@1agh/maude 0.58.2 → 0.58.3

package/apps/studio/video-comp.tsx

@@ -81,7 +81,20 @@ interface MaudeSeekWindow {
   __maudeVideoComps?: Map<string, CompEntry>;
   /** Seek every registered comp to `frame` (paused). Ordinary artboards fall
    *  back to a time-based WAAPI seek. Resolves once the frame has painted. */
-  __maude_seek__?: (frame: number, opts?: { fps?: number }) => Promise<void>;
+  __maude_seek__?: (
+    frame: number,
+    opts?: {
+      fps?: number;
+      /** Capture mode: throw when a seek never lands, instead of only counting it. */
+      strict?: boolean;
+    }
+  ) => Promise<void>;
+  /**
+   * Count of seeks that never landed. The capture shim reads this and refuses
+   * to ship the export rather than encoding a stale frame — a silent wrong
+   * frame is worse than a loud failure.
+   */
+  __maude_seek_failures__?: number;
   /** Serializable comp list for the capture shim / Timeline panel. */
   __maude_comps__?: () => CompSnapshot[];
   /**
@@ -140,6 +153,36 @@ function afterPaint(): Promise<void> {
   });
 }
 
+/** How many paint-spaced attempts a cold Player gets before a seek is a failure. */
+const SEEK_ATTEMPTS = 3;
+
+/**
+ * Seek one comp, giving a not-yet-mounted Player a bounded number of chances.
+ *
+ * Returns whether the seek actually landed. The retry replaces the old silent
+ * swallow: a Player that is genuinely mid-mount settles within a paint or two,
+ * and one that never settles is a real fault the caller must not paper over.
+ */
+async function seekEntryWithRetry(
+  ref: { current: { pause?: () => void; seekTo: (f: number) => void } | null },
+  frame: number
+): Promise<boolean> {
+  for (let attempt = 0; attempt < SEEK_ATTEMPTS; attempt += 1) {
+    try {
+      const player = ref.current;
+      if (player) {
+        player.pause?.();
+        player.seekTo(frame);
+        return true;
+      }
+    } catch {
+      /* fall through to the retry — the next paint may settle it */
+    }
+    if (attempt < SEEK_ATTEMPTS - 1) await afterPaint();
+  }
+  return false;
+}
+
 /**
  * Install the singleton seek bridge on `window`. Idempotent — the first
  * VideoComp to mount wins; later mounts reuse the same functions. The bridge
@@ -156,11 +199,32 @@ export function installMaudeSeekBridge(): void {
     if (entries.length > 0) {
       for (const e of entries) {
         const f = clamp(Math.round(frame), 0, Math.max(0, e.durationInFrames - 1));
-        try {
-          e.ref.current?.pause();
-          e.ref.current?.seekTo(f);
-        } catch {
-          /* Player not yet ready — a later seek settles it */
+        // This used to be a bare try/catch with an empty body and the comment
+        // "Player not yet ready — a later seek settles it". That made a seek
+        // that COMPLETELY FAILED resolve as success: `afterPaint()` proves a
+        // paint happened, not that the right content was in it. Serially it was
+        // benign — frame N+1 repaired frame N's miss, and only frame 0 was ever
+        // exposed — which is exactly why it survived. It is not benign the
+        // moment anything captures ranges in parallel: every range boundary is a
+        // first seek on a cold page, so "a later seek settles it" would be
+        // invoked once per worker instead of once per export, and a stale frame
+        // is a valid-looking file with wrong pixels, not a crash.
+        //
+        // So the hope becomes an explicit bounded retry, and exhausting it is a
+        // real failure the capture shim can see and refuse to ship.
+        if (!(await seekEntryWithRetry(e.ref, f))) {
+          // ALWAYS recorded, so the capture shim can refuse the export even on
+          // the non-strict path. Only THROWN under `strict`, which the shim
+          // passes: a live UI scrub of a still-mounting comp should stay
+          // resilient, but a capture must never proceed on a seek that did not
+          // happen. The old code did neither — it just resolved.
+          w.__maude_seek_failures__ = (w.__maude_seek_failures__ ?? 0) + 1;
+          if (opts?.strict) {
+            throw new Error(
+              `__maude_seek__: comp did not accept frame ${f} after ${SEEK_ATTEMPTS} attempts ` +
+                '(Player never became ready) — refusing to report a seek that did not happen'
+            );
+          }
         }
       }
       await afterPaint();

