@1agh/maude 0.60.3 → 0.60.5

package/apps/studio/api.ts

@@ -1499,11 +1499,14 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
   // shared `.meta.json` document. It lives in `_canvas-state/<slug>.view.json`
   // ({ viewport }) — gitignored, swept on delete, export-excluded. DISTINCT from
   // the legacy `_canvas-state/<slug>.json` ({ sections, viewport:{x,y,scale} })
-  // store: that uses `scale` clamped 0.05–8, this uses `zoom` clamped 0.1–4, so
+  // store: that uses `scale` clamped 0.05–8, this uses `zoom` clamped 0.02–4, so
   // overloading one file would let the two writers clobber each other's shape.
 
-  /** Validate a candidate viewport — finite x/y, zoom clamped [0.1, 4] (the
-   *  Phase 4 rule). Returns the normalized viewport, or null when invalid. */
+  /** Validate a candidate viewport — finite x/y, zoom clamped [0.02, 4] (the
+   *  Phase 4 rule). Mirrors `ZOOM_MIN` in canvas-lib.tsx (issue #91) — keep the
+   *  two floors in lockstep or a save/reload round-trip silently re-clamps a
+   *  zoom the client just let the user reach. Returns the normalized viewport,
+   *  or null when invalid. */
   function normalizeViewport(v: unknown): { x: number; y: number; zoom: number } | null {
     if (!v || typeof v !== 'object' || Array.isArray(v)) return null;
     const vv = v as { x?: unknown; y?: unknown; zoom?: unknown };
@@ -1512,7 +1515,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
       Number.isFinite(vv.y as number) &&
       Number.isFinite(vv.zoom as number)
     ) {
-      const zoom = Math.min(4, Math.max(0.1, vv.zoom as number));
+      const zoom = Math.min(4, Math.max(0.02, vv.zoom as number));
       return { x: vv.x as number, y: vv.y as number, zoom };
     }
     return null;
@@ -1571,6 +1574,41 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     return [...new Set(out)];
   }
 
+  // Issue #91 security follow-up — `layout.artboards[]` (DDR-027 position-only
+  // entries) is reachable from the untrusted canvas origin (DDR-054) via the
+  // same PATCH lane as overlays/locked above, but previously had no count or
+  // magnitude bound. `fit()`/`computeFit` (canvas-lib.tsx) now correctly frames
+  // whatever bounding box this describes — before the zoom-floor fix, a hard
+  // 0.1 zoom clamp accidentally masked an unbounded layout into a cropped,
+  // mismatched view; after it, an oversized synced layout can legitimately be
+  // framed whole, promoting every artboard in it to its own GPU layer at once
+  // (canvas-lib.tsx `content-visibility` comment). Cap count + coordinate
+  // magnitude the same way `normalizeOverlays`/`normalizeLocked` cap theirs.
+  const MAX_LAYOUT_ARTBOARDS = 2000;
+  const MAX_LAYOUT_COORD = 1_000_000;
+
+  function normalizeLayoutArtboards(
+    v: unknown
+  ): Array<{ id: string; x: number; y: number }> | null {
+    if (!Array.isArray(v) || v.length > MAX_LAYOUT_ARTBOARDS) return null;
+    const out: Array<{ id: string; x: number; y: number }> = [];
+    for (const entry of v) {
+      if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return null;
+      const e = entry as { id?: unknown; x?: unknown; y?: unknown };
+      if (typeof e.id !== 'string' || e.id.length === 0 || e.id.length > 128) return null;
+      if (
+        !Number.isFinite(e.x as number) ||
+        !Number.isFinite(e.y as number) ||
+        Math.abs(e.x as number) > MAX_LAYOUT_COORD ||
+        Math.abs(e.y as number) > MAX_LAYOUT_COORD
+      ) {
+        return null;
+      }
+      out.push({ id: e.id, x: e.x as number, y: e.y as number });
+    }
+    return out;
+  }
+
   /** Raw view-file contents, tolerant of a missing/corrupt file (→ `{}`) — the
    *  read half of the read-modify-write both `saveCanvasView` and
    *  `saveCanvasOverlays` need so writing one lane never clobbers the other. */
@@ -1819,7 +1857,18 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
       if (patch.layout === null) {
         next.layout = undefined;
       } else if (typeof patch.layout === 'object' && !Array.isArray(patch.layout)) {
-        next.layout = patch.layout;
+        const rawLayout = patch.layout as Record<string, unknown>;
+        if ('artboards' in rawLayout) {
+          // Bounded — see normalizeLayoutArtboards. An oversized/malformed
+          // `artboards` array is a silent no-op (leaves the prior persisted
+          // layout in place), matching the overlays/locked lanes' convention.
+          const artboards = normalizeLayoutArtboards(rawLayout.artboards);
+          if (artboards !== null) {
+            next.layout = { ...rawLayout, artboards };
+          }
+        } else {
+          next.layout = patch.layout;
+        }
       }
       // Defensive: a stale inline viewport must never persist in the versioned
       // file (the camera lane owns it now). JSON.stringify drops undefined keys.
@@ -2577,6 +2626,11 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     // via git "Get latest" — the file travels through git, this event is only a
     // "refresh your list" nudge for online local tabs (loopback inspector WS).
     ctx.bus.emit('canvas-list-update', { action: 'added', rel, slug });
+    // The inverse of `canvas-deleted` (see deleteCanvas for why this is its own
+    // event). Creating a name the project buried earlier has to lift the
+    // tombstone, or every peer would dutifully trash the new canvas for as long
+    // as the gravestone lives.
+    ctx.bus.emit('canvas-created', { slug });
     // designRel-prefixed path — matches the file-tree `file.path` shape so the
     // client can open it directly after reloadTree().
     return { ok: true, file: path.posix.join(paths.designRel, rel), rel, slug };
@@ -2690,6 +2744,15 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
 
