@1agh/maude 0.60.7 → 1.0.3

package/apps/studio/client/app.jsx

@@ -33,6 +33,7 @@ import { useTreeDrag } from './use-tree-drag.js';
 import ChatPanel from './panels/ChatPanel.jsx';
 import DiffView from './panels/DiffView.jsx';
 import GitPanel from './panels/GitPanel.jsx';
+import SyncConsentDialog from './panels/SyncConsentDialog.jsx';
 import SyncPanel from './panels/SyncPanel.jsx';
 import CloudBar from './panels/CloudBar.jsx';
 import IdentityBar from './panels/IdentityBar.jsx';
@@ -1537,9 +1538,23 @@ function ExportDialog({
   comps = [],
   activeArtboardId = null,
   selection = null,
+  exportLane = 'local',
   onClose,
 }) {
-  const [sel, setSel] = useState(mode === 'handoff' ? 'shadcn' : 'png');
+  // feature-cloud-export-render-workers — on a cell with no render service
+  // (`lane === 'none'`), formats that render through a browser are offered
+  // disabled-with-a-reason instead of firing a request the proxy 404s. ZIP
+  // (JSZip over project files) and the AI-handoff card (clipboard copy) need
+  // no browser and stay live in every lane.
+  const laneBlocked = useCallback(
+    (c) =>
+      (exportLane === 'none' && !c.handoff && c.format !== 'zip') ||
+      // Canva bundles project files the render service can't reach — desktop only
+      // in every workspace lane (exporters/remote.ts REMOTE_UNSUPPORTED_FORMATS).
+      (exportLane !== 'local' && c.format === 'canva'),
+    [exportLane]
+  );
+  const [sel, setSel] = useState(mode === 'handoff' ? 'shadcn' : exportLane === 'none' ? 'zip' : 'png');
   const [scope, setScope] = useState(
     initialScope && EXPORT_SCOPE_LABELS[initialScope] ? initialScope : 'artboard'
   );
@@ -1622,6 +1637,12 @@ function ExportDialog({
       setStatus({ ok: true, msg: `Copied: ${cmd} — run it in Claude Code.` });
       return;
     }
+    if (laneBlocked(card)) {
+      // Belt to the disabled-card braces — a stale selection can't submit a
+      // format this workspace cannot render.
+      setStatus({ ok: false, msg: 'This format needs the render service, which this workspace doesn’t have configured.' });
+      return;
+    }
     setBusy(true);
     setStatus(null);
     // `scale` drives video resolution (deviceScaleFactor → encoder dims);
@@ -1705,6 +1726,12 @@ function ExportDialog({
                 type="button"
                 key={c.id}
                 className={'st-fmt' + (c.id === sel ? ' is-on' : '')}
+                disabled={laneBlocked(c)}
+                title={
+                  laneBlocked(c)
+                    ? 'Needs the render service — not configured on this workspace'
+                    : undefined
+                }
                 onClick={() => {
                   setSel(c.id);
                   setStatus(null);
@@ -1716,6 +1743,14 @@ function ExportDialog({
               </button>
             ))}
           </div>
+          {exportLane === 'none' && (
+            <div className="st-dialog-note" data-testid="export-lane-note">
+              Rendered exports (PNG, PDF, video…) need the render service, which this
+              workspace doesn&apos;t have configured. ZIP and AI handoff still work here —
+              for everything else use the desktop app, or ask your admin to add the
+              <code> maude-render</code> service (see the self-hosting docs).
+            </div>
+          )}
           {!card.handoff && (
             <div className="st-dialog-row">
               <label className="st-dialog-lbl" htmlFor="st-export-scope">
@@ -2568,7 +2603,7 @@ function Sidebar({
   // Cloud Phase 25 C2 — viewer role: create / delete / move / rename
   // affordances are absent (buttons, composer, row menus, drag & drop).
   readOnly = false,
-  /** `{ dashboardUrl, projectName }` when this is a cloud tab, else null. */
+  /** `{ dashboardUrl?, projectName }` when this is a cloud tab, else null. */
   // Tri-state (see the note where this value is created): `undefined` until
   // the server config answers, `null` for the desktop, an object for a cloud
   // tab. Defaulting it to `null` here is what re-broke the boot 404 after the
@@ -2612,6 +2647,10 @@ function Sidebar({
   // Passed through to CloudBar only — lifts linkedHub changes to the app shell
   // so the GitPanel's cloud-managed posture (DDR-218) reacts live.
   onLinkedHub,
+  // feature-cloud-managed-git-posture — the widened DDR-218 gate, resolved once
+  // in App and handed down. Withdraws the drafts switcher: a local branch
+  // switch moves a HEAD the cell knows nothing about.
