(createSyncRuntime(linkedCtx())).toBeNull();
+      // Not just null — null for THIS reason. Without the message this test
+      // would pass on the missing-token path it is meant to precede.
+      expect(warned.join(' ')).toContain('the hub owns history');
+    } finally {
+      console.warn = original;
+    }
+  });
+});
+
 /* ---------------------------------------------------------------- §2b .tsx refusal */
 
 // Coverage moved to sync-runtime.test.ts > discoverCanvases >

package/apps/studio/use-collab.tsx

@@ -592,6 +592,13 @@ function createSession(slug: string): CollabSession {
   let cancelled = false;
   let reconnectTimer: ReturnType<typeof setTimeout> | null = null;
   let wsRef: WebSocket | null = null;
+  // Consecutive failed connects. A server that refuses the upgrade (403/401 —
+  // e.g. a deployment whose proxy does not carry the collab lane) used to be
+  // retried every second, forever, silently — which is indistinguishable from
+  // "nobody else is here" (the cloud-collab RCA shipped invisible exactly this
+  // way). Back off exponentially and say so once.
+  let failedConnects = 0;
+  let failureWarned = false;
 
   function sendFrame(ws: WebSocket, payload: Uint8Array) {
     try {
@@ -624,6 +631,8 @@ function createSession(slug: string): CollabSession {
     wsRef = ws;
 
     ws.addEventListener('open', () => {
+      failedConnects = 0;
+      failureWarned = false;
       session.connected = true;
       notifySession(session);
       // Sync step 1 — announce our state vector so the server can send the
@@ -637,11 +646,22 @@ function createSession(slug: string): CollabSession {
     });
 
     ws.addEventListener('close', () => {
+      const hadConnected = session.connected;
       session.connected = false;
       notifySession(session);
       wsRef = null;
       if (cancelled) return;
-      reconnectTimer = setTimeout(connect, 1000);
+      failedConnects = hadConnected ? 0 : failedConnects + 1;
+      if (failedConnects >= 5 && !failureWarned) {
+        failureWarned = true;
+        console.warn(
+          '[collab] live sync unavailable — the collab socket keeps being refused. ' +
+            'Presence, live annotations and cross-peer updates are off until it connects.'
+        );
+      }
+      // 1s → 2s → 4s → … capped at 15s; a healthy drop (was connected) retries fast.
+      const delay = Math.min(1000 * 2 ** Math.min(failedConnects, 4), 15000);
+      reconnectTimer = setTimeout(connect, delay);
     });
 
     ws.addEventListener('error', () => {

package/apps/studio/whats-new.json

@@ -1,6 +1,60 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "cloud-connect-browser-open-and-decision-modal",
+      "version": "0.55.0",
+      "date": "2026-08-05",
+      "kind": "fix",
+      "title": "Signing in opens your browser again",
+      "summary": "Signing in to Maude Cloud from the app used to go nowhere — the browser never opened, the dialog claimed it had, and you were left holding a code. It opens now, straight to the page with your code already filled in, and the address is always there to click or copy if it doesn't. \"Open in Maude\" also asks a clearer question: it names the folder you have open and the cloud project it would connect it to, says exactly what syncs, and warns you if the two don't look like the same thing.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "activity-says-why-we-looked",
+      "version": "0.55.0",
+      "date": "2026-08-05",
+      "kind": "improvement",
+      "title": "Your project's activity says why we looked",
+      "summary": "The activity page for a cloud project used to show that the platform touched it. Now it shows the reason given at the time, in plain words — and it includes the platform-wide checks that sweep every project, which were previously the only ones you could not see.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "your-own-place-in-a-shared-project",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "improvement",
+      "title": "A shared project keeps your place",
+      "summary": "Open a cloud project and you land on a canvas, not an empty pane, with one line telling you what you can do there. Your open canvas and your pan and zoom are now yours alone — a teammate moving around no longer moves you. And reading a project no longer means reading it blind: reviewers can open the Inspector and Layers panels, which quietly refused to appear before.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "the-real-studio-in-your-browser",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "feature",
+      "title": "The full studio, in your browser",
+      "summary": "A cloud project opened in a browser now gives you the same application as the desktop — Files, Layers, Inspector, search, the toolbar and the live status — and your designs look like your designs: photographs, logos and webfonts load on the canvas. The browser tab also names the account you are signed in as, and lets you sign out.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "design-system-component-styles-load",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "fix",
+      "title": "Design-system styles render on canvases",
+      "summary": "Canvases in a project with a bootstrapped design system were drawing without their component styles — buttons, cards, inputs and the rest fell back to unstyled defaults. They render correctly again, on the desktop as well as in the browser.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "cloud-live-collaboration-connects",
+      "version": "0.54.0",
+      "date": "2026-08-04",
+      "kind": "fix",
+      "title": "Live collaboration works in the browser",
+      "summary": "Opening a cloud project in two browsers now actually collaborates: you see each other's cursors with names, annotations and comments appear live for everyone, and every change is saved to the project. Before, the live channel never connected — selections crossed over anonymously and annotations silently stayed on the machine that drew them.",
+      "surface": "design-ui"
+    },
     {
       "id": "bug-reports-see-the-maude-window",
       "version": "0.53.2",