Variants on the stage, per-turn cost, and an imagery pipeline

Variants live on the stage now, not on a screen of their own.

A strip under the result panel switches between Main and each option (0, 1–4, [ ]), and a building option is watchable live: the preview serves its workspace from a /_lane/<name>/ route and reloads as the builder writes. *All options* shows every option at once, scaled from the real page, with synced scroll.

• A lane footer shows each option's status, risk, builder model, spend and elapsed time, with *Stop*, *Retry*, *Promote* and *Refine* per option and *Discard the whole set*.
• Compare keeps the blind Left/Right judge and adds an open side by side after the decision: any two options or Main, swap, a wipe slider and a phone-width toggle. Nothing is judged there.
• Options stay letters only on every surface until you decide, so names don't bias the pick.
• The Variants screen and its top-bar button are gone; old links open the project with the grid showing. The Versions drawer lists past decisions as read-only records.

Variants on any turn.

The project composer's + menu offers 2–4 options for a follow-up, and each option starts from your current design (variant_seed) and changes only what its brief names. The Home chip seeds from your last pick per template, then the template's default, and both chips state the run count up front ("≈ 5–8 runs"). Settings gains a Variants section: default count, parallel builders, and the model lanes build with — a cheaper builder applies to every lane and each lane shows which model ran. The free plan's variant budget is checked before anything starts; over it, the upgrade dialog opens instead of lanes failing one by one.

Every turn says what it used.

A per-turn line reads "318k tokens (241k cached) · $0.62 API-eq · 1m 52s", ticks live while the turn runs, and opens a breakdown by role (builder, plan, lane, critic, repair) and model. The top bar shows the open design's total, and each variant lane and set shows its own.

• Cost appears only when someone stated it: API-eq is the figure the CLI reported — on a subscription it counts against your plan, not your card — and ~$x (your rate) is an estimate from a rate you entered in Settings → Usage. No price table ships in the app.
• Parsers now read prompt-cache and reasoning tokens (Claude Code, Codex, Cursor, Grok, OpenCode, Qwen, Kimi, Antigravity), per-model splits (Claude Code, Grok), Pi / Oh My Pi's JSON mode and Aider's spend line. Amp, Devin, Cline, Hermes and Kiro report nothing, and the footer says "usage: not reported by <CLI>" instead of a blank.
• Spend lands in a project-local ledger, .1design/usage.jsonl, one row per run with its role, so totals survive app-data resets and travel with the project. Settings → Usage lists recent projects' totals and holds your optional per-model rates.
• A run that nears or hits a plan limit raises a banner on the composer with the CLI's own wording.

Infographics get a drawing vocabulary.

The kit now ships the primitives the craft rules assumed: a ~60-symbol pictogram sprite (assets/infographic/pictograms.svg, one <use href="…#pg-*"> line per figure), a vendored Lucide icon set (assets/icons/lucide/, searched with icons.mjs find <words> so no glyph name is guessed), and chart.mjs — deterministic bars, line, stacked, dots and slope charts as inline SVG with real text and an enforced zero baseline.

• Six rendered family examples (assets/infographic/examples/) pair each index.html with the weak.html it repairs — the weak-versus-strong pair the guide described in prose is now a diff.
• The starter stops teaching the anti-pattern: worked values move into the flow, the example/note blocks are gone, a node is a label beside a figure slot by default, and the diagram area is marked data-info-role="hero".

Infographic craft budgets are gate rows, not advice.

The craft.* checks (craft.diagram-words, craft.element-words, craft.edge-words, craft.unlabelled-edges, craft.hero-share, craft.support-blocks, craft.min-type, craft.categorical-colours, craft.equal-boxes, craft.zero-baseline) measure the rendered canvas — word budgets that scale with canvas area, hero share, the smallest rendered type — and fail the gate on "a document with decoration". Warnings mark the near-misses; not-applicable is recorded when no browser leg ran rather than silently passing. The gate also shoots the three reviewer captures (canvas-thumb, canvas-grey, canvas-notext), so the cover, thumbnail and greyscale tests run on what the gate produced.

The host is the rasterizer.

render_asset renders a project file — or one CSS-selected element — to PNG at an exact size, at 1×/2×/3×, with optional transparency, and writes a provenance row; preview_evaluate runs the kit's allowlisted probe scripts through the same browser the preview uses. When the agent's sandbox has no Chromium of its own, the gate's capture and probe legs route through the host and the report says so (pass (host capture), probe.source: kit or embedded). preview_screenshot gains scale and selector, and scripts/render.mjs carries the same contract for runtimes with no host tools.

