Closes the fourth chat-backend category from the project_agent_runtime
memory. Implements user direction "opencode 和 codex 我们调用 http
server, 通过 ipc 启动本地的 server 模式" — spawn the CLI as a local
HTTP server then POST chat requests to its bound port.
`crates/openpencil-desktop/src/chat_http_server.rs`:
- `HttpServerProvider::for_cli(CliName::Codex | OpenCode)` builds a
bridge that spawns `<bin> serve` and connects to the local
endpoint. Other CliName variants return `None`.
- Lifecycle:
1. Spawn child with stdin=null, stdout+stderr piped.
2. Drain stderr to /dev/null on a sibling task so the server
can't deadlock on a full pipe.
3. Block on stdout lines until one announces the bound port.
Default 10-second timeout (cold first-run can be slow). The
child is killed on timeout so we never leak a half-started
server.
4. Continue draining stdout for the remainder of the server's
life so its operational logs don't back-pressure.
5. POST `{ "message": <prompt> }` to `127.0.0.1:<port><path>`
using reqwest. Non-2xx response → Error + Done { Aborted }.
6. Stream the response bytes; parse each newline-delimited
line through `chat_subprocess::parse_line` (the generic
text / thinking / tool_use / done / error envelope).
7. On any structured `done`, terminate; on receiver-drop,
start_kill the child.
- `parse_listening_line` handles three message formats observed
in the wild: `Listening on http://host:PORT` (Codex),
`Server listening on port NNNN` (OpenCode docs), bare
`listening NNNN` (some local-server frameworks).
`extract_port` prefers `:NNNN` after the last colon (HTTP URL
form) and falls back to the last digit run, so IP octets in
`127.0.0.1:8765` don't get picked up as the port (caught by a
failing test on first iteration).
- `chat_path` is a per-CLI template (defaults to `/v1/chat`); the
settings modal can swap it when wiring up a new server whose
URL differs.
Limitations to flag for future iterations:
- The server is killed after each `send`. Real multi-turn would
want a long-lived server, which means lifting the spawn into a
Client-like singleton (analogous to chat_copilot's
ClientSession). Today's per-send spawn pays the cold-start
twice per turn but keeps the bridge stateless.
- The request body shape (`{ "message": ... }`) is a guess. Each
server's actual API needs to be plumbed when we have real
Codex / OpenCode server specs to compare against.
`crates/openpencil-desktop/Cargo.toml`:
- Adds `reqwest = { version = "0.12", default-features = false,
features = ["rustls-tls", "json", "stream"] }` as a direct dep.
reqwest was already in the graph via anthropic-agent-sdk so the
cost is zero new transitive deps; declaring it directly makes
the chat_http_server module's intent explicit.
`crates/openpencil-desktop/src/chat_subprocess.rs`:
- `parse_line` lifted to `pub(crate)` so chat_http_server can
share the same wire-protocol parser. Centralizing the envelope
shape keeps the four bridges consistent — when one CLI's
protocol evolves, every bridge gets it.
`crates/openpencil-desktop/src/main.rs`:
- `mod chat_http_server;` slotted into the alphabetical mod list.
Tests (7 added, all pass):
- parse_listening_line_codex_format: `Listening on
http://127.0.0.1:8765` → 8765 (asserts the IP-octet rejection
that caught the first iteration's bug)
- parse_listening_line_opencode_format
- parse_listening_line_bare_number
- parse_listening_line_returns_none_when_absent
- for_cli_only_http_server_kinds: Codex + OpenCode → Some, others
→ None
- provider_constructs_as_chat_provider_trait_object: type-check
- provider_labels_match_cli_names: "Codex" / "OpenCode"
All four chat backends now wired in code:
✓ BuiltIn (agent-rs) — chat_runtime.rs
✓ ClaudeCode (anthropic-agent-sdk) — chat_claude.rs
✓ Copilot (copilot-sdk) — chat_copilot.rs
✓ Subprocess (Gemini generic + custom)— chat_subprocess.rs
✓ HttpServer (Codex + OpenCode) — chat_http_server.rs
Acp (third-party ndJSON) remains TODO — that's the fifth backend
in the architecture memo, the open extension point for CLIs we
don't ship a dedicated adapter for.
Total openpencil-desktop tests: 55 (was 48 before this commit).
First of the per-CLI ChatProvider adapters that replace the
hand-rolled stream-JSON parser in chat_subprocess.rs. This one wires
`anthropic_agent_sdk::query` (the in-workspace fork of
bartolli/anthropic-agent-sdk) into the OP chat-panel plumbing.
`crates/openpencil-desktop/src/chat_claude.rs`:
- `ClaudeCodeProvider` impls `ChatProvider`. Constructs trivially
via `new()` (SDK defaults) or `with_options(ClaudeAgentOptions)`
when the settings modal has user overrides (system prompt, model
pick, allowed-tools list, MCP servers, sandbox config — all 30+
SDK option fields).
- `send()` spawns the shared tokio runtime task, calls
`anthropic_agent_sdk::query(prompt, options)`, drains its async
`Stream<Item = Result<Message>>`, and dispatches each Message
through `handle_message`:
- `Message::Assistant.content` Vec<ContentBlock> is unpacked
per block: `Text { text }` → `ChatDelta::TextDelta`,
`Thinking { thinking, .. }` → `Thinking`, `ToolUse { name,
input, .. }` → `ToolUse { name, args = input.to_string() }`,
`ToolResult` swallowed (already part of conversation history
the CLI tracks).
