@agent-native/core 0.169.1 → 0.170.0

package/corpus/templates/slides/app/components/editor/SlideEditor.tsx

@@ -5054,7 +5054,13 @@ export default function SlideEditor({
     (patch: SlideStylePatch) => {
       const editing = editingElRef.current;
       const element = editing ?? resolveSelectedElement();
-      if (!element || !selectedElementSelector) return;
+      // Inline edits entered without selectElementForStyling (the text-box
+      // tool) leave selectedElementSelector null, so fall back the same way the
+      // snapshot readers do rather than dropping the write.
+      const selector =
+        selectedElementSelector ??
+        (editing ? getBuilderSelector(editing) : null);
+      if (!element || !selector) return;
 
       const inlinePatch = inlineInspectorStylePatch(patch);
       const inlineKeys = INLINE_INSPECTOR_STYLE_KEYS.filter(
@@ -5117,11 +5123,7 @@ export default function SlideEditor({
             richTextSelectionRef.current,
           )
         : undefined;
-      const snapshot = buildStyleSnapshot(
-        element,
-        selectedElementSelector,
-        inlineTextStyle,
-      );
+      const snapshot = buildStyleSnapshot(element, selector, inlineTextStyle);
       if (!editing) {
         invalidateSelectionOverlayMeasurement();
       }
@@ -5129,7 +5131,7 @@ export default function SlideEditor({
       if (!editing) {
         syncSelectionToAppState(
           buildSelectionState(getSlideSelectionMode(snapshot), [
-            selectionItemForElement(element, selectedElementSelector, snapshot),
+            selectionItemForElement(element, selector, snapshot),
           ]),
         );
       }
@@ -5211,15 +5213,25 @@ export default function SlideEditor({
         converted.focus({ preventScroll: true });
       }
 
+      // Committing while an edit is open re-renders the slide from `content`
+      // and replaces the contentEditable node; stash a draft instead and let
+      // exitInlineEdit flush it.
+      if (editing) {
+        captureInlineEditDraft(slide.id);
+        return;
+      }
+
       const html = readCurrentSlideContentHtml();
       if (html !== null) onUpdateSlideRef.current({ content: html });
       const selector = getBuilderSelector(converted);
       if (selector) selectElementForStyling(converted, selector);
     },
     [
+      captureInlineEditDraft,
       readCurrentSlideContentHtml,
       resolveSelectedElement,
       selectElementForStyling,
+      slide.id,
     ],
   );
 

