@agent-native/core 0.109.0 → 0.109.2

package/corpus/templates/analytics/server/lib/analytics-alerts.ts

@@ -135,6 +135,12 @@ function nowIso(): string {
 
 const ALERT_RULE_RUNNING_STALE_MS = 15 * 60 * 1000;
 const DEFAULT_HTTP_5XX_ALERT_ID_PREFIX = "default-http-5xx-spike";
+const DEFAULT_AGENT_CHAT_STUCK_ALERT_ID_PREFIX =
+  "default-agent-chat-stuck-spike";
+const DEFAULT_AGENT_CHAT_STUCK_ALERT_THRESHOLD = 3;
+const DEFAULT_AGENT_CHAT_STUCK_ALERT_WINDOW_MINUTES = 10;
+const DEFAULT_AGENT_CHAT_STUCK_ALERT_COOLDOWN_MINUTES = 60;
+const DEFAULT_ALERT_SCOPE_PAGE_SIZE = 500;
 const ALERT_RULE_DEFAULTS_KEY = "analytics-alert-rule-defaults";
 
 function safeJsonParse<T>(raw: unknown, fallback: T): T {
@@ -296,6 +302,14 @@ function defaultHttp5xxAlertEnabled(): boolean {
   return currentDeployHostname() === "analytics.agent-native.com";
 }
 
+function defaultAgentChatStuckAlertEnabled(): boolean {
+  const configured = boolEnv(
+    "ANALYTICS_DEFAULT_AGENT_CHAT_STUCK_ALERT_ENABLED",
+  );
+  if (configured !== null) return configured;
+  return currentDeployHostname() === "analytics.agent-native.com";
+}
+
 function envInt(name: string, fallback: number, min: number, max: number) {
   const raw = process.env[name]?.trim();
   if (!raw) return fallback;
@@ -305,18 +319,30 @@ function envInt(name: string, fallback: number, min: number, max: number) {
     : fallback;
 }
 
-function defaultHttp5xxAlertId(ownerEmail: string, orgId: string | null) {
+function defaultAlertId(
+  prefix: string,
+  ownerEmail: string,
+  orgId: string | null,
+) {
   const hash = createHash("sha256")
     .update(`${ownerEmail.toLowerCase()}|${orgId ?? ""}`)
     .digest("hex")
     .slice(0, 10);
-  return `${DEFAULT_HTTP_5XX_ALERT_ID_PREFIX}-${hash}`;
+  return `${prefix}-${hash}`;
 }
 
-async function defaultHttp5xxAlertScopes(): Promise<AccessCtx[]> {
+async function defaultAnalyticsAlertScopePage(offset: number): Promise<{
+  scopes: AccessCtx[];
+  hasMore: boolean;
+}> {
   const ownerEmail = process.env.ANALYTICS_DEFAULT_ALERT_OWNER_EMAIL?.trim();
   const orgId = process.env.ANALYTICS_DEFAULT_ALERT_ORG_ID?.trim() || null;
-  if (ownerEmail) return [{ email: ownerEmail, orgId }];
+  if (ownerEmail) {
+    return {
+      scopes: offset === 0 ? [{ email: ownerEmail, orgId }] : [],
+      hasMore: false,
+    };
+  }
 
   const db = getDb() as any;
   const rows = await db
@@ -326,7 +352,16 @@ async function defaultHttp5xxAlertScopes(): Promise<AccessCtx[]> {
     })
     .from(schema.analyticsPublicKeys)
     .where(isNull(schema.analyticsPublicKeys.revokedAt))
-    .limit(1000);
+    .groupBy(
+      schema.analyticsPublicKeys.ownerEmail,
+      schema.analyticsPublicKeys.orgId,
+    )
+    .orderBy(
+      asc(schema.analyticsPublicKeys.ownerEmail),
+      asc(schema.analyticsPublicKeys.orgId),
+    )
+    .limit(DEFAULT_ALERT_SCOPE_PAGE_SIZE)
+    .offset(offset);
 
