@agent-native/core 0.115.4 → 0.116.0

package/corpus/core/src/server/collab-plugin.ts

@@ -5,7 +5,11 @@
  * ```ts
  * // server/plugins/collab.ts
  * import { createCollabPlugin } from "@agent-native/core/server";
- * export default createCollabPlugin({ table: "documents", contentColumn: "content" });
+ * export default createCollabPlugin({
+ *   table: "documents",
+ *   contentColumn: "content",
+ *   access: { mode: "resource", resourceType: "document" },
+ * });
  * ```
  */
 
@@ -52,12 +56,47 @@ type CollabAwarenessScope = {
   resourceId?: string;
 };
 
+export type CollabResourceIdResolver = (
+  docId: string,
+) => string | null | Promise<string | null>;
+
+export type CollabAccess =
+  | {
+      mode: "resource";
+      /** The shareable resource type registered via `registerShareableResource`. */
+      resourceType: string;
+      /** Map a collab document id to its parent shareable resource id. */
+      resolveResourceId?: CollabResourceIdResolver;
+    }
+  | {
+      /** Deliver collaboration events to every authenticated user. */
+      mode: "all-authenticated";
+    };
+
+type NormalizedCollabAccess =
+  | {
+      mode: "resource";
+      resourceType: string;
+      resolveResourceId?: CollabResourceIdResolver;
+    }
+  | {
+      mode: "all-authenticated";
+      explicit: boolean;
+    };
+
 /**
- * Whether the no-resourceType warning has already been logged once per server
- * process. Avoids flooding logs on every request in templates that deliberately
- * have no sharing model.
+ * Tables whose implicit all-authenticated warning has already been logged in
+ * this process. Avoids duplicate warnings during hot reloads while still
+ * identifying every affected table.
  */
-let _unscoped_warning_logged = false;
+const COLLAB_WARNING_TABLES_KEY =
+  "__agentNativeImplicitCollabAccessWarningTables__";
+const collabWarningGlobal = globalThis as typeof globalThis & {
+  [COLLAB_WARNING_TABLES_KEY]?: Set<string>;
+};
+const _unscoped_warning_tables = (collabWarningGlobal[
+  COLLAB_WARNING_TABLES_KEY
+] ??= new Set<string>());
 
 export interface CollabPluginOptions {
   /** Table name containing document content. Default: "documents" */
@@ -77,18 +116,25 @@ export interface CollabPluginOptions {
   contentType?: "text" | "json";
   /** Column name for JSON content (used when contentType is "json"). */
   jsonColumn?: string;
+  /**
+   * Access policy for collaboration routes and event delivery.
+   * Use `resource` for registered shareable resources, or explicitly choose
+   * `all-authenticated` for deployment-wide collaboration.
+   */
+  access?: CollabAccess;
   /**
    * The shareable resource type registered via `registerShareableResource`.
    * Used to enforce access checks on collab routes.
-   * Omit only for resources that are always public (no sharing model).
+   * @deprecated Use `access: { mode: "resource", resourceType }`.
    */
   resourceType?: string;
   /**
    * Map the collab document id to the shareable resource id. Many templates
    * use route-specific collab ids (for example, one doc per slide inside a
    * deck) while sharing is enforced at the parent resource level.
+   * @deprecated Use `access: { mode: "resource", resourceType, resolveResourceId }`.
    */
-  resolveResourceId?: (docId: string) => string | null | Promise<string | null>;
+  resolveResourceId?: CollabResourceIdResolver;
   /**
    * Maximum allowed body size in bytes for write operations
    * (update/text/json/patch). Requests exceeding this are rejected with 413.
@@ -97,18 +143,100 @@ export interface CollabPluginOptions {
   maxPayloadBytes?: number;
 }
 