- `Message::Result { subtype, is_error, .. }` is the turn
terminator. `is_error` → `StopReason::Aborted`; otherwise
`map_result_subtype` maps "success" → EndTurn,
"error_max_turns" → MaxTokens, error variants → Aborted,
unknown → EndTurn.
- `System` / `User` / `StreamEvent` swallowed (init / context /
partial-stream payloads the chat widget doesn't surface yet).
- Receiver-drop short-circuit: every iteration checks
`tx.is_closed()` so chat-panel teardown stops the SDK stream
promptly without waiting for the CLI to flush more output.
- Always emits a terminal `Done` — `Result` message → mapped stop
reason; stream EOF without a Result → `EndTurn` fallback.
`crates/openpencil-desktop/Cargo.toml`:
- Adds `anthropic-agent-sdk = { path = "../anthropic-agent-sdk" }`
+ `copilot-sdk = { path = "../copilot-sdk" }`. Copilot dep
declared now even though `chat_copilot.rs` lands in a follow-up,
so Cargo.lock resolves the whole graph in one pass.
`crates/openpencil-desktop/src/main.rs`:
- `mod chat_claude;` between `mod chat_runtime` and
`mod chat_subprocess` so the alphabetical mod-list rule holds.
Tests (3 added, all pass):
- `map_result_subtype_table` covers the success / error_max_turns /
error_during_execution / error / unknown table.
- `provider_label_is_human_readable` asserts the chat widget gets
"Claude Code" as the displayed label.
- `provider_constructs_as_chat_provider_trait_object` is the
compile-time type-check that `ClaudeCodeProvider` satisfies the
`Send + Sync` bounds so it can live behind `Arc<dyn ChatProvider>`
in the widget host.
End-to-end smoke testing requires an actual `claude` binary on PATH.
The 3 tests here verify the wiring + type contracts but not the live
CLI interaction; that lands when the settings modal exposes the
"connect" button + we have a real session to drive.
46 openpencil-desktop tests pass (was 43 before this commit).
Next: chat_copilot.rs over `copilot_sdk::Client + Session`, then
chat_http_server.rs for Codex / OpenCode `serve` mode per the user's
"opencode 和 codex 我们调用 http server, 通过 ipc 启动本地的 server 模式".
Per user direction "可以不放在 vendor 里面，我们移动到自己的工程，
后面就和他们分叉" — promote the two community SDKs from vendor/ to
crates/ so they become first-class OP workspace members we own and
evolve, instead of read-only vendored snapshots.
Moves:
vendor/anthropic-agent-sdk/ → crates/anthropic-agent-sdk/
vendor/copilot-sdk-rust/ → crates/copilot-sdk/
Workspace integration:
- Root `Cargo.toml` exclude list drops both vendor entries; the
existing `members = ["crates/*"]` glob auto-includes them.
- `crates/copilot-sdk/Cargo.toml`: stripped all `[[example]]`
blocks (22 of them) — the examples/ dir was already removed
during the import, and leaving the entries broke
`cargo test --workspace --no-run`.
- `crates/anthropic-agent-sdk/Cargo.toml`: already had its
`[[example]]` blocks pruned in the previous commit.
Lockfile pins (workspace `Cargo.lock`):
Pulling reqwest 0.12.28 (via anthropic-agent-sdk) into the
unified workspace dep graph re-resolved several `icu_*` crates to
the 2.2 line, which requires rustc 1.86. OP's toolchain is 1.85
(locked to stay compatible with the skia-safe-op fork). Pinned:
icu_collections 2.2.0 → 2.1.1
icu_locale_core 2.2.0 → 2.1.1
icu_normalizer 2.2.0 → 2.1.1
icu_normalizer_data 2.2.0 → 2.1.1
icu_properties 2.2.0 → 2.1.2
icu_properties_data 2.2.0 → 2.1.2
icu_provider 2.2.0 → 2.1.1
idna_adapter 1.2.2 → 1.2.1
All eight pins are the latest versions on each crate's 2.1.x /
1.2.x line that compile on rustc 1.85.
Verification:
- `cargo check -p anthropic-agent-sdk` ✓
- `cargo check -p copilot-sdk` ✓
- `cargo test --workspace --no-run` ✓
- `cargo test -p openpencil-shell-core --lib` → 250 pass
- `cargo test -p openpencil-desktop chat_` → 16 pass
Next: replace the hand-rolled subprocess parser in chat_subprocess.rs
with thin per-CLI adapters that route Claude Code through
`anthropic_agent_sdk::SubprocessTransport` and Copilot through
`copilot_sdk::Client + Session`. Gemini stays on the generic stdin
bridge until an upstream Rust SDK exists. Codex + OpenCode get an
HttpServerProvider that spawns `<bin> serve` then connects via a
local HTTP client.
The shell-core trait + `EchoProvider` from `3d754fdc` was the
abstraction. This wires up the first real backend so the AI chat
panel can drive a non-stubbed LLM turn from the native binary.
`crates/openpencil-desktop/src/chat_runtime.rs`:
- `BuiltInProvider` wraps `agent::QueryEngine` (the cross-product
Rust agent runtime at /Users/kayshen/Workspace/ZSeven-W/agent-rs).