package/corpus/templates/slides/app/lib/sanitize-slide-html.ts

@@ -300,42 +300,55 @@ function cleanNode(
 }
 
 function sanitizeHtmlString(html: string, scopeSelector?: string): string {
-  return html
-    .replace(/<style\b[^>]*>([\s\S]*?)<\/style>/gi, (_match, css) => {
-      const safeCss = sanitizeStyleSheet(String(css), scopeSelector);
-      return safeCss
-        ? `<style>${safeCss.replace(/<\/style/gi, "<\\/style")}</style>`
-        : "";
-    })
-    .replace(
-      /<(script|iframe|object|embed|form|input|button|select|textarea|meta|base|link|svg|math)\b[\s\S]*?<\/\1>/gi,
-      "",
-    )
-    .replace(
-      /<(script|iframe|object|embed|form|input|button|select|textarea|meta|base|link|svg|math)\b[^>]*\/?>/gi,
-      "",
-    )
-    .replace(/\s+on[a-z][\w:-]*\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "")
-    .replace(/\s+srcdoc\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "")
-    .replace(/\s+srcset\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "")
-    .replace(
-      /\s+(href|src|xlink:href)\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/gi,
-      (match, attr, _raw, dq, sq, bare) => {
-        const value = dq ?? sq ?? bare ?? "";
-        const safe = sanitizeSlideUrl(
-          value,
-          String(attr).toLowerCase() === "src" ? "image" : "link",
-        );
-        return safe ? ` ${attr}="${escapeHtml(safe)}"` : "";
-      },
-    )
-    .replace(
-      /\s+style\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/gi,
-      (_match, _raw, dq, sq, bare) => {
-        const safe = sanitizeStyle(dq ?? sq ?? bare ?? "");
-        return safe ? ` style="${escapeHtml(safe)}"` : "";
-      },
-    );
+  return (
+    html
+      .replace(/<style\b[^>]*>([\s\S]*?)<\/\s*style\s*>/gi, (_match, css) => {
+        const safeCss = sanitizeStyleSheet(String(css), scopeSelector);
+        return safeCss
+          ? `<style>${safeCss.replace(/<\/style/gi, "<\\/style")}</style>`
+          : "";
+      })
+      .replace(
+        /<(script|iframe|object|embed|form|input|button|select|textarea|meta|base|link|svg|math)\b[\s\S]*?<\/\s*\1\s*>/gi,
+        "",
+      )
+      // Anything left here is a blocked element that never closed. The opening-tag
+      // pass below would strip only its tag and leave the body behind as slide
+      // text — which is how a script's JavaScript renders as visible copy on the
+      // SSR'd share/present pages, where DOMParser is undefined and this regex
+      // twin runs instead of cleanNode(). An unclosed raw-text or embedding
+      // element swallows the rest of the document in a real parser, so dropping
+      // the remainder is what keeps this path agreeing with the DOM path.
+      .replace(
+        /<(script|style|textarea|iframe|object|embed|svg|math)\b[\s\S]*$/i,
+        "",
+      )
+      .replace(
+        /<(script|iframe|object|embed|form|input|button|select|textarea|meta|base|link|svg|math)\b[^>]*\/?>/gi,
+        "",
+      )
+      .replace(/\s+on[a-z][\w:-]*\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "")
+      .replace(/\s+srcdoc\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "")
+      .replace(/\s+srcset\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, "")
+      .replace(
+        /\s+(href|src|xlink:href)\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/gi,
+        (match, attr, _raw, dq, sq, bare) => {
+          const value = dq ?? sq ?? bare ?? "";
+          const safe = sanitizeSlideUrl(
+            value,
+            String(attr).toLowerCase() === "src" ? "image" : "link",
+          );
+          return safe ? ` ${attr}="${escapeHtml(safe)}"` : "";
+        },
+      )
+      .replace(
+        /\s+style\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))/gi,
+        (_match, _raw, dq, sq, bare) => {
+          const safe = sanitizeStyle(dq ?? sq ?? bare ?? "");
+          return safe ? ` style="${escapeHtml(safe)}"` : "";
+        },
+      )
+  );
 }
 
 export function sanitizeSlideHtml(

package/corpus/templates/slides/app/routes/access-request.approve.tsx

@@ -42,16 +42,23 @@ export default function ApproveDeckAccessRequestRoute() {
   const deckId = searchParams.get("deckId") ?? "";
   const approvalTokenFromUrl = searchParams.get("token") ?? "";
   const approvalTokenStorageKey = deckAccessApprovalSessionKey(deckId);
-  const [approvalToken, setApprovalToken] = useState(() => {
-    if (approvalTokenFromUrl) return approvalTokenFromUrl;
-    if (typeof window === "undefined" || !deckId) return "";
+  // Only the URL token is knowable on the server, so reading storage in the
+  // initializer makes the first client render disagree with the server's and
+  // React re-renders the page from scratch. Adopt the stored token after mount.
+  const [approvalToken, setApprovalToken] = useState(
+    () => approvalTokenFromUrl ?? "",
+  );
+
+  useEffect(() => {
+    if (approvalTokenFromUrl || !deckId) return;
     try {
-      return sessionStorage.getItem(approvalTokenStorageKey) ?? "";
-    } catch {
-      // coercion-ok: unavailable tab storage is an absent continuation.
-      return "";
-    }
-  });
+      const stored = sessionStorage.getItem(approvalTokenStorageKey);
+      if (stored) setApprovalToken(stored);
+      // Unavailable tab storage is an absent continuation: the page then asks
+      // for the token rather than silently continuing without one.
+      // coercion-ok: the absent case is visible to the user, not swallowed.
+    } catch {}
+  }, [approvalTokenFromUrl, deckId, approvalTokenStorageKey]);
   const [state, setState] = useState<ApprovalState>({ kind: "loading" });
 
   useEffect(() => {

package/corpus/templates/slides/app/routes.ts

@@ -1,4 +1,6 @@
 import { type RouteConfig } from "@react-router/dev/routes";
 import { flatRoutes } from "@react-router/fs-routes";
 
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/corpus/templates/slides/changelog/2026-08-22-already-uploaded-chat-images-are-no-longer-dropped.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-22
+---
+
+An image attached to chat that was already uploaded elsewhere is no longer silently dropped — the agent now sees it and can add it to the deck.

package/corpus/templates/slides/changelog/2026-08-22-google-drive-and-slides-can-now-connect-with-the-shared-google-oauth.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-08-22
+---
+
+Google Drive and Slides can now connect with the shared Google OAuth app in one click

package/corpus/templates/slides/changelog/2026-08-22-multi-slide-repairs-now-report-slides-that-still-overflow.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-22
+---
+
+Fixing several slides at once now tells you when a slide still doesn't fit instead of always reporting success.

package/corpus/templates/slides/changelog/2026-08-22-update-slide-now-reports-which-batched-edit-was-skipped.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-22
+---
+
+Editing a slide with several batched changes now reports which specific change was skipped instead of only one overall success flag.

package/corpus/templates/slides/server/handlers/google-docs-auth.ts

@@ -2,6 +2,7 @@ import {
   decodeOAuthState,
   encodeOAuthState,
   getAppUrl,
+  getCredentialContext,
   getSession,
   isElectron,
   oauthCallbackResponse,
@@ -9,6 +10,7 @@ import {
   resolveOAuthRedirectUri,
   safeReturnPath,
 } from "@agent-native/core/server";
+import { resolveWorkspaceConnectionForApp } from "@agent-native/core/workspace-connections";
 import {
   defineEventHandler,
   getQuery,
@@ -27,8 +29,45 @@ import {
   isGoogleDocsOAuthConfigured,
   listGoogleDocsAccounts,
 } from "../lib/google-docs-oauth.js";
+import { getSlidesProviderApiRuntime } from "../lib/provider-api.js";
+import { withSlidesRequestContext } from "./request-auth-context.js";
 const OAUTH_STATE_APP_ID = process.env.APP_NAME || "slides";
 
+async function resolveManagedGoogleDriveAccount() {
+  if (!getCredentialContext()) return null;
+  const connection = await resolveWorkspaceConnectionForApp({
+    appId: "slides",
+    provider: "google_drive",
+    requireConnected: true,
+  });
+  if (!connection.available) return null;
+  const credential =
+    await getSlidesProviderApiRuntime().resolveOAuthAccessToken({
+      provider: "google_drive",
+    });
+  if (!credential.accountId) return null;
+  return {
+    email: credential.accountId,
+    accessToken: credential.accessToken,
+    scope: "https://www.googleapis.com/auth/drive.readonly",
+    shared: true,
+  };
+}
+
+async function getAvailableGoogleDocsAccessToken(
+  event: H3Event,
+  owner: string,
+) {
+  return withSlidesRequestContext(event, async () => {
+    const local = await getGoogleDocsAccessToken(owner);
+    if (local) return local;
+    const managed = await resolveManagedGoogleDriveAccount();
+    return managed
+      ? { accessToken: managed.accessToken, accountEmail: managed.email }
+      : null;
+  });
+}
+
 async function requireSessionEmail(event: H3Event): Promise<string | null> {
   const session = await getSession(event);
   if (!session?.email) {
@@ -160,6 +199,18 @@ export const getGoogleDocsStatus = defineEventHandler(
 
     try {
       const accounts = await listGoogleDocsAccounts(owner);
+      if (accounts.length === 0) {
+        const managed = await withSlidesRequestContext(event, () =>
+          resolveManagedGoogleDriveAccount(),
+        );
+        if (managed) {
+          accounts.push({
+            email: managed.email,
+            scope: managed.scope,
+            shared: true,
+          });
+        }
+      }
       const picker = await getGooglePickerConfig(owner);
       return {
         configured: await isGoogleDocsOAuthConfigured(owner),
@@ -206,7 +257,7 @@ export const getGoogleDocsPickerToken = defineEventHandler(
     }
 
     try {
-      const token = await getGoogleDocsAccessToken(owner);
+      const token = await getAvailableGoogleDocsAccessToken(event, owner);
       if (!token) {
         setResponseStatus(event, 401);
         return {

