@agent-native/core 0.146.1 → 0.146.3

package/corpus/templates/slides/app/hooks/use-deck-role.ts

@@ -14,10 +14,18 @@ interface SharesResponse {
  * `Viewer` = no edit affordances, but the editor shell is still navigable;
  * any other role (Owner / Editor / Admin) gets full editing.
  *
- * Returns `canEdit = true` while the role is still loading so that owners
- * never see a flash of view-only chrome on first paint.
+ * `assumeEditorWhileLoading` should only be true when a faster, already-known
+ * signal (e.g. `deck.createdByMe`) confirms the caller is the owner — that
+ * avoids a flash of view-only chrome for owners without ever defaulting a
+ * viewer into edit affordances while the real role is still loading. Without
+ * that signal, `canEdit` stays false until the role query resolves, so a
+ * viewer can never trigger an edit that the server will reject and silently
+ * roll back.
  */
-export function useDeckRole(deckId: string | undefined): {
+export function useDeckRole(
+  deckId: string | undefined,
+  assumeEditorWhileLoading = false,
+): {
   role: SharesResponse["role"] | undefined;
   canEdit: boolean;
   isLoading: boolean;
@@ -29,6 +37,8 @@ export function useDeckRole(deckId: string | undefined): {
   );
   const role = query.data?.role;
   const canEdit =
-    role === undefined ? true : role === "owner" || role !== "viewer";
+    role === undefined
+      ? assumeEditorWhileLoading
+      : role === "owner" || role !== "viewer";
   return { role, canEdit, isLoading: query.isLoading };
 }

package/corpus/templates/slides/app/i18n/en-US.ts

@@ -212,8 +212,10 @@ const messages = {
     assetLibrary: "Asset Library",
     diagrams: "Diagrams",
     insertMermaidDiagram: "Insert Mermaid Diagram",
+    insertMermaidFailed: "Failed to insert diagram",
     excalidrawCanvas: "Excalidraw Canvas",
     convertMermaidToExcalidraw: "Convert Mermaid to Excalidraw",
+    convertMermaidFailed: "Failed to convert diagram",
     removeExcalidrawCanvas: "Remove Excalidraw Canvas",
     transition: "Transition",
     transition_instant: "Instant",

package/corpus/templates/slides/app/pages/DeckEditor.tsx

@@ -44,7 +44,7 @@ import { QuestionFlow } from "@/components/editor/QuestionFlow";
 import SlideEditor from "@/components/editor/SlideEditor";
 import { TweaksPanel } from "@/components/editor/TweaksPanel";
 import { Button } from "@/components/ui/button";
-import { useDecks } from "@/context/DeckContext";
+import { deckIdFromPathname, useDecks } from "@/context/DeckContext";
 import { useAgentGenerating } from "@/hooks/use-agent-generating";
 import { useDeckDesignSystem } from "@/hooks/use-deck-design-system";
 import { useDeckPresence } from "@/hooks/use-deck-presence";
@@ -275,8 +275,10 @@ export default function DeckEditor() {
   });
   // Mirror Google Slides: viewers see the editor shell with edit affordances
   // disabled (rather than a separate "viewer" route). Owners/Editors/Admins
-  // get the full editor.
-  const { canEdit } = useDeckRole(id);
+  // get the full editor. Only assume edit access while the role is still
+  // loading when `createdByMe` already confirms ownership — otherwise a
+  // viewer would briefly see (and could click) edit affordances.
+  const { canEdit } = useDeckRole(id, deck?.createdByMe === true);
   const isNewDeckGenerating = shouldShowNewDeckGeneratingProgress({
     generating,
     isNewDeckCreation: wasNewDeckCreation.current,
@@ -1001,9 +1003,10 @@ export default function DeckEditor() {
         onShowHistory={() => setHistoryOpen(!historyOpen)}
         historyButtonRef={historyButtonRef}
         currentSlide={currentSlide}
-        onUpdateSlide={(updates) =>
-          currentSlide && updateSlide(id, currentSlide.id, updates)
-        }
+        onUpdateSlide={(updates, slideIdOverride) => {
+          const targetId = slideIdOverride ?? currentSlide?.id;
+          if (targetId) updateSlide(id, targetId, updates);
+        }}
         activeUsers={slideActiveUsers.filter((u) => u.email !== session?.email)}
         agentPresent={agentPresent}
         agentActive={agentActive}
@@ -1025,7 +1028,16 @@ export default function DeckEditor() {
         onToggleTextBoxMode={toggleTextBoxMode}
         onDuplicateDeck={() => {
           const newId = `deck-${nanoid()}`;
-          const optimistic = duplicateDeck(id, newId);
+          const optimistic = duplicateDeck(id, newId, undefined, () => {
+            // The background duplicate-deck action failed after we already
+            // navigated to the optimistic copy. If the user is still there,
+            // send them back instead of stranding them on a "Deck
+            // unavailable" screen for a deck that no longer exists.
+            if (deckIdFromPathname(window.location.pathname) === newId) {
+              navigate("/");
+            }
+            toast.error(t("home.duplicateFailed"));
+          });
           if (optimistic) navigate(`/deck/${optimistic.id}`);
         }}
         onExportPdf={async () => {

