@marver-design/marver 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -2,6 +2,78 @@
 
 Notable changes to `@marver-design/marver`. Format follows [Keep a Changelog](https://keepachangelog.com); versions follow semver.
 
+## 0.10.0 - 2026-08-21
+
+### Added
+
+- **Live Jam speaks five more agent CLIs: Cursor, droid (Factory), opencode, grok, and pi**,
+  alongside claude and codex - which also covers the apps built on them (Factory drives
+  `droid`, Cursor drives `cursor-agent`, Conductor drives `claude`). Each adapter spawns its
+  CLI headless with the same posture claude set: edits yes, shell no (or OS-sandboxed) -
+  cursor runs with its sandbox forced on and never gets `--force`, droid loses its shell,
+  delegation, and connector tools, opencode runs under a per-spawn default-deny permission
+  grant, grok has its shell and subagents removed, pi's tool allowlist simply omits bash. Detection knows their env markers (`CURSOR_AGENT`,
+  `OPENCODE`, `PI_CODING_AGENT`; droid and grok set none and are found by PATH), and
+  `jam: "droid"` in the config block names one exactly as before. The Live Jam guide carries
+  the full spawn-and-jail table.
+
+- **The verify loop: agents can now SEE what they built.** Field feedback from 0.9.0: a
+  jam agent shipped variants that were blank at render time, because no-shell (deliberate -
+  the job packet carries untrusted text) also meant no screenshots. The answer is a jailed
+  capability, not a shell: `GET /api/shot?frame=<id>&theme=<t>` on the dev server renders
+  the frame with the machine's own headless Chrome (CDP over Node's built-in WebSocket -
+  zero new dependencies) and returns a PNG under `design/.local/shots/`. Two transports,
+  because the no-shell jail rules out the obvious one: a **file-drop inbox** (the agent
+  writes a `<slug>.request.json`, the dev server renders and writes a `<slug>.result.json`
+  with the PNG path) works for every agent including Claude Code, whose WebFetch refuses
+  localhost; and `npx marver shot <frame>` / `GET /api/shot` for shell-ful agents and
+  humans. The inbox watcher pairs `fs.watch` with a 1s sweep, so a request lands even on
+  filesystems where watching is flaky (macOS temp, network mounts) - the same belt-and-
+  braces the comments daemon uses. Readiness is deterministic (root mounted, fonts ready);
+  a failed navigation, an unreachable server, or a frame that threw at render all return an
+  honest `{ok:false,error}` carrying the real cause (the frame's own exception, surfaced via
+  the frame host) rather than a blank that reads as success - so even an agent whose model
+  cannot read images still learns from the JSON whether the frame rendered. The generated
+  jam instructions require: shoot, read the result, LOOK at the PNG when you can - and say
+  so honestly when you cannot. Verified live: Claude Code screenshotted a tour frame through
+  the file-drop path and read back its real headline; Claude, Codex, Cursor, grok, and pi
+  all read a rendered PNG correctly in isolation (opencode's configured model has no vision,
+  and degrades to the JSON signal).
+- **A troubleshooting drill written for the agent, with an upstream loop**
+  (`design/instructions/jam.md`): boot line first, then the raw run log in
+  `design/.local/jam-logs/`, then the CLI's own headless auth check - fix what belongs to
+  the workspace (a wrong `jam.agent`, a logged-out CLI), and file what belongs to marver
+  at github.com/TNEP4/marver/issues with the evidence and, when debugging surfaced one,
+  the patch. The give-up reply on the canvas now points at the same drill.
+
+### Fixed
+
+- **The daemon pins `PWD` to the workspace when spawning an agent.** `spawn(cwd:)` changes
+  the directory but not the inherited env var, and some CLIs (opencode, verified) trust
+  `PWD` over `getcwd` - a dev server whose own cwd differed from the repo root would have
+  had the agent editing the wrong directory.
+- **The early ack no longer leaks plan narration into the thread.** A first message like
+  "On it...\n\nNow let me gather context: ..." posted the note-to-self along with the ack;
+  a fenceless ack is now trimmed to its first paragraph (a fenced first message stays whole).
+- **`/api/shot` is owner/token gated**, so a cross-origin page can't trigger the browser it
+  spawns; the `marver shot` CLI sends the dev-session token, and the file-drop jam path is
+  unaffected. It also renders from the dev server's actual listening address, not the
+  client-supplied Host header. And a hung headless Chrome can no longer wedge the shot queue -
+  a watchdog kills it past a deadline and settles every in-flight CDP call.
+- **The working glow follows the agent to the frames it actually builds.** A comment on one
+  frame whose answer is several NEW frames ("one frame per page") left the glow stuck on the
+  commented frame. Jam agents have no shell to run `marver work`, so the daemon now moves the
+  glow itself: it watches which frames the agent creates or edits during the job, lights those,
+  and clears the commented frame once the agent is clearly building elsewhere.
+- **Tighter agent jails, verified live.** grok's shell was actually reachable - its deny-list
+  named `run_terminal_cmd` but the real tool is `run_terminal_command`, so the flag missed and
+  a prompt-injected comment could run commands. grok now uses a read/edit tool ALLOWLIST (no
+  shell, no web, no subagents - a name a deny-list can't miss). opencode runs `--pure` so a
+  repo plugin can't execute outside its permission grant. Every other CLI's shell containment
+  was re-checked against the real binary (Cursor's OS sandbox blocks network egress; pi and
+  droid have no shell tool) rather than assumed. The Live Jam guide now states the trust model
+  plainly: your own agent, on your machine, every diff reviewed - not an airtight sandbox.
+
 ## 0.9.0 - 2026-08-21
 
 ### Added

package/README.md

@@ -46,9 +46,9 @@ Frames appear on the canvas the moment the files land. That's the loop.
 
