Skip to content

fix(editor): store scans locally without host uploads - #726

Merged
Aymericr merged 143 commits into
pascalorg:mainfrom
anisayakmitra-in:fix/local-scan-upload
Sep 12, 2026
Merged

fix(editor): store scans locally without host uploads#726
Aymericr merged 143 commits into
pascalorg:mainfrom
anisayakmitra-in:fix/local-scan-upload

Conversation

@anisayakmitra-in

@anisayakmitra-in anisayakmitra-in commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes the self-hosted scan upload path, which currently accepts a file and then silently does nothing when a host upload callback is absent.

Details

  • Stores local GLB and glTF uploads through the existing IndexedDB asset storage.
  • Creates and selects the corresponding ScanNode on the active level.
  • Retains the existing host upload flow when a callback is supplied.
  • Adds coverage for local scan asset creation.

Fixes #645

Validation

  • bun test packages/editor/src/lib/local-guide-image.test.ts
  • bun run --filter @pascal-app/editor check-types
  • bun run --filter @pascal-app/editor test (760 pass)
  • biome check on the changed implementation files

Note

Medium Risk
Changes cut across npm OIDC publishing, CLI runtime download integrity, hosted MCP registry contracts, and monorepo package layout—high impact if misconfigured, though largely additive CI and distribution work.

Overview
This PR ships the 1.0.0 release narrative and tooling alongside substantial product and distribution changes—not the local scan-upload fix described in the current PR template.

Agent workflows and MCP distribution — Adds versioned pascal-3d and furniture-fit skill bundles with marketplace manifests for Claude Code, Codex, Cursor, and Gemini, portable mcp.json, branding assets, and bun run skills:validate (wired into CI). A new MCP Registry workflow validates server.json against the live hosted endpoint and API catalog. Internal repo skills gain metadata.internal; open-pr2 is a separate, explicit PR-writing workflow; review-architecture expands guidance on animation-driven dirty marking.

CLI and npm release pipeline@pascal-app/cli becomes a small npm package with MCP bundled in-package while the web editor runtime downloads from a GitHub release asset with SHA-256 verification; release uploads that asset after publish. Release workflow drops capture-protocol / capture-viewer packages, switches npm publish to GitHub OIDC trusted publishing (no NPM_TOKEN), fixes prerelease graduation semver, and adds pascal agent claim / agent status docs in the changelog.

Package consolidation — Standalone @pascal-app/capture-protocol and @pascal-app/capture-viewer packages are removed; capture lives under @pascal-app/core/capture and @pascal-app/viewer/capture, with README/AGENTS updates.

Standalone editor app — Bootstraps Environment (panel + viewer presentation) and Pool plugins, Tailwind sources for Environment, and a reworked Build tab: roof type picker and ToolOptionsPanel, Kitchen modular cabinet entry, MEP group behavior, fitting thumbnails, and tests for roof feature selection.

Docs (CHANGELOG, README, SETUP), three@0.186, and widespread 1.0.0 version bumps round out the release.

Reviewed by Cursor Bugbot for commit 409576b. Bugbot is set up for automated code reviews on this repo. Configure here.

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale Bugbot comment from a previous run.

wass08 and others added 3 commits August 28, 2026 11:18
…mera hints (pascalorg#728)

* editor: share the shortcut glyph resolver and note Escape's mid-draw behavior

The Keyboard Shortcuts dialog owned the only key→glyph map (⎋, ⌫, ⌘/Ctrl, …)
while `ShortcutToken` — the thing that actually prints a key — knew only about
the command modifier. Move the map next to the token as `shortcutDisplayValue`
and export both from the package, so a second surface (the community
getting-started guide, which teaches Escape / undo / delete) prints the same
glyph for the same key instead of re-deriving the platform rules.

The dialog's output is unchanged; it drops its own copy of the map and its
`isMac` state in favour of the token file's module-level detection, which it was
already relying on for ⌘ anyway.

Also record what Escape really does in `use-keyboard.ts`: a tool that has an
active mid-action consumes the cancel (`markToolCancelConsumed`), so mid-draw it
drops only the chain and keeps the tool armed — the dialog claimed it always
returns to Select mode.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EfcEhXQKCFz216c2Y11Wah

* editor: print Esc, Space and Delete as words, and document the modifier taps

`shortcutDisplayValue` printed ⎋ for Escape, ␣ for Space and ⌫ for
Delete. None of those appear on a keyboard, so they read as "some
symbol" rather than as the key they mean — the getting-started guide
tells users to press Esc and rendered a glyph almost nobody decodes.
They now spell their names, and Delete uses the name the current
platform actually puts on the keycap. ⌘ and the arrows stay: those are
printed on the keys they stand for.

Shift keeps its icon in the token (the rail already draws ph:arrow-fat-up
because the ⇧ glyph sits too high in this font), but drops out of the
display map so any surface printing it as text now gets the word.

Also lists the two tap bindings in the Keyboard Shortcuts dialog. Shift
and Ctrl each mean one thing held and another tapped, and only the hold
was documented, which read as the taps not existing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EfcEhXQKCFz216c2Y11Wah

* editor: keep in-scene HTML under the viewer overlays, and mark the level +

drei's `<Html>` derives its z-index from camera distance and defaults to a
range topping out at 16,777,271. Nothing between it and the viewer column
created a stacking context, so those values competed directly with the
toolbar (z-20), the stage overlay (z-10) and the overlay band (z-30) — and
the wall tool's cursor badge painted over anything an app put in that band,
including the community getting-started card. `isolate` on the canvas area
confines every in-scene HTML layer inside the canvas and leaves their order
relative to each other untouched.

The `data-guide-target` on the level stack's "add above" button is a static
hook for host-app onboarding to point at, read only from outside. Nothing
here depends on it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EfcEhXQKCFz216c2Y11Wah

* editor: add a success cue to the SFX registry

A three-second jingle for finishing something, next to the click and thud
cues the registry already holds. No pitch or volume jitter — a fanfare
that lands a semitone off reads as broken rather than as varied — and a
minimum gap longer than the sound itself, so two milestones that land
together play once instead of phasing over each other.

The asset ships with the standalone editor because `preloadSFX` loads
every definition in the registry, wherever the player is mounted.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EfcEhXQKCFz216c2Y11Wah

* editor: let a host tour point at the Select control

One static `data-guide-target` attribute on the action menu's Select
button, matching the level selector's `level-add`. Nothing in the package
reads it: it exists so a host app's first-run guide can find the control
without the editor knowing a guide exists.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EfcEhXQKCFz216c2Y11Wah

* Two guide targets: the material picker and the ground-floor level row

Both are one static `data-guide-target` attribute and nothing else — no
import, no hook, no conditional class, no knowledge that a guide exists.
The host app's getting-started guide resolves and rings them from outside.

- `paint-material` on the material picker band in `MaterialPaintPanel`, so a
  guide can ask for a brush to be loaded before asking for a surface to be
  clicked. The grid rather than a swatch: the ask is that something is
  chosen, not which.
- `level-ground` on the floating level selector's ordinal-0 row — the one
  level a guide can name without knowing anything about the building. Same
  conditional-attribute shape the Build grid already uses for its tiles.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EfcEhXQKCFz216c2Y11Wah

* editor: export the active snapping mode

A host that has to say something about snapping needs the same answer the
HUD chip on the right of the screen shows, and the editor already has one
source for it — `getActiveSnappingMode`, resolved through the active snap
context. Exported alongside `resolveSnapFlags` so a host can ask whether
the grid is what is in play rather than re-deriving the mapping and owning
a second version of it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EfcEhXQKCFz216c2Y11Wah

* editor: let a host narrow the camera controls hint

The panel over the canvas explains Pan, Rotate and Zoom at once, which is
the right answer for somebody left to find their own way and the wrong one
for somebody being asked for a single gesture: three controls on screen
turns "drag to orbit" into a search. And once the lesson is over it is a
permanent widget explaining what the user has just been walked through.

`useCameraHintFocus` narrows it to the actions a host names, and hides it
outright for an empty list. Null — the default, and what every host gets
without touching it — is all of them, unchanged.

A store rather than a prop because the thing that knows which gesture is
being taught is several levels away from the canvas, and threading it
through would put a teaching concern in every component between. The
editor knows only "show these actions"; it never learns why.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EfcEhXQKCFz216c2Y11Wah

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
One static `data-guide-target` on each of the helper panel's two snapping
chips — `snap-mode` on the Shift/mode chip and `snap-grid-step` on the
Ctrl/grid-step chip — through an optional `guideTarget` prop on `ChipRow`.
Same shape as the Select button, the level "+" and the material picker:
nothing in the package reads it.

The community getting-started guide's window step used to name the keys in
its small print and say the chips were "on the right of the screen", which
first-time users read as decoration. With a hook on the chip the guide can
ring the actual control and ask for the grid step to be shrunk as a beat.


Claude-Session: https://claude.ai/code/session_01EfcEhXQKCFz216c2Y11Wah

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add roof surface placement support for items

Items (e.g. solar panels) can now be placed on sloped roof surfaces.
The placement system computes euler rotation from the roof surface
normal so items sit flush on the slope instead of going inside.

- Add roofStrategy to placement-strategies with enter/move/click/leave
- Wire roof:enter/move/click/leave events in the placement coordinator
- Add calculateRoofRotation in placement-math using surface normals
- Support full 3D cursor rotation for sloped surfaces
- Items on roofs are parented to the level with world-space rotation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fixed conflict

* feat: improve roof placement and hosted extensions

* fix: preserve curved lean-to roof connections

* fix roof and dormer editing behavior

* feat: improve roof openings and lean-to canopies

* Fix centered lean-to placement

* Align placement previews with architecture

* Fix dormer window placement grid orientation

* fix roof canopy geometry and continuous placement

* stabilize canopy miter quality assertions

* stabilize canopy gutter quality assertions

* fix conical roof hover elevation across levels

* fix conical roof placement on higher floors

* limit conical wall roofs to adjacent levels

* limit continuous mono canopy mitering to single-corner L runs

Straight freestanding mono runs now only miter across a corner when the
joined chain is exactly two runs (an L). J-shapes, longer chains, and
closed loops render as plain overlapping runs — no shaped footprint,
no joint step closures, no corner extension — which avoids the dark
wedges and fascia slivers those multi-corner miters produced. Curved
and wall-attached canopies keep their multi-corner mitering.

The joint step closure that L runs still use is rebuilt on geometric
ownership (the lower run raises the closure wall to the sibling top),
so it no longer depends on node-id order or draw direction.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* restrict conical roofs to curved wall footprints

* fix conical roof placement architecture

* fix remaining Bugbot findings

* restrict standard roofs to rectangular rooms

* ignore curved walls for standard roof drawing

* fix lower-floor roof room preview elevation

* test L-shaped roof footprint eligibility

* ignore diagonal walls for standard roof guides

* fix roof placement architecture and window previews

* fix roof footprint previews and wall guides

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

@Aymericr Aymericr left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this — it's exactly the shape I sketched in #645: mirror local-guide-image.ts, persist through saveAsset, and let the existing node side do the rendering. I verified the whole chain: asset:// is on the AssetUrl allowlist, ScanRenderer resolves it through useAssetUrl/loadAssetUrl so it survives reload, the 200 MB cap applies before your branch, and the hosted app always passes onUploadAsset so the host path is untouched (tightening onUploadAsset?.() to onUploadAsset() after the guard is right). The test is a faithful mirror of the lib's shape too.

One change before merge, and Bugbot is right about it: the success path needs setShowScans(true). The guide branch right above yours calls setShowGuides(true) before selecting; showScans is a persisted per-project preference (use-viewer.ts), and packages/nodes/src/scan/renderer.tsx computes visible = showScans && node.visible — so with scans toggled off your upload succeeds invisibly, which is the exact failure mode this PR exists to kill. Grab setShowScans next to the setShowGuides subscription in site-panel/index.tsx and call it in the success path.

Two things I noticed and am explicitly not asking you to fix here:

  • Deleting an asset:// scan orphans the File in IndexedDB (handleDelete only routes http(s) URLs to onDeleteAsset). Guide images have the same gap today, so this stays parity — but scans are up to 200 MB, so I'll file a follow-up for local asset cleanup.
  • mock.module('@pascal-app/core', …) is process-global in bun test; the spread keeps the blast radius to saveAsset and nothing else in the package calls it under test, so it's fine as is.

Push the setShowScans fix and this is good to go. Appreciate you carrying this from the issue write-up through to the PR — the workaround you documented there has a proper home now. (I've approved the CI run.)

