slidemind 0.3.4 → 0.3.12

package/src/bridge/client.mjs

@@ -164,9 +164,15 @@ function transientRetryDelays() {
 // information) from "this session is dead" (the user's problem) — see
 // resolveSearchBackend.
 function sessionInvalidError() {
+  // Deliberately does NOT say `logout --all`: a 401 means the add-in answered
+  // "no such session" (revoked in Settings → Connect CLI, or expired). Running
+  // `setup` with a fresh command replaces this backend's record in place, so
+  // nothing has to be wiped first — and a user with two environments who wipes
+  // everything on every 401 is how the 2026-08-27 reconnect loop happened.
   const err = new Error(
-    "slidemind session is invalid or expired. Run `slidemind logout --all`, then " +
-      "reconnect with a fresh command from the add-in's Connect CLI panel.",
+    "slidemind session is invalid or expired: the add-in no longer knows this session " +
+      "(revoked under Settings → General → Connect CLI, or expired). Reconnect with a fresh " +
+      "command from that panel; other environments and your Microsoft 365 sign-in stay as they are.",
   );
   err.status = 401;
   err.code = "session_invalid";
@@ -191,13 +197,13 @@ function isTransientBridgeError(err) {
   return /relay unreachable/i.test(String(err.message || ""));
 }
 
-async function withTransientRetry(fn) {
+async function withTransientRetry(fn, isRetryable = isTransientBridgeError) {
   const delays = transientRetryDelays();
   for (let attempt = 0; ; attempt += 1) {
     try {
       return await fn();
     } catch (err) {
-      if (attempt >= delays.length || !isTransientBridgeError(err)) throw err;
+      if (attempt >= delays.length || !isRetryable(err)) throw err;
       await new Promise((resolve) => setTimeout(resolve, delays[attempt]));
     }
   }
@@ -531,10 +537,18 @@ async function listPresentationsForBackend(backendURL) {
 async function readinessForBackend(backendURL) {
   const env = deriveEnvLabel(backendURL);
   try {
-    const res = await bridgeFetch(
-      "/api/cli/readiness",
-      { timeoutMs: listTimeoutMs() },
-      backendURL,
+    // Retry only a 503: the add-in answers that (code `backend_unavailable`)
+    // while its session store cannot respond, and a 404 here means an older
+    // add-in without the readiness route, which the fallback below handles
+    // without waiting out the retry delays.
+    const res = await withTransientRetry(
+      () =>
+        bridgeFetch(
+          "/api/cli/readiness",
+          { timeoutMs: listTimeoutMs() },
+          backendURL,
+        ),
+      (err) => err?.status === 503 && err?.code !== "pane_suspended",
     );
     const data = (await res.json()) ?? {};
     const presentations = Array.isArray(data.presentations)
@@ -591,6 +605,12 @@ export async function connectionStatus() {
       backendURL,
       ok: false,
       error: r.reason?.message ? r.reason.message : String(r.reason),
+      // Machine code of the failure (`backend_unavailable`, `session_invalid`,
+      // …) so the readiness ladder can tell "retry shortly" from "re-pair".
+      code: typeof r.reason?.code === "string" ? r.reason.code : null,
+      // The HTTP status too: a proxy's 503 carries no machine code (or only a
+      // prose `error`), and the ladder must still read it as "wait".
+      status: typeof r.reason?.status === "number" ? r.reason.status : null,
       presentations: [],
     };
   });
@@ -1112,13 +1132,19 @@ function conceptTimeoutMs() {
 
 async function postConceptImages(
   brandId,
-  { planMarkdown, slideNumbers },
+  { planMarkdown, slideNumbers, references },
   backendURL,
 ) {
   const body = { planMarkdown };
   if (Array.isArray(slideNumbers) && slideNumbers.length > 0) {
     body.slideNumbers = slideNumbers;
   }
+  // The user's own images, inline: `{ role: "concept" | "style", image:
+  // <data URI>, slides?: number[], name? }`. A concept replaces the generated
+  // mockup for its slides; a style reference leads the generation.
+  if (Array.isArray(references) && references.length > 0) {
+    body.references = references;
+  }
   const res = await bridgeFetch(
     `/api/cli/brands/${encodeURIComponent(brandId)}/concept-images`,
     {
@@ -1136,8 +1162,9 @@ async function postConceptImages(
 }
 
