@1agh/maude 1.2.0 → 1.3.1

package/apps/studio/whats-new.json

@@ -1,6 +1,143 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "live-canvases-long-sessions",
+      "version": "1.3.1",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "Canvases stay live in long sessions",
+      "summary": "A canvas open in your browser on a Maude Cloud project kept working for about 15 minutes and then quietly stopped showing teammates’ changes until you reloaded the page — it now stays live however long you work. And editing a design system’s tokens.css restyles every open canvas that uses it, straight away.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "team-access-and-presence",
+      "version": "1.3.1",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "Lost access? Maude asks you to sign in again",
+      "summary": "If an owner removes your access or your sign-in expires, the Sync panel now tells you to sign in again — instead of \"check your connection\" — and keeps your changes on this computer until you do. Signing in again sends them. And when a teammate closes a canvas, their avatar and cursor now leave everyone else’s screen straight away.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "comment-tool-and-live-tree",
+      "version": "1.3.1",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "The Comment tool works from the toolbar; new images and folders show up for everyone at once",
+      "summary": "Picking Comment in the canvas toolbar now lets you click an element to comment — before, only the C key did. An image saved next to your canvases appears in the file tree straight away, on your machine and your teammates’. A folder you create or move outside Maude, or move in the tree, reaches the team in seconds instead of on the next launch.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "inspector-keeps-number-types",
+      "version": "1.3.1",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "Editing a number in the inspector keeps it a number",
+      "summary": "Changing a value like an artboard height or a video’s length used to turn it into text in the canvas source — some components then misread it. Numbers and on/off values now stay what they were, and leaving a value unchanged no longer rewrites the file.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "artboard-rename-and-files",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "feature",
+      "title": "Rename artboards on the canvas; manage notes and images in the tree",
+      "summary": "Double-click an artboard’s name to rename it — everyone on the project sees the new name. Notes, styles, images and videos beside your canvases now have their own ⋯ menu: Rename…, Move to… and Delete. A file a canvas still uses is not moved or deleted from under it; Maude names the canvas that uses it instead.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "cloud-connect-starts-syncing",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "Connecting a project to Maude Cloud starts syncing right away again",
+      "summary": "Connect used to link the project and then ask you to restart Maude before anything synced. It syncs immediately now, a project that is not linked no longer greets you with a stale “Working offline” note, and a large video upload survives a dropped connection instead of failing.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "file-tree-rename-duplicate",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "feature",
+      "title": "Rename and duplicate canvases and folders from the file tree",
+      "summary": "The ⋯ menu on a canvas now offers Rename… and Duplicate, and folders can be renamed in place. Teammates see the new name immediately — a canvas they have open follows the rename. Menus near the bottom of a long tree now open upward instead of off-screen, and after ⌘D the copy is what stays selected.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "open-team-project-no-folder",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "feature",
+      "title": "Open your team’s project in one step",
+      "summary": "Invited to a project? Choose “Open a project you were invited to”, sign in to Maude Cloud or your team’s server with your email, pick the project and start designing — no folder to choose, no token, no Git. Maude keeps the project’s copy for you and lists it under “Open a team project…”.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "reliable-project-saving",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "feature",
+      "title": "Every change saved, shared and undoable",
+      "summary": "In projects that save through accepted revisions, the status says “Saving…” until your team’s project has your change, History lists each action with its author, Undo takes back only your own action, two people changing the same thing end with the later change instead of a conflict, an unfinished AI edit waits for your decision, and large videos upload and download resumably.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "share-link-deeplink",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "feature",
+      "title": "Share a link to any canvas",
+      "summary": "Copy a link that opens a canvas or file in the browser or Maude. After signing in, return to the shared file; links to another local project ask before switching.",
+      "learnMore": "https://maude.sh/docs/share-links",
+      "surface": "design-ui",
+      "tour": [
+        {
+          "target": "[data-testid=\"share-btn\"]",
+          "title": "Share this file",
+          "body": "Copy a web link, an app link, or a link for this Mac. You can also share another file from its row menu.",
+          "placement": "bottom",
+          "canvas": true
+        }
+      ]
+    },
+    {
+      "id": "native-codex-shared-workflows",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "feature",
+      "title": "Use Maude workflows in Codex",
+      "summary": "Install Maude’s design and flow plugins natively in Codex and use the shared workflows alongside Claude Code. The new guide covers setup, dependencies and the browser requirements for working with Design Studio.",
+      "learnMore": "https://maude.sh/docs/codex",
+      "surface": "design-ui"
+    },
+    {
+      "id": "shared-toast-stack-export-errors",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "improvement",
+      "title": "Notifications stack and clear themselves",
+      "summary": "Export updates, canvas messages and Undo now share a stack that expands when you hover or use the keyboard. Notifications dismiss automatically; long export errors stay short, with the complete message available on demand in export history.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "source-sync-preserves-valid-canvases",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "Safer canvas source syncing",
+      "summary": "Sync now holds incoming canvas code with syntax errors or duplicate declarations and warns you in the Sync panel. Concurrent edits preserve more unchanged code, and recovery copies help you recover local work when a conflicting update is held.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "sticky-notes-take-a-second-line",
+      "version": "1.3.0",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "Sticky notes take a second line",
+      "summary": "Shift+Enter in a sticky note could look like it did nothing. A note never grew, and its text is clipped at the card's edge, so on a full note the new line was inserted and then hidden — notes now grow as you type and keep that height. Opening a note from the keyboard selects all of its text so you can retype it, and Shift+Enter used to replace the lot; it now adds a line instead, while typing still replaces. And on a project synced to a workspace, what you have typed into an open note is no longer overwritten mid-keystroke when a collaborator edits the same note.",
+      "surface": "design-ui"
+    },
     {
       "id": "pdf-export-print-safe-text",
       "version": "1.2.0",

