AI board actions. The Ask AI chat can now create and arrange things on
the space, not just talk about it: text notes, sticky notes, diagram shapes,
frames, stickers, link cards (through the normal unfurl flow), labeled
connections between cards, plus moving and — only when explicitly asked —
deleting existing cards. Works with every configured provider: the model ends
its reply with a fenced ```actions JSON block (no native
tool-calling needed), the server extracts and validates it, and the canvas
applies the sanitized batch. Replies that changed the board show a
"Board updated · N changes" badge in the chat.
Server-side action validation (lib/ai/actions.ts, new; covered by
tests/ai-actions.test.ts). Every batch is sanitized before it reaches the
client: http(s)-only link URLs, moves/deletes/connection endpoints scoped to
the requesting board's card ids (or refs minted in the same batch), numeric
clamps on coordinates/sizes, length caps on strings, and a hard cap of 30
actions per reply. Viewers never get an apply hook, so read-only spaces stay
read-only.
Changed
AI chat prompt now includes a compact CURRENT LAYOUT block (card
geometry + the user's view center, sent from the panel) so the model can
place new cards sensibly; connections it draws pick the facing handles like
a human drag would. Chat output budget raised from 500 to 1200 tokens
(override with AI_CHAT_MAX_TOKENS) so action JSON doesn't truncate.
applyAIActions on the canvas handle (previously dormant) was rebuilt around
the shared action vocabulary and is now wired: AIPanel → page shell →
canvas, editors only.
