@agent-native/core 0.109.2 → 0.109.3

package/corpus/README.md

@@ -27,5 +27,5 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- core files: 2309
-- template files: 6148
+- core files: 2312
+- template files: 6152

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @agent-native/core
 
+## 0.109.3
+
+### Patch Changes
+
+- 5199e0b: Make Chat the first and default starting point in the new-app CLI picker.
+- 5199e0b: Track browser, server, cold-start, framework-readiness, and database latency for app requests; retain action 4xx failures; parallelize legacy route bootstrap reads; and deduplicate session lookups without treating transient auth failures as signed-out sessions.
+- 5199e0b: Deliver remote-session Expo push notifications through a retrying, batched outbox worker and verify provider receipts before marking delivery complete.
+
 ## 0.109.2
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.109.2",
+  "version": "0.109.3",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/cli/create.ts

@@ -200,31 +200,36 @@ export async function createApp(
 async function promptStartShape(
   clack: typeof import("@clack/prompts"),
 ): Promise<"template" | "chat" | "headless"> {
-  const choice = await clack.select({
+  const choice = await clack.select(startShapePromptOptions());
+  if (clack.isCancel(choice)) {
+    clack.cancel("Cancelled.");
+    process.exit(0);
+  }
+  return choice as "template" | "chat" | "headless";
+}
+
+function startShapePromptOptions() {
+  return {
     message: "How do you want to start?",
+    initialValue: "chat",
     options: [
-      {
-        value: "template",
-        label: "Full template(s)",
-        hint: "Clone complete apps (Mail, Calendar, Slides, ...) into a workspace",
-      },
       {
         value: "chat",
         label: "Chat",
         hint: "A single app with a minimal chat UI and the browser shell wired up",
       },
+      {
+        value: "template",
+        label: "Full template(s)",
+        hint: "Clone complete apps (Mail, Calendar, Slides, ...) into a workspace",
+      },
       {
         value: "headless",
         label: "Headless",
         hint: "A single action-first app with one primitive and no UI shell",
       },
     ],
-  });
-  if (clack.isCancel(choice)) {
-    clack.cancel("Cancelled.");
-    process.exit(0);
-  }
-  return choice as "template" | "chat" | "headless";
+  };
 }
 
 /**
@@ -1348,6 +1353,7 @@ export {
   githubTarballUrl as _githubTarballUrl,
   findLocalTemplateFrom as _findLocalTemplateFrom,
   workspaceAppNameForTemplateSelection as _workspaceAppNameForTemplateSelection,
+  startShapePromptOptions as _startShapePromptOptions,
   shouldSkipScaffoldEntry as _shouldSkipScaffoldEntry,
   tarExtractArgs as _tarExtractArgs,
 };

package/corpus/core/src/client/require-session.tsx

@@ -95,14 +95,31 @@ export function RequireSession({
   signedOut,
   bypass = false,
 }: RequireSessionProps) {
+  if (bypass) return <>{children}</>;
+  return (
+    <ResolvedSessionGate
+      fallback={fallback}
+      redirect={redirect}
+      signedOut={signedOut}
+    >
+      {children}
+    </ResolvedSessionGate>
+  );
+}
+
+function ResolvedSessionGate({
+  children,
+  fallback,
+  redirect = true,
+  signedOut,
+}: Omit<RequireSessionProps, "bypass">) {
   const { session, isLoading } = useSession();
   // Guard against firing the redirect more than once (effect re-runs, React
   // StrictMode double-invoke) — a second navigation while the first is in
   // flight is harmless but noisy.
   const redirectedRef = useRef(false);
 
-  const mustRedirect =
-    !bypass && !isLoading && !session && redirect && !isOnSignInPage();
+  const mustRedirect = !isLoading && !session && redirect && !isOnSignInPage();
 
   useEffect(() => {
     if (!mustRedirect) return;
@@ -114,7 +131,6 @@ export function RequireSession({
     window.location.replace(buildSignInReturnHref());
   }, [mustRedirect]);
 
