pmx-canvas 0.1.23 → 0.1.25

package/CHANGELOG.md

@@ -3,6 +3,127 @@
 All notable changes to `pmx-canvas` are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## [0.1.25] - 2026-06-03
+
+Adapter-regression cleanup on top of 0.1.24. Fixes several issues the
+GitHub Copilot and Codex canvas adapters surfaced: effective pinned
+state now shows up on node reads, PMX-served frame-document iframes are
+trusted automatically, group membership is settable through the generic
+node APIs, default node sizes were retuned, and the mutation-history
+diff no longer reports spurious "data changed" for title/content edits.
+
+### Changed
+
+- **Node reads report effective pinned state.** `canvas_get_node` and
+  `canvas_get_layout` (and every read path) now return `pinned: true`
+  when a node is in the context-pin set, not only when its own
+  `pinned` flag is set. Adapters that key off `pinned` now see what
+  the human actually pinned.
+- **Larger default node sizes.** Markdown nodes default to 640×420
+  (was 520×360) and `mcp-app` nodes get an explicit 960×600 default,
+  applied consistently across the HTTP create/batch path, the SDK,
+  and browser auto-placement. Larger app frames render their embedded
+  content without immediate manual resizing.
+- **Mutation-history diff ignores title/content for "data changed".**
+  `canvas_diff` and the history timeline no longer flag a generic
+  "data changed" when only a node's `title` or `content` differs —
+  those are already reported as their own title/content changes, so
+  the data-level diff now compares the remaining fields.
+
+### Added
+
+- **PMX-served frame documents are trusted automatically.** Embedded
+  `mcp-app` iframes whose source is a same-origin
+  `/api/canvas/frame-documents/<id>` URL are now treated as trusted
+  (no sandbox-escape warning), via a new
+  `isSameOriginFrameDocumentUrl()` guard that validates both the
+  origin and the path prefix. External URLs and unrelated same-origin
+  paths remain untrusted.
+- **Group membership through the generic node APIs.** `POST
+  /api/canvas/group` and the node update path accept `children` /
+  `childIds` (or `data.children`) and persist group membership, with
+  validation that rejects missing child IDs, self-references, and
+  nested-group children. Snapshot diffs expose the resulting
+  membership.
+
+### Internal
+
+- Regression coverage for: frame-document trust (same-origin PMX path
+  trusted; external and unrelated same-origin paths not), generic
+  group-children APIs persisting membership and surfacing it in
+  snapshot diffs, the retuned default node sizes through CLI/HTTP/MCP,
+  effective-pinned read state, and the title/content-aware
+  mutation-history diff.
+
+## [0.1.24] - 2026-06-03
+
+Host-adapter and agent-experience (AX) release. Adds host-agnostic AX
+focus/context primitives across every layer, ships GitHub Copilot and
+Codex canvas adapters, moves embedded HTML/MCP-app iframes onto a
+same-origin frame-document transport (still strictly sandboxed via a
+CSP `sandbox` response header), and fixes a batch of iframe-backed
+node drag/resize/fullscreen interaction glitches.
+
+### Added
+
+- **PMX AX focus + context primitives.** A new host-agnostic
+  "agent experience" focus field lets any surface mark which nodes
+  an agent is attending to without moving the viewport. Implemented
+  end to end with full parity:
+  - State: `CanvasStateManager.getAxFocus()` / `setAxFocus()` /
+    `getAxState()`, recorded as a `setAxFocus` mutation-history op
+    (undo/redo) and persisted in a new SQLite `ax_state` table.
+  - SDK: `PmxCanvas.getAxState()`, `getAxContext()`, `setAxFocus()`.
+  - HTTP: `GET`/`PATCH /api/canvas/ax`, `GET /api/canvas/ax/context`,
+    `POST /api/canvas/ax/focus`.
+  - MCP: `canvas_get_ax`, `canvas_set_ax_focus` (45 tools total),
+    plus `canvas://ax` and `canvas://ax-context` resources that emit
+    `notifications/resources/updated` on change.
+  - CLI: `pmx-canvas ax focus <node-id...>` / `--clear`.
+  Focus state carries a `source` tag (`agent`/`api`/`browser`/`cli`/
+  `codex`/`copilot`/`mcp`/`sdk`/`system`) and node IDs are validated
+  against the live layout.
+- **GitHub Copilot canvas adapter.** A new
+  `.github/extensions/pmx-canvas/extension.mjs` (591 lines) plus
+  `skills/pmx-canvas/references/github-copilot-app-adapter.md`
+  document and implement driving the canvas from GitHub Copilot.
+- **Codex canvas adapter coverage.**
+  `skills/pmx-canvas/references/codex-app-adapter.md` documents the
+  Codex host integration, with browser regression coverage.
+- **Same-origin frame-document transport for embedded apps.**
+  Embedded HTML and MCP-app iframes now load their document from
+  `POST /api/canvas/frame-documents` → `GET /api/canvas/frame-
+  documents/<id>` instead of an inline `srcdoc`. The served document
+  carries `Content-Security-Policy: sandbox <tokens>`,
+  `Referrer-Policy: no-referrer`, and `X-Content-Type-Options:
+  nosniff`. The sandbox-token allowlist deliberately excludes
+  `allow-same-origin` and top-navigation tokens, so frame content
+  stays in an opaque origin and cannot reach the canvas host. The
+  document store is in-memory, capped at 128 entries (LRU eviction)
+  and 5 MB per document.
+
+### Changed
+
+- **Iframe-backed node drag is flicker-free.** Node drag now
+  rAF-throttles pointer moves, clears the browser text selection,
+  and toggles an `is-node-dragging` document class to suppress
+  selection and attention-field repaint artifacts. Inline app
+  iframes are kept pointer-inert near the resize handle so resize
+  starts reliably.
+- **Docs tool/resource references updated.** `docs/mcp.md` and the
+  README now read 45 tools + 9 core resources; the `AGENTS.md` and
+  `CLAUDE.md` MCP tool enumerations were corrected to the full
+  45-tool list (they had drifted to 42 and 39 respectively and were
+  missing `canvas_fit_view` and the new AX tools).
+
+### Internal
+
+- Regression coverage for: AX focus set/clear/persistence through
+  state, HTTP, MCP, SDK, and CLI; AX focus round-tripping through
+  SQLite; arrange-lock interactions; iframe-backed node
+  drag/resize/fullscreen behavior (large browser e2e additions); and
+  the Copilot/Codex adapter surfaces.
+
 ## [0.1.23] - 2026-05-12
 
 Persistence overhaul. Canvas state, snapshots, context pins, and the
@@ -1114,6 +1235,8 @@ otherwise have to discover by trial and error.
 - Regression coverage for snapshot flat-`id` aliases on both MCP and
   HTTP surfaces, plus async / top-level-`await` WebView script bodies.
 
+[0.1.25]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.25
+[0.1.24]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.24
 [0.1.23]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.23
 [0.1.22]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.22
 [0.1.21]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.21

package/Readme.md

@@ -55,6 +55,11 @@ prompt engineering, no copy-paste — pin a node in the browser and the MCP
 server fires a `notifications/resources/updated` event the agent's harness
 picks up immediately.
 
+AX context adds a host-agnostic focus layer on top of pins. Core PMX exposes
+`/api/canvas/ax/context`, `canvas://ax-context`, SDK methods, and
+`pmx-canvas ax context|focus`; adapters can map that same primitive to their
+native hook systems without making PMX Canvas GitHub-specific.
+
 ### 05 / Save
 
 Spatial state auto-saves to `.pmx-canvas/canvas.db` (debounced ~500 ms) —
@@ -66,12 +71,24 @@ the DB so SQLite WAL data is checkpointed into the file.
 
 ### 06 / Any agent
 
-Harness-agnostic. Drive the canvas from [MCP](docs/mcp.md) (42 tools,
-8 resources, change notifications), the [CLI](docs/cli.md), the
+Harness-agnostic. Drive the canvas from [MCP](docs/mcp.md) (45 tools,
+9 resources, change notifications), the [CLI](docs/cli.md), the
 [HTTP API](docs/http-api.md), or the [Bun SDK](docs/sdk.md). Works with
 Claude Code, GitHub Copilot CLI, Codex, Cursor, Windsurf, or any agent
 that can spawn an MCP stdio server, call a CLI, or hit an HTTP endpoint.
 
