pmx-canvas 0.2.1 → 0.2.3

package/skills/pmx-canvas/evals/evals.json

@@ -6,6 +6,9 @@
       "name": "investigation-board",
       "prompt": "I'm debugging a memory leak in our Node.js API. The /api/users endpoint is leaking memory on every request. I found a suspicious closure in src/handlers/users.ts that captures the entire request object, and the heap snapshot shows growing EventEmitter listeners. Can you set up an investigation board on the canvas so I can see the full picture?",
       "expected_output": "Creates multiple nodes (bug description, code file, heap findings, hypothesis) connected with edges, arranged in a tree layout. Uses appropriate node types (markdown for findings, file for source, status for investigation progress).",
+      "files": [
+        "evals/fixtures/investigation-board/src/handlers/users.ts"
+      ],
       "assertions": [
         {
           "name": "creates-multiple-nodes",
@@ -93,7 +96,7 @@
       "assertions": [
         {
           "name": "reads-pinned-context",
-          "description": "Reads the canvas://pinned-context MCP resource (not just canvas_query action:layout)",
+          "description": "Reads the curated pin set via canvas://pinned-context — or the host-equivalent (canvas_ax_state / the HTTP pinned-context endpoint) where a direct resource tool is unavailable — not just canvas_query action:layout",
           "type": "output_check"
         },
         {
@@ -113,6 +116,12 @@
       "name": "code-exploration-files",
       "prompt": "I'm trying to understand how the authentication flow works in this project. Can you put the relevant auth files on the canvas so I can see how they connect? The main files are src/auth/login.ts, src/auth/middleware.ts, src/auth/jwt.ts, and src/routes/auth.ts.",
       "expected_output": "Creates file nodes for each mentioned file (content auto-loads), relies on code graph to auto-detect import dependencies, groups auth files together, and reads canvas://code-graph for dependency analysis.",
+      "files": [
+        "evals/fixtures/code-exploration/src/auth/jwt.ts",
+        "evals/fixtures/code-exploration/src/auth/login.ts",
+        "evals/fixtures/code-exploration/src/auth/middleware.ts",
+        "evals/fixtures/code-exploration/src/routes/auth.ts"
+      ],
       "assertions": [
         {
           "name": "uses-file-nodes",
@@ -181,6 +190,251 @@
           "type": "output_check"
         }
       ]
+    },
+    {
+      "id": 8,
+      "name": "workspace-identity-preflight",
+      "prompt": "Attach to the running PMX canvas and add a status node for our deploy. There's already a daemon on port 4313.",
+      "expected_output": "Before mutating, reads GET /health (or serve status) and confirms the returned workspace matches the intended workspace root; refuses to mutate a mismatched/stale listener and starts an isolated server on an explicit --port instead.",
+      "assertions": [
+        {
+          "name": "reads-health",
+          "description": "Reads /health or serve status before any mutation",
+          "type": "output_check"
+        },
+        {
+          "name": "checks-workspace",
+          "description": "Compares the returned workspace to the intended workspace root",
+          "type": "output_check"
+        },
+        {
+          "name": "handles-mismatch",
+          "description": "On workspace mismatch or responsive+pidRunning:false, does NOT mutate; isolates via explicit --port and re-checks /health",
+          "type": "output_check"
+        }
+      ]
+    },
+    {
+      "id": 9,
+      "name": "current-composite-routing",
+      "prompt": "Create a markdown note, a bar chart, and an Excalidraw diagram on the canvas.",
+      "expected_output": "Uses current composites: canvas_node {action:add} for markdown, canvas_render {action:add-graph} for the chart, canvas_app {action:diagram} for Excalidraw. Avoids deprecated single-purpose tools (canvas_add_node/canvas_add_diagram/canvas_build_web_artifact/canvas_open_mcp_app).",
+      "assertions": [
+        {
+          "name": "uses-canvas-node",
+          "description": "Creates the markdown node via canvas_node {action:add}",
+          "type": "output_check"
+        },
+        {
+          "name": "uses-canvas-render",
+          "description": "Creates the chart via canvas_render {action:add-graph}",
+          "type": "output_check"
+        },
+        {
+          "name": "uses-canvas-app",
+          "description": "Creates the Excalidraw diagram via canvas_app {action:diagram}",
+          "type": "output_check"
+        },
+        {
+          "name": "avoids-deprecated",
+          "description": "Does not call deprecated standalones (canvas_add_node/canvas_add_diagram/etc.)",
+          "type": "output_check"
+        }
+      ]
+    },
