@agent-native/core 0.161.23 → 0.162.0

package/corpus/templates/slides/actions/_await-fit-check.ts

@@ -94,15 +94,40 @@ export function formatOverflowForTool(
   deckId: string,
   m: SlideFitMeasurement,
 ): string {
+  const hasHorizontal = (m.horizontalOverflow ?? 0) > 0;
+  const hasVertical = m.verticalOverflow > 0;
+
+  // A row of side-by-side cards/columns that's too wide is a *width formula*
+  // bug (fixed px flex-basis, a wrong container-width assumption, a missing
+  // `min-width: 0`), not a density bug. The old list was vertical-only —
+  // "tighten copy" / "fewer stacked cards" — which cannot shrink a fixed
+  // column width no matter how many times it's applied, so a horizontal
+  // overflow looped forever against fixes that could never touch the actual
+  // defect (see the Oliver Robertson Slack thread this regression test
+  // reproduces).
+  const fixes = [
+    ...(hasHorizontal
+      ? [
+          `Use percentage or flex-based column widths (e.g. \`flex: 1 1 0%\` with \`min-width: 0\`, or \`width: calc((100% - <gaps>) / <count>)\` measured against this slide's own content width) instead of a fixed pixel width per column.`,
+          `Reduce the number of side-by-side columns, or wrap to a second row, if the content cannot fit at the slide's actual content width.`,
+        ]
+      : []),
+    ...(hasVertical || !hasHorizontal
+      ? [
+          `Tighten copy — shorter headings/bullets, drop low-value lines.`,
+          `Reduce vertical density — fewer stacked cards, smaller gaps, body font no smaller than 16px.`,
+          `Reduce slide padding (e.g. 40px top/bottom instead of 60-80px).`,
+          `Split across two slides only if the content cannot be compressed.`,
+        ]
+      : []),
+  ];
+
   return [
     ``,
-    `⚠ Layout overflows the canvas${m.verticalOverflow > 0 ? ` vertically by ${m.verticalOverflow}px` : ""}${(m.horizontalOverflow ?? 0) > 0 ? ` and horizontally by ${m.horizontalOverflow}px` : ""} — natural content is ${m.contentWidth ?? "unknown"}x${m.contentHeight}px inside a ${m.viewportWidth ?? "unknown"}x${m.viewportHeight}px content area.`,
+    `⚠ Layout overflows the canvas${hasVertical ? ` vertically by ${m.verticalOverflow}px` : ""}${hasHorizontal ? ` and horizontally by ${m.horizontalOverflow}px` : ""} — natural content is ${m.contentWidth ?? "unknown"}x${m.contentHeight}px inside a ${m.viewportWidth ?? "unknown"}x${m.viewportHeight}px content area.`,
     ``,
     `Make one structural repair now with \`update-slide --deckId ${deckId} --slideId ${m.slideId}\`. Prefer small surgical patches (--find / --replace) over a full rewrite:`,
-    `1. Tighten copy — shorter headings/bullets, drop low-value lines.`,
-    `2. Reduce vertical density — fewer stacked cards, smaller gaps, body font no smaller than 16px.`,
-    `3. Reduce slide padding (e.g. 40px top/bottom instead of 60-80px).`,
-    `4. Split across two slides only if the content cannot be compressed.`,
+    ...fixes.map((fix, index) => `${index + 1}. ${fix}`),
     ``,
     `Do **not** use zoom, \`transform: scale\`, clipping, \`overflow: scroll\`, or a smaller-than-16px body font. Preserve existing absolute text boxes and fix the normal-flow HTML. Verify the action result and then use \`view-screen\`; do not spin through another repair loop.`,
   ].join("\n");

