stackcanvas 0.2.1 → 0.2.3

package/README.md

@@ -1,6 +1,6 @@
 # stackcanvas
 
-Live infrastructure canvas for [Claude Code](https://claude.com/claude-code).
+Live infrastructure canvas for AI coding agents — any agent that speaks [MCP](https://modelcontextprotocol.io) ([Claude Code](https://claude.com/claude-code) is the CI-verified path).
 The agent writes and plans your Terraform — stackcanvas shows it as a living
 diagram. Drag new resources onto the canvas; the agent turns them into
 idiomatic HCL. No SaaS, no credentials leave your machine: everything runs on
@@ -23,7 +23,13 @@ localhost, reading your local state and plan.
    canvas highlights what will change. Only the agent executes Terraform —
    the canvas has no apply button by design.
 
-## Install (Claude Code)
+## Install
+
+stackcanvas is a standard MCP stdio server (`npx -y stackcanvas`) — point any
+MCP-capable coding agent at it. The paths below, in order of how battle-tested
+they are:
+
+### Claude Code (CI-verified)
 
     claude plugin marketplace add pshenok/stackcanvas
     claude plugin install stackcanvas@stackcanvas
@@ -42,12 +48,12 @@ Or without the plugin system:
 Then, inside a repo with Terraform, just ask: *open the stackcanvas canvas
 for this repo*.
 
-## Other MCP clients
+### Other MCP clients
 
-stackcanvas is a standard [MCP](https://modelcontextprotocol.io) server, so
-any MCP-compatible client can run it. The snippets below are **reported to
-work as standard MCP servers; not yet CI-verified** — only the Claude Code
-path above is exercised in CI.
+The snippets below are **reported to work; not yet CI-verified** — only the
+Claude Code path above is exercised in CI. Codex CLI and other MCP-capable
+agents should work with the equivalent stdio config (`npx -y stackcanvas`) —
+untested, reports welcome in issues.
 
 **Cursor** (`.cursor/mcp.json`):
 
@@ -78,11 +84,14 @@ What's provider-specific is only the curation layer, shipped as **provider packs
 
 - a palette pack (`packages/ui/src/resource-palette.ts`) — curated drag-and-drop types
 - containment rules (`DEFAULT_CONTAINMENT_RULES` in `@stackcanvas/core`) — which
-  resources render as visual containers (AWS VPC/subnet today)
+  resources render as visual containers (AWS VPC/subnet, GCP network/subnetwork,
+  Azure subnet, Cloudflare zone today)
 - icon patterns (`packages/ui/src/icons.tsx`)
 
-AWS ships first. Adding a GCP/Azure/other pack is pure data and makes a great
-first PR.
+Four packs ship today: **AWS** (complete — the reference pack) and **GCP /
+Azure / Cloudflare starter packs** covering the common resource types per
+provider. Rounding out a starter pack, or adding a new provider entirely, is
+pure data and makes a great first PR.
 
 ## OpenTofu
 
@@ -103,7 +112,7 @@ to pin it — both take precedence over auto-detection.
 
 ## Demo
 
-`examples/demo` contains a small AWS config. Run `terraform init && terraform plan -out=tfplan && terraform show -json tfplan > .stackcanvas/plan.json` there and open the canvas to see create-highlighting. `plan` does not create or modify any resources — nothing is provisioned until `terraform apply` (note: the AWS provider still needs credentials and makes read-only API calls during plan).
+`examples/local-demo` is a **zero-credential** playground: `terraform init && terraform apply -auto-approve` creates real state using only local providers (no cloud account touched), and the canvas renders it — including sensitive masking on the generated password. `examples/demo` contains a small AWS config. Run `terraform init && terraform plan -out=tfplan && terraform show -json tfplan > .stackcanvas/plan.json` there and open the canvas to see create-highlighting. `plan` does not create or modify any resources — nothing is provisioned until `terraform apply` (note: the AWS provider still needs credentials and makes read-only API calls during plan).
 
 ## Telemetry
 

package/dist/cli.js

@@ -40,7 +40,15 @@ function deriveEdges(nodes) {
 }
 var DEFAULT_CONTAINMENT_RULES = [
   { containerType: "aws_vpc", memberAttr: "vpc_id", kind: "vpc" },
-  { containerType: "aws_subnet", memberAttr: "subnet_id", kind: "subnet" }
+  { containerType: "aws_subnet", memberAttr: "subnet_id", kind: "subnet" },
+  // GCP networks/subnetworks are referenced by `self_link`, not `id`.
+  { containerType: "google_compute_network", memberAttr: "network", kind: "vpc", containerIdAttr: "self_link" },
+  { containerType: "google_compute_subnetwork", memberAttr: "subnetwork", kind: "subnet", containerIdAttr: "self_link" },
+  { containerType: "azurerm_subnet", memberAttr: "subnet_id", kind: "subnet" },
+  // Cloudflare zones aren't a network container, but they group the
+  // resources scoped to them the same way a VPC groups its members — reuse
+  // the 'vpc' kind rather than introducing a one-off styling kind.
+  { containerType: "cloudflare_zone", memberAttr: "zone_id", kind: "vpc" }
 ];
 function deriveContainment(g, rules = DEFAULT_CONTAINMENT_RULES) {
   const groups = [...g.groups];
@@ -48,7 +56,7 @@ function deriveContainment(g, rules = DEFAULT_CONTAINMENT_RULES) {
   for (const rule of rules) {
     const groupByPhysicalId = /* @__PURE__ */ new Map();
     for (const n of nodes.filter((n2) => n2.type === rule.containerType)) {
-      const pid = n.attributes["id"];
+      const pid = n.attributes[rule.containerIdAttr ?? "id"];
       if (typeof pid !== "string") continue;
       const gid = `${rule.kind}:${n.id}`;
       groups.push({ id: gid, label: n.name, kind: rule.kind, parent: n.group });
@@ -926,7 +934,7 @@ function openBrowser(url) {
 }
 
 // src/version.ts
-var VERSION = "0.2.1";
+var VERSION = "0.2.3";
 
 // src/server.ts
 function looksLikeTerraformRoot(dir) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stackcanvas",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "type": "module",
   "main": "dist/cli.js",
   "bin": {
@@ -29,7 +29,7 @@
     "@types/node": "^22.0.0",
     "tsup": "^8.0.0"
   },
-  "description": "Live infrastructure canvas for Claude Code: see what your AI agent is about to do to your Terraform \u2014 and approve it \u2014 before it happens. Local-first, credentials never leave your machine.",
+  "description": "Live infrastructure canvas for AI coding agents (MCP): see what your agent is about to do to your Terraform \u2014 and approve it \u2014 before it happens. Local-first, credentials never leave your machine.",
   "license": "MIT",
   "repository": {
     "type": "git",