 // Generate concept mockup images for a brand over the pane-free brand route.
-// Body `{ planMarkdown, slideNumbers? }`; the optional `slideNumbers` filters
-// which storyboard beats are rendered (the CLI batches per-slide). Returns the
+// Body `{ planMarkdown, slideNumbers?, references? }`; the optional `slideNumbers`
+// filters which storyboard beats are rendered (the CLI batches per-slide);
+// `references` carries the user's own concept/style images inline. Returns the
 // server's `{ ok, images, slideCount }` augmented with the resolved
 // `backendURL`. When `backendURL` is given it posts directly; otherwise it
 // fans out — like getDesignBundleForBrandAnyBackend, presFP/brandId is globally
@@ -1146,7 +1173,7 @@ async function postConceptImages(
 // unknown brand, missing grant) so callers can degrade to "continue without".
 export async function generateConceptImagesForBrand(
   brandId,
-  { planMarkdown, slideNumbers = null, backendURL = null } = {},
+  { planMarkdown, slideNumbers = null, references = null, backendURL = null } = {},
 ) {
   if (!brandId) {
     throw new Error("generateConceptImagesForBrand: brandId is required");
@@ -1155,7 +1182,11 @@ export async function generateConceptImagesForBrand(
     throw new Error("generateConceptImagesForBrand: planMarkdown is required");
   }
   if (backendURL) {
-    return postConceptImages(brandId, { planMarkdown, slideNumbers }, backendURL);
+    return postConceptImages(
+      brandId,
+      { planMarkdown, slideNumbers, references },
+      backendURL,
+    );
   }
   const sessions = sessionsInScope();
   const failures = [];
@@ -1170,7 +1201,7 @@ export async function generateConceptImagesForBrand(
       }
       return await postConceptImages(
         brandId,
-        { planMarkdown, slideNumbers },
+        { planMarkdown, slideNumbers, references },
         s.backendURL,
       );
     } catch (err) {
@@ -1214,15 +1245,15 @@ async function postGenerateImage(brandId, body, backendURL) {
 }
 
 // Generate ONE regular image over the pane-free brand route
-// (`slidemind imagen`). Body `{ prompt, size?, quality?, brandStyle? }`;
-// returns the server's `{ ok, image, styleReferences }` augmented with the
+// (`slidemind imagen`). Body `{ prompt, size?, quality? }`;
+// returns the server's `{ ok, image }` augmented with the
 // resolved `backendURL`. Fan-out and degradation mirror
 // generateConceptImagesForBrand: throws a typed `imagen_route_unavailable`
 // when no paired backend serves the route (older add-ins, unknown brand,
 // missing grant) so callers can print the one actionable fix.
 export async function generateImageForBrand(
   brandId,
-  { prompt, size = null, quality = null, brandStyle = false, backendURL = null } = {},
+  { prompt, size = null, quality = null, backendURL = null } = {},
 ) {
   if (!brandId) {
     throw new Error("generateImageForBrand: brandId is required");
@@ -1233,7 +1264,6 @@ export async function generateImageForBrand(
   const body = { prompt };
   if (size) body.size = size;
   if (quality) body.quality = quality;
-  if (brandStyle) body.brandStyle = true;
   if (backendURL) {
     return postGenerateImage(brandId, body, backendURL);
   }
@@ -3100,6 +3130,28 @@ export async function getPresentationContent({
   });
 }
 