package/corpus/templates/slides/actions/add-slide.ts

@@ -97,6 +97,7 @@ export default defineAction({
     "call it once per slide in slide order and wait for each result before adding the next slide. " +
     "Avoid parallel add-slide calls for the same deck; sequential writes keep the editor and agent connection stable. " +
     "If the deck has a designSystemId, first use `get-design-system` and apply its `agentContext` tokens/docs; do not use generic slide styling from the id alone. " +
+    "Pass presenter-only speaker notes in `notes`; keep them out of the slide HTML. " +
     "Returns the new slide ID, 1-based slideNumber, and updated slide count.",
   schema: z.object({
     deckId: z.string().describe("Target deck ID"),
@@ -120,7 +121,10 @@ export default defineAction({
       ])
       .optional()
       .describe("Layout type hint"),
-    notes: z.string().optional().describe("Speaker notes for this slide"),
+    notes: z
+      .string()
+      .optional()
+      .describe("Optional presenter-only speaker notes; keep them out of HTML"),
     position: z
       .preprocess((value) => {
         if (typeof value !== "string") return value;
@@ -299,7 +303,7 @@ export default defineAction({
         creativeContextReuseLabels: slideReuseLabels,
       };
       if (layout) newSlide.layout = layout;
-      if (notes) newSlide.notes = notes;
+      if (notes !== undefined) newSlide.notes = notes;
 
       const insertIndex =
         typeof position === "number"

package/corpus/templates/slides/actions/create-deck.ts

@@ -96,12 +96,13 @@ export default defineAction({
     "Create a new deck, optionally already populated with slides, or atomically replace all slides in an existing deck. " +
     "For short AI-generated decks in MCP app hosts, pass all generated slides in this call so the real deck editor opens inline already populated. " +
     "For longer decks or live in-app generation, create the deck with slides: [] and then use add-slide sequentially so progress appears live. " +
+    "Pass presenter-only speaker notes in each slide's `notes` field; keep them out of slide HTML. " +
     "Pass deckId to replace an existing deck. " +
     "Returns the deck id, title, and slide count.",
   schema: z.object({
     title: z.string().describe("Deck title"),
     slides: SlidesSchema.describe(
-      "Array of slides with id, content (HTML), and optional layout",
+      "Array of slides with id, content (HTML), optional layout, and presenter-only notes",
     ),
     deckId: z
       .string()

package/corpus/templates/slides/app/lib/create-deck-generation.ts

@@ -376,6 +376,7 @@ export async function startDeckGeneration({
         `After reading any requested or attached reference material, but before adding the first slide, choose a concise, specific deck title from the user's request and source material. Never use the deck id, run id, file id, uploaded filename, or another opaque alphanumeric token as the title. Do not reuse a generic placeholder like "Untitled scene" when the content or reference context gives you a better title. Call \`patch-deck\` with \`deckId: \"${deckId}\"\` and \`operations: [{ \"op\": \"patch-deck-fields\", \"fields\": { \"title\": \"<generated title>\" } }]\`. Include only \`title\` in \`fields\`; omit all other optional fields. Never leave a generated deck named \"Untitled Deck\" or another placeholder.`,
         "If the user asks for a standalone visual, diagram, hero, one-pager, poster, or a couple of visuals, create only the requested one/few polished visual slides. Do not pad the result into a full presentation.",
         "If the request is for a presentation or deck and does not explicitly ask for one slide, infer a coherent multi-slide outline from the scope and keep adding slides until that outline is complete. Do not stop after the first slide just because the prompt has few explicit instructions.",
+        "When the user requests speaker notes, write presenter-only text into each slide's `notes` field and keep it out of the slide HTML.",
         `Add slides ONE AT A TIME using the \`add-slide\` action with --deckId=${deckId}. Wait for each \`add-slide\` result before calling it again; do not batch or parallelize slide writes.`,
         "Use create-deck and add-slide for this already-created deck. Do not call the legacy generate-slides-ai action: it returns Markdown drafts rather than persisted rendered slide HTML. Treat each successful add-slide result as confirmation to continue with the next planned slide.",
       ].join("\n");

