@marver-design/marver 0.8.0 → 0.9.0

package/dist/{manifest-D3eaARf4.mjs → manifest-DJHU7qfu.mjs}

@@ -1,6 +1,6 @@
 import { r as PKG, t as CONTENT_WIDTH } from "./cli.mjs";
-import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { join, relative, sep } from "node:path";
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { delimiter, isAbsolute, join, relative, sep } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createHash } from "node:crypto";
 //#region src/server/detect.ts
@@ -125,6 +125,68 @@ function firstExisting(root, candidates) {
 	return null;
 }
 //#endregion
+//#region src/server/jam/agent.ts
+/**
+* Which coding agent drives this repo.
+*
+* Live Jam is ON by default, so this is the answer to "on by default with WHAT" - asked
+* once by `init` (which writes the answer into design/config.ts, where it is visible and
+* editable) and again at every dev boot, so a workspace that predates the block - or a
+* human who switched tools - still jams without editing anything.
+*
+* The tool RUNNING us wins: `init` is usually run BY the agent, so its env markers are
+* evidence rather than a guess. Whatever wins must still be on PATH - the daemon has to
+* spawn it.
+*/
+/** Ordered by preference when a machine has both installed and neither is running us. */
+const AGENTS = ["claude", "codex"];
+/** Env vars each CLI sets in the processes it spawns. Deliberately NOT CODEX_HOME or
+*  ANTHROPIC_API_KEY: those are configuration a human exports by hand, not evidence that
+*  the tool is running right now. */
+const MARKERS = {
+	claude: ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT"],
+	codex: ["CODEX_SANDBOX", "CODEX_THREAD_ID"]
+};
+/** Is `cmd` an executable FILE on PATH? A direct stat per PATH entry - no spawn, no shell,
+*  so this is safe to call on every dev boot. Two deliberate narrowings, both in service of
+*  "found means spawnable", because arming an agent that cannot run is worse than staying off:
+*
+*  - `isFile`, because a directory carries the execute bit too (it means "traversable"), so an
+*    access check alone would call a folder named `claude` an agent.
+*  - the bare name only, no PATHEXT: the daemon spawns without a shell, and Node cannot run a
+*    Windows `.cmd`/`.bat` shim that way. Finding one would arm a job that fails on every run.
+*
+*  Only ABSOLUTE PATH entries count. An empty entry means the current directory on POSIX, and
+*  a relative one (`.`, `bin`) resolves against it too - and the current directory is the repo
+*  that was just opened, so a `claude` binary shipped inside it is precisely what must never
+*  be found and spawned. */
+function onPath(cmd, env = process.env) {
+	for (const dir of (env.PATH ?? "").split(delimiter)) {
+		if (!isAbsolute(dir)) continue;
+		try {
+			const file = join(dir, cmd);
+			if (statSync(file).isFile()) {
+				accessSync(file, constants.X_OK);
+				return true;
+			}
+		} catch {}
+	}
+	return false;
+}
+/** The agent to jam with, or undefined when this machine has none installed.
+*
+*  One knowingly-imperfect case: agents nest, and env is inherited, so a codex run started
+*  FROM Claude Code carries both marker families and this picks claude. Env has no depth to
+*  read, and walking the process tree to find the nearest agent ancestor costs more than the
+*  case is worth - so the answer is made visible instead of clever: `init` prints the agent
+*  it chose and writes it into design/config.ts, and instructions/jam.md has the agent confirm
+*  that line names the tool it actually is. One word to correct, once per repo. */
+function detectAgent(env = process.env) {
+	const running = AGENTS.find((a) => MARKERS[a].some((k) => env[k]));
+	if (running && onPath(running, env)) return running;
+	return AGENTS.find((a) => onPath(a, env));
+}
+//#endregion
 //#region src/server/config.ts
 const DEFAULTS = {
 	mode: "studio",
@@ -155,7 +217,10 @@ const DEFAULTS = {
 /** Load design/config.ts via native TS import (Node >= 22.18). Missing or broken fields fall back to defaults. */
 async function loadConfig(root) {
 	const file = join(root, "design", "config.ts");
-	if (!existsSync(file)) return { ...DEFAULTS };
+	if (!existsSync(file)) return {
+		...DEFAULTS,
+		...jamFields(void 0)
+	};
 	try {
 		const user = (await import(`${pathToFileURL(file).href}?t=${Date.now()}`)).default ?? {};
 		return {
@@ -170,11 +235,14 @@ async function loadConfig(root) {
 				name: typeof user.share?.name === "string" ? user.share.name : void 0,
 				logo: typeof user.share?.logo === "string" ? user.share.logo : void 0
 			},
-			jam: validJam(user.jam)
+			...jamFields(user.jam)
 		};
 	} catch (err) {
-		console.error(`[marver] design/config.ts failed to load, using defaults:\n  ${err.message}`);
-		return { ...DEFAULTS };
+		console.error(`[marver] design/config.ts failed to load, using defaults and leaving Live Jam OFF:\n  ${err.message}`);
+		return {
+			...DEFAULTS,
+			jamOff: "unreadable"
+		};
 	}
 }
 const validDim = (n) => typeof n === "number" && Number.isFinite(n) && n >= 1 && n <= 2e4;
@@ -184,20 +252,77 @@ function validPort(n) {
 function validZoom(n) {
 	return typeof n === "number" && Number.isFinite(n) && n >= .1 && n <= 10 ? n : null;
 }
-/** Normalize the jam block. An unknown/missing `agent` means Live Jam stays OFF (returns undefined),
-*  so a stray `jam: {}` never silently arms the daemon. Other fields fall back to lean defaults. */
-function validJam(v) {
-	if (!v || typeof v !== "object") return void 0;
-	const j = v;
-	if (j.agent !== "claude" && j.agent !== "codex") return void 0;
-	const concurrency = typeof j.concurrency === "number" && Number.isInteger(j.concurrency) && j.concurrency >= 1 && j.concurrency <= 16 ? j.concurrency : 3;
+/** Six frames at once is what a jam actually feels like - at 3, half of a multi-frame
+*  ask sat waiting on the other half while the human watched. */
+const DEFAULT_CONCURRENCY = 6;
+/** A config value, printable in a warning. Never throws - a formatter that can crash inside an
+*  error path (JSON.stringify does, on a BigInt) turns a clear message into a mystery. */
+const show = (v) => {
+	try {
+		return JSON.stringify(v) ?? String(v);
+	} catch {
+		return String(v);
+	}
+};
+/** A `{...}` written by hand, not a Date/Map/class instance that merely types as "object". */
+const plainObject = (v) => {
+	if (!v || typeof v !== "object") return false;
+	const proto = Object.getPrototypeOf(v);
+	return proto === Object.prototype || proto === null;
+};
+/** The agent to arm with - or, when the human NAMED one we cannot use, why not (said once,
+*  here, because a bad `jam.agent` is a config-file error like any other).
+*
+*  A named agent is never quietly swapped for another: running a different tool than the one
+*  asked for is worse than not running. Nor is one armed that cannot be spawned - that would
+*  claim every @marver mention, fail it, and never retry. */
+function resolveAgent(named) {
+	if (named === void 0) return detectAgent() ?? "no-agent";
+	if (named !== "claude" && named !== "codex") {
+		console.warn(`[marver] design/config.ts: jam.agent ${show(named)} is not an agent marver can spawn - Live Jam is off. Use "claude" or "codex".`);
+		return "bad-agent";
+	}
+	if (!onPath(named)) {
+		console.warn(`[marver] design/config.ts names jam.agent "${named}", which is not on PATH - Live Jam is off until it is installed.`);
