@agent-native/core 0.161.7 → 0.161.9

package/corpus/templates/design/server/lib/fusion-screens.ts

@@ -32,6 +32,8 @@ import {
 import { getDb, schema } from "../db/index.js";
 import { mutateDesignData } from "./design-data-mutation.js";
 
+const PATH_BASE_PLACEHOLDER = "http://fusion-screen-base.invalid";
+
 /** Default iframe viewport, mirroring add-localhost-screens' defaults. */
 export const DEFAULT_FUSION_SCREEN_WIDTH = 1280;
 export const DEFAULT_FUSION_SCREEN_HEIGHT = 900;
@@ -129,9 +131,23 @@ export async function upsertFusionScreens(args: {
 
   const results: FusionScreenResult[] = [];
 
+  // The base may carry a path prefix (the builder-host preview proxy), so route
+  // paths join onto it rather than resolve against it: `new URL("/", base)`
+  // would drop the prefix and point at the origin root.
+  const originRelativeBase = previewUrl.startsWith("/");
+  const baseWithSlash = previewUrl.endsWith("/")
+    ? previewUrl
+    : `${previewUrl}/`;
+  const resolutionBase = originRelativeBase
+    ? new URL(baseWithSlash, PATH_BASE_PLACEHOLDER).toString()
+    : baseWithSlash;
+
   for (let index = 0; index < paths.length; index += 1) {
     const path = paths[index]!;
-    const url = new URL(path, previewUrl).toString();
+    const screenUrl = new URL(path.replace(/^\/+/, ""), resolutionBase);
+    const url = originRelativeBase
+      ? `${screenUrl.pathname}${screenUrl.search}`
+      : screenUrl.toString();
     const preferredFilename = `fusion-${slugForPath(path)}.html`;
     const existing = existingByFilename.get(preferredFilename);
     const filename = existing?.filename ?? uniqueFilename(path, usedFilenames);

package/corpus/templates/design/server/plugins/builder-host-embed-headers.ts

@@ -0,0 +1,37 @@
+/**
+ * `require-corp` would make the browser reject the containers this canvas frames,
+ * and they cannot opt in via CORP. `frame-ancestors` replaces the embed token as
+ * the limit on who may embed this route. A `response` hook, not middleware: core
+ * sets its security headers from a plugin, which runs later.
+ */
+import { getRequestURL, type H3Event } from "h3";
+
+import { SHELL_CANVAS_PATH } from "../../shared/shell-screens.js";
+
+const BUILDER_FRAME_ANCESTORS = [
+  "https://builder.io",
+  "https://*.builder.io",
+  "https://*.builder.my",
+  "http://localhost:*",
+  "http://127.0.0.1:*",
+].join(" ");
+
+export function isShellCanvasRequest(event: H3Event): boolean {
+  try {
+    return getRequestURL(event).pathname === SHELL_CANVAS_PATH;
+    // coercion-ok: an unparseable URL is not the shell route.
+  } catch {
+    return false;
+  }
+}
+
+export default (nitroApp: any): void => {
+  nitroApp.hooks.hook("response", (res: Response, event: H3Event) => {
+    if (!isShellCanvasRequest(event)) return;
+    res.headers.set("Cross-Origin-Embedder-Policy", "unsafe-none");
+    res.headers.set(
+      "Content-Security-Policy",
+      `frame-ancestors ${BUILDER_FRAME_ANCESTORS}`,
+    );
+  });
+};

package/corpus/templates/design/server/routes/[...page].get.ts

@@ -10,6 +10,7 @@ import {
 } from "@agent-native/core/shared";
 import {
   defineEventHandler,
+  getHeader,
   getQuery,
   getRequestURL,
   setResponseHeader,

