slidemind 0.0.29 → 0.1.1

package/src/bridge/config.mjs

@@ -0,0 +1,214 @@
+// CLI session config: where `slidemind pair` stores the cloud relay endpoint(s)
+// + the opaque session token each was issued. The CLI talks to
+// <backendURL>/api/cli/* with `Authorization: Bearer <sessionToken>`; no
+// localhost, no cert.
+//
+// Multi-environment by design: a slidemind developer can pair the CLI with
+// several backends (local / dev / prod) at once. Each is one record in
+// `sessions[]`; commands fan out across all of them and route by the
+// presentation's origin backend (see client.mjs). One `default` backend is the
+// fallback for the rare single-backend accessor.
+//
+// On-disk shape (v2):
+//   { version: 2, sessions: [{ backendURL, sessionToken, label }], default }
+// The legacy v1 shape ({ backendURL, sessionToken }) is migrated transparently
+// on read, so older installs and the raw-file test writers keep working.
+//
+// Stored under XDG_CONFIG_HOME (config, not cache/state) so it persists and is
+// clearly user-scoped. 0600 — it holds bearer credentials.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export function sessionConfigDir() {
+  if (process.platform === "win32") {
+    const base =
+      process.env.APPDATA || path.join(os.homedir(), "AppData", "Roaming");
+    return path.join(base, "slidemind");
+  }
+  const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+  return path.join(base, "slidemind");
+}
+
+export function sessionConfigPath() {
+  return path.join(sessionConfigDir(), "session.json");
+}
+
+// A short, human env label for a backend URL: localhost → "local", a hostname
+// containing "dev"/"staging" → that word, otherwise the bare hostname. Used in
+// listings and to let `--backend <env>` / `slidemind use <env>` match by name.
+export function deriveEnvLabel(backendURL) {
+  let host;
+  try {
+    host = new URL(backendURL).hostname;
+  } catch {
+    return String(backendURL || "");
+  }
+  if (host === "localhost" || host === "127.0.0.1" || host === "::1") {
+    return "local";
+  }
+  if (/(^|[.-])dev([.-]|$)/i.test(host) || /dev/i.test(host)) return "dev";
+  if (/stag(ing|e)?|stg/i.test(host)) return "staging";
+  if (/prod/i.test(host)) return "prod";
+  return host;
+}
+
+function isValidRecord(o) {
+  return (
+    o &&
+    typeof o.backendURL === "string" &&
+    typeof o.sessionToken === "string" &&
+    o.backendURL &&
+    o.sessionToken
+  );
+}
+
+function readRaw() {
+  let raw;
+  try {
+    raw = fs.readFileSync(sessionConfigPath(), "utf8");
+  } catch {
+    return null; // ENOENT or unreadable → treat as not paired
+  }
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null; // malformed JSON
+  }
+}
+
+// All paired sessions as [{ backendURL, sessionToken, label }]. Migrates the v1
+// single-record shape transparently. Returns [] when not paired / unreadable.
+export function readSessions() {
+  const obj = readRaw();
+  if (!obj) return [];
+  // v2: { version, sessions: [...], default }
+  if (Array.isArray(obj.sessions)) {
+    return obj.sessions.filter(isValidRecord).map((s) => ({
+      backendURL: s.backendURL,
+      sessionToken: s.sessionToken,
+      label: typeof s.label === "string" && s.label ? s.label : deriveEnvLabel(s.backendURL),
+    }));
+  }
+  // v1: { backendURL, sessionToken }
+  if (isValidRecord(obj)) {
+    return [
+      {
+        backendURL: obj.backendURL,
+        sessionToken: obj.sessionToken,
+        label: deriveEnvLabel(obj.backendURL),
+      },
+    ];
+  }
+  return [];
+}
+
+// The backendURL marked default, or null. Falls back to the first session when
+// the stored default is missing/stale.
+export function getDefaultBackend() {
+  const obj = readRaw();
+  const sessions = readSessions();
+  if (sessions.length === 0) return null;
+  const stored = obj && typeof obj.default === "string" ? obj.default : null;
+  if (stored && sessions.some((s) => s.backendURL === stored)) return stored;
+  return sessions[0].backendURL;
+}
+
+function writeAll(sessions, defaultBackend) {
+  fs.mkdirSync(sessionConfigDir(), { recursive: true });
+  const payload = {
+    version: 2,
+    sessions: sessions.map((s) => ({
+      backendURL: s.backendURL,
+      sessionToken: s.sessionToken,
+      label: s.label || deriveEnvLabel(s.backendURL),
+    })),
+  };
+  const def =
+    defaultBackend && sessions.some((s) => s.backendURL === defaultBackend)
+      ? defaultBackend
+      : sessions[0]?.backendURL;
+  if (def) payload.default = def;
+  fs.writeFileSync(sessionConfigPath(), `${JSON.stringify(payload, null, 2)}\n`, {
+    mode: 0o600,
+  });
+}
+
+// Add or replace a session (keyed by backendURL). Becomes the default if none
+// is set yet. Preserves the existing default otherwise.
+export function upsertSession({ backendURL, sessionToken, label = null }) {
+  if (!backendURL || !sessionToken) {
+    throw new Error("upsertSession: backendURL and sessionToken are required");
+  }
+  const sessions = readSessions().filter((s) => s.backendURL !== backendURL);
+  sessions.push({
+    backendURL,
+    sessionToken,
+    label: label || deriveEnvLabel(backendURL),
+  });
+  const def = getDefaultBackend() || backendURL;
+  writeAll(sessions, def);
+  return sessions;
+}
+
+// Remove one session by backendURL. Returns true if a record was removed. If it
+// was the default, the first remaining session becomes the new default.
+export function removeSession(backendURL) {
+  const sessions = readSessions();
+  const next = sessions.filter((s) => s.backendURL !== backendURL);
+  if (next.length === sessions.length) return false;
+  if (next.length === 0) {
+    clearSessionConfig();
+    return true;
+  }
+  let def = getDefaultBackend();
+  if (def === backendURL) def = next[0].backendURL;
+  writeAll(next, def);
+  return true;
+}
+
+export function setDefaultBackend(backendURL) {
+  const sessions = readSessions();
+  if (!sessions.some((s) => s.backendURL === backendURL)) {
+    throw new Error(
+      `setDefaultBackend: not paired with '${deriveEnvLabel(backendURL)}'`,
+    );
+  }
+  writeAll(sessions, backendURL);
+}
+
+// Back-compat single-session accessor: the default session as
+// { backendURL, sessionToken }, or null. Load-bearing for the bridgeFetch
+// fallback and any caller that wants "the one session".
+export function readSessionConfig() {
+  const sessions = readSessions();
+  if (sessions.length === 0) return null;
+  const def = getDefaultBackend();
+  const pick = sessions.find((s) => s.backendURL === def) || sessions[0];
+  return { backendURL: pick.backendURL, sessionToken: pick.sessionToken };
+}
+
+// The full session record (incl. token) for a specific backend, or null.
+export function getSessionFor(backendURL) {
+  return readSessions().find((s) => s.backendURL === backendURL) || null;
+}
+
+// Back-compat writer: upsert a single session (used by tests and any v1 caller).
+export function writeSessionConfig({ backendURL, sessionToken }) {
+  if (!backendURL || !sessionToken) {
+    throw new Error("writeSessionConfig: backendURL and sessionToken are required");
+  }
+  upsertSession({ backendURL, sessionToken });
+}
+
+// Remove the stored session file entirely (all sessions). Returns true if a
+// file was deleted.
+export function clearSessionConfig() {
+  try {
+    fs.rmSync(sessionConfigPath());
+    return true;
+  } catch {
+    return false;
+  }
+}