+  savingIsManaged = false,
 }) {
   const filteredGroups = useMemo(() => {
     if (!search) return groups;
@@ -2977,8 +3016,19 @@ function Sidebar({
       />
       {/* Phase 29 (E4) — the project + draft switcher: a compact one-line dock that
           opens UPWARD, sitting directly above the GitHub identity avatar so the two
-          form one bottom dock. Renders nothing until the project is a git repo. */}
-      <RepoBranchSwitcher project={project} liveBranch={gitBranch} remoteSync={remoteSync} onGetLatest={onGetLatest} />
+          form one bottom dock. Renders nothing until the project is a git repo.
+
+          WITHDRAWN while somebody else is committing (feature-cloud-managed-git-
+          posture). A draft is a local branch, and switching one moves a HEAD the
+          cell knows nothing about — it would rewrite the working tree under a
+          project whose history is being written elsewhere. Same
+          presentation-not-a-control rule as the rest of DDR-218: `/_api/git/branch`
+          and `/_api/git/checkout` keep exactly their old gates, and a terminal
+          `git checkout` still works (and still flushes into Yjs via DDR-051's
+          watcher). Absent, not disabled — there is nothing to explain here. */}
+      {!savingIsManaged && (
+        <RepoBranchSwitcher project={project} liveBranch={gitBranch} remoteSync={remoteSync} onGetLatest={onGetLatest} />
+      )}
       {/* Cloud Phase 23 C3 — Maude Cloud sign-in + remote-project attach, docked
           above the GitHub identity. Dev-server-backed, so it works in the desktop
           shell AND a plain browser. */}
@@ -3776,7 +3826,7 @@ function EditDropdown({ onAction, onClose, hasCanvas, readOnly = false }) {
 function Menubar({
   activePath,
   project,
-  /** `{ dashboardUrl, projectName }` when this is a cloud tab, else null. */
+  /** `{ dashboardUrl?, projectName }` when this is a cloud tab, else null. */
   // Tri-state (see the note where this value is created): `undefined` until
   // the server config answers, `null` for the desktop, an object for a cloud
   // tab. Defaulting it to `null` here is what re-broke the boot 404 after the
@@ -4078,13 +4128,22 @@ function Menubar({
           component, which is how the two shells started diverging last time. */}
       {cloud ? (
         <span className="st-cloudback" data-testid="cloud-back">
-          <a
-            className="st-cloudback-link"
-            href={cloud.dashboardUrl || 'https://cloud.maude.sh'}
-            title="Back to your projects"
-          >
-            ← Dashboard
-          </a>
+          {/* Only when there IS somewhere to go back TO. `dashboardUrl` is
+              absent on a self-hosted hub (one hub serves one project, so there
+              is no dashboard), and a hardcoded fallback here quietly re-created
+              the exact bug the server side just stopped: the link is the ONE
+              way out this tab offers, and it pointed at cloud.maude.sh. The
+              project name below stays either way — a tab must still say which
+              project it is showing. */}
+          {cloud.dashboardUrl ? (
+            <a
+              className="st-cloudback-link"
+              href={cloud.dashboardUrl}
+              title="Back to your projects"
+            >
+              ← Dashboard
+            </a>
+          ) : null}
           {cloud.projectName ? (
             <span className="st-cloudback-project" data-testid="cloud-project-name">
               {cloud.projectName}
@@ -4218,8 +4277,8 @@ function Menubar({
             data-testid="view-only-stamp"
             data-tip={
               cloud?.user
-                ? `${cloud.user} is a viewer on this project — you can browse, comment and export. Ask a project owner for edit access, or sign out if that is not the account you meant to use.`
-                : 'Your role in this project is viewer — you can browse, comment when available, and export. Ask a project owner for edit access.'
+                ? `${cloud.user} is a viewer on this project — you can browse, comment and export where available. Ask a project owner for edit access, or sign out if that is not the account you meant to use.`
+                : 'Your role in this project is viewer — you can browse, comment when available, and export where available. Ask a project owner for edit access.'