- Process-wide tokio runtime singleton (multi-thread, `op-chat`
threads) initialized lazily on first send so cold chrome startup
doesn't pay for the spawn.
- Async → sync bridge: `ChatProvider::send` returns
`Iterator<Item = ChatDelta>`; the impl spawns a tokio task that
pumps agent-rs `Event`s into a `std::sync::mpsc::channel`, then
returns the receiver iterator. Closes on `Result` / `Error` /
receiver drop. Maps `TextDelta` / `Thinking` / `ToolUse` /
`Result` / `Error` straight to the corresponding `ChatDelta`
variants; `ToolResult` / `Usage` / `Notice` / `Unknown` swallow
silently (widget doesn't render them yet — they land in a Phase 2
transcript view).
- `map_stop_reason` table covers agent-rs's stop-reason strings
(`end_turn` / `stop_sequence` / `max_tokens` / `tool_use` /
`aborted` / `user_abort`); unknown values fall through to
`EndTurn` (safe default — turn over).
- `from_provider` is the constructor — takes any
`Arc<dyn Provider>` so tests + future settings-modal wiring (per-
provider credential modals) can drive in their own backend impls.
Cargo:
- `agent = { path = "../../../agent-rs/crates/agent",
default-features = false }` — no default features today because
the `anthropic` feature drags in reqwest's TLS stack (rustls /
icu_collections@2.2 / idna_adapter@1.2) which needs rustc 1.86
while this workspace pins 1.85. The BuiltIn trait + engine wiring
ship now; concrete Anthropic / OpenAI-compat / Ollama Provider
impls flip on once rust-toolchain bumps.
- `tokio` (rt-multi-thread + macros + sync) + `futures` for the
async bridge; `async-trait` for the test double's `Provider`
impl. All three are target-gated to native (cfg desktop OS) per
the workspace WASM-boundary policy in `Cargo.toml`.
Tests (3 added — all pass):
- `builtin_provider_streams_text_deltas_through_iterator` — drives
a scripted `Provider` test double through the engine, asserts
`ChatDelta::TextDelta("Hello")` arrives first and the run ends
with `Done { stop_reason: EndTurn }`.
- `builtin_provider_surfaces_event_error` — `Event::Error` from the
provider lands as a `ChatDelta::Error` carrying both code +
message.
- `map_stop_reason_table` — exhaustive table of every variant +
unknown fallthrough.
Next: Subprocess / HttpServer / Acp bridges per the 4-backend taxonomy
in `project_agent_runtime` memory — each lives in its own module so
the 800-line cap stays honored.
Pivot the desktop's Open path to the canonical `jian-ops-schema`
parser and route layout through `jian-core::LayoutEngine` so files
saved by the TS editor, Jian apps, or any tool emitting the
canonical schema load through the shared parser + paragraph shaper.
Loader (pen_doc_adapter.rs + pen_doc_path_bounds.rs)
- All 12 PenNode variants → NodePayload, with each root's authored
(base.x, base.y) added to harvested rects so multi-design files
(e.g. pencil-demo.op's 14 mockups) spread across the canvas.
- Path anchors port `getPathBoundsFromAnchors` — endpoints + Bezier
handles + cubic-derivative extrema — so curved paths scale into
their (width, height) the way the canonical renderer paints.
- jian-skia's `SkiaMeasure` plugged in via
`LayoutEngine::with_backend(...)`, replacing the ~10% character-
count heuristic with real paragraph-shaper metrics. Wrap/layout
now agree with paint instead of cascading 10% errors.
- Numeric-string fontWeight (`"700"`, `"normal"`, ...) parsed in
both jian-core and the desktop adapter; expanded keyword table
covers black/heavy/extralight/extrabold/demibold/hairline/etc.
- Version-tolerant `load_canonical` retries with `version` rewritten
to `"1.0"` so legacy `version: "2.8"` files still load.
Text + icon rendering
- `Node.text_wrap` gated on `textGrowth: fixed-width` — single-line
by default so font-fallback overshoot doesn't break lines the TS
app shows on one line.
- CJK-aware `wrap_text` (canvas_viewport_overlay.rs) — per-char CJK
breaks, word breaks for Latin, blank-line preservation, explicit
`\n` splits. Takes a weight param.
- `RenderBackend::measure_text_weighted` added with NativeBackend +
WebBackend overrides so wrap measurement matches weighted paint.
- icons.rs + new icons_data.rs sibling cover ~75 lucide variants
for first-party `iconFontName` names from pen-core element-builders
(trending-up/down, compass, refresh-cw, layout-dashboard, users,
package, zap, sliders-horizontal, activity, loader, focus,
chart-line, settings-2, arrow-right, check-circle, alert-triangle,
alert-octagon, sticky-note, bar-chart-2, bold/italic/underline,
shopping-cart/bag, send, message-circle, rocket, menu, credit-card,
x-circle, mail, smartphone, chrome, apple, user, ...). Unknown
names stroke a dot fallback (FALLBACK_ICON_D) instead of a block.
All d-strings copied from lucide-react@0.545.0.
- `Icon::from_name(&str)` resolves kebab-case + common aliases.
- Synthetic bold via PaintStyle::StrokeAndFill for weights ≥600 on
both native and web (single-weight bundles can't serve a real
bold variant).
Chrome polish
- Hover state on file menu / locale picker / shape picker / layer
panel rows / AgentSettings nav + provider cards. Host's
apply_cursor_move updates each per its open state.
