pmx-canvas 0.1.27 → 0.1.28

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -3,6 +3,41 @@
3
3
  All notable changes to `pmx-canvas` are documented here. This project follows
4
4
  [Semantic Versioning](https://semver.org/).
5
5
 
6
+ ## [0.1.28] - 2026-06-06
7
+
8
+ ### Changed
9
+
10
+ - **BREAKING (SDK): `PmxCanvas.addNode()` now returns the created node**
11
+ (a `CanvasNodeState` with `id`, geometry, and data) instead of a bare
12
+ id string. Use `const { id } = canvas.addNode(...)` or keep the whole
13
+ node. The MCP / HTTP / CLI surfaces and the internal `CanvasAccess`
14
+ contract are unchanged (still id-based).
15
+
16
+ ### Fixed
17
+
18
+ - Tufte graph nodes (DotPlot/Bullet/Slopegraph) no longer flicker: the
19
+ chart-height ResizeObserver no longer feeds the document's own scroll
20
+ overflow back into its height.
21
+ - Expanded Tufte graph views now fill the modal instead of staying
22
+ tile-sized with whitespace.
23
+ - Graph node iframes no longer show a doubled scrollbar; a chart that
24
+ fits shows none, a dense chart shows exactly one.
25
+ - Excalidraw / ext-app nodes paint on first mount instead of rendering
26
+ black until a manual expand/collapse (a post-layout host-context
27
+ nudge is delivered once the iframe has settled).
28
+ - `image` and `ledger` nodes get roomier default sizes (480×360 /
29
+ 420×280) instead of a cramped 360-wide frame.
30
+ - `pmx-canvas web-artifact build` streams a stderr heartbeat during the
31
+ long install+bundle so agents don't see it as hung.
32
+ - json-render rejects an unknown `$`-directive (e.g. `$path`) with a
33
+ clear error pointing at `$state`, instead of rendering
34
+ `"[object Object]"`.
35
+ - Web-artifact script-path overrides are contained to the workspace with
36
+ a symlink-aware (realpath) check, fixing a false rejection on macOS.
37
+ - **Security:** the `/api/canvas/image/<id>` route now refuses to serve
38
+ files outside the workspace root (returns 403), closing a path-
39
+ traversal read (e.g. an image node pointed at `../../etc/passwd`).
40
+
6
41
  ## [0.1.27] - 2026-06-06
7
42
 
8
43
  Big release: the full host-agnostic agent-experience (AX) primitive
@@ -1349,6 +1384,7 @@ otherwise have to discover by trial and error.
1349
1384
  - Regression coverage for snapshot flat-`id` aliases on both MCP and
1350
1385
  HTTP surfaces, plus async / top-level-`await` WebView script bodies.
1351
1386
 
1387
+ [0.1.28]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.28
1352
1388
  [0.1.27]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.27
1353
1389
  [0.1.26]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.26
1354
1390
  [0.1.25]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.25