package/src/bridge/pair.mjs

@@ -0,0 +1,67 @@
+// Pairing + session helpers for the CLI side of the cloud relay.
+//
+// `slidemind pair <blob>` decodes {u: backendURL, s: secret} and redeems the
+// one-time secret for an opaque session token, stored by config.mjs. whoami/
+// logout call the session-gated endpoints with that token.
+
+import http from "node:http";
+import https from "node:https";
+
+function isLoopbackHostname(h) {
+  return h === "127.0.0.1" || h === "localhost" || h === "::1";
+}
+
+// Minimal JSON request. Validates the cloud's real cert; skips only for a
+// loopback dev backend (self-signed).
+export function httpJson(method, urlStr, { body = null, token = null } = {}) {
+  const url = new URL(urlStr);
+  const transport = url.protocol === "https:" ? https : http;
+  const payload = body != null ? JSON.stringify(body) : null;
+  const headers = { accept: "application/json" };
+  if (payload) {
+    headers["content-type"] = "application/json";
+    headers["content-length"] = Buffer.byteLength(payload);
+  }
+  if (token) headers.authorization = `Bearer ${token}`;
+  return new Promise((resolve, reject) => {
+    const req = transport.request(
+      url,
+      {
+        method,
+        headers,
+        rejectUnauthorized:
+          url.protocol === "https:" ? !isLoopbackHostname(url.hostname) : undefined,
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (c) => chunks.push(Buffer.from(c)));
+        res.on("end", () => {
+          const text = Buffer.concat(chunks).toString("utf8");
+          let json = null;
+          try {
+            json = text ? JSON.parse(text) : null;
+          } catch {
+            /* non-JSON body */
+          }
+          resolve({ status: res.statusCode ?? 0, json, text });
+        });
+      },
+    );
+    req.on("error", reject);
+    if (payload) req.write(payload);
+    req.end();
+  });
+}
+
+// Decode a `slidemind pair <blob>` code → { backendURL, secret } or null.
+export function decodePairingCode(code) {
+  try {
+    const obj = JSON.parse(Buffer.from(code, "base64url").toString("utf8"));
+    if (obj && typeof obj.u === "string" && typeof obj.s === "string") {
+      return { backendURL: obj.u, secret: obj.s };
+    }
+  } catch {
+    /* malformed */
+  }
+  return null;
+}

package/src/builders/build.mjs

@@ -34,6 +34,7 @@ import { fileURLToPath, pathToFileURL } from "node:url";
 