     // Phase 30 — live tree refresh for other local tabs (see createCanvas).
     ctx.bus.emit('canvas-list-update', { action: 'removed', rel, slug });
+    // A SEPARATE EVENT, DELIBERATELY. `canvas-list-update` is emitted by this
+    // API *and* by the filesystem watcher, so its payload can describe a file
+    // an agent or a `git checkout` produced — which is why discovery treats it
+    // as a nudge and re-derives the truth itself. This one is only ever emitted
+    // HERE, from a privileged route the canvas origin cannot reach, so it
+    // carries something the watcher's version cannot: the user meant it. Sync
+    // needs exactly that, because "gone from this disk" and "deleted from the
+    // project" are different claims and only the second may travel.
+    ctx.bus.emit('canvas-deleted', { slug });
     return {
       ok: true,
       rel,

package/apps/studio/build.ts

@@ -353,6 +353,16 @@ export function writeCompileEntry(target: PlatformTarget): string {
 // Side-effect module: must be imported BEFORE any oxc-parser usage.
 import bindingPath from ${JSON.stringify(bindingSpec)} with { type: 'file' };
 process.env.NAPI_RS_NATIVE_LIBRARY_PATH = bindingPath;
+// DDR-177 — a compiled binary must be self-contained: every runtime-spawned
+// child (canvas-build worker, asset-sweep worker) resolves its JS runtime via
+// resolveBunPath() = MAUDE_BUN_PATH || 'bun'. The desktop app launches this
+// binary with a GUI PATH that has no 'bun', and NOTHING set MAUDE_BUN_PATH —
+// so the asset sweep died with "Executable not found in $PATH" on machines
+// without a user-installed bun. Default it to THIS binary: workerEnv() adds
+// BUN_BE_BUN=1 when MAUDE_BUN_PATH === process.execPath, so children re-enter
+// the sidecar as a plain JS runtime. An explicit launcher-set value (the
+// cell's studio-child.mjs) still wins.
+process.env.MAUDE_BUN_PATH ||= process.execPath;
 `;
   writeFileSync(initPath, initContent);
 

package/apps/studio/canvas-lib.tsx

@@ -214,7 +214,15 @@ export function AIPlaceholder({
 // ─────────────────────────────────────────────────────────────────────────────
 // Module constants
 
-const ZOOM_MIN = 0.1;
+// Issue #91 — was 0.1. A board spanning more world units than ~10x the
+// viewport could never be framed whole: `fit()` and manual zoom-out both
+// funnel through `clampZoom` (below), so the old floor blocked "fit to
+// screen" from ever reaching the zoom a wide board actually needs. 0.02
+// matches the interactive floor other canvas tools (Figma, tldraw) ship.
+// Keep in lockstep with the mirror clamp in `api.ts`'s `normalizeViewport`
+// (the per-machine camera persisted to `_canvas-state/<slug>.view.json`,
+// DDR-115) — that one re-clamps on save/reload independently of this file.
+const ZOOM_MIN = 0.02;
 const ZOOM_MAX = 4.0;
 const ZOOM_STEP_IN = 1.2;
 const ZOOM_STEP_OUT = 1 / 1.2;
@@ -685,7 +693,9 @@ function synthDefaultGrid(seeds: ArtboardSeed[]): ArtboardRect[] {
   });
 }
 