- File menu compacted (row 30, header 22, no `…` suffix on actions),
recent file names truncate with a CJK-aware helper.
- `rfd::MessageDialog` on every failed Open / OpenRecent / Save /
SaveAs / ExportImage with bilingual (EN/ZH) title + path + detail.
OpenRecent failures prune the stale entry.
- `figma_import.rs` modal honest-stub (Coming soon copy, brand glyph),
TopBar Folder+Chevron compound + Figma button.
- Settings sidebar nav + provider cards tinted on hover.
- Recent-files panel polished to single-line names with age column.
Tests
- pen_doc_adapter_tests.rs (sibling via #[path]) — 19 cases covering
multi-root canvas offsets, shape size fallbacks, path anchor
absolutize + Bezier extrema, fixed-width wrap, numeric-string
weights, login.op + pencil-demo.op fixture loads.
- canvas_viewport_overlay.rs wrap_tests — 7 cases: ASCII / CJK /
CJK+Latin / explicit-newline / blank-line / weighted advances.
- icons.rs first_party_icon_font_names_all_resolve guards 27+
authored names against placeholder regressions.
File-cap discipline
- pen_doc_adapter.rs split into mod + path-bounds sibling + tests
sibling.
- icons.rs split into mod + icons_data.rs sibling so the catalogue
can grow without busting the cap.
- canvas_viewport_overlay.rs absorbs wrap_text + UniformBackend /
WeightedBackend test stubs.
Sub-modules
- vendor/jian advanced for `resolve_weight` numeric-string parsing.
Closes the largest TS parity gap (#1 / #2 in the audit): the
document was completely non-persistent — every restart lost the
canvas tree. Wire up native Save / Save As / Open through rfd
dialogs so the user picks the file path themselves (per the
audit conversation: "随意保存").
- new `crates/openpencil-desktop/src/persistence.rs`:
- `DocPayload` / `PagePayload` / `NodePayload` / `StrokePayload`
DTOs with serde derives (hand-rolled JSON shape so shell-core
stays serde-free; Color / Rect / Point2D come from external
crates that don't carry serde derives)
- `to_payload` / `apply_payload` + `kind_to_string` /
`str_to_kind` cover all 9 NodeKind variants including
NodeKind::Other(String)
- `save_as_dialog` / `open_dialog` use `rfd::FileDialog` with
a single combined "OpenPencil" filter covering both `.pen`
and `.op` extensions — both load via Open and save into
either at the user's choice
- `save_to_path` writes through a sibling `.tmp` + rename so a
mid-write crash never leaves a half-written document on disk
- `handle_save` / `handle_save_as` / `handle_open` package the
rfd + state flow + title refresh so the desktop key handler
stays a one-liner per shortcut
- new `WidgetHostNative::document()` / `document_mut()` accessors
— `pub(in crate::widget_host)` field stays internal otherwise
- `DesktopApp` gains `current_path: Option<PathBuf>`; window title
updates to `<filename> — OpenPencil` after Save / Open
- keyboard bindings: Cmd+S (save-in-place or fall through to Save
As when no path), Cmd+Shift+S (force Save As), Cmd+O (open
dialog). All three remain enabled when the settings modal is
focused; bypass the modal-focused editor-shortcut block because
they never type into the port field
- format spec: `{ version: 1, active_page_index: N, pages: [...] }`
— bump `CURRENT_VERSION` + add a migration branch in
`apply_payload` when the schema grows
The native runner outgrew the `examples/` slot — it owns DPI tracking,
caret-blink animation timer, panel-resize cursor, the full Cmd+wheel /
PinchGesture / Pixel/LineDelta dispatch table, etc. None of that is a
sample, so it's been promoted to a real crate.
* New crate `crates/openpencil-desktop/` with a single `[[bin]]`
target. Depends on `openpencil-shell-native` (lib) + winit +
skia-safe (gl), gated to macOS / Linux / Windows.
* `examples/inspector_window.rs` removed; equivalent code lives at
`crates/openpencil-desktop/src/main.rs` with the structs renamed
(DesktopApp / paint) and the doc-block rewritten as a runner spec.
* Run command: `cargo run -p openpencil-desktop --release`. Old
command (`--example inspector_window`) is gone.
* Workspace glob `crates/*` already picks up the new crate, no
Cargo.toml workspace edit needed.
* Docs: crates/CLAUDE.md updated with the new crate row and runner
section retitled "Desktop binary". Top-bar layout test renamed +
uses the TOP_BAR_HEIGHT constant so future height tweaks stop
breaking it.
Lands the four pure W3C → Jian gesture mappers that Phase C2's
browser listeners will consume:
- `event:⌨️:map_keyboard_parts(key, code, location, repeat,
pressed, modifiers, is_composing) -> KeyEvent` — W3C
KeyboardEvent.key/code/location string lookups produce KeyValue
(Char / Named / Unidentified) + KeyCode enum + KeyLocation enum.
Phase C1 covers KeyA-Z, Digit0-9, Enter / Escape / Tab / Space /
Backspace / Delete / arrows; Home/End/PageUp/PageDown/F-keys/
modifier physical codes (ShiftLeft etc) extend the table in C2
(codex C1 NIT-2 deferred).