+export function normalizeCollabAccess(
+  options: Pick<
+    CollabPluginOptions,
+    "access" | "resourceType" | "resolveResourceId"
+  >,
+): NormalizedCollabAccess {
+  const hasLegacyAccess =
+    options.resourceType !== undefined ||
+    options.resolveResourceId !== undefined;
+
+  if (options.access && hasLegacyAccess) {
+    throw new Error(
+      'createCollabPlugin cannot combine "access" with the deprecated root "resourceType" or "resolveResourceId" options. Move those fields into access.',
+    );
+  }
+
+  if (options.access?.mode === "resource") {
+    if (!options.access.resourceType.trim()) {
+      throw new Error(
+        'createCollabPlugin access mode "resource" requires a non-empty resourceType.',
+      );
+    }
+    return options.access;
+  }
+
+  if (options.access?.mode === "all-authenticated") {
+    return { mode: "all-authenticated", explicit: true };
+  }
+
+  if (options.access) {
+    throw new Error(
+      `createCollabPlugin received an unsupported access mode: ${String((options.access as { mode?: unknown }).mode)}`,
+    );
+  }
+
+  if (options.resourceType !== undefined) {
+    if (!options.resourceType.trim()) {
+      throw new Error(
+        'createCollabPlugin "resourceType" must be a non-empty string when provided.',
+      );
+    }
+    return {
+      mode: "resource",
+      resourceType: options.resourceType,
+      resolveResourceId: options.resolveResourceId,
+    };
+  }
+
+  if (options.resolveResourceId !== undefined) {
+    throw new Error(
+      'createCollabPlugin "resolveResourceId" requires a non-empty "resourceType".',
+    );
+  }
+
+  return { mode: "all-authenticated", explicit: false };
+}
+
+function warnForImplicitAllAuthenticatedAccess(table: string): void {
+  if (_unscoped_warning_tables.has(table)) return;
+  _unscoped_warning_tables.add(table);
+  console.warn(
+    `[collab] WARNING: createCollabPlugin for table "${table}" does not declare an access policy. ` +
+      "Collab events will be delivered to ALL authenticated users on this deployment without document-level access scoping. " +
+      'Use access: { mode: "resource", resourceType: "..." } for access-scoped delivery, ' +
+      'or access: { mode: "all-authenticated" } to explicitly acknowledge deployment-wide delivery.',
+  );
+}
+
 export function createCollabPlugin(
   options: CollabPluginOptions = {},
 ): NitroPluginDef {
+  const normalizedAccess = normalizeCollabAccess(options);
   const {
     table = "documents",
     contentColumn = "content",
     idColumn = "id",
     autoSeed = true,
-    resourceType,
-    resolveResourceId,
     maxPayloadBytes = DEFAULT_MAX_PAYLOAD_BYTES,
   } = options;
+  const resourceType =
+    normalizedAccess.mode === "resource"
+      ? normalizedAccess.resourceType
+      : undefined;
+  const resolveResourceId =
+    normalizedAccess.mode === "resource"
+      ? normalizedAccess.resolveResourceId
+      : undefined;
+
+  if (
+    normalizedAccess.mode === "all-authenticated" &&
+    !normalizedAccess.explicit
+  ) {
+    warnForImplicitAllAuthenticatedAccess(table);
+  }
 
   return async (nitroApp: any) => {
     await awaitBootstrap(nitroApp);
@@ -129,15 +257,6 @@ export function createCollabPlugin(
     //     who don't match owner/org — instead of only degrading them to the
     //     poll fallback.
     // See also: SECURITY comment in poll.ts on canSeeChangeForUser.
-    if (!resourceType && !_unscoped_warning_logged) {
-      _unscoped_warning_logged = true;
-      console.warn(
-        "[collab] WARNING: createCollabPlugin called without resourceType. " +
-          "Collab events will be delivered to ALL authenticated users on this deployment " +
-          "without document-level access scoping. Set resourceType to enable access-scoped delivery.",
-      );
-    }
-
     const collabEmitter = getCollabEmitter();
     collabEmitter.on("collab", async (event) => {
       if (!resourceType) {

package/corpus/core/src/server/index.ts

@@ -287,7 +287,9 @@ export {
 } from "../terminal/terminal-plugin.js";
 export {
   createCollabPlugin,
+  type CollabAccess,
   type CollabPluginOptions,
+  type CollabResourceIdResolver,
 } from "./collab-plugin.js";
 