package/corpus/templates/design/shared/builder-preview-url.ts

@@ -0,0 +1,113 @@
+/**
+ * Validation for Builder Fusion container preview URLs. Stops the seam becoming
+ * an open embed primitive pointed at an internal address. Mirrors
+ * builder-internal's list (`packages/app/models/fusion.model.tsx` —
+ * search `builderio.xyz`); keep the two in sync.
+ */
+
+const BUILDER_PREVIEW_HOST_SUFFIXES = [
+  ".fly.dev",
+  ".builderio.xyz",
+  ".builderio.dev",
+  ".builder.codes",
+  ".builder.my",
+  ".builder.live",
+] as const;
+
+const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+
+/**
+ * Development only, and fail closed: the proxy fetches this URL from the
+ * server, so in production a loopback host means scanning the Design host
+ * itself on a caller's behalf.
+ */
+export function isLoopbackPreviewAllowed(): boolean {
+  const nodeEnv =
+    typeof process === "undefined" ? undefined : process.env?.NODE_ENV;
+  // Wins over the bundler flag: a dev-mode bundle served by a production
+  // process is still production.
+  if (nodeEnv === "production") return false;
+  if (nodeEnv === "development" || nodeEnv === "test") return true;
+  const viteEnv = (import.meta as { env?: { DEV?: boolean } }).env;
+  return viteEnv?.DEV === true;
+}
+
+export class InvalidBuilderPreviewUrlError extends Error {
+  constructor(reason: string) {
+    super(`Invalid Builder preview URL: ${reason}`);
+    this.name = "InvalidBuilderPreviewUrlError";
+  }
+}
+
+function isLoopbackHostname(hostname: string): boolean {
+  return LOOPBACK_HOSTNAMES.has(hostname);
+}
+
+/**
+ * Parse and validate a preview URL, returning its normalized form. Throws
+ * rather than returning null so a rejected URL is never indistinguishable from
+ * an absent one — a bad init must not quietly place zero screens and read as an
+ * empty design.
+ */
+export function parseBuilderPreviewUrl(raw: unknown): URL {
+  if (typeof raw !== "string" || !raw.trim()) {
+    throw new InvalidBuilderPreviewUrlError("must be a non-empty string");
+  }
+
+  let url: URL;
+  try {
+    url = new URL(raw.trim());
+  } catch {
+    throw new InvalidBuilderPreviewUrlError(`could not parse "${raw}"`);
+  }
+
+  // Credentials would be replayed by the iframe on every request.
+  if (url.username || url.password) {
+    throw new InvalidBuilderPreviewUrlError("must not embed credentials");
+  }
+
+  const hostname = url.hostname.toLowerCase();
+  if (isLoopbackHostname(hostname) && !isLoopbackPreviewAllowed()) {
+    throw new InvalidBuilderPreviewUrlError(
+      "loopback hosts are only allowed in development",
+    );
+  }
+  const loopback = isLoopbackHostname(hostname);
+
+  if (url.protocol !== "https:" && !(loopback && url.protocol === "http:")) {
+    throw new InvalidBuilderPreviewUrlError(
+      `must use https (got "${url.protocol}")`,
+    );
+  }
+
+  if (
+    !loopback &&
+    !BUILDER_PREVIEW_HOST_SUFFIXES.some((suffix) => hostname.endsWith(suffix))
+  ) {
+    throw new InvalidBuilderPreviewUrlError(
+      `host "${hostname}" is not a recognized Builder preview host`,
+    );
+  }
+
+  return url;
+}
+
+/** Non-throwing form, for UI that wants to branch instead of failing. */
+/**
+ * Origin only. `interactiveFrameUrl` carries whatever route the user is
+ * previewing, and resolving screen paths against that base nests them under it
+ * (`/app.html` + `/about` → `/app.html/about`).
+ */
+export function builderPreviewOrigin(raw: unknown): string {
+  return parseBuilderPreviewUrl(raw).origin;
+}
+
+export function isBuilderPreviewUrl(raw: unknown): boolean {
+  try {
+    parseBuilderPreviewUrl(raw);
+    return true;
+    // coercion-ok: "does not parse" is what this predicate reports as false.
+  } catch {
+    return false;
+  }
+}

package/corpus/templates/design/shared/full-app.ts

@@ -29,11 +29,23 @@ export const FULL_APP_BUILDING = defineFeatureFlag({
 
 export type DesignFusionAppStatus = "building" | "ready" | "error";
 