package/apps/studio/whats-new.json

@@ -1,6 +1,33 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "cloud-sync-matches-your-desktop",
+      "version": "0.58.3",
+      "date": "2026-08-11",
+      "kind": "fix",
+      "title": "The cloud copy matches your desktop",
+      "summary": "A project you connect to the cloud now looks exactly like it does on your machine: no duplicated files, every canvas opens instead of breaking, and your images show up instead of grey boxes. The cloud picker says \"Connected\" for the project this folder is linked to, with a Disconnect right there — and once you're connected, the cloud saves every change automatically, so there's one place your work is saved, not two.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "cloud-link-self-renews",
+      "version": "0.58.3",
+      "date": "2026-08-11",
+      "kind": "fix",
+      "title": "Cloud sync keeps itself signed in",
+      "summary": "A workspace you connect to the cloud stays synced — the session refreshes itself in the background instead of quietly expiring after a few hours and stranding your canvases on \"connecting…\". If a link ever can't sync for a few minutes it now says so and points you to reconnect, instead of spinning forever.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "figma-import",
+      "version": "0.58.3",
+      "date": "2026-08-11",
+      "kind": "feature",
+      "title": "Bring your Figma work in",
+      "summary": "Paste a Figma link and get the real thing, not a picture of it: design frames become editable canvases, a FigJam board becomes your whiteboard with its sticky notes and arrows still attached, and your colour and text styles become design tokens. Add a Figma access token once in Settings to get started.",
+      "surface": "design-ui"
+    },
     {
       "id": "sync-carries-the-path",
       "version": "0.58.2",

package/apps/studio/workspace-mode.ts

@@ -66,6 +66,10 @@ export const FORBIDDEN_ROUTE_PREFIXES: ReadonlyArray<{ prefix: string; why: stri
       prefix: '/_api/generate',
       why: 'media generation runs tenant-authored prompts against a provider key held here',
     },
+    {
+      prefix: '/_api/figma',
+      why: 'the Figma lane STORES and SPENDS a user personal access token, and imports write the design root — a cell must hold no provider credential (DDR-216 D2/D3, same class as /_api/generate)',
+    },
     {
       prefix: '/_api/shell-shot',
       why: 'the shell screenshot spawns a headless browser against the studio — the same evaluation `/_api/export` is forbidden for',

package/cli/commands/design.mjs

@@ -69,6 +69,14 @@ const BIN_VERBS = new Set([
   // contract, and patches (theme-block-scoped) or scaffolds the target
   // design system. CLI-only — no HTTP route, no in-app panel.
   'import-tokens',
+  // DDR-216 (feature-figma-import, Phase 2 / T6). `import-figma` is the REST
+  // door: pulls a real Figma/FigJam document over the API and translates it
+  // with DETERMINISTIC code — no vision model, no agent anywhere in the
+  // ingestion path. That is the structural difference from
+  // `/design:import --reconstruct` (DDR-174), whose whole orchestrator/agent
+  // split exists because an LLM reads its input; do not copy that architecture
+  // into this one, it would close nothing here.
+  'import-figma',
   // DDR-173 (Phase 3 / T12). `import-brand` extracts typed palette/font
   // cues + a hardened logo asset from an already-DDR-167-sanitized SVG for
   // `/design:setup-ds --from-brand` — never re-reads or re-sanitizes the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "0.58.2",
+  "version": "0.58.3",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -54,13 +54,13 @@
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "0.58.2",
-    "@1agh/maude-darwin-x64": "0.58.2",
-    "@1agh/maude-linux-arm64": "0.58.2",
-    "@1agh/maude-linux-arm64-musl": "0.58.2",
-    "@1agh/maude-linux-x64": "0.58.2",
-    "@1agh/maude-linux-x64-musl": "0.58.2",
-    "@1agh/maude-win32-x64": "0.58.2"
+    "@1agh/maude-darwin-arm64": "0.58.3",
+    "@1agh/maude-darwin-x64": "0.58.3",
+    "@1agh/maude-linux-arm64": "0.58.3",
+    "@1agh/maude-linux-arm64-musl": "0.58.3",
+    "@1agh/maude-linux-x64": "0.58.3",
+    "@1agh/maude-linux-x64-musl": "0.58.3",
+    "@1agh/maude-win32-x64": "0.58.3"
   },
   "files": [
     "cli",

