feat(desktop): add channel-first project Canvas POC

crates/buzz-acp/src/base_prompt.md

@@ -15,7 +15,7 @@ The `buzz` CLI is your primary interface. Auth env vars: `BUZZ_RELAY_URL`, `BUZZ
 | `buzz agents` | `draft-create`, `draft-update` |
 | `buzz messages` | `send`, `get`, `thread`, `search` |
 | `buzz channels` | `list`, `get`, `create`, `join`, `members` |
-| `buzz canvas` | `get`, `set` |
+| `buzz canvas` | `get`, `set`, `notify` |
 | `buzz reactions` | `add`, `remove` |
 | `buzz dms` | `list`, `open` |
 | `buzz users` | `get`, `set-profile`, `presence` |
@@ -41,10 +41,28 @@ A project is a named grouping (`kind:30621`) with a home channel. Creating a sec
 - To add tasks: `buzz issues create --channel <current-channel-uuid> --subject "…" --content "…"`. That uses this project's repository and creates one bound to the channel if none exists. `--repo-owner` / `--repo-id` remain valid once a repository exists. Session todos and markdown plans do not appear on the project.
 - To add another channel to this project: `buzz projects add-channel --home-channel <current-channel-uuid> --name "…" [--template "…"]`. This opens an owner-reviewed request in Buzz Desktop and uses the project-aware channel primitive after approval. Do **not** use `buzz channels create` for a channel that should belong to the current project, and do not claim the channel exists until the owner approves it.
 
+## Projects
+
+A project is a named grouping (`kind:30621`) with a home channel. Creating a second project with the same name produces a duplicate card in Buzz Desktop — never do that for work that already has a project.
+
+- If you are in a project's home channel, or a project with that name/slug already exists, do **not** run `buzz projects create`. `<context>` includes a Project block when this channel is a project home — tasks, repositories, and files you create belong to that project.
+- To add a codebase: `buzz repos create --id <id> --name "…" --channel <current-channel-uuid>`. `mkdir` in `REPOS/` is not a Buzz repository.
+- To add tasks: `buzz issues create --channel <current-channel-uuid> --subject "…" --content "…"`. That uses this project's repository and creates one bound to the channel if none exists. `--repo-owner` / `--repo-id` remain valid once a repository exists. Session todos and markdown plans do not appear on the project.
+- To add another channel to this project: `buzz projects add-channel --home-channel <current-channel-uuid> --name "…" [--template "…"]`. This opens an owner-reviewed request in Buzz Desktop and uses the project-aware channel primitive after approval. Do **not** use `buzz channels create` for a channel that should belong to the current project, and do not claim the channel exists until the owner approves it.
+
 `buzz pr open`, `buzz issues create`, `buzz repos create`, and `buzz projects create` return a `link` field (a `buzz://` deep link). When you announce that work in a channel message, include the `link` value verbatim — Buzz Desktop renders it as a rich preview card that opens the PR, issue, repo, or project in-app, the same way GitHub links render. Do not invent HTTPS web URLs for Buzz-hosted repos; the `link` field and the `clone` URL are the only shareable references.
 
 To assign an issue to someone, run `buzz issues assign --issue <event-id> --repo-owner <hex> --repo-id <id> --assignee <hex> --label <name>` after creating it. Remove an assignment with the matching `buzz issues unassign` arguments. Writing assignee names in the issue body or adding recipients with `issues create --to` is notification/presentation only — Buzz Desktop's Assignees rail and the "Assigned to me" filter read the signed assignment operations. Only operations signed by the issue author or repo owner are trusted for other people; anyone may assign or unassign themselves.
 
+## Project Canvas Packages
+
+Project widget Canvases are local packages, distinct from relay-backed channel Canvas markdown. When asked to update one, read the active nest's `CANVASES/index.json`, match the exact community and canonical `30621:<owner>:<dtag>` project coordinate, and edit only that entry's `sourcePath`. Never edit `index.json` or anything under `.runtime/`.
+
+- Widget values live in `data/*.json`; dashboard and widget placement is declared there too, but counts as a presentation change when notifying Buzz. Presentation code lives in `widgets/*.js`, `canvas.js`, and `styles/*.css`. Assets stay in `assets/`. Declare added files in `manifest.json`, keep `canvas.js` last, and do not add `index.html`, dependencies, builds, or network access.
+- After changing only one widget's data, run `buzz canvas notify --source <sourcePath> --widget <widget-id> --change data`. Buzz passes the new data to the live widget without replacing its iframe; object renderers may implement `update(currentElement, nextData, previousData, api)` to animate, while function renderers remount that widget's content.
+- After changing JavaScript, CSS, layout, assets, the manifest, or other presentation behavior, run `buzz canvas notify --source <sourcePath> --widget <widget-id> --change presentation`. Buzz validates the full package and swaps in a fresh sandboxed iframe only after it renders; the manual Reload Canvas button remains available.
+- Project channel and review snapshots are authoritative. Change those values through Buzz rather than editing their bundled fixture rows. `canvas notify` is local-only, requires Buzz Desktop to be running, and does not create a relay event.
+
 ## Conversational Agent Creation
 