SomSamantray and others added 23 commits August 30, 2026 23:58
…lorg#636)

* feat(editor): add structure+utility 'routing' floorplan export scope

Add a third FloorplanExportScope value that includes structure and
utility nodes (ducts, pipes, HVAC) without furniture, shared through a
pure isFloorplanNodeInExportScope predicate used at both collection
filter sites. Existing 'full' and 'structure' behavior is unchanged.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

* feat(editor): export exportFloorplanPdf from the package entry

Re-export exportFloorplanPdf and the FloorplanExportScope type from
@pascal-app/editor so hosts with their own export UI can trigger a
floorplan PDF export without reaching into the settings panel.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

* fix(review): add package-entry re-export smoke test and drop redundant comment

Per code review, add a consumer-side compile-time assertion in apps/editor
that imports exportFloorplanPdf and FloorplanExportScope from the
@pascal-app/editor package entry, so a broken re-export fails check-types
instead of passing silently. Also drop the WHAT-narration doc comment on
collectFloorplanGeometry (behavior-preserving).

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

* docs(review): record residual review findings

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

* refactor(editor): drop routing floorplan export scope

Per review on pascalorg#636: the 'routing' scope has no UI trigger anywhere
(pascalorg#632) and its name would collide with PrintContentScope's vocabulary
from pascalorg#701. Narrows FloorplanExportScope back to 'full' | 'structure'
and simplifies the predicate accordingly. 'full' and 'structure'
behavior is unchanged.

Also renames the predicate's first parameter from `node` to
`definition` (it receives a NodeDefinition, not a node instance) and
corrects the apps/editor smoke test's comment, which mis-described a
runtime barrel import as a compile-time check.

* docs(review): drop residual-findings file, not a supported doc location

This repo keeps durable docs in wiki/, not a top-level docs/ tree, and
the file cited paths that don't exist here (a /tmp/... run path and a
docs/plans/... plan file). The two facts worth keeping — the tracker
issues filed from the original review round, and that pascalorg#631 is the one
confirmed-real finding — move into the PR description instead.

---------

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
…n tarballs, re-export calculateLevelMiters from core/wall (pascalorg#732)

- @pascal-app/editor published with no license field; automated license
  inventories reported it as unlicensed. Declare MIT like its siblings.
- npm auto-includes a package-root LICENSE in the tarball, so committing
  the root MIT text into each published package satisfies the MIT
  attribution requirement without touching the files allowlists.
- @pascal-app/core/wall exported getWallPlanFootprint(wall, miterData)
  without any way to produce or even name miterData; re-export
  calculateLevelMiters plus the Point2D/WallMiterData types from the
  same entry. wall-mitering was already a static dependency of the
  entry, so the module graph is unchanged.

Reported in pascalorg#731.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Carry scene materials through Load Build

validateBuildJson dropped the top-level materials table, so every
scene:<id> slot ref in an imported file pointed at a material that no
longer existed — custom finishes silently reverted to defaults on Load
Build. ParsedBuildJson now carries materials, each entry validated
individually (a bad material never takes the import down, it is
skipped with a warning), and handleConfirmImport hands them to
setScene, whose extra.materials support already existed.

Normalization here is DELIBERATE and documented in-line:
safeParse().data injects defaults and drops unknown keys — the
opposite of apiGraphSchema's preserve-unknowns stance — because import
feeds the live scene store, which only understands schema-shaped
materials.

Split out of pascalorg#720 at the maintainer's request.

* Save Build exports the materials table it now imports

Review follow-up (pascalorg#729): paint a finish, Save Build, Load Build that
file — the finish reverted to default because handleSaveBuild still
exported only { nodes, rootNodeIds, installedPlugins }. Materials ride
along now, closing the round-trip this PR opened on the import side.

Also names the skipped ids in the invalid_materials warning: the
audience is hand-edited files, and a bare count leaves nothing to
repair by.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…e sync (pascalorg#736)

publishLiveSceneSnapshot returned void and silently skipped both the
draft save and the live event whenever no active scene was bound or the
store could not append scene events — mutations 'vanished' with no
error, no log, and no signal to the caller, sending people hunting in
the wrong layer (pascalorg#725).

Neither of the two fixes pascalorg#561 debated survives the constraints: a typed
throw breaks the plain --stdio quick start on the first create_wall, and
lazily binding a draft scene creates persistent artifacts the user never
asked for on stores that may require project context. Instead the skip
becomes visible at the layer the caller sees: publishLiveSceneSnapshot
returns 'published' | 'unbound' | 'events_unsupported', and every
mutating tool spreads a persistence warning into its result (declared in
the tool outputSchema via a shared fragment so the SDK's structured-
content validation keeps it). An AI caller can react by binding a scene
with save_scene/load_scene; a human reading the transcript sees why
nothing persisted.

InMemorySceneStore now implements appendSceneEvent/listSceneEvents so
the three paths are testable; live-sync.test.ts covers them through a
real client/server pair and at the unit level.

Fixes pascalorg#725

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Add roof surface placement support for items

Items (e.g. solar panels) can now be placed on sloped roof surfaces.
The placement system computes euler rotation from the roof surface
normal so items sit flush on the slope instead of going inside.

- Add roofStrategy to placement-strategies with enter/move/click/leave
- Wire roof:enter/move/click/leave events in the placement coordinator
- Add calculateRoofRotation in placement-math using surface normals
- Support full 3D cursor rotation for sloped surfaces
- Items on roofs are parented to the level with world-space rotation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fixed conflict

* feat(cabinets): improve modular sizing and ceiling finishes

* fix(cabinet): improve constrained run reflow

* fix(nodes): constrain modular cabinet reflow

* chore(cabinet): format top finish changes

* fix modular cabinet appliance and corner behavior

* fix cabinet schema version

* fix(cabinet): improve placement snapping behavior

* fix cabinet wall snapping and direct drag

* fix cabinet resize handle pointer ownership

* fix cabinet resize constraints and reflow

* fix cabinet snap architecture findings

* fix cabinet corner resize edge cases

* fix cabinet reflow and handle hit priority

* fix occluded drag and snapped rotation

* fix nested wall cabinet panel edits

* fix L reflow context and run height bounds

* fix L-leg panel edit ownership

* chore: remove cabinet planning artifacts

* refactor: move roof placement into node registry

* fix cabinet resize handle pointer ownership

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix wall curve topology and height drag dimensions

* fix roof accessory paint slots and draw default

* fix duplicate roof segment drainage control

* fix wall editing and add thickness handles

* add plain-language OpenPR2 skill
* Add roof surface placement support for items

Items (e.g. solar panels) can now be placed on sloped roof surfaces.
The placement system computes euler rotation from the roof surface
normal so items sit flush on the slope instead of going inside.

- Add roofStrategy to placement-strategies with enter/move/click/leave
- Wire roof:enter/move/click/leave events in the placement coordinator
- Add calculateRoofRotation in placement-math using surface normals
- Support full 3D cursor rotation for sloped surfaces
- Items on roofs are parented to the level with world-space rotation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fixed conflict

* fix lean-to roof miters across connected runs

* fix canopy miter edge cases

* keep continuous canopy endpoints connected

* avoid invalid curved gutter miters

* fix(viewer): keep curved shed miters flush

* fix lean-to roof mitering and gutter spans

* test(nodes): allow canopy angle sweep under CI load

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…#741)

The open lobby (`/play/<id>`) mounts the editor under a read-only lease and
registers no host panels, so the plugin *manager* was the only tab in the
rail — and the rail opens on its first tab. A visitor who left the game found a
bare "Plugins" heading covering ~40% of the window over the world they had come
to play in.

Gate the manager on having something to manage, or on a writable scene:

- `managedPluginIds(panels)` — the distinct plugins behind the registered
  panels, since one plugin may contribute several and the manager lists plugins.
- `showsPluginManager({managedPluginCount, readOnly, workspaceMode})` — the tab
  earns its slot when a plugin is registered, or when the scene is writable and
  "Create a Pascal plugin" is still worth offering.

The only case this drops is read-only *and* nothing registered, which is exactly
the lobby; with no tabs at all both the v2 and mobile layouts already skip the
sidebar entirely, leaving the canvas alone. A read-only editor keeps the tab as
soon as a plugin is registered — browsing what a project uses is a read, and the
install button was already disabled on its own. Writable edit-workspace
behaviour is unchanged, and fenced by a test that says so.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…cap hints (pascalorg#742)

* feat(editor): capture-mode fov control and orbit/walk/fly framing cameras

- Lens pill in the snapshot overlay drives the main camera's fov (15-110°)
  while capture is open; entry fov restored on every exit path
- Orbit / Walk / Fly segmented control: walk reuses first-person, fly is a
  new no-gravity/no-collision variant on the same controls
- Enter fires the shutter (pointer lock makes the button unclickable);
  walk/fly snapshots synthesize a stored target down the view axis
- Walkthrough HUD hidden and fov effect no-oped while capture owns the frame

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

* feat(editor): drone mode polish — rename, E/Q vertical keys, keycap hints

Fly becomes Drone (lucide Drone icon, internal ids renamed; nothing
persists the value). Drone vertical: Space or E up, Q or Ctrl down; walk
keeps E/R door interaction. Camera hints are keycap chips instead of
sentence lines.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

* fix(editor): drop backdrop-blur from snapshot capture overlay pills

backdrop-filter over the WebGPU canvas flickers black on ProMotion/XDR
displays; the pills are near-opaque so the blur read as solid anyway.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…rg#743)

Snapshot capture in walk/drone still ran the viewer's default selection
manager (cursor hover highlights) and ViewerZoneSystem showed zone
geometry and tags — none of which orbit capture allows into the shot.
Gate both on capture mode.


Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Zod 4.5.0-4.5.4 (upstream PR #6432) makes a wrapped discriminator claim
undefined in addition to its literal. All 48 AnyNode members use
z.literal(t).default(t) as the discriminator, so the union's lazily
built map throws 'Duplicate discriminator value "undefined"' at first
parse — a plain Error that escapes safeParse. Cap every zod range below
4.5.0 until the projection fix lands, and drop the unused zod dependency
from apps/ifc-converter.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
`nodeType()` defaults the node `type` literal so a per-kind schema can fill
it in (`WallNode.parse({ start, end })`). From zod 4.5.0 (upstream #6432) a
`.default()`-wrapped discriminator additionally claims `undefined`, so all 48
`AnyNode` members collide on that key: the union's lazily-built discriminator
map throws `Duplicate discriminator value "undefined"` at the first parse, as
a plain Error that escapes `safeParse` — a crash in every path that validates
a node (scene load, API boundary, MCP bridge).

`nodeUnion()` projects each member to a clone whose `type` is the bare literal
before assembling the union, carrying the member's registry metadata across
`.extend()` so `.describe()` text survives. The 48 node files and `nodeType()`
are untouched, so per-kind parsing keeps its default.

The two call sites that read the kind by parsing the defaulted literal
(`AnyNode.options.map(o => o.shape.type.parse(undefined))`) now use an
exported `nodeKindOf(option)`, which also replaces the `_zod.def` walk in the
nodes coverage test.

Verified on the pinned zod 4.4.3 (core 1164, nodes 1830, mcp 341 tests green,
workspace typecheck clean) and smoke-tested on zod 4.5.4, where the schema
tests pass with the projection and an unprojected two-member union still
throws `Duplicate discriminator value "undefined"` out of `safeParse`.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
`BaseNode.metadata` (and `ZoneNode`'s redeclaration of it) was `z.json()`,
zod's recursive JSON value. That schema is self-referential, and a
self-referential member is exactly what zod 4.5's `z.compile()` refuses to
compile — so it wasn't just the slowest field in every node, it denied the
whole node tree the compiled parser.

Measured on the real `WallNode` (200k parses, steady state):

| schema             | zod 4.4.3 | 4.5.4 interpreted | 4.5.4 `z.compile()` |
|--------------------|-----------|-------------------|---------------------|
| `z.json()`         | 125ms     | 127ms             | 133ms (1.0x)        |
| `z.record(string, unknown)` | 81ms | 68ms          | 31ms (2.2x)         |

So ~1.5x per-node parse today on the shipped zod, and a 4x gap once the
compiled parser lands.

Metadata is a flat bag of per-node extras — every reader in the repo already
guards it with `typeof === 'object' && !Array.isArray()` — so an open object
with unchecked values is the whole contract. This does narrow the published
`@pascal-app/core` input contract: `metadata` was any JSON value and is now
object-only (founder-approved 2026-09-01).