package/plugins/flow/.claude-plugin/config.schema.json

@@ -314,7 +314,7 @@
           "type": "string",
           "enum": ["auto", "on", "off"],
           "default": "auto",
-          "description": "Opt-out default `auto` (absent block == `auto`). `auto` = active only when `kg` is on PATH AND (`store` is set OR a local `.kgai/store` exists) — conservative, mirrors `orchestration.mode:auto`; a first-run repo stays on files until the user opts in via onboarding. `on` = force kgai active (errors surface rather than silently falling back). `off` = disable entirely; today's classic `.ai/decisions/` + STATE.md path, byte-for-byte unchanged."
+          "description": "Opt-out default `auto` (absent block == `auto`). `auto` = active only when `kg` is on PATH AND a store resolves (`kg config` store_root via an approved committed `.kgairc`, this `store` value, or a legacy local `.kgai/store`) — conservative, mirrors `orchestration.mode:auto`; a first-run repo stays on files until the user opts in via onboarding. An unapproved `.kgairc` (`kg config` → pending_approval) counts as NOT resolved until a human runs `kg trust`. `on` = force kgai active (errors surface rather than silently falling back). `off` = disable entirely; today's classic `.ai/decisions/` + STATE.md path, byte-for-byte unchanged."
         },
         "engine": {
           "type": "string",
@@ -325,12 +325,12 @@
         "engineVersion": {
           "type": "string",
           "default": "v1.0.0",
-          "description": "PINNED kgai release the CLI + desktop bundle target. Advance deliberately (harness-verified via `maude kg check-upstream`), never float — auto-tracking `latest` would let an upstream change silently alter behavior mid-rollout and is a supply-chain surface (DDR-054/056 reasoning: the bundled `kg` is third-party)."
+          "description": "MINIMUM kgai release the integration targets (a floor, not a pin — the engine installs via the official installer, which self-updates at SessionStart; the manual pinned-download flow is retired). Must be at least `v1.5.1` — the `.kgairc` three-layer config + `kg config`/`kg prompt`/`kg trust` surface. Verify with `kg version`; drift check via `maude kg check-upstream`."
         },
         "store": {
           "type": "string",
           "default": "",
-          "description": "Remote store the graph syncs to. `s3://company-kg/store` (shared company remote, cross-repo) | `kgai://org/project` (cloud-broker keyspace) | git remote | `\"\"` = local-only `.kgai/store`. Empty string keeps everything on this machine."
+          "description": "Fallback/override store for the `maude kg` verbs. Since kgai v1.5.1 store resolution is primarily the ENGINE's job: a repo with an approved committed `.kgairc` resolves its store via `kg config` (typically a shared parent-folder store like `../.kgai-shared`), and that wins — this value is consulted only when `kg config` yields no store (legacy per-repo setups). The sync remote is set per-STORE with `kg remote` (session layer), never here and never via `kg remote --global`."
         },
         "scope": {
           "type": "object",