@1agh/maude 1.3.0 → 1.3.1

package/apps/studio/git/accepted-guard.ts

@@ -0,0 +1,36 @@
+// Plan T34 / writer registry H09 — the checkout of a project that saves through
+// accepted revisions (DDR-241) is a PROJECTION of the shared history, not a
+// second author.
+//
+// A Git operation that rewrites the checkout's files — switching or adding a
+// draft, discarding, getting latest, resolving a merge — would change files
+// under the sync runtime, and its watcher would propose the result as this
+// person's edit: a local Git graph silently overriding what the team accepted.
+// In that mode these routes refuse, and say where the same intent lives:
+// History (restore an earlier version as a new action). Commit, branch, push
+// and fetch stay — they touch the Git graph, not the files (H10).
+
+/** The `/_api/git/*` routes that rewrite checkout files. */
+export const CHECKOUT_REWRITING_GIT_ROUTES = [
+  '/_api/git/checkout',
+  '/_api/git/fold',
+  '/_api/git/discard',
+  '/_api/git/pull',
+  '/_api/git/resolve',
+] as const;
+
+export const ACCEPTED_GIT_REFUSAL = {
+  ok: false,
+  code: 'accepted-project',
+  error:
+    'This project saves through its shared history, so its files cannot be rewritten from Git here. To go back to an earlier version, restore it from History — it becomes a new change everyone sees.',
+} as const;
+
+/** A refusal when the linked project is in accepted-revisions mode, else null. */
+export function refuseCheckoutRewrite(acceptedMode: (() => boolean) | undefined): Response | null {
+  if (acceptedMode?.() !== true) return null;
+  return Response.json(ACCEPTED_GIT_REFUSAL, {
+    status: 409,
+    headers: { 'Cache-Control': 'no-store' },
+  });
+}

package/apps/studio/hmr-broadcast.ts

@@ -46,8 +46,19 @@ export interface HmrMessage {
   version: number;
   /** Echo of `_lib`-scoped changes for debug + scope reasoning. */
   scope?: 'lib' | 'canvas';
+  /**
+   * The change was written by sync — the project's version landing on this
+   * disk — not by this person's own edit. The iframe may skip a reload it
+   * believes is the echo of an optimistic edit it already shows; it must never
+   * skip one of these, because a teammate's change can ride the same write (a
+   * lost race re-applied onto theirs).
+   */
+  remote?: boolean;
 }
 
+/** How long after a sync write its file's change still counts as remote. */
+export const REMOTE_WRITE_WINDOW_MS = 3_000;
+
 export interface HmrBroadcaster {
   /** Stop subscribing to fs-watch events. */
   stop(): void;
@@ -103,9 +114,28 @@ export function createHmrBroadcaster(
     });
   }
 
+  // Files sync just wrote (see HmrMessage.remote), with the time of the write.
+  const projectedAt = new Map<string, number>();
+  const isRemote = (rel: string | undefined): boolean => {
+    if (!rel) return false;
+    const at = projectedAt.get(rel);
+    return at !== undefined && Date.now() - at < REMOTE_WRITE_WINDOW_MS;
+  };
+  const offProjected = ctx.bus.on('sync:projected', (rel: unknown) => {
+    if (typeof rel !== 'string' || !rel) return;
+    const now = Date.now();
+    projectedAt.set(rel.replace(/\\/g, '/'), now);
+    if (projectedAt.size > 256) {
+      for (const [k, at] of projectedAt)
+        if (now - at >= REMOTE_WRITE_WINDOW_MS) projectedAt.delete(k);
+    }
+  });
+
   function enqueue(msg: HmrMessage) {
     const key = msg.mode === 'hard' ? GLOBAL_KEY : (msg.file ?? GLOBAL_KEY);
     const prev = pendingByKey.get(key);
+    // Coalescing never loses "a teammate's change is in here".
+    if (prev?.remote) msg.remote = true;
     // Same-key coalescing keeps the strongest mode (refreshing the payload for
     // equal rank, so the latest version token wins).
     if (!prev || rank[msg.mode] >= rank[prev.mode]) pendingByKey.set(key, msg);
@@ -115,12 +145,15 @@ export function createHmrBroadcaster(
 