 ## Live Jam
 
-Tag `@marver` in a comment and your own coding agent picks it up - reads the thread, edits the real frame source, replies with a receipt - while the frame wears a live working glow. Nothing to start and nothing to wire: it rides along with `marver dev`, on by default, armed with whichever agent CLI you have. The tool running the process wins, then whatever is on PATH, and `init` writes what it found into `design/config.ts` as `jam: { agent: "claude", concurrency: 6 }` - visible, one word to correct, `jam: false` to switch off.
+Tag `@marver` in a comment and your own coding agent picks it up - reads the thread, edits the real frame source, replies with a receipt - while the frame wears a live working glow. Nothing to start and nothing to wire: it rides along with `marver dev`, on by default, armed with whichever agent CLI you have - Claude Code, Codex, Cursor, Factory's droid, opencode, grok, or pi, which also covers the apps built on them. The tool running the process wins, then whatever is on PATH, and `init` writes what it found into `design/config.ts` as `jam: { agent: "claude", concurrency: 6 }` - visible, one word to correct, `jam: false` to switch off.
 
-The trust boundary is hard: only comments written on the owner's machine trigger (a device-bound ledger - a drive-by comment on a published canvas cannot start work), the agent runs locked down (Claude Code with shell disabled entirely; Codex confined to its workspace-write sandbox), and every reply carries provenance: which agent ran it, as which dev user, on which model when the agent names one. Marver ships no AI; the agent that acts is the one you already run. The [Live Jam guide](docs/live-jam.md) has the config block, the two sandboxes, and what to check when a mention does nothing.
+The trust boundary is hard: only comments written on the owner's machine trigger (a device-bound ledger - a drive-by comment on a published canvas cannot start work), the agent runs locked down (each CLI with its shell removed or OS-sandboxed - the per-agent table is in the guide), and every reply carries provenance: which agent ran it, as which dev user, on which model when the agent names one. Marver ships no AI; the agent that acts is the one you already run. The [Live Jam guide](docs/live-jam.md) has the config block, every agent's jail, and what to check when a mention does nothing.
 
 ## Working state
 

package/dist/{build-D9gimz6K.mjs → build-Dd91jjIg.mjs}

@@ -1,6 +1,6 @@
 import { i as ROUTE, n as NAME } from "./cli.mjs";
-import { c as detectHost, o as loadConfig, r as scanFrames } from "./manifest-DJHU7qfu.mjs";
-import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-BrBWk2Qn.mjs";
+import { l as detectHost, r as scanFrames, s as loadConfig } from "./manifest-DIsp3ldB.mjs";
+import { n as tailwind3Css, r as tailwind4Plugin, t as marverPlugin } from "./plugin-CgLVYTR-.mjs";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, sep } from "node:path";
 import { fileURLToPath } from "node:url";

package/dist/cli.mjs

@@ -39,14 +39,14 @@ function version() {
 }
 const cli = cac(NAME);
 cli.command("init", "Scaffold design/ in this repo").option("--mode <mode>", "studio | embedded", { default: "studio" }).option("--no-demo", "Skip the demo scene (the demo ships unless this flag is passed)").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { init } = await import("./init-8Giknvy1.mjs");
+	const { init } = await import("./init-D2EQEbV6.mjs");
 	init(resolve(opts.root), {
 		mode: opts.mode === "embedded" ? "embedded" : "studio",
 		demo: opts.demo !== false
 	});
 });
 for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot reload, comments, Live Jam)"], ["canvas", "Start the local canvas - same as dev"]]) cli.command(name, desc).option("--root <dir>", "Host repo root", { default: "." }).option("--port <port>", "Port (default 5199)").action(async (opts) => {
-	const { dev } = await import("./dev-CTtkqVo_.mjs");
+	const { dev } = await import("./dev-Dv0GlYQq.mjs");
 	let port;
 	if (opts.port !== void 0) {
 		const n = Number(opts.port);
@@ -56,7 +56,7 @@ for (const [name, desc] of [["dev", "Start the local canvas (everything on: hot
 	await dev(resolve(opts.root), port);
 });
 cli.command("build", "Static export → design/.dist (what ships comes from design/publish.json - publishing is default-closed)").option("--boards <names>", "Publish only these boards (comma-separated); overrides the publish policy").option("--all-boards", "Publish every board - the loud override for the default-closed policy").option("--root <dir>", "Host repo root", { default: "." }).action(async (opts) => {
-	const { buildSite } = await import("./build-D9gimz6K.mjs");
+	const { buildSite } = await import("./build-Dd91jjIg.mjs");
 	try {
 		const boards = opts.boards === void 0 ? void 0 : typeof opts.boards === "string" ? opts.boards : "";
 		await buildSite(resolve(opts.root), boards, opts.allBoards === true);
@@ -92,6 +92,15 @@ cli.command("work <action> [...frames]", "Working state on the canvas: start <sc
 		process.exit(1);
 	}
 });
+cli.command("shot <frame>", "Render one frame headless and print the PNG path (needs `dev` running)").option("--root <dir>", "Host repo root", { default: "." }).option("--theme <name>", "Theme to render (default: light)").action(async (frame, opts) => {
+	const { shotCommand } = await import("./shot-DkkwuCZ2.mjs");
+	try {
+		await shotCommand(resolve(opts.root), frame, opts);
+	} catch (err) {
+		console.error(`[${NAME}] ${err.message}`);
+		process.exit(1);
+	}
+});
 cli.help();
 cli.version(version());
 cli.parse();