             }
           >
             VIEW ONLY
@@ -9610,13 +9669,50 @@ function App() {
   //               UNKNOWN, and anything that would behave differently in the
   //               two shells must wait rather than assume the desktop.
   //   null      — desktop or plain local browser.
-  //   object    — a cloud tab (`{ dashboardUrl, projectName, user, role }`).
+  //   object    — a cloud tab (`{ dashboardUrl?, projectName, user, role }`).
   //
   // Collapsing unknown into "not cloud" is what made the cloud studio open with
   // two console 404s every time: the sign-in bar and the export centre mounted
   // for one frame, each fired the request its shell exists to refuse, and then
   // unmounted. Nothing was broken and everything looked broken.
   const [cfg, setCfg] = useState({ designRel: '.design', cloud: undefined });
+  // WHO IS SAVING THIS PROJECT — one expression, read by every surface that
+  // would otherwise offer to save it, poll for it, or badge it (DDR-218, widened
+  // by feature-cloud-managed-git-posture).
+  //
+  // These two flags were previously derived at the GitPanel call site alone, so
+  // the panel withdrew correctly while the toolbar menu and the status-bar chip
+  // kept rendering a raw dirty count from `gitStatus.files.length` — the very
+  // "lie about work that is already saved" the withdrawal exists to delete. The
+  // count is the claim, wherever it is drawn; hoisting the rule here is what
+  // keeps a third surface from re-introducing it.
+  //
+  // DECLARED HERE, AT THE TOP, ON PURPOSE. Every local-git POLL below is gated
+  // on it, and a dependency array evaluates during render — a `const` further
+  // down would be in its temporal dead zone at the first `useEffect` that names
+  // it. The same hazard the remote-sync effect's own comment records.
+  //
+  // PRESENTATION, NOT A CONTROL — unchanged from DDR-218. `.git` is untouched:
+  // no hook is installed, no config is written, a terminal `git status` /
+  // `git commit` behaves exactly as before, the local `/_api/git/*` routes keep
+  // exactly their old gates, and `git/watch.ts` still flushes a terminal
+  // `git checkout` into Yjs (DDR-051). What stops is MAUDE's own local git
+  // activity — the polls and the surfaces that describe a repo nobody is
+  // editing through. Disconnect restores every one of them live.
+  const cellManaged = !!cfg.cloud;
+  const cloudManaged = !cfg.cloud && !!cloudLinkedHub?.credentialed;
+  const savingIsManaged = cellManaged || cloudManaged;
+  // The raw truth stays available for surfaces that legitimately need it (the
+  // panel's own file list); only the COUNT — the thing that reads as a to-do —
+  // is withheld when this project's saving is somebody else's job.
+  const unsavedCount = savingIsManaged ? 0 : gitStatus?.files?.length || 0;
+  // The posture, readable from callbacks that must NOT re-subscribe when it
+  // flips: the WS handler is installed once for the socket's lifetime, and the
+  // two git-status refreshers are `useCallback([])`s a dozen call sites depend
+  // on being stable. A ref is how they read a live value without becoming a
+  // reason to tear the socket down.
+  const savingIsManagedRef = useRef(savingIsManaged);
+  savingIsManagedRef.current = savingIsManaged;
   // Cloud Phase 25 C2 — viewer role, known at boot from /_config. Every
   // editing affordance in the shell gates on this (absent, not hidden).
   const viewerMode = !!cfg.readOnly;
@@ -9662,11 +9758,16 @@ function App() {
           // Undefined on a server too old to report it, which is why the chip
           // renders conditionally rather than printing `vundefined`.
           version: data.version,
-          // C2/C4 — `{ dashboardUrl, projectName, user, role }` when this is a
+          // C2/C4 — `{ dashboardUrl?, projectName, user, role }` when this is a
           // cloud tab. Its presence is what tells the shared client it is in a
           // browser tab on somebody else's machine; `user`/`role` are what let
           // it say WHICH account that tab is, and offer the way out.
           cloud: data.cloud ?? null,
+          // feature-cloud-export-render-workers — `local` | `remote` | `none`.
+          // Which export formats this server can actually produce; the export
+          // dialogs gate on it. Absent on older servers → undefined, treated
+          // as `local` (the pre-lane behavior) everywhere it is read.
+          exportLane: data.exportLane,
         }));
       })
       .catch(() => {});
@@ -9693,7 +9794,20 @@ function App() {
   }, []);
   // Phase 27 (E2) — seed the git dirty-state on mount; live updates arrive over
   // the `git-status` WS broadcast (Task 5). Solo/non-git projects → repo:false.