   const offAny = ctx.bus.on('fs:any', (rel: string) => {
     const msg = classify(rel);
-    if (msg) enqueue(msg);
+    if (!msg) return;
+    if (isRemote(rel.replace(/\\/g, '/')) || isRemote(msg.file)) msg.remote = true;
+    enqueue(msg);
   });
 
   return {
     stop() {
       offAny();
+      offProjected();
       if (pending) clearTimeout(pending);
       pending = null;
       pendingByKey.clear();

package/apps/studio/http.ts

@@ -98,6 +98,7 @@ import {
   resolveAutoEngine,
   whisperSetup,
 } from './generation/whisper-models.ts';
+import { refuseCheckoutRewrite } from './git/accepted-guard.ts';
 import { createGitEndpoints } from './git/endpoints.ts';
 import { gitShowFile } from './git/service.ts';
 import { createGitHubEndpoints } from './github/endpoints.ts';
@@ -2632,6 +2633,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.checkout(body));
     },
@@ -2644,6 +2647,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('adding a draft requires a local request', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.fold(body));
     },
@@ -2676,6 +2681,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('local request required (DNS-rebinding guard)', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 256 * 1024);
       return gitJson(await gitApi.discard(body));
     },
@@ -2700,6 +2707,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('get latest requires a local request', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.pull(body));
     },
@@ -2714,6 +2723,8 @@ export function createHttp(
         return new Response('cross-origin write rejected', { status: 403 });
       if (!isTrustedRequestHost(req))
         return new Response('resolve requires a local request', { status: 403 });
+      const rewrite = refuseCheckoutRewrite(ctx.syncControl?.current?.()?.acceptedMode);
+      if (rewrite) return rewrite;
       const body = await readJson<unknown>(req, 8 * 1024);
       return gitJson(await gitApi.resolve(body));
     },

package/apps/studio/managed-projects.ts

@@ -69,6 +69,15 @@ export function groupsFromBootstrap(boot: {
   return [...out].slice(0, 32);
 }
 
+function sameServer(a: string | undefined, b: string): boolean {
+  if (!a) return false;
+  try {
+    return normalizeUrl(a) === normalizeUrl(b);
+  } catch {
+    return false;
+  }
+}
+
 async function bootstrapOf(url: string, token: string): Promise<Record<string, unknown> | null> {
   try {
     const res = await fetch(`${url}/api/projects/current/v1/bootstrap`, {
@@ -135,6 +144,19 @@ export async function prepareManagedProject(
     return { ok: false, error: 'The sign-in could not be saved on this computer.', status: 500 };
   const boot = await bootstrapOf(serverUrl, token);
   if (boot && typeof boot.projectId === 'string') projectId ??= boot.projectId;
+  // SIGN IN AGAIN (T20): a new credential for the server this studio is
+  // already syncing with. Reopening the same project attaches to this very
+  // process (the shell never starts a second one for a running project), and
+  // the running runtime still holds the credential the project refused — so
+  // cycle it onto the one just stored. The link is unchanged and never re-read
+  // from disk; only the credential is new, and this process wrote it.
+  if (input.kind !== 'known-hub' && sameServer(ctx.cfg?.linkedHub?.url, serverUrl)) {
+    try {
+      await ctx.syncControl?.restart();
+    } catch (err) {
+      console.error('[managed] could not restart sync on the new sign-in:', err);
+    }
+  }
   const host = new URL(serverUrl).host;
   projectId ??= host;
   if (!/^[A-Za-z0-9._-]{1,128}$/.test(projectId)) projectId = host.replace(/[^A-Za-z0-9._-]/g, '-');

package/apps/studio/sync/index.ts

@@ -1222,6 +1222,9 @@ export function createSyncRuntime(
   /** The outbound delete-lane subscriptions — see `noteToHub`. */
   let deletedUnsub: (() => void) | null = null;
   let createdUnsub: (() => void) | null = null;
+  /** Folders made outside the app while running — see `proposeLocalFolders`. */
+  let foldersUnsub: (() => void) | null = null;
+  let foldersTimer: ReturnType<typeof setTimeout> | null = null;
   /** Periodic remote-document poll — the hub-side half of discovery. */
   let remotePollTimer: ReturnType<typeof setInterval> | null = null;
   /** The stall watchdog's tick — see `stallCheck` in `start()`. */
@@ -1312,6 +1315,15 @@ export function createSyncRuntime(
    * work), and passes are floored `MIN_PASS_INTERVAL_MS` apart.
    */
   let planePassInFlight = false;
+  /**
+   * News that arrived WHILE a pass ran. The running pass may already have read
+   * the disk and the hub's listing, so it cannot carry a file written — or a
+   * row a poke announced — after that point; absorbing the request silently
+   * parked such a file until the next 20 s tick (plan T17/L03: a new image
+   * took 15–20 s to reach a teammate while an edit took one). One more pass,
+   * floored like any other, answers it.
+   */
+  let planePassAgain = false;
   let lastPlanePassAt = 0;
   let planePassWaiter: Promise<void> | null = null;
   let lastPlaneResult: import('./file-plane.ts').FilePlaneResult | null = null;
@@ -1323,7 +1335,10 @@ export function createSyncRuntime(
     // A pass already running IS this pass: it reads the same disk and the same
     // cursor, so the caller waits for its answer rather than racing it. The
     // poll's `await` therefore still means "a pass has happened".
-    if (planePassInFlight) return await (planePassWaiter ?? Promise.resolve());
+    if (planePassInFlight) {
+      planePassAgain = true;
+      return await (planePassWaiter ?? Promise.resolve());
+    }
     const since = Date.now() - lastPlanePassAt;
     // The floor governs POKES. The 20 s poll and the explicit `pullRemoteNow`
     // seam are already bounded by their own callers, and silently deferring a
@@ -1346,6 +1361,10 @@ export function createSyncRuntime(
       } finally {
         planePassInFlight = false;
         planePassWaiter = null;
+        if (planePassAgain) {
+          planePassAgain = false;
+          schedulePlanePass();
+        }
       }
     })();
     planePassWaiter = run;
@@ -1867,9 +1886,33 @@ export function createSyncRuntime(
     return abs;
   };
   const designRelPosix = ctx.paths.designRel.replace(/^\.\//, '').replace(/^\/+|\/+$/g, '');
+  /**
+   * A folder the project removed or moved away is taken off this disk only
+   * once it is empty — but the canvases inside leave AFTER the pull that
+   * learned of the action (their moves and deletions land through their own
+   * documents a beat later). Waiting for the next poke or 20 s tick left the
+   * old folder in a teammate's tree for up to 20 s (plan T31/L02). So a
+   * deferred removal asks for another pass shortly, a bounded number of times.
+   */
+  let dirsRetryTimer: ReturnType<typeof setTimeout> | null = null;
+  let dirsRetries = 0;
+  const DIRS_RETRY_MS = 1_500;
+  const DIRS_RETRY_MAX = 12;
+  function retryDeferredDirs(): void {
+    if (stopped || dirsRetryTimer !== null || dirsRetries >= DIRS_RETRY_MAX) return;
+    dirsRetries += 1;
+    dirsRetryTimer = setTimeout(() => {
+      dirsRetryTimer = null;
+      if (stopped || !acceptedOn()) return;
+      if (documentDiscovery) documentDiscovery.schedule();
+      else applyProjectDirs(acceptedLink?.manifest?.dirs ?? []);
+    }, DIRS_RETRY_MS);
+    dirsRetryTimer.unref?.();
+  }
   function applyProjectDirs(dirs: readonly string[]): void {
     const next = new Set(dirs);
     let changed = false;
+    let deferred = 0;
     for (const rel of next) {
       if (knownProjectDirs.has(rel)) continue;
       const abs = projectDirAbs(rel);
@@ -1903,8 +1946,11 @@ export function createSyncRuntime(
           continue;
         }
         // Canvases inside leave through their own deletion/move first; until
-        // then the folder stays and the next poll tries again.
-        if (entries.some((e) => e !== '.gitkeep')) continue;
+        // then the folder stays and a pass shortly tries again.
+        if (entries.some((e) => e !== '.gitkeep')) {
+          deferred += 1;
+          continue;
+        }
         try {
           for (const e of readdirSync(abs)) rmSync(path.join(abs, e), { force: true });
           rmdirSync(abs);
@@ -1920,6 +1966,8 @@ export function createSyncRuntime(
       changed = true;
     }
     if (changed) saveProjectDirs();
+    if (deferred > 0) retryDeferredDirs();
+    else dirsRetries = 0;
   }
 
