Merge main

Author: Jing-yilin

CONTRIBUTING.md

@@ -157,4 +157,7 @@ through private vulnerability reporting; see `SECURITY.md`.
 ## License
 
 By contributing you agree that your contribution is licensed under the
-Apache License 2.0, the same as the rest of the repository.
+Apache License 2.0, the same as the rest of the repository, and you grant
+ReScience Lab Inc. a perpetual, worldwide, royalty-free, irrevocable license to
+use, modify, sublicense and relicense it under any terms, including in its
+commercial editions. You confirm the contribution is yours to give.

LICENSE

@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 ReScience Lab
+   Copyright 2026 ReScience Lab Inc.
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

README.md

@@ -263,12 +263,32 @@ version's section in `RELEASE-NOTES.md`, then merge: the tag
 The whole procedure, including what to do when a step fails, is under "Cutting a
 release" in `CONTRIBUTING.md`.
 
+## Commercial edition
+
+This repo is the open-source edition, free to use. A commercial edition is
+packaged and supported for studios and teams, from ReScience Lab Inc.
+Pricing is by conversation: write to
+[yilin.jing@rescience.com](mailto:yilin.jing@rescience.com) with your team size
+and what you want to use it for.
+
 ## Licence
 
-This repo is Apache-2.0 (see `LICENSE`).
+This repo is Apache-2.0 (see `LICENSE`), © ReScience Lab Inc.
+
+**Third-party material is not.** The community projects in `canvases/` carry
+screenshots, logos, app-store images and other brand assets of the products
+they study. Those belong to their owners, are not licensed under Apache-2.0
+here, and are included only to research and demonstrate the method. ReScience
+Lab Inc. is not affiliated with or endorsed by any of those companies. None of
+this material ships in the desktop app, which has bundled only
+`canvases/templates` since 1.7.0, or in the commercial edition. The one
+third-party image that does ship is the iPhone shell in `canvases/templates`,
+from a Figma Community mockup and under that file's own terms. To have
+something taken down, write to
+[yilin.jing@rescience.com](mailto:yilin.jing@rescience.com).
 
 **The tldraw SDK it depends on is not.** tldraw ships under the
 [tldraw licence](https://github.com/tldraw/tldraw/blob/main/LICENSE.md): free
-to use with the tldraw watermark visible, paid business licence to remove it.
-Apache-2.0 here covers this repo's own code only. Anyone running the canvas
-is bound by tldraw's terms, and the watermark must stay.
+in development, but any production deployment, the hosted canvas included,
+needs a licence key from tldraw. Apache-2.0 here covers this repo's own code
+only. Anyone running the canvas is bound by tldraw's terms.

RELEASE-NOTES.md

@@ -19,6 +19,11 @@ The app, its skills and the toolkit carry one version.
 
 Everything below is on `main` and reaches no install until a version is cut.
 
+- **Only pictures go to the agent as pictures.** The **+** on a board, a
+  video or a note still shows a picture of it in the chat, but the agent is
+  handed the file behind it rather than that picture, since the file is what
+  it can read and change.
+
 ## v1.7.0
 
 2026-09-26. The community projects open in the app, and the app no longer

canvas/server/agent.ts

@@ -17,7 +17,7 @@ import path from "node:path";
 import { CANVASES } from "./boards.ts";
 import { command, stop } from "./command.ts";
 import { AGENT_SKILLS, installSkills } from "./skills.ts";
-import { folderOf, sameOrigin } from "./sp.ts";
+import { canvasFile, folderOf, sameOrigin } from "./sp.ts";
 import { SAFE_NAME } from "../src/layoutEdit.ts";
 import {
   attach,
@@ -45,12 +45,16 @@ export function createAgentServer(options: {
   examplesDir: string;
   /** Every project by the name its address carries, `/p/<name>/`. */
   projects: () => Map<string, string>;
+  /** Moves a project the agent has just named into a folder of that name (projects.ts). */
+  named: (dir: string) => string | undefined;
+  /** A project by name, or by the name it had before `named` moved it. */
+  project: (name: string) => string | undefined;
   /** This plugin's checkout, whose skills the sessions are given. */
   repoRoot: string;
   /** `<projects dir>/.workspaces`: a folder per session, a record beside each, and the skills. */
   workspaces: string;
 }) {
-  const { examplesDir, projects, repoRoot, workspaces } = options;
+  const { examplesDir, named, project: projectDir, projects, repoRoot, workspaces } = options;
   // One process per message — Claude Code or Codex, by the panel's choice, looked up in
   // agents.ts — its output kept here and streamed to the page. The runs are held in memory, the
   // newest twenty, for the panel to follow and for the history to say which session is running,
@@ -68,6 +72,8 @@ export function createAgentServer(options: {
       child: ChildProcess;
       /** The Stop button was pressed. Windows ends a run by exit code 1, which says nothing. */
       stopped: boolean;
+      /** The project it works on, if any. */
+      dir: string | undefined;
     }
   >();
 