   const seen = new Set<string>();
   const scopes: AccessCtx[] = [];
@@ -342,7 +377,10 @@ async function defaultHttp5xxAlertScopes(): Promise<AccessCtx[]> {
     seen.add(key);
     scopes.push({ email, orgId: scopeOrgId });
   }
-  return scopes;
+  return {
+    scopes,
+    hasMore: rows.length === DEFAULT_ALERT_SCOPE_PAGE_SIZE,
+  };
 }
 
 function rowToRule(row: any): AnalyticsAlertRule {
@@ -517,10 +555,20 @@ export async function deleteAnalyticsAlertRule(
     });
   }
   const db = getDb() as any;
-  await db.delete(schema.analyticsAlertRules).where(ownerWhere(ctx, id));
+  const seededDefault =
+    id.startsWith(`${DEFAULT_HTTP_5XX_ALERT_ID_PREFIX}-`) ||
+    id.startsWith(`${DEFAULT_AGENT_CHAT_STUCK_ALERT_ID_PREFIX}-`);
+  if (seededDefault) {
+    await db
+      .update(schema.analyticsAlertRules)
+      .set({ enabled: false, updatedAt: nowIso() })
+      .where(ownerWhere(ctx, id));
+  } else {
+    await db.delete(schema.analyticsAlertRules).where(ownerWhere(ctx, id));
+  }
   recordChange({
     source: "analytics-alert-rules",
-    type: "delete",
+    type: seededDefault ? "change" : "delete",
     key: existing.id,
     owner: existing.ownerEmail,
     orgId: existing.orgId ?? undefined,
@@ -529,6 +577,20 @@ export async function deleteAnalyticsAlertRule(
 
 const DEFAULT_ALERT_SEED_CHUNK_SIZE = 500;
 
+interface DefaultAnalyticsAlertDefinition {
+  idPrefix: string;
+  name: string;
+  description: string;
+  eventName: string;
+  filters: AnalyticsAlertFilter[];
+  threshold: number;
+  thresholdMode?: AnalyticsAlertThresholdMode;
+  distinctBy?: string | null;
+  windowMinutes: number;
+  cooldownMinutes: number;
+  severity: AnalyticsAlertSeverity;
+}
+
 function chunkArray<T>(items: T[], size: number): T[][] {
   const chunks: T[][] = [];
   for (let i = 0; i < items.length; i += size) {
@@ -537,95 +599,155 @@ function chunkArray<T>(items: T[], size: number): T[][] {
   return chunks;
 }
 
-export async function ensureDefaultHttp5xxSpikeAlertRules(): Promise<{
+function defaultAnalyticsAlertDefinitions(): DefaultAnalyticsAlertDefinition[] {
+  const definitions: DefaultAnalyticsAlertDefinition[] = [];
+
+  if (defaultHttp5xxAlertEnabled()) {
+    definitions.push({
+      idPrefix: DEFAULT_HTTP_5XX_ALERT_ID_PREFIX,
+      name: "Hosted app HTTP 5xx spike",
+      description:
+        "Default Agent Native alert for a spike in server responses with 5xx status codes.",
+      eventName: "http.response",
+      filters: [{ field: "properties.status_class", value: "5xx" }],
+      threshold: envInt(
+        "ANALYTICS_DEFAULT_HTTP_5XX_ALERT_THRESHOLD",
+        5,
+        1,
+        1000,
+      ),
+      windowMinutes: envInt(
+        "ANALYTICS_DEFAULT_HTTP_5XX_ALERT_WINDOW_MINUTES",
+        5,
+        1,
+        60,
+      ),
+      cooldownMinutes: envInt(
+        "ANALYTICS_DEFAULT_HTTP_5XX_ALERT_COOLDOWN_MINUTES",
+        30,
+        0,
+        24 * 60,
+      ),
+      severity: "critical",
+    });
+  }
+
+  if (defaultAgentChatStuckAlertEnabled()) {
+    definitions.push({
+      idPrefix: DEFAULT_AGENT_CHAT_STUCK_ALERT_ID_PREFIX,
+      name: "Hosted agent chat stuck spike",
+      description:
+        "Default Agent Native alert for a spike in agent chats detected as stuck.",
+      eventName: "agent_chat_stuck_detected",
+      filters: [],
+      threshold: envInt(
+        "ANALYTICS_DEFAULT_AGENT_CHAT_STUCK_ALERT_THRESHOLD",
+        DEFAULT_AGENT_CHAT_STUCK_ALERT_THRESHOLD,
+        1,
+        1000,
+      ),
+      thresholdMode: "distinct_count",
+      distinctBy: "properties.runId",
+      windowMinutes: envInt(
+        "ANALYTICS_DEFAULT_AGENT_CHAT_STUCK_ALERT_WINDOW_MINUTES",
+        DEFAULT_AGENT_CHAT_STUCK_ALERT_WINDOW_MINUTES,
+        1,
+        60,
+      ),
+      cooldownMinutes: envInt(
+        "ANALYTICS_DEFAULT_AGENT_CHAT_STUCK_ALERT_COOLDOWN_MINUTES",
+        DEFAULT_AGENT_CHAT_STUCK_ALERT_COOLDOWN_MINUTES,
+        0,
+        24 * 60,
+      ),
+      severity: "critical",
+    });
+  }
+
+  return definitions;
+}
+
+export async function ensureDefaultAnalyticsAlertRules(): Promise<{
   checked: number;
   created: number;
 }> {
-  if (!defaultHttp5xxAlertEnabled()) return { checked: 0, created: 0 };
-
-  const scopes = await defaultHttp5xxAlertScopes();
-  if (!scopes.length) return { checked: 0, created: 0 };
+  const definitions = defaultAnalyticsAlertDefinitions();
+  if (!definitions.length) return { checked: 0, created: 0 };
 
