OpenPencil v0.8.3 — Design Together, Present Anywhere

v0.8.3 is the release where OpenPencil stops being a single-seat tool. Real-time
collaboration arrives end to end — authenticated peer-to-peer sessions, a public
relay for peers that cannot reach each other directly, and built-in regional
hubs — joined alongside browser device login and an online multi-tenant web mode
authenticated against the op-hub. For the first time, two people (or a person and
an agent) can sit in the same document, see each other's cursors, and reconcile
divergent edits without leaving the canvas.

Around that foundation the release grows a full presentation workflow: six 16:9
deck templates, an AI planner that lays out one slide per screen at projector
size, a live slideshow presenter, and export to PDF, self-contained HTML,
editable PowerPoint, and a video composition. A new scene template center lets
you start from a real layout instead of a blank frame, the prompt and asset
centers mature into full-window surfaces, and an official Chrome web-capture
extension snapshots any live page into OpenPencil.

Under the surface the web bundle gets lighter by fetching templates, the icon
catalog, and preview art at runtime instead of embedding them; theme becomes a
per-device preference; and the account/collaboration stack ships prebuilt
op-auth libraries with safe production trust-root rotation. This document walks
through each area, what problem it solves, how to use it, and who benefits.

Highlights

• Real-time collaboration — authenticated P2P with a public relay fallback
  and built-in regional hubs, joined with a 10-character region-tagged pairing
  code. Live remote cursors, cross-account sessions, and a conflict panel that
  replays discarded edits.
• Online multi-tenant web mode — one --serve-web deployment can host many
  tenants, authenticated against the op-hub, with cross-account tenant sharing,
  eviction persistence, and a capability-scoped online /mcp surface.
• Device login — sign in from the browser through the serve-web daemon, with
  a runtime account gate and authenticated profile avatars and usernames.
• Presentation decks — six 16:9 templates and a picker, AI planning at
  projector size, a slideshow presenter, and PDF / HTML / PowerPoint / video
  export, backed by agent geometry validation of every board.
• Scene template center — a browsable catalogue of 58 templates across six
  scenes, from File ▸ New from template, mounted in the browser host too.
• Chrome web-capture extension — snapshot any webpage into OpenPencil with
  faithful HTML, icon, and layout capture, delivered to your account's snapshot
  inbox on the hub, or downloaded offline as a ready-to-open .op file.
• Lighter web runtime — scene templates, the icon catalog, and preview assets
  are fetched at runtime instead of embedded in the wasm bundle.
• Theme is now a device preference on the web host.

Real-Time Collaboration

Collaboration is the headline of this release, and it is built to work whether
your peers are across the desk or across the internet. The goal was a session you
can start in seconds, trust by default, and recover from cleanly when two people
edit the same thing at once.

Starting a session

A session can form three ways, and the client picks the best available path:

• Direct peer-to-peer. When peers can reach each other, they establish an
  encrypted channel and talk directly — the lowest-latency path, ideal for a LAN
  or a well-connected pair.
• Public relay. When a direct connection is not possible (NAT, firewalls,
  different networks), a public relay carries the encrypted traffic between peers.
  The client tolerates public-relay handshake latency and reports join failure by
  stage, so a slow or unreachable relay produces an actionable message instead of
  an opaque hang.
• Regional hubs. Built-in regional collaboration hubs give sessions a nearby,
  known meeting point so peers do not have to discover each other manually.

Whichever path is used, joining is the same: a host shares a 10-character,
region-tagged pairing code that replaces the older open-invite scheme. The
region tag routes participants to the right hub; the short code is easy to read
aloud or paste. On the desktop the join field lives on the unified text input —
paste-to-replace, selectable, and clearable — so entering a code feels like every
other field.

Presence and live editing

Once joined, every participant is present on the canvas. Remote cursors are
painted with the agent pointer so you can see where collaborators are working in
real time, and their avatars are proxied through the daemon rather than fetched
directly by the browser — the browser never talks to an avatar host on its own.
Edits stream between peers as they happen, and the browser host gained
session-safe sync recovery and SSE fan-in so a reconnect re-syncs cleanly rather
than forking the document.

Resolving conflicts

Concurrent editing means occasional divergence, and OpenPencil surfaces it
instead of silently picking a winner. A conflict panel shows per-node,
per-field detail for the edits that collided and can replay the edits that were
discarded during a divergence, so a change that lost a race is recoverable
rather than lost. Queued actions are deferred until a gesture's capture closes, so
an in-flight drag on one side does not corrupt the other side's view of the scene.

Cross-account and hardening

Cross-account collaboration lets people signed in to different accounts share one
session — useful when a designer and a reviewer are on separate hub accounts. This
cycle also put substantial work into resilience: resource-exhaustion guards on the
p2p path, whole-second keepalive clamping, secure-relay transport-failure
classification, gesture-capture ordering fixes, an aligned reauthentication
budget, and — most importantly for a hosted deployment — safe rotation of
production trust roots, so the set of keys a client will trust can change
without breaking live sessions.