+		return "bad-agent";
+	}
+	return named;
+}
+/** Resolve the jam block. Live Jam is ON by default: an absent or partial `jam` resolves
+*  to whatever agent CLI this machine has, so a fresh workspace jams with nothing
+*  configured and an old one needs no re-init. `jam: false` is the off switch. */
+function resolveJam(v) {
+	if (v === false) return "opted-out";
+	const shape = v === void 0 || v === true ? {} : typeof v === "string" ? { agent: v } : plainObject(v) ? v : null;
+	if (!shape) {
+		console.warn(`[marver] design/config.ts: jam must be false, an agent name, or an options object - got ${show(v)}. Live Jam is off.`);
+		return "bad-agent";
+	}
+	const j = shape;
+	const agent = resolveAgent(j.agent);
+	if (agent === "no-agent" || agent === "bad-agent") return agent;
+	const c = j.concurrency;
 	return {
-		agent: j.agent,
-		concurrency,
+		agent,
+		concurrency: typeof c === "number" && Number.isInteger(c) && c >= 1 && c <= 16 ? c : DEFAULT_CONCURRENCY,
 		subagents: j.subagents !== false,
 		proactive: j.proactive === true
 	};
 }
+/** Exactly one of `jam` (armed) or `jamOff` (why not) - so the dev server can speak up about
+*  the one off-state nothing has reported yet, and stay quiet about the rest. BOTH keys are
+*  always written: these spread over the user's own `jam`, and a raw `jam: false` reaching the
+*  server as config would arm the daemon against a truthy object check. */
+function jamFields(v) {
+	const r = resolveJam(v);
+	return typeof r === "string" ? {
+		jam: void 0,
+		jamOff: r
+	} : {
+		jam: r,
+		jamOff: void 0
+	};
+}
 function validViewports(v) {
 	if (!v || typeof v !== "object") return null;
 	const out = {};
@@ -214,7 +339,7 @@ function validViewports(v) {
 //#region src/server/manifest.ts
 const FRAME_EXT = /\.(tsx|jsx|html)$/;
 const RESERVED_SCENES = /* @__PURE__ */ new Set(["components", "screens"]);
-/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted (spec §6). */
+/** Extract `export const meta = {...}` with literal string values only. Anything else is silently omitted. */
 function extractMeta(src) {
 	const m = /export\s+const\s+meta\s*=\s*\{([\s\S]*?)\}/.exec(src);
 	if (!m) return {};
@@ -238,7 +363,7 @@ function extractMeta(src) {
 	if (intent) out.intent = intent;
 	return out;
 }
-/** Content-frame detection (SPEC-026): LEXICAL by convention - the frame file
+/** Content-frame detection: LEXICAL by convention - the frame file
 *  itself imports PKG/content (an import specifier scan, so "<Diagram" inside a
 *  string in a UI frame can never misbadge it; barrels/re-exports are not
 *  detected - meta.intent is the taught path and always works). Returns the
@@ -358,7 +483,7 @@ function scanFrames(root) {
 		})).sort((a, b) => a.name.localeCompare(b.name))
 	};
 }
-/** Variant groups (SPEC-023 §1). A group = 2+ frames in one DIRECTORY whose basenames
+/** Variant groups. A group = 2+ frames in one DIRECTORY whose basenames
 *  are letter-prefixed (`a-terminal`), or frames declaring `meta.of`. Group id = the
 *  directory's id prefix (or meta.of); variant key = the letter (or meta.variant).
 *  Nested directories scope alternatives inside a busy scene (checkout/payment/a-card).
@@ -439,4 +564,4 @@ function writeManifest(root, manifest) {
 }
 const hash = (s) => createHash("sha256").update(s).digest("hex");
 //#endregion
-export { DEFAULTS as a, readJson as c, writeManifest as i, hash as n, loadConfig as o, scanFrames as r, detectHost as s, affectedFrameIds as t };
+export { DEFAULTS as a, detectHost as c, writeManifest as i, readJson as l, hash as n, loadConfig as o, scanFrames as r, detectAgent as s, affectedFrameIds as t };