package/cli/lib/harness/codex-runtime.mjs

@@ -384,7 +384,7 @@ async function materializeRuntimeMarketplace({
   return root;
 }
 
-async function materializePluginSource(item, target, ownedRoot) {
+export async function materializePluginSource(item, target, ownedRoot) {
   await removeOwnedPath(target, ownedRoot);
   await assertTreeHasNoSymlinks(item.value.installPath);
   await cp(item.value.installPath, target, { recursive: true });
@@ -395,6 +395,9 @@ async function materializePluginSource(item, target, ownedRoot) {
       `plugin changed while materializing: ${item.name} (${item.sourceHash} != ${copiedHash})`
     );
   }
+  // A source-owned native package already supplies its entry points and paths.
+  // Flattening Claude commands over it would break relative reference links.
+  if (await pathExists(join(target, '.codex-plugin', 'plugin.json'))) return;
   const commands = await snapshotCommandFiles(target);
   const generatedRoot = join(target, 'skills');
   await mkdir(generatedRoot, { recursive: true });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "1.2.0",
+  "version": "1.3.1",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -52,16 +52,17 @@
     "test:e2e:desktop:acp-cold-start": "pnpm --filter @maude/desktop-e2e e2e:acp-cold-start",
     "test:e2e:desktop:parity": "pnpm --filter @maude/desktop-e2e e2e:parity",
     "test:e2e:desktop:sidecar-respawn": "pnpm --filter @maude/desktop-e2e e2e:sidecar-respawn",
+    "test:e2e:desktop:team-project": "pnpm --filter @maude/desktop-e2e e2e:team-project",
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "1.2.0",
-    "@1agh/maude-darwin-x64": "1.2.0",
-    "@1agh/maude-linux-arm64": "1.2.0",
-    "@1agh/maude-linux-arm64-musl": "1.2.0",
-    "@1agh/maude-linux-x64": "1.2.0",
-    "@1agh/maude-linux-x64-musl": "1.2.0",
-    "@1agh/maude-win32-x64": "1.2.0"
+    "@1agh/maude-darwin-arm64": "1.3.1",
+    "@1agh/maude-darwin-x64": "1.3.1",
+    "@1agh/maude-linux-arm64": "1.3.1",
+    "@1agh/maude-linux-arm64-musl": "1.3.1",
+    "@1agh/maude-linux-x64": "1.3.1",
+    "@1agh/maude-linux-x64-musl": "1.3.1",
+    "@1agh/maude-win32-x64": "1.3.1"
   },
   "files": [
     "cli",

