feat(canvas): land the reviewed canvas stack parts #1399 to #1369

Merged
GN
3d ago
+16821-4821

Summary

  • The canvas stack (#1396 to #1369) was reviewed as 10 parts. #1396 and #1397 reached dev. The other 8 parts (#1399, #1400, #1401, #1402, #1403, #1404, #1405, #1369) were merged into their parent stack branches instead of dev, so their code never landed. This PR lands that remaining work.
  • Spec: spec-openpencil-canvas-mode (v3, figcraft engine). Architecture spine 2026-10-16, amended 2026-10-18 for guest presence.

Related Issue

No issue. The 8 parts above hold the per-part review history.

Type of Change

  • feat: new feature
  • refactor: internal cleanup with no behavior change (OpenPencil removal)

What Changed

  • Agent canvas tools in the termul MCP server, routed to the right project's mounted canvas on desktop and web (#1399, #1401, #1405).
  • Canvas lifecycle: hidden mounts and save before unmount (#1400), a lease across windows and a mount cap (#1402), outside file changes and crash recovery (#1403).
  • OpenPencil daemon removed (#1404). Agent guidance, the agent cursor, and fork release termul-v0.2.0 with Inter fonts (#1369).

Scope

  • Same code as the 8 reviewed parts, merged with current dev. No dev change is reverted: every file that differs from dev differs only by the canvas work.
  • Findings from independent reviews that are still open land in the follow-up PR on top of this branch (canvas/stack-11), which is small enough for CodeRabbit.

How It Was Tested

  • bun run typecheck and bun run ci
  • cargo check --all-targets --locked
  • cargo test --lib -- canvas host_mcp acp::: 956 pass. 3 fail, and the same 3 fail on dev (browser_shim, claude_accounts, destructive_guard).
  • vitest on src/renderer/stores and src/renderer/lib: 4863 pass
  • Real runs in headless Edge and the Windows desktop release build (reports in the part PRs)

Checklist

  • PR title follows the conventional commit format
  • Explained why no issue exists
  • Added or updated tests
  • Read AGENTS.md
  • A human reviewed the complete diff before submission

🤖 Generated with Claude Code

Summary by cubic

Lands the eight reviewed canvas-stack parts (#1399–#1405, #1369) that were merged into their stack branches but never reached dev. The code is unchanged from those reviews, rebased onto current dev, and replaces the OpenPencil daemon with the figcraft editor: the pinned bundle (termul-v0.2.0, with the Inter font) runs in a Termul-served iframe, and Termul owns the .figcraft document, persistence, and the agent gateway.

Agent canvas

  • figcraft's tools are registered in the host termul MCP child and routed to the renderer that holds the project's canvas mount.
  • file.save becomes the host's own save, exports write only inside the project's folder, and every other path-taking call is refused.
  • Each answered agent call shows a guest cursor and a node flash on the editor.

Lifecycle

  • Closing a tab hides the mount instead of unmounting it, and every unmount saves and verifies first.
  • One mount lease per document per host, with takeover and a reconnect grace, plus a mount cap with activity-based eviction.
  • Outside changes reload a clean editor or raise a conflict; crashes remount from the last saved bytes.