-  if (bypass) return <>{children}</>;
   // Still resolving, or redirect already in flight: show the loading fallback
   // rather than flashing app chrome the visitor can't use.
   if (isLoading) return <>{fallback ?? <DefaultSpinner />}</>;

package/corpus/core/src/client/use-action.ts

@@ -27,6 +27,7 @@ import type {
   UseMutationOptions,
 } from "@tanstack/react-query";
 
+import { trackEvent } from "./analytics.js";
 import { agentNativePath } from "./api-path.js";
 import { getBrowserTabId } from "./browser-tab-id.js";
 import { ensureEmbedAuthFetchInterceptor } from "./embed-auth.js";
@@ -221,6 +222,10 @@ export interface ActionFetchOptions {
   includeRequestSource?: boolean;
 }
 
+type InternalActionFetchOptions = ActionFetchOptions & {
+  onResponse?: (response: Response) => void;
+};
+
 /**
  * Conservative per-document keepalive body budget. Browsers commonly enforce
  * an approximately 64 KiB aggregate limit across every in-flight keepalive
@@ -251,11 +256,11 @@ function utf8ByteLength(value: string): number {
   return bytes;
 }
 
-async function actionFetch<T>(
+async function performActionFetch<T>(
   name: string,
   method: string,
   params?: Record<string, any>,
-  options?: ActionFetchOptions,
+  options?: InternalActionFetchOptions,
 ): Promise<T> {
   ensureEmbedAuthFetchInterceptor();
   let url = `${ACTION_PREFIX}/${name}`;
@@ -332,6 +337,7 @@ async function actionFetch<T>(
   try {
     try {
       res = await fetch(url, init);
+      options?.onResponse?.(res);
     } catch (err) {
       if (timedOut) throwTimeout();
       // Caller-initiated cancellation — rethrow untouched so React Query
@@ -418,6 +424,143 @@ async function actionFetch<T>(
   return (data ?? (null as unknown)) as T;
 }
 