package/plugins/design/dependencies.json

@@ -152,11 +152,11 @@
       "hardness": "soft",
       "check": {
         "command": "kg version",
-        "expectExit": 0
+        "expectExit": 0,
+        "minVersion": "1.5.1"
       },
       "install": {
-        "preferred": "See docs/kgai-onboarding.md — download the pinned kgai release binary (kgai is capability-gated + opt-out; nothing to install to use classic .ai/ mode)",
-        "darwin": "curl -fsSL https://github.com/kgaidev/kgai/releases/download/v1.0.0/kg-darwin-arm64 -o /usr/local/bin/kg && chmod +x /usr/local/bin/kg"
+        "preferred": "Install kgai >= 1.5.1 using https://github.com/kgaidev/kgai installation instructions; reuse the existing trusted store. Classic file workflows need no kgai installation."
       },
       "autoInstall": false,
       "fallbackBehavior": "Design DS/canvas/brand decisions are not recorded to the kgai graph; the classic .ai/ path (via /flow:record-ddr) and on-disk sidecars are unchanged.",

package/plugins/design/templates/_shell.html

@@ -138,6 +138,7 @@
           "react-dom/client": "./_canvas-runtime/react-dom_client.js",
           "react/jsx-runtime": "./_canvas-runtime/react_jsx-runtime.js",
           "react/jsx-dev-runtime": "./_canvas-runtime/react_jsx-dev-runtime.js",
+          "sonner": "./_canvas-runtime/sonner.js",
           "pixi.js": "./_canvas-runtime/pixi-js.js",
           "@imgly/background-removal": "./_canvas-runtime/@imgly_background-removal.js",
           "motion": "./_canvas-runtime/motion.js",
@@ -204,7 +205,7 @@
       // module, its tokens, its components CSS and its meta as separate
       // requests. Getting the document through and nothing else is what
       // "refused to connect" looks like from the outside.
-      const cap = params.get('t') || '';
+      let cap = params.get('t') || '';
       // THE BASE THIS DOCUMENT WAS SERVED FROM, not the origin root.
       //
       // The fleet's canvas origin puts the project in the PATH
@@ -222,7 +223,7 @@
         return cap ? abs + (abs.includes('?') ? '&' : '?') + 't=' + encodeURIComponent(cap) : abs;
       };
       const canvasQuery = shaParam ? ('?sha=' + encodeURIComponent(shaParam)) : '';
-      const canvasUrl = canvasRel ? withCap('/' + designRel + '/' + canvasRel + canvasQuery) : null;
+      let canvasUrl = canvasRel ? withCap('/' + designRel + '/' + canvasRel + canvasQuery) : null;
       const myFileKey = canvasRel ? (designRel + '/' + canvasRel) : null;
       // True while an `ai-activity` entry is live for THIS canvas (an agent is
       // running /design:edit|new on it). Mirrors ai-banner's gate: parent relays
@@ -249,6 +250,19 @@
           // The panel just optimistically applied an edit → skip the redundant
           // follow-up module reload (set here, parent-verified).
           lastCssOptimisticAt = Date.now();
+        } else if (m.dgn === 'canvas-cap') {
+          // A re-minted capability (it expires; app.jsx refreshes it). Every
+          // URL built from here on carries it, and asking for this shell
+          // document with it re-plants the origin's cookie — the one module
+          // imports, assets and the live sockets fall back to. Without this an
+          // open canvas stopped loading and updating once its first capability
+          // expired. Only a well-formed token, and only in the cloud (a
+          // desktop canvas never had one).
+          const t = m.t;
+          if (!cap || typeof t !== 'string' || t.length > 4096 || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(t)) return;
+          cap = t;
+          if (canvasRel) canvasUrl = withCap('/' + designRel + '/' + canvasRel + canvasQuery);
+          fetch(withCap('/_canvas-shell.html'), { cache: 'no-store', credentials: 'same-origin' }).catch(() => {});
         }
       });
 