   /**
@@ -1975,9 +2023,17 @@ export function createSyncRuntime(
    * project as ONE action at cold start. Only additive: a folder the manifest
    * lists and this disk lacks is never proposed as a deletion from here.
    */
+  let folderProposal: Promise<void> | null = null;
+  let folderProposalAgain = false;
   function proposeLocalFolders(): void {
     if (!acceptedLink) return;
-    const listed = new Set(acceptedLink.manifest?.dirs ?? []);
+    // One proposal at a time: a second walk while the first is unanswered
+    // would offer the same folders twice.
+    if (folderProposal) {
+      folderProposalAgain = true;
+      return;
+    }
+    const listed = new Set([...(acceptedLink.manifest?.dirs ?? []), ...knownProjectDirs]);
     const found: string[] = [];
     const walk = (abs: string, rel: string, depth: number) => {
       if (depth > 16 || found.length >= 200) return;
@@ -2006,13 +2062,25 @@ export function createSyncRuntime(
       if (rel) walk(path.join(ctx.paths.designRoot, ...rel.split('/')), rel, 1);
     }
     if (found.length === 0) return;
-    void acceptedLink.dirsCreate(found).then((r) => {
-      if (r.status === 'accepted') {
-        for (const d of found) knownProjectDirs.add(d);
-        saveProjectDirs();
-        console.log(`[sync] added ${found.length} local folder(s) to the project.`);
-      }
-    });
+    folderProposal = acceptedLink
+      .dirsCreate(found)
+      .then((r) => {
+        if (r.status === 'accepted') {
+          for (const d of found) knownProjectDirs.add(d);
+          saveProjectDirs();
+          console.log(`[sync] added ${found.length} local folder(s) to the project.`);
+        }
+      })
+      .catch(() => {
+        /* the next folder event or cold start offers them again */
+      })
+      .finally(() => {
+        folderProposal = null;
+        if (folderProposalAgain) {
+          folderProposalAgain = false;
+          proposeLocalFolders();
+        }
+      });
   }
 
   function proposeFolder(
@@ -3535,7 +3603,15 @@ export function createSyncRuntime(
                 // the HMR broadcaster's per-file coalescing collapses the pair
                 // into one `canvas-hmr`. The projector's own echo guard drops the
                 // resulting file→doc read, so this cannot loop.
-                ...(cellPairing ? { onWrote: announceWrite } : {}),
+                onWrote: (abs: string) => {
+                  // Tell the canvas layer this write carries the PROJECT's
+                  // version — possibly a teammate's change merged under this
+                  // person's own — so an open canvas never discards its reload
+                  // as the echo of an optimistic edit (hmr-broadcast `remote`).
+                  const rel = path.relative(ctx.paths.designRoot, abs).split(path.sep).join('/');
+                  if (rel && !rel.startsWith('..')) ctx.bus.emit('sync:projected', rel);
+                  if (cellPairing) announceWrite(abs);
+                },
               });
               projection.start();
               projections.set(canvas.slug, projection);
@@ -3818,6 +3894,18 @@ export function createSyncRuntime(
     });
     discoveryRescan = rescan;
     discoveryUnsub = ctx.bus.on('canvas-list-update', () => rescan.schedule());
+    // A folder made OUTSIDE the app while it runs — an agent's `mkdir` plus
+    // `.gitkeep`, Finder, a `git checkout` — joins the project the way a cold
+    // start adds one: additively, never as a deletion. Without this it stayed
+    // on this machine until the next launch.
+    foldersUnsub = ctx.bus.on('fs:any', (rel: unknown) => {
+      if (typeof rel !== 'string' || !rel.endsWith('/.gitkeep') || !acceptedOn()) return;
+      if (foldersTimer) clearTimeout(foldersTimer);
+      foldersTimer = setTimeout(() => {
+        foldersTimer = null;
+        if (acceptedOn()) proposeLocalFolders();
+      }, 300);
+    });
 
