slidemind 0.3.5 → 0.3.12

package/skills/search/SKILL.md

@@ -142,10 +142,14 @@ Follow `workflow/search.md` for the discipline; this is the CLI shape of its loo
 4. **Read / view, then pick.** For **content** results, read the per-slide **text + score** the
    search prints — that is the on-the-wire signal; you usually don't need the picture. For
    **visual** results, scan the numbered thumbnail list; when the search prints a **contact sheet**
-   path, Read that ONE file — every candidate is on it with its selection number burned in — and
-   when it says there is none on this path, pull individual previews with `slidemind view-slide
-   --search <searchId> --pick <n>` (it writes one result's preview to a file you can Read), or
-   `slidemind search … --json` for the structured payload. Pick by **selection number(s)**.
+   path, Read that ONE file — every candidate is on it with its selection number burned in. With no
+   contact sheet, previews depend on the result type: **slide-library results** support `slidemind
+   view-slide --search <searchId> --pick <n>` (writes one result's preview to a file you can Read);
+   **image/icon results have NO preview on this path** — `view-slide` answers "no image returned"
+   for them, so never call it on an image search, and never retry it hoping for a different answer.
+   For icons, pick by title + score, `download-result` the pick (downloads are cheap), Read the
+   saved file, and re-search once if it was wrong — two failed downloads for the same need means
+   mark it unresolved and move on. Pick by **selection number(s)**.
 5. **Read the source deck when the story matters.** A found slide came out of a real presentation,
    and often the answer the user needs is in the *rest* of it — how the slide was framed, what came
    before and after, whether that deck already covers more of the ask. `slidemind read-source
@@ -237,7 +241,7 @@ insert live, fold into a deck, engine fetch). You are the local harness — this
 | **discover engines** ("list what you can reach") | `slidemind ls engines [--type collection\|search\|scope] [--subtype …]` — returns the engine catalog **plus the search scopes** (pick an `id`; never guess one). The catalog is backend/user-scoped; `--to` is accepted but never needed. No window needed where the add-in serves the pane-free routes. |
 | **engine search** (with `intent`) | `slidemind search "<query>" --engine <id> --intent <auto\|content\|visual> [--top N] [--deck <deck>]` — leave `--to` off → a `searchId` + numbered results, plus the exact follow-up commands for the path it took (`--deck` routes by that deck's design when several environments are connected) |
 | **search a scope** (unfiltered corpus, no engine) | `slidemind search "<query>" --engine <scope:all\|scope:sharepoint> --result-type <slide\|image> [--intent …]` — `--result-type` is required for a scope (defaults to `slide`). Results reuse identically to engine results. |
-| **pull an on-demand thumbnail** for a stored result | `slidemind view-slide --search <searchId> --pick <n>` — writes one result's preview image to a file (add `--to <searchWindow>` only on the relayed path) · or `slidemind search … --json` for the structured payload. |
+| **pull an on-demand thumbnail** for a stored result | `slidemind view-slide --search <searchId> --pick <n>` — SLIDE-library results only; image/icon results have no preview ("no image returned") — download and Read the file instead (add `--to <searchWindow>` only on the relayed path) · or `slidemind search … --json` for the structured payload. |
 | **read a result's SOURCE deck** (the presentation it came from) | `slidemind read-source --search <searchId> --pick <n> [--from-slide N] [--to-slide N] [--out <file.md>]` — Markdown of the whole source presentation, one section per slide (add `--to <searchWindow>` only on the relayed path). Indexed text, not the live file. Slide results only. |
 | **insert live** (reuse a slide → the open window) | `slidemind insert-slide --search <searchId> --pick <n[,n,…]> --to <presId> [--at N]` — **host-required**: the slide lands in that open window |
 | **fold into a deck** (reuse a slide → deck source) | `slidemind add-slide --search <searchId> --pick <n[,n,…]> --deck <deck> [--at N] [--json]` → writes `decks/<slug>/slides/NN-reused-*.pptx` (add `--to <searchWindow>` only on the relayed path, where extraction runs on the search's window) |

