pmx-canvas 0.2.0 → 0.2.2

package/src/server/server.ts

@@ -89,6 +89,7 @@ import {
   syncCanvasRuntimeBackends,
 } from './canvas-operations.js';
 import { dispatchOperationRoute, setOperationEventEmitter } from './operations/index.js';
+import { intentRegistry } from './intent-registry.js';
 import { setWebviewRunner } from './operations/webview-runner.js';
 import {
   closeNodeAppSession,
@@ -135,6 +136,15 @@ setOperationEventEmitter((event, payload) => {
   emitPrimaryWorkbenchEvent(event, payload);
 });
 
+// Ghost Cursor of Intent SSE wiring: the IntentRegistry never imports this
+// module — its `ax-intent` / `ax-intent-clear` frames (including the autonomous
+// TTL-expiry sweeper) are emitted through the injected workbench emitter, same
+// pattern as setOperationEventEmitter. Wired at module top level so in-process
+// MCP/SDK intent signals reach the browser without startCanvasServer().
+intentRegistry.setEmitter((event, payload) => {
+  emitPrimaryWorkbenchEvent(event, payload);
+});
+
 // Webview-runner wiring (plan-008 Wave 3): the webview ops never import this
 // module — the Bun.WebView automation runner is injected here, mirroring the
 // setOperationEventEmitter pattern. The closures call the real automation
@@ -182,6 +192,7 @@ function normalizeGraphViewerSpec(
   const graphConfig = node.data.graphConfig;
   if (
     display !== 'expanded' &&
+    display !== 'site' &&
     graphConfig &&
     typeof graphConfig === 'object' &&
     typeof (graphConfig as Record<string, unknown>).height === 'number'
@@ -1319,8 +1330,11 @@ function handleNodeSurface(pathname: string, url: URL): Response {
 
   if (node.type === 'json-render' || node.type === 'graph') {
     const params = new URLSearchParams({ nodeId, theme });
+    // "Open as site" is a standalone browser tab, so the viewer should fill the
+    // viewport (report #65) — distinct from the in-canvas expand overlay, which hits
+    // the viewer route directly with display=expanded.
     const display = url.searchParams.get('display');
-    if (display === 'expanded') params.set('display', 'expanded');
+    params.set('display', display === 'expanded' ? 'expanded' : 'site');
     return surfaceRedirect(`/api/canvas/json-render/view?${params.toString()}`);
   }
 
@@ -1329,19 +1343,16 @@ function handleNodeSurface(pathname: string, url: URL): Response {
     if (node.data.viewerType === 'web-artifact' && typeof node.data.path === 'string' && node.data.path) {
       return surfaceRedirect(`/artifact?path=${encodeURIComponent(node.data.path)}`);
     }
-    // Hosted ext-app — serve the same prepared HTML the in-canvas frame receives.
-    // The app's host bridge has no peer in a standalone tab, so interactive
-    // tool-calls won't function there; the UI still renders. Served TOP-LEVEL with
-    // a tighter sandbox than the in-canvas iframe (no allow-popups-to-escape-sandbox)
-    // since this is untrusted third-party HTML opened as its own page.
-    if (node.data.mode === 'ext-app' && typeof node.data.html === 'string' && node.data.html) {
-      return surfaceHtmlResponse(node.data.html, HTML_SURFACE_SANDBOX);
-    }
     // URL-backed viewer — hand off to its own origin.
     if (typeof node.data.url === 'string' && isSafeSurfaceRedirect(node.data.url)) {
       return surfaceRedirect(node.data.url);
     }
-    return responseText('MCP app node has no openable surface', 404);
+    // Hosted ext-app (e.g. Excalidraw) is a LIVE MCP-app shell that only renders with
+    // the in-canvas AppBridge host; served to a standalone tab it errored with
+    // `-32601` (report #61). It is intentionally NOT openable as a site — open such
+    // apps externally through their own app, or view them in the canvas. (Kept in sync
+    // with canOpenNodeAsSurface in src/shared/surface.ts, which hides the UI control.)
+    return responseText('This MCP app renders in the canvas and cannot be opened as a standalone site.', 404);
   }
 
   if (node.type === 'webpage') {
@@ -1572,12 +1583,18 @@ async function handleJsonRenderView(url: URL): Promise<Response> {
   const axToken = url.searchParams.get('axToken');
   const axEnabled = resolveNodeAxCapabilities(node).enabled;
   const frameToken = url.searchParams.get('frameToken');
-  const fitContent = url.searchParams.get('fit') === 'content';
+  const displayParam = url.searchParams.get('display');
+  const display = displayParam === 'expanded' ? 'expanded' as const
+    : displayParam === 'site' ? 'site' as const
+    : undefined;
+  // A standalone "site" tab fills the viewport; content-fit (grow-to-content for the
+  // in-canvas iframe) would fight that, so it's ignored in site mode (#65).
+  const fitContent = url.searchParams.get('fit') === 'content' && display !== 'site';
   const html = await buildJsonRenderViewerHtml({
     title,
     spec,
     ...(theme ? { theme } : {}),
-    ...(url.searchParams.get('display') === 'expanded' ? { display: 'expanded' as const } : {}),
+    ...(display ? { display } : {}),
     ...(devtoolsEnabled ? { devtools: true } : {}),
     ...(axToken ? { nodeId, axToken } : {}),
     // Seed the read-side AX state (only for AX-enabled nodes) so specs can bind /ax.
@@ -2164,6 +2181,16 @@ function handleWorkbenchEvents(req: Request): Response {
           timestamp: new Date().toISOString(),
         }),
       );
+      for (const intent of intentRegistry.list()) {
+        controller.enqueue(
+          toSseFrame('ax-intent', {
+            intent,
+            reason: 'connect-snapshot',
+            sessionId: primaryWorkbenchSessionId,
+            timestamp: new Date().toISOString(),
+          }),
+        );
+      }
       pingTimer = setInterval(() => {
         try {
           controller.enqueue(
@@ -3799,6 +3826,7 @@ export function startCanvasServer(options: CanvasServerOptions = {}): string | n
 }
 