Call sites that leaned on the old looser type:

- `nodes/cabinet/run-ops`: four `?.metadata ?? null` fallbacks become `?? {}`
  (both consumers normalized `null` to `{}` already, so no behavior change).
- `nodes/dormer/csg-geometry`: the virtual roof segment's `metadata: null`
  becomes `{}`.
- comments in `ifc-converter` and the converter app that described the field
  as `z.json()`.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
pascalorg#744 capped zod below 4.5.0 because `AnyNode` threw on first parse; pascalorg#745
fixed that with bare-literal discriminators. The remaining blocker was 27
failures plus a broken `tsc --build` in packages/mcp, which looked like an
MCP-SDK incompatibility with zod 4.5. It wasn't: it was two zod copies in
the tree.

Bun preserves a transitive resolution that still satisfies its range, so
moving our five workspace ranges to 4.5.4 left
`@modelcontextprotocol/sdk/zod` pinned at 4.4.3 while our schemas ran on
4.5.4. The SDK's compat layer is typed as
`z3.ZodTypeAny | z4.$ZodType` with `z4` imported from its *own* zod
(dist/esm/server/zod-compat.d.ts:1-3), so every `inputSchema` we hand it
was a foreign `$ZodType` — hence the TS2322s — and its `safeParse` ran
4.4.3 internals over 4.5.4 schema objects, which is where
`expected "nonoptional"` came from. Deleting the nested copy alone (SDK
still 1.29.0) took packages/mcp from 27 failures to 1 and made
`tsc --build` clean.

Bumping the SDK 1.29.0 -> 1.30.0 is the durable form of that fix: it makes
bun re-resolve the SDK subtree, which dedupes zod onto the single root
4.5.4 and drops the nested entry from the lockfile. A from-scratch install
of either SDK version already dedupes; only our incremental range change
skewed. No SDK API changed.

The one genuine zod 4.5 behavior change is in JSON Schema emission: a
union of primitive types now folds to `type: ['number','string']` instead
of `anyOf: [{type:'number'},{type:'string'}]`. Both forms validate
identically under the ajv draft-2020-12 validator the SDK ships (checked
against 0.9, "6 ft", true, null, {}), so `measurement.test.ts` now asserts
the accepted type set rather than the spelling.

Left alone: `ultracite/zod` and `react-doctor/eslint-plugin-react-hooks/zod`
keep their own 4.4.3 — dev-only CLIs that never see our schemas.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
`z.compile()` (zod 4.5) AOT-codegens a parser. Applied per node kind, on
first parse of that kind, it is p50 2.8x faster than the interpreted
per-kind schema and 3.4x faster than parsing through `AnyNode`.

Applied to the *union* it is the wrong trade: 41ms of codegen in one hit
and no faster than the per-kind map on mixed input (0.98x). Applied to
all 48 kinds eagerly it costs +44MB RSS. So: one lazy `Map`, one clone
per kind, only for kinds a call site actually sees, and off by default.

Wired at three long-lived call sites — the MCP bridge create path,
scene-load migrations, and the store create/update parses — each of
which re-parses the same handful of kinds for the lifetime of the tab.

Parity is asserted for all 48 kinds: identical output (key set *and*
key order, since `wall.height` absence is a mode), identical issues,
identical `error.message`, both against the interpreted per-kind schema
and against the union. Under `jitless` / a blocked `Function`
constructor, `z.core.util.allowsEval` short-circuits and every schema
stays interpreted — proven in a child process.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…lts to Pascal (pascalorg#749)

* viewer: re-resolve dangling library material refs when the dynamic library registers

AI-generated `library:mtl_*` presets register asynchronously (a host fetch),
so a wall that renders before they land resolves its painted slots to the
slot default — and the wall material cache, whose signature assumed library
refs are static catalog content, pinned that default for the whole session.

Library-ref signatures now carry an `#unresolved` tag while the ref dangles,
and the wall renderer + cutout loop watch the dynamic library version, so a
late registration flips the signature and recomputes the materials.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

* editor: drop the paint picker's All source tab, default to Pascal

Parity with the Items / Rooms / Build browse surfaces, which dropped the
combined list because it buried the curated set.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
… draws from it (pascalorg#750)

The roof's 'Create from' (draw two corners vs pick a detected room) only
existed as a hand-rolled row in the standalone Build tab, backed by
toolDefaults.roof.footprintSource — which preset seeding nulls on every
activation and the roof tool clears on unmount, so the choice never
reliably survived, and the community Build sidebar (preset-driven,
hardcoded) never surfaced it at all.

Kinds now declare pick-one option rows via def.toolOptions (the sidebar
sibling of toolHints[].chip), rendered by the shared <ToolOptionsPanel>
that any host mounts once — no per-kind host wiring. The roof declares
footprintSource over a small ephemeral store (like roof-placement-mode),
the tool and the 2D floorplan hook read that store (the hook through the
registry — its editor sources land in the nodes program, where a nodes
import would cycle onto nodes' own dist), and the standalone Build tab
replaces its hand-rolled row with the panel.


Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
mode and tool were two independently-writable, independently-persisted
fields with six ad-hoc writers (setMode, raw setTool, setPhase's rewrite,
setStructureLayer's rewrite, keyboard, panels), so impossible states —
build with no tool, a lit tool in select mode, a paint swatch click that
never re-armed paint mode — were representable and survived reload.

The store now holds a ToolMode discriminated union as the source of truth
(build carries its tool by construction), with armToolMode as the sole
transition: it owns phase/viewMode promotions, default-tool election,
paint priming, and syncBrushModeScope, and materializes mode/tool mirrors
so the ~150 existing readers are untouched. armMaterialPaint arms paint
and sets the brush in one step — the material picker now routes through
it, so picking a swatch always returns to paint mode. setMode/setTool
remain as thin wrappers over the transition; rehydration normalizes the
persisted toolMode against legacy mode/tool pairs.


Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…ment regressions (pascalorg#752)

* editor: camera follows the level across mode switches and new levels

Switching level presentation (stacked/exploded/solo) never moved the
camera — the level-frame effect only fired on selection change — and a
freshly created level framed at y=0 because the effect read the level
Object3D's position before LevelSystem had lerped it anywhere.

The effect now derives the destination analytically (stacked elevation +
exploded gap, shared with LevelSystem via getLevelPresentationY), watches
levelMode, and skips when already on target — which also swallows the
thumbnail generator's synchronous stacked/restore round-trip.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

* editor: studio snapshot camera polish — capture pill, instant pointer lock, wheel lens + click shutter

- The Studio capbar's preselected crop no longer hides the
  standard/viewport/area pill: preselecting seeds the overlay, and only an
  explicit host lockCrop (the publish cover's exact-shape capture) hides
  the switcher.
- Switching the snapshot camera to walk/drone locks the pointer in the same
  click (flushSync mounts the controls first) instead of demanding a second
  canvas click.
- While walk/drone hold the lock: wheel drives the lens (accumulated
  sub-degree deltas, wheel-up zooms in) and left click fires the shutter
  alongside Enter. Walk's door-toggle click is silenced during capture, and
  the acquiring click can't shoot (shutter gates on the lock being held).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

* editor: fix window on-wall placement preview and opening cursor facing

Two regressions in opening placement:

- pascalorg#718 rewrote MoveWindowTool to publish drag state through
  useLiveNodeOverrides, including `parentId` — but reparenting is
  structural: the wall's CSG merge and the renderer's nesting walk the
  wall's `children` array, which an override never joins. Placing a window
  preset showed no on-wall preview at all (no cut, no mesh — only the
  override-independent guides), while doors, still on scene writes, worked.
  The wall branch and free-follow now write the scene exactly like
  MoveDoorTool (reparent on host change, direct mesh transform + live
  transforms on same-host slides), and stale overrides are dropped when
  entering the wall mode.

- The door/window PLACEMENT tools still fed `calculateCursorRotation` into
  the cursor and facing triangle — the helper pascalorg#643 identified as π off and
  migrated every other caller away from. The triangle pointed at the far
  side of the wall on half the walls. Both tools now use the wall-child
  world yaw (`itemRotation - wallAngle`, the move tools' convention), and
  the helper is deleted so nothing can regress onto it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

* editor: capture walk/drone — E opens, Esc pauses, click shoots, drone re-locks

Four snapshot-camera fixes:

- E/R open doors and windows again during capture walk (only the CLICK
  path is capture-gated now — a locked click is the shutter), and the
  walkthrough crosshair (dot → green ring over an interactable) renders in
  the capture overlay, which replaces the walkthrough HUD.
- Esc acts like P in walk/drone: the browser's pointer-lock exit pauses
  (cursor freed, camera and capture kept) instead of bailing to orbit and
  throwing away the framed pose; the overlay only dismisses on Esc from
  orbit. Covers both the keydown path and the no-keydown native unlock.
- The click shutter actually fires: FirstPersonControls' document-capture
  mousedown handler stops propagation while locked, so the overlay's
  listener moves to window-capture (and the door-toggle mousedown yields
  during capture).
- Switching cameras right after freeing the cursor hit the browser's
  ~1.25s re-lock cooldown — the reason drone (only reachable with a free
  cursor) never locked while walk-from-orbit did. The lock helper retries
  once after the cooldown while still framing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

* editor: freeze walk/drone while the shutter renders

From the click/Enter until the saved toast clears, look, walk physics and
drone motion hold still — a late WASD tap or mouse twitch no longer shifts
the frame out from under the shot the user just took.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

* editor: second Esc in capture walk/drone cancels the snapshot

First Esc frees the cursor (pause); with the cursor already free, Esc now
cancels capture — setCaptureMode(false) lands the camera back on orbit —
instead of doing nothing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018gQSsJ7nfdARkNH5PcKUjt

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
)

* Add roof surface placement support for items

Items (e.g. solar panels) can now be placed on sloped roof surfaces.
The placement system computes euler rotation from the roof surface
normal so items sit flush on the slope instead of going inside.

- Add roofStrategy to placement-strategies with enter/move/click/leave
- Wire roof:enter/move/click/leave events in the placement coordinator
- Add calculateRoofRotation in placement-math using surface normals
- Support full 3D cursor rotation for sloped surfaces
- Items on roofs are parented to the level with world-space rotation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fixed conflict

* Enhance modular cabinet editing and validation

* Complete cabinet interaction enhancements

* Fix architecture review findings

* fix cabinet wall opening awareness during moves

* feat cabinet exact dimension placement

* feat cabinet run width equalization

* feat cabinet run array duplication

* feat add wall cabinet height presets

* chore remove swing check and hinge quick action

* fix cabinet preview architecture findings

* fix(cabinet): preview linked L runs during width resize

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
…on receipts, DOM panel (pascalorg#755)

* viewer: perf-tracks shared sink for ?perf instrumentation

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nq2rLE18tFVES2LU6HGokK

* viewer/editor: ?perf instrumentation pass — real GPU timestamps, per-system User Timing tracks

- DRAW read info.render.calls (lifetime render() count, never reset) — now drawCalls
- GPU time now from WebGPU timestamp queries (trackTimestamp + resolveTimestampsAsync);
  the old queue-fence delta stays as QUEUE (backpressure), encode CPU as ENCODE
- perf-tracks: shared sink emitting DevTools custom tracks (trackGroup Pascal) +
  per-window counter buckets; perf-observers: longtask observer
- spans: frame-cpu (FrameLimiter advance), geometry builders, wall miter/rebuild/CSG,
  door/window rebuilds, pointer raycast, react-render Profiler boundary
- panel: FRAME cpu avg/max, MEM (info.memory + JS heap), visible-only census at 2s,
  TRACKS readout, clearPerfMeasures per drain; FPS threshold matches the 50fps cap
- deleted dormant DebugRenderer (unreferenced; would double-render if mounted)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nq2rLE18tFVES2LU6HGokK

* viewer: perf panel as draggable DOM tool, out of the canvas

drei <Html> wrappers carry a camera-driven transform, which turns the old
overlay's position:fixed into 'fixed relative to the wrapper' — the panel
drifted with the camera. PerfMonitor is now a headless in-canvas collector
publishing to perf-panel-store; PerfPanel portals to <body>: draggable by
header, dockable to the nearest edge as a live fps tab, placement persisted
in localStorage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nq2rLE18tFVES2LU6HGokK

* viewer: perf-actions ledger contract + sample tap in perf-tracks

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nq2rLE18tFVES2LU6HGokK

* viewer/editor: action-cost ledger for ?perf

Edit gestures now produce receipts: begin/commit/cancel bracket a gesture,
every perf-tracks sample in between is attributed to it, and the action
settles only when dirty nodes + deferred wall rebuilds hit zero and one more
GPU sample lands. Receipts surface in the panel (last action + breakdown),
the console, and a DevTools 'Actions' lane.

