@marver-design/marver 0.6.0 → 0.8.0

package/CHANGELOG.md

@@ -2,6 +2,101 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.8.0 - 2026-08-19
+
+Live Jam: tag `@marver` in a canvas comment and a local coding agent picks it up, edits the real
+frame source, and replies in the thread - live. Plus a dev identity system and a full polish pass
+on the comment thread experience.
+
+### Added
+
+- **Live Jam - the agent in the thread.** A daemon inside `marver dev` watches the comment logs:
+  an owner-authored `@marver` spawns a headless agent (`jam: { agent: "claude" }` or `"codex"`)
+  that reads the whole thread, edits the real frame source, and replies live - a streamed
+  first-line ack within seconds (model provenance included), a look-around-before-asking clarify
+  ladder, replies matched to your message's energy and length, follow-ups in an engaged thread
+  triggering WITHOUT re-tagging, parallel jobs across frames, and crash-safe recovery: a batch
+  killed mid-run (even by a server restart) resumes on the next boot from a durable journal.
+  Every reply carries a provenance tooltip - dev user, harness, model.
+- **A hard trust boundary.** Only the owner's device triggers: a device-bound ledger (keyed per
+  board + comment id, never synced), a same-origin + cookie gate on every dev write (comments AND
+  profile), and a recursion guard so agent replies never re-trigger. The agent gets no shell -
+  Read/Edit/Write/Glob/Grep + WebSearch/WebFetch only - and its reply is extracted structurally
+  (the `marver-reply` block), so narration can never leak into a thread. Comment text is framed
+  as untrusted data end to end.
+- **The felt surface.** A frame being worked on wears the selection geometry in marver blue with
+  a rotating shimmer, a top-to-bottom content wave, and a parallelogram shimmer matrix on its
+  flank - phased per frame so parallel jams don't pulse in sync, held alive by a heartbeat for
+  the whole job. Replies land as minimal notification pills (frame title + preview) that stack
+  into a card deck at 3+, expand, clear, and jump you to the thread - delivered instantly over
+  the dev websocket. Marver renders as its own participant with the blue mark avatar everywhere.
+- **Dev identity + review controls.** Comments in dev render as "You" (green Y) until you set a
+  profile - hover your avatar (pen on gray), "Set up your profile": name + photo, saved to
+  `design/.local/` on your machine only; a connect account takes over name + email automatically,
+  and account-less history re-renders as the live you. New shortcuts: ⇧L toggles "laser comment"
+  (the element lighting comments paint in the artwork - anchoring stays precise with it off),
+  ⇧C hides pins, both in stateful two-row tooltips; Prototype view moved beside Hide UI.
+
+### Changed
+
+- **The thread card grew up.** World-parked beside its frame with pin-style screen-constant
+  scaling, height rules that respect the frame, content-mask scroll fades, a custom glass
+  scrollbar riding the card's far edge (action buttons never collide), and a stage-docked
+  position in Play that re-docks on device switches. The composer centers its text exactly,
+  renders `@marver` bold WITHOUT caret drift (metrics-safe text-stroke), and the send button is
+  reliably clickable.
+- Laser/comment hover lighting leaves a frame together with the pointer - no fossilized outlines
+  on frames the cursor crossed; the expanded notification list no longer clips pill shadows.
+
+## 0.7.0 - 2026-08-17
+
+Prototype mode becomes a first-class review surface. The prototype (Play) now carries the same toolbar
+as the canvas, laser and comments work INSIDE it, and every comment wears the colour of the element it
+points at - the groundwork for tagging a coding agent from anywhere you review.
+
+### Added
+
+- **The prototype is a review surface, not just a viewer.** Play's top-right toolbar is now the SAME
+  controls as the canvas - device switch, theme, laser, comment - built from one shared set of
+  components so the two can never drift. Laser and comment work inside the running prototype: the stage
+  runs the same element inspector the canvas frames do, so you can point at, highlight, and comment on
+  the live app while you walk a flow. The bottom-left navigator (restart / prev / i-of-N / next) stays.
+- **Hide UI (H).** One binary toggle hides all chrome for a clean point-and-shoot frame, shared by the
+  canvas and the prototype. No auto-fade, no hover magic; a page refresh always brings the chrome back
+  (the safety net for a forgotten shortcut). It replaces the prototype's old three-state auto-hiding bar.
+- **Comments wear their element's colour.** Comment mode reuses laser's per-element depth hue: the
+  element you hover, the composer, the pin, the thread card, and the active-element highlight all take
+  that specific element's colour - a comment on a blue heading reads blue, on a green button green. The
+  avatar keeps the commenter's own colour; filled buttons use a hue-aware shade so the glyph stays legible.
+- **The commented element lights up.** Picking an element locks a persistent outline on it (the highlight
+  stops chasing the mouse while you compose), and opening a thread re-lights its anchored element - so
+  everyone sees exactly which element a comment is about. It clears on close.
+
+### Changed
+
+- **Prototype chrome is discreet and reliable.** The prototype's floating toolbar wears the same quiet
+  dark skin as the bottom-left navigator, so it recedes into the stage instead of reading as a bright
+  slab; and it no longer auto-hides or sticks under the cursor - it behaves exactly like the canvas pill
+  (explicit collapse, Hide-UI, no surprises).
+- **Prototype is an action, not a menu item.** The Prototype-view button moved into the canvas pill's
+  action group (beside comment, laser, tidy), leaving the far right purely for UI management (Hide UI,
+  collapse).
+- **The element label reads clearer.** The laser/comment element tooltip now sits below-left of the
+  cursor with a gap - clear of the element you are pointing at - and slides in from the edge instead of
+  being clipped.
+- **Escape exits laser mode**, matching comment mode.
+
+### Fixed
+
+- **Canvas comment highlight is now reliable.** A frame hosting an open thread or a draft shows its LIVE
+  app rather than the frozen lean snapshot, so the active-element highlight appears, updates, and clears
+  in real time - it used to be intermittently missing, or frozen after close, depending on snapshot
+  timing. A clean snapshot rebuilds once the thread closes.
+- **Highlights only show while a thread is active.** Closing a thread or hiding pins (Shift+C) clears the
+  element highlight; a remotely-resolved thread no longer strands one.
+- **Prototype comment overlay positions faster** after a walk and never renders behind the frame or off
+  screen. Element-hue values, message origins, and stage-swap timing are all validated.
+
 ## 0.6.0 - 2026-08-17
 