-function computeFit(rects: ArtboardRect[], hostEl: HTMLElement, pad = 24): ViewportState {
+// Exported for the same reason as `clampZoom` above — lets a unit test prove
+// the raw fit computation for a wide board isn't what's clamping the zoom.
+export function computeFit(rects: ArtboardRect[], hostEl: HTMLElement, pad = 24): ViewportState {
   if (rects.length === 0) return { x: 0, y: 0, zoom: 1 };
   let xMin = Number.POSITIVE_INFINITY;
   let yMin = Number.POSITIVE_INFINITY;
@@ -907,7 +917,10 @@ export interface ViewportControllerHandle {
   isInteracting: boolean;
 }
 
-function clampZoom(z: number): number {
+// Exported (like `revealAxisDelta` in canvas-shell.tsx) so a pure-logic unit
+// test can pin the zoom floor without booting the DOM/host-dependent
+// viewport controller.
+export function clampZoom(z: number): number {
   if (!Number.isFinite(z)) return 1;
   return Math.min(ZOOM_MAX, Math.max(ZOOM_MIN, z));
 }

package/apps/studio/canvas-shell.tsx

@@ -67,15 +67,13 @@ import {
 import { ContextualToolbar } from './contextual-toolbar.tsx';
 import { CursorsOverlay } from './cursors-overlay.tsx';
 import {
+  buildComposeSelection,
   cssPath,
   deriveFile,
-  domPath,
   hoverTargetToSelection,
+  openCommentComposer,
   realClasses,
   resolveSelectionEl,
-  scopedCdSelector,
-  selectorIndex,
-  shortText,
 } from './dom-selection.ts';
 import { setElementDragActive } from './drag-state.ts';
 import { EqualSpacingHandles } from './equal-spacing-handles.tsx';
@@ -1378,33 +1376,17 @@ function buildRegistry(deps: {
     });
   };
 
+  // issue-90 — right-click "Add comment" (element / artboard-chrome / world)
+  // used to only postMessage the parent shell, which merely mirrors the
+  // target for the StatusBar/sidebar; it never dispatched `cm:open-composer`,
+  // the event `comments-overlay.tsx` actually listens on to open the
+  // composer. Selecting the menu item did nothing. `openCommentComposer`
+  // sends both, matching the working comment-tool-click path
+  // (canvas-comment-mount.tsx's `dropComment`).
   const postComposeForTarget = (target: ContextTarget): void => {
     if (typeof window === 'undefined') return;
-    const composeSelector = target.cdId
-      ? scopedCdSelector(target.cdId, target.artboardId)
-      : cssPath(target.el);
-    const sel: Selection | null = target.el
-      ? {
-          file: deriveFile(),
-          id: target.cdId ?? undefined,
-          selector: composeSelector,
-          artboardId: target.artboardId,
-          index: target.cdId ? selectorIndex(document, composeSelector, target.el) : 0,
-          tag: target.el.tagName.toLowerCase(),
-          classes: realClasses(target.el),
-          text: shortText(target.el, 240),
-          dom_path: domPath(target.el),
-          bounds: (target.el as HTMLElement).getBoundingClientRect
-            ? boundsOf(target.el as HTMLElement)
-            : null,
-          html: (target.el.outerHTML ?? '').slice(0, 4000),
-        }
-      : null;
-    try {
-      window.parent.postMessage({ dgn: 'comment-compose', selection: sel }, '*');
-    } catch {
-      /* ignore */
-    }
+    const sel = buildComposeSelection(target, target.clientX, target.clientY);
+    openCommentComposer(sel, target.clientX, target.clientY);
   };
 