+    {
+      "id": 10,
+      "name": "existing-board-extension",
+      "prompt": "Add two more findings to the investigation board that's already on the canvas.",
+      "expected_output": "Searches the existing board first, snapshots before extending, adds new nodes without duplicating existing titles, and validates the final layout for collisions.",
+      "assertions": [
+        {
+          "name": "searches-first",
+          "description": "Searches existing nodes (canvas_query {action:search}) before adding",
+          "type": "output_check"
+        },
+        {
+          "name": "snapshots-before",
+          "description": "Snapshots before extending the board",
+          "type": "output_check"
+        },
+        {
+          "name": "no-duplicates",
+          "description": "Adds new nodes without duplicating existing node titles",
+          "type": "output_check"
+        },
+        {
+          "name": "validates-layout",
+          "description": "Runs canvas_query {action:validate} (or arrange+validate) on the result",
+          "type": "output_check"
+        }
+      ]
+    },
+    {
+      "id": 11,
+      "name": "context-pin-workflow",
+      "prompt": "Pin the auth design node so I (the agent) keep it in context, then confirm it's pinned.",
+      "expected_output": "Pins via a verified path (canvas_pin_nodes, the CLI pin, or browser/right-click 'Pin as context'), then reads canvas://pinned-context to confirm; does not claim a broken UI action succeeded.",
+      "assertions": [
+        {
+          "name": "pins-via-verified-path",
+          "description": "Pins via canvas_pin_nodes / CLI pin / 'Pin as context' — not an unverified action",
+          "type": "output_check"
+        },
+        {
+          "name": "reads-pinned-context",
+          "description": "Reads canvas://pinned-context (or canvas_ax_state) to confirm the pin",
+          "type": "output_check"
+        },
+        {
+          "name": "confirms-count",
+          "description": "Confirms the pin is reflected (context count / pinned set) rather than assuming success",
+          "type": "output_check"
+        }
+      ]
+    },
+    {
+      "id": 12,
+      "name": "status-node-cleanup",
+      "prompt": "Remove the obsolete 'Deploy: pending' status node from the board.",
+      "expected_output": "Removes the status node via canvas_node {action:remove} (status nodes are removable like any other type) and verifies removal; undo remains available.",
+      "assertions": [
+        {
+          "name": "removes-status-node",
+          "description": "Removes the status node via canvas_node {action:remove}",
+          "type": "output_check"
+        },
+        {
+          "name": "verifies-removal",
+          "description": "Verifies the node is gone from the layout",
+          "type": "output_check"
+        },
+        {
+          "name": "preserves-undo",
+          "description": "Notes/relies on undo (canvas_history) remaining available",
+          "type": "output_check"
+        }
+      ]
+    },
+    {
+      "id": 13,
+      "name": "ax-html-control-surface",
+      "prompt": "Build an AX control surface as an HTML node with a button that creates a work item and a button that steers me.",
+      "expected_output": "Creates an opted-in html node (axCapabilities.enabled) using the blessed recipe: awaits window.PMX_AX.emit, reflects live state via pmx-ax-update, avoids sandbox-blocked localStorage, and labels the steer button as queued for the next turn (not immediate wake).",
+      "assertions": [
+        {
+          "name": "opts-in-ax",
+          "description": "Creates the html node with axCapabilities.enabled = true",
+          "type": "output_check"
+        },
+        {
+          "name": "awaits-emit",
+          "description": "Uses window.PMX_AX.emit with await (not fire-and-forget)",
+          "type": "output_check"
+        },
+        {
+          "name": "sandbox-safe",
+          "description": "Avoids localStorage/sessionStorage/cookies in the sandboxed iframe",
+          "type": "output_check"
+        },
+        {
+          "name": "labels-steer-queued",
+          "description": "Labels steering as queued for the next turn, not immediate agent wake",
+          "type": "output_check"
+        }
+      ]
+    },
+    {
+      "id": 14,
+      "name": "ax-delivery-lifecycle",
+      "prompt": "There are pending steering messages from the board. Pick them up and act on them.",
+      "expected_output": "Reads compact context (newest-first pendingSteering + totalPending/omittedPending) and/or claims via canvas_ax_delivery {action:claim}; acts, then marks delivered. Understands direct delivery stays FIFO oldest-first.",
+      "assertions": [
+        {
+          "name": "reads-newest-first",
