Doop：把 AI Agent 放进实时设计画布

153export function buildMcpServer(owner?: string, ownerId?: string): McpServer {
154  const actorFrom = (agent_name?: string) => actions.resolveActor({ name: agent_name, kind: 'agent', owner })
155  /* Canvas access for agents mirrors the web UI: the OAuth user's id runs
156     through the same canAccessCanvas gate as browser sessions. Every tool
157     that takes a canvas or frame id resolves it through these. */
158  const canvasFor = (canvasId: string) => {
159    const c = store.getCanvas(canvasId)
160    return c && canAccessCanvas(ownerId, c) ? c : undefined
161  }
162  const frameFor = (frameId: string) => {
163    const f = store.getFrame(frameId)
164    if (!f) return undefined
165    return canvasFor(f.canvasId) ? f : undefined
166  }
167  const noCanvas = (id: string) => err(`no canvas with id ${id} accessible to this account`)
168  const noFrame = (id: string) => err(`no frame with id ${id} accessible to this account`)
169  /* Reads count as arrival: presence (and with it every "your agent is
170     connected" confirmation in the UI) must appear on an agent's FIRST
171     canvas-scoped call, not only once it mutates something. */
172  const arrive = (canvasId: string, agent_name?: string) => {
173    if (agent_name) actions.heartbeatAgent(canvasId, actorFrom(agent_name))
174  }
175  const server = new McpServer({ name: 'doop-canvas', version: '0.1.0' }, { instructions: INSTRUCTIONS })

205/** Agent announces what it is working on right now (empty string clears it). */
206export function setAgentStatus(canvasId: string, actor: Actor, status: string) {
207  const clean = status.trim()
208  agentTouch(canvasId, actor.name, undefined, clean || null, actor.owner)
209
210  const list = taskLog.get(canvasId) ?? []
211  /* board cards stay open until explicitly completed — a status change
212     narrates work ON a card, it doesn't end it */
213  const open = list.find((t) => sameAgent(t, actor) && !t.endedAt && !t.queuedBy)
214  if (open?.status === clean) return // same status re-posted: nothing new
215  if (open) {
216    open.endedAt = Date.now()
217    persist.saveTask(canvasId, open)
218    broadcast(canvasId, { type: 'task', task: open })
219  }
220  if (clean) {
221    const task: AgentTask = {
222      id: nanoid(8),
223      agentName: actor.name,
224      owner: actor.owner,
225      color: actor.color,
226      status: clean,
227      startedAt: Date.now(),
228    }
229    list.unshift(task)
230    if (list.length > 100) list.length = 100
231    taskLog.set(canvasId, list)
232    persist.saveTask(canvasId, task)
233    broadcast(canvasId, { type: 'task', task })
234    logActivity(canvasId, actor, `is working on: ${clean}`)
235  }

69/** Work every agent that has something waiting, one at a time. Re-checking the
70 *  queue between runs is what carries a card into its next pipeline stage. */
71async function sweep(canvasId: string) {
72  running.add(canvasId)
73  try {
74    for (let i = 0; i < MAX_SWEEP_RUNS; i++) {
75      const next = actions.pendingWorkAgents(canvasId)[0]
76      if (!next) break
77      await runAgent(canvasId, next)
78    }
79  } finally {
80    running.delete(canvasId)
81    if (queued.delete(canvasId)) onFeedback(canvasId)
82  }
83}

126  it('rejects unauthenticated API and MCP calls', async () => {
127    expect((await fetch(`${BASE}/api/canvases`)).status).toBe(401)
128    const mcp = await fetch(`${BASE}/mcp`, { method: 'POST', body: '{}' })
129    expect(mcp.status).toBe(401)
130    expect(mcp.headers.get('www-authenticate')).toContain('oauth-protected-resource')
131  })
132
133  it('signs up three accounts and creates a canvas with a frame', async () => {
134    await owner.signUp('owner@test.dev', 'Owner')
135    await invited.signUp('invited@test.dev', 'Invited')
136    await stranger.signUp('stranger@test.dev', 'Stranger')
137    invitedId = (await (await invited.get('/api/me')).json()).id
138
139    const canvas = await (await owner.post('/api/canvases', { name: 'ACL' })).json()
140    canvasId = canvas.id
141    const frame = await (await owner.post(`/api/canvases/${canvasId}/frames`, { name: 'F1' })).json()
142    frameId = frame.id
143  })
144
145  it('is private by default: non-owners are blocked everywhere', async () => {
146    expect((await stranger.get(`/api/canvases/${canvasId}`)).status).toBe(403)
147    expect((await stranger.post(`/api/canvases/${canvasId}/frames`, { name: 'x' })).status).toBe(403)
148    expect((await stranger.patch(`/api/frames/${frameId}`, { name: 'hacked' })).status).toBe(403)
149    expect((await stranger.delete(`/api/frames/${frameId}`)).status).toBe(403)
150    expect((await stranger.patch(`/api/canvases/${canvasId}`, { name: 'renamed' })).status).toBe(403)
151    expect(await stranger.joinWs(canvasId)).toEqual({ kind: 'closed', code: 4403 })