pmx-canvas 0.2.4 → 0.2.5

package/dist/types/client/nodes/ExtAppFrame.d.ts

@@ -8,6 +8,16 @@ interface ExtAppHostDimensionsTarget {
     clientHeight?: number;
     getBoundingClientRect(): Pick<DOMRectReadOnly, 'width' | 'height'>;
 }
+/**
+ * Finding F (0.2.4): detect a WebKit-only host — Safari or a WKWebView (e.g. the
+ * GitHub Copilot app's embedded panel). Blink engines (Chrome / Chromium / Edge /
+ * the Codex browser, all of which carry a Chrome/Chromium/CriOS/Edg token) and
+ * Android WebView are excluded, as is Gecko (no `AppleWebKit`). Used to gate the
+ * one-time ext-app iframe repaint remount to the only engine that exhibits the
+ * present-at-load black-tile paint race, so the remount is a strict no-op
+ * everywhere we can test (Chrome / Codex / Playwright).
+ */
+export declare function isWebKitOnlyHost(userAgent: string): boolean;
 export declare function getExtAppBridgeInitKey(node: CanvasNodeState, retryKey: number): string;
 export declare function resolveExtAppDisplayModeRequest(requestedMode: DisplayMode, isExpanded: boolean): {
     nextMode: DisplayMode;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmx-canvas",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Spatial canvas workbench for coding agents — infinite 2D canvas with agent-native CLI, MCP integration, nodes, edges, file watching, and snapshots",
   "type": "module",
   "main": "./src/server/index.ts",

package/skills/pmx-canvas/SKILL.md

@@ -195,6 +195,13 @@ Prefer `canvas_query { action: "search" }` over parsing the full layout.
 - Hosted MCP-app/ext-app nodes such as Excalidraw require the in-canvas host bridge and are not
   standalone **Open as site** targets. URL-backed viewers and bundled web artifacts remain
   openable.
+- A hosted ext-app (Excalidraw) node that is already on the board when a **WebKit** host panel
+  loads (e.g. the GitHub Copilot app's embedded WKWebView) can render as a black tile — a host
+  paint race on the nested iframe, not a broken node (the session is healthy and `sessionStatus`
+  is `ready`; it renders fine in Chrome, the Codex browser, and for nodes created live after the
+  panel hydrates). The canvas auto-remounts the iframe once on load under WebKit to force a
+  repaint; if a tile is still black, expand-then-close it (forces a remount) or open the workbench
+  in a normal browser. Do not diagnose a healthy app session as a broken node.
 - Graph and json-render standalone surfaces use `display=site` and fill the browser viewport, and
   reflow on a live window resize in a normal browser. Some single-tab host browsers (e.g. the
   Codex in-app browser) don't deliver live-resize events, so a resized standalone chart can look

package/skills/pmx-canvas/references/full-reference.md

@@ -764,7 +764,8 @@ tools below operate on the live canvas state.
 > "evaluate" | "resize" }` respectively. Field names are unchanged.
 
 **`canvas_webview_status`** — Inspect the current automation session
-- Returns `{ supported, active, backend, viewportWidth, viewportHeight, url, lastError }`
+- Returns `{ supported, active, headlessOnly, url, backend, width, height, dataStoreDir, startedAt, lastError }`
+  (the viewport size is `width` / `height`, not `viewportWidth` / `viewportHeight`)
 - Call before `start` to check whether a session is already alive
 
 **`canvas_webview_start`** — Start (or replace) the automation session

package/src/client/nodes/ExtAppFrame.tsx

@@ -45,6 +45,19 @@ async function postJson<T>(url: string, body: Record<string, unknown>): Promise<
   return json.result as T;
 }
 