Call sites: the interaction scope store as the generic bracket (yields to
more specific ones), use-drag-action, 2D floorplan gestures, place/undo/
redo/delete/level-switch; markToolCancelConsumed finalizes cancels.
Settle system feeds the ledger per frame at priority 100.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nq2rLE18tFVES2LU6HGokK

* viewer: window.__pascalPerf probe hooks for scripted perf runs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nq2rLE18tFVES2LU6HGokK

* viewer: settle counts only live dirty nodes

A node deleted while dirty (undo of a wall split) leaves its mark in
dirtyNodes forever — no system clears marks for missing nodes — and that
phantom dirt kept every action receipt from settling in furnished scenes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nq2rLE18tFVES2LU6HGokK

* perf ledger: review fixes — scope ownership, settle without timestamps, no-op undo

- the interaction scope now commits only the action IT began (id token), and
  yields only to an UNCOMMITTED action, so a settling receipt can't swallow
  the next gesture and a specific call site's cancel is never committed by
  the generic bracket
- devices without timestamp-query settle on the queue fence instead of
  timing every receipt out
- a no-op undo/redo no longer opens a receipt
- import order (CI quality)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nq2rLE18tFVES2LU6HGokK

* viewer: declare react-dom (portal in perf-panel)

CI typecheck resolves per-package: the perf panel's createPortal import needs
react-dom declared, not inherited from hoisting. Same peer + types pattern as
packages/editor.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nq2rLE18tFVES2LU6HGokK

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
…ton (pascalorg#756)

Panel-placed plugin kinds (e.g. pets) have no catalog entry to find; let a
definition drop the Search action while keeping move/duplicate/delete.


Claude-Session: https://claude.ai/code/session_01FB5xnSoozJZ1jXCFgbLSDG

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The manifest-first archive moved surface-mesh, point-cloud, and
device-motion payloads out of inline stream data into JSON preview
artifacts, but renderability and hydration still assumed inline —
surface mesh reported "no data", point cloud and the motion trajectory
silently vanished. Accept application/json payload artifacts as
renderable and fetch them into the inline payload shape the layers
already consume.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Aymericr and others added 9 commits September 11, 2026 10:05
The 1.0.0 release failed with EOTP on its first publish: npm no longer
accepts direct publishing with 2FA-bypass granular tokens. Drop
NODE_AUTH_TOKEN from every publish step so npm 11 exchanges the GitHub
Actions OIDC token instead. Requires each @pascal-app package to have
this repository, workflow file and the npm environment configured as a
trusted publisher on npmjs.com.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…scalorg#845)

The npm package carried the whole standalone Next editor: 65 MB compressed,
102 MB unpacked, for 0.1 MB of CLI code. Agents that only speak MCP paid that
cost too, because the MCP bridge started the editor to reach it.

Split the two. `dist/` now holds the CLI plus `services/pascal-mcp.mjs` and a
`runtime-source.json` naming the web runtime archive for this exact version,
its size, and its SHA-256. The web editor runtime ships as a GitHub release
asset and is downloaded once per version, verified, and installed through the
existing atomic install seam.

- MCP is its own managed service (`run/mcp.json`), started on demand by
  `pascal mcp connect` with no editor process and no runtime download.
- Commands that start the editor resolve the runtime from
  `PASCAL_BUNDLED_RUNTIME_DIR`, `--runtime <directory-or-archive>`, the
  installed version, else the release asset; a digest mismatch deletes the
  temporary file and installs nothing.
- Downloads stream over `node:https` with `HTTPS_PROXY`/`NO_PROXY` support and
  no new dependency; concurrent first runs share the install lock.
- `stage-runtime` writes a deterministic `pascal-web-runtime-<version>.tar.gz`
  plus `.sha256`; the release job verifies both before publishing and uploads
  them to the CLI tag right after it is pushed.
- The smoke test now covers MCP-only startup with no runtime present and the
  local-archive install, including a one-byte tamper that must fail closed.

Package: 0.46 MB compressed, 2.46 MB unpacked, 68 files.
Archive: 64.2 MB compressed, 106 MB installed.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Document the hosted-only Capture scan path (list_captures, get_capture,
open_capture_as_project) in the pascal-3d skill and its tool workflows, and
scope the counted 46-tool annotation inventory to the public package so the
hosted server's extra tools do not read as a packet gap.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…rg#849)

* feat(plugins): add optional hosted auth to the Cursor plugin

A Cursor install can now reach hosted Pascal — projects, Pascal Capture
scans and shared workspaces — with an optional API key, while the
credential-free local `pascal mcp connect` server keeps working.

`.cursor-plugin/plugin.json` declares an optional `PASCAL_API_KEY`
variable and points `mcpServers` at a new Cursor-dialect
`.cursor-plugin/mcp.json` that adds a `pascal-hosted` server for
https://editor.pascal.app/api/mcp. Cursor substitutes the bare
`${PASCAL_API_KEY}` plugin-variable form from its dashboard, so the
repository holds only the placeholder. The variable is absent from
`required`, so an install with no key still loads and only
`pascal-hosted` fails (401).

The portable `mcp.json` stays credential-free on purpose. Agent Plugins
1.0.0 forbids secrets and placeholder expansion in `headers` (7.2.3,
9.2), its only remote keyword is `streamable-http` rather than Cursor's
`http`, and Codex drops a plugin-supplied `Authorization` as a
client-owned header. Codex users therefore keep using
`codex mcp add --bearer-token-env-var PASCAL_API_KEY`.

ClawHub already declares `PASCAL_API_KEY` optional through
`metadata.openclaw.envVars[].required: false`, so the skills are
unchanged.

`bun run skills:validate` now asserts the Cursor MCP path, a `pascal`
server identical to the portable one, the exact hosted URL and header
template, the optional-and-never-required variable with no unsupported
schema keywords, and that no `${VAR}` in the Cursor config is
undeclared.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(plugins): keep the Cursor author block within Cursor's schema

Cursor's plugin.json schema allows only name and email under author
(additionalProperties: false); the url field failed validation on every
install. Compare the Cursor manifest's author on those two fields and
link the changelog entry to pascalorg#849.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
… and rotation-stable surface planning (row 17) (pascalorg#850)

* perf(nodes): invalidate slabs by derived polygon changes

* perf(core): scope temporal reconciliation to changed nodes

* fix(nodes): mirror rendered slab context membership and order

* perf(nodes): reuse slab inputs and scope polygon derivation

* test(core): verify structural temporal reconciliation outcomes

* docs: describe temporal candidates and slab dependency tracking

* perf(core): skip disjoint room coverage and rotated surface rewrites

Cache polygon bounds for indexed surface scoping and preserve exact cyclic
outer-ring rotations in the shared slab and ceiling planners.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jmmz2AMwTzcnKsSHHPEMhN

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…lorg#851)

Avoid npm package sprawl before 1.0.0: `@pascal-app/capture-protocol`
becomes the `@pascal-app/core/capture` subpath and
`@pascal-app/capture-viewer` becomes `@pascal-app/viewer/capture` (plus
`@pascal-app/viewer/capture/preview`), so the release ships seven
packages: core, viewer, editor, nodes, mcp, ifc-converter, cli.

Neither package was ever published to npm, so no npm consumer migrates.
The protocol code is pure zod/TS, so core keeps its no-Three.js layer
rule; the runtime and its reference layers keep viewer's existing peers
and now reach viewer internals through relative imports instead of a
self-referential `@pascal-app/viewer` specifier.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…est imports it (pascalorg#852)

The registered tool lifecycle test imports @react-three/test-renderer, but
only the viewer workspace declared it. Hoisting hid the missing dependency;
private-editor CI uses Bun's isolated linker and cannot resolve that import
from the editor workspace. Declare the same ^9.1.0 development dependency
in editor and record it in the workspace lockfile entry.


Claude-Session: https://claude.ai/code/session_01Jmmz2AMwTzcnKsSHHPEMhN

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…ascalorg#853)

The 1.0.0 run failed publishing core with E404. actions/setup-node with
registry-url writes an .npmrc whose token falls back to the placeholder
XXXXX-XXXXX-XXXXX-XXXXX when NODE_AUTH_TOKEN is unset; npm sent that fake
token instead of exchanging the Actions OIDC token, and the registry
answered 404. Without registry-url no .npmrc is written and npm 11 falls
through to trusted publishing.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Aymericr and others added 17 commits September 11, 2026 16:18
…lorg#856)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
…arify device-path visibility (pascalorg#858)

* fix(capture): cache preview data and improve device path visibility

* fix(capture): recover failed JSON preview downloads

* test(viewer): preload one React instance before rendering hooks
…editor@1.0.0 @pascal-app/nodes@1.0.0 @pascal-app/mcp@1.0.0 @pascal-app/ifc-converter@1.0.0 @pascal-app/cli@1.0.0

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…pascalorg#859)

`@pascal-app/cli@1.0.0` is on the npm `latest` tag with `pascal agent claim`,
`pascal agent status`, and the read-only `check_collisions.candidate` input, so
the checksum-verified GitHub prerelease the docs pointed at is obsolete. Delete
the "Verified CLI preview" and "Verified GitHub preview" sections, stop
recommending the `beta` dist-tag (it still resolves to the older
`1.0.0-beta.1`), and drop the inverted claim that the npm package bundles the
web editor runtime — 1.0.0 downloads it from a release asset on first use.

Close the changelog's `Unreleased` heading as `1.0.0 (2026-09-12)` with the
package and contributor sections the earlier releases carry.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…rg#735)

manifold-3d's emscripten glue awaits import('node:module') behind a Node
check; the branch never executes in a browser, but webpack refuses to
build any graph that can reach it. export-manager.tsx statically imports
the manifold worker wrapper and ExportManager renders unconditionally
from the editor root, so every external webpack consumer of
@pascal-app/editor failed at build time (pascalorg#715).

The worker chunk is still built by the consumer's bundler, but it no
longer contains a traceable manifold-3d specifier. The glue is loaded at
runtime through an import() no bundler follows: bare specifier first
(bun tests, dev servers, bundlers that inlined it anyway), then a
version-pinned jsDelivr copy for bundled browser builds — emscripten
locates manifold.wasm relative to the glue's own URL, so the CDN path
self-resolves. configureManifoldRuntime(options) lets offline or
CSP-restricted hosts point both URLs at self-hosted assets.

A failed load no longer poisons later attempts: the cached module
promise resets on rejection.

Fixes pascalorg#715

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* docs(mcp): make batch-first apply_patch usage the stated default

Tool description, agent guide, from-brief preamble, and README now instruct agents to compose one atomic apply_patch batch per phase instead of looping single-op calls. The tool already validates all ops before applying any; only the guidance was missing.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* test(mcp): assert batch-first apply_patch guidance surfaces

Lock the tool description, agent guide, from_brief preamble, and README
row that state batch-first as the default without changing apply_patch
runtime behavior.

---------

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
pascalorg#814)

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
…alorg#848)

`bun run skills:validate` fails on Windows for every cross-file link
inside a skill bundle and for both OpenAI interface assets, even though
each referenced file exists inside the plugin. `resolve()` returns
backslash-separated paths on Windows, so the `${dir}/` prefix compared
against never matched.

Compare on a normalized separator instead, and cover the predicate with
a focused test so the check stays platform-independent.
The MCP SDK emits tool schemas with a draft-07 dialect, so clients that
enforce JSON Schema 2020-12 reject every tool call. The generated schemas
use no draft-07-only keywords, so re-registering the tools/list handler to
retarget the declared $schema is sufficient.

Fixes pascalorg#696
…org#847)

* fix(editor): skip roof support levels in the floorplan export

`resolveExportLevels()` collected every level child of the active
building and filtered on `type === 'level'` only, so a dedicated roof
support level (`metadata.role === 'roof'`) produced an extra page with
just the roof outline. `agent-guide.ts` already states that such a level
is not an occupied story, and the level UI and elevation math honour it;
the export did not.

Filter roof levels out of the export set and cover it with a regression
test, including the case where the roof level is the selected one.

Fixes pascalorg#618

* ci(release): publish through npm trusted publishing only (pascalorg#839)

The 1.0.0 release failed with EOTP on its first publish: npm no longer
accepts direct publishing with 2FA-bypass granular tokens. Drop
NODE_AUTH_TOKEN from every publish step so npm 11 exchanges the GitHub
Actions OIDC token instead. Requires each @pascal-app package to have
this repository, workflow file and the npm environment configured as a
trusted publisher on npmjs.com.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* feat(cli): ship a small CLI that downloads the web editor runtime (pascalorg#845)

The npm package carried the whole standalone Next editor: 65 MB compressed,
102 MB unpacked, for 0.1 MB of CLI code. Agents that only speak MCP paid that
cost too, because the MCP bridge started the editor to reach it.

Split the two. `dist/` now holds the CLI plus `services/pascal-mcp.mjs` and a
`runtime-source.json` naming the web runtime archive for this exact version,
its size, and its SHA-256. The web editor runtime ships as a GitHub release
asset and is downloaded once per version, verified, and installed through the
existing atomic install seam.

- MCP is its own managed service (`run/mcp.json`), started on demand by
  `pascal mcp connect` with no editor process and no runtime download.
- Commands that start the editor resolve the runtime from
  `PASCAL_BUNDLED_RUNTIME_DIR`, `--runtime <directory-or-archive>`, the
  installed version, else the release asset; a digest mismatch deletes the
  temporary file and installs nothing.
- Downloads stream over `node:https` with `HTTPS_PROXY`/`NO_PROXY` support and
  no new dependency; concurrent first runs share the install lock.
- `stage-runtime` writes a deterministic `pascal-web-runtime-<version>.tar.gz`
  plus `.sha256`; the release job verifies both before publishing and uploads
  them to the CLI tag right after it is pushed.
- The smoke test now covers MCP-only startup with no runtime present and the
  local-archive install, including a one-byte tamper that must fail closed.

Package: 0.46 MB compressed, 2.46 MB unpacked, 68 files.
Archive: 64.2 MB compressed, 106 MB installed.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* docs(skills): describe the hosted-only capture tools (pascalorg#846)

Document the hosted-only Capture scan path (list_captures, get_capture,
open_capture_as_project) in the pascal-3d skill and its tool workflows, and
scope the counted 46-tool annotation inventory to the public package so the
hosted server's extra tools do not read as a packet gap.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* feat(plugins): add optional hosted auth to the Cursor plugin (pascalorg#849)

* feat(plugins): add optional hosted auth to the Cursor plugin

A Cursor install can now reach hosted Pascal — projects, Pascal Capture
scans and shared workspaces — with an optional API key, while the
credential-free local `pascal mcp connect` server keeps working.

`.cursor-plugin/plugin.json` declares an optional `PASCAL_API_KEY`
variable and points `mcpServers` at a new Cursor-dialect
`.cursor-plugin/mcp.json` that adds a `pascal-hosted` server for
https://editor.pascal.app/api/mcp. Cursor substitutes the bare
`${PASCAL_API_KEY}` plugin-variable form from its dashboard, so the
repository holds only the placeholder. The variable is absent from
`required`, so an install with no key still loads and only
`pascal-hosted` fails (401).

The portable `mcp.json` stays credential-free on purpose. Agent Plugins
1.0.0 forbids secrets and placeholder expansion in `headers` (7.2.3,
9.2), its only remote keyword is `streamable-http` rather than Cursor's
`http`, and Codex drops a plugin-supplied `Authorization` as a
client-owned header. Codex users therefore keep using
`codex mcp add --bearer-token-env-var PASCAL_API_KEY`.

ClawHub already declares `PASCAL_API_KEY` optional through
`metadata.openclaw.envVars[].required: false`, so the skills are
unchanged.

`bun run skills:validate` now asserts the Cursor MCP path, a `pascal`
server identical to the portable one, the exact hosted URL and header
template, the optional-and-never-required variable with no unsupported
schema keywords, and that no `${VAR}` in the Cursor config is
undeclared.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(plugins): keep the Cursor author block within Cursor's schema

Cursor's plugin.json schema allows only name and email under author
(additionalProperties: false); the url field failed validation on every
install. Compare the Cursor manifest's author on those two fields and
link the changelog entry to pascalorg#849.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* perf: per-slab invalidation, candidate-scoped temporal reconciliation and rotation-stable surface planning (row 17) (pascalorg#850)

* perf(nodes): invalidate slabs by derived polygon changes

* perf(core): scope temporal reconciliation to changed nodes

* fix(nodes): mirror rendered slab context membership and order

* perf(nodes): reuse slab inputs and scope polygon derivation

* test(core): verify structural temporal reconciliation outcomes

* docs: describe temporal candidates and slab dependency tracking

* perf(core): skip disjoint room coverage and rotated surface rewrites

Cache polygon bounds for indexed surface scoping and preserve exact cyclic
outer-ring rotations in the shared slab and ceiling planners.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jmmz2AMwTzcnKsSHHPEMhN

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* editor: integrate Environment with generic host and export APIs (pascalorg#831)

* refactor(packages): fold capture packages into core and viewer (pascalorg#851)

Avoid npm package sprawl before 1.0.0: `@pascal-app/capture-protocol`
becomes the `@pascal-app/core/capture` subpath and
`@pascal-app/capture-viewer` becomes `@pascal-app/viewer/capture` (plus
`@pascal-app/viewer/capture/preview`), so the release ships seven
packages: core, viewer, editor, nodes, mcp, ifc-converter, cli.

Neither package was ever published to npm, so no npm consumer migrates.
The protocol code is pure zod/TS, so core keeps its no-Three.js layer
rule; the runtime and its reference layers keep viewer's existing peers
and now reach viewer internals through relative imports instead of a
self-referential `@pascal-app/viewer` specifier.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* fix(editor): declare @react-three/test-renderer where the lifecycle test imports it (pascalorg#852)

The registered tool lifecycle test imports @react-three/test-renderer, but
only the viewer workspace declared it. Hoisting hid the missing dependency;
private-editor CI uses Bun's isolated linker and cannot resolve that import
from the editor workspace. Declare the same ^9.1.0 development dependency
in editor and record it in the workspace lockfile entry.


Claude-Session: https://claude.ai/code/session_01Jmmz2AMwTzcnKsSHHPEMhN

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* ci(release): drop registry-url so npm uses OIDC trusted publishing (pascalorg#853)

The 1.0.0 run failed publishing core with E404. actions/setup-node with
registry-url writes an .npmrc whose token falls back to the placeholder
XXXXX-XXXXX-XXXXX-XXXXX when NODE_AUTH_TOKEN is unset; npm sent that fake
token instead of exchanging the Actions OIDC token, and the registry
answered 404. Without registry-url no .npmrc is written and npm 11 falls
through to trusted publishing.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* ci(release): log npm verbosely to surface OIDC exchange errors (pascalorg#856)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* fix(capture): cache preview artifacts, retry failed downloads, and clarify device-path visibility (pascalorg#858)

* fix(capture): cache preview data and improve device path visibility

* fix(capture): recover failed JSON preview downloads

* test(viewer): preload one React instance before rendering hooks

* release: @pascal-app/core@1.0.0 @pascal-app/viewer@1.0.0 @pascal-app/editor@1.0.0 @pascal-app/nodes@1.0.0 @pascal-app/mcp@1.0.0 @pascal-app/ifc-converter@1.0.0 @pascal-app/cli@1.0.0

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs: replace the CLI preview instructions with the published npm CLI (pascalorg#859)

`@pascal-app/cli@1.0.0` is on the npm `latest` tag with `pascal agent claim`,
`pascal agent status`, and the read-only `check_collisions.candidate` input, so
the checksum-verified GitHub prerelease the docs pointed at is obsolete. Delete
the "Verified CLI preview" and "Verified GitHub preview" sections, stop
recommending the `beta` dist-tag (it still resolves to the older
`1.0.0-beta.1`), and drop the inverted claim that the npm package bundles the
web editor runtime — 1.0.0 downloads it from a release asset on first use.

Close the changelog's `Unreleased` heading as `1.0.0 (2026-09-12)` with the
package and contributor sections the earlier releases carry.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* docs: describe the release workflow and refresh the validation scope (pascalorg#860)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* fix(editor): keep manifold-3d out of consumer bundler graphs (pascalorg#735)

manifold-3d's emscripten glue awaits import('node:module') behind a Node
check; the branch never executes in a browser, but webpack refuses to
build any graph that can reach it. export-manager.tsx statically imports
the manifold worker wrapper and ExportManager renders unconditionally
from the editor root, so every external webpack consumer of
@pascal-app/editor failed at build time (pascalorg#715).

The worker chunk is still built by the consumer's bundler, but it no
longer contains a traceable manifold-3d specifier. The glue is loaded at
runtime through an import() no bundler follows: bare specifier first
(bun tests, dev servers, bundlers that inlined it anyway), then a
version-pinned jsDelivr copy for bundled browser builds — emscripten
locates manifold.wasm relative to the glue's own URL, so the CDN path
self-resolves. configureManifoldRuntime(options) lets offline or
CSP-restricted hosts point both URLs at self-hosted assets.

A failed load no longer poisons later attempts: the cached module
promise resets on rejection.

Fixes pascalorg#715

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* mcp: make batch-first apply_patch the stated default (pascalorg#767)

* docs(mcp): make batch-first apply_patch usage the stated default

Tool description, agent guide, from-brief preamble, and README now instruct agents to compose one atomic apply_patch batch per phase instead of looping single-op calls. The tool already validates all ops before applying any; only the guidance was missing.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* test(mcp): assert batch-first apply_patch guidance surfaces

Lock the tool description, agent guide, from_brief preamble, and README
row that state batch-first as the default without changing apply_patch
runtime behavior.

---------

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(editor): type optional ancestor traversal for downstream consumers (pascalorg#814)

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>

* fix(viewer): clamp GLB floor animation on slow frames (pascalorg#820)

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>

* fix(skills): compare bundle paths without a hardcoded separator (pascalorg#848)

`bun run skills:validate` fails on Windows for every cross-file link
inside a skill bundle and for both OpenAI interface assets, even though
each referenced file exists inside the plugin. `resolve()` returns
backslash-separated paths on Windows, so the `${dir}/` prefix compared
against never matched.

Compare on a normalized separator instead, and cover the predicate with
a focused test so the check stays platform-independent.

---------

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
Co-authored-by: Aymeric Rabot <aymeric@pascal.app>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Co-authored-by: Wassim SAMAD <wass08@gmail.com>
Co-authored-by: Adam NAILI <18304870+AxiomeCG@users.noreply.github.com>
Co-authored-by: ActArtech <123718991+ActArtech@users.noreply.github.com>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Co-authored-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
* fix(cli): preserve configured Mint host origin

* ci: enable trusted publishing for MCP and CLI releases (pascalorg#779)

* docs: add verified candidate CLI preview (pascalorg#780)

* docs: add verified candidate CLI preview

* docs: activate preview runtime during upgrades

* Require measured evidence and target-scoped furniture checks (pascalorg#781)

* Strengthen furniture fit evidence boundaries

* Record candidate validation status

* Clarify requested geometry scope

* Record furniture evidence gate results

* Document skill validation and safe preview activation (pascalorg#782)

* Record final skill validation status

* Clarify routing audit result

* Document safe preview activation

* editor: Add duct and pipe fittings, routing, and system checks (pascalorg#769)

* Add roof surface placement support for items

Items (e.g. solar panels) can now be placed on sloped roof surfaces.
The placement system computes euler rotation from the roof surface
normal so items sit flush on the slope instead of going inside.

- Add roofStrategy to placement-strategies with enter/move/click/leave
- Wire roof:enter/move/click/leave events in the placement coordinator
- Add calculateRoofRotation in placement-math using surface normals
- Support full 3D cursor rotation for sloped surfaces
- Items on roofs are parented to the level with world-space rotation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fixed conflict

* fix: pass nodes to lazy inspector panels

* MEP: unify duct and DWV routing UX

* Point editor dev runtime at local Streetscape plugin

* MEP: add exact lengths and branch affordances

* Make MEP runs surface-aware

* MEP: unify wall-aware duct and pipe run UX

- Add surface-aware drafting, snapping, and run attachments
- Support wall-attached run movement and endpoint updates
- Improve placement grid anchoring and semantic surface events

* MEP: free wall-attached routing and simplify fitting actions

- Continue routing horizontally after leaving a wall
- Keep quick material actions for pipe fittings only

* Fix duct and DWV direction capture from camera rays

* Align MEP snapping with architecture rules

* chore: satisfy repository checks

* test: scope pipe continuation handle assertion

* Add configurable MEP hangers and fix run drawing interactions

* Unify MEP accessory snapping and system connectivity

- Add shared snapping for MEP accessories with live setting updates
- Respect surfaces, levels, building transforms, and system boundaries
- Add coverage for snapping and cross-floor port connectivity

* Improve MEP connection feedback, slope controls, checks and hangers

* MEP: expand fitting catalogs and accessory configuration

- Add duct and DWV fittings, accessories, geometry, placement, and thumbnails
- Unify fitting selection through configurable tool options

* Simplify MEP build tools by removing the Add Trap action

- Remove the context-specific DWV Pipe Add Trap button from the Build tab

* Unify MEP run editing and placement UX

- Preview pipe and duct edits through live overrides
- Track fitting placement with interaction scopes
- Align surface-aware routing and accessory snapping

* Use live overrides for MEP selection previews

- Keep duct and pipe drag, roll, and offset previews out of committed scene state
- Render selection handles from live node overrides during interactions

* Simplify pipe routing status controls

* Make drafting behavior registry-driven

* Fix drafting history test registry setup

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* perf(editor): instance the ceiling corner brackets per level (pascalorg#784)

* perf(editor): instance ceiling corner brackets per level

Replace the per-corner meshes with two level-wide InstancedMeshes sharing
one unit BoxGeometry. Legs and cubes use the same geometry/material path,
so their individual transforms fit in a single batch per opacity state.
Normal instances use 0.72 opacity and highlighted instances use 0.92;
instanceColor carries the original gray/indigo colors. Three 0.185.1's
StandardNodeLibrary maps MeshBasicMaterial to MeshBasicNodeMaterial, whose
NodeMaterial.setupDiffuseColor multiplies instanceColor into material color.
This requires no custom shader or per-camera sorting.