 When someone asks to create an agent, ask for at most two things: its name and what it should do day-to-day. Write the `--system-prompt` yourself. Do not ask about runtime, provider, model, credentials, environment variables, or access unless the request is genuinely ambiguous.

crates/buzz-acp/src/lib.rs

@@ -4529,6 +4529,15 @@ mod agent_draft_prompt_tests {
             .contains("add them explicitly with `buzz channels add-member` only when authorized"));
         assert!(prompt.contains("never changes membership automatically"));
     }
+
+    #[test]
+    fn shared_base_prompt_teaches_project_canvas_notifications() {
+        let prompt = include_str!("base_prompt.md");
+        assert!(prompt.contains("buzz canvas notify --source"));
+        assert!(prompt.contains("--change data"));
+        assert!(prompt.contains("--change presentation"));
+        assert!(prompt.contains("Never edit `index.json` or anything under `.runtime/`"));
+    }
 }
 
 fn default_heartbeat_prompt() -> String {

crates/buzz-cli/README.md

@@ -78,6 +78,8 @@ buzz messages vote --event <event-id> --direction up
 # Canvas
 buzz canvas get --channel <uuid>
 buzz canvas set --channel <uuid> --content "# Welcome"
+buzz canvas notify --source <project-canvas-dir> --widget <widget-id> --change data
+buzz canvas notify --source <project-canvas-dir> --widget <widget-id> --change presentation
 
