@1agh/maude 0.60.4 → 0.60.5

package/apps/studio/api.ts

@@ -1499,11 +1499,14 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
   // shared `.meta.json` document. It lives in `_canvas-state/<slug>.view.json`
   // ({ viewport }) — gitignored, swept on delete, export-excluded. DISTINCT from
   // the legacy `_canvas-state/<slug>.json` ({ sections, viewport:{x,y,scale} })
-  // store: that uses `scale` clamped 0.05–8, this uses `zoom` clamped 0.1–4, so
+  // store: that uses `scale` clamped 0.05–8, this uses `zoom` clamped 0.02–4, so
   // overloading one file would let the two writers clobber each other's shape.
 
-  /** Validate a candidate viewport — finite x/y, zoom clamped [0.1, 4] (the
-   *  Phase 4 rule). Returns the normalized viewport, or null when invalid. */
+  /** Validate a candidate viewport — finite x/y, zoom clamped [0.02, 4] (the
+   *  Phase 4 rule). Mirrors `ZOOM_MIN` in canvas-lib.tsx (issue #91) — keep the
+   *  two floors in lockstep or a save/reload round-trip silently re-clamps a
+   *  zoom the client just let the user reach. Returns the normalized viewport,
+   *  or null when invalid. */
   function normalizeViewport(v: unknown): { x: number; y: number; zoom: number } | null {
     if (!v || typeof v !== 'object' || Array.isArray(v)) return null;
     const vv = v as { x?: unknown; y?: unknown; zoom?: unknown };
@@ -1512,7 +1515,7 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
       Number.isFinite(vv.y as number) &&
       Number.isFinite(vv.zoom as number)
     ) {
-      const zoom = Math.min(4, Math.max(0.1, vv.zoom as number));
+      const zoom = Math.min(4, Math.max(0.02, vv.zoom as number));
       return { x: vv.x as number, y: vv.y as number, zoom };
     }
     return null;
@@ -1571,6 +1574,41 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
     return [...new Set(out)];
   }
 
+  // Issue #91 security follow-up — `layout.artboards[]` (DDR-027 position-only
+  // entries) is reachable from the untrusted canvas origin (DDR-054) via the
+  // same PATCH lane as overlays/locked above, but previously had no count or
+  // magnitude bound. `fit()`/`computeFit` (canvas-lib.tsx) now correctly frames
+  // whatever bounding box this describes — before the zoom-floor fix, a hard
+  // 0.1 zoom clamp accidentally masked an unbounded layout into a cropped,
+  // mismatched view; after it, an oversized synced layout can legitimately be
+  // framed whole, promoting every artboard in it to its own GPU layer at once
+  // (canvas-lib.tsx `content-visibility` comment). Cap count + coordinate
+  // magnitude the same way `normalizeOverlays`/`normalizeLocked` cap theirs.
+  const MAX_LAYOUT_ARTBOARDS = 2000;
+  const MAX_LAYOUT_COORD = 1_000_000;
+
+  function normalizeLayoutArtboards(
+    v: unknown
+  ): Array<{ id: string; x: number; y: number }> | null {
+    if (!Array.isArray(v) || v.length > MAX_LAYOUT_ARTBOARDS) return null;
+    const out: Array<{ id: string; x: number; y: number }> = [];
+    for (const entry of v) {
+      if (!entry || typeof entry !== 'object' || Array.isArray(entry)) return null;
+      const e = entry as { id?: unknown; x?: unknown; y?: unknown };
+      if (typeof e.id !== 'string' || e.id.length === 0 || e.id.length > 128) return null;
+      if (
+        !Number.isFinite(e.x as number) ||
+        !Number.isFinite(e.y as number) ||
+        Math.abs(e.x as number) > MAX_LAYOUT_COORD ||
+        Math.abs(e.y as number) > MAX_LAYOUT_COORD
+      ) {
+        return null;
+      }
+      out.push({ id: e.id, x: e.x as number, y: e.y as number });
+    }
+    return out;
+  }
+
   /** Raw view-file contents, tolerant of a missing/corrupt file (→ `{}`) — the
    *  read half of the read-modify-write both `saveCanvasView` and
    *  `saveCanvasOverlays` need so writing one lane never clobbers the other. */
@@ -1819,7 +1857,18 @@ export function createApi(ctx: Context, hooks: ApiHooks): Api {
       if (patch.layout === null) {
         next.layout = undefined;
       } else if (typeof patch.layout === 'object' && !Array.isArray(patch.layout)) {
-        next.layout = patch.layout;
+        const rawLayout = patch.layout as Record<string, unknown>;
+        if ('artboards' in rawLayout) {
+          // Bounded — see normalizeLayoutArtboards. An oversized/malformed
+          // `artboards` array is a silent no-op (leaves the prior persisted
+          // layout in place), matching the overlays/locked lanes' convention.
+          const artboards = normalizeLayoutArtboards(rawLayout.artboards);
+          if (artboards !== null) {
+            next.layout = { ...rawLayout, artboards };
+          }
+        } else {
+          next.layout = patch.layout;
+        }
       }
       // Defensive: a stale inline viewport must never persist in the versioned
       // file (the camera lane owns it now). JSON.stringify drops undefined keys.

