@marver-design/marver 0.8.1 → 0.10.0

package/CHANGELOG.md

@@ -2,6 +2,149 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.10.0 - 2026-08-21
+
+### Added
+
+- **Live Jam speaks five more agent CLIs: Cursor, droid (Factory), opencode, grok, and pi**,
+  alongside claude and codex - which also covers the apps built on them (Factory drives
+  `droid`, Cursor drives `cursor-agent`, Conductor drives `claude`). Each adapter spawns its
+  CLI headless with the same posture claude set: edits yes, shell no (or OS-sandboxed) -
+  cursor runs with its sandbox forced on and never gets `--force`, droid loses its shell,
+  delegation, and connector tools, opencode runs under a per-spawn default-deny permission
+  grant, grok has its shell and subagents removed, pi's tool allowlist simply omits bash. Detection knows their env markers (`CURSOR_AGENT`,
+  `OPENCODE`, `PI_CODING_AGENT`; droid and grok set none and are found by PATH), and
+  `jam: "droid"` in the config block names one exactly as before. The Live Jam guide carries
+  the full spawn-and-jail table.
+
+- **The verify loop: agents can now SEE what they built.** Field feedback from 0.9.0: a
+  jam agent shipped variants that were blank at render time, because no-shell (deliberate -
+  the job packet carries untrusted text) also meant no screenshots. The answer is a jailed
+  capability, not a shell: `GET /api/shot?frame=<id>&theme=<t>` on the dev server renders
+  the frame with the machine's own headless Chrome (CDP over Node's built-in WebSocket -
+  zero new dependencies) and returns a PNG under `design/.local/shots/`. Two transports,
+  because the no-shell jail rules out the obvious one: a **file-drop inbox** (the agent
+  writes a `<slug>.request.json`, the dev server renders and writes a `<slug>.result.json`
+  with the PNG path) works for every agent including Claude Code, whose WebFetch refuses
+  localhost; and `npx marver shot <frame>` / `GET /api/shot` for shell-ful agents and
+  humans. The inbox watcher pairs `fs.watch` with a 1s sweep, so a request lands even on
+  filesystems where watching is flaky (macOS temp, network mounts) - the same belt-and-
+  braces the comments daemon uses. Readiness is deterministic (root mounted, fonts ready);
+  a failed navigation, an unreachable server, or a frame that threw at render all return an
+  honest `{ok:false,error}` carrying the real cause (the frame's own exception, surfaced via
+  the frame host) rather than a blank that reads as success - so even an agent whose model
+  cannot read images still learns from the JSON whether the frame rendered. The generated
+  jam instructions require: shoot, read the result, LOOK at the PNG when you can - and say
+  so honestly when you cannot. Verified live: Claude Code screenshotted a tour frame through
+  the file-drop path and read back its real headline; Claude, Codex, Cursor, grok, and pi
+  all read a rendered PNG correctly in isolation (opencode's configured model has no vision,
+  and degrades to the JSON signal).
+- **A troubleshooting drill written for the agent, with an upstream loop**
+  (`design/instructions/jam.md`): boot line first, then the raw run log in
+  `design/.local/jam-logs/`, then the CLI's own headless auth check - fix what belongs to
+  the workspace (a wrong `jam.agent`, a logged-out CLI), and file what belongs to marver
+  at github.com/TNEP4/marver/issues with the evidence and, when debugging surfaced one,
+  the patch. The give-up reply on the canvas now points at the same drill.
+
+### Fixed
+
+- **The daemon pins `PWD` to the workspace when spawning an agent.** `spawn(cwd:)` changes
+  the directory but not the inherited env var, and some CLIs (opencode, verified) trust
+  `PWD` over `getcwd` - a dev server whose own cwd differed from the repo root would have
+  had the agent editing the wrong directory.
+- **The early ack no longer leaks plan narration into the thread.** A first message like
+  "On it...\n\nNow let me gather context: ..." posted the note-to-self along with the ack;
+  a fenceless ack is now trimmed to its first paragraph (a fenced first message stays whole).
+- **`/api/shot` is owner/token gated**, so a cross-origin page can't trigger the browser it
+  spawns; the `marver shot` CLI sends the dev-session token, and the file-drop jam path is
+  unaffected. It also renders from the dev server's actual listening address, not the
+  client-supplied Host header. And a hung headless Chrome can no longer wedge the shot queue -
+  a watchdog kills it past a deadline and settles every in-flight CDP call.
+- **The working glow follows the agent to the frames it actually builds.** A comment on one
+  frame whose answer is several NEW frames ("one frame per page") left the glow stuck on the
+  commented frame. Jam agents have no shell to run `marver work`, so the daemon now moves the
+  glow itself: it watches which frames the agent creates or edits during the job, lights those,
+  and clears the commented frame once the agent is clearly building elsewhere.
+- **Tighter agent jails, verified live.** grok's shell was actually reachable - its deny-list
+  named `run_terminal_cmd` but the real tool is `run_terminal_command`, so the flag missed and
+  a prompt-injected comment could run commands. grok now uses a read/edit tool ALLOWLIST (no
+  shell, no web, no subagents - a name a deny-list can't miss). opencode runs `--pure` so a
+  repo plugin can't execute outside its permission grant. Every other CLI's shell containment
+  was re-checked against the real binary (Cursor's OS sandbox blocks network egress; pi and
+  droid have no shell tool) rather than assumed. The Live Jam guide now states the trust model
+  plainly: your own agent, on your machine, every diff reviewed - not an airtight sandbox.
+
+## 0.9.0 - 2026-08-21
+
+### Added
+
+- **A Live Jam guide** (`docs/live-jam.md`), now that the feature arrives armed rather than
+  opted into: how the agent is chosen and how to correct it, every key in the config block,
+  what each of the two CLIs is allowed to do, where the trust boundary sits, and what to
+  check when a mention does nothing.
+
+### Changed
+
+- **Live Jam is on by default, at concurrency 6.** Tagging `@marver` in a comment was the
+  headline workflow and a config edit stood in front of it. Now it arms itself: the tool
+  RUNNING the process wins (its env markers are evidence, and `init` is usually run by the
+  agent), then whatever is on PATH, claude first. That last tie-break is a guess, which is
+  why the answer is made visible rather than clever - `init` prints the agent it chose and
+  writes it into `design/config.ts` in plain sight as
+  `jam: { agent: "claude", concurrency: 6 }`, and the generated instructions have the agent
+  confirm that line names the tool it actually is. One word to correct, once per repo.
+  Workspaces that predate the block need no re-init; they resolve the same way at every
+  dev boot. `jam: false` is the off switch, and `jam: "codex"` is shorthand for naming the
+  agent. Six frames at once replaces three - at three, half of a multi-frame ask sat
+  waiting on the other half while the human watched. With no agent CLI installed, jam stays
+  off and both `init` and `marver dev` say so instead of going quiet.
+- **A named agent is never quietly swapped, nor armed when it cannot run.** `jam.agent`
+  naming something marver cannot spawn turns Live Jam off with a printed reason rather than
+  detecting some other tool and answering the human's comments with it; the same applies
+  when the named CLI is not on PATH, which used to claim every mention and then fail it. A
+  `design/config.ts` that fails to parse also leaves jam off - it may have said `jam: false`,
+  and arming a process spawn against intent we cannot read is the one wrong-way error worth
+  avoiding.
+- **`jam.subagents` does something now, and Codex fans out too.** The setting existed but never
+  reached the spawned agent, which reads no config - so the parallel-frame policy is stated in
+  the job prompt, and turning it off keeps a job on a single agent. The Codex adapter had also
+  been marked as having no subagents; `codex exec` carries `collaboration.spawn_agent`, so a
+  multi-frame Codex job now fans out the way a Claude Code one does. The prompt only ever says
+  "you MAY", so an older CLI without those tools just works serially instead of failing.
+- **Worth knowing, now that it is on by default:** the two agents are locked down differently,
+  because their CLIs differ. Claude Code is spawned with shell access removed entirely
+  (`--disallowedTools Bash`); Codex runs in its own `workspace-write` sandbox, which bounds
+  what commands can *touch* but still lets the model run them. Both are confined to the
+  workspace, and every change is a diff you review.
+
+### Fixed
+
+- **A one-message agent no longer posts the raw reply fence into the thread.** Live Jam posts
+  the agent's first streamed message as an immediate ack. Codex emits a single message at the
+  very end, carrying the completion block, and a fast Claude Code run can do the same - so the
+  ack was the finished reply, fence and all, followed by a second message with the same words.
+  The early path now normalizes exactly like the final one, which also makes the existing
+  duplicate check catch it: one clean reply.
+
+- **The jam ledger and journal are bound to the machine that wrote them.** Both live in
+  `design/.local/`, which is gitignored and never synced - but gitignore is a convention,
+  not provenance: a repo can force-add its own `.local/` and hand a clone a pre-authorized
+  ledger plus a pre-baselined journal. Each line and file now carries a device stamp, so
+  jam state that arrived with a clone is read as absent. The stamp is derived from the
+  machine, not stored (marver writes nothing outside `design/`), so it stops one repo
+  published to everyone rather than someone who already knows your machine - and the larger
+  caution is unchanged either way: `marver dev` imports and executes `design/config.ts`, so
+  running a dev server in a repo you do not trust is already running its code.
+  One-time upgrade cost: an existing journal predates the stamp, so the first boot after
+  upgrading rebaselines - any `@marver` mention left unprocessed while the server was down
+  is marked seen instead of run. Re-comment to pick it up.
+
+- **Comments wear the brand blue.** Pins, thread cards, the comment-mode pick cursor and
+  the anchored-thread chrome move off systemGreen. Interact keeps purple, and green is now
+  reserved for the done state alone - in dark mode the comment and done greens had drifted
+  to the same value, so a frame carrying threads and a frame that had just landed a change
+  looked alike. A pin, a thread card and a selected frame are told apart by shape.
+
 ## 0.8.1 - 2026-08-19
 