package/corpus/templates/slides/app/pages/DeckEditor.tsx

@@ -174,6 +174,27 @@ function MissingDeckAccessPane({
   );
 }
 
+// The Cmd/Ctrl+C-then-V slide-duplicate shortcut can only tell "this key
+// event targets the slide rail/canvas" apart from "focus fell back to
+// nothing because a panel/dialog elsewhere just closed" by checking a
+// deny-list of known text surfaces — and that list can never be complete
+// (see the Andrew Rohman Slack thread this guards against: a slide copied
+// once early in a session kept silently re-duplicating on unrelated later
+// pastes). Bounding how long a copy stays "armed" turns a missed deny-list
+// entry from a silent, indefinite landmine into, at worst, a narrow window
+// that still covers the real copy-then-paste gesture.
+export const SLIDE_CLIPBOARD_ARM_WINDOW_MS = 30_000;
+
+/** True when a Cmd/Ctrl+V should still be treated as "paste the slide that
+ * was just copied" rather than unrelated clipboard activity landing outside
+ * every recognized text field. */
+export function isSlideClipboardStillArmed(
+  armedAt: number | null,
+  now: number = Date.now(),
+): boolean {
+  return armedAt !== null && now - armedAt <= SLIDE_CLIPBOARD_ARM_WINDOW_MS;
+}
+
 export default function DeckEditor() {
   const t = useT();
   const { id } = useParams<{ id: string }>();
@@ -861,6 +882,11 @@ export default function DeckEditor() {
   // (rather than just an id) so paste still works after Cut has already
   // removed the original slide from the deck.
   const slideClipboardRef = useRef<Slide | null>(null);
+  // Only gates the ambient document-level Cmd/Ctrl+V shortcut below — the
+  // rail's right-click "Paste" menu item is an explicit click with no
+  // ambiguity risk, so it keeps working off `hasSlideClipboard` alone however
+  // long ago the copy happened.
+  const slideClipboardArmedAtRef = useRef<number | null>(null);
   const [hasSlideClipboard, setHasSlideClipboard] = useState(false);
 
   const copySlide = useCallback(
@@ -868,6 +894,7 @@ export default function DeckEditor() {
       const slide = deck?.slides.find((s) => s.id === slideId);
       if (!slide) return;
       slideClipboardRef.current = slide;
+      slideClipboardArmedAtRef.current = Date.now();
       setHasSlideClipboard(true);
     },
     [deck],
@@ -879,6 +906,7 @@ export default function DeckEditor() {
       const slide = deck.slides.find((s) => s.id === slideId);
       if (!slide) return;
       slideClipboardRef.current = slide;
+      slideClipboardArmedAtRef.current = Date.now();
       setHasSlideClipboard(true);
       const idx = deck.slides.findIndex((s) => s.id === slideId);
       const nextSlide = deck.slides[idx + 1] || deck.slides[idx - 1];
@@ -1029,7 +1057,12 @@ export default function DeckEditor() {
         return;
       }
 
-      if (!hasSlideClipboard || !activeSlideId) return;
+      if (
+        !hasSlideClipboard ||
+        !activeSlideId ||
+        !isSlideClipboardStillArmed(slideClipboardArmedAtRef.current)
+      )
+        return;
       e.preventDefault();
       pasteSlideAfter(activeSlideId);
     };

package/corpus/templates/slides/app/routes/p.$id.tsx

@@ -81,7 +81,9 @@ function toSharedDeck(row: {
   return {
     title: row.title || data.title || "Untitled",
     slides: Array.isArray(data.slides)
-      ? data.slides.map((slide, index) => toSharedDeckSlide(slide, index))
+      ? data.slides.map((slide, index) =>
+          toSharedDeckSlide(slide, index, { includeNotes: false }),
+        )
       : [],
     aspectRatio: data.aspectRatio,
   };

package/corpus/templates/slides/changelog/2026-08-18-generated-slides-preserve-speaker-notes.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-18
+---
+
+Generated slides now preserve requested speaker notes.

