@1agh/maude 1.0.7 → 1.0.9

package/apps/studio/bin/_video-playwright.mjs

@@ -25,7 +25,7 @@
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
-import { assertRenderOutputSizeOk, launchChromium } from './_pw-launch.mjs';
+import { addScriptCspSafe, assertRenderOutputSizeOk, launchChromium } from './_pw-launch.mjs';
 
 const args = Object.fromEntries(
   process.argv.slice(2).reduce((acc, cur, i, all) => {
@@ -63,6 +63,24 @@ if (!url) {
 
 const timeoutMs = Number(timeout) * 1000;
 const deviceScaleFactor = Math.max(1, Math.min(4, Number(scale) || 1));
+
+// Hard self-kill — the whole shim, not just individual Playwright calls, has a
+// wall-clock ceiling. `launchChromium` has NO timeout, and on headless Linux
+// `--enable-gpu` can hang Chromium at GPU-process init before a single log line
+// — a silent wedge that ate the full 600s render budget with nothing to show.
+// This guarantees the process EXITS with a diagnostic instead of hanging, so
+// the render worker (and the export gate) fail fast and legibly. Generous
+// enough for a slow software encode; well under any job/test budget.
+const HARD_KILL_MS = Math.max(timeoutMs, 150_000);
+const hardKill = setTimeout(() => {
+  console.error(
+    `_video-playwright: HARD TIMEOUT after ${HARD_KILL_MS}ms — exiting. The render did not ` +
+      `complete (see the last stage logged above; on headless Linux this is usually the video ` +
+      `encoder or GPU init). gpu=${process.env.MAUDE_CAPTURE_GPU === '1' ? 'on' : 'off'}.`
+  );
+  process.exit(7);
+}, HARD_KILL_MS);
+hardKill.unref?.();
 // `--audio` is presence-checked (Object.fromEntries maps a bare flag to '1'), so
 // absence of the flag entirely (not passed) still defaults to audio ON — video.ts
 // always passes an explicit '0'/'1'.
@@ -74,6 +92,35 @@ const frameFormat = frameFormatArg === 'jpeg' ? 'jpeg' : 'png';
 /** Wait a real turn of the event loop + a frame so a seek settles before shot. */
 const SETTLE_MS = 16;
 
+/**
+ * Run a `page.evaluate` with a hard wall-clock cap. A `page.evaluate` awaits its
+ * in-page promise with NO Playwright timeout, so a WebCodecs encoder that never
+ * resolves (headless Linux without a working encoder) hangs the whole render
+ * indefinitely. This races the evaluate against a timer and throws a NAMED
+ * error on overrun, so the shim exits (fail-fast + diagnostic) instead of
+ * wedging the render worker until the job timeout.
+ */
+async function evalWithTimeout(page, fn, arg, ms, stage) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(
+      () =>
+        reject(
+          new Error(
+            `encode stage "${stage}" did not resolve within ${ms}ms — headless WebCodecs ` +
+              `likely has no working video encoder (see the "webcodecs caps" line above).`
+          )
+        ),
+      ms
+    );
+  });
+  try {
+    return await Promise.race([page.evaluate(fn, arg), timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // GPU opt-in, measured not assumed (2026-08-09, M-series mac, 1920x1080):
 //
 //   config                        h264 prefer-hardware   png        jpeg q90
@@ -93,15 +140,58 @@ const SETTLE_MS = 16;
 // something to smuggle in behind a perf flag. Opt in with MAUDE_CAPTURE_GPU=1.
 const gpuArgs =
   process.env.MAUDE_CAPTURE_GPU === '1' ? ['--enable-gpu', '--ignore-gpu-blocklist'] : [];
+console.error(
+  `_video-playwright: launching chromium (gpu=${gpuArgs.length ? 'on' : 'off'}, format=${format})`
+);
 const browser = await launchChromium(gpuArgs.length ? { args: gpuArgs } : undefined);
+console.error('_video-playwright: browser launched');
 try {
   const ctx = await browser.newContext({
+    serviceWorkers: 'block',
     viewport: { width: 1440, height: 900 },
     deviceScaleFactor,
   });
   const page = await ctx.newPage();
   await page.goto(url, { waitUntil: 'load', timeout: timeoutMs });
   await page.evaluate(() => document.fonts.ready);
+  console.error('_video-playwright: page loaded');
+
+  // UNCONDITIONAL WebCodecs capability probe — logged for every video render
+  // regardless of which encode path runs, so the render worker's log always
+  // names what this headless box can actually encode. This is THE fact that
+  // differs between a mac dev machine and headless Linux/the cloud worker, and
+  // the answer decides whether video needs a different encoder entirely. Bounded
+  // so a hung isConfigSupported (seen on some headless builds) can't wedge here.
+  try {
+    const caps = await evalWithTimeout(
+      page,
+      async () => {
+        const probe = async (codec) => {
+          try {
+            if (typeof VideoEncoder?.isConfigSupported !== 'function') return 'no-webcodecs';
+            const r = await VideoEncoder.isConfigSupported({ codec, width: 320, height: 180 });
+            return r?.supported ? 'yes' : 'no';
+          } catch (e) {
+            return `err:${e?.name || 'x'}`;
+          }
+        };
+        return {
+          avc: await probe('avc1.42001f'),
+          vp9: await probe('vp09.00.10.08'),
+          vp8: await probe('vp8'),
+          av1: await probe('av01.0.04M.08'),
+        };
+      },
+      undefined,
+      15_000,
+      'isConfigSupported probe'
+    );
+    console.error(
+      `_video-playwright: webcodecs caps avc=${caps.avc} vp9=${caps.vp9} vp8=${caps.vp8} av1=${caps.av1}`
+    );
+  } catch (e) {
+    console.error(`_video-playwright: cap probe failed: ${e instanceof Error ? e.message : e}`);
+  }
 
   // Resolve the target artboard handle. Priority: explicit --selector (from the
   // export scope Target) → --artboard id → first artboard. `--widen` climbs to
@@ -147,7 +237,18 @@ try {
   // no renderMediaOnWeb container support (and no audio need); an artboard with
   // no registered comp (ordinary/CSS) has nothing for renderMediaOnWeb to render
   // — both fall through to the frame-step path below.
-  const useRenderer = !!renderLib && format !== 'gif' && !!compId;
+  //
+  // MAUDE_RENDER_SKIP_WHOLE_COMP=1 forces the frame-step path even for a
+  // registered comp. @remotion/web-renderer's renderMediaOnWeb never RESOLVES on
+  // the headless Linux render worker (measured on the cloud fleet AND CI — even
+  // a 12-frame comp and even muted; WebCodecs itself works, per the caps probe,
+  // so it is something in web-renderer's whole-comp pipeline that wedges). On
+  // that host it only ever burned the renderMediaOnWeb timeout and then fell to
+  // frame-step anyway — so the worker skips it and goes straight to the path
+  // that WORKS, reclaiming those minutes for the actual (muted) render. The
+  // desktop, where renderMediaOnWeb works and carries audio, leaves it on.
+  const skipWholeComp = process.env.MAUDE_RENDER_SKIP_WHOLE_COMP === '1';
+  const useRenderer = !skipWholeComp && !!renderLib && format !== 'gif' && !!compId;
 
   // When the whole-comp renderer path throws we DON'T fail the export. The most
   // common cause is a `RangeError: Maximum call stack size exceeded` from
@@ -166,7 +267,7 @@ try {
     try {
       const t0 = Date.now();
       const libSrc = readFileSync(renderLib, 'utf8');
-      await page.addScriptTag({ content: libSrc, type: 'module' });
+      await addScriptCspSafe(page, { content: libSrc, type: 'module', name: 'render-lib' });
       await page.waitForFunction(() => typeof window.__maudeRenderVideo__ === 'function', {
         timeout: timeoutMs,
       });
@@ -175,7 +276,14 @@ try {
       const frameRange =
         Number.isFinite(explicitFrames) && explicitFrames > 0 ? [0, explicitFrames - 1] : null;
 