     // The OUTBOUND half of the delete lane. `api.ts` emits these two only from
     // its privileged create/delete routes, never from the filesystem watcher —
@@ -4518,6 +4606,12 @@ export function createSyncRuntime(
     attachOne = null;
     discoveryUnsub?.();
     discoveryUnsub = null;
+    foldersUnsub?.();
+    foldersUnsub = null;
+    if (foldersTimer) clearTimeout(foldersTimer);
+    foldersTimer = null;
+    if (dirsRetryTimer) clearTimeout(dirsRetryTimer);
+    dirsRetryTimer = null;
     deletedUnsub?.();
     deletedUnsub = null;
     createdUnsub?.();

package/apps/studio/sync/presentation.ts

@@ -427,6 +427,27 @@ export function syncPresentation(
     };
   }
 
+  // Accepted revisions: the project answered "sign in first" to a change —
+  // the sign-in was revoked or its person removed. The change is kept on this
+  // device and retried, but it cannot reach anyone until someone signs in
+  // again, so this is a refusal, never "Saving … check your connection".
+  const refusedSignIn = readAcceptedRefused(status.accepted);
+  if (refusedSignIn) {
+    const n = refusedSignIn.pending;
+    return {
+      phase: 'refused',
+      online: false,
+      label: 'sign in again',
+      title:
+        `${project} no longer accepts your sign-in — ` +
+        (n > 0
+          ? `${n} change${n === 1 ? ' is' : 's are'} kept on this device and not shared.`
+          : 'your changes are not shared.'),
+      next: 'Sign in again to share them.',
+      names: [],
+    };
+  }
+
   // A refused SOURCE change outranks an unreachable hub for the same reason a
   // refusal does: it is sticky, and it is the part that needs a person.
   // (With the hub reachable, the same sentence lists every other lane too.)
@@ -634,6 +655,15 @@ function readAcceptedPending(
   };
 }
 
+/** `status.accepted.credentialRefused`, validated — only a literal `true` counts. */
+function readAcceptedRefused(raw: unknown): { pending: number } | null {
+  if (!raw || typeof raw !== 'object') return null;
+  const r = raw as { credentialRefused?: unknown; pending?: unknown };
+  if (r.credentialRefused !== true) return null;
+  const p = r.pending;
+  return { pending: typeof p === 'number' && Number.isInteger(p) && p > 0 && p <= 1e6 ? p : 0 };
+}
+
 /** `status.aiAction`, validated — never trusted off disk. */
 function readAiAction(raw: unknown): { state: 'open' | 'held'; canvases: number } | null {
   if (!raw || typeof raw !== 'object') return null;

package/apps/studio/sync/status.ts

@@ -103,6 +103,8 @@ export interface AcceptedSaveStatus {
   oldestPendingAt: number | null;
   ackMs: { last: number | null; p95: number | null; n: number };
   rejected: number;
+  /** The project refuses this sign-in — changes wait for signing in again. */
+  credentialRefused?: boolean;
 }
 
 export interface SyncNotice {
@@ -406,7 +408,9 @@ export function createSyncStatusStore(opts: SyncStatusStoreOptions): SyncStatusS
       accepted = next;
       // Going from waiting to caught-up (or back) is news; a latency tick is not.
       flush(
-        ((was?.pending ?? 0) === 0) !== (next.pending === 0) || next.rejected !== was?.rejected
+        ((was?.pending ?? 0) === 0) !== (next.pending === 0) ||
+          next.rejected !== was?.rejected ||
+          !!next.credentialRefused !== !!was?.credentialRefused
       );
     },
     updateFiles(next) {

package/apps/studio/sync/transaction-client.ts

@@ -98,6 +98,14 @@ export interface TransactionStats {
   ackMs: { last: number | null; p95: number | null; n: number };
   /** Final rejections this session (conflicts, invalid source, rights…). */
   rejected: number;
+  /**
+   * The project answered the last attempt "sign in first": this sign-in was
+   * revoked or its person disabled. The change stays in the outbox and is
+   * retried with whatever credential `token()` returns next — it is not lost,
+   * but it cannot be shared until someone signs in again, which is what a
+   * person must be told instead of "check your connection".
+   */
+  credentialRefused: boolean;
 }
 