+The repo also ships a GitHub Copilot app adapter at
+`.github/extensions/pmx-canvas/`. It opens the live PMX workbench in a native
+Copilot canvas panel, injects AX pinned/focused context on prompt submission,
+and exposes adapter actions for status, AX focus, context refresh, and explicit
+session steering.
+
+In the Codex app, PMX Canvas is MCP-first plus the Codex in-app Browser: agents
+read `canvas://ax-context` / `canvas_get_ax`, humans use the live `/workbench`
+view, and Codex-originated focus can be labeled with `source: "codex"` through
+`canvas_set_ax_focus`. The CLI remains a fallback for scripts and manual
+debugging, not the native Codex adapter path.
+
 ## Prerequisites
 
 - [Bun](https://bun.sh) >= 1.3.12
@@ -126,6 +143,20 @@ Add to your agent's MCP config:
 
 The canvas auto-starts on first tool call.
 
+### Use inside the GitHub Copilot app
+
+This repository includes a project canvas extension:
+
+```text
+.github/extensions/pmx-canvas/extension.mjs
+```
+
+When loaded by the Copilot app, it opens the PMX workbench natively, starts a
+matching local PMX server when needed, and injects `AX` pinned/focused context
+as hidden per-turn context. The adapter is thin: PMX state still lives in
+`.pmx-canvas/canvas.db`, and the same HTTP, MCP, CLI, and SDK surfaces remain
+available to non-GitHub agents.
+
 ### Install the agent skill (recommended)
 
 The fastest way to get a working canvas is to install the `pmx-canvas` agent
@@ -148,8 +179,8 @@ Common harness skill directories: `.claude/skills/` (Claude Code),
 `.github/skills/` or `.copilot/skills/` (Copilot CLI),
 `.agents/skills/` (cross-harness convention). Once the canvas is running,
 the agent can read `canvas://skills` and pull in companion skills
-(`web-artifacts-builder`, `json-render-*`, `pmx-canvas-testing`,
-`playwright-cli`, etc.) as the work demands.
+(`control-session-orchestrator`, `web-artifacts-builder`, `json-render-*`,
+`pmx-canvas-testing`, `playwright-cli`, etc.) as the work demands.
 
 ## Documentation
 
@@ -157,7 +188,7 @@ the agent can read `canvas://skills` and pull in companion skills
   the three-tier visual matrix (json-render → html → web-artifact)
 - **[CLI reference](docs/cli.md)** — full command surface, daemon mode,
   watch streams, WebView automation
-- **[MCP reference](docs/mcp.md)** — 42 tools, 8 resources, change
+- **[MCP reference](docs/mcp.md)** — 45 tools, 9 resources, change
   notifications, node-type routing
 - **[HTTP API](docs/http-api.md)** — REST endpoints, SSE, batch operations
 - **[Bun SDK](docs/sdk.md)** — `createCanvas()` for TypeScript on Bun

package/dist/canvas/global.css

@@ -1107,10 +1107,13 @@ body,
   position: absolute;
   bottom: 0;
   right: 0;
-  width: 16px;
-  height: 16px;
+  width: 32px;
+  height: 32px;
+  background: rgba(0, 0, 0, 0.001);
   cursor: nwse-resize;
-  z-index: 2;
+  z-index: 30;
+  pointer-events: auto;
+  touch-action: none;
 }
 
 .canvas-node .node-resize-handle::after {
@@ -1130,6 +1133,36 @@ body,
   opacity: 1;
 }
 
+html.is-node-resizing,
+html.is-node-resizing * {
+  cursor: nwse-resize !important;
+}
+
+html.is-node-resizing .canvas-node {
+  transition: box-shadow 0.15s ease !important;
+}
+
+html.is-node-dragging .attention-field-layer {
+  visibility: hidden;
+}
+
+html.is-node-dragging,
+html.is-node-dragging * {
+  cursor: grabbing !important;
+  user-select: none !important;
+  -webkit-user-select: none !important;
+}
+
+html.is-node-dragging iframe,
+html.is-node-dragging .ext-app-preview-catcher {
+  pointer-events: none !important;
+}
+
+html.is-node-resizing iframe,
+html.is-node-resizing .ext-app-preview-catcher {
+  pointer-events: none !important;
+}
+
 /* Pinned node indicator */
 .canvas-node.pinned {
   border-style: dashed;