 ### Added

package/README.md

@@ -6,7 +6,7 @@
 
 **The agent-native design canvas.** A `design/` folder in your repo, one command, and a canvas of live frames built from your app's real components and theme. Your coding agent designs by writing files; the tool ships no AI.
 
-[marver.design](https://marver.design) · [Deploying a canvas](docs/publish.md) · [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Issues](https://github.com/TNEP4/marver/issues)
+[marver.design](https://marver.design) · [Live Jam](docs/live-jam.md) · [Deploying a canvas](docs/publish.md) · [Changelog](CHANGELOG.md) · [Contributing](CONTRIBUTING.md) · [Issues](https://github.com/TNEP4/marver/issues)
 
 ## Quickstart
 
@@ -27,6 +27,7 @@ Frames appear on the canvas the moment the files land. That's the loop.
 - **Frames are real code.** Plain TSX/HTML files rendered from your repo's actual components and theme - zero imports from this package required. An approved design promotes into the app by moving a file, not by re-implementing a picture.
 - **Everything hot-reloads.** The agent writes, you watch it land - live.
 - **True viewports.** Each frame is a real iframe: drag its edge and your actual breakpoints fire.
+- **Your agent answers on the canvas.** Tag `@marver` in a comment and it picks up the job, edits the real source, and replies in the thread - no wiring, on by default. See [Live Jam](#live-jam).
 - **No AI inside.** The designer is the coding agent you already run and pay for. `init` generates the `design/AGENTS.md` contract that teaches it the whole workflow.
 
 ## The canvas
@@ -45,9 +46,9 @@ Frames appear on the canvas the moment the files land. That's the loop.
 
 ## Live Jam
 
-Tag `@marver` in a comment and your own coding agent picks it up - reads the thread, edits the real frame source, replies with a receipt - while the frame wears a live working glow. Opt in with `jam: { agent: "claude" }` (or `"codex"`) in `design/config.ts`.
+Tag `@marver` in a comment and your own coding agent picks it up - reads the thread, edits the real frame source, replies with a receipt - while the frame wears a live working glow. Nothing to start and nothing to wire: it rides along with `marver dev`, on by default, armed with whichever agent CLI you have - Claude Code, Codex, Cursor, Factory's droid, opencode, grok, or pi, which also covers the apps built on them. The tool running the process wins, then whatever is on PATH, and `init` writes what it found into `design/config.ts` as `jam: { agent: "claude", concurrency: 6 }` - visible, one word to correct, `jam: false` to switch off.
 