@@ -310,6 +316,16 @@ export function createAgentServer(options: {
               !/^[A-Za-z0-9+/]*={0,2}$/.test(i.data)
             )
               return send(400, "bad image data");
+            if (
+              i.reference !== undefined &&
+              (typeof i.reference !== "object" ||
+                !["project", "community"].every(
+                  (k) =>
+                    i.reference[k] === undefined ||
+                    typeof i.reference[k] === "string",
+                ))
+            )
+              return send(400, "bad image reference");
           }
           // The body cap above is the panel's limit in base64; a client that is not the
           // panel meets the limit itself here, in the bytes the files come out as.
@@ -358,7 +374,7 @@ export function createAgentServer(options: {
           // The project it was sent from, by the name its address carries. None from the home page
           // or an example, and then the agent has no project to write to.
           const dir =
-            project === undefined ? undefined : projects().get(project);
+            project === undefined ? undefined : projectDir(project);
           if (project !== undefined && dir === undefined)
             return send(404, "no such project");
           // The session the panel is in, or a new one. Its id names a folder and a file, so it has
@@ -494,15 +510,44 @@ export function createAgentServer(options: {
           fs.mkdirSync(keptOf(id), { recursive: true });
           const imagesDir = images.length ? keptOf(id) : "";
           const held: AgentImage[] = images.map(
-            (i: { n: number; name: string; type: string; data: string }) => ({
-              ...i,
-              path: picture(
-                id,
-                `image-${i.n}`,
-                i.type,
-                Buffer.from(i.data, "base64"),
-              ),
-            }),
+            (i: {
+              n: number;
+              name: string;
+              type: string;
+              data: string;
+              reference?: { project?: string; community?: string };
+            }) => {
+              // Anything but a picture (a board, a video, a note) keeps its picture for the
+              // panel, and the agent is pointed at its file, in the canvases of the project it
+              // was attached from, which need not be the one it is sent from. A community
+              // project's is not on this machine, so it keeps the name `sp fetch` finds it by.
+              const ref = i.reference;
+              const from = ref?.project && projects().get(ref.project);
+              const file =
+                ref?.community === undefined &&
+                (ref?.project === undefined || from)
+                  ? canvasFile(
+                      from ? path.join(from, CANVASES) : examplesDir,
+                      examplesDir,
+                      i.name,
+                    )
+                  : undefined;
+              return {
+                ...i,
+                path: picture(
+                  id,
+                  `image-${i.n}`,
+                  i.type,
+                  Buffer.from(i.data, "base64"),
+                ),
+                reference:
+                  ref &&
+                  (file ??
+                    (ref.community
+                      ? `${i.name} of the community project ${ref.community}`
+                      : i.name)),
+              };
+            },
           );
           const c = command(
             def.bin,
@@ -523,11 +568,12 @@ export function createAgentServer(options: {
               // server's port.
               env: {
                 ...process.env,
-                SP_PROJECT: project,
+                SP_PROJECT: dir && path.basename(dir),
                 SP_CANVAS_PORT: String(req.socket.localPort),
               },
             }),
             stopped: false,
+            dir,
           });
           runs.set(run.id, run);
           record.runs.push(run.id);
@@ -637,6 +683,24 @@ export function createAgentServer(options: {
             finish(error.code === "ENOENT" ? def.missing : String(error));
           });
           run.child.on("close", (code, signal) => {
+            // The turn that named an unnamed project is over, so its folder can take the name.
+            // Not when another turn has already started on it: that one moves it when it ends.
+            if (
+              dir !== undefined &&
+              code === 0 &&
+              ![...runs.values()].some((r) => r !== run && r.dir === dir && !ended(r))
+            ) {
+              // Never in the way of the run ending: a throw here would leave it running for good.
+              try {
+                const moved = named(dir);
+                if (moved)
+                  record.projects = record.projects.map((had) =>
+                    had === dir ? moved : had,
+                  );
+              } catch (error) {
+                console.error(`[agent] ${dir} could not be named: ${error}`);
+              }
+            }
             settle();
             if (ended(run)) return;
             const tail = stderr.trim().split("\n").slice(-5).join("\n");