package/corpus/templates/slides/server/handlers/assets.ts

@@ -1,7 +1,6 @@
 import path from "path";
 
 import { uploadFile } from "@agent-native/core/file-upload";
-import { getSession } from "@agent-native/core/server";
 import { runWithRequestContext } from "@agent-native/core/server";
 import { and, desc, eq } from "drizzle-orm";
 import {
@@ -13,6 +12,12 @@ import {
 import { nanoid } from "nanoid";
 
 import { getDb, schema } from "../db/index.js";
+import {
+  resolveSlidesRequestAuth,
+  type SlidesRequestAuthContext,
+} from "./request-auth-context.js";
+
+type AuthedSlidesSession = SlidesRequestAuthContext & { email: string };
 
 export const MAX_ASSET_FILE_SIZE = 10 * 1024 * 1024; // 10 MB
 
@@ -32,13 +37,19 @@ export interface ListedUploadedAsset {
   createdAt: string;
 }
 
-async function requireSession(event: Parameters<typeof getSession>[0]) {
-  const session = await getSession(event).catch(() => null);
-  if (!session?.email) {
+async function requireSession(
+  event: Parameters<typeof resolveSlidesRequestAuth>[0],
+): Promise<{ session: AuthedSlidesSession | null; error: string | null }> {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { session: null, error: auth.error };
+  }
+  if (!auth.context.email) {
     setResponseStatus(event, 401);
-    return null;
+    return { session: null, error: "Unauthorized" };
   }
-  return session;
+  return { session: auth.context as AuthedSlidesSession, error: null };
 }
 
 function isRasterAssetExtension(ext: string): boolean {
@@ -180,9 +191,9 @@ export async function uploadImageAsset(args: {
  * framework provider chain, return its hosted URL.
  */
 export const uploadAsset = defineEventHandler(async (event) => {
-  const session = await requireSession(event);
+  const { session, error: authError } = await requireSession(event);
   if (!session) {
-    return { error: "Unauthorized" };
+    return { error: authError };
   }
 
   const parts = await readMultipartFormData(event);
@@ -217,9 +228,9 @@ export const uploadAsset = defineEventHandler(async (event) => {
  * GET /api/assets — list assets this user has uploaded, most recent first.
  */
 export const listAssets = defineEventHandler(async (event) => {
-  const session = await requireSession(event);
+  const { session, error } = await requireSession(event);
   if (!session) {
-    return { error: "Unauthorized" };
+    return { error };
   }
   const db = getDb();
   const rows: ListedUploadedAsset[] = await db
@@ -244,9 +255,9 @@ export const listAssets = defineEventHandler(async (event) => {
  * that provider's own API — but it no longer appears in this app's library.
  */
 export const deleteAsset = defineEventHandler(async (event) => {
-  const session = await requireSession(event);
+  const { session, error } = await requireSession(event);
   if (!session) {
-    return { error: "Unauthorized" };
+    return { error };
   }
   const id = getRouterParam(event, "id");
   if (!id) {

package/corpus/templates/slides/server/handlers/design-system-decode-job-status.ts

@@ -1,11 +1,13 @@
 import {
   FeatureNotConfiguredError,
   fetchBuilderDesignSystemDecodeJobStatus,
-  getSession,
 } from "@agent-native/core/server";
 import { defineEventHandler, getQuery, setResponseStatus } from "h3";
 
-import { withSlidesRequestContext } from "./request-auth-context.js";
+import {
+  resolveSlidesRequestAuth,
+  withSlidesRequestContext,
+} from "./request-auth-context.js";
 
