@1agh/maude 0.57.0 → 0.58.0

package/apps/studio/http.ts

@@ -1507,6 +1507,14 @@ export function createHttp(
         ...ctx.cfg,
         canvasOrigin: ctx.canvasOrigin,
         readOnly: projectReadOnly(req),
+        // WHICH RELEASE THIS IS. `/_config` reaches the browser in cloud mode,
+        // so the bar for adding a field here is "would I publish it" — and a
+        // version is the git tag, which is public. Nothing else rides along.
+        //
+        // Resolved through `resolveMaudeVersion`, the same function the What's
+        // New feed uses: one answer, so the chip in the status bar and the feed
+        // can never name different versions.
+        version: resolveMaudeVersion(),
         // Cloud Phase 27 (DDR-209) — the capability that opens the cookieless
         // canvas origin, minted per session by the proxy. Absent on a desktop,
         // where the canvas origin is loopback and needs none. `canvasUrl()`

package/apps/studio/input-router.tsx

@@ -446,6 +446,34 @@ export function yieldsToArtboardDrag(
   );
 }
 
+/**
+ * Click-phase counterpart to `yieldsToArtboardDrag` (issue-78). The onClick
+ * handler below suppresses the browser's native `click` for every gesture it
+ * already routed as `select` on the matching pointerdown, so a just-selected
+ * element's own click handler doesn't also fire. But an artboard-chrome
+ * control — e.g. the video-timeline badge (`.dc-artboard-video-badge`,
+ * DDR-148) rendered as a sibling of `.dc-artboard-body` — never goes through
+ * `select`; it's an interactive button that needs its own `onClick` to reach
+ * React. Without this exemption a bare click on it while in Move (or a
+ * Cmd/Ctrl+click from Browse/an annotation tool) is preventDefault +
+ * stopImmediatePropagation'd in the capture phase before React's delegated
+ * listener ever runs, so the button silently does nothing. Mirrors
+ * `yieldsToArtboardDrag`'s modifier gate: a held Cmd/Ctrl is reserved for
+ * deep-select and stays unexempted.
+ */
+export function yieldsClickToArtboardChrome(
+  wouldRouteKind: RouterAction['kind'] | null,
+  target: EventTarget | null,
+  modifiers: { metaKey: boolean; ctrlKey: boolean }
+): boolean {
+  return (
+    wouldRouteKind === 'select' &&
+    !modifiers.metaKey &&
+    !modifiers.ctrlKey &&
+    isArtboardDragChrome(target)
+  );
+}
+
 export function useInputRouter(opts: UseInputRouterOptions): void {
   const { hostRef, getActiveTool, isSpaceHeld, callbacks, enabled = true, claimableActions } = opts;
 
@@ -631,8 +659,18 @@ export function useInputRouter(opts: UseInputRouterOptions): void {
                 ? 'context-menu'
                 : null;
       if (wouldRouteKind && (!claimableActions || claimableActions.has(wouldRouteKind))) {
+        // issue-78 — a bare click on an artboard-chrome control (the video-
+        // timeline badge) must still reach its own onClick; see
+        // yieldsClickToArtboardChrome for why. Mirrors the onPointerDown/
+        // onMouseDown pattern above: preventDefault always runs (so a forged
+        // chrome-alike element inside untrusted canvas content can't use this
+        // exemption to let its own native click default action — e.g. an
+        // <a>'s navigation or an <input type="file">'s picker — fire), but
+        // stopImmediatePropagation is skipped so the real chrome button's own
+        // React onClick still gets the (now-inert-by-default) event.
+        const yields = yieldsClickToArtboardChrome(wouldRouteKind, e.target, e);
         e.preventDefault();
-        e.stopImmediatePropagation();
+        if (!yields) e.stopImmediatePropagation();
       }
     };
 

package/apps/studio/test/config-version.test.ts

@@ -0,0 +1,88 @@
+// The running version reaches the client — feature-release-reaches-the-fleet.
+//
+// Reading which release a Maude was actually running used to mean probing
+// production by hand, and the first probe of the v0.57.0 incident was MISREAD
+// (a 401 that looked like "route exists" was the blanket answer for any unknown
+// path). The fix has three surfaces reporting one version: the hub's `/health`,
+// this `/_config`, and the status-bar chip the client draws from it.
+//
+// What is asserted here is the middle one, plus the two properties that make it
+// safe to put there: it is resolved through the SINGLE version function, and it
+// carries nothing else.
+
+import { afterAll, describe, expect, test } from 'bun:test';
+import type { Subprocess } from 'bun';
+
+import { resolveMaudeVersion } from '../whats-new.ts';
+import { bootServer, killProc, makeSandbox, nextPort } from './_helpers.ts';
+
+const procs: Subprocess[] = [];
+afterAll(async () => {
+  for (const p of procs) await killProc(p);
+});
+
+async function boot(env: Record<string, string> = {}) {
+  const { root } = makeSandbox();
+  const port = nextPort();
+  procs.push(await bootServer(root, port, env));
+  return `http://localhost:${port}`;
+}
+
+describe('/_config names the release it is running', () => {
+  test('the version is present, and is a real version', async () => {
+    const base = await boot();
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as { version?: string };
+
+    expect(typeof cfg.version).toBe('string');
+    // `0.0.0` was the private-workspace placeholder these manifests carried
+    // before they joined the release line — reporting it is the bug, not a pass.
+    expect(cfg.version).not.toBe('0.0.0');
+    expect(cfg.version).toMatch(/^\d+\.\d+\.\d+/);
+  });
+
+  test('it is the SAME answer the What’s New feed uses', async () => {
+    // One resolution path (DDR-045). Two would eventually disagree, and a chip
+    // that contradicts the feed beside it is worse than no chip.
+    const base = await boot();
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as { version?: string };
+    const feed = (await (await fetch(`${base}/_api/whats-new`)).json()) as { version?: string };
+
+    expect(cfg.version).toBe(resolveMaudeVersion());
+    expect(cfg.version).toBe(feed.version);
+  });
+});
+
+describe('the version rides along, and nothing else does', () => {
+  test('a cloud tab gets the version too', async () => {
+    // `/_config` reaches a browser on someone else's machine in workspace mode.
+    // A git tag is public, so the version is fine there — this pins that it
+    // actually arrives, since the chip is the cloud's only version surface.
+    const base = await boot({
+      MAUDE_WORKSPACE_MODE: '1',
+      MAUDE_WORKSPACE_ALLOW_DEV_MODULES: '1',
+      MAUDE_PROJECT_NAME: 'Alligators',
+    });
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as {
+      version?: string;
+      cloud?: unknown;
+    };
+
+    expect(typeof cfg.version).toBe('string');
+    expect(cfg.cloud).toBeDefined();
+  });
+
+  test('no server path or secret came with it', async () => {
+    const base = await boot();
+    const cfg = (await (await fetch(`${base}/_config`)).json()) as Record<string, unknown>;
+
+    // The version was the one field this change added. Anything matching these
+    // shapes arriving in the browser payload is a leak, and the review that
+    // waves it through will be the one that reads "it was already there".
+    for (const key of Object.keys(cfg)) {
+      expect(key).not.toMatch(/token$/i);
+      expect(key).not.toMatch(/secret|password|apiKey/i);
+    }
+    const serialized = JSON.stringify(cfg);
+    expect(serialized).not.toMatch(/BEGIN [A-Z ]*PRIVATE KEY/);
+  });
+});

package/apps/studio/test/input-router.test.ts

@@ -10,6 +10,7 @@ import {
   isArtboardDragChrome,
   isEditableTarget,
   type Tool,
+  yieldsClickToArtboardChrome,
   yieldsToArtboardDrag,
 } from '../input-router.tsx';
 
@@ -552,6 +553,61 @@ describe('input-router / yieldsToArtboardDrag', () => {
   });
 });
 