+function actionTelemetryNow(): number {
+  return typeof performance !== "undefined" ? performance.now() : Date.now();
+}
+
+function parseServerTiming(
+  response: Response | undefined,
+): Map<string, number> {
+  const timings = new Map<string, number>();
+  const value = response?.headers.get("server-timing");
+  if (!value) return timings;
+
+  for (const entry of value.split(",")) {
+    const [rawName, ...params] = entry.trim().split(";");
+    const name = rawName?.trim();
+    if (!name) continue;
+    const duration = params
+      .map((param) => /^dur=(.+)$/i.exec(param.trim())?.[1])
+      .find(Boolean);
+    const parsed = duration === undefined ? NaN : Number(duration);
+    if (Number.isFinite(parsed)) timings.set(name, parsed);
+  }
+  return timings;
+}
+
+function shouldTrackActionResponse(
+  error: unknown,
+  durationMs: number,
+  response: Response | undefined,
+): boolean {
+  if (error || durationMs >= 1_000) return true;
+  if (response && response.status >= 400 && response.status < 500) return true;
+  if (
+    /\bstartup(?:-db)?\s*;/i.test(response?.headers.get("server-timing") ?? "")
+  ) {
+    return true;
+  }
+  const raw = (import.meta.env as Record<string, string | undefined>)
+    ?.VITE_AGENT_NATIVE_ACTION_TELEMETRY_SAMPLE_RATE;
+  const parsed = raw === undefined ? 0.1 : Number(raw);
+  const rate = Number.isFinite(parsed) ? Math.max(0, Math.min(1, parsed)) : 0.1;
+  return Math.random() < rate;
+}
+
+async function actionFetch<T>(
+  name: string,
+  method: string,
+  params?: Record<string, any>,
+  options?: ActionFetchOptions,
+): Promise<T> {
+  const startedAt = actionTelemetryNow();
+  let response: Response | undefined;
+  let responseAt: number | undefined;
+  let error: unknown;
+
+  try {
+    return await performActionFetch<T>(name, method, params, {
+      ...options,
+      onResponse: (nextResponse) => {
+        response = nextResponse;
+        responseAt = actionTelemetryNow();
+      },
+    });
+  } catch (caught) {
+    error = caught;
+    throw caught;
+  } finally {
+    try {
+      const completedAt = actionTelemetryNow();
+      const durationMs = Math.max(0, completedAt - startedAt);
+      if (shouldTrackActionResponse(error, durationMs, response)) {
+        const ttfbMs =
+          responseAt === undefined
+            ? undefined
+            : Math.max(0, responseAt - startedAt);
+        const serverTiming = parseServerTiming(response);
+        const serverDurationMs = serverTiming.get("app");
+        const errorStatus = Number(
+          (error as { status?: unknown } | undefined)?.status,
+        );
+        const statusCode =
+          response?.status ??
+          (Number.isFinite(errorStatus) ? errorStatus : undefined);
+        const timedOut =
+          (error as { timedOut?: unknown } | undefined)?.timedOut === true;
+        const cancelled = options?.signal?.aborted === true && !timedOut;
+        const contentLength = Number(response?.headers.get("content-length"));
+
+        trackEvent("action.response", {
+          request_id:
+            response?.headers.get("x-agent-native-request-id") ?? undefined,
+          action: name,
+          method,
+          status_code: statusCode,
+          status_class:
+            statusCode === undefined
+              ? "network"
+              : `${Math.floor(statusCode / 100)}xx`,
+          success: !error,
+          outcome: !error
+            ? "success"
+            : timedOut
+              ? "timeout"
+              : cancelled
+                ? "cancelled"
+                : response
+                  ? "http-error"
+                  : "network-error",
+          duration_ms: Math.round(durationMs),
+          ttfb_ms: ttfbMs === undefined ? undefined : Math.round(ttfbMs),
+          body_ms:
+            ttfbMs === undefined ? undefined : Math.round(durationMs - ttfbMs),
+          server_duration_ms:
+            serverDurationMs === undefined
+              ? undefined
+              : Math.round(serverDurationMs),
+          network_overhead_ms:
+            ttfbMs === undefined || serverDurationMs === undefined
+              ? undefined
+              : Math.max(0, Math.round(ttfbMs - serverDurationMs)),
+          framework_ready_wait_ms: serverTiming.get("startup"),
+          db_operation_wall_ms: serverTiming.get("db"),
+          db_connect_total_ms: serverTiming.get("db-connect"),
+          db_slowest_operation_ms: serverTiming.get("db-slowest"),
+          startup_db_operation_wall_ms: serverTiming.get("startup-db"),
+          startup_db_connect_total_ms: serverTiming.get("startup-db-connect"),
+          response_bytes:
+            Number.isFinite(contentLength) && contentLength >= 0
+              ? contentLength
+              : undefined,
+        });
+      }
+    } catch {
+      // Performance telemetry must never change the action result.
+    }
+  }
+}
+
 /**
  * Imperatively call an action from browser/client code.
  *

package/corpus/core/src/client/use-session.ts

@@ -1,4 +1,4 @@
-import { useState, useEffect, useRef } from "react";
+import { useEffect, useState } from "react";
 
 import type { AuthSession } from "../server/auth.js";
 import { setSentryUser, trackSessionStatus } from "./analytics.js";
@@ -11,6 +11,65 @@ interface UseSessionResult {
   isLoading: boolean;
 }
 
+const SESSION_CACHE_TTL_MS = 30_000;
+const SESSION_RETRY_DELAY_MS = 1_000;
+let cachedSession: AuthSession | null | undefined;
+let cachedSessionAt = 0;
+let sessionRequest: Promise<AuthSession | null | undefined> | undefined;
+let trackedSessionIdentity: string | null | undefined;
+
+function hasFreshSessionCache(): boolean {
+  return (
+    cachedSession !== undefined &&
+    Date.now() - cachedSessionAt < SESSION_CACHE_TTL_MS
+  );
+}
+
+function publishSessionIdentity(session: AuthSession | null): void {
+  const identity = session?.userId ?? session?.email ?? null;
+  if (trackedSessionIdentity !== identity) {
+    trackedSessionIdentity = identity;
+    if (session) {
+      setSentryUser(
+        {
+          id: session.userId,
+          email: session.email,
+          username: session.name,
+        },
+        session.orgId ?? null,
+      );
+    } else {
+      setSentryUser(null, null);
+    }
+  }
+  trackSessionStatus(Boolean(session));
+}
+
+function fetchSharedSession(): Promise<AuthSession | null | undefined> {
+  if (hasFreshSessionCache()) return Promise.resolve(cachedSession ?? null);
+  if (sessionRequest) return sessionRequest;
+
+  sessionRequest = (async () => {
+    try {
+      const res = await fetch(agentNativePath("/_agent-native/auth/session"));
+      if (!res.ok) return undefined;
+
+      const data = await res.json();
+      const session = data.error ? null : (data as AuthSession);
+      cachedSession = session;
+      cachedSessionAt = Date.now();
+      publishSessionIdentity(session);
+      return session;
+    } catch {
+      return undefined;
+    }
+  })().finally(() => {
+    sessionRequest = undefined;
+  });
+
+  return sessionRequest;
+}
+
 /**
  * Client-side hook to get the current auth session.
  *
@@ -21,61 +80,33 @@ interface UseSessionResult {
  * Templates should use this instead of building their own auth context.
  */
 export function useSession(): UseSessionResult {
-  const [session, setSession] = useState<AuthSession | null>(null);
-  const [isLoading, setIsLoading] = useState(true);
-  const trackedRef = useRef(false);
+  const cached = hasFreshSessionCache() ? (cachedSession ?? null) : null;
+  const [session, setSession] = useState<AuthSession | null>(cached);
+  const [isLoading, setIsLoading] = useState(!hasFreshSessionCache());
 
   useEffect(() => {
     let cancelled = false;
+    let retryTimer: ReturnType<typeof setTimeout> | undefined;
 
-    async function fetchSession() {
-      let signedIn = false;
-      let resolved: AuthSession | null = null;
-      try {
-        const res = await fetch(agentNativePath("/_agent-native/auth/session"));
-        if (!res.ok) {
-          setSession(null);
-          return;
-        }
-        const data = await res.json();
-        if (!cancelled) {
-          // The endpoint returns { error: "..." } when not authenticated
-          if (data.error) {
-            setSession(null);
-          } else {
-            resolved = data as AuthSession;
-            setSession(resolved);
-            signedIn = true;
-          }
-        }
-      } catch {
-        if (!cancelled) setSession(null);
-      } finally {
-        if (!cancelled) {
-          setIsLoading(false);
-          if (resolved) {
-            setSentryUser(
-              {
-                id: resolved.userId,
-                email: resolved.email,
-                username: resolved.name,
-              },
-              resolved.orgId ?? null,
-            );
-          } else {
-            setSentryUser(null, null);
-          }
-          if (!trackedRef.current) {
-            trackedRef.current = true;
-            trackSessionStatus(signedIn);
-          }
-        }
+    const resolveSession = async () => {
+      const resolved = await fetchSharedSession();
+      if (cancelled) return;
+
+      if (resolved === undefined) {
+        retryTimer = setTimeout(() => {
+          void resolveSession();
+        }, SESSION_RETRY_DELAY_MS);
+        return;
       }
-    }
 
-    fetchSession();
+      setSession(resolved);
+      setIsLoading(false);
+    };
+
+    void resolveSession();
     return () => {
       cancelled = true;
+      if (retryTimer) clearTimeout(retryTimer);
     };
   }, []);
 

package/corpus/core/src/db/client.ts

@@ -10,6 +10,11 @@
  */
 import path from "path";
 
+import {
+  beginDatabaseOperation,
+  recordDatabaseRetry,
+} from "./request-telemetry.js";
+
 const recyclingPostgresPools = new WeakSet<object>();
 const loggedNeonPools = new WeakSet<object>();
 
@@ -735,6 +740,7 @@ export async function retryOnConnectionError<T>(
     } catch (e) {
       last = e;
       if (!isConnectionError(e) || attempt === maxAttempts - 1) throw e;
+      recordDatabaseRetry();
       await new Promise((r) => setTimeout(r, 100 * (attempt + 1)));
     }
   }
@@ -790,6 +796,9 @@ export async function withDbTimeout<T>(
 ): Promise<T> {
   let timer: ReturnType<typeof setTimeout> | undefined;
   let settled = false;
+  const finishTelemetry = beginDatabaseOperation(
+    op === "connect" ? "connect" : "query",
+  );
 
   const runCleanup = async () => {
     if (!onTimeout) return;
@@ -811,12 +820,14 @@ export async function withDbTimeout<T>(
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
+      finishTelemetry("success");
       complete(value);
     };
     const fail = (err: unknown) => {
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
+      finishTelemetry("error");
       reject(err);
     };
 
@@ -825,6 +836,7 @@ export async function withDbTimeout<T>(
       settled = true;
       void (async () => {
         await runCleanup();
+        finishTelemetry("timeout");
         reject(new DbTimeoutError(op, ms));
       })();
     }, ms);
@@ -1171,13 +1183,7 @@ async function createDbExecInternal(
             return retryOnConnectionError<{
               rows: unknown[];
               rowsAffected: number;
-            }>(() =>
-              withDbTimeout(
-                "http-query",
-                () => queryNeonClient(pool, sql),
-                dbOpTimeoutMs(),
-              ),
-            );
+            }>(() => queryNeonClient(pool, sql));
           }
           const result = await retryOnConnectionError<{
             rows: unknown[];

package/corpus/core/src/db/create-get-db.ts

@@ -84,23 +84,28 @@ export function isSqlRead(sql: string): boolean {
  * connection the transaction needs. The pool-level error logger still fires
  * on idle-client drops inside transactions.
  */
-export function buildResilientNeonPool(pool: {
-  connect(): Promise<any>;
-  query(
-    sql: string,
-    args?: any[],
-  ): Promise<{ rows: unknown[]; rowCount?: number }>;
-  end(): Promise<void>;
-  on(event: string, listener: (...args: any[]) => void): unknown;
-}): typeof pool {
+export function buildResilientNeonPool<
+  T extends {
+    connect(): Promise<any>;
+    query(...args: any[]): Promise<any>;
+    end(): Promise<void>;
+    on(event: string, listener: (...args: any[]) => void): unknown;
+  },
+>(pool: T): T {
   // Preserve all original pool methods and properties; only override `connect`
   // and `query` at the Pool level (used by drizzle's neon-serverless adapter
   // when it calls pool.query() directly, e.g. outside a transaction).
   const resilientQuery = async (
-    sql: string,
+    sql: string | { text?: unknown },
     args?: any[],
   ): Promise<{ rows: unknown[]; rowCount?: number }> => {
-    const isRead = isSqlRead(sql);
+    const sqlText =
+      typeof sql === "string"
+        ? sql
+        : typeof sql?.text === "string"
+          ? sql.text
+          : "";
+    const isRead = isSqlRead(sqlText);
 
     const runAttempt = async (): Promise<{
       rows: unknown[];
@@ -135,7 +140,9 @@ export function buildResilientNeonPool(pool: {
         const result = await withDbTimeout(
           "query",
           () =>
-            client.query(sql, args ?? []) as Promise<{
+            (args === undefined
+              ? client.query(sql)
+              : client.query(sql, args)) as Promise<{
               rows: unknown[];
               rowCount?: number;
             }>,
@@ -180,7 +187,7 @@ export function buildResilientNeonPool(pool: {
       const val = (target as any)[prop];
       return typeof val === "function" ? val.bind(target) : val;
     },
-  });
+  }) as T;
 }
 
 /**