 const sha256 = (s: string) => createHash('sha256').update(s, 'utf8').digest('hex');
@@ -139,6 +147,12 @@ export function createTransactionClient(opts: TransactionClientOptions) {
   const waiting = new Map<string, number>();
   const acks: number[] = [];
   let rejectedCount = 0;
+  let credentialRefused = false;
+  const setCredentialRefused = (next: boolean) => {
+    if (credentialRefused === next) return;
+    credentialRefused = next;
+    opts.onStats?.(stats());
+  };
   function stats(): TransactionStats {
     const sorted = [...acks].sort((a, b) => a - b);
     return {
@@ -152,6 +166,7 @@ export function createTransactionClient(opts: TransactionClientOptions) {
         n: acks.length,
       },
       rejected: rejectedCount,
+      credentialRefused,
     };
   }
   const setPending = (delta: number) => {
@@ -239,13 +254,24 @@ export function createTransactionClient(opts: TransactionClientOptions) {
         if (attempt > 0) {
           const known = await request('GET', `transactions/${entry.transactionId}`);
           if (known.status === 200 && known.json) {
+            setCredentialRefused(false);
             rmSync(file, { force: true });
             return known.json as ProposalResult;
           }
         }
         const { status, json } = await request('POST', 'proposals', entry.bytes);
+        // Not an answer about the change — about who is asking. Kept and
+        // retried (a new sign-in supplies a new token), and said out loud.
+        if (status === 401) {
+          setCredentialRefused(true);
+          throw new TransactionError(
+            'the project no longer accepts this sign-in',
+            'unauthenticated'
+          );
+        }
         const result = json as ProposalResult | null;
         if (result && (result.status === 'accepted' || result.status === 'rejected')) {
+          setCredentialRefused(false);
           if (result.status === 'rejected' && (result.code === 'retryable' || status >= 500)) {
             throw new TransactionError('hub asked to retry', 'retryable');
           }

package/apps/studio/use-tool-mode.tsx

@@ -18,6 +18,7 @@ import {
   useContext,
   useEffect,
   useMemo,
+  useRef,
   useState,
 } from 'react';
 
@@ -53,6 +54,9 @@ export type ShapeKind = 'square' | 'rounded' | 'circle' | 'diamond' | 'triangle'
  */
 export type CanvasMode = 'preview' | 'edit';
 
+/** Document event two provider instances keep one active tool through. */
+export const TOOL_SYNC_EVENT = 'maude:tool-sync';
+
 /** The resting tool each mode arms (and returns to via `resetTool`). */
 export const MODE_DEFAULT_TOOL: Readonly<Record<CanvasMode, Tool>> = Object.freeze({
   preview: 'browse',
@@ -231,6 +235,46 @@ export function ToolProvider({
   // FigJam look); sharp squares stay one popover click away.
   const [shapeKind, setShapeKind] = useState<ShapeKind>('rounded');
 
+  // ONE ACTIVE TOOL PER CANVAS DOCUMENT, across provider instances.
+  //
+  // A UI canvas carries TWO providers: the comment-mount layer's (it owns the
+  // comment drop) and canvas-lib's own (it owns the palette) — separate
+  // bundles, so separate contexts. They used to converge only through a tool
+  // KEYDOWN, which both routers see; a palette CLICK reached canvas-lib's
+  // provider alone. So "Comment" in the palette lit up while the comment
+  // layer stayed in browse, and clicking the canvas dropped nothing — you had
+  // to know to press C (plan T31/L11). A change here is announced on the
+  // document and every other instance adopts it. The boot posture is NOT
+  // announced (the two instances deliberately boot differently — see
+  // `initial`); only a change after mount is.
+  const syncId = useRef(Math.random().toString(36).slice(2));
+  const toolRef = useRef(tool);
+  toolRef.current = tool;
+  const announced = useRef(false);
+  useEffect(() => {
+    if (!announced.current) {
+      announced.current = true;
+      return;
+    }
+    if (typeof document === 'undefined') return;
+    document.dispatchEvent(
+      new CustomEvent(TOOL_SYNC_EVENT, { detail: { tool, from: syncId.current } })
+    );
+  }, [tool]);
+  useEffect(() => {
+    if (typeof document === 'undefined') return;
+    const onSync = (e: Event) => {
+      const d = (e as CustomEvent<{ tool?: unknown; from?: unknown }>).detail;
+      if (!d || d.from === syncId.current || typeof d.tool !== 'string') return;
+      // Already there: nothing to do, and — for a sticky-locked tool — not
+      // touching it keeps the lock.
+      if (d.tool === toolRef.current) return;
+      setTool(d.tool as Tool);
+    };
+    document.addEventListener(TOOL_SYNC_EVENT, onSync);
+    return () => document.removeEventListener(TOOL_SYNC_EVENT, onSync);
+  }, [setTool]);
+
   // Cursor sync — applied inside the canvas (this hook runs in the canvas
   // context). The active tool's cursor is set on <body> AND forced across the
   // whole canvas working area via an `!important` rule, so the custom cursor