-      const rendered = await page.evaluate(
+      // Bound the whole-comp render: @remotion/web-renderer drives WebCodecs,
+      // which on headless Linux without a working encoder never resolves — a
+      // hang, not a throw, so the graceful frame-step fallback below never
+      // fires. A wall-clock cap turns that hang INTO a throw, which the catch
+      // converts into exactly that fallback (frame-step, muted) — the video
+      // still exports instead of wedging the render worker.
+      const rendered = await evalWithTimeout(
+        page,
         async ({ compId, container, scale, muted, frameRange, licenseKey }) => {
           return window.__maude_render_video__(compId, {
             container,
@@ -192,7 +300,9 @@ try {
           muted: !wantAudio,
           frameRange,
           licenseKey,
-        }
+        },
+        Math.min(timeoutMs, 90_000),
+        `renderMediaOnWeb(${format})`
       );
 
       writeFileSync(out, Buffer.from(rendered.b64, 'base64'));
@@ -421,9 +531,14 @@ async function frameStepCapture({
   const isGif = format === 'gif';
   if (encoding) {
     const libSrc = readFileSync(encodeLib, 'utf8');
-    await page.addScriptTag({ content: libSrc, type: 'module' });
+    await addScriptCspSafe(page, { content: libSrc, type: 'module', name: 'encode-lib' });
     await page.waitForFunction(() => typeof window.__maudeEnc === 'object', { timeout: timeoutMs });
-    const started = await page.evaluate(
+    // Bound the encoder start: on headless Linux without a working WebCodecs
+    // encoder this promise never resolves, so a wall-clock cap converts the hang
+    // into a fast, diagnostic failure instead of consuming the whole render
+    // budget in silence.
+    const started = await evalWithTimeout(
+      page,
       async ({ width, height, fps, isGif, gifColors, fmt }) => {
         if (isGif) {
           window.__maudeEnc.startGif({ width, height, fps, maxColors: gifColors });
@@ -438,7 +553,9 @@ async function frameStepCapture({
         isGif,
         gifColors: Number(args.gifColors) || 256,
         fmt: format,
-      }
+      },
+      Math.min(timeoutMs, 45_000),
+      `startVideo(${format})`
     );
     console.error(`encoder: ${started.container} / ${started.codec} @ ${outW}×${outH}`);
   }
@@ -470,12 +587,15 @@ async function frameStepCapture({
     if (encoding) {
       const tEnc = Date.now();
       const b64 = shot.toString('base64');
-      await page.evaluate(
+      await evalWithTimeout(
+        page,
         async ({ b64, isGif, format }) => {
           if (isGif) return window.__maudeEnc.addGifFrame(b64);
           return window.__maudeEnc.addVideoFrame(b64, format);
         },
-        { b64, isGif, format: shotFormat }
+        { b64, isGif, format: shotFormat },
+        30_000,
+        `addFrame#${f}`
       );
       // NB: this stage is the double CDP crossing — the screenshot bytes go out
       // to node as base64 and straight back into the same page, to an encoder
@@ -512,10 +632,13 @@ async function frameStepCapture({
     result = { ...result, degraded: true, audioDropped: true, fallbackReason };
   }
   if (encoding) {
-    const enc = await page.evaluate(
+    const enc = await evalWithTimeout(
+      page,
       async ({ isGif }) =>
         isGif ? window.__maudeEnc.finishGif() : window.__maudeEnc.finishVideo(),
-      { isGif }
+      { isGif },
+      Math.min(timeoutMs, 45_000),
+      `finish(${format})`
     );
     writeFileSync(out, Buffer.from(enc.b64, 'base64'));
     result = { ...result, out, bytes: enc.bytes, container: enc.container, codec: enc.codec };

package/apps/studio/canvas-edit.ts

@@ -4180,6 +4180,39 @@ export function readArtboardPrintProp(
   return objectExpressionToPlain(resolved);
 }
 