package/src/bridge/build-and-push.mjs

@@ -273,10 +273,10 @@ export async function renderDeckToBase64(
   // server splices them back from. Keyed by slide file name, like `slides`.
   const conversions = loadConversions(deckDir);
   const hasConversions = Object.keys(conversions).length > 0;
-  for (const file of conversionsMissingPreserveSource(conversions)) {
+  for (const file of conversionsMissingPreserveSource(conversions, deckDir)) {
     process.stderr.write(
-      `note: ${file} has preserved native objects but no conversions/*.slide.pptx ` +
-        `to splice them from — re-run 'slidemind adopt' for that deck\n`,
+      `note: ${file} has preserved native objects or a sourced chart but no ` +
+        `conversions/*.slide.pptx to read them from — re-run 'slidemind adopt' for that deck\n`,
     );
   }
 

package/src/bridge/bundle.mjs

@@ -30,7 +30,6 @@
 //   ├── assets/brand-images.md    (on-demand manifest of the reusable master images,
 //   │                              built from wire.extractedImages — design.md only
 //   │                              carries a sparse pointer + per-kind counts)
-//   ├── samples/*                 (downloaded from wire.samples[].url — brand reference slides)
 //   ├── fonts/*                   (downloaded from wire.fonts[].url, optional)
 //   ├── master/empty-layout.pptx  (downloaded from wire.master.url, optional)
 //   ├── engines.json              (wire.engines[] — legacy: new backends dropped the
@@ -87,6 +86,33 @@ export function readMaterializedBundleMeta(presFP) {
   }
 }
 
+// Every design materialized on this machine: one entry per cache dir that
+// carries a readable bundle.json. `ready` reports these so the agent can ask
+// the user WHICH design to build against when more than one is at hand —
+// no network, never throws.
+export function listCachedBundles() {
+  const root = bundleCacheRoot();
+  let entries = [];
+  try {
+    entries = fs.readdirSync(root, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const out = [];
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const dir = path.join(root, entry.name);
+    try {
+      const meta = JSON.parse(fs.readFileSync(path.join(dir, "bundle.json"), "utf8"));
+      const presFP = meta?.presFP ?? entry.name;
+      out.push({ presFP, dir, meta });
+    } catch {
+      /* half-written or foreign dir — not a design */
+    }
+  }
+  return out;
+}
+
 // Wipe the whole materialized bundle cache so the next build/push/download
 // re-fetches every design bundle fresh from the add-in. `slidemind init` calls
 // this: init is the deliberate (re)setup point — and `slidemind update`
@@ -164,22 +190,6 @@ async function downloadInto(targetPath, url) {
   fs.writeFileSync(targetPath, buf);
 }
 
-// File extension for a sample image, derived from its wire `contentType`. The
-// sample's stable `id` is the basename; samples carry no `filename` on the wire.
-function sampleExt(contentType) {
-  switch (contentType) {
-    case "image/jpeg":
-      return ".jpg";
-    case "image/webp":
-      return ".webp";
-    case "image/svg+xml":
-      return ".svg";
-    case "image/png":
-    default:
-      return ".png";
-  }
-}
-
 const REUSABLE_KIND_ORDER = [
   "logo",
   "icon",
@@ -235,11 +245,11 @@ function buildReusableImagesManifest(extractedImages) {
 
 // Sync the bundle for `presId`. Idempotent: every call rewrites all inline
 // text from the freshly fetched wire (the wire is fetched on every call
-// anyway), downloads only binaries whose per-item blob etag changed (samples
-// are write-once by id), and prunes files the wire no longer serves. There is
+// anyway), downloads only binaries whose per-item blob etag changed, and
+// prunes files the wire no longer serves. There is
 // deliberately NO staleness token to compare — the materialized dir is always
 // a per-item projection of the last wire, so authored-layer edits that bypass
-// a bundle re-produce (engines, image-source guidelines, sample curation) and
+// a bundle re-produce (engines, image-source guidelines) and
 // deployment-owned content (workflow refs, the lint engine) can never go
 // stale here. `force` re-downloads binaries even when their etags match.
 // Target: `presId` (pane registry), or `brandId` in options for the pane-free
@@ -376,7 +386,7 @@ export async function materializeBundle(
       return;
     }
     if (!force && exists && !etag) {
-      return; // write-once binary (samples carry no etag) — presence is currency
+      return; // write-once binary without an etag — presence is currency
     }
     downloads.push({ rel, target, url, etag: etag ?? null, label });
   };
@@ -408,21 +418,6 @@ export async function materializeBundle(
       "master empty-layout.pptx",
     );
   }
-  // Per-CD sample slides (the brand's own reference slides) — write-once
-  // captures keyed by the sample's stable `id`; extension derived from
-  // `contentType`.
-  for (const sample of wire.samples ?? []) {
-    if (!sample?.url || !sample?.id) continue;
-    queueBinary(
-      path.join(
-        "samples",
-        `${path.basename(sample.id)}${sampleExt(sample.contentType)}`,
-      ),
-      sample.url,
-      null,
-      `sample ${sample.id}`,
-    );
-  }
   // Reusable master images (logos, decorations, illustrations the add-in's
   // vision pass lifted from the brand's own master and flagged `reusable`).
   // Each carries a `workspacePath` (e.g. `assets/master-<sha8>.<ext>`) that the
@@ -522,6 +517,21 @@ export async function materializeBundle(
         role: f.role,
         family: f.family,
         filename: path.basename(f.filename),
+        // Face descriptors (multi-face families: Regular/Bold/Italic/…).
+        // Without them every face of a family registers descriptor-less and
+        // the last one wins for ALL weights — bold measured with the regular
+        // face. Older backends omit them; default to a plain 400/normal face.
+        weight:
+          typeof f.weight === "number" && f.weight >= 100 && f.weight <= 900
+            ? f.weight
+            : 400,
+        style: f.style === "italic" ? "italic" : "normal",
+        variable:
+          f.variable &&
+          typeof f.variable.minWeight === "number" &&
+          typeof f.variable.maxWeight === "number"
+            ? { minWeight: f.variable.minWeight, maxWeight: f.variable.maxWeight }
+            : null,
       })),
     binaries,
     fetchedAt: new Date().toISOString(),
@@ -529,9 +539,13 @@ export async function materializeBundle(
   };
   fs.writeFileSync(metaPath, JSON.stringify(meta, null, 2), "utf8");
 
+  // Last, after every write AND the prune — the overlay must win over the wire.
+  const overlaid = applyBundleOverlay(dir);
+
   return {
     dir,
     presFP,
+    overlaid,
     etag: wire.etag ?? null,
     version: wire.version ?? null,
     // Which backend actually served the wire — meaningful on the brandId
@@ -545,6 +559,47 @@ export async function materializeBundle(
   };
 }
 
+// Copy `$SLIDEMIND_BUNDLE_OVERLAY/**` over a materialized bundle. Experiment-only
+// hook for the skill-optimization loop (LOOP_PLAN.md): it lets a run vary the
+// add-in-owned workflow/design docs without a deploy. Deliberately undocumented
+// in user-facing help. The wire re-syncs every text file on EVERY materialize
+// (and the prune deletes anything it doesn't own), so this re-applies each time.
+export function applyBundleOverlay(dir) {
+  const overlay = process.env.SLIDEMIND_BUNDLE_OVERLAY;
+  if (!overlay) return 0;
+  let copied = 0;
+  try {
+    if (!fs.statSync(overlay).isDirectory()) return 0;
+    fs.cpSync(overlay, dir, {
+      recursive: true,
+      force: true,
+      // Docs only (.md/.css): the bundle dir also holds lint-engine.mjs and
+      // capture-engine.mjs, which the CLI dynamic-imports — an overlay must
+      // never be able to swap executable code, and text files re-sync from the
+      // wire on every materialize so a doc overlay can't persist past the
+      // experiment (binaries would).
+      filter: (src) => {
+        let st;
+        try {
+          st = fs.lstatSync(src);
+        } catch {
+          return false; // dangling symlink — skip, never fail the materialize
+        }
+        if (st.isDirectory()) return true;
+        if (!/\.(md|css)$/i.test(src)) return false;
+        copied += 1;
+        return true;
+      },
+    });
+  } catch (err) {
+    // The overlay is an experiment convenience — a bad overlay must not break
+    // ready/build/push after an otherwise successful sync.
+    process.stderr.write(`bundle overlay skipped: ${err.message}\n`);
+    return 0;
+  }
+  return copied;
+}
+
 // Delete files the current sync doesn't own and collapse empty directories.
 // `expected` holds dir-relative paths exactly as `path.join` built them, so
 // the comparison is platform-consistent.

package/src/bridge/capture.mjs

@@ -114,6 +114,12 @@ export function buildCaptureInput(deckDir, bundleDir) {
       family: f.family,
       filename: path.basename(f.filename),
       bytesB64: fs.readFileSync(fontPath).toString("base64"),
+      // Face descriptors — the capture engine emits per-face @font-face
+      // weight/style rules from these (engine defaults 400/normal when a
+      // pre-descriptor meta.json omits them).
+      weight: f.weight,
+      style: f.style,
+      variable: f.variable ?? null,
     });
   }
 
@@ -214,3 +220,31 @@ export async function captureDeckLocally({ deckDir, bundleDir, onProgress }) {
   const input = buildCaptureInput(deckDir, bundleDir);
   return withBrowser((browser) => engine.captureDeck(browser, input, { onProgress }));
 }
+
+/**
+ * The `<Chart>` stand-in runtime the add-in exports from the SAME artifact
+ * (`chartPreview: { scripts: [{ filename, source }], tokensCss }`), for the
+ * host-free HTML preview (`slidemind build`, and the review gate that serves
+ * it). The CLI ships no chart source: the page inlines these before any slide
+ * is evaluated, exactly where the add-in's own page loads them.
+ *
+ * null when the bundle has no engine or the engine predates charts. That is
+ * never a silent degradation: such a bundle's lint engine (same deployment)
+ * rejects `<Chart>` as an unknown component before a page is ever built.
+ */
+export async function loadChartPreview(bundleDir) {
+  if (!bundleDir || !bundleHasCaptureEngine(bundleDir)) return null;
+  const enginePath = path.join(bundleDir, "capture-engine.mjs");
+  const version = readBundleMeta(bundleDir).captureEngineVersion ?? "0";
+  const engine = await import(
+    `${pathToFileURL(enginePath).href}?v=${encodeURIComponent(version)}`
+  );
+  const preview = engine.chartPreview;
+  if (!preview || !Array.isArray(preview.scripts)) return null;
+  return {
+    scripts: preview.scripts.filter(
+      (s) => s && typeof s.filename === "string" && typeof s.source === "string",
+    ),
+    tokensCss: typeof preview.tokensCss === "string" ? preview.tokensCss : "",
+  };
+}

package/src/bridge/client.mjs

@@ -164,9 +164,15 @@ function transientRetryDelays() {
 // information) from "this session is dead" (the user's problem) — see
 // resolveSearchBackend.
 function sessionInvalidError() {
+  // Deliberately does NOT say `logout --all`: a 401 means the add-in answered
+  // "no such session" (revoked in Settings → Connect CLI, or expired). Running
+  // `setup` with a fresh command replaces this backend's record in place, so
+  // nothing has to be wiped first — and a user with two environments who wipes
+  // everything on every 401 is how the 2026-08-27 reconnect loop happened.
   const err = new Error(
-    "slidemind session is invalid or expired. Run `slidemind logout --all`, then " +
-      "reconnect with a fresh command from the add-in's Connect CLI panel.",
+    "slidemind session is invalid or expired: the add-in no longer knows this session " +
+      "(revoked under Settings → General → Connect CLI, or expired). Reconnect with a fresh " +
+      "command from that panel; other environments and your Microsoft 365 sign-in stay as they are.",
   );
   err.status = 401;
   err.code = "session_invalid";
@@ -191,13 +197,13 @@ function isTransientBridgeError(err) {
   return /relay unreachable/i.test(String(err.message || ""));
 }
 
-async function withTransientRetry(fn) {
+async function withTransientRetry(fn, isRetryable = isTransientBridgeError) {
   const delays = transientRetryDelays();
   for (let attempt = 0; ; attempt += 1) {
     try {
       return await fn();
     } catch (err) {
-      if (attempt >= delays.length || !isTransientBridgeError(err)) throw err;
+      if (attempt >= delays.length || !isRetryable(err)) throw err;
       await new Promise((resolve) => setTimeout(resolve, delays[attempt]));
     }
   }
@@ -531,10 +537,18 @@ async function listPresentationsForBackend(backendURL) {
 async function readinessForBackend(backendURL) {
   const env = deriveEnvLabel(backendURL);
   try {
-    const res = await bridgeFetch(
-      "/api/cli/readiness",
-      { timeoutMs: listTimeoutMs() },
-      backendURL,
+    // Retry only a 503: the add-in answers that (code `backend_unavailable`)
+    // while its session store cannot respond, and a 404 here means an older
+    // add-in without the readiness route, which the fallback below handles
+    // without waiting out the retry delays.
+    const res = await withTransientRetry(
+      () =>
+        bridgeFetch(
+          "/api/cli/readiness",
+          { timeoutMs: listTimeoutMs() },
+          backendURL,
+        ),
+      (err) => err?.status === 503 && err?.code !== "pane_suspended",
     );
     const data = (await res.json()) ?? {};
     const presentations = Array.isArray(data.presentations)
@@ -591,6 +605,12 @@ export async function connectionStatus() {
       backendURL,
       ok: false,
       error: r.reason?.message ? r.reason.message : String(r.reason),
+      // Machine code of the failure (`backend_unavailable`, `session_invalid`,
+      // …) so the readiness ladder can tell "retry shortly" from "re-pair".
+      code: typeof r.reason?.code === "string" ? r.reason.code : null,
+      // The HTTP status too: a proxy's 503 carries no machine code (or only a
+      // prose `error`), and the ladder must still read it as "wait".
+      status: typeof r.reason?.status === "number" ? r.reason.status : null,
       presentations: [],
     };
   });
@@ -1112,13 +1132,19 @@ function conceptTimeoutMs() {
 
 async function postConceptImages(
   brandId,
-  { planMarkdown, slideNumbers },
+  { planMarkdown, slideNumbers, references },
   backendURL,
 ) {
   const body = { planMarkdown };
   if (Array.isArray(slideNumbers) && slideNumbers.length > 0) {
     body.slideNumbers = slideNumbers;
   }
+  // The user's own images, inline: `{ role: "concept" | "style", image:
+  // <data URI>, slides?: number[], name? }`. A concept replaces the generated
+  // mockup for its slides; a style reference leads the generation.
+  if (Array.isArray(references) && references.length > 0) {
+    body.references = references;
+  }
   const res = await bridgeFetch(
     `/api/cli/brands/${encodeURIComponent(brandId)}/concept-images`,
     {
@@ -1136,8 +1162,9 @@ async function postConceptImages(
 }
 
 // Generate concept mockup images for a brand over the pane-free brand route.
-// Body `{ planMarkdown, slideNumbers? }`; the optional `slideNumbers` filters
-// which storyboard beats are rendered (the CLI batches per-slide). Returns the
+// Body `{ planMarkdown, slideNumbers?, references? }`; the optional `slideNumbers`
+// filters which storyboard beats are rendered (the CLI batches per-slide);
+// `references` carries the user's own concept/style images inline. Returns the
 // server's `{ ok, images, slideCount }` augmented with the resolved
 // `backendURL`. When `backendURL` is given it posts directly; otherwise it
 // fans out — like getDesignBundleForBrandAnyBackend, presFP/brandId is globally
@@ -1146,7 +1173,7 @@ async function postConceptImages(
 // unknown brand, missing grant) so callers can degrade to "continue without".
 export async function generateConceptImagesForBrand(
   brandId,
-  { planMarkdown, slideNumbers = null, backendURL = null } = {},
+  { planMarkdown, slideNumbers = null, references = null, backendURL = null } = {},
 ) {
   if (!brandId) {
     throw new Error("generateConceptImagesForBrand: brandId is required");
@@ -1155,7 +1182,11 @@ export async function generateConceptImagesForBrand(
     throw new Error("generateConceptImagesForBrand: planMarkdown is required");
   }
   if (backendURL) {
-    return postConceptImages(brandId, { planMarkdown, slideNumbers }, backendURL);
+    return postConceptImages(
+      brandId,
+      { planMarkdown, slideNumbers, references },
+      backendURL,
+    );
   }
   const sessions = sessionsInScope();
   const failures = [];
@@ -1170,7 +1201,7 @@ export async function generateConceptImagesForBrand(
       }
       return await postConceptImages(
         brandId,
-        { planMarkdown, slideNumbers },
+        { planMarkdown, slideNumbers, references },
         s.backendURL,
       );
     } catch (err) {
@@ -1214,15 +1245,15 @@ async function postGenerateImage(brandId, body, backendURL) {
 }
 
 // Generate ONE regular image over the pane-free brand route
-// (`slidemind imagen`). Body `{ prompt, size?, quality?, brandStyle? }`;
-// returns the server's `{ ok, image, styleReferences }` augmented with the
+// (`slidemind imagen`). Body `{ prompt, size?, quality? }`;
+// returns the server's `{ ok, image }` augmented with the
 // resolved `backendURL`. Fan-out and degradation mirror
 // generateConceptImagesForBrand: throws a typed `imagen_route_unavailable`
 // when no paired backend serves the route (older add-ins, unknown brand,
 // missing grant) so callers can print the one actionable fix.
 export async function generateImageForBrand(
   brandId,
-  { prompt, size = null, quality = null, brandStyle = false, backendURL = null } = {},
+  { prompt, size = null, quality = null, backendURL = null } = {},
 ) {
   if (!brandId) {
     throw new Error("generateImageForBrand: brandId is required");
@@ -1233,7 +1264,6 @@ export async function generateImageForBrand(
   const body = { prompt };
   if (size) body.size = size;
   if (quality) body.quality = quality;
-  if (brandStyle) body.brandStyle = true;
   if (backendURL) {
     return postGenerateImage(brandId, body, backendURL);
   }
@@ -3316,20 +3346,26 @@ export function resolveDesignSource(
     return { status: "ambiguous", ...dedupeCandidates(matches) };
   }
 
-  const distinctDesigns = new Set(all.map(designKey));
+  // A live pane outranks a suspended one for the DESIGN decision: a
+  // backgrounded — or closed and not yet purged — window must not turn the one
+  // design the user actually has in front of them into a question. Only when
+  // nothing is live do the suspended windows decide.
+  const live = all.filter(isPaneReadyPresentation);
+  const pool = live.length > 0 ? live : all;
+  const distinctDesigns = new Set(pool.map(designKey));
   if (distinctDesigns.size === 1) {
     // One design open (possibly one window mirrored across backends, or several
     // windows on the SAME CD). Pick via the mirror tie-break, else a live pane,
     // else the first — the design is unambiguous either way.
     const entry =
-      tieBreakMatches(all, deckPresFP) ??
-      all.find(isPaneReadyPresentation) ??
-      all[0];
+      tieBreakMatches(pool, deckPresFP) ??
+      pool.find(isPaneReadyPresentation) ??
+      pool[0];
     return { status: "resolved", entry };
   }
   // ≥2 distinct designs open — the only case that asks the user (the deck ref
   // does NOT auto-pick; it only annotates `suggested`).
-  return { status: "ambiguous", ...dedupeCandidates(all) };
+  return { status: "ambiguous", ...dedupeCandidates(pool) };
 }
 
 // Pick a target presentation given the (possibly multi-backend) registry and an

package/src/bridge/config.mjs

@@ -160,6 +160,7 @@ export function readSessions() {
       backendURL: s.backendURL,
       sessionToken: s.sessionToken,
       label: typeof s.label === "string" && s.label ? s.label : deriveEnvLabel(s.backendURL),
+      ...(typeof s.oid === "string" && s.oid ? { oid: s.oid } : {}),
       ...(typeof s.msGraphRefreshToken === "string" && s.msGraphRefreshToken
         ? { msGraphRefreshToken: s.msGraphRefreshToken }
         : {}),
@@ -199,6 +200,7 @@ function writeAll(sessions, defaultBackend) {
       backendURL: s.backendURL,
       sessionToken: s.sessionToken,
       label: s.label || deriveEnvLabel(s.backendURL),
+      ...(s.oid ? { oid: s.oid } : {}),
       ...(s.msGraphRefreshToken ? { msGraphRefreshToken: s.msGraphRefreshToken } : {}),
     })),
   };
@@ -220,15 +222,32 @@ function writeAll(sessions, defaultBackend) {
 // pairing that session with the previous user's delegated Graph token would
 // fetch one person's content under another's session. `slidemind login` again
 // is one command; a mismatched identity is not recoverable by the user.
-export function upsertSession({ backendURL, sessionToken, label = null }) {
+export function upsertSession({ backendURL, sessionToken, label = null, oid = null }) {
   if (!backendURL || !sessionToken) {
     throw new Error("upsertSession: backendURL and sessionToken are required");
   }
-  const sessions = readSessions().filter((s) => s.backendURL !== backendURL);
+  const all = readSessions();
+  const previous = all.find((s) => s.backendURL === backendURL);
+  const sessions = all.filter((s) => s.backendURL !== backendURL);
+  // A re-pair replaces the add-in session, not the Microsoft 365 sign-in — but
+  // only when the SAME person re-paired: a claim can hand a shared machine to
+  // someone else, who must not inherit the previous user's delegated token.
+  // Identity is the add-in-reported `oid`; unknown on either side means drop.
+  const samePerson = Boolean(oid) && previous?.oid === oid;
+  // Dropping the field detaches the record from a keychain-stored secret; the
+  // secret itself has to go too, or the previous user's refresh token stays
+  // readable at rest for whoever shares this login keychain.
+  if (!samePerson && previous?.msGraphRefreshToken === KEYCHAIN_MARKER && keychainUsable()) {
+    keychainDelete(backendURL);
+  }
   sessions.push({
     backendURL,
     sessionToken,
     label: label || deriveEnvLabel(backendURL),
+    ...(oid ? { oid } : {}),
+    ...(samePerson && previous?.msGraphRefreshToken
+      ? { msGraphRefreshToken: previous.msGraphRefreshToken }
+      : {}),
   });
   const def = getDefaultBackend() || backendURL;
   writeAll(sessions, def);

package/src/bridge/engine-download.mjs

@@ -14,7 +14,7 @@ import {
   imageSizeFromBuffer,
   svgSizeFromMarkup,
 } from "./image-dimensions.mjs";
-import { describeRecolor } from "./recolor.mjs";
+import { applyLocalRecolor, describeRecolor } from "./recolor.mjs";
 
 // Every image format an engine accepts, plus the alias spellings seen in the
 // wild. Mirrors the add-in's `searchImage` set (lib/image-formats.ts there);
@@ -151,12 +151,18 @@ function describeRecolorWithRefusal(markup, mimeType, iconColor, refusedColor) {
     refusedColor ? null : (iconColor ?? null),
   );
   if (!refusedColor) return described;
+  // With the local bake in place (applyLocalRecolor), a surviving refusal
+  // means the glyph itself declined the colour — say why instead of sending
+  // the agent on a pane hunt.
+  const why =
+    described.mode === "multicolor"
+      ? "it is a multi-tone glyph and a single colour would flatten it — left as designed."
+      : described.mode === "raster"
+        ? "raster images carry their own colours."
+        : "the glyph's paint structure could not be rewritten safely.";
   return {
     ...described,
-    note:
-      `Saved in its ORIGINAL colours — recolouring to ${refusedColor} runs in the slidemind add-in. ` +
-      "Re-run this download with --to <presId> (a PowerPoint window with the slidemind pane open) " +
-      "to bake the colour in.",
+    note: `Saved in its ORIGINAL colours — recolouring to ${refusedColor} was not applied: ${why}`,
   };
 }
 
