mirror of
https://github.com/block/buzz.git
synced 2026-10-29 21:41:33 +00:00
61226c68be
Implement the Project Canvas plan: live queries, task actions, navigation, and standard components for sandboxed widget packages. - RPC plumbing: child-to-host canvas.query/subscribe/unsubscribe/command/ open messages with strict schemas, tiered budgets answered as error results instead of frame kills (16 concurrent subscriptions, 10 commands per minute, 3 opens per 10s, 64 KiB port messages), and a disposal-fenced dispatcher (projectCanvasRpc) so late completions never post to a closed port. - Data broker (projectCanvasBroker): project.metadata, project.channels.list, project.reviews.list, project.tasks.list/get, people.lookup (max 32 pubkeys, avatars inlined as data URLs up to 48 KiB through a 32-entry LRU), and people.search, all scoped by page-fed sources; live subscriptions re-push on source changes with serialized dedupe, and commands/opens resolve against those sources before any delegate runs so widgets can never widen scope. - New capabilities project.tasks.read, project.people.read, project.tasks.write, and app.open in the Rust manifest validator and TS protocol, with per-(binding, revision) consent for the consequential pair: an approve/deny banner gates them, denial degrades the canvas to read-only, and widget-initiated writes surface toasts. - Task actions: NIP-34 status events (kinds 1630-1633) via the previously unused buildGitStatusTags, tasks.setStatus/assign/unassign mutations, and useLiveProjectWorkItems keeping issues and reviews fresh over a relay subscription with backoff, reconnect overlap, and debounced invalidation. - Navigation: canvas.open targets channel/user/task/review behind app.open; ProjectChannelHome routes them and remounts the workspace sheet with the selected item. - SDK runtime served at /__buzz/sdk.js and /__buzz/sdk.css before every package script: data.query/liveQuery/command, app.open, capabilities(), and ui.avatar/reviewRow/channelRow themed by --buzz-* variables. The bundled template's activeChannels and reviews widgets now render from liveQuery instead of fixture snapshots, a tasks widget adds Mark done/ Reopen/Assign to me, and the SDK surface is documented in base_prompt.md and nest_skill.md. Tested: desktop unit suite 5895 passing (new broker, rpc, protocol, template, and issue-template tests), Tauri lib 3076 passing, buzz-acp prompt tests, canvas e2e spec 7 passing with new capability-badge and consent assertions, and clippy, fmt, biome, tsc, px-text, and file-size gates all clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Signed-off-by: Matt Toohey <contact@matttoohey.com>