package/dist/{plugin-BVFuRfEo.mjs → plugin-BrBWk2Qn.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME, r as PKG } from "./cli.mjs";
 import { n as localProfile, t as isConnected } from "./profile-BkiWglVE.mjs";
-import { i as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-D3eaARf4.mjs";
+import { i as writeManifest, n as hash, r as scanFrames, t as affectedFrameIds } from "./manifest-DJHU7qfu.mjs";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, watch, writeFileSync } from "node:fs";
 import { basename, dirname, join, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -14,7 +14,7 @@ function cookie(req, name) {
 	const m = new RegExp(`(?:^|;\\s*)${name}=([^;]+)`).exec(String(req.headers.cookie ?? ""));
 	return m ? m[1] : "";
 }
-/** The owner gate (SPEC-live-jam §1). The dev server is 127.0.0.1-only, so the live threat is a
+/** The owner gate. The dev server is 127.0.0.1-only, so the live threat is a
 *  cross-origin drive-by page firing a POST at localhost. Two defenses, mirroring the published
 *  side (collab.ts:206): a double-submit cookie (mv_c is JS-readable same-origin, so a cross-origin
 *  page cannot read it to echo x-mv-c), plus an Origin allowlist. Only a POST that passes this is
@@ -185,7 +185,7 @@ function apiMiddleware(root) {
 				}
 				const dir = join(root, "design", ".local");
 				mkdirSync(dir, { recursive: true });
-				const { validAvatar } = await import("./collab-pLGzSvm5.mjs");
+				const { validAvatar } = await import("./collab-s3k5byM1.mjs");
 				let cur = {};
 				try {
 					cur = JSON.parse(readFileSync(join(dir, "profile.json"), "utf8"));
@@ -199,8 +199,40 @@ function apiMiddleware(root) {
 				atomicWrite(join(dir, "profile.json"), JSON.stringify(prof, null, 2) + "\n");
 				return json(res, 200, { user: localProfile(root) });
 			}
+			if (path === "work") {
+				const { workActivity, readDevInfo, WORK_TTL_DEFAULT, WORK_TTL_MAX } = await import("./work-CLrmY-vQ.mjs");
+				const tokenOk = () => {
+					const t = readDevInfo(root)?.token;
+					return !!t && req.headers["x-mv-work"] === t;
+				};
+				if (req.method === "GET") {
+					if (!ownerGated(req) && !tokenOk()) return json(res, 403, { error: "forbidden" });
+					return json(res, 200, { frames: workActivity.active() });
+				}
+				if (req.method === "POST") {
+					if (!ownerGated(req) && !tokenOk()) return json(res, 403, { error: "forbidden" });
+					const raw = await readBody(req);
+					if (raw == null) return json(res, 400, { error: "body too large" });
+					let b;
+					try {
+						b = JSON.parse(raw);
+					} catch {
+						return json(res, 400, { error: "malformed JSON" });
+					}
+					const frames = Array.isArray(b.frames) ? b.frames.filter((f) => typeof f === "string" && f) : [];
+					const on = b.on !== false;
+					if (!on && b.all === true) {
+						workActivity.clearAll("cli");
+						return json(res, 200, { frames: workActivity.active() });
+					}
+					if (!frames.length) return json(res, 400, { error: "frames required" });
+					const ttl = Math.min(Math.max(Number(b.ttlMs) || WORK_TTL_DEFAULT, 1e4), WORK_TTL_MAX);
+					for (const f of frames) on ? workActivity.mark(f, ttl, "cli") : workActivity.clear(f, "cli");
+					return json(res, 200, { frames: workActivity.active() });
+				}
+			}
 			if (path === "boards.rights" && req.method === "GET") {
-				const { listBoards } = await import("./comments-DSwMhdbZ.mjs");
+				const { listBoards } = await import("./comments-BZBKhKRO.mjs");
 				return json(res, 200, {
 					local: true,
 					stored: listBoards(join(root, "design", "comments"))
@@ -208,7 +240,7 @@ function apiMiddleware(root) {
 			}
 			const cm = /^comments\/([a-z0-9][a-z0-9-]*)$/.exec(path);
 			if (cm) {
-				const { appendEvents, readLog } = await import("./comments-DSwMhdbZ.mjs");
+				const { appendEvents, readLog } = await import("./comments-BZBKhKRO.mjs");
 				const dir = join(root, "design", "comments");
 				if (req.method === "GET") return json(res, 200, { events: readLog(dir, cm[1]) });
 				if (req.method === "POST") {
@@ -237,14 +269,14 @@ function apiMiddleware(root) {
 						};
 					});
 					const fresh = appendEvents(dir, cm[1], stamped);
-					const { record } = await import("./ledger-wFvEIEGi.mjs").then((n) => n.n);
+					const { record } = await import("./ledger-BgA7nQoH.mjs").then((n) => n.n);
 					for (const ev of fresh) if (ev.type === "create" || ev.type === "reply") record(root, cm[1], ev.id);
 					backgroundPush(root);
 					return json(res, 200, { accepted: fresh.length });
 				}
 			}
 			if (path === "sync" && req.method === "POST") {
-				const { loadCollab, syncOnce } = await import("./sync-Ch4Bymb1.mjs");
+				const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
 				const collab = loadCollab(root);
 				if (!collab) return json(res, 200, { connected: false });
 				try {
@@ -273,7 +305,7 @@ function backgroundPush(root) {
 	pushTimer = setTimeout(async () => {
 		pushTimer = null;
 		try {
-			const { loadCollab, syncOnce } = await import("./sync-Ch4Bymb1.mjs");
+			const { loadCollab, syncOnce } = await import("./sync-BJKKmy1n.mjs");
 			const collab = loadCollab(root);
 			if (collab) await syncOnce(root, collab);
 		} catch {}
@@ -454,7 +486,7 @@ function marverPlugin(ctx) {
 					zoomSpeed: config.zoomSpeed,
 					noTheme: themeFile() == null,
 					setup: setupPending,
-					projectName: basename(root)
+					projectName: config.share.name || basename(root)
 				})}`;
 			}
 			if (id === "\0virtual:sh-data") return "export default null";

