feat(desktop): add channel-first project Canvas POC - #6974
Draft
matt2e wants to merge 2 commits into
Draft
Conversation
🔐 Codex Security Review
|
matt2e
force-pushed
the
jitter/channel-project-features-on-thomas
branch
from
August 31, 2026 02:02
17f8339 to
c81760d
Compare
Move projects onto the channel-first stack: a channel can opt into project features and surface them as tabs alongside chat, instead of projects living as a separate top-level surface. Desktop: - Channel project features are opt-in per channel, with a feature bar, settings pane, and tabs for the canvas, resources, repos, reviews, and meetings; project home redirects to its channel - Sidebar nests project channels under a project disclosure group, adds move destinations, and keeps section storage in sync with moves - Extract the join-channel banner and the channel pane main column, and pull sidebar scroll lock and unread DM previews into their own modules to stay under the file-size ratchet - Survive unmounted editor views and listener teardown races via mountedEditorView and safeUnlisten Project Canvas: - Sandboxed local canvas packages served over a Tauri custom protocol, with manifest validation, path security, and snapshot storage that supports pending/committed widget updates and revision pruning - React canvas host and surface plus a shared protocol module - Bundle a project-canvas-template resource with demo dashboards, widgets, and styles CLI and agent surface: - Add `buzz canvas notify` to tell the local desktop that a widget's presentation or data changed; it runs locally with no relay connection - Update the ACP base prompt and nest skill docs for canvas authoring Also promotes Projects out of preview-features. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Matt Toohey <contact@matttoohey.com>
matt2e
force-pushed
the
jitter/channel-project-features-on-thomas
branch
from
August 31, 2026 05:26
c81760d to
031030f
Compare
The app aborted on every macOS and Linux launch. `ipc::start` runs synchronously from Tauri's `setup` hook, on the main thread with no Tokio runtime in context, and called `tokio::net::UnixListener::from_std` there. That call registers the socket with the reactor, so it panicked with "there is no reactor running" — and because `setup` runs inside tao's `did_finish_launching`, a non-unwinding ObjC callback, the panic escalated to `panic_cannot_unwind` and killed the process before a window ever appeared. Bind the socket synchronously as before (so stale-socket and permission failures still surface as a returned error), then hand the std listener to `spawn_serving`, which converts it inside the spawned task where the reactor is live. Socket cleanup on a failed conversion matches the existing accept error path. Covered by a unit test that calls `spawn_serving` from a plain sync context, exactly as `setup` does, and asserts the socket still accepts a connection; it reproduces the original panic when the conversion moves back to the call site. Verified with `just staging`: the app now boots past `did_finish_launching`, creates `CANVASES/.runtime/agent-updates.sock` with 0600 permissions, and reaches the frontend. Full Tauri test suite (3031), clippy, fmt, and the file-size gate pass. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Matt Toohey <contact@matttoohey.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
allow-scriptsiframe behind a boundedMessageChanneldata bridgebuzz canvas notify --change data|presentationhandoff: data updates keep the iframe and widget root mounted for animation, while presentation updates use the existing validated last-known-good reload gateValidation
cargo test -p buzz-cli(416/416)env -u BUZZ_ACP_ALLOWED_RESPOND_TO cargo test -p buzz-acp -- --test-threads=1(840/840 across unit and integration tests)pnpm -C desktop test(5,783/5,783)cargo test --workspace --manifest-path desktop/src-tauri/Cargo.toml(full Tauri workspace; 3,004 desktop tests plus integration crates)POC boundary
The native Canvas runtime fails closed outside macOS. A hostile raw-Tauri-IPC probe must still pass in the packaged macOS app before treating this as a production security boundary. Real project/channel/review data remains read-only inside the Canvas; agents mutate the local package through the filesystem and notify the running Desktop. Package storage is not synced.