- `event::ime::{composition_start, composition_update, composition_end}`
+ `utf16_selection_to_utf8` helper. The helper walks
`text.char_indices()` accumulating `len_utf16()` to remap UTF-16
code-unit offsets (what `CompositionEvent.getTargetRanges()`
hands us) to UTF-8 byte offsets (what jian-core's `ImeKind::
CompositionUpdate { selection: Range<usize> }` requires per spec
§2.4). Mis-ordered range returns None; out-of-range bounds clamp
to text.len(). CJK (你好), surrogate pairs (🙂), mixed-encoding
(aé), zero-length selections, and empty text are all covered.
- `event::pointer::map_wheel(position, dx, dy, dz, mode, mods,
timestamp: Instant) -> WheelEvent` — flips W3C deltaY sign so
widget code reads Jian-internal positive-up. Phase C1
intentionally takes `timestamp` as a parameter rather than
calling `Instant::now()` internally; `std::time::Instant::now()`
panics on wasm32-unknown-unknown ("time not implemented on this
platform") and the C2 listener will fill the timestamp from a
polyfill (web_time::Instant). Made the mapper pure to keep the
panic locus in the listener glue, where the polyfill lives.
- `event::focus::map_focus(gained, node_id_hint,
related_node_id_hint) -> FocusEvent` — pure pass-through; the
W3C target → WidgetId correlation work lives in C2 alongside
the DOM mirror id registry (Phase D groundwork).
Tests (`tests/dom_event_mapping.rs`, 22 tests, all native):
- keyboard: 5 tests + 1 empty-string-key fallback test (codex C1
NIT-3) — key/code/location preservation, named key, location
decoding, is_composing propagation, multi-codepoint &
empty-string Unidentified fallback
- ime: 8 tests — start/update/end shapes, UTF-16→UTF-8 remap for
CJK / surrogate pair / mixed encoding / zero-length / no-selection
/ mis-ordered range / out-of-range clamp / empty text
- wheel: 4 tests — Y sign flip, X no-flip, mode decoding, deltaZ
passthrough
- focus: 2 tests — gained=true with both hints, blur with no
related target
Plumbing:
- shell-web grows a direct path-with-version `jian-core` dep.
shell-core re-exports `gesture::*` but not `geometry::*`, and
the wheel mapper builds `WheelEvent.position` from
`jian_core::geometry::Point::new(...)`. Same path-with-version
pattern as shell-core's own jian-core dep.
- `pub mod event;` is NOT cfg-gated to skia — the mappers are pure
and useful on the wasm32-clean stub baseline too.
Plan-vs-implementation deviations (deliberate, all kept narrow):
- `map_keyboard_parts` adds `is_composing: bool` parameter (jian-core
KeyEvent struct REQUIRES the field per spec §2.4).
- `map_focus` adds `related_node_id_hint: Option<u64>` parameter
(jian-core FocusEvent struct field; plan body missed it).
- `map_wheel` takes `timestamp: Instant` parameter instead of
calling `Instant::now()` internally (avoids wasm32-unknown-unknown
runtime panic; pure mapper).
- `event/pointer.rs` covers ONLY wheel; full PointerEvent mapping
(kind / phase / buttons / pressure) lives in C2 alongside listener
registration since that's where the W3C PointerEvent surface meets
the runtime context.
Verification:
- `cargo test -p openpencil-shell-web --test dom_event_mapping` —
22/22 passing
- `cargo check -p openpencil-shell-web --target
wasm32-unknown-unknown --no-default-features --features web` —
green (compile guard)
- `EMSDK=$HOME/.emsdk bash tools/check-wasm-bundle.sh` — PASS
- 0 env.* imports
- 615 616 bytes gzip = 58% of 1 MiB ceiling (no growth — event
modules dead-code-eliminated when not called)
- `bash tools/check-widget-boundary.sh` — PASS (event/ doesn't
violate F1-F4)
Codex iterate review: 1 round → GO with 1 deferred CONCERN
(Instant source for C2 — already documented inline) + 3 NITs
(deltaX comment wording, additional KeyCode entries, extra
edge-case tests). NIT-1 and NIT-3 fixed in this commit; NIT-2
deferred to C2.
Adds the widget facade that B2 inspector widgets and Phase C event
handling will plug into. Logic-bearing widget code lives in
shell-core (per spec §1.4); shell-native + shell-web only own their
RenderBackend impls + DOM event mapping + accesskit DOM mirror.
What's added:
- `widgets::Widget` trait with `id` / `layout` / `paint(&self,...)` /
`access_node` methods. Phase B widgets are static — `paint` is
`&self`, mutable per-widget state lives in `*State` structs that
B2 lands. Phase C will extend the trait with a `&mut self` event
method for input handling.
- `widgets::WidgetId(pub u64)` plus a `pub const ROOT_WIDGET_ID =
WidgetId(0)` and a `WidgetId::new(id)` constructor with
`debug_assert!(id != 0)`. The tuple constructor stays public so
pattern matching + `const` contexts keep working; `::new` is the
conventional path that surfaces the root-id reservation in debug
builds. (Codex B1 R1 NIT-7 — make the convention compiler-visible
before Phase C tree routing lands.)
- `widgets::PaintCx<'a> { backend: &'a mut dyn RenderBackend }` and
`widgets::LayoutCx { available_width, dpi }` — frame-scoped paint
context + layout-time context. The `&mut dyn` indirection lets
shell-native + shell-web reuse the widget code without
monomorphising over the concrete backend.