+// issue-78 — the actual regression: the router's capture-phase `click`
+// listener claimed every bare click while in the Move tool (and every
+// Cmd/Ctrl+click from Browse/annotation tools) and called
+// `stopImmediatePropagation()` unconditionally, unlike its pointerdown/
+// mousedown siblings above. That killed the native click on any artboard-
+// chrome control BEFORE React's delegated onClick ever ran — including the
+// video-timeline badge (`.dc-artboard-video-badge`, DDR-148), which sits
+// outside `.dc-artboard-body` as chrome. Clicking it did nothing.
+// `yieldsClickToArtboardChrome` is the decision the click handler now gates
+// its suppression on, mirroring `yieldsToArtboardDrag` above.
+describe('input-router / yieldsClickToArtboardChrome', () => {
+  const chrome = (): EventTarget =>
+    ({
+      closest: (sel: string) => (sel === '[data-dc-screen]' ? {} : null),
+    }) as unknown as EventTarget;
+  const body = (): EventTarget => ({ closest: () => ({}) }) as unknown as EventTarget; // matches every selector, incl. .dc-artboard-body
+
+  test('bare click on the video-timeline badge in Move tool (the reported bug) → true', () => {
+    expect(
+      yieldsClickToArtboardChrome('select', chrome(), { metaKey: false, ctrlKey: false })
+    ).toBe(true);
+  });
+
+  test('cmd+click on artboard chrome (deep-select, not a chrome control) → false', () => {
+    expect(yieldsClickToArtboardChrome('select', chrome(), { metaKey: true, ctrlKey: false })).toBe(
+      false
+    );
+  });
+
+  test('bare click on .dc-artboard-body content (not chrome) → false', () => {
+    expect(yieldsClickToArtboardChrome('select', body(), { metaKey: false, ctrlKey: false })).toBe(
+      false
+    );
+  });
+
+  test('bare click outside any artboard → false (nothing to yield to)', () => {
+    const outside = { closest: () => null } as unknown as EventTarget;
+    expect(yieldsClickToArtboardChrome('select', outside, { metaKey: false, ctrlKey: false })).toBe(
+      false
+    );
+  });
+
+  test('non-select routed kind (e.g. context-menu) on chrome → false', () => {
+    expect(
+      yieldsClickToArtboardChrome('context-menu', chrome(), { metaKey: false, ctrlKey: false })
+    ).toBe(false);
+  });
+
+  test('null routed kind on chrome → false', () => {
+    expect(yieldsClickToArtboardChrome(null, chrome(), { metaKey: false, ctrlKey: false })).toBe(
+      false
+    );
+  });
+});
+
 // T25 — Drag-vs-click threshold. Centralized here so every drag-class gesture
 // (artboard drag, artboard marquee, element marquee, annotation pen/rect/etc.)
 // reads the same value. Microsoft Win32 SM_CXDRAG default + d3-drag convention.

package/apps/studio/test/whats-new.test.ts

@@ -23,8 +23,20 @@ describe('whats-new feed loader', () => {
     }
   });
 
-  test('resolveMaudeVersion reads the design plugin manifest', () => {
+  test('resolveMaudeVersion resolves a real release version', () => {
     expect(resolveMaudeVersion()).toMatch(/^\d+\.\d+\.\d+/);
+    // The studio's own manifest is preferred over the design plugin's (it is
+    // the one staged into the cell image), and `0.0.0` — the placeholder both
+    // carried before joining the release line — is never an answer.
+    expect(resolveMaudeVersion()).not.toBe('0.0.0');
+  });
+
+  test('an unversioned root falls through rather than reporting the placeholder', () => {
+    const root = mkdtempSync(join(tmpdir(), 'maude-ver-'));
+    writeFileSync(join(root, 'package.json'), JSON.stringify({ version: '0.0.0' }));
+    // No plugin manifest above a tmpdir either, so this lands on `dev` — a
+    // value obviously not a release, rather than a plausible wrong number.
+    expect(resolveMaudeVersion(root)).toBe('dev');
   });
 