Keep the per-ceiling drag controllers memoized and non-rendering. Geometry,
height, live overrides and preview changes update that ceiling's matrices;
hover transfers only the affected parts between packed instance arrays.
Capacity doubles with headroom on overflow, count tracks occupied slots,
and React observes the batch store only when meshes are reallocated.
Conservative expanding spheres keep native raycasts valid after writes;
frustumCulled=false prevents stale render bounds from hiding handles.
InstancedMesh.prototype.raycast remains unchanged on the pointer fast path.

Use R3F's per-instance over/out events, with move reconciliation when packed
slots change ownership. Snapshot outgoing hover targets and pointer-down
part identities, allow clicks across highlight-batch transfers at the canvas
root, and retain stable React keys so R3F transfers interaction state on
capacity growth. Preserve the level portal and registry retry, ceiling:click
payload, drag/snap/SFX/override lifecycle, and synchronous capture hiding.

Accepted visual changes from the architect ruling:
- Normal brackets render at 1000 and highlighted brackets at 1001, making
  mixed overlaps deterministically highlighted-on-top.
- Ordering against other transparent objects at 1000 is now per batch,
  using the shared geometry centre at the level origin, rather than per
  bracket. There is no per-camera instance sorting.
No other intentional behavior changes.

Validation:
- Built the local core/viewer package outputs needed for editor validation.
- packages/editor: bun test src -- 848 pass, 0 fail across 119 files.
- Includes 12 new tests for instance indexing, highlights, capacity, old
  leg matrix parity, native raycasts, and mounted R3F hover/click/drag,
  override, capture, and unmount behavior.
- packages/editor: bun run check-types (tsgo --noEmit) -- passed.
- Root: bunx biome check on all four changed files -- clean.
- Runtime draw/frame measurements and pixel comparison remain with the
  architect; no browser or dev server was started.

* fix(editor): stabilize ceiling bracket picking and resource lifetime

Resolve equal-distance bracket hits by ceiling/corner/part identity for
hover, pointer-down and click. Packed instance IDs and opacity batch order
no longer decide the owner at coincident same-height ceiling corners.
Keep native InstancedMesh raycasting and the existing click payload.

Give each batch a clone of the unit box geometry and dispose that geometry
before retiring the mesh/material on growth or teardown. WebGPU owns
instance-attribute cleanup through its geometry disposal listener.

Use StaticDrawUsage for instance matrices and colors. Writes bump versions
and add update ranges for the affected slots. Clear source ranges after
rendering because TSL uploads internal attribute wrappers; their ranges are
consumed by the backend. The attribute scheduler regression verifies that
unchanged resting frames cause no attribute updates.

Poll sceneRegistry.revision and re-resolve the level only when it changes.
Keep a stable portal group attached beneath the current level so replacing
a level object does not remount the same primitives and lose R3F event
registration. Reparenting preserves the mesh, geometry and matrix buffers.
Read the live registry object for every drag-plane query as well. Retain
the initial requestAnimationFrame retry and synchronous capture hiding.
Document that ceiling:click.position remains level-local; do not transform
or otherwise change that payload.

The reviewer's normalView/MRT concern remains uncertain: overlapping faces
with different normals may change AO/ink output when batch order changes.
No normal/MRT changes are made here. The architect will check pixels with
ink and AO enabled. The previously accepted transparency ordering remains.

Validation:
- packages/editor: bun test src -- 852 pass, 0 fail, 119 files.
- New mounted regressions cover 20 repeated moves over coincident corners,
  stable click/drag ownership, and a translated/rotated same-id level
  replacement with unchanged geometry/matrix versions and local payloads.
- Unit regressions verify geometry dispose events on growth/teardown and
  Three's WebGPU attribute scheduler skipping unchanged frames while
  changed slots carry bounded update ranges.
- bunx tsc --noEmit -p packages/editor/tsconfig.json -- exit 0, no output.
- bunx biome check on all four changed files -- clean.

* docs(editor): note accepted small bracket matrix uploads

Accept whole-array uploads on every render for small matrix buffers using Three 0.185.1’s uniform BufferNode path; above the device uniform-buffer limit, the attribute path honors versions and update ranges.

* perf(nodes): skip animation mixers for items without clips (pascalorg#785)

* feat(capture): add shared clay previews and dollhouse rendering

* docs(capture): document local previews and mesh presentation

* Split canopy regression matrix into independent tests

* feat(skills): fail closed on missing furniture inputs

* perf(nodes): batch ceiling undersides and slab bodies (charter row 16) (pascalorg#789)

* perf(nodes): batch ceiling undersides and slab bodies

* fix(nodes): close surface batch ownership and rebuild lifecycles

* fix(editor): reconcile paint previews after apply exceptions

* fix(nodes): rebuild slabs and release batches on material cache clear

* fix(nodes): strip the merged wall batch from GLB exports

* fix(editor): include moved node identity in perf receipts

* fix(editor): preserve grid surface hits while batching

* fix: preserve batched surfaces in geometry raycasts

* test(nodes): run source-system probes from a package-local file, not bun -e (pascalorg#792)

Fix private-editor CI's Lint, Typecheck & Test / Unit tests failure on Bun 1.3.0 Linux: eval probes started at the editor submodule root could not resolve @pascal-app/core from dependencies hoisted to the private root.

Write isolated probes under ignored package-local .turbo directories, resolve source imports and mocks from import.meta.dir, and remove probes in finally. Apply the same fix to the core parser test that imports zod from an eval probe. Preserve all cases and assertions.

Verified both dependency layouts, package and private-root test invocations, eval failure and file success from /tmp with automatic installs disabled, randomized nodes tests (seed 1), core parser tests, Biome, and no-emit typechecks.

* test(nodes): establish probe mocks before any fiber/react import (pascalorg#793)

* test(nodes): establish probe mocks before any fiber/react import (Bun 1.3.0)

* test(nodes): make source-system probes linker-agnostic (isolated node_modules)

* skills: make furniture follow-ups blocker-aware (pascalorg#794)

* feat(skills): add verdict-aware furniture follow-ups

* fix(skills): make furniture follow-ups blocker-aware

* fix(skills): enforce furniture action boundaries

* test(skills): pin furniture decision evidence

* docs: record agent skills 0.1.4 release source (pascalorg#795)

* docs(skills): prepare OpenAI plugin submission

* docs(skills): complete OpenAI review fixtures

* docs(skills): prepare ClawHub publication

* fix(plugin): require MCP for OpenAI submission (pascalorg#799)

* feat(mcp): add tool execution middleware

* docs(skills): record 0.1.6 as released

* fix(mcp): propagate tool cancellation

* fix(mcp): preserve executor on tool updates

* chore(skills): harden ClawHub bundles

* test(skills): reject ClawHub ignore overrides

* Add official MCP Registry publishing

* ci(mcp): verify live catalog consistency

* feat(skills): bundle local Claude MCP connector

* docs(skills): correct Claude MCP upgrade guidance

* docs(skills): record 0.1.7 release

* fix(skills): hide maintainer workflows from discovery

* fix(mcp): classify all tool side effects

* docs(openai): add tool annotation justifications (pascalorg#813)

* feat(cli): add hosted agent claim command (pascalorg#815)

* feat(cli): add hosted agent claim command

* fix(cli): require canonical claim expiry

* fix(ci): authenticate CLI npm publish (pascalorg#816)

* fix(ci): restore OIDC for CLI publishing (pascalorg#817)

* feat(cli): prefill hosted agent claim (pascalorg#818)

* docs(cli): publish verified agent claim preview (pascalorg#819)

* feat(cli): report hosted agent status (pascalorg#821)

* docs(cli): publish verified agent status preview (pascalorg#822)

* feat(skills): add human-openable fit prechecks (pascalorg#824)

* docs(skills): record agent report release evidence (pascalorg#825)

* perf: scope undo/redo invalidation to changed geometry and cleared previews (charter row 7) (pascalorg#805)

* Scope undo invalidation to changed geometry and cleared previews

* Reset editor state before randomized store tests

* Resolve history probe mocks from each consuming package

* Restore discarded preview dependency closures on undo and redo

* Limit rendered slab invalidation to changed boundary bands

* Cover history support transfers and scoped endpoint rebuilds

* Pin endpoint history closure with spatial sync mounted

* Run package tests against core source without rebuilding dist

* test: drop the repo-wide core source preload

* test: verify consecutive undo and redo invalidation

Zundo 2.3.0 appends the just-left snapshot to both destination stacks, so the existing pre-jump length indices are correct. Cover three adjacency-changing moves and each undo/redo with cleared marks and flushed microtasks.

* fix: invalidate old slab covering dependents on reparent

Refresh covering dependents below both parent levels, deduplicating equal resolved levels. Cover reparent from level 2 to level 3 and undo with exact wall/ceiling sets and unrelated levels left clean.

* perf: drain initial wall builds within the time budget (charter row 6) (pascalorg#800)

* perf: drain initial wall builds within the time budget

* fix(core): invalidate hydration atomically with scene edits

* test: isolate scene fixtures from randomized ordering

* fix(core): complete normalization before publishing hydration

* fix(viewer): preserve and bound initial wall drain lifetime

* docs: clarify hydration lifetime and wall drain counters

* Experience fix pass: placement, selection rotation, roof, stairs, capture, Cmd+S, three 0.186 (pascalorg#807)

* fix(capture): round armed FOV, add Alt slow modifier for the drone camera

armCaptureFov stored the live camera FOV verbatim, so fractional pose FOVs
printed float tails in the HUD and left the reset button enabled. Both
writers now share clampCaptureFov.

Alt holds the drone at 0.2x speed and look sensitivity for fine framing;
Shift stays the boost.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(roof): keep the gable shell base on the wall top

The CSG degeneracy guard enforced its 5 cm minimum by lowering the shell
base, which for wallHeight-0 room roofs put the gable 4 cm inside the
wall and z-fought its faces. Raise the eave instead; mirror the floor in
the opening-placement frame and the shed inset panel.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* feat(editor): Cmd/Ctrl+S saves instead of opening the browser dialog

Capture-phase, always-on listener so the page-save dialog never appears.
Hosts can take the chord over via onSaveShortcut; the default flushes the
autosave through the existing executeSave path.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(tools): anchor composite presets at their footprint centre, lift previews to the level

Fresh (absolute) placement mapped the cursor to the node origin, so a
cabinet run landed |bounds.center| away from the pointer. Subtract the
rotated centre and keep it under the cursor across R/T. The registry
mover's box/sphere now ride the target level's stacked Y like the other
placement tools.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(stair): follow the storey height from the elected base

Level-destination stairs returned the full floor-to-floor height even
when a slab lifted their base, so the top overshot the storey plane. The
resolver now subtracts the elected base for both destinations. The panel
exposes Follows storey / Custom rise for level stairs, and the stair tool
and landing toggle seed from the storey instead of a 2.5 m constant.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(item): drop un-hosted items to the floor, draw the placement box on the right storey

The floor-path Y was frozen at drag start (pascalorg#638), so an item pulled off a
shelf kept the shelf height after reparenting. Read the live grid Y
instead. The cursor group, grid surface and facing pose now add the
level mesh's stacked Y, which the building-local tool group lacks.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(selection): keep member rotation when pressing R/T mid-drag

translateGroupPatches dropped the snapshots' yaw after a mid-gesture
rotation, so the layout orbited while every item kept its old facing and
the commit wrote the same. Carry rotation for vec3/scalar participants,
pivot every session on the shared mesh-box centre the idle shortcut
uses, and engage an armed session before rotating.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* chore(deps): three 0.186.0

No removed export is used and every peer range admits r186. Two
adjustments: Renderer.dispose() is async now, so the capability probe
swallows its rejection; and r186's CommonJS entry re-exports the ES
module, which Bun cannot require() while the same process imports three
as ESM. A bun test preload steers fiber/drei/maath/meshline (no exports
map, CJS main) to their module builds, the way bundlers already resolve
them. Types stay on 0.184.1 (0.185 types OOM tsgo).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* test: pre-evaluate three in the bun test preload