 export {

package/corpus/core/src/styles/agent-native.css

@@ -927,7 +927,35 @@
   display: inline-block;
 }
 
+.agent-tool-call {
+  position: relative;
+}
+
 @media (prefers-reduced-motion: no-preference) {
+  .agent-tool-call--entering {
+    animation: agent-tool-call-enter 220ms var(--ease-out-strong) both;
+  }
+
+  .agent-tool-call[data-active-tail="true"]::after {
+    position: absolute;
+    z-index: 1;
+    inset: 0 0 auto;
+    height: 2rem;
+    pointer-events: none;
+    content: "";
+    background: linear-gradient(
+      90deg,
+      transparent 0%,
+      transparent 38%,
+      hsl(var(--foreground) / 0.055) 50%,
+      transparent 62%,
+      transparent 100%
+    );
+    background-repeat: repeat;
+    background-size: 14rem 100%;
+    animation: agent-thinking-shine 2.6s linear infinite;
+  }
+
   @supports ((background-clip: text) or (-webkit-background-clip: text)) {
     .agent-thinking-indicator__text,
     .agent-running-shimmer {
@@ -960,6 +988,18 @@
     }
   }
 
+  @keyframes agent-tool-call-enter {
+    from {
+      opacity: 0;
+      transform: translateY(0.375rem);
+    }
+
+    to {
+      opacity: 1;
+      transform: translateY(0);
+    }
+  }
+
   @supports (view-transition-name: agent-native-chat) {
     .agent-native-chat-view-transition {
       contain: layout;

package/corpus/core/src/templates/default/.agents/skills/agent-native-toolkit/SKILL.md

@@ -85,7 +85,10 @@ in the moment of agent use.
   approval, generative UI, progress, and screen-state exposure.
 - **Chat history kit**: presentational chat lists and recent-chat rails belong
   in Toolkit; Core keeps thread persistence, agent execution, transport, and
-  page-to-sidebar handoff. Apps inject routing, labels, and domain actions.
+  page-to-sidebar handoff. Use Toolkit's `ChatHistoryRail` for the standard
+  five-item sidebar preview and a footer row with New chat followed by an
+  ellipsis disclosure up to fifteen. Apps inject routing, labels, and domain
+  actions.
 - **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
   `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
   Access tabs plus a Personal/Organization scope toggle. The canonical home

package/corpus/core/src/templates/default/.agents/skills/real-time-collab/SKILL.md

@@ -16,7 +16,7 @@ metadata:
 
 Collaborative editing uses Yjs CRDT via TipTap. The agent and human users are
 equal participants — both edit the same Y.Doc and changes merge cleanly without
-conflicts. Always set `resourceType` on `createCollabPlugin`.
+conflicts. Always choose an explicit `access` mode on `createCollabPlugin`.
 
 ## How It Works
 
@@ -104,7 +104,16 @@ in **different** regions merge fine through the CRDT.
 
 ## Security
 
-### Always set `resourceType`
+### Always choose an explicit access mode
+
+Inspect the schema and sharing registration before configuring collaboration:
+
+- For owned or shareable records, use `mode: "resource"` and the resource type
+  registered through `registerShareableResource`.
+- For records deliberately visible to every authenticated user on the
+  deployment, use `mode: "all-authenticated"`.
+- Never invent a `resourceType` merely to silence a warning. Resource mode is
+  correct only when the matching ownership and sharing model exists.
 
 ```ts
 // server/plugins/collab.ts
@@ -114,14 +123,23 @@ export default createCollabPlugin({
   table: "documents",
   contentColumn: "content",
   idColumn: "id",
-  resourceType: "document", // required
+  access: { mode: "resource", resourceType: "document" },
 });
 ```
 
-Without `resourceType`, the server logs a one-time warning and collab push
-events are delivered to **all authenticated users** without document-level
-scoping. Set it to the resource type name registered via
-`registerShareableResource`.
+For intentionally deployment-wide authenticated collaboration:
+
+```ts
+createCollabPlugin({
+  table: "todos",
+  contentColumn: "content",
+  access: { mode: "all-authenticated" },
+});
+```
+
+Omitting `access` is supported only for legacy compatibility and is deprecated.
+It behaves like `all-authenticated`, logs a warning, and is flagged by Doctor.
+Choose the mode explicitly so access intent is reviewable.
 