- `widgets::LayoutBox { rect: Rect }` with `Debug + Clone + Copy +
PartialEq` derives.
- A `rect(x, y, w, h)` constructor convenience used by tests + B2.
Test harness (`tests/widgets_static.rs`):
- `RecordingBackend` impl `RenderBackend` counting each call.
- `paint_cx_dispatches_through_dyn_backend` — verifies fill_rect /
stroke_rect / save / translate / clip_rect / restore all dispatch
via `&mut dyn RenderBackend`.
- `widget_trait_dispatches_layout_and_paint` — minimal `StubWidget`
proves the trait shape compiles; asserts layout result, paint
dispatch count, `WidgetId::new(7)` round-trip, `ROOT_WIDGET_ID.0
== 0`, and `access_node().role() == Role::GenericContainer`. Real
semantic roles (TreeItem / EditableText / etc) land with B2.
Plumbing:
- `accesskit = "0.24"` added to shell-core deps to match shell-web's
pin (the version compatible with shell-native's accesskit_winit
Step 1a usage). Codex B1 R1 Q3 flagged that shell-native does not
yet pull accesskit; this is acknowledged as a Phase C tracked item
— verify the same version when DOM mirror / native a11y wires up.
- `Rect` now derives `PartialEq` so `LayoutBox` can use the same
derive. `Eq` is intentionally NOT derived (Vec2 carries floats);
comment in render_backend.rs explains.
Plan-vs-implementation deviations (deliberate, all kept narrow):
- Plan B1 step 2 declares `pub mod {dropdown, prop_row, text_input,
tree};` + re-exports inside widgets/mod.rs. Omitted here because
those modules don't exist until B2; declaring them now would
break the B1 standalone build. Top-block plan mini-patch
convention applies (override sketches in body).
- Plan didn't enumerate the accesskit dep + `Rect: PartialEq`
deltas — added with rationale comments.
Verification:
- `cargo test -p openpencil-shell-core` — green
- `cargo check -p openpencil-shell-core --target
wasm32-unknown-unknown` — green (shell-core stays wasm32-clean
per spec §1.2)
- `cargo check -p openpencil-shell-native` — green (no regression)
Codex iterate review: 4 rounds → GO. Round 1 CONCERN (3 items),
Round 2 CONCERN (1 stale comment), Round 3 CONCERN (comment vs
test body mismatch), Round 4 GO clean. Q3 (accesskit_winit
alignment) carries to Phase C as informational.
Wires the workspace at vendor/skia-safe-op (committed in the previous
commit) via [patch.crates-io] so every consumer of skia-safe /
skia-bindings — both the wasm32-unknown-unknown shell-web bundle and
the macOS / Linux / Windows shell-native desktop binary — resolves
through the fork on every target.
[patch.crates-io] is workspace-global, NOT target-scoped; cargo does
not natively support per-target patches, so this is the accepted
blast radius. The fork is byte-identical to upstream rust-skia 0.97.0
except for the new `wasm_unknown` platform module + its single new
dispatch arm; native builds resolve to the same upstream platform
modules they did before. Verified `cargo check -p
openpencil-shell-native` builds through the fork unchanged.
Trade-off: upstream rust-skia patches no longer flow until we
re-vendor; Cargo.lock records `path` sources for skia-bindings /
skia-safe rather than `registry+...`. The full rationale block is
inline in Cargo.toml.
The Cargo.lock delta also pins js-sys 0.3.97 → 0.3.94 / web-sys
0.3.97 → 0.3.94 — this is the transitive consequence of pinning
wasm-bindgen = "=0.2.117" on shell-web (last 0.2.x release that
compiles on the workspace's Rust 1.85 toolchain; 0.2.120+ requires
1.86). Documented in shell-web/Cargo.toml.
Step 1b §3.2 P0.5B Run path, sub-phase C-hard.1.
Why: "Design a profile card" through MiniMax-M2.7 produced a 375×803 mobile
screen with auto-injected status bar, because the planner skill listed
"profiles" as a Type 2 single-task screen and the orchestrator's
isMobileScreen heuristic ran on width≤480 alone.
What: design-type.md + decomposition.md add Type 0 (single component:
card / badge / chip / modal) with width=400 height=0 1 subtask no chrome.
isMobileFullScreen helper extracted to orchestrator-plan-classify.ts and
required by both orchestrator.ts and orchestrator-sub-agent.ts so the
two paths can't drift on what "mobile" means (Codex review caught this
when only orchestrator.ts had the new check).
Verified with same MiniMax + same prompt: 400×320 component, 8 nodes,
firstChildRole=card, no status-bar.
Wires the workspace at vendor/skia-safe-op (committed in the previous
commit) via [patch.crates-io] so every consumer of skia-safe /
skia-bindings — both the wasm32-unknown-unknown shell-web bundle and
the macOS / Linux / Windows shell-native desktop binary — resolves
through the fork on every target.
[patch.crates-io] is workspace-global, NOT target-scoped; cargo does
not natively support per-target patches, so this is the accepted
blast radius. The fork is byte-identical to upstream rust-skia 0.97.0
except for the new `wasm_unknown` platform module + its single new
dispatch arm; native builds resolve to the same upstream platform
modules they did before. Verified `cargo check -p
openpencil-shell-native` builds through the fork unchanged.