   const db = getDb() as any;
-  const threshold = envInt(
-    "ANALYTICS_DEFAULT_HTTP_5XX_ALERT_THRESHOLD",
-    5,
-    1,
-    1000,
-  );
-  const windowMinutes = envInt(
-    "ANALYTICS_DEFAULT_HTTP_5XX_ALERT_WINDOW_MINUTES",
-    5,
-    1,
-    60,
-  );
-  const cooldownMinutes = envInt(
-    "ANALYTICS_DEFAULT_HTTP_5XX_ALERT_COOLDOWN_MINUTES",
-    30,
-    0,
-    24 * 60,
-  );
-
-  const scopesById = new Map<string, AccessCtx>();
-  for (const scope of scopes) {
-    scopesById.set(defaultHttp5xxAlertId(scope.email, scope.orgId), scope);
-  }
-  const allIds = Array.from(scopesById.keys());
-
-  const existingIds = new Set<string>();
-  for (const idChunk of chunkArray(allIds, DEFAULT_ALERT_SEED_CHUNK_SIZE)) {
-    const rows = await db
-      .select({ id: schema.analyticsAlertRules.id })
-      .from(schema.analyticsAlertRules)
-      .where(inArray(schema.analyticsAlertRules.id, idChunk));
-    for (const row of rows) existingIds.add(row.id);
-  }
+  let checked = 0;
+  let created = 0;
+  let offset = 0;
+  while (true) {
+    const page = await defaultAnalyticsAlertScopePage(offset);
+    const candidatesById = new Map<
+      string,
+      { definition: DefaultAnalyticsAlertDefinition; scope: AccessCtx }
+    >();
+    for (const scope of page.scopes) {
+      for (const definition of definitions) {
+        candidatesById.set(
+          defaultAlertId(definition.idPrefix, scope.email, scope.orgId),
+          { definition, scope },
+        );
+      }
+    }
+    const allIds = Array.from(candidatesById.keys());
+    checked += allIds.length;
+
+    const existingIds = new Set<string>();
+    for (const idChunk of chunkArray(allIds, DEFAULT_ALERT_SEED_CHUNK_SIZE)) {
+      const rows = await db
+        .select({ id: schema.analyticsAlertRules.id })
+        .from(schema.analyticsAlertRules)
+        .where(inArray(schema.analyticsAlertRules.id, idChunk));
+      for (const row of rows) existingIds.add(row.id);
+    }
 
