v0.3.13 · Verified Codex canvas and one-prompt setup

Codex OpenPencil v0.3.13 makes the desktop Canvas entry open a verified, editable canvas in Codex's built-in browser, and pins the dependency-remediated Rust runtime for new installations.

Open the canvas

Choose ＋ → OpenPencil Canvas → 在 Codex 中打开 (Open in Codex). The launcher sends one opening request to the current chat, Codex opens the existing canvas in its built-in browser, and the launcher confirms the native editor's ready receipt. The real desktop button-to-chat-to-browser chain has been verified. Hosts without text-message handoff provide 复制打开指令 (Copy opening instruction) to paste and send in the current chat. Failed or uncertain handoffs do not automatically launch an external browser or resend a message.

Install with one prompt

Give Codex this:

按照 https://github.com/ZSeven-W/codex-openpencil 的 INSTALL.md 帮我安装并配置 OpenPencil，打开可编辑画布，做一个单页手机任务管理 APP。

Or:

Install and set up https://github.com/ZSeven-W/codex-openpencil following its INSTALL.md, open an editable canvas, and create a single-page mobile task app.

Requires Node.js 22+, Git, and a recent local Codex client with plugin support. Setup downloads and verifies the matching Rust editor and web assets; no Rust compiler, API key, DSH, separate OpenPencil desktop app, or GitHub account is required.

Image generation is enabled by default and may consume Codex image-generation quota. Say “只搜图”, “不要生图”, or “use stock images only” to skip generation. Unavailable or failed generation falls back to stock search.

What changed since v0.3.9

• Replaced blocked local-frame navigation and the temporary default-browser launcher with the current-chat/in-app-browser handoff. Ready receipts distinguish a delivered message from a connected editor.
• Preserve the launching host's theme and existing canvas session. Unsupported messaging and clipboard denial have explicit fallbacks.
• Pin runtime-v0.8.5-d155cd0 with verified sizes and SHA-256 values for all six OS/CPU builds. Its dependency audit passes with reviewed, documented exceptions for an unchanged build-only Copilot SDK ZIP dependency.
• Keep runtime-only releases out of GitHub Latest so the plugin release is the normal download and release-information entry point.
• Update both READMEs with the tested desktop opening flow and retain the full Codex screenshot banner.

Selection-based chat editing, guarded saves/recovery, live slide previews, generated-image import, and the existing Code panel remain available. In the ordinary browser canvas, the Code panel provides baseline source; continue implementation in the current chat with “继续转代码”.

Validation

• All 87 plugin regression tests and six Node.js 22/24 package CI jobs passed.
• Fresh public installation passed on macOS, Windows and Linux, each on ARM64 and x64: empty plugin/runtime state, public Codex CLI 0.162.1, real native edit/save/independent reopen, installed-plugin and terminal smoke checks, and repeat setup. POSIX runners also tested a real PTY.
• Runtime dependency audit, production Web/WASM gate and all six native build/smoke jobs passed.
• The actual Codex desktop MCP Apps button delivered to the current chat; the in-app browser and originating launcher both showed “画布已连接”.

Fresh install CI · Package CI · Runtime build/audit · Validation record

Runner installation coverage does not establish bare-OS dependency provisioning or MCP Apps behavior in every host version. The current desktop handoff is verified; hosts with fewer capabilities use the documented copy fallback.

Update an existing installation

In your existing clone, run git pull --ff-only, then npm run setup. A new plugin connection may require fully quitting and reopening Codex. Closing only the canvas tab can leave the previous plugin connection loaded. Valid custom runtimes remain selected; the managed published runtime follows the new pin. Setup verification uses an isolated test document.

简体中文 README · English README · Install guide

Rust editor runtime 0.8.5 (d155cd0)

Complete native Rust editor, matching editable WASM, CanvasKit, fonts and product assets. Six native build runners pass edit/save/reopen and design-to-code round-trip smoke tests. Dependency audit passes with documented build-only SDK exceptions.

v0.3.9 · Code panel to Codex

The existing right Code panel now captures the chosen framework and exact design target, shows deterministic baseline source, and can hand implementation to the current Codex conversation. Verified primary source returns to the same preview, copy and download actions; the runnable project and supporting files remain in the workspace.

• MCP Apps hosts with text messaging receive one explicit Generate request. Ordinary browser panels keep the usable baseline and ask you to say “继续转代码” in Codex. Unsupported or uncertain deliveries are never automatically retried.
• Captured page, nodes and design version remain fixed. Cancelled, superseded and changed-design requests cannot receive a stale completion.
• The matching Rust runtime exposes read-only code export for the eight existing panel frameworks and CSS variables.
• Validation: 74 plugin regressions, six Node.js 22/24 CI jobs, stable Rust workspace format/Clippy, 766 Web host and 1,251 host-services tests, native export/return/stale-design smoke, actual Code-panel interaction and a runnable HTML button interaction. Six runtime build runners also verify native edit/save/reopen and HTML/React/Vue source round trips.

Live MCP Apps presentation and automatic message delivery have not been verified in the current host. The ordinary in-app browser requires the chat continuation described above.

The separate upstream dependency audit still reports existing rustls/ruzstd advisories and a yanked zip version. No locked dependency versions changed in this update. See the validation record for exact evidence and limitations.

v0.3.8 · Live slide previews

The Codex canvas sidebar now shows Layers and Slides, with the conversation kept in Codex. Slide cards render the actual board content, preserve portrait/landscape proportions, and update after edits or page switches. Clicking a card navigates to its board.

The plugin pins a new complete editor runtime at 175844ede42a47268f753d331f0eeae32b010324. Standalone OpenPencil retains its Agent tab; the embedded host capability is transient.

