npm - @agent-native/core-corpus - Versions diffs - 0.201.1 → 0.202.0-nightly-20261006033736 - Mend

@@ -2,9 +2,31 @@ function escapeSqlValue(value: string): string {
   return value.replace(/'/g, "''");
 }
+// GoogleSQL has no doubled-quote escape: 'o''brien' is a syntax error, and an
+// unescaped backslash would swallow the closing quote.
+function escapeGoogleSqlValue(value: string): string {
+  const escapes: Record<string, string> = {
+    "\\": "\\\\",
+    "'": "\\'",
+    '"': '\\"',
+    "\n": "\\n",
+    "\r": "\\r",
+    "\t": "\\t",
+    "\b": "\\b",
+    "\f": "\\f",
+  };
+  return value.replace(
+    /[\\'"\x00-\x1f\x7f]/g,
+    (character) =>
+      escapes[character] ??
+      `\\x${character.charCodeAt(0).toString(16).padStart(2, "0")}`,
+  );
+}
 export interface InterpolateOptions {
   failClosedTimeVariables?: boolean;
   customDateRangeSupport?: boolean;
+  googleSqlValues?: boolean;
 }
 // ponytail: daily date spines cap custom ranges at roughly ten years; use per-query budgets if wider history becomes a supported need.
@@ -29,6 +51,8 @@ export function interpolateDashboardPanelSql(
       config.timeScope !== "fixed-window" &&
       config.timeScope !== "cohort-history" &&
       config.timeScope !== "all-time",
+    // First-party panels are PostgreSQL SQL that the BigQuery binder re-quotes.
+    googleSqlValues: panel.source === "bigquery",
   });
 }
@@ -169,6 +193,8 @@ export function interpolate(
       return "__missing_dashboard_time_filter__";
     }
     if (value == null) return "";
-    return escapeSqlValue(String(value));
+    return options.googleSqlValues
+      ? escapeGoogleSqlValue(String(value))
+      : escapeSqlValue(String(value));
   });
 }

@@ -32,4 +32,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core-corpus/corpu
 ## Generated Counts
-- template files: 11159
+- template files: 11187

@@ -26,6 +26,11 @@ agent answers about browser recordings in the Analytics template.
   browser or agent.
 - Playback bytes must go through scoped server helpers that check
   `session-recording` access before reading private blob refs.
+- First-party SQL (`query-agent-native-analytics`, dashboard panels) reads
+  `session_recordings` through the same `session-recording` access rule as
+  the UI: the caller's own recordings, plus recordings in the active org that
+  are org-visible or shared with the caller or that org. Any new SQL path over
+  recordings must use that rule, not an `org_id` match.
 - SQL inline chunks are a local/dev fallback only; production should use
   private or encrypted blob storage.
 - A local Analytics app pointed at a production database must also use the key

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-10-02
+---
+Dashboard queries preserve recording permissions across supported SQL formats

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-10-05
+---
+Agent links copied from a dashboard, analysis, or session replay are shorter, so Claude can fetch them without hitting its URL length limit.

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-10-05
+---
+BigQuery dashboard filters work with values that contain apostrophes or backslashes

@@ -242,7 +242,7 @@ function replayChunkSeqsFromQuery(query: Record<string, unknown>): number[] {
 function verifyAgentReplayAccessToken(
   event: any,
   recordingId: string,
-): { token: string; viewerEmail: string } | null | false {
+): { token: string; viewerEmail?: string } | null | false {
   const token = readAgentReplayAccessToken(event);
   if (!token) return null;
   const access = resolveSessionReplayAgentAccess(recordingId, token);

@@ -1007,6 +1007,8 @@ export function buildBigQueryAlertQuery(
   return `SELECT * FROM (${candidateSql}) AS analytics_alert_page${cursorPredicate ? ` WHERE ${cursorPredicate}` : ""} ORDER BY timestamp DESC, id DESC`;
 }
+// PostgreSQL quoting on purpose: queryFirstPartyAnalytics lexes this SQL as
+// PostgreSQL, and its binder re-quotes every literal for GoogleSQL.
 function bigQuerySqlLiteral(value: string): string {
   return `'${value.replace(/'/g, "''")}'`;
 }

@agent-native/core-corpus 0.201.1 → 0.202.0-nightly-20261006033736