package/apps/studio/build.ts

@@ -353,6 +353,16 @@ export function writeCompileEntry(target: PlatformTarget): string {
 // Side-effect module: must be imported BEFORE any oxc-parser usage.
 import bindingPath from ${JSON.stringify(bindingSpec)} with { type: 'file' };
 process.env.NAPI_RS_NATIVE_LIBRARY_PATH = bindingPath;
+// DDR-177 — a compiled binary must be self-contained: every runtime-spawned
+// child (canvas-build worker, asset-sweep worker) resolves its JS runtime via
+// resolveBunPath() = MAUDE_BUN_PATH || 'bun'. The desktop app launches this
+// binary with a GUI PATH that has no 'bun', and NOTHING set MAUDE_BUN_PATH —
+// so the asset sweep died with "Executable not found in $PATH" on machines
+// without a user-installed bun. Default it to THIS binary: workerEnv() adds
+// BUN_BE_BUN=1 when MAUDE_BUN_PATH === process.execPath, so children re-enter
+// the sidecar as a plain JS runtime. An explicit launcher-set value (the
+// cell's studio-child.mjs) still wins.
+process.env.MAUDE_BUN_PATH ||= process.execPath;
 `;
   writeFileSync(initPath, initContent);
 

package/apps/studio/canvas-lib.tsx

@@ -214,7 +214,15 @@ export function AIPlaceholder({
 // ─────────────────────────────────────────────────────────────────────────────
 // Module constants
 
-const ZOOM_MIN = 0.1;
+// Issue #91 — was 0.1. A board spanning more world units than ~10x the
+// viewport could never be framed whole: `fit()` and manual zoom-out both
+// funnel through `clampZoom` (below), so the old floor blocked "fit to
+// screen" from ever reaching the zoom a wide board actually needs. 0.02
+// matches the interactive floor other canvas tools (Figma, tldraw) ship.
+// Keep in lockstep with the mirror clamp in `api.ts`'s `normalizeViewport`
+// (the per-machine camera persisted to `_canvas-state/<slug>.view.json`,
+// DDR-115) — that one re-clamps on save/reload independently of this file.
+const ZOOM_MIN = 0.02;
 const ZOOM_MAX = 4.0;
 const ZOOM_STEP_IN = 1.2;
 const ZOOM_STEP_OUT = 1 / 1.2;
@@ -685,7 +693,9 @@ function synthDefaultGrid(seeds: ArtboardSeed[]): ArtboardRect[] {
   });
 }
 
-function computeFit(rects: ArtboardRect[], hostEl: HTMLElement, pad = 24): ViewportState {
+// Exported for the same reason as `clampZoom` above — lets a unit test prove
+// the raw fit computation for a wide board isn't what's clamping the zoom.
+export function computeFit(rects: ArtboardRect[], hostEl: HTMLElement, pad = 24): ViewportState {
   if (rects.length === 0) return { x: 0, y: 0, zoom: 1 };
   let xMin = Number.POSITIVE_INFINITY;
   let yMin = Number.POSITIVE_INFINITY;
@@ -907,7 +917,10 @@ export interface ViewportControllerHandle {
   isInteracting: boolean;
 }
 