 export function stopCanvasServer(): void {
+  intentRegistry.reset();
   canvasState.close();
   closeAllMcpAppSessions();
   setCanvasLayoutUpdateEmitter(null);

package/src/shared/ax-intent.ts

@@ -0,0 +1,64 @@
+/**
+ * Ghost Cursor of Intent — the shared pre-commit "intent" envelope.
+ *
+ * An intent is EPHEMERAL PRESENCE, not canvas state: it describes a move the
+ * agent is ABOUT to make (create / move / connect / remove / edit) so the canvas
+ * can paint a faint placeholder before the real mutation lands. Like a
+ * multiplayer cursor, it auto-expires, is count-capped, and never enters
+ * `canvas_get_layout`, `state.json`, or snapshots.
+ *
+ * This module is import-shared by the server (IntentRegistry + the intent ops)
+ * and the client (intent-store + IntentLayer); it must stay free of any
+ * server-only or client-only imports.
+ */
+
+export type PmxAxIntentKind = 'create' | 'move' | 'connect' | 'remove' | 'edit';
+
+export type PmxAxIntentEdgeType = 'relation' | 'depends-on' | 'flow' | 'references';
+
+export interface PmxAxIntentEdge {
+  from: string;
+  to: string;
+  type: PmxAxIntentEdgeType;
+}
+
+export interface PmxAxIntent {
+  /** Stable id → update / clear / veto. Auto-generated when a signal omits it. */
+  id: string;
+  kind: PmxAxIntentKind;
+  /** create: where the new node forms. move: the destination. */
+  position?: { x: number; y: number };
+  /** move / edit / remove: the existing node the intent targets. */
+  nodeId?: string;
+  /** connect: the edge about to be drawn. */
+  edge?: PmxAxIntentEdge;
+  /** Node type the ghost renders (icon + type badge). Defaults to a neutral box. */
+  nodeType?: string;
+  /** Short action label shown on the ghost chip ("Add evidence"). */
+  label?: string;
+  /** WHY — shown beneath the ghost. The legibility payoff. */
+  reason?: string;
+  /** 0..1 → ghost opacity/solidity. */
+  confidence?: number;
+  /** Ordering hint for staged-batch ghosts (the numbered previsualization rail). */
+  seq?: number;
+  /** Source label of the surface that signalled the intent (mcp/api/sdk/...). */
+  source?: string;
+  /** Epoch ms when the intent was first signalled. */
+  createdAt: number;
+  /** Epoch ms when the intent auto-dissolves if not settled/cleared first. */
+  expiresAt: number;
+}
+
+export const INTENT_KINDS: PmxAxIntentKind[] = ['create', 'move', 'connect', 'remove', 'edit'];
+
+export const INTENT_EDGE_TYPES: PmxAxIntentEdgeType[] = ['relation', 'depends-on', 'flow', 'references'];
+
+/** Default lifetime of an unsettled ghost. */
+export const DEFAULT_INTENT_TTL_MS = 8000;
+
+/** Hard ceiling on TTL so a stuck ghost can never linger. */
+export const MAX_INTENT_TTL_MS = 60000;
+
+/** Live-intent cap — oldest is evicted past this (presence, not a queue). */
+export const MAX_LIVE_INTENTS = 12;

package/src/shared/surface.ts

@@ -19,8 +19,12 @@ export function canOpenNodeAsSurface(type: string, data: Record<string, unknown>
     case 'graph':
       return true;
     case 'mcp-app':
+      // Hosted ext-app nodes (e.g. Excalidraw) are a LIVE MCP-app shell that needs the
+      // in-canvas AppBridge host to render; a standalone browser tab has no host, so
+      // "Open as site" only produced a broken `-32601` page (report #61). Those apps
+      // open externally through their own app, not PMX. Only a bundled web-artifact
+      // (static) or a real url-backed viewer can open as a standalone site.
       return (data.viewerType === 'web-artifact' && typeof data.path === 'string' && data.path.length > 0)
-        || (data.mode === 'ext-app' && typeof data.html === 'string' && data.html.length > 0)
         || (typeof data.url === 'string' && data.url.length > 0);
     case 'webpage':
       return typeof data.url === 'string' && data.url.length > 0;