package/dist/{serve-CwAfayJk.mjs → serve-CZqPnj19.mjs}

@@ -3,10 +3,29 @@ import { existsSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { extname, isAbsolute, join, relative, resolve } from "node:path";
 import { createHmac, randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
+//#region src/shared/utm.ts
+/** Automatic attribution for the powered-by links: every canvas tags its marver.design
+*  link so site analytics can see WHICH canvas sent a visitor - zero user setup.
+*  Conventional UTM semantics (stable groupings first, the variable last):
+*    utm_source   = the surface class ('published-canvas' | 'dev-canvas')
+*    utm_medium   = the link unit ('powered-by')
+*    utm_campaign = THIS canvas's name, slugged ("Marver tour" -> "marver-tour")
+*    utm_content  = the placement ('gate' badge | 'shell' wordmark)
+*/
+function poweredByUrl(canvasName, source, content) {
+	const slug = (canvasName ?? "").toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+	return `https://marver.design/?${new URLSearchParams({
+		utm_source: source,
+		utm_medium: "powered-by",
+		...slug ? { utm_campaign: slug } : {},
+		utm_content: content
+	}).toString()}`;
+}
+//#endregion
 //#region src/server/serve.ts
 /**
 * `marver serve` - a zero-dependency static server for design/.dist with an optional
-* password gate (SPEC-M2 §4b). No MARVER_PASSWORD → plain static serving. With it, the
+* password gate. No MARVER_PASSWORD → plain static serving. With it, the
 * bundle is never sent pre-auth: every unauthenticated request gets the gate page, auth
 * is a POST compare + an HMAC-signed 30-day cookie keyed off the password itself (all
 * instances agree, nothing stored server-side).
@@ -49,9 +68,9 @@ async function serve(root, portFlag) {
 	let bearerCheck = null;
 	let sessionCheck = null;
 	if (process.env.MARVER_DATA_DIR) {
-		const { collabHandler } = await import("./collab-pLGzSvm5.mjs");
-		const { appendEvents, readLog } = await import("./comments-DSwMhdbZ.mjs");
-		const { dataDir } = await import("./comments-DSwMhdbZ.mjs");
+		const { collabHandler } = await import("./collab-s3k5byM1.mjs");
+		const { appendEvents, readLog } = await import("./comments-BZBKhKRO.mjs");
+		const { dataDir } = await import("./comments-BZBKhKRO.mjs");
 		const dir = dataDir();
 		const seedDir = join(dist, "design", "comments");
 		if (existsSync(seedDir)) for (const f of readdirSync(seedDir)) {
@@ -60,7 +79,7 @@ async function serve(root, portFlag) {
 			appendEvents(join(dir, "comments"), board, readLog(seedDir, board));
 		}
 		collab = collabHandler(dir, dist);
-		const { loadStore, createInvite, normEmail, sessionUser } = await import("./auth-B36fMCM3.mjs");
+		const { loadStore, createInvite, normEmail, sessionUser } = await import("./auth-KQ9Aj-nB.mjs");
 		bearerCheck = (token) => sessionUser(dir, token);
 		sessionCheck = (req) => {
 			const tok = /(?:^|;\s*)mv_s=([\w-]+)/.exec(String(req.headers.cookie ?? ""))?.[1];
@@ -128,7 +147,12 @@ async function serve(root, portFlag) {
 				if (!bearerOk && !preGate) return gate(res, meta, !!collab);
 			}
 		}
-		if (collab && url.pathname.startsWith("/__mv/api/")) {
+		if (url.pathname.startsWith("/__mv/api/")) {
+			if (!collab) {
+				res.statusCode = 404;
+				res.setHeader("content-type", "application/json");
+				return res.end("{\"error\":\"collaboration is not enabled on this canvas\"}");
+			}
 			collab(req, res, url).then((handled) => {
 				if (!handled) {
 					res.statusCode = 404;
@@ -188,7 +212,7 @@ const MARK_AT = (size) => `<svg viewBox="0 0 256 256" width="${size}" height="${
 const MARK = MARK_AT(17);
 const MARK_LG = MARK_AT(24);
 /** The gate: the canvas's own antechamber - light ground, dot grid, glass card in the
-*  shell's exact token language. Three doors, one credential each (SPEC-M3 gate v2):
+*  shell's exact token language. Three doors, one credential each:
 *  guests pay the canvas password, members sign in with their OWN password, and an
 *  invite link (#/i/<token>) opens straight into the claim. The member and claim
 *  states exist only on collaboration canvases - a static canvas keeps one field. */
@@ -423,7 +447,7 @@ ${collabOn ? `
     ` : ""}
   })()
   <\/script>
-  ${meta.branding ? `<footer><a href="https://marver.design" target="_blank" rel="noopener">${MARK} <span>Powered by <span class="md">Marver.design</span></span> <svg class="up" viewBox="0 0 256 256" width="11" height="11" fill="currentColor" aria-hidden><path d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"/></svg></a></footer>` : ""}
+  ${meta.branding ? `<footer><a href="${poweredByUrl(meta.name, "published-canvas", "gate")}" target="_blank" rel="noopener">${MARK} <span>Powered by <span class="md">Marver.design</span></span> <svg class="up" viewBox="0 0 256 256" width="11" height="11" fill="currentColor" aria-hidden><path d="M200,64V168a8,8,0,0,1-16,0V83.31L69.66,197.66a8,8,0,0,1-11.32-11.32L172.69,72H88a8,8,0,0,1,0-16H192A8,8,0,0,1,200,64Z"/></svg></a></footer>` : ""}
 </main></body></html>`);
 }
 const esc = (s) => s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);