An image-generation broker.

generate_image_asset, list_image_candidates and import_image_asset mediate generation through the host: the provider is a per-project mapping (imagery.generate in project.json) to one MCP connection's tool, pinned by a schema hash so a contract drift refuses rather than re-maps. Up to three candidates stage under the run folder for review; importing one promotes it into assets/generated/ with its prompt and generator recorded.

• The turn prompt now states each runtime's image capability up front. Codex declares its native image_gen tool (enable it with codex features enable image_generation); runtimes with none are steered to vectors or the broker instead of guessing.

Fetched free-licensed imagery.

fetch_asset reaches exactly three sources — Openverse, Wikimedia Commons and unDraw — over fixed API endpoints, and downloads only the file URL the API returned. Downloads are validated on the wire facts (bounded size, magic-sniffed, SVG sanitised) and land under assets/fetched/ with license and source URL on record.

Every raster answers for provenance, palette and credit.

The gate's assets.provenance row requires a design-evidence/assets.json record for every raster — fetched assets need license + source, generated need a prompt or generator — and assets.attribution fails the gate when a required credit line never reaches the canvas markup. palette-check.mjs measures a generated or fetched figure's ΔE distance from the direction's own tokens before it is imported — an off-palette candidate is rejected by a number, not a feeling; photos keep their colours.

A shared imagery skill.

references/imagery.md teaches the ladder by asset role — structure is always vector; a figure climbs pictogram → authored SVG → generate → fetch — plus a per-asset brief template and the on-palette prompt recipe. A plan that declares an imagery: block gets it at Step 2, and the plan check requires every declared raster to carry a role, a strategy rung and a fallback.

Design systems get a real management screen.

The Systems screen is now master/detail: a filterable list with palette tiles, and a detail pane showing the package's swatches, fonts, DESIGN.md brief, card list and files. A package can be applied to the open project, duplicated under a fresh id, or moved to the Trash — and saving the open project as a system still lives here.

• Claude Design exports import as systems. Point the screen at an export folder (_ds_manifest.json + *.dc.html cards) and the cards, assets and usage rules land as a package with a generated tokens.css. A ds-<id> direction publishes with it, so the imported system is pickable on Home and readable by the kit at once.

A default agent for MCP calls.

Settings → MCP access → Setup gains a runtime + model pick that external design_generate / project_create calls fall back to — and it beats the target project's own pick. The calls themselves also accept runtime / model arguments now.

Conversations show what the artifact cost.

Each Home row rolls up active work time and reported token spend across every run the conversation has made — queue waits and pause gaps never count, a dollar figure appears only when the CLI reported one, and a runtime that prints no usage line invents nothing.

A 12-brief infographic eval set.

evals/infographic.json covers all six families across four canvas presets — led by the motivating "Explain: how blockchain works" on A4 — each brief carrying a held-out comprehension key. run.mjs records the gate rows, the measured craft.* numbers, the critique score when a filled report survives, token/wall cost, and raster provenance kinds per attempt, consolidated into evals/results/*/infographic-<stamp>-<agent>.json.

Gate claims cross-check themselves.

Verdicts and release-evidence rows now read back what the checker actually produced — a host capture, an embedded-probe run, or a missing measurement is labelled in the report instead of absorbed into a PASS, so "the checks say pass" and "the checks could run" are never the same sentence.

An agent's "the gate passes" no longer stands over a failed gate.

When a turn's last message claims a pass the journaled checks don't back — a FAIL, a check that could not run, or a gate that was never called — the host appends the fact to the conversation ("The gate did not pass — 2 errors · browser check could not run"), once per run.

An externally-dispatched run no longer wears the wrong agent's name.

A project with no agent pick used to display the first ready runtime — an MCP-created Devin run rendered as "Claude Code". The resolved runtime and model are now stamped onto the project before the turn dispatches, so the composer chip, the run's parser and any follow-up send all agree on what actually ran.

The studio can now fetch imagery — from three named sources only.

fetch_asset calls the Openverse, Wikimedia Commons or unDraw APIs and downloads only the file URL the API returned; every redirect hop is re-checked against the same host allowlist, a URL an agent hands it outside those hosts is refused, and license plus source URL are recorded per file.

Generated images go through your own MCP connection.

The broker calls exactly the one connection + tool the project names — your server, your account — over the same transport Settings tests. A result that arrives as a bare URL is refused rather than fetched, and staged candidates live under the project's own run folder.

Everything else stays local-first.

Renders and probes run through the host's own browser against the local preview server; projects, candidates, exports and provenance records live on your disk, and agents still run under your own installed CLIs and accounts.

Usage numbers stay on your machine.

The token/cost ledger is a file in the project's .1design/ folder — excluded from exports, snapshots and the preview server — and no usage figure is sent with anonymous events.