@agent-native/core-corpus 0.210.2 → 0.211.0

package/corpus/templates/slides/app/pages/DeckEditor.tsx

@@ -1110,22 +1110,6 @@ export default function DeckEditor() {
     }
     setDrawMode(next);
   }, [drawMode]);
-  const togglePinMode = useCallback(() => {
-    const next = !pinMode;
-    if (next) {
-      trackEvent("slide_tool_selected", {
-        app_name: "slides",
-        template_name: "slides",
-        tool: "comment_pin",
-      });
-    }
-    if (next) {
-      setDrawMode(false);
-      setTextBoxMode(false);
-      setShapeType(null);
-    }
-    setPinMode(next);
-  }, [pinMode]);
   const toggleTextBoxMode = useCallback(() => {
     const next = !textBoxMode;
     if (next) {
@@ -1159,18 +1143,6 @@ export default function DeckEditor() {
     setTextBoxMode(false);
     setShapeType(type);
   }, []);
-  const toggleComments = useCallback(() => {
-    const opening = sidePanel !== "comments";
-    if (opening) {
-      trackEvent("slide_panel_opened", {
-        app_name: "slides",
-        template_name: "slides",
-        panel: "comments",
-      });
-    }
-    if (!opening) setSelectedCommentThreadId(null);
-    setSidePanel(opening ? "comments" : null);
-  }, [sidePanel]);
   const selectCommentThread = useCallback(
     (threadId: string) => {
       setSelectedCommentThreadId(threadId);
@@ -1301,6 +1273,29 @@ export default function DeckEditor() {
   const canEdit = deckRole.canEdit && !readOnlyWidget;
   // The widget's write grant carries no comment actions.
   const canComment = deckRole.canComment && !readOnlyWidget && !widgetEmbed;
+  const toggleComments = useCallback(() => {
+    if (sidePanel !== "comments") {
+      trackEvent("slide_panel_opened", {
+        app_name: "slides",
+        template_name: "slides",
+        panel: "comments",
+      });
+      setSidePanel("comments");
+    }
+    if (!canComment) return;
+    const arming = !pinMode;
+    if (arming) {
+      trackEvent("slide_tool_selected", {
+        app_name: "slides",
+        template_name: "slides",
+        tool: "comment_pin",
+      });
+      setDrawMode(false);
+      setTextBoxMode(false);
+      setShapeType(null);
+    }
+    setPinMode(arming);
+  }, [sidePanel, canComment, pinMode]);
   const generationContext =
     deck?.generationContext &&
     typeof deck.generationContext === "object" &&
@@ -2176,6 +2171,9 @@ export default function DeckEditor() {
   } = useDeckDesignSystem(deck?.designSystemId, deck?.id);
   useContrastAuditBridge(deck, designSystemRawData);
   const commentsOpen = sidePanel === "comments";
+  useEffect(() => {
+    if (!commentsOpen) setPinMode(false);
+  }, [commentsOpen]);
 
   const {
     questions: questionFlowQuestions,
@@ -4248,6 +4246,7 @@ export default function DeckEditor() {
         }
       } else {
         setPinMode(true);
+        setSidePanel("comments");
       }
     };
 
@@ -5310,7 +5309,6 @@ export default function DeckEditor() {
         deckId={id}
         deckTitle={deck.title}
         canEdit={canEdit}
-        canComment={canComment}
         onTitleChange={(title) => updateDeck(id, { title })}
         currentSlideIndex={currentIndex >= 0 ? currentIndex : 0}
         sidebarOpen={sidebarOpen}
@@ -5392,8 +5390,6 @@ export default function DeckEditor() {
         }}
         drawMode={drawMode}
         onToggleDrawMode={toggleDrawMode}
-        pinMode={pinMode}
-        onTogglePinMode={togglePinMode}
         textBoxMode={textBoxMode}
         onToggleTextBoxMode={toggleTextBoxMode}
         shapeType={shapeType}
@@ -6076,9 +6072,7 @@ export default function DeckEditor() {
             onCloseLayers={() => setLayersOpen(false)}
             onOpenAnimations={openAnimationsForTarget}
             onToggleAnimations={toggleAnimations}
-            commentsOpen={commentsOpen}
             onToggleComments={toggleComments}
-            onTogglePinMode={togglePinMode}
             onToggleDrawMode={toggleDrawMode}
             onSelectedAnimationTargetsChange={setAnimationTargets}
             slideId={currentSlide.id}