package/dist/{sync-Ch4Bymb1.mjs → sync-BJKKmy1n.mjs}

@@ -1,10 +1,10 @@
 import { t as diffEvents } from "./events-BMtBvvgU.mjs";
-import { appendEvents, listBoards, readLog } from "./comments-DSwMhdbZ.mjs";
+import { appendEvents, listBoards, readLog } from "./comments-BZBKhKRO.mjs";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 //#region src/server/sync.ts
 /**
-* Dev ↔ published comment sync (SPEC-M3 §2) - one merge rule, run from the dev side.
+* Dev ↔ published comment sync - one merge rule, run from the dev side.
 *
 * The published serve is the canonical home; the repo's design/comments/ is the
 * mirror the agent reads. Each exchange is: pull remote events → union into local

package/dist/work-CLrmY-vQ.mjs

@@ -0,0 +1,97 @@
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+//#region src/server/jam/activity.ts
+function createActivity(ttlMs = 9e4) {
+	const m = /* @__PURE__ */ new Map();
+	const cbs = [];
+	const frames = () => [...new Set([...m.keys()].map((k) => k.slice(k.indexOf("|") + 1)))];
+	const emit = () => {
+		const f = frames();
+		for (const cb of cbs) cb(f);
+	};
+	return {
+		mark(frame, ttl, src = "cli") {
+			if (!frame) return;
+			m.set(`${src}|${frame}`, Date.now() + (ttl ?? ttlMs));
+			emit();
+		},
+		clear(frame, src = "cli") {
+			if (m.delete(`${src}|${frame}`)) emit();
+		},
+		clearAll(src = "cli") {
+			let changed = false;
+			for (const k of [...m.keys()]) if (k.startsWith(`${src}|`)) {
+				m.delete(k);
+				changed = true;
+			}
+			if (changed) emit();
+		},
+		active: frames,
+		sweep() {
+			const now = Date.now();
+			let changed = false;
+			for (const [k, until] of m) if (until <= now) {
+				m.delete(k);
+				changed = true;
+			}
+			if (changed) emit();
+		},
+		onChange(fn) {
+			cbs.push(fn);
+			return () => {
+				const i = cbs.indexOf(fn);
+				if (i !== -1) cbs.splice(i, 1);
+			};
+		}
+	};
+}
+//#endregion
+//#region src/server/work.ts
+/**
+* The working-state rail for CHAT-driven agents (the jam daemon has its own in-process
+* path into the same set). A coding agent that just accepted a request creates the frame
+* files first, then `npx marver work start <frame...>` - the canvas shows the live
+* working shimmer before a single component exists. `marver work done` clears it.
+*
+* Transport: the dev server writes design/.local/dev.json ({port, token}) at boot; the
+* CLI reads it to find the server and authenticate. The token makes the endpoint
+* unreachable from a drive-by browser page (which cannot read local files), while any
+* process that can read the repo - the owner's own tools - is trusted by definition.
+* Presence itself NEVER touches disk (activity.ts).
+*/
+/** One per process - the dev server, the jam daemon, and the API all share it. */
+const workActivity = createActivity();
+/** The longest a CLI mark may glow unrefreshed - a forgotten `done` self-heals. */
+const WORK_TTL_MAX = 18e5;
+const WORK_TTL_DEFAULT = 6e5;
+const infoPath = (root) => join(root, "design", ".local", "dev.json");
+/** Written once per boot (dev.ts), removed on close - the CLI's discovery + credential. */
+function writeDevInfo(root, port) {
+	const token = randomBytes(24).toString("base64url");
+	mkdirSync(join(root, "design", ".local"), { recursive: true });
+	writeFileSync(infoPath(root), JSON.stringify({
+		port,
+		token,
+		ts: Date.now()
+	}, null, 2) + "\n");
+	return token;
+}
+function removeDevInfo(root) {
+	try {
+		rmSync(infoPath(root), { force: true });
+	} catch {}
+}
+function readDevInfo(root) {
+	try {
+		const v = JSON.parse(readFileSync(infoPath(root), "utf8"));
+		return typeof v?.port === "number" && typeof v?.token === "string" ? {
+			port: v.port,
+			token: v.token
+		} : null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+export { WORK_TTL_DEFAULT, WORK_TTL_MAX, readDevInfo, removeDevInfo, workActivity, writeDevInfo };