@@ -218,16 +224,29 @@ async function streamOneResult({
     if (res?.svgMarkup) {
       // SVG arrives inline, not as a stream.
       fs.rmSync(tempPath, { force: true });
+      // Window-free tint fallback: the pane-side refusal is about WHERE the
+      // rewrite runs, not whether it's possible — for currentColor/mono SVGs
+      // the bake is a deterministic local string transform. Measured impact:
+      // one sim batch carried 235 "saved in ORIGINAL colours" notes, every
+      // one an off-brand icon on the rendered slide.
+      let markup = res.svgMarkup;
+      if (recolorRefused) {
+        const local = applyLocalRecolor(markup, recolorRefused);
+        if (local.applied) {
+          markup = local.markup;
+          recolorRefused = null;
+        }
+      }
       const filename = `engine-${searchId}-${selection}.svg`;
       const target = path.join(assetsDir, filename);
-      fs.writeFileSync(target, res.svgMarkup, "utf8");
+      fs.writeFileSync(target, markup, "utf8");
       return {
         selection,
         path: target,
         reference: `./assets/${filename}`,
         mimeType: res.mimeType ?? "image/svg+xml",
         recolor: describeRecolorWithRefusal(
-          res.svgMarkup,
+          markup,
           res.mimeType,
           iconColor,
           recolorRefused,

package/src/bridge/recolor.mjs

@@ -110,3 +110,49 @@ export function describeRecolor(svgMarkup, mimeType, appliedColor = null) {
     note,
   };
 }
+
+// Bake a colour into an SVG LOCALLY — the fallback for the window-free path,
+// where the add-in refuses the tint (`recolor_needs_host`) because its
+// DOM-based classifier lives pane-side. For the two recolourable modes the
+// rewrite is a deterministic string transform this module can do itself:
+//   currentColor — replace every `currentColor` paint with the hex;
+//   mono         — replace every concrete fill/stroke paint with the hex.
+// Multicolor and raster are refused (flattening a multi-tone glyph or touching
+// raster bytes is never right). Returns { markup, applied }.
+export function applyLocalRecolor(svgMarkup, hex) {
+  if (typeof svgMarkup !== "string" || !hex || !isSvg(null, svgMarkup)) {
+    return { markup: svgMarkup, applied: false };
+  }
+  if (hasCurrentColor(svgMarkup)) {
+    return {
+      markup: svgMarkup.replace(
+        /((?:fill|stroke)\s*[:=]\s*["']?\s*)currentColor/gi,
+        `$1${hex}`,
+      ),
+      applied: true,
+    };
+  }
+  const paints = distinctPaints(svgMarkup);
+  if (paints.size >= 2 || paints.size === 0) {
+    // Multicolor: never flatten. Zero declared paints: the glyph renders in
+    // the SVG default (black) via inheritance — inject a root fill instead of
+    // rewriting nothing.
+    if (paints.size === 0) {
+      return {
+        markup: svgMarkup.replace(/<svg\b/i, `<svg fill="${hex}"`),
+        applied: true,
+      };
+    }
+    return { markup: svgMarkup, applied: false };
+  }
+  const markup = svgMarkup.replace(
+    /((?:fill|stroke)\s*[:=]\s*["']?\s*)(#[0-9a-fA-F]{3,8}|rgba?\([^)]*\)|hsla?\([^)]*\)|[a-zA-Z]+)/g,
+    (m, prefix, value) => {
+      const v = value.trim().toLowerCase();
+      if (v === "none" || v === "transparent") return m;
+      if (!/^#|^rgb|^hsl/.test(v) && !NAMED_COLORS.has(v)) return m;
+      return `${prefix}${hex}`;
+    },
+  );
+  return { markup, applied: true };
+}

package/src/bridge/setup-claim.mjs

@@ -114,7 +114,13 @@ export async function redeemSetupClaim({ backendURL, secret, cliVersion }) {
   }
 
   if (result.status === 200 && result.json?.sessionToken) {
-    return String(result.json.sessionToken);
+    // `oid` (the user's directory id) arrives from add-ins that report it; an
+    // older add-in leaves it null, which the session store treats as "unknown
+    // person" — i.e. never inherit the previous Microsoft 365 sign-in.
+    return {
+      sessionToken: String(result.json.sessionToken),
+      oid: typeof result.json.oid === "string" && result.json.oid ? result.json.oid : null,
+    };
   }
   // Discriminate on the error CODE, not the status. A deployment that predates
   // one-command setup has no such route, so the request falls through to that