@zvada/cr8 0.1.0 → 0.3.0

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cr8",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "A local-first design canvas shared by people and AI agents.",
   "author": {
     "name": "Adam Zvada",
@@ -13,10 +13,8 @@
       "command": "npx",
       "args": [
         "-y",
-        "@zvada/cr8@0.1.0",
-        "mcp",
-        "--workspace",
-        "${CLAUDE_PROJECT_DIR}"
+        "@zvada/cr8@0.3.0",
+        "mcp-connect"
       ]
     }
   }

package/.codex-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "${PLUGIN_ROOT}/dist/cr8.mjs",
-        "mcp"
+        "mcp-connect"
       ]
     }
   }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cr8",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "A local-first design canvas shared by people and AI agents.",
   "author": {
     "name": "Adam Zvada",

package/README.md

@@ -7,16 +7,16 @@ Two workspaces share one project:
 - **Design** is the canvas: artboards, layers, text, images and vectors, with generation built in.
 - **Flows** is where repeatable AI-media recipes live: a graph of steps over image, vector and video models that a person can rerun and edit, and an agent can build and run.
 
-One local process serves both to the browser, speaks MCP to an agent, and answers a JSON command line. Nothing runs in the cloud except the AI media itself: generation runs on hosted models with your CR8 account, and every result is copied into the project. Your designs never leave your computer.
+One local process serves both to the browser, speaks MCP to an agent, and answers a JSON command line. Nothing runs in the cloud except the AI media itself: generation runs on hosted models with your CR8 account. Flow outputs stay in the cloud until you add them to Design; every asset used by a design is copied into its project. Your designs never leave your computer.
 
 > [!NOTE]
 > CR8 is an invited preview, and it is proprietary software: install it and use it, including for your own commercial work, but do not copy, modify or redistribute it. What you make with it is yours. The terms are in [LICENSE](LICENSE).
 
 ## Install
 
-You need Node.js 20.19 or newer for the npm and source installs. The binaries and the desktop app need nothing.
+You need Node.js 20.19 or newer for the npm and source installs. The binaries and desktop app bundle their runtime and need no separate Node/npm install. GitHub downloads currently require access to the private source repository; npm is the public install route.
 
-**From npm** (after the first release). One command creates a project, serves it and opens your browser:
+**From npm.** One command creates a project, serves it and opens your browser:
 
 ```bash
 npx @zvada/cr8 start designs/first
@@ -29,16 +29,17 @@ npm install -g @zvada/cr8
 cr8 start designs/first
 ```
 
-**A release binary** (after the first release). Each GitHub release carries one executable per platform (`cr8-darwin-arm64.zip`, `cr8-darwin-x64.zip`, `cr8-linux-x64.tar.gz`, `cr8-linux-arm64.tar.gz`, `cr8-windows-x64.zip`), a `SHA256SUMS.txt`, and a build attestation. Check the sum, unpack, run:
+**A release binary.** Each GitHub release carries one executable per platform (`cr8-darwin-arm64-unsigned.zip`, `cr8-darwin-x64-unsigned.zip`, `cr8-linux-x64.tar.gz`, `cr8-linux-arm64.tar.gz`, `cr8-windows-x64.zip`) and a `SHA256SUMS.txt`. The macOS archives are unsigned until a certificate is configured, and GitHub attests a build only for a public repository. Check the sum, unpack, run:
 
 ```bash
-shasum -a 256 -c SHA256SUMS.txt --ignore-missing
-unzip cr8-darwin-arm64.zip && ./cr8-darwin-arm64 start designs/first
+shasum -a 256 cr8-darwin-arm64-unsigned.zip
+# Compare with this archive’s entry in SHA256SUMS.txt.
+unzip cr8-darwin-arm64-unsigned.zip && ./cr8-darwin-arm64 start designs/first
 ```
 
-**The desktop app** (after the first release). The same release carries a macOS app (dmg and zip), a Windows installer and a Linux AppImage. It is a window around the same local process: open a project folder and the canvas appears, no browser tab needed.
+**The desktop app.** The same release carries a macOS app (dmg and zip), a Windows installer and a Linux AppImage. It is a window around the same local process: open a project folder and the canvas appears, no browser tab needed.
 
-**From source** (today). With Git and Node.js:
+**From source.** With Git and Node.js:
 
 ```bash
 git clone https://github.com/zvadaadam/baby-canva.git "$HOME/.cr8"
@@ -53,7 +54,7 @@ The full page, with the agent-host details, is [docs/user/install.md](docs/user/
 
 ## Update
 
-Your designs live in their own repositories, so an update never touches them. Restart your agent host afterwards, since it keeps the server running.
+Designs live outside the installation directory. Restart the agent host after an update, and update any version pinned in its MCP configuration separately. Keep a project backup before a major upgrade: opening a project can migrate its format.
 
 | Installed from | Update with |
 | --- | --- |
@@ -81,15 +82,17 @@ The first time you generate an image, CR8 asks you to connect your account: **Co
 Claude Code, Codex and any MCP host can drive CR8. The host starts the server when a tool is called and stops it when the session ends, so do not run `cr8 start` for the agent.
 