Who benefits: designers get pair-design and live review; agent users get a
shared canvas an AI can drive while a human watches the cursor move; teams get a
session model that degrades gracefully across networks.

Accounts, Device Login, and Online Hosting

Collaboration needs identity, so v0.8.3 brings account sign-in out of the earlier
prereleases where it was intentionally hidden.

Signing in from the browser

Browser device login runs through the serve-web daemon: a runtime account gate
governs access to account-scoped features, and once you sign in the editor shows
your authenticated profile avatar and username. The flow reports the machine name
to SSO for device identification. The desktop build links a prebuilt op-auth
library — shipped for Intel and Apple-silicon macOS, Linux, and Windows (MSVC
and arm64) — so the auth bridge is available without a separate build toolchain,
and it is linked to survive thin-LTO release builds.

Online multi-tenant mode

The --serve-web daemon can now run as a shared, multi-tenant host rather than a
single-user server. Tenants are authenticated against the op-hub, and the mode
supports cross-account tenant sharing whose membership persists across
evictions, plus session node creation, account-switch isolation, and tenant-aware
URLs so one deployment cleanly serves many accounts. The online /mcp surface
authenticates the live endpoint and enforces a capability profile and scope,
so a hosted MCP client only sees the tools and documents it is entitled to, and
the bootstrap cache degrades safely when the endpoint is unavailable.

Who benefits: developers and teams can stand up one hosted OpenPencil for a
group instead of one server per person, with per-tenant isolation and a scoped
automation surface.

Presentation Decks

Decks are a first-class document type in v0.8.3, closing the loop from "generate a
layout" to "stand up and present it."

Templates and planning

Start from one of six 16:9 deck templates through the template picker, or
describe a deck and let the AI plan it. The planning corpus learned that a
projector board differs from a page: the agent plans a deck at projector size
with one slide per screen, scaffolds the screen roots in a single insert, and
wraps multi-board templates onto rows on the canvas. Crucially, the agent now
judges each board by its geometry as well as its prompt — pinning boards to the
projector aspect, centering board content instead of stacking it at the top, and
reporting row overflow rather than clipping it — so generated decks come out
presentation-ready.

Presenting

A deck can be presented as a slideshow directly in preview, with presenter
controls to drive it forward and back. A dedicated slides rail is the deck's
single navigator, replacing ad-hoc scrolling with a predictable slide list.

Exporting

When a deck is done, export it to the format the audience needs:

• PDF — one page per slide.
• Self-contained slideshow HTML — a single file that plays anywhere a browser
  is available, no assets to ship alongside.
• Editable PowerPoint (.pptx) — hand off to anyone who lives in PowerPoint.
• Hyperframes video composition — emit the deck as a motion composition.

Who benefits: designers can produce a real deck without leaving the tool;
developers and PMs get portable output (PDF/HTML/PPTX) that drops into existing
workflows.

Scene Templates, Prompt Center, and Asset Center

Three surfaces matured this release to make starting and iterating faster.

• Scene template center — a browsable catalogue that grew to 58 templates
  across six scenes, opened from File ▸ New from template, mounted in the
  browser host, and fully localized. Templates come with dual actions so you can
  open one directly or feed it to the agent. The template grid scrolls on the
  trackpad and lays out its decks correctly.
• Prompt center — gained web, dashboard, component, and modify entries and
  visual prompt previews, and scales with the viewport so it stays usable on
  small and large windows alike.
• Asset center — grew into a full-window responsive gallery with
  dual-action templates, palette bands, one consistent control language, and
  DESIGN.md style import, so a written design system can seed the assets.

Who benefits: newcomers get a mass-market on-ramp (start from a real layout);
power users get faster iteration and a place to bring their own design system.

Chrome Web-Capture Extension and HTML Import

The official OpenPencil Chrome extension turns any live webpage into editable
OpenPencil design content. It settles lazy pages before capture and transfers the
result across the extension's process boundary in bounded slices to stay within
IPC and ingress limits.

Captured snapshots are delivered to your account's snapshot inbox on the hub
(POST /api/v1/snapshots); a client that offers a snapshot to a hub without the
inbox route degrades gracefully rather than failing hard. When you are offline or
prefer a local artifact, the extension's download emits a ready-to-open .op
file instead.

Underneath, the HTML and browser-snapshot import pipeline was overhauled for
fidelity: SVG image sources rasterize at the byte-cache seam, inline-flow
blocks fold into a single styled text node instead of fragmenting, and
web-snapshot text, icon, and layout capture are markedly more faithful. This
builds on the op-html import path introduced in v0.8.2 (files, URLs, and ZIP
projects) and is also reachable through the MCP and CLI import tools.

Who benefits: designers can lift a real page as a starting point; agent and
MCP users get a capture-to-canvas pipeline that lands directly in an account.