 /**
  * Reads a Builder design-system decode job's status. The UI polls this after
@@ -13,8 +15,13 @@ import { withSlidesRequestContext } from "./request-auth-context.js";
  * job leaves `pending` and exposes a `branchUrl` (or reports an `error`).
  */
 export const designSystemDecodeJobStatus = defineEventHandler(async (event) => {
-  const session = await getSession(event).catch(() => null);
-  if (!session?.email) {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const session = auth.context;
+  if (!session.email) {
     setResponseStatus(event, 401);
     return { error: "Unauthorized" };
   }
@@ -26,8 +33,10 @@ export const designSystemDecodeJobStatus = defineEventHandler(async (event) => {
   }
 
   try {
-    return await withSlidesRequestContext(event, () =>
-      fetchBuilderDesignSystemDecodeJobStatus(jobId.trim()),
+    return await withSlidesRequestContext(
+      event,
+      () => fetchBuilderDesignSystemDecodeJobStatus(jobId.trim()),
+      session,
     );
   } catch (err) {
     if (err instanceof FeatureNotConfiguredError) {

package/corpus/templates/slides/server/handlers/design-system-upload-start.ts

@@ -1,11 +1,13 @@
 import {
   FeatureNotConfiguredError,
-  getSession,
   startBuilderDesignSystemUpload,
 } from "@agent-native/core/server";
 import { defineEventHandler, readBody, setResponseStatus } from "h3";
 
-import { withSlidesRequestContext } from "./request-auth-context.js";
+import {
+  resolveSlidesRequestAuth,
+  withSlidesRequestContext,
+} from "./request-auth-context.js";
 
 const MAX_FIG_BYTES = 512 * 1024 * 1024;
 
@@ -21,8 +23,13 @@ interface AttachmentInput {
  * server; the file bytes never do.
  */
 export const designSystemUploadStart = defineEventHandler(async (event) => {
-  const session = await getSession(event).catch(() => null);
-  if (!session?.email) {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const session = auth.context;
+  if (!session.email) {
     setResponseStatus(event, 401);
     return { error: "Unauthorized" };
   }
@@ -66,8 +73,10 @@ export const designSystemUploadStart = defineEventHandler(async (event) => {
   }
 
   try {
-    const uploads = await withSlidesRequestContext(event, () =>
-      startBuilderDesignSystemUpload(attachments),
+    const uploads = await withSlidesRequestContext(
+      event,
+      () => startBuilderDesignSystemUpload(attachments),
+      session,
     );
     return { uploads };
   } catch (err) {

package/corpus/templates/slides/server/handlers/index-design-system-sources.ts

@@ -1,12 +1,14 @@
 import {
   FeatureNotConfiguredError,
-  getSession,
   indexBuilderDesignSystem,
 } from "@agent-native/core/server";
 import { defineEventHandler, readBody, setResponseStatus } from "h3";
 
 import { upsertBuilderProxyDesignSystem } from "../lib/builder-design-system-proxy.js";
-import { withSlidesRequestContext } from "./request-auth-context.js";
+import {
+  resolveSlidesRequestAuth,
+  withSlidesRequestContext,
+} from "./request-auth-context.js";
 
 /**
  * Finalizes Builder DSI indexing from upload tokens produced by the
@@ -14,8 +16,14 @@ import { withSlidesRequestContext } from "./request-auth-context.js";
  * storage; this endpoint only forwards the opaque tokens.
  */
 export const indexDesignSystemSources = defineEventHandler(async (event) => {
-  const session = await getSession(event).catch(() => null);
-  if (!session?.email) {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const session = auth.context;
+  const sessionEmail = session.email;
+  if (!sessionEmail) {
     setResponseStatus(event, 401);
     return { error: "Unauthorized" };
   }
@@ -45,21 +53,28 @@ export const indexDesignSystemSources = defineEventHandler(async (event) => {
   }));
 