Bun's plugin onResolve does not run for static imports, so steering the
R3F packages to their module builds never applied in CI (isolated linker)
and the CJS require("three") kept racing the ESM import. Evaluating the
package's own three copy first makes the later require() a cache hit.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(roof): lift the inner cutter and deck with the shell eave

The 5 cm CSG floor lifted only the outer shell, so a flat zero-height
roof would have ended up with a solid cap under the deck. Compute the
lift once and apply it to every volume.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(editor): fall back to the autosave flush when the host does not handle Cmd+S

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(roof): floor every prism at 5 cm instead of lifting by the shell's eave

A shell-derived lift left overhanging deck cutters with a negative eave.
Clamp each volume's top the way main did, just at 5 cm and without the
base sink, so cutters stay level with the shells they carve.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(stair): drop the duplicate geometry Rise control

The rise-mode block already exposes the Rise field in custom mode; the
geometry copy wrote totalRise behind the Follows storey toggle.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* test: import resolveSync explicitly in the three preload

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* test: skip the three preload where the cwd has no three dependency

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(editor): seed placed stairs from the elected base; keep the gesture when R/T cannot engage

The stair tool seeded the flight from the storey height alone, a slab
thickness too tall until syncStairRises caught up; it now subtracts the
drop point's elected base like the resolver. A failed engage() on R/T no
longer tears down the pointer listeners.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(stair): cap the placed rise by the pointed support surface

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix: scale the stair ghost to the placed rise; await renderer.dispose() before the WebGL fallback

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(stair): read the placed rise from the preview scene

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(selection): re-fit alignment bounds from the start footprint after each R/T

Rotating the previous axis-aligned fit inflated the anchors every step.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(stair): switching to straight materializes a flight; level labels use the shared display name

A curved stair switched to straight had no stair-segment child and drew
nothing (and vanished on select). The type change now creates a default
flight in the same history step and the viewer falls back to that flight
for already-broken scenes. Stair and elevator panels label levels the way
the level switcher does, and the rise toggle reads Follows level like walls.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* feat(roof): wall-footprint roofs follow their source walls' tops

Room roofs computed their elevation once at creation, so a later custom
wall height left the roof at the storey plane. Roofs now remember their
source walls and a core system re-derives position[1] (highest top,
clamped to the level floor) on wall/slab/level edits, history-paused like
the stair rise sync. Moving the roof by hand detaches it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(stair): a flight height edit pins the parent stair to the new total rise

On a follows-level stair the sync handed the edited height straight back,
so the segment slider did nothing. The edit now also writes totalRise
(the stair becomes Custom rise, as editing Rise on its own panel does).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(roof): follow wall tops below the storey plane

Walls shorter than the level (2.5 m in a 3 m storey) left a gap because
the roof elevation was clamped to its level floor. Follow the wall top.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* feat(roof): follow walls by intent, resolved from the footprint

Replace the source-wall id list with support.kind 'walls': room and
conical roofs are created following, the system resolves the enclosure
under the roof centre on the level below and writes the highest wall top
(unclamped), an explicit Y edit or vertical handle drag flips the roof to
custom, and the panel offers Follows walls / Custom like walls do. No
migration; existing roofs stay custom until the user opts in.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(roof): pick supporting walls by footprint overlap, not closed-room membership

A room missing a wall, or an L-room whose centre falls outside, left the
roof frozen. Walls whose band overlaps a segment footprint on the level
below now count; segment-less roofs keep the point-in-room lookup.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

* fix(roof): parent room roofs to the storey above their walls; follow walls on the roof's own level too

Armed on the walls' level, the tool parented the roof to that level and
the follow rule only looked one storey down, so a Floor 1 roof dropped to
the Level 0 wall tops. The roof now goes to the level above the walls
when one exists (top floor keeps it on the walls' level), and the
resolver considers walls on the roof's level and the one below.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hQVFZ62S1qJDsBM9ferYc

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* test(editor): resolve history probe modules from packages that depend on them (isolated linker) (pascalorg#828)

* test(editor): resolve history probe modules from packages that depend on them (isolated linker)

* test(nodes): keep the lean-to canopy angle sweep under the per-test timeout on slow runners

* feat(editor): streamline connected pipe and duct drafting (pascalorg#827)

* Add roof surface placement support for items

Items (e.g. solar panels) can now be placed on sloped roof surfaces.
The placement system computes euler rotation from the roof surface
normal so items sit flush on the slope instead of going inside.

- Add roofStrategy to placement-strategies with enter/move/click/leave
- Wire roof:enter/move/click/leave events in the placement coordinator
- Add calculateRoofRotation in placement-math using surface normals
- Support full 3D cursor rotation for sloped surfaces
- Items on roofs are parented to the level with world-space rotation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fixed conflict

* fix: pass nodes to lazy inspector panels

* feat: add immersive WebXR editor support

* chore: remove WebXR integration

* chore: remove WebXR support

* chore: checkpoint existing editor work before inline insertion

* docs: track inline insertion implementation steps

* docs: record inline insertion domain contract completion

* feat: add inline pipe fitting insertion and run snapping

- Split pipe runs around inline fittings with preserved connections
- Improve run snapping, marquee selection, and rotation shortcut ownership

* feat: route insertion tools through registry scene context

- Add screen-space projection data for cross-view snapping
- Use registry scene APIs for atomic node changes and selection

* feat: keep run end caps aligned during endpoint moves

- Update mated duct and pipe end caps as endpoints move
- Cache shared handle geometry and materials
- Remove redundant connection and snap labels

* fix: scale run direction feedback geometry

- Preserve ray and arrow dimensions while using unit-sized shared geometry

* fix: resolve architecture review findings

* fix(cli): trim vendored archives from runtime

* fix(nodes): preserve automatic end cap ownership

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Wassim SAMAD <wass08@gmail.com>

* skills: portable mcp.json, channel manifests, validator parity (pascalorg#829)

* chore(skills): portable mcp.json, channel manifests, validator parity

Add the root mcp.json the Agent Plugins spec fixes for Codex and Cursor
(previously only .mcp.json shipped, so those hosts installed the skills
without the MCP server), a Gemini CLI extension manifest, and repository
and icons on server.json. Make plugin.json the single bundle version
source and assert name, version, description and author parity across
all five descriptors, mcp.json/.mcp.json equality, the Claude marketplace
skill set, the documented OpenAI interface fields, byte-identical
.clawhubignore files, and fragment-aware links across skills/README.md
and VALIDATION.md. Fix the broken anchor to the verified GitHub preview,
the 0.1.7 release-notes version, the Cursor snippets to
${env:PASCAL_API_KEY}, add bun run skills:validate for CI and docs,
drop the version literal from mcp-registry.yml, add the skills.sh badge,
the shell-history caveat, and CHANGELOG entries for the distribution work.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* chore(skills): add Cursor manifest and plate logo for marketplaces

Directory forms want a 1:1 logo on a background plate, and Cursor's
checklist wants it committed and referenced by relative path. Add the
brand mark on its #171717 plate as assets/pascal-mark-plate.svg and the
byte-identical brand-kit 1024 px PNG, point the OpenAI logo at the plate
SVG (composerIcon keeps the transparent mark), add
.cursor-plugin/plugin.json with Cursor-native fields, list the 1024 icon
on server.json, and assert the Cursor manifest's parity and paths in the
validator.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* skills: make skills/ the Claude plugin root (pascalorg#832)

* fix(skills): make skills/ the Claude plugin root

The Claude marketplace entry sourced the plugin from the repository root,
so every `/plugin install pascal-agent-skills@pascal` copied the whole
monorepo into the plugin cache and, because that root carries package.json
next to bun.lock, ran `bun install --frozen-lockfile --ignore-scripts`
against it on every install and update (60 s timeout, not disableable). A
fresh install produced a 1.2 GB cache, 1.1 GB of it node_modules, to
deliver two markdown skill bundles.

Point the marketplace entry at ./skills and move the Claude plugin manifest
and the bundled local `pascal mcp connect` configuration into that root; a
plugin cannot reference files above its own root, so both have to live
inside skills/. The manifest lists the bundles explicitly because the
default skills/ scan no longer applies once skills/ is itself the root. A
fresh install is now 196 KB with no node_modules, package.json, or
packages/. skills.sh tree URLs, the Codex and Cursor Agent Plugins layout,
Gemini and ClawHub still read the root plugin.json, root mcp.json, and the
same skills/ tree.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* chore(skills): list the plugin as Pascal in directories

Directory listings show the display name next to product plugins listed
by brand, so use the brand rather than "Pascal agent skills" across the
Claude, Cursor and OpenAI manifests. The identifier stays
pascal-agent-skills.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* docs(changelog): link the plugin-root fix to pascalorg#832

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* skills: bundle the hosted Pascal MCP server with a key prompt (pascalorg#835)

* feat(plugin): add hosted MCP server to the Claude Code plugin

The plugin only bundled the local `pascal mcp connect` stdio server, so a
Claude Code user with a Pascal account had to leave the plugin and run
`claude mcp add` by hand before touching a hosted project or a Capture scan.
Declaring the key as `userConfig.pascal_api_key` lets Claude Code collect it
in the enable-time prompt and substitute it into the `pascal-hosted` server's
Authorization header, so the hosted tools arrive with the skills.

The option is `sensitive` so Claude Code stores the key in the OS keychain
instead of settings.json, and `required: false` so a local-only install still
works with the field left empty.

`${user_config.*}` is a Claude Code substitution, so the hosted server cannot
live in the portable Agent Plugins `mcp.json` that Codex and Cursor read. The
validators now enforce that split: the `pascal` server must be byte-identical
in both files, `skills/.mcp.json` may add only `pascal-hosted`, and the hosted
Authorization header must stay a `user_config` reference so no literal
credential can ship in the published plugin source.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* docs(changelog): link the hosted MCP entry to pascalorg#835

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* ci(release): graduate prerelease versions on stable bumps (pascalorg#837)

The stable-bump path split "1.0.0-beta.5" on dots, so major produced
2.0.0, minor 1.1.0, patch failed on "0-beta" arithmetic, and none would
have published a beta version on the latest dist-tag. Any stable bump on
a prerelease now yields its base version, matching npm semver, so the
1.0.0-beta.N line can be released as 1.0.0.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* perf(cli): prune build-only files from the portable runtime (pascalorg#838)

`next build` copies its tracing root into `.next/standalone`, so the staged
runtime shipped app sources, repository documentation, build trace metadata and
assets that `server.js` never reads.

Pruned from `dist/runtime`:

- `public/audios/radios` (39.3 MB) — the radio catalogue is played by the hosted
  community app, which serves its own copy; nothing in this repository requests
  `/audios/radios`.
- `next/dist/server/capsize-font-metrics.json` + `font-utils.js` (4.1 MB) —
  `font-utils.js` is the only reader of the metrics and is itself unreachable
  from the standalone server.
- A stray 3.15 MB authoring screenshot and a duplicate `.glb` under
  `public/items` — item assets are addressed by convention, and anything else is
  now dropped and named on stdout.
- `apps/editor/{app,components,lib}` plus dev-only configuration and docs
  (0.5 MB) — TypeScript sources and tests that Node never executes.
- `.nft.json` build trace metadata and source maps under `.next` (0.7 MB).

Before: 107.5 MB tarball, 149.2 MB unpacked, 2956 files.
After:   64.6 MB tarball, 101.7 MB unpacked, 2870 files.

The release budget in the smoke test drops to 75 MB / 115 MB / 3200 files so the
regression cannot come back unnoticed. `stage-runtime` + `smoke-runtime` pass,
and the packed CLI still serves the editor, `/scenes`, a scene page with all 84
of its static chunks, and every sampled public asset.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* perf(editor): re-encode fitting thumbnails as 256px webp (pascalorg#842)

`public/icons/fittings/` held 16 PNGs at 1254x1254 RGBA — 11 MB of assets
for thumbnails that render at 56 CSS px in the MEP tool options grid, and
11 MB of the 64.6 MB packed CLI runtime. Every other icon under
`public/icons` is already a small webp.

Each PNG becomes a 256x256 lossy webp with alpha (`cwebp -q 85 -m 6
-alpha_q 100 -resize 256 256`), which is still 2.3x the largest rendered
size — the portable build sets `images.unoptimized`, so the raw file is
what the browser scales. The directory drops from 11 MB to 164 KB.

`build-tab.tsx` derives the path from the fitting type, so the extension
in that template is the only reference to update.

Packed runtime smoke: 54.1 MB compressed, 91.0 MB unpacked, 2870 files
(was 64.6 MB / 101.7 MB / 2870).

