ponzu 1.70.0 → 1.71.1

package/README.md

@@ -34,7 +34,7 @@ This clones the repo into `~/Ponzu/north-brook/ponzu` (or reuses the clone there
 
 Or [download the Mac app](https://ponzu.design/download) (Apple silicon, signed and notarized; it updates itself). Windows (x64) and Linux (x64, an AppImage or a `.deb`) builds are in beta, on the [releases page](https://github.com/north-brook/ponzu/releases/latest); they update themselves too, and the Windows one isn't signed yet, so SmartScreen asks before its first launch. It opens `.design` folders like documents, and on first launch it sets up Claude Code, Codex and Cursor for you. There's nothing else to install or keep running.
 
-Its home screen's **Suggested** tab proposes designs for the projects your agents worked in lately. When you open it (at most every ten minutes, and only to top it up to eight), Ponzu runs your own Claude Code (or Codex, without Claude Code) headless and read-only, on your agent's account, in two steps: a glance at each project's file list and readme, with no tools, names a few designs, then one run for each reads the code it starts from and writes its prompt. Claude Code gets only Read, Glob and Grep, Codex its read-only sandbox, and neither gets any MCP servers. You copy the prompt you like into your agent. The ideas are kept in `~/.ponzu/suggestions.json`.
+Its home screen's **Suggested** tab proposes designs for the projects your agents worked in lately. When you open it (at most every ten minutes, and only to top it up to eight), Ponzu runs your own Claude Code (or Codex, without Claude Code) headless and read-only, on your agent's account, in two steps: a glance at each project's file list and readme, with no tools, names a few designs, then one run for each reads the code it starts from and writes its prompt. Claude Code gets only Read, Glob and Grep, Codex its read-only sandbox, and neither gets any MCP servers. You copy the prompt you like into your agent. The ideas are kept in `~/.ponzu/suggestions.json`. Your other Macs' Ponzu show theirs too, for their own projects, over your tailnet, and opening the tab asks each to look again.
 
 The app also puts `ponzu` in your terminal, running from inside the app so it updates with it. It links the command into a folder your shell already searches that you can write to (`~/.local/bin`, `~/bin` or `/usr/local/bin`), never over another `ponzu`. If there's no such folder, choose **Ponzu › Install Terminal Command…**, which asks for your password to add it to `/usr/local/bin`.
 

package/dist/index.js

@@ -33422,6 +33422,7 @@ See it
 
 What the person sees
 - On their canvas, the load plays once when the artboard appears: when they open its page, and each time you edit it. Then a finite animation holds its end. Hovering or clicking the artboard doesn't replay it, so never tell them it will.
+- Their canvas plays what record shows. It holds motion still on purpose: while its window is in the background on battery, while they pan across a crowded page, for parts too small to see at their zoom, and for loops longer than 20 s on an artboard zoomed far out. If record shows the motion working and they say it doesn't play, tell the Ponzu team with send_feedback instead of reworking the design.
 - A hint that fades out ends hidden, so the canvas shows nothing once it has played.
 - When they need to watch the motion (an entrance to review, a hint that leaves), put a looping copy on an artboard beside the real one: animation-iteration-count: infinite, with a beat of about a second held at the end of the keyframes so each cycle reads as one play. Keep the real one finite, and say which is which in a note.
 - If the motion answers something the person does, put it on :hover or :focus, so they can set it off themselves.
@@ -47009,7 +47010,7 @@ function serve(ws, opts = {}) {
       return Response.json({ ok: true });
     }
     if (path === "/api/suggestions" || path === "/api/suggestions/refresh") {
-      if (caller !== "local" || !sameHostOk(req, url))
+      if (caller === "local" && !sameHostOk(req, url))
         return new Response("Forbidden", { status: 403 });
       const refresh = path === "/api/suggestions/refresh";
       if (refresh && req.method !== "POST")
@@ -47449,7 +47450,7 @@ function serve(ws, opts = {}) {
 function peerAllowed(req, pathname) {
   if (isPage(req))
     return false;
-  if (pathname === "/api/shelf" || pathname === "/api/update/install")
+  if (pathname === "/api/shelf" || pathname === "/api/update/install" || pathname === "/api/suggestions/refresh")
     return req.method === "POST";
   if (req.method !== "GET")
     return false;
@@ -47461,6 +47462,7 @@ function peerAllowed(req, pathname) {
     "/api/thumb",
     "/api/info",
     "/api/macs",
+    "/api/suggestions",
     "/ws"
   ].includes(pathname) || /^\/files\/[^/]+\/assets\/.+$/.test(pathname);
 }
@@ -47487,13 +47489,13 @@ function isPage(req) {
 }
 var SHELF_ACTIONS = ["archive", "restore", "scratch", "recent"];
 async function relay(req, target) {
-  const shelf = req.method === "POST" && new URL(target).pathname === "/api/shelf";
-  if (req.method !== "GET" && !shelf)
+  const post = req.method === "POST" && ["/api/shelf", "/api/suggestions/refresh"].includes(new URL(target).pathname);
+  if (req.method !== "GET" && !post)
     return new Response("Method not allowed", { status: 405 });
   try {
     const res = await fetch(target, {
-      signal: AbortSignal.timeout(shelf ? 5000 : 30000),
-      ...shelf ? {
+      signal: AbortSignal.timeout(post ? 5000 : 30000),
+      ...post ? {
         method: "POST",
         headers: { "content-type": "application/json" },
         body: await req.text()
@@ -47638,7 +47640,7 @@ function remoteUpdater(endpoint, token) {
 // apps/cli/package.json
 var package_default = {
   name: "ponzu",
-  version: "1.70.0",
+  version: "1.71.1",
   description: "The open source canvas your agent draws on in HTML and CSS.",
   type: "module",
   license: "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ponzu",
-  "version": "1.70.0",
+  "version": "1.71.1",
   "description": "The open source canvas your agent draws on in HTML and CSS.",
   "license": "MIT",
   "type": "module",