 Non-owner sharees who have explicit access fall back to state-vector catch-up
 (safe, slightly higher latency). Awareness routes require the same viewer
@@ -133,7 +151,10 @@ Write routes reject payloads exceeding `maxPayloadBytes` (default 2 MB) with
 HTTP 413. Override:
 
 ```ts
-createCollabPlugin({ resourceType: "document", maxPayloadBytes: 512 * 1024 });
+createCollabPlugin({
+  access: { mode: "resource", resourceType: "document" },
+  maxPayloadBytes: 512 * 1024,
+});
 ```
 
 ## Enabling Collaboration
@@ -144,7 +165,7 @@ createCollabPlugin({ resourceType: "document", maxPayloadBytes: 512 * 1024 });
 pnpm add @tiptap/extension-collaboration @tiptap/extension-collaboration-caret @tiptap/y-tiptap @tiptap/core
 ```
 
-### 2. Add collab server plugin (with `resourceType`)
+### 2. Add collab server plugin (with explicit access)
 
 ```ts
 // server/plugins/collab.ts
@@ -154,7 +175,7 @@ export default createCollabPlugin({
   table: "documents",
   contentColumn: "content",
   idColumn: "id",
-  resourceType: "document",
+  access: { mode: "resource", resourceType: "document" },
 });
 ```
 
@@ -343,9 +364,10 @@ the whole history — external/agent edits must not wipe the user's undo stack.
 
 ## Common Pitfalls
 
-- **Missing `resourceType`** — The server logs a warning on startup and
-  delivers collab events to all authenticated users without access scoping.
-  Always set `resourceType`.
+- **Missing `access`** — Legacy omission behaves like `all-authenticated`, logs
+  a startup warning, and is flagged by Doctor. Choose `resource` for records
+  backed by ownership/sharing, or explicit `all-authenticated` for intentionally
+  deployment-wide records. Never invent a resource type to silence the warning.
 - **Don't pass `content` as a TipTap prop** when Collaboration is enabled —
   Yjs owns the content. Seed via `editor.commands.setContent()` only when the
   Y.XmlFragment is empty.

package/corpus/core/src/templates/default/.agents/skills/real-time-sync/SKILL.md

@@ -72,7 +72,7 @@ The agent modifies data in SQL, but the UI runs in the browser. SSE bridges same
   });
   ```
 
-  `useDbSync` and every `subscribeSyncEvents` subscriber share one `EventSource` and one fallback poll loop per tab — this is how collaborative documents receive doc updates and cursor/awareness events.
+  `useDbSync` and every `subscribeSyncEvents` subscriber share one `EventSource` and one fallback poll loop per tab — this is how collaborative documents receive doc updates and cursor/awareness events. Hidden tabs keep that shared transport alive by default: SSE stays connected and active fallback polling relaxes to a 10-second floor (idle polling remains once per minute). Pass `pauseWhenHidden: true` only for a consumer that explicitly must stop all hidden-tab sync.
 
 ## Which sources to depend on
 

package/corpus/core/src/templates/headless/.agents/skills/agent-native-toolkit/SKILL.md

@@ -85,7 +85,10 @@ in the moment of agent use.
   approval, generative UI, progress, and screen-state exposure.
 - **Chat history kit**: presentational chat lists and recent-chat rails belong
   in Toolkit; Core keeps thread persistence, agent execution, transport, and
-  page-to-sidebar handoff. Apps inject routing, labels, and domain actions.
+  page-to-sidebar handoff. Use Toolkit's `ChatHistoryRail` for the standard
+  five-item sidebar preview and a footer row with New chat followed by an
+  ellipsis disclosure up to fifteen. Apps inject routing, labels, and domain
+  actions.
 - **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
   `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
   Access tabs plus a Personal/Organization scope toggle. The canonical home

package/corpus/core/src/templates/workspace-core/.agents/skills/agent-native-toolkit/SKILL.md

@@ -85,7 +85,10 @@ in the moment of agent use.
   approval, generative UI, progress, and screen-state exposure.
 - **Chat history kit**: presentational chat lists and recent-chat rails belong
   in Toolkit; Core keeps thread persistence, agent execution, transport, and
-  page-to-sidebar handoff. Apps inject routing, labels, and domain actions.
+  page-to-sidebar handoff. Use Toolkit's `ChatHistoryRail` for the standard
+  five-item sidebar preview and a footer row with New chat followed by an
+  ellipsis disclosure up to fifteen. Apps inject routing, labels, and domain
+  actions.
 - **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
   `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
   Access tabs plus a Personal/Organization scope toggle. The canonical home

package/corpus/core/src/templates/workspace-core/.agents/skills/real-time-collab/SKILL.md

@@ -16,7 +16,7 @@ metadata:
 
 Collaborative editing uses Yjs CRDT via TipTap. The agent and human users are
 equal participants — both edit the same Y.Doc and changes merge cleanly without
-conflicts. Always set `resourceType` on `createCollabPlugin`.
+conflicts. Always choose an explicit `access` mode on `createCollabPlugin`.
 