+// Ask the pane whether its host document is actually still alive (the
+// `ping-document` op — one PowerPoint.run in the webview). This exists for
+// `ready`'s zombie check: a webview whose document was closed keeps its socket
+// (and thus its registry lease) alive, so only a host round-trip tells the
+// truth. Deliberately NOT engineOpWithPaneWait — a probe must fail fast, never
+// park in the 120s pane wait. Callers decide what a failure means; this just
+// returns the ack or throws the transport error.
+export async function pingPresentation({ presId, backendURL, timeoutMs = 12000 }) {
+  if (!presId) throw new Error("pingPresentation: presId is required");
+  const res = await bridgeFetch(
+    `/api/cli/presentations/${encodeURIComponent(presId)}/ping`,
+    {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({}),
+      timeoutMs,
+    },
+    backendURL,
+  );
+  return res.json(); // { ok, presId?, fileName? } | { ok: false, code, error }
+}
+
 function ensurePaneAckOk(data, operation) {
   if (!data || data.ok !== false) return data ?? {};
   const detail = data.error || `${operation} failed`;
@@ -3294,20 +3346,26 @@ export function resolveDesignSource(
     return { status: "ambiguous", ...dedupeCandidates(matches) };
   }
 
-  const distinctDesigns = new Set(all.map(designKey));
+  // A live pane outranks a suspended one for the DESIGN decision: a
+  // backgrounded — or closed and not yet purged — window must not turn the one
+  // design the user actually has in front of them into a question. Only when
+  // nothing is live do the suspended windows decide.
+  const live = all.filter(isPaneReadyPresentation);
+  const pool = live.length > 0 ? live : all;
+  const distinctDesigns = new Set(pool.map(designKey));
   if (distinctDesigns.size === 1) {
     // One design open (possibly one window mirrored across backends, or several
     // windows on the SAME CD). Pick via the mirror tie-break, else a live pane,
     // else the first — the design is unambiguous either way.
     const entry =
-      tieBreakMatches(all, deckPresFP) ??
-      all.find(isPaneReadyPresentation) ??
-      all[0];
+      tieBreakMatches(pool, deckPresFP) ??
+      pool.find(isPaneReadyPresentation) ??
+      pool[0];
     return { status: "resolved", entry };
   }
   // ≥2 distinct designs open — the only case that asks the user (the deck ref
   // does NOT auto-pick; it only annotates `suggested`).
-  return { status: "ambiguous", ...dedupeCandidates(all) };
+  return { status: "ambiguous", ...dedupeCandidates(pool) };
 }
 
 // Pick a target presentation given the (possibly multi-backend) registry and an

package/src/bridge/config.mjs

@@ -160,6 +160,7 @@ export function readSessions() {
       backendURL: s.backendURL,
       sessionToken: s.sessionToken,
       label: typeof s.label === "string" && s.label ? s.label : deriveEnvLabel(s.backendURL),
+      ...(typeof s.oid === "string" && s.oid ? { oid: s.oid } : {}),
       ...(typeof s.msGraphRefreshToken === "string" && s.msGraphRefreshToken
         ? { msGraphRefreshToken: s.msGraphRefreshToken }
         : {}),
@@ -199,6 +200,7 @@ function writeAll(sessions, defaultBackend) {
       backendURL: s.backendURL,
       sessionToken: s.sessionToken,
       label: s.label || deriveEnvLabel(s.backendURL),
+      ...(s.oid ? { oid: s.oid } : {}),
       ...(s.msGraphRefreshToken ? { msGraphRefreshToken: s.msGraphRefreshToken } : {}),
     })),
   };
@@ -220,15 +222,32 @@ function writeAll(sessions, defaultBackend) {
 // pairing that session with the previous user's delegated Graph token would
 // fetch one person's content under another's session. `slidemind login` again
 // is one command; a mismatched identity is not recoverable by the user.
-export function upsertSession({ backendURL, sessionToken, label = null }) {
+export function upsertSession({ backendURL, sessionToken, label = null, oid = null }) {
   if (!backendURL || !sessionToken) {
     throw new Error("upsertSession: backendURL and sessionToken are required");
   }
-  const sessions = readSessions().filter((s) => s.backendURL !== backendURL);
+  const all = readSessions();
+  const previous = all.find((s) => s.backendURL === backendURL);
+  const sessions = all.filter((s) => s.backendURL !== backendURL);
+  // A re-pair replaces the add-in session, not the Microsoft 365 sign-in — but
+  // only when the SAME person re-paired: a claim can hand a shared machine to
+  // someone else, who must not inherit the previous user's delegated token.
+  // Identity is the add-in-reported `oid`; unknown on either side means drop.
+  const samePerson = Boolean(oid) && previous?.oid === oid;
+  // Dropping the field detaches the record from a keychain-stored secret; the
+  // secret itself has to go too, or the previous user's refresh token stays
+  // readable at rest for whoever shares this login keychain.
+  if (!samePerson && previous?.msGraphRefreshToken === KEYCHAIN_MARKER && keychainUsable()) {
+    keychainDelete(backendURL);
+  }
   sessions.push({
     backendURL,
     sessionToken,
     label: label || deriveEnvLabel(backendURL),
+    ...(oid ? { oid } : {}),
+    ...(samePerson && previous?.msGraphRefreshToken
+      ? { msGraphRefreshToken: previous.msGraphRefreshToken }
+      : {}),
   });
   const def = getDefaultBackend() || backendURL;
   writeAll(sessions, def);