   try {
-    return await withSlidesRequestContext(event, async ({ email, orgId }) => {
-      const result = await indexBuilderDesignSystem({ sources, projectName });
-      const proxy = await upsertBuilderProxyDesignSystem({
-        result,
-        ownerEmail: email ?? session.email,
-        orgId: orgId ?? null,
-        projectName,
-        sourceKind: "figma",
-      });
-      return {
-        ...result,
-        ...proxy,
-        uploadedFileCount: uploadTokens.length,
-      };
-    });
+    return await withSlidesRequestContext(
+      event,
+      async ({ email, orgId }) => {
+        const result = await indexBuilderDesignSystem({
+          sources,
+          projectName,
+        });
+        const proxy = await upsertBuilderProxyDesignSystem({
+          result,
+          ownerEmail: email ?? sessionEmail,
+          orgId: orgId ?? null,
+          projectName,
+          sourceKind: "figma",
+        });
+        return {
+          ...result,
+          ...proxy,
+          uploadedFileCount: uploadTokens.length,
+        };
+      },
+      session,
+    );
   } catch (err) {
     if (err instanceof FeatureNotConfiguredError) {
       setResponseStatus(event, 412);

package/corpus/templates/slides/server/handlers/share.ts

@@ -116,7 +116,7 @@ async function createShareLink(event: any, deckId: string) {
   }
 
   const slides = storedDeck.slides.map((slide: unknown, index: number) =>
-    toSharedDeckSlide(slide, index),
+    toSharedDeckSlide(slide, index, { includeNotes: false }),
   );
 
   await db.insert(schema.deckShareLinks).values({

package/corpus/templates/slides/server/plugins/agent-chat.ts

@@ -57,7 +57,7 @@ export default createAgentChatPlugin({
     return authContext.orgId === undefined ? null : authContext.orgId;
   },
   prepareRequest: prepareSlidesChatAttachments,
-  systemPrompt: `You are an AI deck assistant. You create, edit, import, export, style, share, and navigate decks through actions and shared application state. For a newly created presentation, use create-deck with slides: [] only when you are creating the deck yourself, then add-slide sequentially with full rendered HTML. The legacy generate-slides-ai action returns Markdown drafts and is not part of the persisted presentation workflow.
+  systemPrompt: `You are an AI deck assistant. You create, edit, import, export, style, share, and navigate decks through actions and shared application state. For a newly created presentation, use create-deck with slides: [] only when you are creating the deck yourself, then add-slide sequentially with full rendered HTML. The legacy generate-slides-ai action returns Markdown drafts and is not part of the persisted presentation workflow. When speaker notes are requested, keep presenter-only text in each slide's notes field rather than the slide HTML, and preserve notes during source-preserving edits.
 
 When the user asks to improve, beautify, restyle, or make an uploaded/existing deck on-brand, treat it as an in-place source-preserving edit unless the user explicitly asks to rewrite the story or change slide count. First call view-screen when the active deck is unclear, then get-deck with compact=true for deck orientation. If you need slide markup, call get-deck with compact=false explicitly and only when the edit requires the full HTML. If get-deck.sourceImport exists, preserve its slide count, order, IDs, factual copy, notes, images, charts, tables, diagrams, freeform objects, and source aspect ratio. For a deck-wide restyle, use one patch-deck call with requireAllSourceSlides=true and one patch-slide operation with fields.content for every source slide ID; the action rejects partial coverage. Do not split a full-deck restyle into arbitrary batches or use one-by-one update-slide calls - reserve update-slide for targeted one-slide edits. After the patch succeeds, verify with get-deck using compact=true so the verification does not retransmit every slide's HTML. Do not claim a partial or initial pass. Do not use add-slide, delete, reorder, or replace source imagery with generic cards for this workflow. If sourceImport.fidelity is partial or imagesSkipped is nonzero, stop and report the exact fidelity warning instead of claiming a reliable improvement.
 For a targeted one-slide edit, prefer get-deck with the stable slideId from view-screen or compact get-deck. It returns only that slide's full HTML by default, so do not load the full deck when one slide is enough. For code-style edits, request compact=false and format=true, then call update-slide with that slide's contentHash as baseContentHash and an ordered edits list. Use exact replace, insert-before/after, replace-between, or regex-replace edits; include expectedMatches for ambiguous markers. The action applies the whole list atomically under the deck lock, so a failed required match writes nothing. Set format=true on update-slide when readable line breaks should be persisted. Use fullContent only for an intentional full rewrite. Pass compact=true when you only need a lightweight check of that slide.