+/**
+ * How the linkage was established. `builder-host` (opened from builder.io's
+ * embedded Design tab) never provisions or deploys the container — Builder owns
+ * it, and Builder's chat session drives it. Absent means `design-app`.
+ */
+export type DesignFusionAppSource = "design-app" | "builder-host";
+
 export interface DesignFusionApp {
   /** Builder project id the app branch lives in. */
   projectId: string;
   /** Branch backing this design (one branch per design). */
   branchName: string;
+  source?: DesignFusionAppSource;
+  /** Builder organization owning the project. Set for `builder-host` designs. */
+  builderOrgId?: string;
+  /** Builder content id the tab was opened from, when there is one. */
+  contentId?: string;
   /** Builder visual-editor URL for the branch (progress/debugging). */
   editorUrl?: string;
   /** Container dev-server URL once the container is ready; iframe-able. */
@@ -94,10 +106,17 @@ export function readFusionApp(data: unknown): DesignFusionApp | null {
     app.status === "ready" || app.status === "error" ? app.status : "building";
   const str = (value: unknown): string | undefined =>
     typeof value === "string" && value ? value : undefined;
+  const source: DesignFusionAppSource | undefined =
+    app.source === "builder-host" || app.source === "design-app"
+      ? app.source
+      : undefined;
   return {
     projectId,
     branchName,
     status,
+    source,
+    builderOrgId: str(app.builderOrgId),
+    contentId: str(app.contentId),
     editorUrl: str(app.editorUrl),
     previewUrl: str(app.previewUrl),
     statusMessage: str(app.statusMessage),

package/corpus/templates/design/shared/shell-screens.ts

@@ -0,0 +1,139 @@
+/**
+ * Builds the same `{ screens, placedFrames }` shape as `upsertFusionScreens`,
+ * but in memory and without a database, for a canvas the host drives entirely
+ * over postMessage. Keep the derivations here identical to the server version:
+ * a screen that changes shape between the two paths changes fileIds, and the
+ * canvas keys selection and frame geometry on those.
+ */
+
+import type { CanvasFramePlacement } from "./canvas-frames.js";
+
+/** The host-driven canvas route: no design row, no session, no server writes. */
+export const SHELL_CANVAS_PATH = "/visual-edit/shell";
+
+/** Mirrors add-localhost-screens' defaults, as the server builder does. */
+export const DEFAULT_SHELL_SCREEN_WIDTH = 1280;
+export const DEFAULT_SHELL_SCREEN_HEIGHT = 900;
+const DEFAULT_SHELL_GAP = 160;
+export const MAX_SHELL_SCREENS = 100;
+
+export interface ShellScreen {
+  fileId: string;
+  filename: string;
+  path: string;
+  url: string;
+  title: string;
+  width: number;
+  height: number;
+}
+
+export interface ShellScreensResult {
+  screens: ShellScreen[];
+  placedFrames: Array<{
+    fileId: string;
+    filename?: string;
+    frame: CanvasFramePlacement;
+  }>;
+}
+
+function slugForPath(path: string): string {
+  const slug = path
+    .replace(/^\/+/, "")
+    .replace(/[^a-zA-Z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "")
+    .toLowerCase();
+  return (slug || "home").slice(0, 80);
+}
+
+function titleFromPath(path: string): string {
+  const trimmed = path.replace(/^\/+|\/+$/g, "");
+  if (!trimmed) return "Home";
+  const last = trimmed.split("/").pop() ?? trimmed;
+  return last.replace(/[-_]+/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+}
+
+function uniqueFilename(path: string, used: Set<string>): string {
+  const base = `fusion-${slugForPath(path)}.html`;
+  let filename = base;
+  let suffix = 2;
+  while (used.has(filename)) {
+    filename = `${base.replace(/\.html$/, "")}-${suffix}.html`;
+    suffix += 1;
+  }
+  used.add(filename);
+  return filename;
+}
+
+/**
+ * Derived from the filename rather than random: a remount must produce the same
+ * ids or the canvas loses selection and frame geometry on every reload.
+ */
+function shellFileId(filename: string): string {
+  return `shell-${filename.replace(/\.html$/, "")}`;
+}
+
+export function buildShellScreens(args: {
+  previewOrigin: string;
+  paths: string[];
+  width?: number;
+  height?: number;
+  startX?: number;
+  startY?: number;
+  gap?: number;
+}): ShellScreensResult {
+  const {
+    previewOrigin,
+    paths,
+    width = DEFAULT_SHELL_SCREEN_WIDTH,
+    height = DEFAULT_SHELL_SCREEN_HEIGHT,
+    startX = 0,
+    startY = 0,
+    gap = DEFAULT_SHELL_GAP,
+  } = args;
+
+  const baseWithSlash = previewOrigin.endsWith("/")
+    ? previewOrigin
+    : `${previewOrigin}/`;
+  const baseOrigin = new URL(baseWithSlash).origin;
+
+  const used = new Set<string>();
+  const screens: ShellScreen[] = [];
+  const placedFrames: ShellScreensResult["placedFrames"] = [];
+  const seenPaths = new Set<string>();
+  let nextX = startX;
+
+  // The host assembles this list from a repo parse plus visited URLs, so a bad
+  // parse must not mount hundreds of live iframes. Well above any real route
+  // count, so it only ever trips on pathological input.
+  for (const rawPath of paths.slice(0, MAX_SHELL_SCREENS)) {
+    const path = rawPath.startsWith("/") ? rawPath : `/${rawPath}`;
+    // A duplicate path would otherwise get a second frame stacked on the first.
+    if (seenPaths.has(path)) continue;
+    seenPaths.add(path);
+
+    // `\\host` survives the leading-slash strip and resolves protocol-relative,
+    // so a route from the host could otherwise place a frame on another origin.
+    const resolved = new URL(path.replace(/^\/+/, ""), baseWithSlash);
+    if (resolved.origin !== baseOrigin) continue;
+
+    const filename = uniqueFilename(path, used);
+    const fileId = shellFileId(filename);
+    screens.push({
+      fileId,
+      filename,
+      path,
+      url: resolved.toString(),
+      title: titleFromPath(path),
+      width,
+      height,
+    });
+    placedFrames.push({
+      fileId,
+      filename,
+      frame: { fileId, filename, x: nextX, y: startY, width, height },
+    });
+    nextX += width + gap;
+  }
+
+  return { screens, placedFrames };
+}