Trade-off: upstream rust-skia patches no longer flow until we
re-vendor; Cargo.lock records `path` sources for skia-bindings /
skia-safe rather than `registry+...`. The full rationale block is
inline in Cargo.toml.
The Cargo.lock delta also pins js-sys 0.3.97 → 0.3.94 / web-sys
0.3.97 → 0.3.94 — this is the transitive consequence of pinning
wasm-bindgen = "=0.2.117" on shell-web (last 0.2.x release that
compiles on the workspace's Rust 1.85 toolchain; 0.2.120+ requires
1.86). Documented in shell-web/Cargo.toml.
Step 1b §3.2 P0.5B Run path, sub-phase C-hard.1.
Picks up the keyboard/IME/focus event additions + W3C wheel deltaMode
landed in jian commit d5d358e. shell-core re-exports of the new types
land in the next commit; this commit only moves the pointer + Cargo.lock.
cargo test -p openpencil-shell-core --test gesture_re_export → 6/6 PASS
against the pinned submodule.
Anchor v19 pivot at the workspace level: vendor Jian as a git submodule
pinned to fork commit ad13ce6 (P0.5 mini-gate GO; skia-safe 0.78 → 0.97 +
new pub draw_on_canvas adapter), wire jian-core / jian-skia / jian-host-desktop
as path deps with explicit version per spec §12.2, and re-export the
Jian render/geometry/scene types from shell-core so shell-native can
translate the OP RenderBackend facade into jian DrawOp commands.
shell-core stays wasm32-clean: only jian-core (already wasm32-validated
in P0.5) plus glam / bitflags / thiserror / tracing land here.
shell-native picks up the full P0-pinned GL stack (skia-safe 0.97.0,
glutin 0.32.3, glutin-winit 0.5.0, glow 0.17.0, winit 0.30.13,
raw-window-handle 0.6.2, scopeguard 1.2) plus jian-skia (textlayout)
and target-gated jian-host-desktop (default-features = false, no `run`
feature so we skip Jian's softbuffer raster present path — OP owns its
own GPU swap_buffers per spec §3.6).
Adds OP RenderBackend trait + Rect / Color (with RED/GREEN/BLUE/BLACK/
WHITE/TRANSPARENT named constants per spec §5.2) + TextLayout facade
that wraps jian_core::render::TextRun explicitly (TextRun has no Default
impl, fields enumerated to honour spec §5.2 round-2 CONCERN-1 fix).
Boundary checks all pass:
- wasm32 shell-web metadata: no jian-host-desktop / jian-skia
- aarch64-linux-android shell-native metadata: no jian-host-desktop
- shell-core src: no glutin / skia_safe / winit / glow imports
Tasks 2-4 (SharedSkiaContext + NativeBackend + ShellEvent mapping +
acceptance) follow per plan v7.
P0 dep-stack probe (Step 1a) cleared all three OS targets in CI
run 25358457742:
- macOS aarch64: full window+GL probe (cross-API state + readback) PASS
- Linux x86_64 (hosted runner): link-time PASS, runtime DEFERRED
(LINUX_GPU_DEFERRED_NO_RUNNER) — Xvfb GLX limitation; same skip as
bevy / rust-skia / iced CI.
- Windows x86_64 (hosted runner): link-time PASS, runtime DEFERRED
(WINDOWS_GPU_DEFERRED_NO_RUNNER per spec §8.2).
Pin versions captured in
`openpencil-docs/superpowers/notes/2026-05-05-skia-glow-loader-compat-probe.md`.
Reverts:
- transient `[dev-dependencies]` block in shell-native Cargo.toml
(skia-safe / glutin / glutin-winit / glow / raw-window-handle /
scopeguard / dev-only winit override).
- transient `tests/p0_probe.rs` + `examples/p0_probe.rs`.
- transient workflow steps that gated `--ignored P0_PROBE_GATE` and the
Xvfb / freetype / mesa apt installs that only the probe needed.
Kept:
- prod winit dep features `["x11", "wayland", "wayland-csd-adwaita",
"rwh_06"]` — needed for Linux to satisfy winit's
`compile_error!("...not supported by winit")` guard. Stage F may
trim this when RenderBackend lands.
- workflow's libxkbcommon / libwayland apt install — winit's link-time
deps for the features above.
- `.gitattributes` — enforces `eol=lf` so future cross-OS rustfmt stays
green.
Task 1 will reintroduce skia-safe / glutin / glow / raw-window-handle
/ scopeguard as permanent prod deps when SharedSkiaContext +
RenderBackend land.
Drives the three-OS CI matrix verification of the skia-safe + glutin +
glow + winit dep stack per Step 1a spec §7.
- examples/p0_probe.rs: stencil_visibility + readback chain runner (must
own a real OS main thread because winit on macOS rejects
EventLoop::new() from cargo test worker threads).
- tests/p0_probe.rs: subprocess-invoke wrapper, gated
#[ignore = "P0_PROBE_GATE"] so default cargo test stays untouched.
- Cargo.toml: add transient [target.'cfg(not(target_arch = "wasm32"))'.
dev-dependencies] block (skia-safe 0.97 + glutin 0.32.3 + glutin-winit
0.5.0 + glow 0.17.0 + raw-window-handle 0.6.2 + scopeguard 1.2.0 +
winit defaults). Pinned to versions resolved in /tmp/skia-glow-probe.