   const fitItem: MenuItem = {
@@ -2141,6 +2123,18 @@ function buildRegistry(deps: {
       ],
     ],
     'artboard-chrome': [
+      [
+        // issue-90 — right-click on an artboard's own label/border chrome
+        // (outside its body, where `data-cd-id` never resolves) had no
+        // "Add comment" entry at all; only a hit inside the body counted as
+        // `element`. Anchors at the click point (no element under it).
+        {
+          id: 'add-comment',
+          label: 'Add comment',
+          shortcut: 'C',
+          onSelect: postComposeForTarget,
+        },
+      ],
       [
         {
           id: 'fit-one',
@@ -2273,6 +2267,17 @@ function buildRegistry(deps: {
       [exportItem('export-artboard', 'Export this artboard…', 'artboard')],
     ],
     world: [
+      // issue-90 — right-click on empty canvas background (no artboard, no
+      // element) had no "Add comment" entry at all. Anchors at the click
+      // point, same as the comment tool's own floating-pin fallback.
+      [
+        {
+          id: 'add-comment',
+          label: 'Add comment',
+          shortcut: 'C',
+          onSelect: postComposeForTarget,
+        },
+      ],
       [fitItem, resetItem],
       [
         exportItem('export-canvas', 'Export canvas as separate…', 'canvas-as-separate'),
@@ -2320,16 +2325,6 @@ function filterRegistryForReadOnly(registry: ContextRegistry): ContextRegistry {
   return out;
 }
 
-function boundsOf(el: HTMLElement) {
-  const r = el.getBoundingClientRect();
-  return {
-    x: Math.round(r.left),
-    y: Math.round(r.top),
-    w: Math.round(r.width),
-    h: Math.round(r.height),
-  };
-}
-
 // ─────────────────────────────────────────────────────────────────────────────
 // Task A1 (feature-element-editing-robustness) — camera-aware reveal.
 //

package/apps/studio/client/app.jsx

@@ -4704,6 +4704,11 @@ function StatusBar({
   onOpenSync,
   changesCount = 0,
   unpushed = 0,
+  // Somebody else commits this project (a cloud cell, or the cell behind a
+  // linked+credentialed desktop repo — DDR-218). The chip then names the
+  // mechanism that IS saving rather than reporting a working-tree count the
+  // user has no reason to act on. Default false = today's local-first chip.
+  savingIsManaged = false,
   changesOpen = false,
   onOpenChanges,
   version,
@@ -4811,11 +4816,17 @@ function StatusBar({
           <span className="st-sb-changes-dot" aria-hidden="true" />
           <span className="lbl">changes</span>
           <span className="val">
-            {changesCount > 0
-              ? `${changesCount} unsaved`
-              : unpushed > 0
-                ? `${unpushed} to publish`
-                : 'all saved'}
+            {savingIsManaged
+              ? // Not "all saved": assets and project config are written into the
+                // cell's checkout but never committed there, so asserting a clean
+                // save would overstate what the cloud actually holds. Naming the
+                // mechanism is both honest and the thing the user needs to know.
+                'cloud saving'
+              : changesCount > 0
+                ? `${changesCount} unsaved`
+                : unpushed > 0
+                  ? `${unpushed} to publish`
+                  : 'all saved'}
           </span>
         </button>
       )}
@@ -11383,7 +11394,26 @@ function App() {
     for (const f of gitStatus?.files || []) m.set(f.path, KIND[f.status]);
     return m;
   }, [gitStatus]);
-  const unsavedCount = gitStatus?.files?.length || 0;
+  // WHO IS SAVING THIS PROJECT — one expression, read by every surface that
+  // would otherwise offer to save it (DDR-218 + the cell's `historyOnly`).
+  //
+  // These two flags were previously derived at the GitPanel call site alone, so
+  // the panel withdrew correctly while the toolbar menu and the status-bar chip
+  // kept rendering a raw dirty count from `gitStatus.files.length` — the very
+  // "lie about work that is already saved" the withdrawal exists to delete. The
+  // count is the claim, wherever it is drawn; hoisting the rule here is what
+  // keeps a third surface from re-introducing it.
+  //
+  // PRESENTATION, NOT A CONTROL — unchanged from DDR-218. `.git` is untouched,
+  // a terminal `git` behaves exactly as before, the server routes keep their own
+  // gates, and Disconnect restores every surface live.
+  const cellManaged = !!cfg.cloud;
+  const cloudManaged = !cfg.cloud && !!cloudLinkedHub?.credentialed;
+  const savingIsManaged = cellManaged || cloudManaged;
+  // The raw truth stays available for surfaces that legitimately need it (the
+  // panel's own file list, `dirtyByPath`); only the COUNT — the thing that reads
+  // as a to-do — is withheld when this project's saving is somebody else's job.
+  const unsavedCount = savingIsManaged ? 0 : gitStatus?.files?.length || 0;
 