 # Agent Memory (NIP-AE)
 buzz mem ls

crates/buzz-cli/TESTING.md

@@ -184,6 +184,11 @@ echo "# Canvas from stdin" | buzz canvas set --channel "$CHANNEL_ID" --content -
 # canvas get
 buzz canvas get --channel "$CHANNEL_ID"
 # Expected: raw markdown string, or: null
+
+# Local project Canvas notification (Buzz Desktop must be running)
+buzz canvas notify --source "$CANVAS_SOURCE" --widget chores --change data | jq .
+buzz canvas notify --source "$CANVAS_SOURCE" --widget chores --change presentation | jq .
+# Expected: accepted true; data preserves the iframe, presentation reloads it
 ```
 
 ### 6.3 Messages
@@ -587,41 +592,42 @@ buzz channels delete --channel "$FORUM_ID" | jq .
 | 22 | `channels remove-member` | ☐ | Needs admin:channels |
 | 23 | `canvas get` | ☐ | |
 | 24 | `canvas set` | ☐ | Direct and stdin |
-| 25 | `reactions add` | ☐ | |
-| 26 | `reactions remove` | ☐ | |
-| 27 | `reactions get` | ☐ | |
-| 28 | `dms list` | ☐ | |
-| 29 | `dms open` | ☐ | |
-| 30 | `dms add-member` | ☐ | Needs messages:write |
-| 31 | `users get` | ☐ | Self, single, batch |
-| 32 | `users set-profile` | ☐ | |
-| 33 | `users presence` | ☐ | |
-| 34 | `users set-presence` | ☐ | online, away, offline |
-| 35 | `workflows list` | ☐ | |
-| 36 | `workflows create` | ☐ | |
-| 37 | `workflows update` | ☐ | |
-| 38 | `workflows delete` | ☐ | |
-| 39 | `workflows trigger` | ☐ | |
-| 40 | `workflows runs` | ☐ | |
-| 41 | `workflows get` | ☐ | |
-| 42 | `workflows approve` | ☐ | Validation only (needs approval gate); bare = approve, `--approved false` = deny |
-| 43 | `feed get` | ☐ | |
-| 44 | `social publish` | ☐ | |
-| 45 | `social set-contacts` | ☐ | |
-| 46 | `social event` | ☐ | |
-| 47 | `social notes` | ☐ | |
-| 48 | `social contacts` | ☐ | |
-| 49 | `repos create` | ☐ | |
-| 50 | `repos get` | ☐ | |
-| 51 | `repos list` | ☐ | |
-| 52 | `repos protect list` | ☐ | Empty/populated rules; unknown rules visible; malformed rule reported in validation_error |
-| 53 | `repos protect set` | ☐ | Create and replace complete exact-ref rule; verify metadata is preserved |
-| 54 | `repos protect remove` | ☐ | Remove exact ref; missing rule → NotFound |
-| 55 | `upload file` | ☐ | |
-| 56 | `pack validate` | ☐ | Local, no relay |
-| 57 | `pack inspect` | ☐ | Local, no relay |
-| 58 | `notes set` | ☐ | First publish, edit/carry, --clear-tags, ambiguity, empty-stdin guard |
-| 59 | `notes get` | ☐ | By name, by naddr, --content-only, cross-author, ambiguous → exit 1 |
-| 60 | `notes ls` | ☐ | Own, --author all, --tag, --limit |
-| 61 | `notes rm` | ☐ | Delete→get 404, double-delete idempotent, missing slug → NotFound |
-| 62 | `users set-status` | ☐ | Text+emoji, text only, emoji-only (`--text ""`), `--clear`, `--clear` + `--text` → exit 1 |
+| 25 | `canvas notify` | ☐ | Data and presentation with Desktop running |
+| 26 | `reactions add` | ☐ | |
+| 27 | `reactions remove` | ☐ | |
+| 28 | `reactions get` | ☐ | |
+| 29 | `dms list` | ☐ | |
+| 30 | `dms open` | ☐ | |
+| 31 | `dms add-member` | ☐ | Needs messages:write |
+| 32 | `users get` | ☐ | Self, single, batch |
+| 33 | `users set-profile` | ☐ | |
+| 34 | `users presence` | ☐ | |
+| 35 | `users set-presence` | ☐ | online, away, offline |
+| 36 | `workflows list` | ☐ | |
+| 37 | `workflows create` | ☐ | |
+| 38 | `workflows update` | ☐ | |
+| 39 | `workflows delete` | ☐ | |
+| 40 | `workflows trigger` | ☐ | |
+| 41 | `workflows runs` | ☐ | |
+| 42 | `workflows get` | ☐ | |
+| 43 | `workflows approve` | ☐ | Validation only (needs approval gate); bare = approve, `--approved false` = deny |
+| 44 | `feed get` | ☐ | |
+| 45 | `social publish` | ☐ | |
+| 46 | `social set-contacts` | ☐ | |
+| 47 | `social event` | ☐ | |
+| 48 | `social notes` | ☐ | |
+| 49 | `social contacts` | ☐ | |
+| 50 | `repos create` | ☐ | |
+| 51 | `repos get` | ☐ | |
+| 52 | `repos list` | ☐ | |
+| 53 | `repos protect list` | ☐ | Empty/populated rules; unknown rules visible; malformed rule reported in validation_error |
+| 54 | `repos protect set` | ☐ | Create and replace complete exact-ref rule; verify metadata is preserved |
+| 55 | `repos protect remove` | ☐ | Remove exact ref; missing rule → NotFound |
+| 56 | `upload file` | ☐ | |
+| 57 | `pack validate` | ☐ | Local, no relay |
+| 58 | `pack inspect` | ☐ | Local, no relay |
+| 59 | `notes set` | ☐ | First publish, edit/carry, --clear-tags, ambiguity, empty-stdin guard |
+| 60 | `notes get` | ☐ | By name, by naddr, --content-only, cross-author, ambiguous → exit 1 |
+| 61 | `notes ls` | ☐ | Own, --author all, --tag, --limit |
+| 62 | `notes rm` | ☐ | Delete→get 404, double-delete idempotent, missing slug → NotFound |
+| 63 | `users set-status` | ☐ | Text+emoji, text only, emoji-only (`--text ""`), `--clear`, `--clear` + `--text` → exit 1 |

crates/buzz-cli/src/commands/channels.rs

@@ -1580,6 +1580,9 @@ pub async fn dispatch_canvas(cmd: crate::CanvasCmd, client: &BuzzClient) -> Resu
     match cmd {
         CanvasCmd::Get { channel } => cmd_get_canvas(client, &channel).await,
         CanvasCmd::Set { channel, content } => cmd_set_canvas(client, &channel, &content).await,
+        CanvasCmd::Notify { .. } => {
+            unreachable!("local Canvas notifications are handled before relay setup")
+        }
     }
 }
 

crates/buzz-cli/src/commands/mod.rs

@@ -12,6 +12,7 @@ pub mod notes;
 pub mod pack;
 pub mod patches;
 pub mod pr;
+pub mod project_canvas;
 pub mod project_channel;
 pub mod projects;
 pub mod reactions;