package/corpus/templates/slides/server/lib/chat-attachments.ts

@@ -47,7 +47,10 @@ export async function prepareSlidesChatAttachments(args: {
     path: string;
     url?: string;
     type: string;
-    size: number;
+    // Unset (not 0) for an attachment we never downloaded — an already-hosted
+    // URL-only attachment has no known byte size, and "0" would misreport it
+    // as an empty file instead of an unmeasured one.
+    size?: number;
   }> = [];
   const failed: Array<{ name: string; reason: string }> = [];
   const nextAttachments = [...args.attachments];
@@ -55,10 +58,33 @@ export async function prepareSlidesChatAttachments(args: {
   for (let index = 0; index < args.attachments.length; index++) {
     const attachment = args.attachments[index];
     if (!attachment) continue;
+    const ext = path.extname(attachment.name).toLowerCase();
+
+    // An attachment can arrive already durably hosted — a plain `url` with no
+    // inline `data` (e.g. `referenceImagePaths`/image content parts wrap an
+    // uploaded file as `{ type: "image", url }`, per
+    // packages/core/src/client/agent-chat-adapter.ts). There are no bytes to
+    // save, but the file IS attached; skipping it here because only `data`
+    // was ever recognized as "attached" is what silently drops it and leaves
+    // the agent with no signal it exists.
+    if (
+      typeof attachment.data !== "string" &&
+      typeof attachment.url === "string"
+    ) {
+      if (isSlidesReferenceFileExtension(ext)) {
+        uploaded.push({
+          originalName: attachment.name,
+          path: attachment.url,
+          url: attachment.url,
+          type: attachment.contentType || "application/octet-stream",
+        });
+      }
+      continue;
+    }
+
     const dataUrl = attachmentDataUrl(attachment);
     if (!dataUrl) continue;
 
-    const ext = path.extname(attachment.name).toLowerCase();
     if (!isSlidesReferenceFileExtension(ext)) continue;
 
     const decoded = decodeDataUrl(dataUrl);
@@ -93,7 +119,7 @@ export async function prepareSlidesChatAttachments(args: {
   const fileList = uploaded
     .map(
       (file) =>
-        `- ${file.originalName} (${file.type}, ${(file.size / 1024).toFixed(1)}KB) at path: ${file.path}${file.url ? `; embeddable URL: ${file.url}` : ""}`,
+        `- ${file.originalName} (${file.type}${typeof file.size === "number" ? `, ${(file.size / 1024).toFixed(1)}KB` : ""}) at path: ${file.path}${file.url ? `; embeddable URL: ${file.url}` : ""}`,
     )
     .join("\n");
   const failureList = failed

package/corpus/templates/slides/server/lib/google-docs-oauth.ts

@@ -14,7 +14,8 @@ const TOKEN_URL = "https://oauth2.googleapis.com/token";
 const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 const USERINFO_URL = "https://www.googleapis.com/oauth2/v2/userinfo";
 
-export const GOOGLE_DOCS_PROVIDER = "google-docs";
+export const GOOGLE_DOCS_PROVIDER = "google";
+const LEGACY_GOOGLE_DOCS_PROVIDER = "google-docs";
 export const GOOGLE_DRIVE_READONLY_SCOPE =
   "https://www.googleapis.com/auth/drive.readonly";
 export const GOOGLE_DOCS_SCOPES = [
@@ -35,6 +36,18 @@ export function hasGoogleDriveExportScope(scope?: string): boolean {
   );
 }
 
+function hasGoogleDriveAccessScope(scope?: string): boolean {
+  if (!scope?.trim()) return true;
+  const grantedScopes = new Set(
+    (scope ?? "").split(/\s+/).filter((value) => value.length > 0),
+  );
+  return [
+    "https://www.googleapis.com/auth/drive",
+    "https://www.googleapis.com/auth/drive.file",
+    GOOGLE_DRIVE_READONLY_SCOPE,
+  ].some((requiredScope) => grantedScopes.has(requiredScope));
+}
+
 interface GoogleDocsTokens {
   access_token: string;
   refresh_token?: string;
@@ -130,6 +143,7 @@ export async function getGoogleDocsAuthUrl(
 }
 
 async function refreshGoogleDocsToken(
+  provider: string,
   accountId: string,
   owner: string,
   tokens: GoogleDocsTokens,
@@ -143,7 +157,7 @@ async function refreshGoogleDocsToken(
   }
 
   if (!tokens.refresh_token) {
-    await deleteOAuthTokens(GOOGLE_DOCS_PROVIDER, accountId);
+    await deleteOAuthTokens(provider, accountId, owner);
     throw new Error("Google Docs connection expired. Please reconnect.");
   }
 
@@ -190,7 +204,7 @@ async function refreshGoogleDocsToken(
 
   if (!data?.access_token) {
     if (isPermanentGoogleRefreshError(data?.error)) {
-      await deleteOAuthTokens(GOOGLE_DOCS_PROVIDER, accountId);
+      await deleteOAuthTokens(provider, accountId, owner);
     }
     throw new Error(
       data?.error_description ||
@@ -208,7 +222,7 @@ async function refreshGoogleDocsToken(
     scope: data.scope ?? tokens.scope,
   };
   await saveOAuthTokens(
-    GOOGLE_DOCS_PROVIDER,
+    provider,
     accountId,
     updated as unknown as Record<string, unknown>,
     owner,
@@ -286,23 +300,26 @@ export async function listGoogleDocsAccounts(owner: string): Promise<
   Array<{
     email: string;
     scope?: string;
+    shared?: boolean;
   }>
 > {
-  const accounts = await listOAuthAccountsByOwner(GOOGLE_DOCS_PROVIDER, owner);
-  return accounts.map((account) => ({
-    email: account.accountId,
-    scope:
-      typeof account.tokens.scope === "string"
-        ? account.tokens.scope
-        : undefined,
-  }));
+  const accounts = await listGoogleProviderAccounts(owner);
+  return accounts
+    .map((account) => ({
+      email: account.accountId,
+      scope:
+        typeof account.tokens.scope === "string"
+          ? account.tokens.scope
+          : undefined,
+    }))
+    .filter((account) => hasGoogleDriveAccessScope(account.scope));
 }
 
 export async function disconnectGoogleDocs(owner: string): Promise<void> {
-  const accounts = await listOAuthAccountsByOwner(GOOGLE_DOCS_PROVIDER, owner);
+  const accounts = await listGoogleProviderAccounts(owner);
   await Promise.all(
     accounts.map((account) =>
-      deleteOAuthTokens(GOOGLE_DOCS_PROVIDER, account.accountId),
+      deleteOAuthTokens(account.provider, account.accountId, owner),
     ),
   );
 }
@@ -311,17 +328,50 @@ export async function getGoogleDocsAccessToken(owner: string): Promise<{
   accessToken: string;
   accountEmail: string;
 } | null> {
-  const accounts = await listOAuthAccountsByOwner(GOOGLE_DOCS_PROVIDER, owner);
+  const accounts = await listGoogleProviderAccounts(owner);
   if (accounts.length === 0) return null;
 
   const account = accounts[0];
-  const stored = await getOAuthTokens(GOOGLE_DOCS_PROVIDER, account.accountId);
+  const stored = await getOAuthTokens(
+    account.provider,
+    account.accountId,
+    owner,
+  );
   if (!stored) return null;
 
   const accessToken = await refreshGoogleDocsToken(
+    account.provider,
     account.accountId,
     owner,
     stored as unknown as GoogleDocsTokens,
   );
   return { accessToken, accountEmail: account.accountId };
 }
+
+async function listGoogleProviderAccounts(owner: string): Promise<
+  Array<{
+    provider: string;
+    accountId: string;
+    tokens: Record<string, unknown>;
+  }>
+> {
+  const accounts = await Promise.all(
+    [GOOGLE_DOCS_PROVIDER, LEGACY_GOOGLE_DOCS_PROVIDER].map(async (provider) =>
+      (await listOAuthAccountsByOwner(provider, owner)).map((account) => ({
+        provider,
+        accountId: account.accountId,
+        tokens: account.tokens,
+      })),
+    ),
+  );
+  const seen = new Set<string>();
+  return accounts.flat().filter((account) => {
+    if (!hasGoogleDriveAccessScope(String(account.tokens.scope ?? ""))) {
+      return false;
+    }
+    const key = account.accountId.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}

package/corpus/templates/slides/server/lib/slide-content-patch.ts

@@ -86,10 +86,21 @@ export async function applySlideContentEdits(
 
 export async function formatSlideHtml(content: string): Promise<string> {
   try {
-    const prettier = await import("prettier");
-    return await prettier.format(content, {
+    // prettier's main entry `import()`s all 13 parser plugins, so a bundler
+    // inlines ~3.5MB of flow/typescript/yaml/markdown parsers just to format
+    // HTML. Load the standalone core plus only the plugins the HTML printer
+    // reaches, which still formats embedded <style> and <script>.
+    const [{ format }, ...plugins] = await Promise.all([
+      import("prettier/standalone"),
+      import("prettier/plugins/html"),
+      import("prettier/plugins/postcss"),
+      import("prettier/plugins/babel"),
+      import("prettier/plugins/estree"),
+    ]);
+    return await format(content, {
       parser: "html",
       htmlWhitespaceSensitivity: "ignore",
+      plugins,
     });
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);