package/corpus/templates/slides/server/routes/api/deck-agent-context.json.get.ts

@@ -77,7 +77,7 @@ export default defineEventHandler(async (event) => {
   const data = parseDeckData(deck.data);
   const slides = Array.isArray(data.slides)
     ? data.slides.map((slide: unknown, index: number) =>
-        toSharedDeckSlide(slide, index),
+        toSharedDeckSlide(slide, index, { includeNotes: false }),
       )
     : [];
 

package/corpus/templates/slides/server/routes/api/exports/[filename].get.ts

@@ -2,9 +2,10 @@ import { createReadStream } from "fs";
 import { stat } from "fs/promises";
 import path from "path";
 
-import { getSession, streamFile } from "@agent-native/core/server";
+import { streamFile } from "@agent-native/core/server";
 import { defineEventHandler, getRouterParam, setResponseStatus } from "h3";
 
+import { resolveSlidesRequestAuth } from "../../../handlers/request-auth-context.js";
 import { tenantExportDir } from "../../../lib/tenant-files.js";
 
 const CONTENT_TYPES: Record<string, string> = {
@@ -15,8 +16,13 @@ const CONTENT_TYPES: Record<string, string> = {
 };
 
 export default defineEventHandler(async (event) => {
-  const session = await getSession(event).catch(() => null);
-  if (!session?.email) {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const session = auth.context;
+  if (!session.email) {
     setResponseStatus(event, 401);
     return { error: "Unauthorized" };
   }

package/corpus/templates/slides/server/routes/api/exports/google-slides.post.ts

@@ -1,10 +1,11 @@
-import { getSession, runWithRequestContext } from "@agent-native/core/server";
+import { runWithRequestContext } from "@agent-native/core/server";
 import {
   defineEventHandler,
   readMultipartFormData,
   setResponseStatus,
 } from "h3";
 
+import { resolveSlidesRequestAuth } from "../../../handlers/request-auth-context.js";
 import { getGoogleDocsAccessToken } from "../../../lib/google-docs-oauth.js";
 
 const PPTX_CONTENT_TYPE =
@@ -28,8 +29,14 @@ const UPLOAD_URL =
  * See "Export Behavior" in `templates/slides/AGENTS.md` for the routing rule.
  */
 export default defineEventHandler(async (event) => {
-  const session = await getSession(event).catch(() => null);
-  if (!session?.email) {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const session = auth.context;
+  const sessionEmail = session.email;
+  if (!sessionEmail) {
     setResponseStatus(event, 401);
     return { error: "Unauthorized" };
   }
@@ -50,8 +57,8 @@ export default defineEventHandler(async (event) => {
   // be org-scoped vault secrets, and resolving them without the org reports the
   // integration as unconfigured.
   const account = await runWithRequestContext(
-    { userEmail: session.email, orgId: session.orgId },
-    () => getGoogleDocsAccessToken(session.email),
+    { userEmail: sessionEmail, orgId: session.orgId },
+    () => getGoogleDocsAccessToken(sessionEmail),
   );
   if (!account) {
     setResponseStatus(event, 409);

package/corpus/templates/slides/server/routes/api/exports/html.post.ts

@@ -1,17 +1,19 @@
 import path from "path";
 
-import {
-  getSession,
-  readBody,
-  runWithRequestContext,
-} from "@agent-native/core/server";
+import { readBody, runWithRequestContext } from "@agent-native/core/server";
 import { defineEventHandler, setResponseStatus } from "h3";
 
 import exportHtmlAction from "../../../../actions/export-html.js";
+import { resolveSlidesRequestAuth } from "../../../handlers/request-auth-context.js";
 
 export default defineEventHandler(async (event) => {
-  const session = await getSession(event).catch(() => null);
-  if (!session?.email) {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const session = auth.context;
+  if (!session.email) {
     setResponseStatus(event, 401);
     return { error: "Unauthorized" };
   }

package/corpus/templates/slides/server/routes/api/exports/pptx.post.ts

@@ -1,20 +1,22 @@
 import path from "path";
 