package/apps/studio/whats-new.json

@@ -1,6 +1,42 @@
 {
   "$schema": "./whats-new.schema.json",
   "entries": [
+    {
+      "id": "live-canvases-long-sessions",
+      "version": "1.3.1",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "Canvases stay live in long sessions",
+      "summary": "A canvas open in your browser on a Maude Cloud project kept working for about 15 minutes and then quietly stopped showing teammates’ changes until you reloaded the page — it now stays live however long you work. And editing a design system’s tokens.css restyles every open canvas that uses it, straight away.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "team-access-and-presence",
+      "version": "1.3.1",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "Lost access? Maude asks you to sign in again",
+      "summary": "If an owner removes your access or your sign-in expires, the Sync panel now tells you to sign in again — instead of \"check your connection\" — and keeps your changes on this computer until you do. Signing in again sends them. And when a teammate closes a canvas, their avatar and cursor now leave everyone else’s screen straight away.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "comment-tool-and-live-tree",
+      "version": "1.3.1",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "The Comment tool works from the toolbar; new images and folders show up for everyone at once",
+      "summary": "Picking Comment in the canvas toolbar now lets you click an element to comment — before, only the C key did. An image saved next to your canvases appears in the file tree straight away, on your machine and your teammates’. A folder you create or move outside Maude, or move in the tree, reaches the team in seconds instead of on the next launch.",
+      "surface": "design-ui"
+    },
+    {
+      "id": "inspector-keeps-number-types",
+      "version": "1.3.1",
+      "date": "2026-09-15",
+      "kind": "fix",
+      "title": "Editing a number in the inspector keeps it a number",
+      "summary": "Changing a value like an artboard height or a video’s length used to turn it into text in the canvas source — some components then misread it. Numbers and on/off values now stay what they were, and leaving a value unchanged no longer rewrites the file.",
+      "surface": "design-ui"
+    },
     {
       "id": "artboard-rename-and-files",
       "version": "1.3.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1agh/maude",
-  "version": "1.3.0",
+  "version": "1.3.1",
   "description": "Marketplace of Claude Code plugins by Michal Dovrtěl: `design` (canvas-first design iteration) + `flow` (generic agentic workflow loop with .ai second brain). Ships the `maude` CLI (with `mdcc` legacy alias) to scaffold workspace, run the design dev server, and manage configs.",
   "type": "module",
   "engines": {
@@ -56,13 +56,13 @@
     "test:e2e:desktop:parity:cloud": "pnpm --filter @maude/desktop-e2e e2e:parity:cloud"
   },
   "optionalDependencies": {
-    "@1agh/maude-darwin-arm64": "1.3.0",
-    "@1agh/maude-darwin-x64": "1.3.0",
-    "@1agh/maude-linux-arm64": "1.3.0",
-    "@1agh/maude-linux-arm64-musl": "1.3.0",
-    "@1agh/maude-linux-x64": "1.3.0",
-    "@1agh/maude-linux-x64-musl": "1.3.0",
-    "@1agh/maude-win32-x64": "1.3.0"
+    "@1agh/maude-darwin-arm64": "1.3.1",
+    "@1agh/maude-darwin-x64": "1.3.1",
+    "@1agh/maude-linux-arm64": "1.3.1",
+    "@1agh/maude-linux-arm64-musl": "1.3.1",
+    "@1agh/maude-linux-x64": "1.3.1",
+    "@1agh/maude-linux-x64-musl": "1.3.1",
+    "@1agh/maude-win32-x64": "1.3.1"
   },
   "files": [
     "cli",