 ## How It Works
 
@@ -104,7 +104,16 @@ in **different** regions merge fine through the CRDT.
 
 ## Security
 
-### Always set `resourceType`
+### Always choose an explicit access mode
+
+Inspect the schema and sharing registration before configuring collaboration:
+
+- For owned or shareable records, use `mode: "resource"` and the resource type
+  registered through `registerShareableResource`.
+- For records deliberately visible to every authenticated user on the
+  deployment, use `mode: "all-authenticated"`.
+- Never invent a `resourceType` merely to silence a warning. Resource mode is
+  correct only when the matching ownership and sharing model exists.
 
 ```ts
 // server/plugins/collab.ts
@@ -114,14 +123,23 @@ export default createCollabPlugin({
   table: "documents",
   contentColumn: "content",
   idColumn: "id",
-  resourceType: "document", // required
+  access: { mode: "resource", resourceType: "document" },
 });
 ```
 
-Without `resourceType`, the server logs a one-time warning and collab push
-events are delivered to **all authenticated users** without document-level
-scoping. Set it to the resource type name registered via
-`registerShareableResource`.
+For intentionally deployment-wide authenticated collaboration:
+
+```ts
+createCollabPlugin({
+  table: "todos",
+  contentColumn: "content",
+  access: { mode: "all-authenticated" },
+});
+```
+
+Omitting `access` is supported only for legacy compatibility and is deprecated.
+It behaves like `all-authenticated`, logs a warning, and is flagged by Doctor.
+Choose the mode explicitly so access intent is reviewable.
 
 Non-owner sharees who have explicit access fall back to state-vector catch-up
 (safe, slightly higher latency). Awareness routes require the same viewer
@@ -133,7 +151,10 @@ Write routes reject payloads exceeding `maxPayloadBytes` (default 2 MB) with
 HTTP 413. Override:
 
 ```ts
-createCollabPlugin({ resourceType: "document", maxPayloadBytes: 512 * 1024 });
+createCollabPlugin({
+  access: { mode: "resource", resourceType: "document" },
+  maxPayloadBytes: 512 * 1024,
+});
 ```
 
 ## Enabling Collaboration
@@ -144,7 +165,7 @@ createCollabPlugin({ resourceType: "document", maxPayloadBytes: 512 * 1024 });
 pnpm add @tiptap/extension-collaboration @tiptap/extension-collaboration-caret @tiptap/y-tiptap @tiptap/core
 ```
 
-### 2. Add collab server plugin (with `resourceType`)
+### 2. Add collab server plugin (with explicit access)
 
 ```ts
 // server/plugins/collab.ts
@@ -154,7 +175,7 @@ export default createCollabPlugin({
   table: "documents",
   contentColumn: "content",
   idColumn: "id",
-  resourceType: "document",
+  access: { mode: "resource", resourceType: "document" },
 });
 ```
 
@@ -343,9 +364,10 @@ the whole history — external/agent edits must not wipe the user's undo stack.
 
 ## Common Pitfalls
 
-- **Missing `resourceType`** — The server logs a warning on startup and
-  delivers collab events to all authenticated users without access scoping.
-  Always set `resourceType`.
+- **Missing `access`** — Legacy omission behaves like `all-authenticated`, logs
+  a startup warning, and is flagged by Doctor. Choose `resource` for records
+  backed by ownership/sharing, or explicit `all-authenticated` for intentionally
+  deployment-wide records. Never invent a resource type to silence the warning.
 - **Don't pass `content` as a TipTap prop** when Collaboration is enabled —
   Yjs owns the content. Seed via `editor.commands.setContent()` only when the
   Y.XmlFragment is empty.

package/corpus/core/src/templates/workspace-core/.agents/skills/real-time-sync/SKILL.md

@@ -72,7 +72,7 @@ The agent modifies data in SQL, but the UI runs in the browser. SSE bridges same
   });
   ```
 
-  `useDbSync` and every `subscribeSyncEvents` subscriber share one `EventSource` and one fallback poll loop per tab — this is how collaborative documents receive doc updates and cursor/awareness events.
+  `useDbSync` and every `subscribeSyncEvents` subscriber share one `EventSource` and one fallback poll loop per tab — this is how collaborative documents receive doc updates and cursor/awareness events. Hidden tabs keep that shared transport alive by default: SSE stays connected and active fallback polling relaxes to a 10-second floor (idle polling remains once per minute). Pass `pauseWhenHidden: true` only for a consumer that explicitly must stop all hidden-tab sync.
 
