Add SDK canvas runtime support

[jmoseley]

Canvas providers need stable runtime contracts across SDKs so native hosts and extensions can declare canvases, handle provider callbacks, and drive canvas chrome without adopting the broader Rust handler refactor from the prototype branch.

What changed

• Adds the Node extension canvas surface (createCanvas, canvas declarations, handler contexts, errors, and exports) and wires session create/resume to send canvases, requestCanvasRenderer, requestExtensions, and stable extensionInfo.
• Adds focused Rust canvas support with Canvas, CanvasHandler, direct canvas.open|focus|reload|close|action.invoke provider callback routing, and host APIs under session.canvas() for discover, list_open, open, focus, reload, close, and invoke_action.
• Aligns the SDK contracts with the runtime branch: displayName is required for canvas declarations, session.canvas.listOpen is a real RPC, resume consumes openCanvases, and capabilities.ui.canvases is boolean.
• Adds ExtensionInfo { source, name } / extensionInfo so consumers can opt into stable agent-facing extension IDs like github-app:<provider-name> instead of reconnect-specific fallback IDs.

Notes for reviewers

The Rust implementation is additive and keeps the existing separate permission/user-input/tool handler model. Canvas provider callbacks are routed through a focused per-session canvas registry rather than a unified session handler refactor.

Validation

• cd nodejs && npm run typecheck
• cd nodejs && npm run lint (existing warnings only)
• cd nodejs && npx vitest run test/client.test.ts test/extension.test.ts
• cd rust && cargo +nightly-2026-04-14 fmt --check
• cd rust && cargo clippy --all-features --all-targets -- -D warnings
• cd rust && cargo test --all-features

[Copilot]

Pull request overview

This PR adds cross-SDK “canvas runtime” support, enabling SDK consumers to declare canvases, receive direct provider callbacks (canvas.*), and use host-side session.canvas.* RPCs with stable extension identity (extensionInfo)—without requiring the larger handler refactor from the prototype branch.

Changes:

• Rust: Introduces a new canvas module (declarations, handler traits, dispatch, host RPC types) and wires SessionConfig / ResumeSessionConfig to serialize canvas-related fields on session.create / session.resume.
• Rust: Adds Session::canvas() host API and updates the session event loop/router to handle direct provider callback requests (canvas.open|focus|reload|close|action.invoke).
• Node.js: Adds a canvas surface (createCanvas, types, dispatch), forwards canvas declarations + request flags + extensionInfo on session create/resume, and routes direct canvas.* JSON-RPC requests to registered canvases with tests.

Show a summary per file

File	Description
rust/tests/session_test.rs	Adds coverage for Rust canvas wire fields, provider dispatch routing, and SessionCanvas host API behavior.
rust/tests/e2e/elicitation.rs	Updates capability struct test to include the new ui.canvases field.
rust/src/wire.rs	Extends session create/resume wire payloads with canvases, request flags, and extension_info.
rust/src/types.rs	Adds ExtensionInfo, canvas config fields on session configs, resume result open-canvas capture, and UiCapabilities.canvases.
rust/src/session.rs	Adds SessionCanvas host API + open-canvas tracking and routes canvas.* provider callbacks through a per-session registry.
rust/src/router.rs	Adds debug logging when routing requests to a registered session.
rust/src/lib.rs	Exposes the new canvas module publicly.
rust/src/jsonrpc.rs	Adds debug logging for incoming JSON-RPC requests from the runtime.
rust/src/canvas.rs	New Rust canvas module: declarations, handler traits, registry + dispatch, request/response types, and unit tests.
nodejs/test/extension.test.ts	Verifies createCanvas is exported from the extension surface.
nodejs/test/client.test.ts	Adds tests for forwarding canvas fields on create/resume and for direct provider dispatch behavior.
nodejs/src/types.ts	Adds SessionCapabilities.ui.canvases, introduces ExtensionInfo, and extends session configs with canvas fields.
nodejs/src/session.ts	Adds per-session canvas registration and lookup to support direct dispatch routing.
nodejs/src/index.ts	Exports canvas APIs/types and ExtensionInfo from the main entrypoint.
nodejs/src/extension.ts	Exports canvas APIs/types and ExtensionInfo from the extension surface.
nodejs/src/client.ts	Forwards canvas fields on create/resume and registers handlers for direct canvas.* provider callbacks.
nodejs/src/canvas.ts	New Node canvas module: canvas declaration/types, createCanvas, and provider request dispatch helper.

Copilot's findings

• Files reviewed: 17/17 changed files
• Comments generated: 5

[github-actions]

Cross-SDK Consistency Review

This PR adds canvas runtime support to the Node.js and Rust SDKs. The following new public APIs are being added to Node.js:

New public types/classes

• Canvas, CanvasError, createCanvas()
• CanvasAction, CanvasActionContext, CanvasDeclaration, CanvasHostContext, CanvasJsonSchema, CanvasLifecycleContext, CanvasOpenContext, CanvasOpenResponse, CanvasOptions
• ExtensionInfo

New SessionConfigBase options

• canvases?: Canvas[]
• requestCanvasRenderer?: boolean
• requestExtensions?: boolean
• extensionInfo?: ExtensionInfo

None of these exist in Python, Go, .NET, or Java SDKs.

Assessment

The canvas provider feature is a significant new surface area that has been deliberately added to Node.js (extension host) and Rust (native host) — both of which are the primary runtimes for this feature. The PR description scopes the work explicitly to these two SDKs.

However, the three session config options that affect session behaviour (requestCanvasRenderer, requestExtensions, extensionInfo) are more broadly applicable — they are opt-ins that any SDK consumer might want to use regardless of whether they are implementing a canvas provider. For example:

• A Python-based app using requestCanvasRenderer: true would want the model to have access to canvas tools.
• An app with a stable extension identity would want to provide extensionInfo.

Recommendation: Consider whether requestCanvasRenderer, requestExtensions, and extensionInfo should be added to the session config in the other SDKs (Python, Go, .NET, Java) as follow-up work, even if the full canvas provider handler surface (createCanvas, callbacks, etc.) is deferred. These are wire-protocol fields that are useful independently of canvas provider implementation.

If the intent is to intentionally keep canvas support Node.js/Rust only for this release, a brief note in the PR or a tracking issue for the other SDKs would be helpful for future contributors.

Generated by SDK Consistency Review Agent for issue #1401 · ● 5.6M · ◷