+/**
+ * Finding F (0.2.4): detect a WebKit-only host — Safari or a WKWebView (e.g. the
+ * GitHub Copilot app's embedded panel). Blink engines (Chrome / Chromium / Edge /
+ * the Codex browser, all of which carry a Chrome/Chromium/CriOS/Edg token) and
+ * Android WebView are excluded, as is Gecko (no `AppleWebKit`). Used to gate the
+ * one-time ext-app iframe repaint remount to the only engine that exhibits the
+ * present-at-load black-tile paint race, so the remount is a strict no-op
+ * everywhere we can test (Chrome / Codex / Playwright).
+ */
+export function isWebKitOnlyHost(userAgent: string): boolean {
+  return /AppleWebKit/.test(userAgent) && !/Chrome|Chromium|CriOS|Edg|Android/.test(userAgent);
+}
+
 export function getExtAppBridgeInitKey(node: CanvasNodeState, retryKey: number): string {
   const html = typeof node.data.html === 'string' ? node.data.html : '';
   const serverName = typeof node.data.serverName === 'string' ? node.data.serverName : '';
@@ -194,6 +207,7 @@ export function ExtAppFrame({ node, expanded = false }: { node: CanvasNodeState;
   const toolResultSendingRef = useRef<Promise<void> | null>(null);
   const bridgeReadyRef = useRef(false);
   const themeUnsubRef = useRef<(() => void) | null>(null);
+  const webkitRepaintDoneRef = useRef(false);
   const [status, setStatus] = useState<'loading' | 'ready' | 'done'>('loading');
   const [error, setError] = useState<string | null>(null);
   const [retryKey, setRetryKey] = useState(0);
@@ -262,6 +276,29 @@ export function ExtAppFrame({ node, expanded = false }: { node: CanvasNodeState;
     window.addEventListener('message', onAxMessage);
     return () => window.removeEventListener('message', onAxMessage);
   }, [axEnabled, axToken, nodeId]);
+
+  // Finding F (0.2.4): in a WebKit host panel (e.g. the GitHub Copilot app's
+  // WKWebView), the doubly-nested ext-app iframe (workbench iframe → mcp-app.html
+  // iframe) can lose the initial-paint race during board hydration and come up as a
+  // black tile for nodes already present at panel-load — clean in Blink (Chrome /
+  // Codex / our Playwright e2e) and clean for nodes created live after hydration.
+  // The deterministic recovery is an iframe remount (exactly what expand+close, and
+  // the error-retry button, already do). Replicate that recovery ONCE, on mount, in
+  // WebKit-only — gated on the engine so it is a strict no-op in Blink and cannot
+  // regress the engine we test against. Inline board instance only (the one that
+  // loads black); the expanded overlay already remounts on open.
+  useEffect(() => {
+    if (expanded || webkitRepaintDoneRef.current) return;
+    if (typeof navigator === 'undefined' || typeof window === 'undefined') return;
+    if (!isWebKitOnlyHost(navigator.userAgent)) return;
+    webkitRepaintDoneRef.current = true;
+    // Let the initial hydration burst settle, then force one remount so the nested
+    // iframe repaints (mirrors the post-hydration expand+close recovery).
+    const timer = window.setTimeout(() => setRetryKey((k) => k + 1), 250);
+    return () => window.clearTimeout(timer);
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, []);
+
   const toMcpTheme = (theme: string): McpUiTheme => (theme === 'light' ? 'light' : 'dark');
   const isExpanded = expanded || expandedNodeId.value === nodeId;
 

package/src/server/intent-registry.ts

@@ -60,6 +60,7 @@ const intentUpdateSchema = z.looseObject({
   confidence: z.number().min(0).max(1).optional(),
   seq: z.number().int().min(0).max(9999).optional(),
   ttlMs: z.number().positive().max(MAX_INTENT_TTL_MS).optional(),
+  vetoed: z.boolean().optional(),
 });
 
 function parseOrThrow<T>(schema: z.ZodType<T>, raw: unknown, label: string): T {
@@ -165,6 +166,21 @@ export class IntentRegistry {
     if (!existing) throw new OperationError(`No live intent "${id}".`, 404);
     const patch = parseOrThrow(intentUpdateSchema, raw, 'intent update');
     const now = Date.now();
+
+    // A vetoed update is a veto, not a patch: poison the id and dissolve the ghost
+    // so a later linked settle (beginCommit) is rejected — for a live, non-committing
+    // intent the same authoritative outcome as clear({ vetoed:true }). (A committing
+    // intent is already gated above with a 409, so the commit wins the race.) Without
+    // this, vetoed-via-update only dissolved the ghost visually while the linked
+    // mutation still landed (#C, 0.2.4).
+    if (patch.vetoed === true) {
+      this.rememberVeto(id);
+      this.intents.delete(id);
+      this.emit('ax-intent-clear', { id, vetoed: true });
+      this.maybeStopSweeper();
+      return { ...existing, expiresAt: now };
+    }
+
     const ttl = typeof patch.ttlMs === 'number' ? patch.ttlMs : DEFAULT_INTENT_TTL_MS;
 
     const intent: PmxAxIntent = {

package/src/server/operations/ops/intent.ts

@@ -66,6 +66,7 @@ const intentUpdateShape = {
   confidence: z.number().optional().describe('0..1 → ghost opacity/solidity.'),
   seq: z.number().optional().describe('New ordering hint.'),
   ttlMs: z.number().optional().describe('Reset the TTL to this many ms from now.'),
+  vetoed: z.boolean().optional().describe('Veto the intent: dissolves the ghost AND poisons the id so a later linked settle is rejected (same as clear { vetoed:true }).'),
 };
 
 const intentUpdateSchema = z.looseObject(intentUpdateShape);