-  const missingIds = allIds.filter((id) => !existingIds.has(id));
-  if (!missingIds.length) return { checked: scopes.length, created: 0 };
+    const now = nowIso();
+    const rowsToInsert = allIds
+      .filter((id) => !existingIds.has(id))
+      .map((id) => {
+        const { definition, scope } = candidatesById.get(id)!;
+        return {
+          id,
+          name: definition.name,
+          description: definition.description,
+          eventName: definition.eventName,
+          filters: JSON.stringify(definition.filters),
+          thresholdMode: definition.thresholdMode ?? ("event_count" as const),
+          distinctBy: definition.distinctBy ?? null,
+          threshold: definition.threshold,
+          windowMinutes: definition.windowMinutes,
+          cooldownMinutes: definition.cooldownMinutes,
+          severity: definition.severity,
+          channels: JSON.stringify(["inbox"]),
+          emailRecipients: JSON.stringify([]),
+          enabled: true,
+          createdAt: now,
+          updatedAt: now,
+          ownerEmail: scope.email,
+          orgId: scope.orgId,
+        };
+      });
 
-  const now = nowIso();
-  const rowsToInsert = missingIds.map((id) => {
-    const scope = scopesById.get(id)!;
-    return {
-      id,
-      name: "Hosted app HTTP 5xx spike",
-      description:
-        "Default Agent Native alert for a spike in server responses with 5xx status codes.",
-      eventName: "http.response",
-      filters: JSON.stringify([
-        { field: "properties.status_class", value: "5xx" },
-      ]),
-      thresholdMode: "event_count" as const,
-      distinctBy: null,
-      threshold,
-      windowMinutes,
-      cooldownMinutes,
-      severity: "critical" as const,
-      channels: JSON.stringify(["inbox"]),
-      emailRecipients: JSON.stringify([]),
-      enabled: true,
-      createdAt: now,
-      updatedAt: now,
-      ownerEmail: scope.email,
-      orgId: scope.orgId,
-    };
-  });
+    for (const rowChunk of chunkArray(
+      rowsToInsert,
+      DEFAULT_ALERT_SEED_CHUNK_SIZE,
+    )) {
+      const inserted = await db
+        .insert(schema.analyticsAlertRules)
+        .values(rowChunk)
+        .onConflictDoNothing()
+        .returning({ id: schema.analyticsAlertRules.id });
+      created += inserted.length;
+    }
 
-  let created = 0;
-  for (const rowChunk of chunkArray(
-    rowsToInsert,
-    DEFAULT_ALERT_SEED_CHUNK_SIZE,
-  )) {
-    const inserted = await db
-      .insert(schema.analyticsAlertRules)
-      .values(rowChunk)
-      .onConflictDoNothing()
-      .returning({ id: schema.analyticsAlertRules.id });
-    created += inserted.length;
+    if (!page.hasMore) break;
+    offset += DEFAULT_ALERT_SCOPE_PAGE_SIZE;
   }
 
-  return { checked: scopes.length, created };
+  return { checked, created };
 }
 
 export async function listEnabledAnalyticsAlertRules(options: {

package/corpus/templates/clips/.agents/skills/dictate/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: dictate
 description: >-
-  The Dictate tab in Clips — press-and-hold dictation history (Hold-Fn / Cmd+Shift+Space),
-  AI cleanup, and the desktop-app integration that captures the audio. Use when listing
-  past dictations, polishing dictation text, or wiring the desktop tray hand-off.
+  The Dictate tab in Clips — press-and-hold desktop dictation, mobile voice
+  dictation, history, AI cleanup, and native capture hand-offs. Use when
+  listing past dictations, polishing dictation text, or wiring native capture.
 ---
 
 # Dictate
@@ -25,7 +25,9 @@ The press-and-hold UX intentionally mirrors **Wispr Flow**. See `templates/clips
 
 ## Data model touched
 
-- **`dictations`** — `id`, `fullText`, `cleanedText`, `durationMs`, `audioUrl`, `source` (`hold-fn` | `hotkey` | `manual`), `createdAt`, `ownableColumns()`.
+- **`dictations`** — `id`, `fullText`, `cleanedText`, `durationMs`, `audioUrl`,
+  `source` (desktop shortcuts, `manual`, or `mobile`), `createdAt`,
+  `ownableColumns()`.
 
 `fullText` is the raw native transcript captured on-device (macOS Speech / Web Speech). `cleanedText` is the optional AI-polished version produced by the shared `cleanup-transcript` pipeline. UI shows `cleanedText ?? fullText`.
 
