pmx-canvas 0.1.34 → 0.1.35

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to `pmx-canvas` are documented here. This project follows
 
 ## [Unreleased]
 
+## [0.1.35] - 2026-06-08
+
+### Fixed
+
+- **HTTP batch accepts a bare-array body again (report #49).** `POST /api/canvas/batch`
+  with a top-level `[ ... ]` array created nothing and returned `{ ok: true, results: [] }`
+  — the 0.1.33 `readJson` hardening (empty/whitespace/non-object → `{}`) also coerced
+  top-level arrays to `{}`, so the handler's bare-array branch was dead. Batch now reads
+  the body with an array-preserving variant, so both documented shapes work: the canonical
+  `{ "operations": [...] }` and a bare `[...]`. `readJson` is unchanged for every other
+  endpoint (still object-only), so the malformed-body robustness is preserved.
+
 ## [0.1.34] - 2026-06-08
 
 ### Added
@@ -1763,6 +1775,7 @@ otherwise have to discover by trial and error.
 - Regression coverage for snapshot flat-`id` aliases on both MCP and
   HTTP surfaces, plus async / top-level-`await` WebView script bodies.
 
+[0.1.35]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.35
 [0.1.34]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.34
 [0.1.33]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.33
 [0.1.32]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.32

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmx-canvas",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "description": "Spatial canvas workbench for coding agents — infinite 2D canvas with agent-native CLI, MCP integration, nodes, edges, file watching, and snapshots",
   "type": "module",
   "main": "./src/server/index.ts",

package/src/server/server.ts

@@ -1072,6 +1072,34 @@ async function readJson(req: Request): Promise<Record<string, unknown>> {
   }
 }
 
+/**
+ * Like {@link readJson}, but PRESERVES a top-level JSON array. For endpoints that
+ * accept either an object or a bare array (e.g. `/api/canvas/batch`, whose CLI
+ * help and handler both document a bare `[...]` form). readJson coerces arrays to
+ * `{}` so object-shaped handlers never crash on `body.field`; this variant keeps
+ * the array so the handler's array branch can run. Empty/whitespace/malformed
+ * bodies still resolve to `{}`.
+ */
+async function readJsonObjectOrArray(req: Request): Promise<Record<string, unknown> | unknown[]> {
+  let text = '';
+  try {
+    text = await req.text();
+  } catch (error) {
+    logWorkbenchWarning('readJson', error);
+    return {};
+  }
+  if (!text.trim()) return {};
+  try {
+    const value = JSON.parse(text) as unknown;
+    if (Array.isArray(value)) return value;
+    if (!value || typeof value !== 'object') return {};
+    return value as Record<string, unknown>;
+  } catch (error) {
+    logWorkbenchWarning('readJson', error);
+    return {};
+  }
+}
+
 function htmlEscape(value: string): string {
   return value
     .replaceAll('&', '&amp;')
@@ -2495,8 +2523,12 @@ async function handleCanvasAddGraph(req: Request): Promise<Response> {
 }
 
 async function handleCanvasBatch(req: Request): Promise<Response> {
-  const body = await readJson(req);
-  const operations = Array.isArray(body.operations) ? body.operations : Array.isArray(body) ? body : [];
+  // Accept both documented shapes: { operations: [...] } and a bare [...] array.
+  // Uses the array-preserving reader so the bare-array form isn't coerced to {}.
+  const body = await readJsonObjectOrArray(req);
+  const operations = Array.isArray(body)
+    ? body
+    : Array.isArray(body.operations) ? body.operations : [];
   const normalized = operations
     .filter((operation): operation is Record<string, unknown> => operation && typeof operation === 'object' && !Array.isArray(operation))
     .map((operation) => ({