-import {
-  getSession,
-  readBody,
-  runWithRequestContext,
-} from "@agent-native/core/server";
+import { readBody, runWithRequestContext } from "@agent-native/core/server";
 import { defineEventHandler, setResponseStatus } from "h3";
 
 import exportPptxAction from "../../../../actions/export-pptx.js";
+import { resolveSlidesRequestAuth } from "../../../handlers/request-auth-context.js";
 
 const PPTX_CONTENT_TYPE =
   "application/vnd.openxmlformats-officedocument.presentationml.presentation";
 
 export default defineEventHandler(async (event) => {
-  const session = await getSession(event).catch(() => null);
-  if (!session?.email) {
+  const auth = await resolveSlidesRequestAuth(event);
+  if (!auth.ok) {
+    setResponseStatus(event, auth.statusCode);
+    return { error: auth.error };
+  }
+  const session = auth.context;
+  if (!session.email) {
     setResponseStatus(event, 401);
     return { error: "Unauthorized" };
   }

package/corpus/templates/slides/shared/api.ts

@@ -126,6 +126,11 @@ export interface SharedDeckSlide {
   splitByParagraph?: boolean;
 }
 
+export interface SharedDeckSlideOptions {
+  /** Include presenter-only notes for an authenticated internal read. */
+  includeNotes?: boolean;
+}
+
 const SHARED_SLIDE_TRANSITIONS = new Set<SharedSlideTransition>([
   "instant",
   "none",
@@ -216,12 +221,13 @@ function normalizeSlideAnimation(
 export function toSharedDeckSlide(
   value: unknown,
   index: number,
+  options: SharedDeckSlideOptions = {},
 ): SharedDeckSlide {
   const slide = isRecord(value) ? value : {};
   const shared: SharedDeckSlide = {
     id: normalizeString(slide.id, `slide-${index + 1}`),
     content: normalizeString(slide.content, ""),
-    notes: "",
+    notes: options.includeNotes ? normalizeString(slide.notes, "") : "",
     layout: normalizeString(slide.layout, "content"),
   };
 

package/corpus/templates/tasks/.agents/skills/real-time-sync/SKILL.md

@@ -50,7 +50,7 @@ The agent modifies data in SQL, but the UI runs in the browser. SSE bridges same
 
    For list/sidebar queries, use the same pattern — pass the counter into the queryKey of every list query you want to keep fresh.
 
-4. **Fallback** polling calls `/_agent-native/poll?since=N`. It runs every 2 seconds until SSE is connected, then relaxes to 15 seconds (`SSE_FALLBACK_INTERVAL_MS`). If SSE is disabled or unavailable (e.g., edge/serverless deployments), polling continues at the 2 s cadence. Polling is the universal serverless fallback: new framework writes are read from the durable `sync_events` log, while the older DB timestamp scan remains as a slower safety net for direct SQL writes and older processes.
+4. **Fallback** polling calls `/_agent-native/poll?since=N`. It polls every 2 seconds only while an agent run is in flight; otherwise it idles at 60 seconds whether or not SSE is connected (`SSE_FALLBACK_INTERVAL_MS` and `IDLE_POLL_INTERVAL_MS`, both 60 s). A hidden tab polls no faster than every 10 seconds (`HIDDEN_POLL_INTERVAL_MS`). Polling is the universal serverless fallback: new framework writes are read from the durable `sync_events` log, while the older DB timestamp scan remains as a slower safety net for direct SQL writes and older processes.
 
 5. When the agent writes to the database, the version increments, SSE/polling detects it, and React Query refetches the affected queries.