+          "description": "Uses compact context (newest-first + counts) or canvas_ax_delivery claim to find fresh steering",
+          "type": "output_check"
+        },
+        {
+          "name": "acts-then-marks",
+          "description": "Acts on the steering then marks it delivered (canvas_ax_delivery {action:mark})",
+          "type": "output_check"
+        },
+        {
+          "name": "understands-fifo",
+          "description": "Recognizes the direct delivery queue is FIFO oldest-first, distinct from compact context",
+          "type": "output_check"
+        }
+      ]
+    },
+    {
+      "id": 15,
+      "name": "final-cleanup-and-validate",
+      "prompt": "We're done with the test board. Clean up the temporary nodes and leave the canvas as we found it.",
+      "expected_output": "Removes retry/test fixtures, runs canvas_query {action:validate} to confirm no accidental collisions/dangling edges, and restores the baseline snapshot.",
+      "assertions": [
+        {
+          "name": "removes-fixtures",
+          "description": "Removes the temporary/retry fixture nodes",
+          "type": "output_check"
+        },
+        {
+          "name": "validates-final",
+          "description": "Validates the final layout (canvas_query {action:validate})",
+          "type": "output_check"
+        },
+        {
+          "name": "restores-baseline",
+          "description": "Restores the baseline snapshot to leave the canvas as found",
+          "type": "output_check"
+        }
+      ]
+    },
+    {
+      "id": 16,
+      "name": "ghost-cursor-intent",
+      "prompt": "Add an 'Auth design' status node to the review area. Before adding it, signal what you're about to do so I can veto it if I disagree, then make the change.",
+      "expected_output": "Signals a create intent first with canvas_intent {action:signal, kind:\"create\", position, nodeType:\"status\", label, reason, confidence}, then creates the 'Auth design' node at that position with canvas_node {action:\"add\", type:\"status\", x, y, intentId}. Understands that a vetoed intent rejects its linked mutation. Does not silently mutate without signalling when steering would help.",
+      "assertions": [
+        {
+          "name": "signals-intent-first",
+          "description": "Calls canvas_intent {action:signal} with label/reason and a confidence in [0,1] before the visible mutation",
+          "type": "output_check"
+        },
+        {
+          "name": "links-mutation-to-intent",
+          "description": "Passes the returned intentId on canvas_node {action:add, type:\"status\", x, y, intentId} so the ghost settles into the real node",
+          "type": "output_check"
+        },
+        {
+          "name": "respects-veto",
+          "description": "Understands a vetoed intent rejects its linked mutation (\"Intent <id> was vetoed\") rather than treating signal as cosmetic, and clears/updates intent appropriately",
+          "type": "output_check"
+        }
+      ]
+    },
+    {
+      "id": 17,
+      "name": "standalone-surface-open-as-site",
+      "prompt": "Open the bar-chart graph node as a standalone full-page site for a screenshot, and also try to open the Excalidraw diagram node the same way. Tell me the correct surface URL for each.",
+      "expected_output": "For the graph/json-render node, uses the stable surface URL /api/canvas/surface/<id> which redirects to the full-viewport display=site viewer (reads surfaceUrl from the node, does not fabricate a path). Recognizes the hosted Excalidraw/ext-app node is NOT an open-as-site target (its surface route returns a clean 404 — it renders only with the in-canvas host bridge) and does not claim a standalone tab will work. Notes that some host browsers (e.g. the Codex in-app single-tab browser) don't deliver live-resize events, so a system browser is recommended for separate full-page viewing.",
+      "assertions": [
+        {
+          "name": "graph-site-surface-url",
+          "description": "Gives the graph node's /api/canvas/surface/<id> URL (which redirects to display=site, full viewport) from the node payload rather than fabricating one",
+          "type": "output_check"
+        },
+        {
+          "name": "extapp-not-open-as-site",
+          "description": "States the hosted Excalidraw/ext-app node is not an open-as-site target (clean 404; renders in-canvas only) instead of claiming a standalone tab works",
+          "type": "output_check"
+        },
+        {
+          "name": "host-browser-caveat",
+          "description": "Recommends a system browser for separate full-page viewing and/or notes single-tab host browsers may not reflow on live resize",
+          "type": "output_check"
+        }
+      ]
     }
   ]
 }

