pmx-canvas 0.1.4 → 0.1.6

package/CHANGELOG.md

@@ -3,6 +3,135 @@
 All notable changes to `pmx-canvas` are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## [0.1.6] - 2026-04-26
+
+CLI/MCP regression cleanup after the 0.1.5 coverage pass. This release tightens
+graph creation routing, restores legacy json-render Badge compatibility, and
+makes MCP node creation routes explicit enough for agents to recover from schema
+drift without guessing.
+
+### Added
+
+- **Top-level `pmx-canvas graph add`.** This now routes through the agent CLI
+  and creates graph nodes via the same HTTP path as the canonical
+  `pmx-canvas node add --type graph ...` command, instead of falling through to
+  server startup.
+- **MCP node-type routing metadata.** `canvas_describe_schema` and
+  `canvas://schema` now expose `mcp.nodeTypeRouting`, so agents can discover
+  that `json-render`, `graph`, `web-artifact`, `external-app`, and `group`
+  use dedicated creation tools instead of guessing `canvas_add_node`.
+- **MCP schema entry for `external-app`.** The running schema now lists
+  `external-app` as a virtual node family backed by `canvas_open_mcp_app`, with
+  notes pointing Excalidraw callers to the higher-level `canvas_add_diagram`
+  preset.
+- **`mcpTool` field on every node-type schema entry**, plus
+  `canvas_open_mcp_app` and `canvas_create_group` added to the published
+  `mcp.tools` array — both surfaces help an agent discover the right tool for
+  each canvas operation without guessing.
+
+### Changed
+
+- **Graph height semantics are documented consistently across surfaces.** For
+  CLI graph commands, `--node-height` / `--nodeHeight` set the canvas node frame
+  height, `--chart-height` sets the chart content height, and `--height` remains
+  a compatibility alias for frame height. For MCP/HTTP/batch payloads,
+  `nodeHeight` is frame height and `height` is chart content height.
+- **PMX Canvas skill guidance now includes MCP-specific gotchas.** The bundled
+  skill documents the MCP node-type routing table, `canvas_open_mcp_app`
+  transport requirements, `canvas_build_web_artifact` source-string behavior and
+  cold-build timeout expectations, `canvas_pin_nodes.nodeIds`, and the required
+  `canvas_diff.snapshot` argument.
+- **Legacy `props.label` is removed from Badge specs after normalization.** The
+  validated/persisted spec now carries exactly one of `text` or `label`, never
+  both — a stricter future validator can flag the legacy key without breaking
+  saved canvases written before this release.
+- **`canvas_build_web_artifact` `id` alias is conditional.** When
+  `openInCanvas` is `false` (or no canvas node was created), the `id` field is
+  omitted from the response instead of being `undefined`. Consumers can now
+  reliably use `'id' in response` to detect the build-only case. `nodeId` is
+  always present and remains the canonical identifier.
+
+### Fixed
+
+- **`pmx-canvas graph add` no longer starts a rogue server.** The top-level
+  command is registered with the agent CLI, so malformed or valid graph commands
+  cannot fall through to server startup and leak a fallback daemon.
+- **Legacy json-render `Badge` specs are accepted again.** Saved specs using
+  `props.label` now normalize to `props.text`, and legacy status variants
+  (`success`, `info`, `warning`, `error`, `danger`) normalize to the current
+  shadcn Badge enum before validation.
+- **Web-artifact build responses include `id` (alias for `nodeId`) when a
+  canvas node was created.** Keeps MCP/HTTP add-style responses consistent.
+- **Graph CLI node-height aliases now work.** `--node-height` and
+  `--nodeHeight` set the canvas node frame height, `--chart-height` sets the
+  chart content height, and CLI `--height` remains a compatibility alias for
+  the frame height.
+
+### Internal
+
+- Regression coverage for top-level graph CLI routing, graph height flags,
+  legacy Badge normalization (now including `info → secondary` and
+  `error → destructive` plus the post-normalization `label` removal), MCP
+  node-type routing metadata, and web-artifact response ID aliases.
+
+[0.1.6]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.6
+
+## [0.1.5] - 2026-04-26
+
+Image-validation hardening + CLI ergonomics. The boundary where untrusted
+file paths become canvas state now validates magic bytes, and common CLI
+typos produce one-line suggestions instead of help-block dumps.
+
+### Added
+
+- **Magic-byte validation for local image nodes.** PNG / JPEG / GIF / SVG /
+  WebP / BMP / ICO / AVIF headers are sniffed before a file becomes an
+  `image` node. A file renamed `screenshot.png` containing PowerPoint XML
+  is now rejected with a clear error before it reaches the renderer.
+- **macOS cloud-on-demand placeholder detection.** Files in iCloud Drive,
+  OneDrive, etc. that are not yet downloaded locally are detected via
+  `stat -f %Xf` flags and rejected with a hint to download them first —
+  no more silent freezes when an iCloud-only file is dropped on the canvas.
+- **`/bin/dd` escape hatch with a 5s timeout** for macOS-only paths where
+  the direct fs read could hang on an unresponsive volume (e.g. an
+  unmounted SMB share that still satisfies `existsSync`). Distinguishes
+  timeout (`SIGTERM` / `ETIMEDOUT`) from generic spawn failures so the
+  cloud-storage hint isn't shown for unrelated errors.
+- **CLI typo hints for resource subcommands.**
+  - `pmx-canvas node delete <id>` and `pmx-canvas node rm <id>` exit 1 with
+    `Did you mean: pmx-canvas node remove?`.
+  - `pmx-canvas edge delete <id>` and `pmx-canvas edge rm <id>` get the
+    same treatment.
+  - `pmx-canvas node pin <id>` redirects to the top-level
+    `pmx-canvas pin <id>` command.
+
+### Changed
+
+- **`GET /api/canvas/image/:id` is now async** (`fs/promises.readFile`) and
+  validates content before serving — returns **400** on invalid image bytes
+  instead of 200 with `application/octet-stream`.
+- **Bare `pmx-canvas node` (no subcommand)** now exits 1 with structured
+  JSON instead of printing the resource help block. Use
+  `pmx-canvas node --help` for the listing.
+
+### Internal
+
+- New module `src/server/image-source.ts` extracts and extends image
+  validation from `canvas-operations.ts`. Same error contract; richer
+  checks. The MCP and HTTP layers both flow through `addCanvasNode`, so
+  CLAUDE.md rule #5 (four-layer parity) is preserved without touching
+  the SDK or MCP server.
+- Direct fs read is the fast path on every platform (no fork, no shell);
+  `dd` is only consulted on macOS as a fallback when direct read fails on
+  a path that wasn't flagged as a placeholder.
+- Real magic-byte fixtures in `tests/unit/canvas-operations.test.ts` (was:
+  `*.png` extension smoke tests). New HTTP coverage in
+  `tests/unit/server-api.test.ts` for valid / invalid / missing image
+  paths. New CLI coverage for `node delete`, `node pin`, `edge delete`,
+  `edge rm` typo hints.
+
+[0.1.5]: https://github.com/pskoett/pmx-canvas/releases/tag/v0.1.5
+
 ## [0.1.4] - 2026-04-26
 
 Graph/CLI ergonomics + canvas-node taxonomy hardening. Three threads: