@zvada/cr8 0.2.0 → 0.3.1

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cr8",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "A local-first design canvas shared by people and AI agents.",
   "author": {
     "name": "Adam Zvada",
@@ -13,10 +13,8 @@
       "command": "npx",
       "args": [
         "-y",
-        "@zvada/cr8@0.2.0",
-        "mcp",
-        "--workspace",
-        "${CLAUDE_PROJECT_DIR}"
+        "@zvada/cr8@0.3.1",
+        "mcp-connect"
       ]
     }
   }

package/.codex-plugin/mcp.json

@@ -4,7 +4,7 @@
       "command": "node",
       "args": [
         "${PLUGIN_ROOT}/dist/cr8.mjs",
-        "mcp"
+        "mcp-connect"
       ]
     }
   }

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "cr8",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "A local-first design canvas shared by people and AI agents.",
   "author": {
     "name": "Adam Zvada",

package/README.md

@@ -7,16 +7,16 @@ Two workspaces share one project:
 - **Design** is the canvas: artboards, layers, text, images and vectors, with generation built in.
 - **Flows** is where repeatable AI-media recipes live: a graph of steps over image, vector and video models that a person can rerun and edit, and an agent can build and run.
 
-One local process serves both to the browser, speaks MCP to an agent, and answers a JSON command line. Nothing runs in the cloud except the AI media itself: generation runs on hosted models with your CR8 account, and every result is copied into the project. Your designs never leave your computer.
+One local process serves both to the browser, speaks MCP to an agent, and answers a JSON command line. Nothing runs in the cloud except the AI media itself: generation runs on hosted models with your CR8 account. Flow outputs stay in the cloud until you add them to Design; every asset used by a design is copied into its project. Your designs never leave your computer.
 
 > [!NOTE]
 > CR8 is an invited preview, and it is proprietary software: install it and use it, including for your own commercial work, but do not copy, modify or redistribute it. What you make with it is yours. The terms are in [LICENSE](LICENSE).
 
 ## Install
 
-You need Node.js 20.19 or newer for the npm and source installs. The binaries and the desktop app need nothing.
+You need Node.js 20.19 or newer for the npm and source installs. The binaries and desktop app bundle their runtime and need no separate Node/npm install. GitHub downloads currently require access to the private source repository; npm is the public install route.
 
-**From npm** (after the first release). One command creates a project, serves it and opens your browser:
+**From npm.** One command creates a project, serves it and opens your browser:
 
 ```bash
 npx @zvada/cr8 start designs/first
@@ -29,16 +29,17 @@ npm install -g @zvada/cr8
 cr8 start designs/first
 ```
 
-**A release binary** (after the first release). Each GitHub release carries one executable per platform (`cr8-darwin-arm64.zip`, `cr8-darwin-x64.zip`, `cr8-linux-x64.tar.gz`, `cr8-linux-arm64.tar.gz`, `cr8-windows-x64.zip`), a `SHA256SUMS.txt`, and a build attestation. Check the sum, unpack, run:
+**A release binary.** Each GitHub release carries one executable per platform (`cr8-darwin-arm64-unsigned.zip`, `cr8-darwin-x64-unsigned.zip`, `cr8-linux-x64.tar.gz`, `cr8-linux-arm64.tar.gz`, `cr8-windows-x64.zip`) and a `SHA256SUMS.txt`. The macOS archives are unsigned until a certificate is configured, and GitHub attests a build only for a public repository. Check the sum, unpack, run:
 
 ```bash
-shasum -a 256 -c SHA256SUMS.txt --ignore-missing
-unzip cr8-darwin-arm64.zip && ./cr8-darwin-arm64 start designs/first
+shasum -a 256 cr8-darwin-arm64-unsigned.zip
+# Compare with this archive’s entry in SHA256SUMS.txt.
+unzip cr8-darwin-arm64-unsigned.zip && ./cr8-darwin-arm64 start designs/first
 ```
 
-**The desktop app** (after the first release). The same release carries a macOS app (dmg and zip), a Windows installer and a Linux AppImage. It is a window around the same local process: open a project folder and the canvas appears, no browser tab needed.
+**The desktop app.** The same release carries a macOS app (dmg and zip), a Windows installer and a Linux AppImage. It is a window around the same local process: open a project folder and the canvas appears, no browser tab needed.
 