@@ -331,6 +345,7 @@
       //   - module: location.reload() — the canvas module re-fetches.
       //   - hard: location.reload() — _lib/* changed, everything re-bundles.
       // The WS connection retries on close (dev-server restart resilience).
+      const pendingMediaHeals = new WeakMap();
       function connectHmr() {
         const proto = location.protocol === 'https:' ? 'wss' : 'ws';
         // `base` for the same reason every other URL here carries it: on the
@@ -392,12 +407,22 @@
             if (msg.type !== 'canvas-hmr') return;
             if (msg.mode === 'css') {
               const v = msg.version || Date.now();
-              // Match by exact filename when we have one; otherwise refresh all.
-              const targetFile = (msg.file || '').split('/').pop();
+              // Match by PATH when we have one; otherwise refresh all. By path,
+              // not by file name: every design system has a `tokens.css`, and
+              // a change to one canvas's imported `system/<a>/tokens.css`
+              // "matched" the shell's link to `system/<b>/tokens.css` — which
+              // swapped the wrong sheet and skipped the reload below that the
+              // changed one needed (plan T31/L16).
+              const changed = msg.file ? '/' + msg.file : '';
               let matched = false;
               for (const link of document.querySelectorAll('link[rel="stylesheet"]')) {
                 const href = link.getAttribute('href') || '';
-                if (!targetFile || href.includes(targetFile)) {
+                if (!href) continue;
+                let linkPath = '';
+                try {
+                  linkPath = decodeURIComponent(new URL(href, location.href).pathname);
+                } catch {}
+                if (!changed || linkPath.endsWith(changed)) {
                   const base = href.split('?')[0];
                   link.setAttribute('href', base + '?v=' + v);
                   matched = true;
@@ -414,7 +439,21 @@
               if (!matched && msg.file && canvasRel) {
                 const cssDir = msg.file.replace(/[^/]+$/, '');
                 const canvasDir = canvasRel.replace(/[^/]+$/, '');
-                if (cssDir === canvasDir) location.reload();
+                if (cssDir === canvasDir) {
+                  location.reload();
+                } else {
+                  // …and a stylesheet imported from ANYWHERE else (a design
+                  // system's tokens.css) is inlined the same way. The module's
+                  // style tag names what it inlined; re-import so it re-injects.
+                  // (Canvas script could add names here, but that can only
+                  // FORCE a reload — the safe direction.)
+                  var bundled = document.querySelector('style[data-canvas-css="bundled"]');
+                  var names = bundled && bundled.dataset.canvasCssSources ? bundled.dataset.canvasCssSources.split('|') : [];
+                  if (names.indexOf(msg.file) !== -1) {
+                    if (window.__maudeCanvasRuntime && window.__maudeCanvasRuntime.remount) softReload(v);
+                    else location.reload();
+                  }
+                }
               }
             } else if (msg.mode === 'module' || msg.mode === 'hard') {
               // Only reload when the change touches *this* canvas (or `_lib`).
@@ -441,7 +480,11 @@
                   // direction; it can never suppress one.)
                   var hasComps = false;
                   try { hasComps = !!(window.__maude_comps__ && window.__maude_comps__().length); } catch (err) { hasComps = false; }
-                  if (!hasComps && Date.now() - lastCssOptimisticAt < 1500) return;
+                  // …but NEVER a sync write (`remote`): it can carry a
+                  // teammate's change merged under this person's own edit (a
+                  // lost race re-applied onto theirs), and skipping it left
+                  // their change off this canvas until a manual reload.
+                  if (!hasComps && !msg.remote && Date.now() - lastCssOptimisticAt < 1500) return;