Editing and Rendering

Day-to-day editing got a round of polish:

• Drop an image file onto a node to set its fill, and match a node's height
  to its image fill ratio so imported imagery keeps its proportions.
• The settings panel was rebuilt as a wide modal with a shared row language;
  the chat panel, slides rail, and template centers were refreshed;
  documents now open with top-level layers collapsed, behind a minimized chat
  bar, so you land on the canvas rather than a wall of chrome.
• Complex scripts are shaped instead of painted in storage order, fixing
  Arabic/Indic and other complex-script rendering, and IME punctuation that
  commits without a composition is accepted (a long-standing CJK input gap).
• Interactive widgets render and carry their authored design tokens through
  scenes, and chrome text is measured in its painted, family-aware font.

For Developers

Beyond the UI, v0.8.3 changes several developer-facing surfaces:

• MCP — the online /mcp endpoint authenticates and enforces a capability
  profile and scope, so hosting OpenPencil for a team no longer means exposing an
  unscoped automation surface. Ping identity is nested under _meta so strict MCP
  clients accept the server.
• One-click integrations — one-click MCP registration for twelve CLIs, and
  one-click ACP presets for Kimi, Gemini, and Qwen, so wiring an external
  agent to OpenPencil is a single action.
• Deck export as portable output — decks emit PDF, self-contained HTML,
  .pptx, and a video composition; framework codegen preserves generated results
  across framework tabs.
• Web SDK — the SDK bundle tripwire is aligned to the shared 8 MiB budget as
  the runtime moves assets out of the core bundle; the public web SDK remains a
  read-only .op viewer.
• Release verification — releases now publish SHA256SUMS plus a provenance
  attestation, so automated download verification is possible.

Under the Hood

Changes that are largely invisible day to day but worth calling out:

• Web bundle slimming. Scene templates, the icon catalog, and preview assets
  are fetched at runtime rather than embedded in the wasm bundle, trimming what
  ships over the wire on first load; heavy image codecs stay out of the core
  bundle behind their own size ceiling, and the SDK bundle tripwire is aligned to
  the shared budget. (The web host and Chrome extension enforce concrete transfer
  ceilings — e.g. bounded live-sync document pushes and the extension's sliced,
  capped ingress — so large payloads fail predictably instead of silently.)
• Auth stack. Prebuilt op-auth libraries across platforms, ABI v2 auth with
  a local debugging build flag, an isolated bundled-runtime symbol, and safe
  rotation of production trust roots underpin device login and collaboration.
• Engineering hygiene. A workspace-wide typed-error campaign replaced
  stringly-typed error paths across editor, MCP, services, CLI, and web crates; a
  final 800-line-per-file sweep split every oversized module; and async hygiene
  work (bounded channels, safe block_on, deterministic thread teardown) hardened
  the host loops. The collaboration runtime was extracted into its own crate.
• Localization. This round's new panel strings were added across all fifteen
  locales, including the scene template center.

Upgrade Notes and Compatibility

• Collaboration reachability. Direct P2P needs peers that can connect;
  otherwise sessions fall back to the public relay or a regional hub. Expect to
  share a 10-character region-tagged pairing code to join.
• Accounts. Device login and the online multi-tenant features authenticate
  against the op-hub. The desktop app links a prebuilt op-auth library; if you
  build from source, ensure the prebuilt libraries for your platform are present.
• Web hosting. CLI and ACP agents remain native-only — the web host
  exposes built-in API-key agent profiles only, and does not sync CLI/ACP
  credentials to the server. A public reverse proxy must still set
  OPENPENCIL_WEB_ALLOWED_ORIGINS (and, for private AI endpoints,
  OPENPENCIL_WEB_AI_ENDPOINT_ALLOWLIST).
• Online /mcp. Hosted MCP clients are subject to capability-profile and
  scope enforcement; a client expecting an unscoped surface will see fewer tools.
• Web SDK. The public web SDK remains read-only.
• Retired TypeScript app. The TypeScript + Electron application (last tagged
  v0.7.5) is not part of this release and lives only in git history.

Acknowledgements

Thanks to the upstream maintainers behind the third-party forks documented in the
README, and
to everyone testing collaboration in the field and filing the network,
conflict-resolution, and relay reports that shaped this release.

Web Docker Image

• Image: ghcr.io/zseven-w/openpencil-web:v0.8.3
• Digest: sha256:3ab1232ed1857777c2e24d3fea3934ba2f0a11f4c25cd4e48f288ffdf58321d6

Verify Your Download

Every asset is listed in SHA256SUMS.txt and carries a signed build-provenance attestation tying it to this repository, commit, and CI run:

gh attestation verify <downloaded-file> --repo ZSeven-W/openpencil

Some antivirus engines heuristically flag low-prevalence installers — see docs/security/antivirus-false-positives.md.

Contributors

@3moeslam @ganondev @caniko