-**From source** (today). With Git and Node.js:
+**From source.** With Git and Node.js:
 
 ```bash
 git clone https://github.com/zvadaadam/baby-canva.git "$HOME/.cr8"
@@ -53,7 +54,7 @@ The full page, with the agent-host details, is [docs/user/install.md](docs/user/
 
 ## Update
 
-Your designs live in their own repositories, so an update never touches them. Restart your agent host afterwards, since it keeps the server running.
+Designs live outside the installation directory. Restart the agent host after an update, and update any version pinned in its MCP configuration separately. Keep a project backup before a major upgrade: opening a project can migrate its format.
 
 | Installed from | Update with |
 | --- | --- |
@@ -78,18 +79,22 @@ The first time you generate an image, CR8 asks you to connect your account: **Co
 
 ### With an agent
 
-Claude Code, Codex and any MCP host can drive CR8. The host starts the server when a tool is called and stops it when the session ends, so do not run `cr8 start` for the agent.
+MCP hosts must support **2026-07-28** to drive CR8. The Claude Code and Codex versions [checked on 2026-09-14](docs/user/install.md#host-compatibility) still requested older protocols; saving their configuration does not verify a connection. Until your host supports the required protocol, agents can use the [JSON CLI](#from-a-terminal-or-a-script) and people can use the local browser.
+
+A compatible host's `mcp-connect` registration joins the runtime already opened by `cr8 start` in that workspace, so you and the agent edit the same project. When none is running, the host starts CR8 on demand and stops its process when the session ends. These commands save user-level configuration:
 
 ```bash
-claude mcp add --transport stdio --scope user cr8 -- cr8 mcp      # Claude Code
-codex mcp add cr8 -- cr8 mcp                                       # Codex
+claude mcp add --transport stdio --scope user cr8 -- cr8 mcp-connect # Claude Code
+codex mcp add cr8 -- cr8 mcp-connect                                # Codex
 ```
 
-Then ask for a deliverable, not a tool:
+One user-level registration follows each agent session's project folder. Desktop onboarding and Settings can add it directly through the installed agent CLI, without a running chat. Browser Settings offers setup prompts and manual configuration. Setup creates no design files.
+
+After verifying the connection with a read-only `list_skills` call, ask for a deliverable:
 
 > Initialize CR8 at `designs/thumbnail` and make a 1280 × 720 YouTube thumbnail for an AI mobile-app builder. Keep every layer editable and show me the canvas.
 
-The agent creates the project, starts the canvas and hands you its URL. You watch and edit in the browser while it works; a host that renders MCP Apps shows the same canvas inline. Three skills ship with CR8 and teach the agent how to work well: `cr8-design` for the canvas, `cr8-flows` for recipes, `cr8-feedback` for reporting. Put them where the hosts look with `cr8 skills install`. Once the package is public, `/plugin marketplace add zvadaadam/baby-canva` installs the server and the skills into Claude Code in one step.
+The agent creates the project, starts the canvas and hands you its URL. You watch and edit in the browser while it works; a host that renders MCP Apps shows the same canvas inline. Three skills ship with CR8 and teach the agent how to work well: `cr8-design` for the canvas, `cr8-flows` for recipes, `cr8-feedback` for reporting. MCP exposes the same instructions through `read_skill`, so separate skill installation is optional; `cr8 skills install` adds host-native discovery. If the source repository becomes public, `/plugin marketplace add zvadaadam/baby-canva` installs the server and the skills into Claude Code in one step.
 
 The tools and what the agent sees are described in [docs/user/mcp.md](docs/user/mcp.md).
 
@@ -110,7 +115,7 @@ Bring references in and check the result against them: `cr8 import picture.png -
 
 ### In the desktop app
 
-Open the app on a project folder, or launch it with `--workspace DIR --project designs/first`. It spawns the same local process, or joins one that already holds the project, and shows the canvas in its own window. See [docs/user/desktop.md](docs/user/desktop.md).
+Open the app on a project folder, or launch it with `--workspace DIR --project designs/first`. It spawns the same local process, or joins one that already holds the project, and shows the canvas in its own window. First launch offers Create/Open and optional agent setup in the same window. Its dashboard lists local files under Canvas and saved graphs under Flows, with Settings alongside them; returning from the dashboard or Settings preserves the canvas. **Settings → Agents · MCP** configures a stable bundled launcher for Claude Code or Codex without npm; connections survive desktop restarts. See [docs/user/desktop.md](docs/user/desktop.md).
 
 ## Your files
 
@@ -132,7 +137,7 @@ Commit `cr8.json`, `flows.json`, `flow-runs.json`, `assets/` and `.gitignore`; a
 
 Drawing, editing, importing, exporting, the CLI and the agent tools all work without an account. Generating images, vectors, video and image-to-layers runs on hosted models and needs your CR8 account, connected once per device: the sign-in page hands this computer a grant that renews itself and lives in CR8's home folder, readable by you alone. `cr8 connect --open` does the same from a terminal, `cr8 status` shows the connection, `cr8 disconnect` forgets it. An agent never sees your credentials; when a generation needs the account, it hands you the sign-in URL.
 
-Every generation is recorded in the cloud with its model, prompt and parameters, and the result is copied into the project's `assets/` before the design may use it. Only video clips stay in the cloud; `cr8 media-download` writes one to a file.
+Every generation is recorded in the cloud with its model, prompt and parameters, and the result is copied into the project's `assets/` before the design may use it. Flow outputs stay in the cloud until Add to Design copies an image or SVG into the project. Clips remain in Flows; `cr8 media-download` writes a job output to a file.
 
 ## Feedback