- .github/workflows/rust-check.yml: install Linux GL prereqs (xvfb,
mesa, libxkbcommon, libwayland) and add a P0-probe-gate step running
cargo test --ignored on each OS (Linux through xvfb-run; Windows
early-returns per spec §8.2 WINDOWS_GPU_DEFERRED_NO_RUNNER).
All three artefacts are TRANSIENT — reverted in a follow-up cleanup
commit after CI is green and the loader-compat notes commit lands.
Task 1 owns the permanent integration.
Anchor v19 pivot at the workspace level: vendor Jian as a git submodule
pinned to fork commit ad13ce6 (P0.5 mini-gate GO; skia-safe 0.78 → 0.97 +
new pub draw_on_canvas adapter), wire jian-core / jian-skia / jian-host-desktop
as path deps with explicit version per spec §12.2, and re-export the
Jian render/geometry/scene types from shell-core so shell-native can
translate the OP RenderBackend facade into jian DrawOp commands.
shell-core stays wasm32-clean: only jian-core (already wasm32-validated
in P0.5) plus glam / bitflags / thiserror / tracing land here.
shell-native picks up the full P0-pinned GL stack (skia-safe 0.97.0,
glutin 0.32.3, glutin-winit 0.5.0, glow 0.17.0, winit 0.30.13,
raw-window-handle 0.6.2, scopeguard 1.2) plus jian-skia (textlayout)
and target-gated jian-host-desktop (default-features = false, no `run`
feature so we skip Jian's softbuffer raster present path — OP owns its
own GPU swap_buffers per spec §3.6).
Adds OP RenderBackend trait + Rect / Color (with RED/GREEN/BLUE/BLACK/
WHITE/TRANSPARENT named constants per spec §5.2) + TextLayout facade
that wraps jian_core::render::TextRun explicitly (TextRun has no Default
impl, fields enumerated to honour spec §5.2 round-2 CONCERN-1 fix).
Boundary checks all pass:
- wasm32 shell-web metadata: no jian-host-desktop / jian-skia
- aarch64-linux-android shell-native metadata: no jian-host-desktop
- shell-core src: no glutin / skia_safe / winit / glow imports
Tasks 2-4 (SharedSkiaContext + NativeBackend + ShellEvent mapping +
acceptance) follow per plan v7.
P0 dep-stack probe (Step 1a) cleared all three OS targets in CI
run 25358457742:
- macOS aarch64: full window+GL probe (cross-API state + readback) PASS
- Linux x86_64 (hosted runner): link-time PASS, runtime DEFERRED
(LINUX_GPU_DEFERRED_NO_RUNNER) — Xvfb GLX limitation; same skip as
bevy / rust-skia / iced CI.
- Windows x86_64 (hosted runner): link-time PASS, runtime DEFERRED
(WINDOWS_GPU_DEFERRED_NO_RUNNER per spec §8.2).
Pin versions captured in
`openpencil-docs/superpowers/notes/2026-05-05-skia-glow-loader-compat-probe.md`.
Reverts:
- transient `[dev-dependencies]` block in shell-native Cargo.toml
(skia-safe / glutin / glutin-winit / glow / raw-window-handle /
scopeguard / dev-only winit override).
- transient `tests/p0_probe.rs` + `examples/p0_probe.rs`.
- transient workflow steps that gated `--ignored P0_PROBE_GATE` and the
Xvfb / freetype / mesa apt installs that only the probe needed.
Kept:
- prod winit dep features `["x11", "wayland", "wayland-csd-adwaita",
"rwh_06"]` — needed for Linux to satisfy winit's
`compile_error!("...not supported by winit")` guard. Stage F may
trim this when RenderBackend lands.
- workflow's libxkbcommon / libwayland apt install — winit's link-time
deps for the features above.
- `.gitattributes` — enforces `eol=lf` so future cross-OS rustfmt stays
green.
Task 1 will reintroduce skia-safe / glutin / glow / raw-window-handle
/ scopeguard as permanent prod deps when SharedSkiaContext +
RenderBackend land.
Drives the three-OS CI matrix verification of the skia-safe + glutin +
glow + winit dep stack per Step 1a spec §7.
- examples/p0_probe.rs: stencil_visibility + readback chain runner (must
own a real OS main thread because winit on macOS rejects
EventLoop::new() from cargo test worker threads).
- tests/p0_probe.rs: subprocess-invoke wrapper, gated
#[ignore = "P0_PROBE_GATE"] so default cargo test stays untouched.
- Cargo.toml: add transient [target.'cfg(not(target_arch = "wasm32"))'.
dev-dependencies] block (skia-safe 0.97 + glutin 0.32.3 + glutin-winit
0.5.0 + glow 0.17.0 + raw-window-handle 0.6.2 + scopeguard 1.2.0 +
winit defaults). Pinned to versions resolved in /tmp/skia-glow-probe.
- .github/workflows/rust-check.yml: install Linux GL prereqs (xvfb,
mesa, libxkbcommon, libwayland) and add a P0-probe-gate step running
cargo test --ignored on each OS (Linux through xvfb-run; Windows
early-returns per spec §8.2 WINDOWS_GPU_DEFERRED_NO_RUNNER).
All three artefacts are TRANSIENT — reverted in a follow-up cleanup
commit after CI is green and the loader-compat notes commit lands.
Task 1 owns the permanent integration.
Kayshen-X