 import { lintSlidesOrThrow } from "./lint-slides.mjs";
 import { resolveSkillForDeck } from "./resolve-skill.mjs";
+import { slideOrderWarning, sortSlideFilenames } from "../lib/slide-order.mjs";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -606,14 +607,17 @@ export function buildDeck(deckDir, opts = {}) {
         `${path.basename(deckDir)}' to produce the editable .pptx.`,
     );
   }
-  const slideFiles = fs
-    .readdirSync(slidesDir)
-    .filter((f) => f.endsWith(".jsx"))
-    .sort()
-    .map((f) => path.join(slidesDir, f));
+  const slideNames = sortSlideFilenames(
+    fs.readdirSync(slidesDir).filter((f) => f.endsWith(".jsx")),
+  );
+  const slideFiles = slideNames.map((f) => path.join(slidesDir, f));
   if (slideFiles.length === 0) {
     throw new Error(`No .jsx files in ${slidesDir}`);
   }
+  const orderWarning = slideOrderWarning(slideNames);
+  if (orderWarning) {
+    process.stderr.write(`warning: ${orderWarning}\n`);
+  }
 
   // Layout discovery: brand layouts first, then the active skill's layouts
   // override on basename collision — so a sibling skill could reach for the

package/src/lib/slide-order.mjs

@@ -0,0 +1,28 @@
+// Slide play order over the CLI is FILENAME order. The in-app design agent
+// passes an explicit ordered list to its `build_and_push` tool; the CLI has no
+// such channel, so decks encode order with zero-padded numeric prefixes
+// (01-cover.jsx, 02-agenda.jsx, …) — see skills/create-slides/SKILL.md
+// (command mapping). The sort is numeric-aware so unpadded prefixes still
+// order correctly (2-foo.jsx before 10-bar.jsx).
+
+const collator = new Intl.Collator("en", { numeric: true });
+
+export function sortSlideFilenames(filenames) {
+  return [...filenames].sort(collator.compare);
+}
+
+// Warn (never fail) when a multi-slide deck has slide files without a numeric
+// prefix: their play order is accidental-alphabetical, which is the #1 way a
+// deck comes out shuffled.
+export function slideOrderWarning(filenames) {
+  if (filenames.length < 2) return null;
+  const unprefixed = filenames.filter((f) => !/^\d+[-_]/.test(f));
+  if (unprefixed.length === 0) return null;
+  const sample = unprefixed.slice(0, 3).join(", ");
+  const more = unprefixed.length > 3 ? ", …" : "";
+  return (
+    `slide order is filename order, but ${unprefixed.length} of ` +
+    `${filenames.length} slide files lack a numeric prefix (${sample}${more}) — ` +
+    `rename to NN-<topic>.jsx (01-cover.jsx, 02-…) so play order matches intent`
+  );
+}

package/src/mcp/server.mjs

@@ -22,10 +22,9 @@
 //     Fetches a chosen search result's bytes and writes them into a deck's
 //     assets/ folder for the slide JSX to reference.
 //
-// Everything routes through the add-in's local bridge at
-// https://127.0.0.1:3001/local/* with a shared token the add-in writes to
-// `${XDG_STATE_HOME:-~/.local/state}/slidemind/bridge-token`
-// (Windows: `%LOCALAPPDATA%\\slidemind\\bridge-token`). See src/bridge/client.mjs.
+// Everything routes through the add-in's cloud relay at
+// `<backendURL>/api/cli/*` with the Bearer session token established by
+// `slidemind pair`. See src/bridge/client.mjs.
 
 import fs from "node:fs";
 import path from "node:path";
@@ -132,6 +131,9 @@ const server = new McpServer(
       "with an active corporate design is required, and all brand rules come from that " +
       "design's bundle (design.md), never hardcoded here. " +
       "Always call slidemind_list_open_presentations first to learn which presentation_id to target. " +
+      "The CLI may be paired with several add-in environments (local/dev/prod) at once; the list spans " +
+      "all of them and each entry is tagged with its env, and routing to the right backend is automatic — " +
+      "just pass the presentation_id back. " +
       "For brand imagery, slidemind_search_engine then slidemind_download_result.",
   },
 );
@@ -142,15 +144,16 @@ server.registerTool(
     title: "List open PowerPoint windows",
     description:
       "List PowerPoint windows registered with the slidemind local bridge, including retained entries whose task-pane socket is temporarily disconnected. " +
-      "Each entry has a stable presId — pass it as `presentation_id` to slidemind_push_deck. " +
+      "Spans every paired add-in environment (local/dev/prod); each entry carries an `env` tag and a stable presId — pass the presId as `presentation_id` to the other tools and routing to that env is automatic. " +
       "If the list is empty the user has no PowerPoint open with the add-in loaded.",
     inputSchema: {},
   },
   async () => {
     try {
-      const { listOpenPresentations } = await loadBridgeClient();
+      const { listOpenPresentations, toPublicPresentation } =
+        await loadBridgeClient();
       const list = await listOpenPresentations();
-      return textResult({ presentations: list });
+      return textResult({ presentations: list.map(toPublicPresentation) });
     } catch (err) {
       return errorResult(err);
     }