+  //
+  // NOT WHILE SOMEBODY ELSE IS COMMITTING. In cloud-managed posture this asks
+  // about a repo the user is not editing through, and every answer it brings
+  // back is drawn somewhere as a claim about their work. Reactive on
+  // `savingIsManaged`, not mount-only, so Disconnect resumes it live and
+  // Connect stops it live — the requirement `git-cloud-posture.test.ts`
+  // already pins for the panel.
   useEffect(() => {
+    if (savingIsManaged) {
+      // Drop what the local repo last said, too. A stale `gitStatus` left
+      // standing keeps the tree's M/A/D badges lit after the posture changed.
+      setGitStatus(null);
+      return undefined;
+    }
     let cancelled = false;
     fetch('/_api/git/status')
       .then((r) => r.json())
@@ -9704,7 +9818,7 @@ function App() {
     return () => {
       cancelled = true;
     };
-  }, []);
+  }, [savingIsManaged]);
   const [commentsByFile, setCommentsByFile] = useState({}); // { file: [Comment] }
   // Phase 6 — the in-iframe composer owns drafting; the shell no longer holds
   // a `draft` state. Mutations route through postMessage → WS instead.
@@ -10034,10 +10148,15 @@ function App() {
   // toggles on its own and coexists with Inspector/Changes/Comments/Chat.
   const toggleTimeline = useCallback(() => setTimelineOpen((v) => !v), []);
   const whatsNew = useWhatsNew(MDCC_VERSION);
-  // Same tri-state rule as the sign-in bar: the export queue is a LOCAL job
-  // runner, `/_api/export-jobs` is one of the routes a cell refuses outright
-  // (DDR-209 D1), and hydrating before the shell is known 404s every boot.
-  const exportCenter = useExportCenter({ enabled: cfg.cloud === null });
+  // Same tri-state rule as the sign-in bar: hydrating before the shell is
+  // known 404s every boot. On desktop (`cloud === null`) the export queue is
+  // the LOCAL job runner, always on. In a cloud tab it hydrates only when the
+  // cell actually holds a jobs lane (`exportLane === 'remote'`) — a cell
+  // without a render service still refuses `/_api/export-jobs` outright
+  // (DDR-209 D1 posture, now lane-scoped by feature-cloud-export-render-workers).
+  const exportCenter = useExportCenter({
+    enabled: cfg.cloud === null || cfg.exportLane === 'remote',
+  });
   // Phase 29 (E4) — first-run onboarding wizard. The native shell boots a minimal
   // "welcome" project on first launch; we ask it whether this is a first run and, if
   // so, show the wizard OVER the (empty) canvas browser. Completing any door switches
@@ -11245,7 +11364,13 @@ function App() {
           } else if (m.type === 'git-status' && m.payload) {
             // Phase 27 (E2) Task 5 — live dirty-state. Updates the Changes-panel
             // count + tree M/A/D badges reactively, no polling.
-            setGitStatus(m.payload);
+            //
+            // The server PUSHES this, so gating the fetches alone would not be
+            // enough: the broadcast would quietly re-populate everything the
+            // polls stopped asking for. Read through a ref because this handler
+            // is installed once, by an effect that must not re-subscribe the
+            // socket every time the posture flips.
+            if (!savingIsManagedRef.current) setGitStatus(m.payload);
           } else if (m.type === 'git-lifecycle' && m.payload) {
             // Phase 8 Task 7 — branch switch / pull mid-session. Server has
             // already flushed every dirty Y.Doc to JSON; just prompt the user.
@@ -11283,6 +11408,7 @@ function App() {
   // dual-allowlist gate them main-origin only). After a mutation we refresh
   // status optimistically; the `git-status` WS broadcast also lands shortly.
   const refreshGitStatus = useCallback(async () => {
+    if (savingIsManagedRef.current) return; // cloud-managed — nobody polls a repo they don't commit to
     try {
       const r = await fetch('/_api/git/status');
       if (r.ok) setGitStatus(await r.json());
@@ -11295,6 +11421,11 @@ function App() {
   // without it the status is local-only and the nudge never fires. Network call —
   // call sparingly (mount / interval / post-action), never on the WS hot path.
   const refreshRemoteSync = useCallback(async () => {
+    // The ahead/behind probe is a real network `git fetch` against the LOCAL
+    // repo's remote — the one remote a cloud-managed project has nothing to do
+    // with. Gated here as well as at the interval, so a post-action call site
+    // cannot reintroduce it.