package/src/bridge/engine-download.mjs

@@ -14,7 +14,7 @@ import {
   imageSizeFromBuffer,
   svgSizeFromMarkup,
 } from "./image-dimensions.mjs";
-import { describeRecolor } from "./recolor.mjs";
+import { applyLocalRecolor, describeRecolor } from "./recolor.mjs";
 
 // Every image format an engine accepts, plus the alias spellings seen in the
 // wild. Mirrors the add-in's `searchImage` set (lib/image-formats.ts there);
@@ -151,12 +151,18 @@ function describeRecolorWithRefusal(markup, mimeType, iconColor, refusedColor) {
     refusedColor ? null : (iconColor ?? null),
   );
   if (!refusedColor) return described;
+  // With the local bake in place (applyLocalRecolor), a surviving refusal
+  // means the glyph itself declined the colour — say why instead of sending
+  // the agent on a pane hunt.
+  const why =
+    described.mode === "multicolor"
+      ? "it is a multi-tone glyph and a single colour would flatten it — left as designed."
+      : described.mode === "raster"
+        ? "raster images carry their own colours."
+        : "the glyph's paint structure could not be rewritten safely.";
   return {
     ...described,
-    note:
-      `Saved in its ORIGINAL colours — recolouring to ${refusedColor} runs in the slidemind add-in. ` +
-      "Re-run this download with --to <presId> (a PowerPoint window with the slidemind pane open) " +
-      "to bake the colour in.",
+    note: `Saved in its ORIGINAL colours — recolouring to ${refusedColor} was not applied: ${why}`,
   };
 }
 
@@ -218,16 +224,29 @@ async function streamOneResult({
     if (res?.svgMarkup) {
       // SVG arrives inline, not as a stream.
       fs.rmSync(tempPath, { force: true });
+      // Window-free tint fallback: the pane-side refusal is about WHERE the
+      // rewrite runs, not whether it's possible — for currentColor/mono SVGs
+      // the bake is a deterministic local string transform. Measured impact:
+      // one sim batch carried 235 "saved in ORIGINAL colours" notes, every
+      // one an off-brand icon on the rendered slide.
+      let markup = res.svgMarkup;
+      if (recolorRefused) {
+        const local = applyLocalRecolor(markup, recolorRefused);
+        if (local.applied) {
+          markup = local.markup;
+          recolorRefused = null;
+        }
+      }
       const filename = `engine-${searchId}-${selection}.svg`;
       const target = path.join(assetsDir, filename);
-      fs.writeFileSync(target, res.svgMarkup, "utf8");
+      fs.writeFileSync(target, markup, "utf8");
       return {
         selection,
         path: target,
         reference: `./assets/${filename}`,
         mimeType: res.mimeType ?? "image/svg+xml",
         recolor: describeRecolorWithRefusal(
-          res.svgMarkup,
+          markup,
           res.mimeType,
           iconColor,
           recolorRefused,

package/src/bridge/recolor.mjs

@@ -110,3 +110,49 @@ export function describeRecolor(svgMarkup, mimeType, appliedColor = null) {
     note,
   };
 }
+
+// Bake a colour into an SVG LOCALLY — the fallback for the window-free path,
+// where the add-in refuses the tint (`recolor_needs_host`) because its
+// DOM-based classifier lives pane-side. For the two recolourable modes the
+// rewrite is a deterministic string transform this module can do itself:
+//   currentColor — replace every `currentColor` paint with the hex;
+//   mono         — replace every concrete fill/stroke paint with the hex.
+// Multicolor and raster are refused (flattening a multi-tone glyph or touching
+// raster bytes is never right). Returns { markup, applied }.
+export function applyLocalRecolor(svgMarkup, hex) {
+  if (typeof svgMarkup !== "string" || !hex || !isSvg(null, svgMarkup)) {
+    return { markup: svgMarkup, applied: false };
+  }
+  if (hasCurrentColor(svgMarkup)) {
+    return {
+      markup: svgMarkup.replace(
+        /((?:fill|stroke)\s*[:=]\s*["']?\s*)currentColor/gi,
+        `$1${hex}`,
+      ),
+      applied: true,
+    };
+  }
+  const paints = distinctPaints(svgMarkup);
+  if (paints.size >= 2 || paints.size === 0) {
+    // Multicolor: never flatten. Zero declared paints: the glyph renders in
+    // the SVG default (black) via inheritance — inject a root fill instead of
+    // rewriting nothing.
+    if (paints.size === 0) {
+      return {
+        markup: svgMarkup.replace(/<svg\b/i, `<svg fill="${hex}"`),
+        applied: true,
+      };
+    }
+    return { markup: svgMarkup, applied: false };
+  }
+  const markup = svgMarkup.replace(
+    /((?:fill|stroke)\s*[:=]\s*["']?\s*)(#[0-9a-fA-F]{3,8}|rgba?\([^)]*\)|hsla?\([^)]*\)|[a-zA-Z]+)/g,
+    (m, prefix, value) => {
+      const v = value.trim().toLowerCase();
+      if (v === "none" || v === "transparent") return m;
+      if (!/^#|^rgb|^hsl/.test(v) && !NAMED_COLORS.has(v)) return m;
+      return `${prefix}${hex}`;
+    },
+  );
+  return { markup, applied: true };
+}

package/src/bridge/setup-claim.mjs

@@ -114,7 +114,13 @@ export async function redeemSetupClaim({ backendURL, secret, cliVersion }) {
   }
 
   if (result.status === 200 && result.json?.sessionToken) {
-    return String(result.json.sessionToken);
+    // `oid` (the user's directory id) arrives from add-ins that report it; an
+    // older add-in leaves it null, which the session store treats as "unknown
+    // person" — i.e. never inherit the previous Microsoft 365 sign-in.
+    return {
+      sessionToken: String(result.json.sessionToken),
+      oid: typeof result.json.oid === "string" && result.json.oid ? result.json.oid : null,
+    };
   }
   // Discriminate on the error CODE, not the status. A deployment that predates
   // one-command setup has no such route, so the request falls through to that

package/src/builders/build.mjs

@@ -29,9 +29,12 @@
 
 import { spawn } from "node:child_process";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { resolveBundleDirForDeck } from "../bridge/bundle.mjs";
+import { loadChartPreview } from "../bridge/capture.mjs";
 import { FAVICON_LINK } from "./gate-server.mjs";
 import { lintSlidesOrThrow } from "./lint.mjs";
 import { resolveSkillForDeck } from "./resolve-skill.mjs";
@@ -145,6 +148,98 @@ function copyDesignSystem(deckDir, skill) {
   fs.writeFileSync(path.join(deckDir, "layouts.css"), cssChunks.join("\n\n"));
 }
 
+// First concrete (non-generic) family of a CSS var's font stack, or null.
+function firstConcreteFamily(cssText, varName) {
+  const match = cssText.match(new RegExp(`--${varName}\\s*:\\s*([^;]+);`));
+  if (!match) return null;
+  const generics = new Set([
+    "sans-serif",
+    "serif",
+    "monospace",
+    "system-ui",
+    "ui-sans-serif",
+    "ui-serif",
+    "ui-monospace",
+    "cursive",
+    "fantasy",
+  ]);
+  for (const part of match[1].split(",")) {
+    const family = part.trim().replace(/^['"]|['"]$/g, "");
+    if (family && !generics.has(family.toLowerCase())) return family;
+  }
+  return null;
+}
+
+// Copy the materialized bundle's brand fonts next to the preview and emit the
+// same @font-face block the server's capture page uses: one rule per FACE
+// under its canonical family plus the CSS-token alias (--font-sans/--font-mono),
+// with real weight/style descriptors so bold/italic render (and later measure)
+// with the real face instead of a synthesized one. Without this the preview
+// showed system fallbacks while capture/export used the brand face.
+function brandFontFaces(deckDir, skill) {
+  const bundleDir = skill.bundleDir;
+  if (!bundleDir || !fs.existsSync(bundleDir)) return "";
+  let meta = {};
+  try {
+    meta = JSON.parse(
+      fs.readFileSync(path.join(bundleDir, "bundle.json"), "utf8"),
+    );
+  } catch {
+    return "";
+  }
+  const fonts = Array.isArray(meta.fonts) ? meta.fonts : [];
+  if (fonts.length === 0) return "";
+
+  let css = "";
+  try {
+    css = fs.readFileSync(path.join(deckDir, "corporate-design.css"), "utf8");
+  } catch {
+    /* alias resolution degrades to canonical families only */
+  }
+  const aliasByRole = {
+    primary: firstConcreteFamily(css, "font-sans"),
+    mono: firstConcreteFamily(css, "font-mono"),
+  };
+
+  const outFonts = path.join(deckDir, "fonts");
+  const rules = [];
+  for (const font of fonts) {
+    if (!font?.family || !font?.filename) continue;
+    const filename = path.basename(font.filename);
+    const src = path.join(bundleDir, "fonts", filename);
+    if (!fs.existsSync(src)) continue;
+    fs.mkdirSync(outFonts, { recursive: true });
+    fs.copyFileSync(src, path.join(outFonts, filename));
+
+    const weight =
+      font.variable &&
+      typeof font.variable.minWeight === "number" &&
+      typeof font.variable.maxWeight === "number"
+        ? `${font.variable.minWeight} ${font.variable.maxWeight}`
+        : String(
+            typeof font.weight === "number" &&
+              font.weight >= 100 &&
+              font.weight <= 900
+              ? font.weight
+              : 400,
+          );
+    const style = font.style === "italic" ? "italic" : "normal";
+    const format = filename.toLowerCase().endsWith(".otf")
+      ? "opentype"
+      : "truetype";
+    const rule = (family) =>
+      `@font-face { font-family: ${JSON.stringify(family)}; ` +
+      `src: url(${JSON.stringify(`./fonts/${filename}`)}) format("${format}"); ` +
+      `font-weight: ${weight}; font-style: ${style}; font-display: block; }`;
+    rules.push(rule(font.family));
+    const alias = aliasByRole[font.role];
+    if (alias && alias.toLowerCase() !== font.family.toLowerCase()) {
+      rules.push(rule(alias));
+    }
+  }
+  return rules.join("\n");
+}
+
 function loadOverrides(deckDir) {
   const file = path.join(deckDir, "overrides.json");
   if (!fs.existsSync(file)) return { version: 1, slides: {} };
@@ -258,6 +353,10 @@ const HTML_TEMPLATE = `<!doctype html>
       font-style: italic;
     }
   </style>
+  <style id="brand-font-faces">__BRAND_FONT_FACES__</style>
+  <!-- Chart palette for the <Chart> stand-in (from the bundle's capture engine;
+       empty when the bundle carries no chart runtime). -->
+  <style id="chart-theme-tokens">__CHART_THEME_TOKENS__</style>
   <style>
     html, body { margin: 0; padding: 0; height: 100%; background: #0a0a0a; overflow: hidden; }
     :root {
@@ -470,6 +569,11 @@ __SLIDES__
   <script crossorigin src="https://unpkg.com/react@18/umd/react.production.min.js"></script>
   <script crossorigin src="https://unpkg.com/react-dom@18/umd/react-dom.production.min.js"></script>
   <script src="https://unpkg.com/@babel/standalone/babel.min.js"></script>
+  <!-- The <Chart> stand-in runtime: the add-in's own vendored scripts, inlined
+       from the bundle's capture engine (this CLI ships no chart source). They
+       install window.SlidemindChart, which the bootstrap below binds as Chart
+       before any slide is evaluated. -->
+__CHART_PREVIEW_SCRIPTS__
   <script>window.__SLIDE_EDITOR_OVERRIDES__ = __OVERRIDES__;</script>
   <script>window.SVG_ASSETS = __SVG_ASSETS__;</script>
   <script>
@@ -500,8 +604,11 @@ __RUNTIME_APPLIER__
                 var nameNode = node.name;
                 // Intrinsic elements only: a lowercase JSXIdentifier. Skip
                 // components (<SlideCover>), member/namespaced names, fragments.
+                // <Chart> is the one component that opts in (as in the add-in's
+                // instrument-source-loc): it forwards the attribute onto its
+                // root div, so a review pin on a chart resolves to its tag.
                 if (!nameNode || nameNode.type !== "JSXIdentifier") return;
-                if (!/^[a-z]/.test(nameNode.name)) return;
+                if (!/^[a-z]/.test(nameNode.name) && nameNode.name !== "Chart") return;
                 for (var i = 0; i < node.attributes.length; i++) {
                   var a = node.attributes[i];
                   if (a.type === "JSXAttribute" && a.name &&
@@ -649,6 +756,14 @@ __RUNTIME_APPLIER__
         }
       });
 