Validation: 764 Web host tests, 67 shared sidebar tests, 66 plugin tests, full Rust format/Clippy, production WASM gates, native edit/save/reopen, and actual browser inspection in light/dark modes. All six published native runtimes passed their build and save/reopen smoke checks.

v0.3.7 — Generate images by default

New photos, illustrations and product imagery now use Codex's built-in image generation by default. Generation may consume your Codex image-generation quota. Both English and Chinese READMEs display this notice before the one-prompt install example.

Codex gives a brief chat progress notice before generation and continues without a separate per-call permission question. Say "不要生图", "只搜图" or "use stock images only" to use stock search throughout the task. The host's own required approvals still apply.

Unavailable or failed generation uses native scoped stock search. Unknown generation results are checked rather than blindly retried, and completed assets are reused after import/save failures. The existing portable image import/save flow remains in place. The canvas adds no generation switch or prompt form. The plugin does not manage quota or invoke a separate generation provider.

Validation: package checks, skill validation and all 66 regression tests passed. The isolated native bridge passed edit/preview/save/reopen, and the bundled Codex host loaded the installed v0.3.7 plugin with 185 tools. This policy update made no image-generation calls and did not retest stock search; the public-runtime search limitations recorded in docs/validation.md remain unchanged.

Reconnect the plugin or start a new chat after updating to load the new workflow.

v0.3.6 — Image consent and portable imports

New image slots now use native stock search by default. Before using Codex's built-in image generation, the design skill requires an explanation of quota use, the intended assets and number of calls, followed by explicit permission for that task and count. Generation unavailable or failed uses scoped stock fallback; search failure never authorizes generation. No canvas toggle or extra prompt form is added.

The model-only canvas_import_image embeds local PNG/JPEG/WebP bytes into an existing image node, preserving its layout and checking the current page and document version. Generated originals stay in the project, and the workflow inspects the native preview, saves and verifies reopen. The bridge does not invoke providers or manage quota; consent is guided by the skill rather than enforced as a host accounting gate.

Validation:

• Package checks, skill validation and all 66 regression tests passed.
• The actual bundled Codex host loads the installed plugin with 185 tools.
• Local native stock search resolved one requested slot; import, native rendering, save and independent reopen passed after deleting the original asset.
• The verified pinned public runtime passed import/render/save/reopen. Its stock search failed for two independent test queries; this is recorded separately and no public-runtime stock-search success is claimed.
• No quota-consuming image-generation call was made during testing.

Reconnect the plugin or start a new chat after updating to load the new tool and workflow. See docs/validation.md for evidence and limitations.

v0.3.5 — Selection-only canvas

The canvas now leaves editing instructions, progress and results in the current Codex chat. Its existing footer shows only the selected count and names, with no extra selection row, prompt box or submission button.

Selection context still syncs silently to capable hosts. Codex verifies the current targets through canvas_selection, limits edits to their subtrees, and checks the preview and saved design. The obsolete canvas_prepare_edit and canvas_edit_status tools have been removed; the plugin exposes 184 tools.

Validation: package checks, 59 regression tests, skill validation, isolated native selection and bridge smoke tests, actual browser single/multiple selection, narrow light layout, live dark-theme switch, Save and independent reopen all passed. The local installed plugin also passed the bundled Codex host check. Live embedded Codex UI presentation remains unverified; the public runtime catalog is unchanged.

Reconnect the plugin and reopen the canvas to load the new UI. See validation details.

v0.3.4 — Match the OpenPencil editor theme

The canvas toolbar, selection strip, loading wrapper, buttons, inputs and dialogs now match the Rust OpenPencil editor's neutral light/dark surfaces and blue accent. The compact 32 px selection strip remains unchanged.

Validated against the real Rust/WASM editor in the existing Chrome profile, including light/dark host switching, the optional prompt input, Save As, and an actual edit/save/reopen. Package checks, all 69 regression tests, and the installed plugin's bundled Codex host check passed (186 tools).

Reconnect the plugin and reopen the canvas after updating to load the new styling.

v0.3.3 — Compact canvas selection strip

The canvas selection guide now fits in a 32 px single row, down from about 62 px. It keeps selection feedback and the chat hint visible, truncates long names, and expands only when the optional prompt input is opened.

Validated in the existing Chrome profile at 720 px and 360 px, with light/dark themes, long selection names, shortcut entry and edit progress. Package checks, all 69 regression tests, and the installed plugin's native edit/save/reopen plus bundled Codex host checks passed.

Reopen the canvas panel after updating to load the compact layout.

v0.3.2 — Reliable desktop plugin startup

Codex desktop could report OpenPencil as installed while its MCP server failed to start because the desktop PATH could not find the terminal's Node executable. The plugin now launches with the Node executable registered privately by setup, with Node 22+ validation and local fallbacks. System PATH, existing Node installations and unrelated MCP servers are preserved.

Setup now verifies the installed plugin through Codex's actual app-server loader before reporting success, including the expected plugin identity and canvas tools. Run npm run host-check to diagnose loading without creating a chat or editing a design.

Validation:

• 69 tests and package checks pass; the Node 22/24 matrix passes on macOS, Windows and Linux.
• Fresh installation passes on all six OS/CPU builds, including host loading, native edit/save/reopen, terminal PNG/save and repeat setup.
• The bundled desktop app-server reproduced the previous failure and now loads the installed canvas controls.

After updating, reconnect the plugin or start a new chat to refresh its tools. A fresh host check does not prove an existing chat has reloaded. Embedded Codex presentation and actual canvas shortcut message delivery remain unverified.