   test('a missing feed dir yields empty entries and never throws', () => {

package/apps/studio/whats-new.json

@@ -1,6 +1,15 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "release-version-visible",
+      "version": "0.58.0",
+      "date": "2026-08-07",
+      "kind": "improvement",
+      "title": "See which version of Maude you are running",
+      "summary": "The Studio status bar now shows the running version, and the hub admin header shows it beside the bundle hash — so you can tell what you are on without digging. In the cloud it is the same chip, because the cloud serves the same Studio.",
+      "surface": "design-ui"
+    },
     {
       "id": "cloud-connect-tells-you-what-happened",
       "version": "0.57.0",

package/apps/studio/whats-new.ts

@@ -43,18 +43,42 @@ export interface WhatsNewFeed {
 let cache: WhatsNewFeed | null = null;
 
 /**
- * Read the installed maude version from the design plugin manifest.
- * `apps/studio/` → `plugins/design/.claude-plugin/plugin.json`.
- * That manifest ships in BOTH npm installs and marketplace-cache clones
- * (same rationale as build.ts `readPluginVersion`). Falls back to `dev`.
+ * Read the installed maude version.
+ *
+ * THE ONE resolution path (DDR-045: disk paths come from `paths.ts`). Everything
+ * that wants to name the running version — the What's New feed, `/_config`, the
+ * status-bar chip — calls this rather than growing a second answer that can
+ * disagree with the first.
+ *
+ * Two sources, in order:
+ *
+ *   1. the studio's OWN `package.json`. It rides the release line since the
+ *      fleet-verification change, and it is the only one of the two that is
+ *      staged into the cell image — a cloud tab asking "which version am I on"
+ *      gets an answer rather than `dev`.
+ *   2. `plugins/design/.claude-plugin/plugin.json`, which ships in BOTH npm
+ *      installs and marketplace-cache clones (same rationale as build.ts
+ *      `readPluginVersion`). Kept as the fallback so an older layout that lacks
+ *      a version-stamped studio manifest still resolves.
+ *
+ * Falls back to `dev` — a placeholder that is obviously not a release, never a
+ * plausible-looking wrong number.
  */
 export function resolveMaudeVersion(root: string = DEV_SERVER_ROOT): string {
-  const manifest = join(root, '..', '..', 'plugins', 'design', '.claude-plugin', 'plugin.json');
-  try {
-    const parsed = JSON.parse(readFileSync(manifest, 'utf8')) as { version?: unknown };
-    if (typeof parsed.version === 'string') return parsed.version;
-  } catch {
-    /* fall through */
+  const candidates = [
+    join(root, 'package.json'),
+    join(root, '..', '..', 'plugins', 'design', '.claude-plugin', 'plugin.json'),
+  ];
+  for (const manifest of candidates) {
+    try {
+      const parsed = JSON.parse(readFileSync(manifest, 'utf8')) as { version?: unknown };
+      // `0.0.0` is the private-workspace placeholder these manifests carried
+      // before they joined the release line. Treating it as an answer is how
+      // `/health` came to report `0.0.0` for months.
+      if (typeof parsed.version === 'string' && parsed.version !== '0.0.0') return parsed.version;
+    } catch {
+      /* try the next one */
+    }
   }
   return 'dev';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -54,13 +54,13 @@
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.57.0",
-    "@1agh/maude-darwin-x64": "0.57.0",
-    "@1agh/maude-linux-arm64": "0.57.0",
-    "@1agh/maude-linux-arm64-musl": "0.57.0",
-    "@1agh/maude-linux-x64": "0.57.0",
-    "@1agh/maude-linux-x64-musl": "0.57.0",
-    "@1agh/maude-win32-x64": "0.57.0"
+    "@1agh/maude-darwin-arm64": "0.58.0",
+    "@1agh/maude-darwin-x64": "0.58.0",
+    "@1agh/maude-linux-arm64": "0.58.0",
+    "@1agh/maude-linux-arm64-musl": "0.58.0",
+    "@1agh/maude-linux-x64": "0.58.0",
+    "@1agh/maude-linux-x64-musl": "0.58.0",
+    "@1agh/maude-win32-x64": "0.58.0"
   },
   "files": [
     "cli",