+      // The Chart binding slide jsx is compiled against — installed by the
+      // bundle's chart-preview scripts above; without them a chart renders
+      // nothing, exactly as the add-in's page behaves.
+      var Chart = window.SlidemindChart
+        ? window.SlidemindChart.createComponent(React)
+        : function () { return null; };
+      var slideScope = Object.assign({ Chart: Chart }, LAYOUTS);
+
       var slides = [];
       document.querySelectorAll('script[data-kind="slide"]').forEach(function (s) {
         var idx = parseInt(s.dataset.index, 10);
@@ -657,7 +772,7 @@ __RUNTIME_APPLIER__
           var Component = evalJsx(
             s.textContent,
             "slides/" + name + ".jsx",
-            LAYOUTS
+            slideScope
           );
           slides[idx] = { name: name, Component: Component };
         } catch (err) {
@@ -898,6 +1013,11 @@ export async function buildDeck(deckDir, opts = {}) {
   );
   await lintSlidesOrThrow({ deckDir, slideFiles, layoutSources });
 
+  // The <Chart> stand-in runtime rides in the same bundle cache (see
+  // loadChartPreview) — resolved after lint, which already proved the bundle
+  // is materialized.
+  const chartPreview = await loadChartPreview(resolveBundleDirForDeck(deckDir));
+
   copyDesignSystem(deckDir, skill);
 
   const layoutsBlock = layoutFiles.map(inlineLayout).join("\n");
@@ -908,11 +1028,22 @@ export async function buildDeck(deckDir, opts = {}) {
   const svgAssets = collectSvgAssets(deckDir);
 