 Image-heavy boards, done right. A board full of high-resolution screenshots now zooms fast and stays

package/dist/{build-BZaPa2DS.mjs → build-B8z902TW.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
-import { o as loadConfig, r as scanFrames, s as detectHost } from "./manifest-C8FODq2S.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-wMY9lNf3.mjs";
+import { o as loadConfig, r as scanFrames, s as detectHost } from "./manifest-D3eaARf4.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BVFuRfEo.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/cli.mjs

@@ -39,14 +39,14 @@ function version() {
 }
 const cli = cac(NAME);
 cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "studio | embedded", { default: "studio" }).option("--no-demo", "Skip the demo scene (the demo ships unless this flag is passed)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { init } = await import("./init-DsCUmlCW.mjs");
+	const { init } = await import("./init-DrLomSWq.mjs");
 	init(resolve(opts.root), {
 		mode: opts.mode === "embedded" ? "embedded" : "studio",
 		demo: opts.demo !== false
 	});
 });
 cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-DaPQ9xA5.mjs");
+	const { dev } = await import("./dev-BYm9ebfN.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -56,7 +56,7 @@ cli.command("dev", "Start the canvas").option("--root <dir>", "Host repo root",
 	await dev(resolve(opts.root), port);
 });
 cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-BZaPa2DS.mjs");
+	const { buildSite } = await import("./build-B8z902TW.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
 		await buildSite(resolve(opts.root), boards, opts.allBoards === true);
@@ -66,7 +66,7 @@ cli.command("build", "Static export → design/.dist (what ships comes from desi
 	}
 });
 cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default $PORT or 4199)").action(async (opts) => {
-	const { serve } = await import("./serve-D_KBK7Oy.mjs");
+	const { serve } = await import("./serve-CwAfayJk.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -75,7 +75,7 @@ cli.command("serve", "Serve design/.dist (set MARVER_PASSWORD to gate it)").opti
 	serve(resolve(opts.root), port);
 });
 cli.command("comments <action> [value]", "Comment collaboration: connect <url> · sync · list · reply <thread> · resolve <thread> · invite <email> · revoke <email>").option("--root <dir>", "Host repo root", { default: "." }).option("--invite <token>", "connect: claim this invite instead of signing in").option("--canvas-password <password>", "connect: the canvas gate password (default $MARVER_PASSWORD or prompt)").option("--email <email>", "connect: account email (skips the prompt)").option("--password <password>", "connect: account password (skips the prompt - mind your shell history)").option("--name <name>", "connect --invite: display name for the new account").option("--open", "list: only unresolved threads").option("--json", "list: machine-readable output").option("--board <board>", "scope to one board").option("--body <text>", "reply: the reply text").option("--addressed-in <frame>", "resolve: the variant frame that answered the feedback").action(async (action, value, opts) => {
-	const { commentsCommand } = await import("./comments-odHzYdO3.mjs");
+	const { commentsCommand } = await import("./comments-BrpC86Kf.mjs");
 	try {
 		await commentsCommand(resolve(opts.root), action, value, opts);
 	} catch (err) {