package/corpus/templates/slides/scripts/edit-fidelity/run.ts

@@ -2827,8 +2827,6 @@ async function runTextSurfaceQa(page: Page, base: string, browserName: string) {
     }
     await exerciseControl(editComment, "comment edit", true);
     await editComment.press("Escape");
-    await page.getByRole("button", { name: "More" }).click();
-    await page.locator("[data-toolbar-pin-button]").click();
     const [pinTarget] = await listTargets(page, slideTwo);
     if (!pinTarget)
       throw new Error("second slide has no comment anchor target");
@@ -2842,7 +2840,7 @@ async function runTextSurfaceQa(page: Page, base: string, browserName: string) {
     await exerciseControl(pinComment, "pinned comment composer", true);
     await pinComment.press("Escape");
     await page.getByRole("button", { name: "More" }).click();
-    await page.locator("[data-toolbar-pin-button]").click();
+    await page.getByRole("menuitem", { name: /^Comments/ }).click();
 
     const deckTitle = page
       .locator('[data-slides-editor-root="true"] input[type="text"]')

package/corpus/templates/tasks/.agents/skills/actions/references/action-fields.md

@@ -95,9 +95,9 @@ MCP clients see no `outputSchema` by default. Set `mcpOutputSchema: true` (requi
 
 `authorize` decides whether the caller may run the action at all. It wraps
 `run`, so it holds at **all six dispatch sites** — agent tool, HTTP, frontend
-hook, MCP, A2A, CLI — unlike `needsApproval`, which is honoured only in the
-agent loop. Use `authorize` for "not everyone may do this"; use `needsApproval`
-to ask a human to bless one call a permitted caller is already allowed to make.
+hook, MCP, A2A, CLI. Use `authorize` for "not everyone may do this"; use
+`needsApproval` to ask a human to bless one call a permitted caller is already
+allowed to make.
 
 ```ts
 import { coachAccess } from "../lib/access.js"; // defineAppRoles(...)
@@ -140,4 +140,6 @@ export default defineAction({
 
 When the gate is truthy and the call isn't yet approved, the loop emits an `approval_required` event and **stops the turn — `run()` never executes**. A predicate gates conditionally (e.g. only external recipients) and **fails closed**: a throw is treated as "approval required". It receives its own copy of the prepared snapshot of the validated arguments, defaults applied, and the approval binds to the snapshot's hash, so an approved call runs only with the arguments that were approved (a Date binds by its time). The human approves via the chat UI's Approve affordance, which re-issues the turn with the call's `approvalKey`, and only then does the action run.
 
+Approval is given in the app, so HTTP never grants it. The HTTP action route and the generated Workers entry run a gated call only for the proven app UI (a frontend call from the signed-in user, same origin, holding the short-lived UI capability; `isProvenUiRequest`, the proof `uiOnly` uses) or the app's MCP directory widget. Every other HTTP caller (bearer or API key, MCP OAuth token, org service token, A2A, extension iframe, mobile app) gets `409 approval_required`, and a service identity can never approve. The shared client presents the capability with every write from a signed-in session (minted once per user, reused for nine minutes, never for reads or public pages), so a gated button works on its first request. A call without proof gets `403 ui_capability_required`; the client then re-mints and retries once, which is only the fallback for an expired or rejected capability. Every surface evaluates the gate through `preparedCallNeedsApproval`, so a throwing predicate asks there too. A caller that must run unattended needs a different action, never a bypass of the gate.
+
 **Keep approvals rare** — the default is off and almost every action should leave it off. The canonical example is Mail's `send-email` (`needsApproval: true`). See the `security` skill and the Human Approval doc.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core-corpus",
-  "version": "0.210.2",
+  "version": "0.211.0",
   "description": "Opt-in source corpus for Agent-Native Core source-search.",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {