Add Studio: agent-rendered artifacts and design canvases

[jamesrochabrun]

Summary

Adds Studio: a side panel where agents render things that do not exist in the codebase yet — one HTML document, or several variants of a component on an infinite canvas — and the user points, comments, tweaks, edits, and picks one. Works for Claude and Codex. Nothing is ever written into the project; everything the user does on the surface becomes either a panel-local edit or a prompt.

Full design, invariants, and remaining gaps: AgentHubStudio.md.

Agent-facing tools (bundled MCP server, both providers)

• agenthub_artifact(title, html, id?) — one self-contained document, served verbatim.
• agenthub_design(component, variants[], props?, sourcePath?, id?) — N variants side by side. Each variant's CSS is scoped to its own artboard at the tool boundary (StudioCSSScoper): body, :root variables, @media, @keyframes all work per variant; scripts are stripped; unparseable CSS is rejected with a character offset.
• agenthub_list_artifacts / agenthub_get_artifact(id, variant?) — discovery and the current content of an artifact (including edits the user made in the panel), read from a JSON index + sidecar the app publishes. The CLI never opens SQLite.
• Every tool now carries MCP annotations (readOnlyHint on list/get/planning, destructiveHint only on worktree deletion).

Panel

• Served from an in-process loopback NWListener server (GET/HEAD, 127.0.0.1 only, path-traversal guarded, no-store). Open in browser / Copy link / Export work; re-files reload in place; host-page changes regenerate canvases already on disk (hostVersion marker).
• Inspect: Comment (element-anchored instruction → prompt stamped with the variant), Crop (region + screenshot → prompt), Edit (Canvas design toolbar, applied live). On a canvas, edits are baked into the variant (artboard innerHTML serialized into the payload, debounced, quiet — no reload) with Revert; documents keep the send-to-agent path.
• Tweaks: one shared props schema per canvas (sliders/colors/selects/toggles/text) exposed to every artboard as CSS custom properties — one control moves every variant. Save defaults writes back into the payload; Ideas/Custom/Delete go to the session agent as re-file prompts. Documents get the same panel by calling dc_set_props. A declared prop no variant references is a tool error.
• Implement ▾ (header) and an Implement pill per artboard — the one action that asks for code; the prompt carries the edited variant. Choosing a variant in chat ("go with the ghost one") resolves through agenthub_get_artifact.
• Settings › Studio: per-project storage with delete; toggle for the system-prompt nudge.
• The panel is button-only (no auto-open); the button appears on every session card in the project once something is filed.

Getting agents to use it

• StudioAgentGuidance system-prompt line (Claude --append-system-prompt, Codex developer_instructions), default-on, only when the bundled server is attached.
• Bundled agenthub-studio skill installed for both providers (model-invocable + explicit /agenthub-studio).

Codex compatibility (surfaced while testing)

Codex 0.148 introduced per-tool MCP approval; under approval_policy = never every AgentHub MCP call failed with "MCP tool call requires approval, but approval policy is never". The Codex bootstrap now sets mcp_servers.agenthub.default_tools_approval_mode = "auto", and XcodeBuildMCP to auto when the effective policy (AgentHub's own, else the global ~/.codex/config.toml value via the new read-only CodexGlobalConfigReader) is never/full-auto. Older Codex ignores the key.

Storage

• New v18_create_studio_artifacts migration (blob payload + payloadVersion); project-scoped with worktree rollup; served documents are a cache derived from SQLite, reconciled on launch.
• SidePanelContent.artifact (claude.ai artifacts) renamed .claudeArtifact so the two features are never confused.

Test plan

• cd app/modules/AgentHubCLI && swift test — 146 tests incl. StudioCSSScoperTests, StudioFragmentNormalizerTests, StudioTweakPropsTests, StudioArtifactQueueTests, StudioIndexStoreTests.
• ./scripts/test.sh core — incl. StudioDocumentWriterTests, StudioStaticServerTests (live socket), StudioLibraryTests, StudioArtifactStoreTests (v18 preserves the v17 baseline), StudioTweaksTests, StudioDesignEditStateTests, StudioPanelStateTests, StudioArtifactHandlerTests, CLISessionsViewModelStudioTests, CodexGlobalConfigReaderTests, launch-builder/config suites for the guidance + approval-mode args.
• Manually: filed a canvas from a live session via the MCP server; verified tweaks move every variant, edit-bake + Implement carry inline edits, Comment box follows pan/zoom, Codex 0.148 under never accepts the configured server.