package/corpus/templates/design/shared/source-mode.ts

@@ -420,6 +420,16 @@ export function isDesignSourceType(value: unknown): value is DesignSourceType {
   );
 }
 
+/**
+ * Screens whose content is a URL into a running app. Their markup lives in the
+ * app's source, so every edit is a handoff, never a design-file write — the
+ * distinction the editor keeps having to make, and keeps making per-call-site.
+ */
+export function isRunningAppSourceType(value: unknown): boolean {
+  const sourceType = normalizeDesignSourceType(value);
+  return sourceType === "localhost" || sourceType === "fusion";
+}
+
 export function normalizeDesignSourceType(
   value: unknown,
 ): DesignSourceType | null {

package/corpus/templates/slides/.agents/skills/slide-editing/SKILL.md

@@ -90,6 +90,15 @@ To edit a slide's content:
    preserve quote, speaker, date, metric, and uncertainty status. Existing HTML
    or visual similarity is not proof of source fidelity.
 
+## Skipping a Slide
+
+Set a slide's `skipped: true` via a `patch-deck` `patch-slide` operation to
+exclude it from Present/Presenter playback without deleting it — the slide
+stays in the deck, editor, and exports. Set `skipped: false` (or omit it) to
+include it again. The rail's right-click menu on each slide thumbnail offers
+Cut, Copy, Paste, Delete, New slide, Duplicate slide, and Skip slide as the
+same operations.
+
 ## Click-to-reveal animations
 
 Animations are metadata over the final slide HTML, not alternate slide markup.

package/corpus/templates/slides/actions/patch-deck.ts

@@ -113,6 +113,12 @@ const SlideFieldsSchema = z.object({
     .describe(
       "Complete ordered on-click reveal list. Include every intended target in order; unlisted elements remain visible. Use elementPath from the final HTML and 0-based indexes.",
     ),
+  skipped: z
+    .boolean()
+    .optional()
+    .describe(
+      "Exclude this slide from Present/Presenter playback without deleting it.",
+    ),
 });
 
 /** Update fields on a single existing slide */
@@ -165,6 +171,7 @@ const AddSlideOp = z.object({
         .optional(),
       animations: z.array(z.unknown()).optional(),
       splitByParagraph: z.boolean().optional(),
+      skipped: z.boolean().optional(),
     })
     .passthrough(),
 });
@@ -346,6 +353,7 @@ export function applyOperation(deck: any, op: Operation): void {
         slide.excalidrawData = fields.excalidrawData;
       if (fields.transition !== undefined) slide.transition = fields.transition;
       if (fields.animations !== undefined) slide.animations = fields.animations;
+      if (fields.skipped !== undefined) slide.skipped = fields.skipped;
       break;
     }