-The trust boundary is hard: only comments written on the owner's machine trigger (a device-bound ledger - a drive-by comment on a published canvas cannot start work), the agent runs locked down (Claude Code with shell disabled entirely; Codex confined to its workspace-write sandbox), and every reply carries provenance: agent, model, dev user. Marver ships no AI; the agent that acts is the one you already run.
+The trust boundary is hard: only comments written on the owner's machine trigger (a device-bound ledger - a drive-by comment on a published canvas cannot start work), the agent runs locked down (each CLI with its shell removed or OS-sandboxed - the per-agent table is in the guide), and every reply carries provenance: which agent ran it, as which dev user, on which model when the agent names one. Marver ships no AI; the agent that acts is the one you already run. The [Live Jam guide](docs/live-jam.md) has the config block, every agent's jail, and what to check when a mention does nothing.
 
 ## Working state
 
@@ -58,7 +59,7 @@ The same glow, driven from the terminal. When your agent takes a request, it cre
 | Command | What it does |
 |---|---|
 | `npx marver init` | Scaffold `design/` in this repo (safe to re-run; refreshes managed files) |
-| `npx marver dev` / `canvas` | Start the local canvas - hot reload, comments, Live Jam (`--port`, default 5199) |
+| `npx marver dev` / `canvas` | Start the local canvas - hot reload, comments, Live Jam armed (`--port`, default 5199) |
 | `npx marver build` | Static export → `design/.dist`; what ships comes from `design/publish.json` (default-closed) |
 | `npx marver serve` | Serve the export; `MARVER_PASSWORD` gates it, `MARVER_DATA_DIR` persists comments + accounts |
 | `npx marver comments …` | The agent's queue: `connect <url>` · `sync` · `list` · `reply` · `resolve` · `invite <email>` · `revoke <email>` |

package/dist/{build-BBVQRetk.mjs → build-Dd91jjIg.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
-import { o as loadConfig, r as scanFrames, s as detectHost } from "./manifest-B4zcDGBf.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BdQEeTLg.mjs";
+import { l as detectHost, r as scanFrames, s as loadConfig } from "./manifest-DIsp3ldB.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-CgLVYTR-.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/cli.mjs

@@ -39,14 +39,14 @@ function version() {
 }
 const cli = cac(NAME);
 cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "studio | embedded", { default: "studio" }).option("--no-demo", "Skip the demo scene (the demo ships unless this flag is passed)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { init } = await import("./init-DWdhjJD5.mjs");
+	const { init } = await import("./init-D2EQEbV6.mjs");
 	init(resolve(opts.root), {
 		mode: opts.mode === "embedded" ? "embedded" : "studio",
 		demo: opts.demo !== false
 	});
 });
 for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot reload, comments, Live Jam)"], ["canvas", "Start the local canvas - same as dev"]]) cli.command(name, desc).option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-BTAhTie-.mjs");
+	const { dev } = await import("./dev-Dv0GlYQq.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -56,7 +56,7 @@ for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot
 	await dev(resolve(opts.root), port);
 });
 cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-BBVQRetk.mjs");
+	const { buildSite } = await import("./build-Dd91jjIg.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
 		await buildSite(resolve(opts.root), boards, opts.allBoards === true);
@@ -92,6 +92,15 @@ cli.command("work <action> [...frames]", "Working state on the canvas: start <sc
 		process.exit(1);
 	}
 });
+cli.command("shot <frame>", "Render one frame headless and print the PNG path (needs `dev` running)").option("--root <dir>", "Host repo root", { default: "." }).option("--theme <name>", "Theme to render (default: light)").action(async (frame, opts) => {
+	const { shotCommand } = await import("./shot-DkkwuCZ2.mjs");
+	try {
+		await shotCommand(resolve(opts.root), frame, opts);
+	} catch (err) {
+		console.error(`[${NAME}] ${err.message}`);
+		process.exit(1);
+	}
+});
 cli.help();
 cli.version(version());
 cli.parse();