package/corpus/templates/slides/server/plugins/agent-chat.ts

@@ -100,14 +100,17 @@ When a Google Drive or Google Slides request needs authentication, tell the user
         search: async (query: string) => {
           const db = getDb();
           const access = accessFilter(decks, deckShares);
+          // Project only id/title — decks.data is the full deck JSON (every
+          // slide) and must not be pulled into this per-keystroke search.
+          const mentionColumns = { id: decks.id, title: decks.title };
           const rows = query
             ? await db
-                .select()
+                .select(mentionColumns)
                 .from(decks)
                 .where(and(access, like(decks.title, `%${query}%`)))
                 .limit(15)
             : await db
-                .select()
+                .select(mentionColumns)
                 .from(decks)
                 .where(access)
                 .orderBy(desc(decks.updatedAt))

package/corpus/templates/slides/tsconfig.json

@@ -2,6 +2,11 @@
   "extends": "@agent-native/core/tsconfig.base.json",
   "compilerOptions": {
     "ignoreDeprecations": "6.0",
+    // The shared base targets ES2020, but `new Error(message, { cause })`
+    // needs ErrorOptions from lib.es2022.error.d.ts (matches packages/core's
+    // own tsconfig.json, which already targets ES2022 for the same reason).
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
     "rootDirs": [".", "./.react-router/types"],
     "paths": {
       "*": ["./*"],

package/corpus/templates/slides/vitest.config.ts

@@ -16,7 +16,12 @@ export default mergeConfig(
     },
     test: {
       include: ["**/*.{test,spec}.?(c|m)[jt]s?(x)"],
-      exclude: ["**/node_modules/**", "**/.git/**", "**/dist/**"],
+      exclude: [
+        "**/node_modules/**",
+        "**/.git/**",
+        "**/dist/**",
+        "**/.react-router/**",
+      ],
     },
   }),
 );

package/corpus/templates/tasks/.agents/skills/secrets/SKILL.md

@@ -19,10 +19,17 @@ data, and generated extension/app content may mention credential **names** such
 as `OPENAI_API_KEY`, but must not contain real API keys, tokens, webhook URLs,
 signing secrets, OAuth refresh tokens, or private Builder/customer data.
 
-Secret values are supplied at runtime through deployment configuration, the
-encrypted `app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
-`${keys.NAME}` substitution. Examples must use obvious placeholders such as
-`<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not real-looking copied values.
+Provider secret values are supplied at runtime through the encrypted
+`app_secrets` vault, `saveCredential` / `resolveCredential`, OAuth, or
+`${keys.NAME}` substitution. Deployment configuration is reserved for
+deploy-level secrets and non-provider configuration. Examples must use obvious
+placeholders such as `<OPENAI_API_KEY>` or `${keys.SLACK_WEBHOOK}`, not
+real-looking copied values.
+
+Provider credentials and provider account identifiers are workspace data. Use
+standard workspace connections and org/workspace vault scopes; never put them
+in `.env` or deployment environment variables, and never add a provider-specific
+action or startup bootstrap just to write a credential for one organization.
 
 ## Credential Modeling Preflight
 

package/corpus/templates/tasks/app/routes/settings.tsx

@@ -15,7 +15,10 @@ export function meta() {
 
 export default function SettingsRoute() {
   const t = useT();
-  const agentSettingsTabs = useAgentSettingsTabs();
+  // Tasks embeds an ExtensionSlot in TaskFieldsSidebar and wires /extensions
+  // into agent navigation, so the settings management tab must exist too —
+  // otherwise the /settings/extensions destination silently falls back to General.
+  const agentSettingsTabs = useAgentSettingsTabs({ extensionTools: true });
   useSetPageTitle(t("header.pageSettings"));
 
   return (

package/corpus/templates/tasks/app/routes.ts

@@ -1,4 +1,6 @@
 import { type RouteConfig } from "@react-router/dev/routes";
 import { flatRoutes } from "@react-router/fs-routes";
 
-export default flatRoutes() satisfies RouteConfig;
+export default flatRoutes({
+  ignoredRouteFiles: ["**/*.test.{ts,tsx}", "**/*.spec.{ts,tsx}"],
+}) satisfies RouteConfig;

package/corpus/templates/tasks/changelog/2026-08-22-the-extensions-link-now-opens-the-extensions-tab-instead-o.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-08-22
+---
+
+The Extensions link now opens the Extensions tab in Settings instead of silently landing on General.