@@ -81,7 +83,28 @@ The press-and-hold flow is **owned by the desktop app** (`src-tauri/`). On Hold-
 3. The dictation row is created via the framework HTTP layer — the agent does not start/stop dictations.
 4. AI cleanup is a background pass via `cleanup-dictation`, not in the hot path — never block paste-on-release on a network round-trip.
 
-Agents must **never** wire dictation start/stop server-side. The native key listener is the only entry point.
+Agents must **never** wire dictation start/stop server-side. Desktop key
+listeners and the mobile capture UI own those user gestures.
+
+## Mobile dictation
+
+The Agent Native iOS/Android app exposes Dictate from native Home, deep links,
+and OS quick actions. Mobile is click-to-toggle rather than hold-to-talk:
+
+1. `expo-audio` records mic-only M4A and persists it under the app documents
+   directory before any network request.
+2. A durable capture-queue row protects the audio across interruptions, app
+   restarts, and upload failures.
+3. The named mobile voice client posts multipart audio to the authenticated
+   `/_agent-native/transcribe-voice` route. Provider keys never enter the app.
+4. The cleaned transcript is editable, copied to the OS clipboard, and saved
+   with `create-dictation --source=mobile`; edits use `update-dictation`.
+5. The audio also syncs to Clips through the resumable recording upload path so
+   a failed transcription never destroys the captured speech.
+
+Do not auto-send mobile dictation to an agent or another app. iOS/Android quick
+actions open capture; clipboard is the cross-app fallback until platform
+keyboard/accessibility insertion is enabled.
 
 ## UI conventions (don't break)
 

package/corpus/templates/clips/.agents/skills/meetings/SKILL.md

@@ -47,6 +47,13 @@ Meeting capture records **two streams** and tags transcript segments by source:
 
 Each transcript segment carries a `source: "mic" | "system"` tag, which we use to attribute action items to the right attendee. This is why **per-attendee action items only work reliably with mic + system capture** — mic-only recordings make remote attendees silent. Document this caveat whenever you surface action items.
 
+The iOS/Android companion is intentionally different: mobile background meeting
+capture is microphone-only because the operating systems do not expose another
+phone app's Zoom/Meet/Teams audio. It is appropriate for in-person rooms and for
+capturing audio played from a separate device. Mobile recordings still receive
+Clips transcription and summaries, but do not promise desktop-quality remote
+speaker attribution or per-attendee action items.
+
 ## Bidirectional recording ↔ meeting link
 
 A meeting can have an associated recording, and a recording can be linked back to a meeting:

package/corpus/templates/clips/.agents/skills/recording/SKILL.md

@@ -38,6 +38,27 @@ Some recordings are linked to a meeting — when `meeting_id` is non-null on the
    `processing` to `ready`. Do not wait for the upload/finalize response before
    opening the page.
 
+## Mobile companion lifecycle
+
+The Agent Native mobile app uses the same recording rows and binary upload
+routes with native capture primitives:
+
+1. Camera video/import uses `expo-camera` / the system photo picker; meeting
+   audio uses `expo-audio` with background recording enabled.
+2. The native file is copied into the documents directory and a typed
+   AsyncStorage capture job is written before upload starts.
+3. `create-recording` receives a stable client-generated id,
+   `sourceAppName: "Agent Native Mobile"`, and the container MIME type.
+4. Upload reads at most 3 MiB through an Expo FileHandle and persists the next
+   chunk index after every acknowledged POST. The 4 MiB server cap still
+   applies.
+5. Foreground/resume reconciliation polls `/api/uploads/:id/status`; retryable
+   failures back off and never discard the local file. Completion can post a
+   local notification and the recording appears in Clips everywhere.
+
+Mobile audio M4A is an MP4 container and uses the recording route's MP4 MIME
+alias. The bytes are not converted or loaded whole into JavaScript memory.
+
 ## Seekable playback (don't ship raw MediaRecorder output)
 