-function clampZoom(z: number): number {
+// Exported (like `revealAxisDelta` in canvas-shell.tsx) so a pure-logic unit
+// test can pin the zoom floor without booting the DOM/host-dependent
+// viewport controller.
+export function clampZoom(z: number): number {
   if (!Number.isFinite(z)) return 1;
   return Math.min(ZOOM_MAX, Math.max(ZOOM_MIN, z));
 }

package/apps/studio/canvas-shell.tsx

@@ -67,15 +67,13 @@ import {
 import { ContextualToolbar } from './contextual-toolbar.tsx';
 import { CursorsOverlay } from './cursors-overlay.tsx';
 import {
+  buildComposeSelection,
   cssPath,
   deriveFile,
-  domPath,
   hoverTargetToSelection,
+  openCommentComposer,
   realClasses,
   resolveSelectionEl,
-  scopedCdSelector,
-  selectorIndex,
-  shortText,
 } from './dom-selection.ts';
 import { setElementDragActive } from './drag-state.ts';
 import { EqualSpacingHandles } from './equal-spacing-handles.tsx';
@@ -1378,33 +1376,17 @@ function buildRegistry(deps: {
     });
   };
 
+  // issue-90 — right-click "Add comment" (element / artboard-chrome / world)
+  // used to only postMessage the parent shell, which merely mirrors the
+  // target for the StatusBar/sidebar; it never dispatched `cm:open-composer`,
+  // the event `comments-overlay.tsx` actually listens on to open the
+  // composer. Selecting the menu item did nothing. `openCommentComposer`
+  // sends both, matching the working comment-tool-click path
+  // (canvas-comment-mount.tsx's `dropComment`).
   const postComposeForTarget = (target: ContextTarget): void => {
     if (typeof window === 'undefined') return;
-    const composeSelector = target.cdId
-      ? scopedCdSelector(target.cdId, target.artboardId)
-      : cssPath(target.el);
-    const sel: Selection | null = target.el
-      ? {
-          file: deriveFile(),
-          id: target.cdId ?? undefined,
-          selector: composeSelector,
-          artboardId: target.artboardId,
-          index: target.cdId ? selectorIndex(document, composeSelector, target.el) : 0,
-          tag: target.el.tagName.toLowerCase(),
-          classes: realClasses(target.el),
-          text: shortText(target.el, 240),
-          dom_path: domPath(target.el),
-          bounds: (target.el as HTMLElement).getBoundingClientRect
-            ? boundsOf(target.el as HTMLElement)
-            : null,
-          html: (target.el.outerHTML ?? '').slice(0, 4000),
-        }
-      : null;
-    try {
-      window.parent.postMessage({ dgn: 'comment-compose', selection: sel }, '*');
-    } catch {
-      /* ignore */
-    }
+    const sel = buildComposeSelection(target, target.clientX, target.clientY);
+    openCommentComposer(sel, target.clientX, target.clientY);
   };
 
   const fitItem: MenuItem = {
@@ -2141,6 +2123,18 @@ function buildRegistry(deps: {
       ],
     ],
     'artboard-chrome': [
+      [
+        // issue-90 — right-click on an artboard's own label/border chrome
+        // (outside its body, where `data-cd-id` never resolves) had no
+        // "Add comment" entry at all; only a hit inside the body counted as
+        // `element`. Anchors at the click point (no element under it).
+        {
+          id: 'add-comment',
+          label: 'Add comment',
+          shortcut: 'C',
+          onSelect: postComposeForTarget,
+        },
+      ],
       [
         {
           id: 'fit-one',
@@ -2273,6 +2267,17 @@ function buildRegistry(deps: {
       [exportItem('export-artboard', 'Export this artboard…', 'artboard')],
     ],
     world: [
+      // issue-90 — right-click on empty canvas background (no artboard, no
+      // element) had no "Add comment" entry at all. Anchors at the click
+      // point, same as the comment tool's own floating-pin fallback.
+      [
+        {
+          id: 'add-comment',
+          label: 'Add comment',
+          shortcut: 'C',
+          onSelect: postComposeForTarget,
+        },
+      ],
       [fitItem, resetItem],
       [
         exportItem('export-canvas', 'Export canvas as separate…', 'canvas-as-separate'),
@@ -2320,16 +2325,6 @@ function filterRegistryForReadOnly(registry: ContextRegistry): ContextRegistry {
   return out;
 }
 
-function boundsOf(el: HTMLElement) {
-  const r = el.getBoundingClientRect();
-  return {
-    x: Math.round(r.left),
-    y: Math.round(r.top),
-    w: Math.round(r.width),
-    h: Math.round(r.height),
-  };
-}
-
 // ─────────────────────────────────────────────────────────────────────────────
 // Task A1 (feature-element-editing-robustness) — camera-aware reveal.
 //