Implement the Project Canvas plan: live queries, task actions, navigation,
and standard components for sandboxed widget packages.
- RPC plumbing: child-to-host canvas.query/subscribe/unsubscribe/command/
open messages with strict schemas, tiered budgets answered as error
results instead of frame kills (16 concurrent subscriptions, 10 commands
per minute, 3 opens per 10s, 64 KiB port messages), and a disposal-fenced
dispatcher (projectCanvasRpc) so late completions never post to a closed
port.
- Data broker (projectCanvasBroker): project.metadata,
project.channels.list, project.reviews.list, project.tasks.list/get,
people.lookup (max 32 pubkeys, avatars inlined as data URLs up to 48 KiB
through a 32-entry LRU), and people.search, all scoped by page-fed
sources; live subscriptions re-push on source changes with serialized
dedupe, and commands/opens resolve against those sources before any
delegate runs so widgets can never widen scope.
- New capabilities project.tasks.read, project.people.read,
project.tasks.write, and app.open in the Rust manifest validator and TS
protocol, with per-(binding, revision) consent for the consequential
pair: an approve/deny banner gates them, denial degrades the canvas to
read-only, and widget-initiated writes surface toasts.
- Task actions: NIP-34 status events (kinds 1630-1633) via the previously
unused buildGitStatusTags, tasks.setStatus/assign/unassign mutations, and
useLiveProjectWorkItems keeping issues and reviews fresh over a relay
subscription with backoff, reconnect overlap, and debounced invalidation.
- Navigation: canvas.open targets channel/user/task/review behind app.open;
ProjectChannelHome routes them and remounts the workspace sheet with the
selected item.
- SDK runtime served at /__buzz/sdk.js and /__buzz/sdk.css before every
package script: data.query/liveQuery/command, app.open, capabilities(),
and ui.avatar/reviewRow/channelRow themed by --buzz-* variables. The
bundled template's activeChannels and reviews widgets now render from
liveQuery instead of fixture snapshots, a tasks widget adds Mark done/
Reopen/Assign to me, and the SDK surface is documented in base_prompt.md
and nest_skill.md.
Tested: desktop unit suite 5895 passing (new broker, rpc, protocol,
template, and issue-template tests), Tauri lib 3076 passing, buzz-acp
prompt tests, canvas e2e spec 7 passing with new capability-badge and
consent assertions, and clippy, fmt, biome, tsc, px-text, and file-size
gates all clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
61226c68be