 ```bash
-claude mcp add --transport stdio --scope user cr8 -- cr8 mcp      # Claude Code
-codex mcp add cr8 -- cr8 mcp                                       # Codex
+claude mcp add --transport stdio --scope user cr8 -- cr8 mcp-connect # Claude Code
+codex mcp add cr8 -- cr8 mcp-connect                                # Codex
 ```
 
-Then ask for a deliverable, not a tool:
+One user-level registration follows each agent session's project folder. Desktop onboarding and Settings can add it directly through the installed agent CLI, without a running chat. Browser Settings offers setup prompts and manual configuration. Setup creates no design files.
+
+Then ask for a deliverable:
 
 > Initialize CR8 at `designs/thumbnail` and make a 1280 × 720 YouTube thumbnail for an AI mobile-app builder. Keep every layer editable and show me the canvas.
 
-The agent creates the project, starts the canvas and hands you its URL. You watch and edit in the browser while it works; a host that renders MCP Apps shows the same canvas inline. Three skills ship with CR8 and teach the agent how to work well: `cr8-design` for the canvas, `cr8-flows` for recipes, `cr8-feedback` for reporting. Put them where the hosts look with `cr8 skills install`. Once the package is public, `/plugin marketplace add zvadaadam/baby-canva` installs the server and the skills into Claude Code in one step.
+The agent creates the project, starts the canvas and hands you its URL. You watch and edit in the browser while it works; a host that renders MCP Apps shows the same canvas inline. Three skills ship with CR8 and teach the agent how to work well: `cr8-design` for the canvas, `cr8-flows` for recipes, `cr8-feedback` for reporting. MCP exposes the same instructions through `read_skill`, so separate skill installation is optional; `cr8 skills install` adds host-native discovery. If the source repository becomes public, `/plugin marketplace add zvadaadam/baby-canva` installs the server and the skills into Claude Code in one step.
 
 The tools and what the agent sees are described in [docs/user/mcp.md](docs/user/mcp.md).
 
@@ -110,7 +113,7 @@ Bring references in and check the result against them: `cr8 import picture.png -
 
 ### In the desktop app
 
-Open the app on a project folder, or launch it with `--workspace DIR --project designs/first`. It spawns the same local process, or joins one that already holds the project, and shows the canvas in its own window. See [docs/user/desktop.md](docs/user/desktop.md).
+Open the app on a project folder, or launch it with `--workspace DIR --project designs/first`. It spawns the same local process, or joins one that already holds the project, and shows the canvas in its own window. First launch offers Create/Open and optional agent setup in the same window. Its dashboard lists local files under Canvas and saved graphs under Flows, with Settings alongside them; returning from the dashboard or Settings preserves the canvas. **Settings → Agents · MCP** configures a stable bundled launcher for Claude Code or Codex without npm; connections survive desktop restarts. See [docs/user/desktop.md](docs/user/desktop.md).
 
 ## Your files
 
@@ -132,7 +135,7 @@ Commit `cr8.json`, `flows.json`, `flow-runs.json`, `assets/` and `.gitignore`; a
 
 Drawing, editing, importing, exporting, the CLI and the agent tools all work without an account. Generating images, vectors, video and image-to-layers runs on hosted models and needs your CR8 account, connected once per device: the sign-in page hands this computer a grant that renews itself and lives in CR8's home folder, readable by you alone. `cr8 connect --open` does the same from a terminal, `cr8 status` shows the connection, `cr8 disconnect` forgets it. An agent never sees your credentials; when a generation needs the account, it hands you the sign-in URL.
 
-Every generation is recorded in the cloud with its model, prompt and parameters, and the result is copied into the project's `assets/` before the design may use it. Only video clips stay in the cloud; `cr8 media-download` writes one to a file.
+Every generation is recorded in the cloud with its model, prompt and parameters, and the result is copied into the project's `assets/` before the design may use it. Flow outputs stay in the cloud until Add to Design copies an image or SVG into the project. Clips remain in Flows; `cr8 media-download` writes a job output to a file.
 
 ## Feedback
 
@@ -159,4 +162,19 @@ npm run build                    # the package, the account hub and the desktop
 npm run test:install             # pack the npm artifact and install it the way a user would
 ```
 
-`src/` is the `@zvada/cr8` package: `shared/` (the scene model and the command contract), `web/` (the browser workspace and the MCP App), `runtime/` (the local process: HTTP app, MCP server, CLI). `apps/` holds what runs elsewhere: the desktop shell and the two Cloudflare Workers, the media API and the account hub. `packages/` is the code the Workers share with the runtime. One composition root builds one runtime, and one route table drives the HTTP app, the browser, the MCP App and the CLI. A release is cut by pushing a tag; the runbook is [docs/operations/release.md](docs/operations/release.md).
+The product lives in eight private npm workspaces. Each owns its dependencies, configuration and focused tests:
+
+| Package | Owns |
+| --- | --- |
+| [core](packages/core/) | Canonical scene, commands, layout and local protocol |
+| [runtime](packages/runtime/) | Local process, project files, CLI, MCP and media clients |
+| [editor](packages/editor/) | Browser editor, Flows and embedded MCP App |
+| [desktop](packages/desktop/) | Electron launcher over the local runtime |
+| [account-hub](packages/account-hub/) | Cloud account UI, WorkOS and installation grants |
+| [media-api](packages/media-api/) | Cloud generation Worker, providers and output catalog |
+| [contracts](packages/contracts/) | Contracts shared with the Workers |
+| [media-safety](packages/media-safety/) | Image and SVG byte validation |
+
+Run a focused command from the root with `npm run test --workspace @cr8/editor`, or from inside that package with `npm test`. Root `tests/` holds cross-package integration and installation checks. Root scripts assemble and verify the whole product.
+
+The root remains the published `@zvada/cr8` package and plugin: `npm run build:package` bundles the private workspace source into one `dist/cr8.mjs`, with no installed runtime dependencies. The account hub has its own build into `dist/account`; the local editor is loopback-only. See [architecture](docs/internals/architecture.md), the [package decision](docs/decisions/2026-09-10-package-ownership.md), and the [release runbook](docs/operations/release.md).