                 }
                 // Phase 30 (F4) — prefer an in-place hot-swap for ANY canvas-body
                 // (`module`) change whenever the canvas runtime is mounted: the
@@ -534,6 +577,51 @@
                 // working one is a cheap refetch of now-cached bytes.
                 el.setAttribute('href', href.split('?')[0] + '?v=' + v);
               }
+              // A reference can reach a peer before its video/audio bytes.
+              // Retry failed players when those bytes arrive, without resetting
+              // healthy playback or dropping capability parameters from the URL.
+              const arrivedUrl = new URL(withCap('/' + designRel + '/' + msg.file), document.baseURI);
+              for (const media of document.querySelectorAll('video, audio')) {
+                if (media.readyState > 0) continue;
+                const candidates = media.hasAttribute('src')
+                  ? [media]
+                  : Array.from(media.querySelectorAll('source[src]'));
+                const targets = candidates.flatMap((target) => {
+                  const src = target.getAttribute('src');
+                  if (!src) return [];
+                  try {
+                    const url = new URL(src, document.baseURI);
+                    if (url.origin !== arrivedUrl.origin || url.pathname !== arrivedUrl.pathname) return [];
+                    url.searchParams.set('v', String(v));
+                    return [{ target, src, next: url.href }];
+                  } catch { return []; }
+                });
+                if (!targets.length) continue;
+                pendingMediaHeals.get(media)?.();
+                const clear = () => {
+                  media.removeEventListener('error', retry, true);
+                  media.removeEventListener('loadedmetadata', clear);
+                  media.removeEventListener('emptied', clear);
+                  pendingMediaHeals.delete(media);
+                };
+                const retry = () => {
+                  clear();
+                  if (!media.isConnected || media.readyState > 0) return;
+                  if (targets.some(({ target, src }) => target.getAttribute('src') !== src)) return;
+                  for (const { target, next } of targets) target.setAttribute('src', next);
+                  media.load();
+                };
+                if (media.error || media.networkState === 3) {
+                  retry();
+                } else if (media.networkState === 2) {
+                  // The initial response can still be an older in-flight 404.
+                  // One arrival permits one retry; success/source change cancels it.
+                  pendingMediaHeals.set(media, clear);
+                  media.addEventListener('error', retry, true);
+                  media.addEventListener('loadedmetadata', clear);
+                  media.addEventListener('emptied', clear);
+                }
+              }
             }
           } catch (e) {
             console.warn('[canvas-shell] HMR message parse error', e);

package/plugins/flow/dependencies.json

@@ -101,11 +101,11 @@
       "hardness": "soft",
       "check": {
         "command": "kg version",
-        "expectExit": 0
+        "expectExit": 0,
+        "minVersion": "1.5.1"
       },
       "install": {
-        "preferred": "See docs/kgai-onboarding.md — download the pinned kgai release binary (kgai is capability-gated + opt-out; nothing to install to use classic .ai/ mode)",
-        "darwin": "curl -fsSL https://github.com/kgaidev/kgai/releases/download/v1.0.0/kg-darwin-arm64 -o /usr/local/bin/kg && chmod +x /usr/local/bin/kg"
+        "preferred": "Install kgai >= 1.5.1 using https://github.com/kgaidev/kgai installation instructions; reuse the existing trusted store. Classic file workflows need no kgai installation."
       },
       "autoInstall": false,
       "fallbackBehavior": "flow/design fall back to the classic .ai/decisions/ + STATE.md file path (no regression). The kgai knowledge-graph backend (kg context/ingest/sync, cross-repo company memory) is inactive.",