package/dist/work-lzC-lPY0.mjs

@@ -0,0 +1,76 @@
+import { n as NAME } from "./cli.mjs";
+import { WORK_TTL_DEFAULT, WORK_TTL_MAX, readDevInfo } from "./work-CLrmY-vQ.mjs";
+//#region src/cli/work.ts
+/**
+* `marver work` - the coding agent's hand on the canvas working state.
+*
+*   work start <scene/frame ...> [--ttl <minutes>]   mark frames actively working
+*   work done  <scene/frame ...> | --all             clear the glow
+*   work list                                        what is glowing right now
+*
+* The intended choreography (taught in design/AGENTS.md): on accepting a request,
+* create the frame FILES first (name, meta, a minimal skeleton), pin them on the
+* right board, `work start` them - the human sees the request land on the canvas
+* within seconds - build (independent frames in parallel, one subagent each), then
+* `work done`. Marks self-expire (default 10 min, max 30) so a crashed agent can
+* never leave a frame glowing forever.
+*/
+async function workCommand(root, action, frames, opts) {
+	const info = readDevInfo(root);
+	if (!info) throw new Error(`\`${NAME} dev\` is not running in this repo (design/.local/dev.json not found) - start it first.`);
+	const call = async (method, body) => {
+		let res;
+		try {
+			res = await fetch(`http://localhost:${info.port}/__mv/api/work`, {
+				method,
+				headers: {
+					"content-type": "application/json",
+					"x-mv-work": info.token
+				},
+				...body === void 0 ? {} : { body: JSON.stringify(body) }
+			});
+		} catch {
+			throw new Error(`could not reach \`${NAME} dev\` on port ${info.port} - is it still running?`);
+		}
+		const data = await res.json().catch(() => ({}));
+		if (res.status === 403) throw new Error(`the dev server refused the token - it likely restarted; try again (design/.local/dev.json is re-read each run)`);
+		if (!res.ok) throw new Error(String(data?.error ?? `work ${action} failed (${res.status})`));
+		if (!Array.isArray(data?.frames)) throw new Error(`port ${info.port} did not answer like \`${NAME} dev\` - is it still running?`);
+		return data;
+	};
+	switch (action) {
+		case "start": {
+			if (!frames.length) throw new Error("name the frames: work start <scene/frame ...>");
+			const min = Number(opts.ttl);
+			const ttlMs = Number.isFinite(min) && min > 0 ? Math.min(Math.max(min * 6e4, 1e4), WORK_TTL_MAX) : WORK_TTL_DEFAULT;
+			const { frames: active } = await call("POST", {
+				frames,
+				on: true,
+				ttlMs
+			});
+			const pretty = ttlMs >= 6e4 ? `${Math.round(ttlMs / 6e4)} min` : `${Math.round(ttlMs / 1e3)} s`;
+			console.log(`working: ${active.join(", ")}   (auto-expires in ${pretty} - re-run to extend, \`work done\` to clear)`);
+			return;
+		}
+		case "done": {
+			if (!frames.length && !opts.all) throw new Error("name the frames (or --all): work done <scene/frame ...>");
+			const { frames: active } = await call("POST", opts.all ? {
+				on: false,
+				all: true
+			} : {
+				frames,
+				on: false
+			});
+			console.log(active.length ? `still working: ${active.join(", ")}` : "nothing working - all clear");
+			return;
+		}
+		case "list": {
+			const { frames: active } = await call("GET");
+			console.log(active.length ? active.join("\n") : "nothing working");
+			return;
+		}
+		default: throw new Error(`unknown action "${action}" - use start · done · list`);
+	}
+}
+//#endregion
+export { workCommand };

package/package.json

@@ -1,10 +1,24 @@
 {
   "name": "@marver-design/marver",
-  "version": "0.8.0",
-  "description": "The agent-native design canvas. A design/ folder, one command, a canvas of live frames built from your repo's real components. The tool ships no AI - your coding agent is the designer.",
+  "version": "0.9.0",
+  "description": "The agent-native design canvas. A design/ folder, one command, a canvas of live frames built from your repo's real components - comment @marver and your own coding agent does the work. The tool ships no AI.",
   "type": "module",
   "private": false,
   "license": "Apache-2.0",
+  "author": "Nic Touron (https://github.com/TNEP4)",
+  "keywords": [
+    "design",
+    "canvas",
+    "agent",
+    "prototyping",
+    "design-tool",
+    "react",
+    "vite",
+    "tailwind"
+  ],
+  "bugs": {
+    "url": "https://github.com/TNEP4/marver/issues"
+  },
   "bin": {
     "marver": "dist/cli.mjs"
   },
@@ -55,6 +69,7 @@
   "engines": {
     "node": ">=22.18.0"
   },
+  "packageManager": "pnpm@11.0.8",
   "homepage": "https://marver.design",
   "repository": {
     "type": "git",

package/src/client/const.ts

@@ -4,7 +4,7 @@ export const NAME = 'marver'
 export const PKG = '@marver-design/marver'   // registry identity; bin stays `marver`
 export const ROUTE = '/__mv'
 
-/** Content-frame natural widths (SPEC-026): Doc layout -> own-size width.
+/** Content-frame natural widths: Doc layout -> own-size width.
  *  Shared by the Doc primitive (measurement messages) and the server-side
  *  manifest scan (defaultSize for content frames) - one source, no drift. */
 export const CONTENT_WIDTH: Record<string, number> = { document: 760, wide: 1280 }

package/src/client/content/diagram.tsx

@@ -1,5 +1,5 @@
 /**
- * The Diagram block - first-class Mermaid (SPEC-026).
+ * The Diagram block - first-class Mermaid.
  * Mermaid is marver's dependency behind a dynamic import: a workspace with no
  * Diagram loads no mermaid bytes. Source-level theme overrides (%%{init}%%,
  * yaml frontmatter) are stripped so the marver palette always holds; the