+    if (savingIsManagedRef.current) return;
     try {
       const r = await fetch('/_api/git/status?remote=1');
       if (!r.ok) return;
@@ -11392,35 +11523,49 @@ function App() {
     }
   }, []);
 
+  // THE HISTORY THAT IS ACTUALLY BEING WRITTEN (feature-cloud-managed-git-
+  // posture). Same signature and same row shape as `gitLoadLog` — the two are
+  // interchangeable at the call site precisely because the format, the argv and
+  // the parser behind them are ONE module (`git/log-format.ts`), imported by
+  // both the local service and the cell.
+  //
+  // Failure is REPORTED, never mistaken for emptiness: `null` means "we could
+  // not reach the cloud" (the panel shows a Retry callout), `[]` means "the
+  // cloud has no versions yet" (the panel shows the empty state). Collapsing
+  // the two is what produced the original bug in the first place.
+  const [cloudHistory, setCloudHistory] = useState(null); // { branch, project, hubHost } | null
+  const gitLoadCloudLog = useCallback(async (path) => {
+    try {
+      const qs =
+        '/_api/cloud/history?limit=40' + (path ? `&path=${encodeURIComponent(path)}` : '');
+      const r = await fetch(qs);
+      if (!r.ok) return null;
+      const data = await r.json();
+      if (!data?.ok) return null;
+      setCloudHistory({
+        branch: data.branch ?? null,
+        project: data.project ?? null,
+        hubHost: data.hubHost ?? null,
+      });
+      return data.entries || [];
+    } catch {
+      return null;
+    }
+  }, []);
+
   // Repo-relative path → M/A/D/U badge for the tree (paths match: both the tree
   // and gitStatus use `.design/ui/Foo.tsx`). Keyed off gitStatus so it updates
   // live with the WS broadcast.
   const dirtyByPath = useMemo(() => {
     const KIND = { modified: 'M', added: 'A', deleted: 'D', untracked: 'U' };
     const m = new Map();
+    // A tree badge is the SAME claim as the withdrawn count, drawn one row at a
+    // time: "this file is unsaved". In cloud-managed posture it is not — the
+    // cell committed it seconds ago. Empty, so the tree simply says nothing.
+    if (savingIsManaged) return m;
     for (const f of gitStatus?.files || []) m.set(f.path, KIND[f.status]);
     return m;
-  }, [gitStatus]);
-  // WHO IS SAVING THIS PROJECT — one expression, read by every surface that
-  // would otherwise offer to save it (DDR-218 + the cell's `historyOnly`).
-  //
-  // These two flags were previously derived at the GitPanel call site alone, so
-  // the panel withdrew correctly while the toolbar menu and the status-bar chip
-  // kept rendering a raw dirty count from `gitStatus.files.length` — the very
-  // "lie about work that is already saved" the withdrawal exists to delete. The
-  // count is the claim, wherever it is drawn; hoisting the rule here is what
-  // keeps a third surface from re-introducing it.
-  //
-  // PRESENTATION, NOT A CONTROL — unchanged from DDR-218. `.git` is untouched,
-  // a terminal `git` behaves exactly as before, the server routes keep their own
-  // gates, and Disconnect restores every surface live.
-  const cellManaged = !!cfg.cloud;
-  const cloudManaged = !cfg.cloud && !!cloudLinkedHub?.credentialed;
-  const savingIsManaged = cellManaged || cloudManaged;
-  // The raw truth stays available for surfaces that legitimately need it (the
-  // panel's own file list, `dirtyByPath`); only the COUNT — the thing that reads
-  // as a to-do — is withheld when this project's saving is somebody else's job.
-  const unsavedCount = savingIsManaged ? 0 : gitStatus?.files?.length || 0;
+  }, [gitStatus, savingIsManaged]);
 
   // Phase 28 (E3) — keep remote ahead/behind fresh so the "Get latest" nudge
   // surfaces on its own: probe once a repo is known, again whenever the Changes
@@ -11428,6 +11573,13 @@ function App() {
   // publish then shows up without the user first attempting their own publish).