   const html = HTML_TEMPLATE.replace("__TITLE__", path.basename(deckDir))
+    .replace("__BRAND_FONT_FACES__", brandFontFaces(deckDir, skill))
     .replace("__LAYOUTS__", layoutsBlock)
     .replace("__SLIDES__", slidesBlock)
     .replace("__OVERRIDES__", safeInlineJson(loadOverrides(deckDir)))
     .replace("__SVG_ASSETS__", safeInlineJson(svgAssets))
-    .replace("__RUNTIME_APPLIER__", safeInline(fs.readFileSync(RUNTIME_APPLIER, "utf8")));
+    .replace("__RUNTIME_APPLIER__", safeInline(fs.readFileSync(RUNTIME_APPLIER, "utf8")))
+    // Function replacers: script sources may contain `$&`-style patterns that a
+    // string replacement would expand.
+    .replace("__CHART_THEME_TOKENS__", () => (chartPreview ? chartPreview.tokensCss : ""))
+    .replace("__CHART_PREVIEW_SCRIPTS__", () =>
+      chartPreview
+        ? chartPreview.scripts
+            .map((script) => `  <script>\n${safeInline(script.source)}\n  </script>`)
+            .join("\n")
+        : "",
+    );
 
   const out = path.join(deckDir, "presentation.html");
   fs.writeFileSync(out, html);
@@ -965,6 +1096,35 @@ const OPENER_EXIT_GRACE_MS = 2000;
 // user to open manually unless `quiet` — callers with their own messaging (the
 // review/plan gates) pass quiet:true and speak for themselves.
 export function openInBrowser(target, { quiet = false } = {}) {
+  // Machine-level browser kill-switch for headless simulation batches
+  // (scripts/codex-sim.mjs writes it for the batch, removes it after): every
+  // env/PATH/cwd channel for reaching a sim session proved lossy at least
+  // once, so the LAST line of defense is a HOME-scoped marker no shell can
+  // strip. Stale-guarded to 6h so a crashed batch can't silently disable the
+  // browser for real use forever.
+  // Two locations: the config dir, and THIS MODULE'S OWN DIRECTORY — session
+  // shells have shown unreliable HOME/XDG resolution, but a session that runs
+  // this code by definition resolves __dirname correctly.
+  for (const kill of [
+    path.join(
+      process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"),
+      "slidemind",
+      "suppress-browser",
+    ),
+    path.join(__dirname, ".sim-suppress-browser"),
+  ]) {
+    try {
+      const age = Date.now() - fs.statSync(kill).mtimeMs;
+      if (age < 6 * 60 * 60 * 1000) {
+        if (!quiet) {
+          process.stderr.write(`browser suppressed (simulation) — open ${target} manually\n`);
+        }
+        return Promise.resolve(false);
+      }
+    } catch {
+      // marker absent — keep checking / open normally
+    }
+  }
   const chain = openerChain(target);
   return new Promise((resolve) => {
     const tryAt = (i) => {
@@ -1012,10 +1172,15 @@ function parseArgs(argv) {
       args.deck = argv[++i];
     } else if (a === "--open") {
       args.open = true;
+    } else if (a === "--fix") {
+      args.fix = true;
     } else if (a === "-h" || a === "--help") {
       process.stdout.write(
-        "Usage: slidemind build <deck> [--open]\n" +
-          "       node src/builders/build.mjs --deck <deck> [--open]\n",
+        "Usage: slidemind build <deck> [--open] [--fix]\n" +
+          "       node src/builders/build.mjs --deck <deck> [--open] [--fix]\n" +
+          "  --fix  apply the deterministic lint autofixes to slides/*.jsx before building\n" +
+          "         (pin inline-svg px size from its viewBox; letter-spacing em→px where the\n" +
+          "         block's px font-size makes the conversion exact)\n",
       );
       process.exit(0);
     } else {
@@ -1033,6 +1198,15 @@ function parseArgs(argv) {
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   const deckDir = path.resolve(args.deck);
+  if (args.fix) {
+    const { fixDeckSlides } = await import("./lint-fix.mjs");
+    const fixed = fixDeckSlides(deckDir);
+    if (fixed.fixes) {
+      process.stdout.write(
+        `Autofixed ${fixed.fixes} lint issue(s) in ${fixed.files} slide file(s) — re-read any file before patching it.\n`,
+      );
+    }
+  }
   const { out, slideCount } = await buildDeck(deckDir);
   const rel = path.relative(process.cwd(), out) || out;
   process.stdout.write(`Built ${rel}  (${slideCount} slides)\n`);