package/dist/{collab-CXy8gqoz.mjs → collab-pLGzSvm5.mjs}

@@ -1,4 +1,4 @@
-import { i as readLog, r as listBoards, t as appendEvents } from "./comments-Ba8mU600.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-DSwMhdbZ.mjs";
 import { claimInvite, createInvite, inviteInfo, ownerName, publicUser, revokeUser, sessionUser, signIn, signOut, updateProfile } from "./auth-B36fMCM3.mjs";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
@@ -20,7 +20,8 @@ const EVENT_TYPES = /* @__PURE__ */ new Set([
 	"resolve",
 	"reopen",
 	"react",
-	"profile"
+	"profile",
+	"reanchor"
 ]);
 const ID_RE = /^[\w-]{8,64}$/;
 const MAX_BODY_TEXT = 1e4;
@@ -60,10 +61,11 @@ function validateEvents(incoming, log, u, board) {
 		if (!ev || typeof ev !== "object") return "malformed event";
 		if (typeof ev.id !== "string" || !ID_RE.test(ev.id)) return "event id must be an 8-64 char token";
 		if (!EVENT_TYPES.has(ev.type)) return `unknown event type "${ev.type}"`;
+		if (ev.agent !== void 0 || ev.agentMeta !== void 0) return "agent provenance is daemon-only";
 		if (typeof ev.ts !== "number" || ev.ts < 15778368e5 || ev.ts > now + 6e4) return "event timestamp out of bounds";
 		if (ev.board !== void 0 && ev.board !== board) return "event board does not match the endpoint";
 		if (ev.body !== void 0 && (typeof ev.body !== "string" || ev.body.length > MAX_BODY_TEXT)) return "body too long";
-		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
+		if ((ev.type === "create" || ev.type === "reply" || ev.type === "react" || ev.type === "edit" || ev.type === "reanchor") && ev.author?.email?.toLowerCase() !== me) return "event author must be the signed-in account";
 		if (typeof ev.commentId !== "string" || !ID_RE.test(ev.commentId)) {
 			if (ev.type !== "profile") return "event needs a commentId";
 		}
@@ -84,7 +86,16 @@ function validateEvents(incoming, log, u, board) {
 				break;
 			}
 			case "resolve":
-			case "reopen": if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot resolve a thread that does not exist";
+			case "reopen":
+				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot resolve a thread that does not exist";
+				break;
+			case "reanchor": {
+				if (!creates.has(ev.commentId) && !incoming.some((x) => x.type === "create" && x.commentId === ev.commentId)) return "cannot reanchor a thread that does not exist";
+				if (ev.anchor == null) return "reanchor needs a new anchor";
+				const owner = authors.get(ev.commentId);
+				if (owner && owner !== me) return "only the thread author can reanchor";
+				break;
+			}
 		}
 	}
 	return null;
@@ -294,4 +305,4 @@ function collabHandler(dataDir, distDir) {
 	};
 }
 //#endregion
-export { collabHandler };
+export { collabHandler, validAvatar };

package/dist/{comments-odHzYdO3.mjs → comments-BrpC86Kf.mjs}

@@ -1,7 +1,8 @@
 import { n as NAME } from "./cli.mjs";
-import { i as syncOnce, n as connectClaim, o as replay, r as loadCollab, t as connect } from "./sync-CkBk-tUk.mjs";
-import { i as readLog, r as listBoards, t as appendEvents } from "./comments-Ba8mU600.mjs";
-import { readFileSync } from "node:fs";
+import { n as replay } from "./events-BMtBvvgU.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-DSwMhdbZ.mjs";
+import { connect, connectClaim, loadCollab, syncOnce } from "./sync-Ch4Bymb1.mjs";
+import { n as localProfile } from "./profile-BkiWglVE.mjs";
 import { join } from "node:path";
 import { createInterface } from "node:readline";
 import { randomUUID } from "node:crypto";
@@ -162,18 +163,11 @@ const pushIfConnected = async (root) => {
 *  authors against the session - an authorless push would be rejected), else the
 *  local dev profile. */
 const localAuthor = (root) => {
-	const collab = loadCollab(root);
-	if (collab?.email) return {
-		email: collab.email,
-		name: collab.name
-	};
-	try {
-		const p = JSON.parse(readFileSync(join(root, "design", ".local", "profile.json"), "utf8"));
-		if (p?.email) return {
-			email: p.email,
-			name: p.name
-		};
-	} catch {}
+	const p = localProfile(root);
+	return p.email ? {
+		email: p.email,
+		name: p.name
+	} : void 0;
 };
 //#endregion
 export { commentsCommand };

package/dist/{comments-Ba8mU600.mjs → comments-DSwMhdbZ.mjs}

@@ -1,4 +1,4 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.mjs";
+import "./events-BMtBvvgU.mjs";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, writeSync } from "node:fs";
 import { join } from "node:path";
 //#region src/server/comments.ts
@@ -11,12 +11,6 @@ import { join } from "node:path";
 * state is derived by replaying events (ordered by ts then id, last writer wins per
 * field). Files, not a database - tens to low hundreds of events per board.
 */
-var comments_exports = /* @__PURE__ */ __exportAll({
-	appendEvents: () => appendEvents,
-	dataDir: () => dataDir,
-	listBoards: () => listBoards,
-	readLog: () => readLog
-});
 const BOARD_RE = /^[a-z0-9][a-z0-9-]*$/;
 const boardFile = (dir, board) => {
 	if (!BOARD_RE.test(board)) throw new Error(`bad board name: ${board}`);
@@ -87,4 +81,4 @@ function dataDir() {
 	return dir;
 }
 //#endregion
-export { readLog as i, comments_exports as n, listBoards as r, appendEvents as t };
+export { appendEvents, dataDir, listBoards, readLog };