 Raw `MediaRecorder` files are not friendly to progressive HTTP playback, which
@@ -191,6 +212,8 @@ export function useRecorder() {
 - **Never** start a `MediaRecorder` without a user gesture (or a user-initiated `record-intent`).
 - **Never** re-prompt for permissions on pause/resume — reuse the stream.
 - **Never** fire the upload from the main thread if the chunks are large — prefer a web worker for anything longer than ~60s.
+- **Never** read a complete mobile recording into JavaScript memory. Use bounded
+  FileHandle reads and checkpoint every acknowledged chunk.
 - The `recordings` row must exist **before** the first chunk is sent.
 - On every lifecycle change, write `navigation` → `{ view: "record" }` → `{ view: "recording", recordingId }` so the agent can see what's happening.
 - All AI generated during/after recording goes through the agent chat — see `ai-video-tools`.

package/corpus/templates/clips/AGENTS.md

@@ -51,6 +51,16 @@ Detailed media, meeting, dictation, editing, and sharing rules live in
   `previewTruncated` is true, it may end mid-sentence and does not show where
   transcription ended. Call `get-recording-player-data` before judging
   completeness or quoting the full transcript.
+- Mobile captures originate in the Agent Native iOS/Android app. The phone
+  persists each audio/video file before network work, creates the recording
+  with `sourceAppName: "Agent Native Mobile"`, and resumes bounded chunk
+  uploads from its durable queue. Do not ask users to keep a capture screen
+  open or re-record after a transient upload failure; reconnect Clips and retry
+  the saved job from mobile Home.
+- Mobile meeting capture is microphone-only. It can record an in-person room or
+  audio playing from another device, but iOS and Android do not expose another
+  phone app's Zoom/Meet/Teams call audio to this flow. Do not claim mobile
+  attendee attribution has the desktop mic-plus-system-audio fidelity.
 - Dictation cleanup, Clip title/cleanup, and meeting summaries should pass
   bounded `voiceContext` to the shared cleanup/transcription path when active
   app context, learned vocabulary, user notes, or AGENTS.md preferences are

package/corpus/templates/clips/actions/create-dictation.ts

@@ -1,9 +1,10 @@
 /**
- * Create a dictation row from browser or desktop voice capture.
+ * Create a dictation row from browser, desktop, or mobile voice capture.
  */
 
 import { defineAction } from "@agent-native/core";
 import { writeAppState } from "@agent-native/core/application-state";
+import { and, eq } from "drizzle-orm";
 import { z } from "zod";
 
 import { getDb, schema } from "../server/db/index.js";
@@ -11,18 +12,28 @@ import {
   getActiveOrganizationId,
   getCurrentOwnerEmail,
   nanoid,
+  ownerEmailMatches,
 } from "../server/lib/recordings.js";
 
 export default defineAction({
   description:
-    "Create a dictation history row from captured voice text. Used by browser Dictate and desktop voice capture.",
+    "Create a dictation history row from captured voice text. Used by browser, desktop, and mobile voice capture.",
   schema: z.object({
+    id: z.string().min(1).optional().describe("Stable client-generated id"),
     fullText: z.string().min(1).describe("Raw dictation text"),
     cleanedText: z.string().nullable().optional(),
     durationMs: z.coerce.number().int().min(0).optional(),
     audioUrl: z.string().url().nullable().optional(),
     source: z
-      .enum(["fn-hold", "cmd-shift-space", "manual", "other", "fn", "custom"])
+      .enum([
+        "fn-hold",
+        "cmd-shift-space",
+        "manual",
+        "mobile",
+        "other",
+        "fn",
+        "custom",
+      ])
       .default("manual"),
     targetApp: z.string().nullable().optional(),
     startedAt: z.string().datetime().optional(),
@@ -32,10 +43,24 @@ export default defineAction({
     const ownerEmail = getCurrentOwnerEmail();
     const orgId = await getActiveOrganizationId().catch(() => null);
     const now = new Date().toISOString();
-    const id = nanoid();
+    const id = args.id ?? nanoid();
     const fullText = args.fullText.trim();
     if (!fullText) throw new Error("Dictation text is required");
 
+    if (args.id) {
+      const [existing] = await db
+        .select()
+        .from(schema.dictations)
+        .where(
+          and(
+            eq(schema.dictations.id, id),
+            ownerEmailMatches(schema.dictations.ownerEmail, ownerEmail),
+          ),
+        )
+        .limit(1);
+      if (existing) return existing;
+    }
+
     await db.insert(schema.dictations).values({
       id,
       fullText,