package/corpus/templates/slides/app/pages/Index.tsx

@@ -45,7 +45,7 @@ import {
   describeDeckPersistenceFailure,
   type Deck,
 } from "@/context/DeckContext";
-import { useDecks } from "@/context/DeckContext";
+import { deckIdFromPathname, useDecks } from "@/context/DeckContext";
 import { useAgentGenerating } from "@/hooks/use-agent-generating";
 import { useDesignSystems } from "@/hooks/use-design-systems";
 import { useWorkspaceDefaults } from "@/hooks/use-workspace-defaults";
@@ -1088,7 +1088,16 @@ export default function Index() {
     (id: string) => {
       let copy: ReturnType<typeof duplicateDeck> | undefined;
       flushSync(() => {
-        copy = duplicateDeck(id, `deck-${nanoid()}`);
+        copy = duplicateDeck(id, `deck-${nanoid()}`, undefined, () => {
+          // The background duplicate-deck action failed after we already
+          // navigated to the optimistic copy's route. If the user is still
+          // there, send them back to the deck list instead of stranding them
+          // on a "Deck unavailable" screen for a deck that no longer exists.
+          if (deckIdFromPathname(window.location.pathname) === copy?.id) {
+            navigate("/");
+          }
+          toast.error(t("home.duplicateFailed"));
+        });
       });
       // The context refuses a second copy of the same deck while the first
       // one's action is still in flight.

package/corpus/templates/slides/app/root.tsx

@@ -97,7 +97,11 @@ function useExitSelectionOnOutsideClick() {
       const target = e.target as HTMLElement;
       if (
         target.closest(".slide-content") ||
-        target.closest(".slide-image-clickable")
+        target.closest(".slide-image-clickable") ||
+        target.closest("[data-slide-context-toolbar]") ||
+        target.closest(
+          '[role="dialog"], [role="menu"], [role="listbox"], [data-radix-popper-content-wrapper], [data-radix-menu-content]',
+        )
       ) {
         return;
       }

package/corpus/templates/slides/package.json

@@ -53,6 +53,7 @@
     "nanoid": "^5.1.9",
     "p-limit": "^7.3.0",
     "pdf-parse": "^2.4.5",
+    "pdfjs-dist": "5.4.296",
     "pptxgenjs": "4.0.1",
     "react-markdown": "^10.1.0",
     "rehype-raw": "^7.0.0",

package/corpus/templates/slides/server/handlers/import/html-converter.ts

@@ -334,9 +334,18 @@ function formatFidelityRun(
     `font-style:${run.italic ? "italic" : "normal"}`,
     `text-decoration:${run.underline ? "underline" : "none"}`,
   ].join(";");
+  const href = run.href && isSafeLinkHref(run.href) ? run.href : undefined;
+  if (href) {
+    return `<a href="${esc(href)}" target="_blank" rel="noopener noreferrer" style="${styles};">${esc(run.content)}</a>`;
+  }
   return `<span style="${styles};">${esc(run.content)}</span>`;
 }
 
+/** A source PDF/PPTX link annotation is untrusted input — only render schemes a browser treats as navigation, never `javascript:`/`data:`/etc. */
+function isSafeLinkHref(href: string): boolean {
+  return /^(https?:|mailto:)/i.test(href);
+}
+
 function fontWeightForFamily(
   fontFamily: string | undefined,
   fallback: number,