+/**
+ * Every print artboard's `print` prop in a canvas, keyed by artboard id.
+ *
+ * The per-id reader above is what the PDF adapter uses when it has the checkout
+ * on disk. A render worker (DDR-230) does NOT — it holds no tenant files by
+ * design — so the cell resolves these up front and ships them inside the job
+ * (`options.printProps`, exporters/jobs.ts). Until it did, a cloud print PDF
+ * silently came back with no BleedBox/TrimBox and no marks: the adapter's
+ * `readFileSync` failed against the worker's empty scratch root and the
+ * fall-through was "not a print artboard" (DDR-232 follow-up, found by the
+ * worker-lane export E2E).
+ */
+export function readAllArtboardPrintProps(
+  canvasAbsPath: string,
+  source: string
+): Record<string, Record<string, unknown>> {
+  const out: Record<string, Record<string, unknown>> = {};
+  const parsed = parseSync(canvasAbsPath, source, { sourceType: 'module' });
+  if (parsed.errors && parsed.errors.length > 0) return out;
+  for (const ab of collectJsxByTag(parsed.program, 'DCArtboard')) {
+    const id = getStringAttr(ab.openingElement, 'id');
+    if (!id || getStringAttr(ab.openingElement, 'kind') !== 'print') continue;
+    const attr = findAttribute(ab.openingElement, 'print');
+    if (attr?.value?.type !== 'JSXExpressionContainer') continue;
+    const expr = attr.value.expression as AnyNode | undefined;
+    if (!expr) continue;
+    const resolved = resolveValueNode(parsed.program, expr);
+    if (resolved?.type !== 'ObjectExpression') continue;
+    out[id] = objectExpressionToPlain(resolved);
+  }
+  return out;
+}
+
 /**
  * Delete the `<DCArtboard id="…">` whose `id` prop equals `artboardId` — the
  * artboard counterpart of applyDeleteElement (an artboard is addressed by its id

package/apps/studio/canvas-lib.tsx

@@ -124,6 +124,7 @@ import {
   diffLayoutPositions,
 } from './commands/move-artboards-command.ts';
 import { scopedCdSelector, selectorIndex, shortText } from './dom-selection.ts';
+import { applyCaptureChrome } from './exporters/capture-chrome.ts';
 import {
   type DomToSvgApi,
   pinArtboard,
@@ -1860,6 +1861,11 @@ function useExportCaptureBridge() {
         : null;
       void (async () => {
         const savedWorld = resetWorldPlane();
+        // Hold the chrome suppression across the WHOLE batch. `svgForElement`
+        // applies it per target too (ref-counted), but a 10-artboard deck would
+        // otherwise add and remove the style ten times — ten forced reflows,
+        // and the member watching the canvas sees the chrome flicker.
+        const releaseChrome = applyCaptureChrome(document);
         try {
           const all = Array.from(document.querySelectorAll('[data-dc-screen]'));
           const targets = wanted?.length
@@ -1905,6 +1911,7 @@ function useExportCaptureBridge() {
             message: err instanceof Error ? err.message : String(err),
           });
         } finally {
+          releaseChrome();
           restoreWorldPlane(savedWorld);
           busy = false;
         }

package/apps/studio/client/app.jsx

@@ -12,6 +12,11 @@ import { createRoot } from 'react-dom/client';
 // import that Bun erases), so this pulls only string constants into the client
 // bundle — no React, no input-router. See the tool-cursor handler below.
 import { resolveToolCursor } from '../canvas-cursors.ts';
+import {
+  defaultScopeForFormat,
+  isScopeValidForFormat,
+  validScopesForFormat,
+} from '../exporters/format-scopes.ts';
 // feature-3-web-artboards T5 — the single source (grid-track-handles.ts) for
 // the Inspector's Grid-section track parser/serializer, shared with the
 // on-canvas gutter-drag overlay so both edit the SAME track-list shape.
@@ -35,6 +40,7 @@ import {
   captureDeckViaBrowser,
   captureScale,
   sanitizeCapturedItems,
+  recordBrowserExport,
 } from './export-lane.js';
 import { TreeRowMenu, useRowMenu } from './tree-row-menu.jsx';
 import { useTreeDrag } from './use-tree-drag.js';
@@ -1175,18 +1181,6 @@ const EXPORT_SCOPE_LABELS = {
   'canvas-as-separate': 'Canvas · artboards separate',
   'project-raw': 'Whole project (raw)',
 };
-const EXPORT_VALID_SCOPES = {
-  png: ['selection', 'artboard', 'canvas-as-separate'],
-  pdf: ['selection', 'artboard', 'canvas-as-separate'],
-  svg: ['selection', 'artboard', 'canvas-as-separate'],
-  html: ['artboard', 'canvas-as-separate'],
-  pptx: ['canvas-as-separate'],
-  mp4: ['artboard'],
-  gif: ['artboard'],
-  webm: ['artboard'],
-  canva: ['canvas-as-separate'],
-  zip: ['project-raw'],
-};
 const PNG_SCALES = [
   { value: 1, label: '1× (native)' },
   { value: 2, label: '2× (retina)' },
@@ -1583,8 +1577,17 @@ function ExportDialog({
     [exportLane]
   );
   const [sel, setSel] = useState(mode === 'handoff' ? 'shadcn' : 'png');
-  const [scope, setScope] = useState(
-    initialScope && EXPORT_SCOPE_LABELS[initialScope] ? initialScope : 'artboard'
+  // DDR-231 Phase 2 T4 — seed from the shared table, and only honour an
+  // incoming hint the CHOSEN FORMAT can actually render. A hint the format
+  // can't take (a context menu's `project-raw`, a re-run of a zip history
+  // entry) used to survive into the request and reach the render service as
+  // an unrenderable file-tree target: "invalid render job".
+  // The dialog opens on the PNG card; the format-change effect below re-seeds
+  // the scope whenever the member picks another one.
+  const [scope, setScope] = useState(() =>
+    initialScope && isScopeValidForFormat('png', initialScope)
+      ? initialScope
+      : defaultScopeForFormat('png')
   );
   const [scale, setScale] = useState(2);
   // feature-2-print-artboards T4/T6 — PNG resolution (folds scale + dpi, see
@@ -1608,7 +1611,7 @@ function ExportDialog({
   const [status, setStatus] = useState(null); // { ok, msg }
   const [recent, setRecent] = useState([]);
   const card = EXPORT_CARDS.find((c) => c.id === sel) || EXPORT_CARDS[0];
-  const validScopes = card.handoff ? [] : EXPORT_VALID_SCOPES[card.format] || ['artboard'];
+  const validScopes = card.handoff ? [] : validScopesForFormat(card.format);
   // Long-comp tiers (feature-enhanced-video-editing Task 1). 900 frames is the
   // safe tier (the frame-step fallback runs ~2.5 s/frame and 1080p captures
   // have died from memory pressure above it); 3600 is the server's default cap
@@ -1629,10 +1632,13 @@ function ExportDialog({
   const exportOverCap = card.temporal && exportCompFrames > EXPORT_DEFAULT_CAP;
 
   // Keep the scope valid for the chosen format (pptx/zip etc. only allow a
-  // subset) — mirrors VALID_SCOPES_PER_FORMAT in the in-canvas dialog.
+  // subset). Both dialogs and the server now read one table
+  // (exporters/format-scopes.ts) — see DDR-231 Phase 2 T4.
   useEffect(() => {
-    if (validScopes.length && !validScopes.includes(scope)) setScope(validScopes[0]);
-  }, [validScopes, scope]);
+    if (validScopes.length && !validScopes.includes(scope)) {
+      setScope(defaultScopeForFormat(card.format));
+    }
+  }, [validScopes, scope, card.format]);
 
   // DDR-231 T7 — wake the render service the moment the dialog opens on a
   // remote-lane workspace: the multi-GB Chromium container starts booting
@@ -1715,17 +1721,31 @@ function ExportDialog({
     // the in-canvas dialog's captureScopeHints.
     if (activeArtboardId) options.artboardId = activeArtboardId;
     if (selection?.selector) options.selection = selection;
+    // Which canvas FILE this dialog is exporting — the server's `_active.json`
+    // lags a tab switch, and a job resolved against the stale file renders the
+    // wrong canvas (with this dialog's artboardId, which then never matches).
+    if (activePath && activePath !== SYSTEM_TAB) options.canvasFile = activePath;
     // DDR-231 — the browser lane: in a workspace, png/svg of the active
     // artboard is captured by the member's OWN browser (the canvas already
     // renders here) — instant, no fleet wake. Everything else continues to
     // the jobs lane below.
+    // NOTE the format gate. `browserCaptureEligible` answers for the whole
+    // browser lane, pptx included — but this branch is the SINGLE-ARTBOARD
+    // capture that downloads what the bridge returns verbatim. Without the
+    // gate, a pptx export fell in here, asked the bridge for a "pptx" (which it
+    // renders as PNG), and died in `sanitizeCapturedItems` on "not a valid
+    // pptx" — silently degrading to the worker lane, which is why the deck
+    // arrived minutes later with none of the browser lane's fixes in it. The
+    // dedicated deck branch below was unreachable. Found by the T7 export E2E.
     const browserEligible =
+      BROWSER_CAPTURE_FORMATS.has(card.format) &&
       browserCaptureEligible({
         exportLane,
         format: card.format,
         scope,
         artboardId: options.artboardId,
-      }) && typeof onBrowserCapture === 'function';
+      }) &&
+      typeof onBrowserCapture === 'function';
     if (browserEligible) {
       try {
         const capScale = captureScale(options);
@@ -1742,8 +1762,18 @@ function ExportDialog({
         // caps count/bytes, sniffs magic, forces name+MIME.
         const safeItems = await sanitizeCapturedItems(items, card.format);
         for (const it of safeItems) downloadCapturedBlob(it.name, it.blob);
+        // DDR-231 Phase 2 T6 — the export is DONE and the member should see
+        // that, in the dialog and in the ledger. Phase 1 closed the modal the
+        // instant the download was handed off, so a browser-lane export left
+        // no trace anywhere ("v exports dialog nic nevidim").
+        for (const it of safeItems) {
+          await recordBrowserExport({ format: card.format, scope, filename: it.name });
+        }
         setBusy(false);
-        onClose();
+        setStatus({
+          ok: true,
+          msg: `Saved ${safeItems.map((it) => it.name).join(', ')} to your downloads.`,
+        });
         return;
       } catch (err) {
         if (exportLane !== 'remote') {
@@ -1773,10 +1803,17 @@ function ExportDialog({
           name: deckName,
           onProgress: (current, total) =>
             setStatus({ ok: true, msg: `Capturing ${current}/${total}…` }),
+          // Composition happens in-cell AFTER the last capture, and it is not
+          // instant for a 10-slide deck. Without this the status sat on
+          // "Capturing 10/10…" through the whole assemble step and the deck
+          // then appeared out of nowhere — the reported "modal closes, nothing
+          // happens, and after a while it downloads by itself".
+          onAssemble: () => setStatus({ ok: true, msg: 'Assembling deck…' }),
         });
         downloadCapturedBlob(filename, blob);
+        await recordBrowserExport({ format: card.format, scope, filename });
         setBusy(false);
-        onClose();
+        setStatus({ ok: true, msg: `Saved ${filename} to your downloads.` });
         return;
       } catch (err) {
         if (exportLane !== 'remote') {
@@ -1844,6 +1881,10 @@ function ExportDialog({
               <button
                 type="button"
                 key={c.id}
+                // Stable hooks for the export E2E harnesses (agent-browser web
+                // + desktop-e2e native) — data-testid convention, DDR-231
+                // Phase 2 T7/T8.
+                data-testid={`export-format-${c.id}`}
                 className={'st-fmt' + (c.id === sel ? ' is-on' : '')}
                 disabled={laneBlocked(c)}
                 title={
@@ -1878,6 +1919,7 @@ function ExportDialog({
               </label>
               <select
                 id="st-export-scope"
+                data-testid="export-scope"
                 className="st-select"
                 value={scope}
                 onChange={(e) => setScope(e.target.value)}
@@ -2060,12 +2102,14 @@ function ExportDialog({
             <div
               className={'callout ' + (status.ok ? 'callout--success' : 'callout--error')}
               style={{ fontSize: 12 }}
+              data-testid="export-status"
+              data-ok={status.ok ? '1' : '0'}
             >
               {status.msg}
             </div>
           )}
           {recent.length > 0 && (
-            <div className="st-export-recent">
+            <div className="st-export-recent" data-testid="export-recent">
               <div className="st-rp-hd">Recent</div>
               {recent.map((h, i) => (
                 <div className="st-export-recent-row" key={i}>
@@ -2083,7 +2127,13 @@ function ExportDialog({
           <button type="button" className="btn btn--ghost" onClick={onClose}>
             Cancel
           </button>
-          <button type="button" className="btn btn--primary" disabled={busy} onClick={doExport}>
+          <button
+            type="button"
+            className="btn btn--primary"
+            data-testid="export-submit"
+            disabled={busy}
+            onClick={doExport}
+          >
             <StIcon name="download" size={14} />
             {card.handoff
               ? 'Copy handoff command'
@@ -13183,6 +13233,17 @@ function App() {
     // Reply target for the export bridge: the canvas iframe's own origin.
     const replyOrigin = cfg?.canvasOrigin || window.location.origin;
     async function runBridgedExport(source, id, payload) {
+      // The in-canvas dialog exports the canvas it LIVES IN — which the M1
+      // gate above just proved is `activePath`. Stamp it so scope resolution
+      // never falls back to the server's (asynchronously written, possibly
+      // stale) `_active.json` — same rule as the shell dialog's canvasFile.
+      // OVERWRITE, not fill-if-absent: the M1 gate above proved the sender IS
+      // the active canvas iframe (untrusted, DDR-054), so a canvasFile IT
+      // supplied must not survive — the bridged export renders the canvas it
+      // lives in, full stop (security review W2).
+      if (payload?.options && activePath && activePath !== SYSTEM_TAB) {
+        payload.options.canvasFile = activePath;
+      }
       const reply = (msg) => {
         try {
           if (source) source.postMessage({ dgn: 'export-result', id, ...msg }, replyOrigin);

package/apps/studio/client/export-lane.js

@@ -42,10 +42,17 @@ export function browserCaptureEligible({ exportLane, format, scope, artboardId }
  * 3× mirrors the desktop PNG-deck fallback's FALLBACK_SCALE (crisp in
  * non-vector viewers).
  *
- * @param {{ capture: Function, name?: string, scale?: number, onProgress?: Function }} args
+ * @param {{ capture: Function, name?: string, scale?: number, onProgress?: Function,
+ *           onAssemble?: Function }} args
  * @returns {Promise<{ filename: string, blob: Blob }>}
  */
-export async function captureDeckViaBrowser({ capture, name = 'export', scale = 3, onProgress }) {
+export async function captureDeckViaBrowser({
+  capture,
+  name = 'export',
+  scale = 3,
+  onProgress,
+  onAssemble,
+}) {
   const items = await capture({
     format: 'png',
     artboardIds: null,
@@ -59,6 +66,9 @@ export async function captureDeckViaBrowser({ capture, name = 'export', scale =
   fd.set('scale', String(scale));
   fd.set('name', name);
   for (const it of items) fd.append('image', it.blob, it.name);
+  // Composition is a distinct, non-instant phase — tell the caller so the
+  // status stops claiming the capture is still running.
+  onAssemble?.();
   const r = await fetch('/_api/export-assemble', { method: 'POST', body: fd });
   if (!r.ok) throw new Error((await r.text()) || `deck assembly failed (${r.status})`);
   const disp = r.headers.get('content-disposition') || '';
@@ -154,3 +164,28 @@ export async function sanitizeCapturedItems(items, format) {
 export function captureScale(options = {}) {
   return Math.max(1, Math.min(8, options.dpi ? options.dpi / 96 : options.scale || 1));
 }
+
+/**
+ * Record a browser-lane export in the cell's ledger so it shows up in the
+ * Recent tab and the notification center like every other export.
+ *
+ * DDR-231 Phase 2 T6: the browser lane produces the file in the member's own
+ * browser, so there is no job to complete and nothing wrote a history row —
+ * the reported symptom was "the modal just closes and I see nothing in the
+ * export dialog". Best-effort by design: the member already HAS the file, so a
+ * failed ledger write must never surface as a failed export.
+ *
+ * @param {{ format: string, scope: string, filename: string }} entry
+ * @returns {Promise<void>}
+ */
+export async function recordBrowserExport(entry) {
+  try {
+    await fetch('/_api/export-history', {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify(entry),
+    });
+  } catch {
+    /* the file is already saved — the ledger is a convenience, not the export */
+  }
+}