canvas/server/projects.test.ts

@@ -4,7 +4,7 @@ import type { AddressInfo } from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { expect, it } from "vitest";
-import { createProjectsServer, withoutFiles } from "./projects.ts";
+import { createProjectsServer, namedFolder, withoutFiles } from "./projects.ts";
 
 // One server for every project: `/` goes to the one opened, else home, each is at `/p/<name>/`, the
 // root has the examples and no project, and a page of the server's own can make one. The folder
@@ -202,6 +202,18 @@ it("serves every project at its own address and makes new ones", async () => {
       expect(
         JSON.parse((await ask("/__sp/projects", { name: "  " })).text).url,
       ).toBe(url);
+    expect(
+      JSON.parse(
+        fs.readFileSync(path.join(tmp, "projects/Untitled/project.json"), "utf8"),
+      ).unnamed,
+    ).toBe(true);
+    // Typed, "Untitled" is the person's name for it, so its folder is never renamed.
+    await ask("/__sp/projects", { name: "Untitled 9" });
+    expect(
+      JSON.parse(
+        fs.readFileSync(path.join(tmp, "projects/Untitled 9/project.json"), "utf8"),
+      ).unnamed,
+    ).toBeUndefined();
     write("projects/Untitled/project.json", JSON.stringify({ name: "Gamma" }));
     const titled = JSON.parse((await ask("/__sp/projects.json")).text);
     expect(titled.find((p: any) => p.name === "Untitled").title).toBe("Gamma");
@@ -248,3 +260,40 @@ it("keeps a community board it draws off file: addresses, after its doctype", ()
   );
   expect(withoutFiles("<p>")).toMatch(/^<meta [^>]+><p>$/);
 });
+
+// A project made without a name takes the one its agent writes, and only then.
+it("names an Untitled project's folder from its project.json", () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "sp-named-"));
+  const project = (folder: string, json: object) => {
+    fs.mkdirSync(path.join(tmp, folder));
+    fs.writeFileSync(
+      path.join(tmp, folder, "project.json"),
+      JSON.stringify({ unnamed: true, ...json }),
+    );
+    return path.join(tmp, folder);
+  };
+  expect(namedFolder(project("Untitled 10", { name: "Acme Inc. " }))).toBe(
+    path.join(tmp, "Acme Inc"),
+  );
+  expect(namedFolder(project("Untitled 3", { name: " Kasra " }))).toBe(
+    path.join(tmp, "Kasra"),
+  );
+  expect(namedFolder(project("Untitled", { format: 1 }))).toBeUndefined();
+  expect(namedFolder(project("Mine", { name: "Other" }))).toBeUndefined();
+  // An "Untitled" the person typed has no `unnamed`.
+  expect(
+    namedFolder(project("Untitled 11", { name: "Other", unnamed: undefined })),
+  ).toBeUndefined();
+  expect(namedFolder(project("Untitled 2", { name: "Mine" }))).toBeUndefined();
+  expect(namedFolder(project("Untitled 4", { name: "a/b" }))).toBeUndefined();
+  expect(
+    namedFolder(project("Untitled 5", { name: ".hidden" })),
+  ).toBeUndefined();
+  for (const [folder, name] of [
+    ["Untitled 6", "a\\b"],
+    ["Untitled 7", "a: b"],
+    ["Untitled 8", "CON"],
+    ["Untitled 9", 42],
+  ] as const)
+    expect(namedFolder(project(folder, { name }))).toBeUndefined();
+});