package/skills/pmx-canvas/evals/fixtures/code-exploration/src/auth/jwt.ts

@@ -0,0 +1,17 @@
+const SECRET = process.env.JWT_SECRET ?? 'dev-secret';
+
+export interface JwtClaims {
+  sub: string;
+  exp: number;
+}
+
+export function signJwt(claims: JwtClaims): string {
+  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url');
+  return `${payload}.${SECRET}`;
+}
+
+export function verifyJwt(token: string): JwtClaims | null {
+  const [payload, signature] = token.split('.');
+  if (signature !== SECRET || !payload) return null;
+  return JSON.parse(Buffer.from(payload, 'base64url').toString()) as JwtClaims;
+}

package/skills/pmx-canvas/evals/fixtures/code-exploration/src/auth/login.ts

@@ -0,0 +1,12 @@
+import { signJwt, type JwtClaims } from './jwt';
+
+export async function login(username: string, password: string): Promise<string | null> {
+  const ok = await checkCredentials(username, password);
+  if (!ok) return null;
+  const claims: JwtClaims = { sub: username, exp: Date.now() + 3_600_000 };
+  return signJwt(claims);
+}
+
+async function checkCredentials(username: string, password: string): Promise<boolean> {
+  return Boolean(username) && password.length >= 8;
+}

package/skills/pmx-canvas/evals/fixtures/code-exploration/src/auth/middleware.ts

@@ -0,0 +1,13 @@
+import { verifyJwt } from './jwt';
+
+export interface AuthedRequest {
+  headers: Record<string, string>;
+  userId?: string;
+}
+
+export function authMiddleware(req: AuthedRequest, next: () => void): void {
+  const token = (req.headers.authorization ?? '').replace(/^Bearer /, '');
+  const claims = verifyJwt(token);
+  if (claims) req.userId = claims.sub;
+  next();
+}

package/skills/pmx-canvas/evals/fixtures/code-exploration/src/routes/auth.ts

@@ -0,0 +1,13 @@
+import { login } from '../auth/login';
+import { authMiddleware, type AuthedRequest } from '../auth/middleware';
+
+export function registerAuthRoutes(router: {
+  post(path: string, handler: (req: AuthedRequest) => Promise<unknown>): void;
+  use(handler: (req: AuthedRequest, next: () => void) => void): void;
+}): void {
+  router.use(authMiddleware);
+  router.post('/login', async (req) => {
+    const token = await login(req.headers.username ?? '', req.headers.password ?? '');
+    return token ? { token } : { error: 'invalid credentials' };
+  });
+}

package/skills/pmx-canvas/evals/fixtures/investigation-board/src/handlers/users.ts

@@ -0,0 +1,27 @@
+import { EventEmitter } from 'node:events';
+
+const refreshBus = new EventEmitter();
+
+interface UserRequest {
+  query: Record<string, string>;
+  headers: Record<string, string>;
+}
+
+interface UserResponse {
+  json(body: unknown): void;
+}
+
+/**
+ * GET /api/users
+ *
+ * Memory leak: every request registers a `refresh` listener whose closure
+ * captures the entire `req` object and is never removed. The heap retains one
+ * request per call and the EventEmitter listener count grows without bound.
+ */
+export function getUsers(req: UserRequest, res: UserResponse): void {
+  refreshBus.on('refresh', () => {
+    // Captures `req` for the lifetime of the process — the leak.
+    void req.headers;
+  });
+  res.json({ users: [] });
+}