   // Declared after `refreshRemoteSync` to avoid a temporal-dead-zone on the dep.
   useEffect(() => {
+    if (savingIsManaged) {
+      // Nothing to nudge about: Publish is withdrawn in this posture, so a
+      // probe could only produce a count nobody may act on. Clear the last
+      // answer as well — a stale ahead/behind would outlive the link.
+      setRemoteSync(null);
+      return undefined;
+    }
     if (gitStatus?.repo === false) return; // solo / non-git project — no remote
     refreshRemoteSync();
     // Poll in the background too — not only while Changes is open — so the dock's
@@ -11436,7 +11588,7 @@ function App() {
     // TTL-cached server-side, so a missed tick is cheap to re-issue).
     const id = setInterval(refreshRemoteSync, changesOpen ? 60000 : 120000);
     return () => clearInterval(id);
-  }, [gitStatus?.repo, changesOpen, refreshRemoteSync]);
+  }, [savingIsManaged, gitStatus?.repo, changesOpen, refreshRemoteSync]);
 
   // ----- Tab management (single-canvas) -----
   // Single-canvas model: opening a file REPLACES the active one (no tab strip).
@@ -12854,6 +13006,18 @@ function App() {
           if (source) source.postMessage({ dgn: 'export-result', id, ...msg }, replyOrigin);
         } catch {}
       };
+      // feature-cloud-export-render-workers — a workspace with no render
+      // service can't produce browser-rendered formats; answer the in-canvas
+      // dialog with the reason instead of relaying a request the proxy 404s.
+      // ZIP (and any browser-free format) still goes through.
+      if (cfg.exportLane === 'none' && payload?.format !== 'zip') {
+        reply({
+          ok: false,
+          error:
+            'This format needs the render service, which this workspace doesn’t have configured. ZIP still works here; for rendered formats use the desktop app or ask your admin to add maude-render.',
+        });
+        return;
+      }
       try {
         // feature-background-export-notification-center — enqueue and reply
         // with the job id immediately; the notification center (which
@@ -14462,6 +14626,7 @@ function App() {
           canvasKinds={cfg?.canvasKinds}
           syncStatus={syncStatus}
           onLinkedHub={setCloudLinkedHub}
+          savingIsManaged={savingIsManaged}
         />
       );
     if (id === 'changes')
@@ -14498,7 +14663,16 @@ function App() {
           onDiscard={gitDiscard}
           onPublish={gitPublish}
           onGetLatest={gitGetLatest}
-          loadLog={gitLoadLog}
+          // WHICH HISTORY, decided at the ONE place the posture is named — not
+          // inside the panel, which would be a second derivation of the rule
+          // `cloud-managed-save-surfaces.test.ts` exists to keep singular.
+          loadLog={cloudManaged ? gitLoadCloudLog : gitLoadLog}
+          historySource={cloudManaged ? 'cloud' : 'local'}
+          // What the cloud half of the header names. The cell reports its own
+          // project and branch with the log; the hub host is the fallback,
+          // because a header that names the LOCAL folder while listing the
+          // CLOUD's commits is the confusion this feature exists to end.
+          cloudHistory={cloudHistory}
           onOpenCanvas={(p) => openTab(p)}
           onOpenDiff={(file) => setDiffTarget({ file, beforeSha: 'HEAD', conflict: false })}
           activeCanvas={activeCanvasFile}
@@ -14606,6 +14780,10 @@ function App() {
       <CloudRoleBanner cloud={cfg.cloud} />
       <UpdateBanner update={updateReady} onDismiss={() => setUpdateReady(null)} />
       <SyncBanner status={syncStatus} />
+      {/* First-upgrade consent (Task 2) — global on purpose: a consent that
+          only appears if you happen to open the Sync panel is not consent.
+          Skipped during first-run onboarding so two flows don't stack. */}
+      {!firstRun && <SyncConsentDialog status={syncStatus} cloud={cfg.cloud} />}
       {!usageNudge && !tourSteps && <WhatsNewToast wn={whatsNew} />}
       {!usageNudge && !tourSteps && <ExportToast center={exportCenter} />}
       {gitLifecycle && (
@@ -15652,6 +15830,7 @@ function App() {
           // scope=artboard fell back to `:first-of-type` (always the first).
           activeArtboardId={selected?.artboardId ?? canvasActiveArtboard ?? null}
           selection={selected?.selector ? { selector: selected.selector, file: selected.file } : null}
+          exportLane={cfg.exportLane || 'local'}
           onClose={() => setExportDialog(null)}
         />
       )}