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* chore(editor): drop unreferenced public assets (pascalorg#843)

Remove 53 MB of committed assets nothing in this repository reads: the
small-kitchen-cabinet item (10.9 MB; the item catalog resolves every item
from remote storage and no demo references this slug), a stray authoring
screenshot, and the radio catalogue (39 MB) that only the hosted community
app plays from its own copy. The CLI staging script already pruned the
radios and the screenshot; its rm(force) calls tolerate their absence.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* ci(release): publish through npm trusted publishing only (pascalorg#839)

The 1.0.0 release failed with EOTP on its first publish: npm no longer
accepts direct publishing with 2FA-bypass granular tokens. Drop
NODE_AUTH_TOKEN from every publish step so npm 11 exchanges the GitHub
Actions OIDC token instead. Requires each @pascal-app package to have
this repository, workflow file and the npm environment configured as a
trusted publisher on npmjs.com.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* feat(cli): ship a small CLI that downloads the web editor runtime (pascalorg#845)

The npm package carried the whole standalone Next editor: 65 MB compressed,
102 MB unpacked, for 0.1 MB of CLI code. Agents that only speak MCP paid that
cost too, because the MCP bridge started the editor to reach it.

Split the two. `dist/` now holds the CLI plus `services/pascal-mcp.mjs` and a
`runtime-source.json` naming the web runtime archive for this exact version,
its size, and its SHA-256. The web editor runtime ships as a GitHub release
asset and is downloaded once per version, verified, and installed through the
existing atomic install seam.

- MCP is its own managed service (`run/mcp.json`), started on demand by
  `pascal mcp connect` with no editor process and no runtime download.
- Commands that start the editor resolve the runtime from
  `PASCAL_BUNDLED_RUNTIME_DIR`, `--runtime <directory-or-archive>`, the
  installed version, else the release asset; a digest mismatch deletes the
  temporary file and installs nothing.
- Downloads stream over `node:https` with `HTTPS_PROXY`/`NO_PROXY` support and
  no new dependency; concurrent first runs share the install lock.
- `stage-runtime` writes a deterministic `pascal-web-runtime-<version>.tar.gz`
  plus `.sha256`; the release job verifies both before publishing and uploads
  them to the CLI tag right after it is pushed.
- The smoke test now covers MCP-only startup with no runtime present and the
  local-archive install, including a one-byte tamper that must fail closed.

Package: 0.46 MB compressed, 2.46 MB unpacked, 68 files.
Archive: 64.2 MB compressed, 106 MB installed.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* docs(skills): describe the hosted-only capture tools (pascalorg#846)

Document the hosted-only Capture scan path (list_captures, get_capture,
open_capture_as_project) in the pascal-3d skill and its tool workflows, and
scope the counted 46-tool annotation inventory to the public package so the
hosted server's extra tools do not read as a packet gap.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* feat(plugins): add optional hosted auth to the Cursor plugin (pascalorg#849)

* feat(plugins): add optional hosted auth to the Cursor plugin

A Cursor install can now reach hosted Pascal — projects, Pascal Capture
scans and shared workspaces — with an optional API key, while the
credential-free local `pascal mcp connect` server keeps working.

`.cursor-plugin/plugin.json` declares an optional `PASCAL_API_KEY`
variable and points `mcpServers` at a new Cursor-dialect
`.cursor-plugin/mcp.json` that adds a `pascal-hosted` server for
https://editor.pascal.app/api/mcp. Cursor substitutes the bare
`${PASCAL_API_KEY}` plugin-variable form from its dashboard, so the
repository holds only the placeholder. The variable is absent from
`required`, so an install with no key still loads and only
`pascal-hosted` fails (401).

The portable `mcp.json` stays credential-free on purpose. Agent Plugins
1.0.0 forbids secrets and placeholder expansion in `headers` (7.2.3,
9.2), its only remote keyword is `streamable-http` rather than Cursor's
`http`, and Codex drops a plugin-supplied `Authorization` as a
client-owned header. Codex users therefore keep using
`codex mcp add --bearer-token-env-var PASCAL_API_KEY`.

ClawHub already declares `PASCAL_API_KEY` optional through
`metadata.openclaw.envVars[].required: false`, so the skills are
unchanged.

`bun run skills:validate` now asserts the Cursor MCP path, a `pascal`
server identical to the portable one, the exact hosted URL and header
template, the optional-and-never-required variable with no unsupported
schema keywords, and that no `${VAR}` in the Cursor config is
undeclared.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fix(plugins): keep the Cursor author block within Cursor's schema

Cursor's plugin.json schema allows only name and email under author
(additionalProperties: false); the url field failed validation on every
install. Compare the Cursor manifest's author on those two fields and
link the changelog entry to pascalorg#849.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* perf: per-slab invalidation, candidate-scoped temporal reconciliation and rotation-stable surface planning (row 17) (pascalorg#850)

* perf(nodes): invalidate slabs by derived polygon changes

* perf(core): scope temporal reconciliation to changed nodes

* fix(nodes): mirror rendered slab context membership and order

* perf(nodes): reuse slab inputs and scope polygon derivation

* test(core): verify structural temporal reconciliation outcomes

* docs: describe temporal candidates and slab dependency tracking

* perf(core): skip disjoint room coverage and rotated surface rewrites

Cache polygon bounds for indexed surface scoping and preserve exact cyclic
outer-ring rotations in the shared slab and ceiling planners.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jmmz2AMwTzcnKsSHHPEMhN

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* editor: integrate Environment with generic host and export APIs (pascalorg#831)

* refactor(packages): fold capture packages into core and viewer (pascalorg#851)

Avoid npm package sprawl before 1.0.0: `@pascal-app/capture-protocol`
becomes the `@pascal-app/core/capture` subpath and
`@pascal-app/capture-viewer` becomes `@pascal-app/viewer/capture` (plus
`@pascal-app/viewer/capture/preview`), so the release ships seven
packages: core, viewer, editor, nodes, mcp, ifc-converter, cli.

Neither package was ever published to npm, so no npm consumer migrates.
The protocol code is pure zod/TS, so core keeps its no-Three.js layer
rule; the runtime and its reference layers keep viewer's existing peers
and now reach viewer internals through relative imports instead of a
self-referential `@pascal-app/viewer` specifier.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* fix(editor): declare @react-three/test-renderer where the lifecycle test imports it (pascalorg#852)

The registered tool lifecycle test imports @react-three/test-renderer, but
only the viewer workspace declared it. Hoisting hid the missing dependency;
private-editor CI uses Bun's isolated linker and cannot resolve that import
from the editor workspace. Declare the same ^9.1.0 development dependency
in editor and record it in the workspace lockfile entry.


Claude-Session: https://claude.ai/code/session_01Jmmz2AMwTzcnKsSHHPEMhN

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* ci(release): drop registry-url so npm uses OIDC trusted publishing (pascalorg#853)

The 1.0.0 run failed publishing core with E404. actions/setup-node with
registry-url writes an .npmrc whose token falls back to the placeholder
XXXXX-XXXXX-XXXXX-XXXXX when NODE_AUTH_TOKEN is unset; npm sent that fake
token instead of exchanging the Actions OIDC token, and the registry
answered 404. Without registry-url no .npmrc is written and npm 11 falls
through to trusted publishing.

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* ci(release): log npm verbosely to surface OIDC exchange errors (pascalorg#856)

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* fix(capture): cache preview artifacts, retry failed downloads, and clarify device-path visibility (pascalorg#858)

* fix(capture): cache preview data and improve device path visibility

* fix(capture): recover failed JSON preview downloads

* test(viewer): preload one React instance before rendering hooks

* release: @pascal-app/core@1.0.0 @pascal-app/viewer@1.0.0 @pascal-app/editor@1.0.0 @pascal-app/nodes@1.0.0 @pascal-app/mcp@1.0.0 @pascal-app/ifc-converter@1.0.0 @pascal-app/cli@1.0.0

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* docs: replace the CLI preview instructions with the published npm CLI (pascalorg#859)

`@pascal-app/cli@1.0.0` is on the npm `latest` tag with `pascal agent claim`,
`pascal agent status`, and the read-only `check_collisions.candidate` input, so
the checksum-verified GitHub prerelease the docs pointed at is obsolete. Delete
the "Verified CLI preview" and "Verified GitHub preview" sections, stop
recommending the `beta` dist-tag (it still resolves to the older
`1.0.0-beta.1`), and drop the inverted claim that the npm package bundles the
web editor runtime — 1.0.0 downloads it from a release asset on first use.

Close the changelog's `Unreleased` heading as `1.0.0 (2026-09-12)` with the
package and contributor sections the earlier releases carry.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* docs: describe the release workflow and refresh the validation scope (pascalorg#860)

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

* fix(editor): keep manifold-3d out of consumer bundler graphs (pascalorg#735)

manifold-3d's emscripten glue awaits import('node:module') behind a Node
check; the branch never executes in a browser, but webpack refuses to
build any graph that can reach it. export-manager.tsx statically imports
the manifold worker wrapper and ExportManager renders unconditionally
from the editor root, so every external webpack consumer of
@pascal-app/editor failed at build time (pascalorg#715).

The worker chunk is still built by the consumer's bundler, but it no
longer contains a traceable manifold-3d specifier. The glue is loaded at
runtime through an import() no bundler follows: bare specifier first
(bun tests, dev servers, bundlers that inlined it anyway), then a
version-pinned jsDelivr copy for bundled browser builds — emscripten
locates manifold.wasm relative to the glue's own URL, so the CDN path
self-resolves. configureManifoldRuntime(options) lets offline or
CSP-restricted hosts point both URLs at self-hosted assets.

A failed load no longer poisons later attempts: the cached module
promise resets on rejection.

Fixes pascalorg#715

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

* mcp: make batch-first apply_patch the stated default (pascalorg#767)

* docs(mcp): make batch-first apply_patch usage the stated default

Tool description, agent guide, from-brief preamble, and README now instruct agents to compose one atomic apply_patch batch per phase instead of looping single-op calls. The tool already validates all ops before applying any; only the guidance was missing.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* test(mcp): assert batch-first apply_patch guidance surfaces

Lock the tool description, agent guide, from_brief preamble, and README
row that state batch-first as the default without changing apply_patch
runtime behavior.

---------

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

* fix(editor): type optional ancestor traversal for downstream consumers (pascalorg#814)

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>

* fix(viewer): clamp GLB floor animation on slow frames (pascalorg#820)

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>

* fix(skills): compare bundle paths without a hardcoded separator (pascalorg#848)

`bun run skills:validate` fails on Windows for every cross-file link
inside a skill bundle and for both OpenAI interface assets, even though
each referenced file exists inside the plugin. `resolve()` returns
backslash-separated paths on Windows, so the `${dir}/` prefix compared
against never matched.

Compare on a normalized separator instead, and cover the predicate with
a focused test so the check stays platform-independent.

---------

Signed-off-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
Co-authored-by: Aymeric Rabot <aymeric@pascal.app>
Co-authored-by: Sudhir Yadav <sudhir9297@gmail.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Wassim SAMAD <wass08@gmail.com>
Co-authored-by: Aymeric Rabot <aymeric.rabot@gmail.com>
Co-authored-by: Adam NAILI <18304870+AxiomeCG@users.noreply.github.com>
Co-authored-by: ActArtech <123718991+ActArtech@users.noreply.github.com>
Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
Co-authored-by: FenjuFu <92919259+FenjuFu@users.noreply.github.com>
Co-authored-by: Wu Shuwen <mikewushuwen@outlook.com>
…pascalorg#857)

collectFloorplanSchedules walked the whole level subtree and ignored
FloorplanExportScope, so a structure-only PDF still emitted zone/room
schedule pages whose geometry the same export excluded.

Thread scope into the collector and gate schedule contributors with
isFloorplanNodeInExportScope, matching geometry collection.

Fixes pascalorg#631

@Aymericr Aymericr left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The local fallback now stores the scan through the shared asset store and makes scans visible before selecting the new node. I verified the focused regression test, core/viewer builds, editor typecheck, and Biome on the updated branch.

@Aymericr
Aymericr merged commit c9cb633 into pascalorg:main Sep 12, 2026
1 check passed

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 409576b. Configure here.

} catch {
useUploadStore.getState().setError(levelId, 'Could not add that scan.')
}
return

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HUD scan upload still needs host

High Severity

The new local scan flow is only used from the site panel. The references HUD still requires uploadHandler and reports that scan upload is unavailable when no host callback exists, so self-hosted GLB/glTF uploads from that control never create a ScanNode.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 409576b. Configure here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Self-hosted editor: scan upload button is a silent no-op (onUploadAsset never wired locally)