   // Phase 28 (E3) — keep remote ahead/behind fresh so the "Get latest" nudge
   // surfaces on its own: probe once a repo is known, again whenever the Changes
@@ -14446,7 +14476,7 @@ function App() {
           // mislead, it does not remove a capability. The real gates are
           // server-side (`projectReadOnly`, the manifest's role matrix), and
           // they are unchanged by this flag.
-          historyOnly={!!cfg.cloud}
+          historyOnly={cellManaged}
           // DDR-218 (fix 8) — the DESKTOP half of the same withdrawal: a repo
           // linked+credentialed to Maude Cloud is cloud-managed (the cell
           // commits every edit as it lands), so the local Changes surface is
@@ -14454,7 +14484,7 @@ function App() {
           // Live: CloudBar lifts every link change (resolve/attach/detach)
           // into `cloudLinkedHub`. Same presentation-not-a-control rule as
           // `historyOnly` above; Disconnect restores the panel in place.
-          cloudManaged={!cfg.cloud && !!cloudLinkedHub?.credentialed}
+          cloudManaged={cloudManaged}
           resizing={resizingFor('changes')}
           onClose={() => setChangesOpen(false)}
           onCommit={gitCommit}
@@ -15521,7 +15551,11 @@ function App() {
           // holds (opening Sync closes whatever else the right slot shows).
           onOpenSync={syncStatus ? () => toggleRightPanel('sync') : undefined}
           changesCount={unsavedCount}
-          unpushed={gitStatus?.unpushed || 0}
+          // `unpushed` is a LOCAL-git offer ("N to publish"), and the panel has
+          // withdrawn Publish under either managed posture — so the chip must
+          // not keep advertising it either.
+          unpushed={savingIsManaged ? 0 : gitStatus?.unpushed || 0}
+          savingIsManaged={savingIsManaged}
           changesOpen={changesOpen}
           onOpenChanges={gitStatus?.repo ? () => setChangesOpen(true) : undefined}
           version={cfg?.version}

package/apps/studio/client/panels/SyncPanel.jsx

@@ -89,6 +89,15 @@ function readAssets(raw) {
   return { ...raw, failures };
 }
 
+/** The file plane (feature-sync-file-plane), or null when unreadable/absent —
+ *  absent is the norm: the payload carries `files` only once a flag-on pull
+ *  has run this boot. */
+function readFiles(raw) {
+  if (!raw || typeof raw !== 'object') return null;
+  if (![raw.synced, raw.pulled, raw.conflicts].every(isCount)) return null;
+  return raw;
+}
+
 export default function SyncPanel({
   status, // the live `sync:status` payload (never null while mounted)
   project, // display name for the header sentence (hub-supplied → safeName'd)
@@ -150,6 +159,7 @@ export default function SyncPanel({
   const truncated = isCount(status?.itemsTruncated) ? status.itemsTruncated : 0;
   const assets = readAssets(status?.assets);
   const assetFailures = assets?.failures || [];
+  const files = readFiles(status?.files);
 
   const { attention, byGroup } = useMemo(() => {
     const attention = items.filter((i) => i.state === 'auth-rejected');
@@ -329,6 +339,23 @@ export default function SyncPanel({
             )}
           </section>
         )}
+
+        {files && (
+          <section aria-label="Project files" data-testid="sync-files">
+            <div className="gp-sect-label">
+              project files <span className="gp-group-count">{files.synced}</span>
+            </div>
+            <div className="sp-assets-line">
+              {`${files.synced} synced` + (files.pulled > 0 ? ` · ${files.pulled} pulled` : '')}
+            </div>
+            {files.conflicts > 0 && (
+              <div className="sp-assets-retry" data-testid="sync-files-conflicts">
+                {files.conflicts} conflict{files.conflicts === 1 ? '' : 's'} — the older copies are
+                kept in _trash/.
+              </div>
+            )}
+          </section>
+        )}
       </div>
     </aside>
   );

package/apps/studio/context.ts

@@ -47,6 +47,15 @@ export interface LinkedHub {
    * would split peers of the same project apart. See sync/doc-name.ts.
    */
   workspaceId?: string;
+  /**
+   * feature-sync-file-plane — opt-in for the manifest-driven file plane
+   * (Plane B): the downward project-file pull AND the widened upward sweep
+   * (stylesheets, docs, code modules — classifier membership, see
+   * sync/file-membership.ts). Default OFF this release; `MAUDE_SYNC_FILES=1`
+   * forces it on for a session. The flag gates ONLY the new plane — the
+   * canvas CRDT lanes and the DDR-217 asset lanes run regardless.
+   */
+  syncFiles?: boolean;
 }
 
 export interface DevServerConfig {