pmx-canvas 0.1.32 → 0.1.34

package/CHANGELOG.md

@@ -5,6 +5,79 @@ All notable changes to `pmx-canvas` are documented here. This project follows
 
 ## [Unreleased]
 
+## [0.1.34] - 2026-06-08
+
+### Added
+
+- **Adapterless agents see browser-originated AX activity (report #43).**
+  `canvas://ax-pending-steering` and `canvas_claim_ax_delivery` now return a
+  `pendingActivity` digest alongside `pending` steering: open canvas-bound items
+  awaiting the agent — open work items and pending approval gates / elicitations /
+  mode requests, typically created by the human in the browser. Every AX mutation
+  already fires `ax-state-changed` (so MCP clients that subscribe are pushed
+  `canvas://ax-work` live); `pendingActivity` closes the gap for clients that
+  **poll** the delivery surface instead. Loop-safe (a consumer never sees items it
+  originated) and read-only there — resolve each via its own tool
+  (`canvas_resolve_approval` / `canvas_respond_elicitation` / `canvas_resolve_mode`
+  / `canvas_update_work_item`), not `canvas_mark_ax_delivery` (that stays
+  steering-only).
+
+### Changed
+
+- **`POST /api/canvas/graph` accepts `heightPx` / `nodeHeight` for the node frame
+  height.** `height` sets the chart's plot height; the node frame previously only
+  honored `nodeHeight` / `size.height`, so a caller passing `height`/`heightPx`
+  expecting the node to resize got the default. `heightPx` is now an alias for the
+  node frame height (matching the SDK input field), removing the silent surprise.
+  (With content-fit the node grows to the chart regardless; this is a DX fix.)
+- **"Open as site" opens in the system browser.** A node's "Open as site" action
+  (the header `↗` and the expanded-overlay button) now opens the standalone surface
+  in the real OS browser via `POST /api/canvas/open-external`, replacing the
+  separate "Open in system browser" button (one action instead of two). The
+  endpoint accepts an optional `{ url }` limited to the node's own surface route
+  (origin + pathname checked, `400` otherwise) so a caller can preserve safe
+  presentation params like the current theme without any SSRF risk; it still falls
+  back to a normal new browser tab when the OS launch is unavailable.
+
+### Fixed
+
+- **Nodes grow to fit their content — graph clipping (report #48).** Iframe-backed
+  surfaces (graph, json-render, html/html-primitive, web-artifact) now report their
+  natural content height to the parent over a nonce-validated `content-height`
+  postMessage bridge, and the node **grows** to fit it. This fixes graphs created at
+  a small height (e.g. 300px in an embedded panel) rendering with the chart cut off
+  at the bottom — the node now sizes to the chart (title + plot + axes + labels).
+  - **Grow-only & gated:** a node only ever grows (never shrinks), so it can't
+    clip and — being monotonic with a dead-band — can't oscillate (the old
+    Tufte-chart flicker is structurally impossible). Skipped for `strictSize`,
+    user-resized, docked, collapsed, and group nodes, and for unbounded/scrolling
+    surfaces (presentation decks, hosted ext-apps, URL/webpage viewers).
+  - Charts render at their **intrinsic** height when the node is auto-fitting (so
+    the reported height is stable and the node converges in one step); they still
+    fill the frame down for fixed-size (strictSize / user-resized) nodes.
+  - Iframe surfaces grow up to ~1400px before scrolling (text nodes keep the ~600px
+    cap). A manual resize marks the node `userResized` and turns content-fit off.
+
+## [0.1.33] - 2026-06-08
+
+### Changed
+
+- **Edge creation echoes the full edge.** `POST /api/canvas/edge` now returns the
+  complete created edge — `from`, `to`, `type`, `style`, and `animated` alongside
+  `ok` and `id` — instead of just `{ ok, id }`. This mirrors how node creation
+  echoes the created node, so a client no longer has to re-read the layout to learn
+  the resolved edge shape. Additive on the HTTP response; the SDK `addEdge` still
+  returns the bare edge id.
+
+### Fixed
+
+- **Bodyless and malformed JSON `POST`s are handled cleanly.** `readJson` now
+  reads the raw request body and treats an empty/whitespace body as `{}` without
+  logging a spurious warning (e.g. `POST /api/canvas/fit` with no body), and
+  rejects a top-level JSON array (or any non-object) to `{}` instead of letting it
+  flow through as though it were an object. Endpoints that read optional fields
+  from the body keep working with or without a payload.
+
 ## [0.1.32] - 2026-06-07
 
 ### Added
@@ -1690,6 +1763,8 @@ otherwise have to discover by trial and error.
 - Regression coverage for snapshot flat-`id` aliases on both MCP and
   HTTP surfaces, plus async / top-level-`await` WebView script bodies.
 
+[0.1.34]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.34
+[0.1.33]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.33
 [0.1.32]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.32
 [0.1.31]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.31
 [0.1.30]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.30