 ## Which sources to depend on
 

package/corpus/core/src/templates/workspace-core/.agents/skills/voice-transcription/SKILL.md

@@ -24,9 +24,10 @@ shared agent sidebar.
 - **Always show the mic alongside the send button.** Cursor replaces send
   with mic when the composer is empty; their users complain. We keep both
   visible — Lovable does the same.
-- **Ask before switching modes.** The mic opens a shadcn popover offering
-  **Start voice mode** and **Keep dictating**; never silently replace the
-  established dictation behavior.
+- **Ask before switching modes.** The mic opens a compact shadcn popover with
+  **Real-time voice** as the primary action and **Dictate** as the secondary;
+  never silently replace the established dictation behavior. Users can choose
+  **Remember my preference** to skip the chooser on later clicks.
 - **Dictation is click-to-toggle, not push-to-talk.** More forgiving in a sidebar, avoids
   host-app hotkey clashes. Keyboard shortcut is `Cmd/Ctrl+Shift+M` and
   `Escape` cancels mid-recording.
@@ -100,6 +101,9 @@ action before requesting microphone permission.
   `application_state["realtime-voice-prefs"]`. Keep this separate from
   `voice-transcription-prefs`, which configures editable dictation rather than
   the speech-to-speech session.
+- Store the optional remembered chooser selection at
+  `application_state["voice-input-preference"]`. Keep it separate from both
+  mode-specific preference objects.
 - Missing-key failures should open Settings focused on the user-scoped
   `OPENAI_API_KEY` field. Never send, log, or echo the key to the browser.
 
@@ -147,11 +151,11 @@ Default behavior:
 
 | File                                                                  | Purpose                                             |
 | --------------------------------------------------------------------- | --------------------------------------------------- |
-| `packages/core/src/client/composer/useVoiceDictation.ts`              | Provider-routing hook (MediaRecorder / Web Speech)  |
-| `packages/core/src/client/composer/VoiceButton.tsx`                   | Mic button + live amplitude + cancel overlay        |
-| `packages/core/src/client/composer/RealtimeVoiceMode.tsx`            | Opt-in popover + persistent speech orb              |
-| `packages/core/src/client/composer/useRealtimeVoiceMode.tsx`         | WebRTC lifecycle, provider events, and tool bridge  |
-| `packages/core/src/client/composer/TiptapComposer.tsx`                | Wires the hook, insertion, and keyboard shortcut    |
+| `packages/toolkit/src/composer/useVoiceDictation.ts`                  | Provider-routing hook (MediaRecorder / Web Speech)  |
+| `packages/toolkit/src/composer/VoiceButton.tsx`                       | Mic button + live amplitude + cancel overlay        |
+| `packages/toolkit/src/composer/RealtimeVoiceMode.tsx`                | Opt-in popover + persistent speech orb              |
+| `packages/toolkit/src/composer/useRealtimeVoiceMode.tsx`             | WebRTC lifecycle, provider events, and tool bridge  |
+| `packages/toolkit/src/composer/TiptapComposer.tsx`                    | Wires the hook, insertion, and keyboard shortcut    |
 | `packages/core/src/client/settings/VoiceTranscriptionSection.tsx`     | Live source + cleanup controls in sidebar settings  |
 | `packages/core/src/client/transcription/BuilderTranscriptionCta.tsx`  | CTA shown when Builder account isn't connected      |
 | `packages/core/src/client/transcription/use-live-transcription.ts`    | Web Speech live-transcription hook for recordings   |

package/corpus/templates/analytics/.agents/skills/agent-native-toolkit/SKILL.md

@@ -85,7 +85,10 @@ in the moment of agent use.
   approval, generative UI, progress, and screen-state exposure.
 - **Chat history kit**: presentational chat lists and recent-chat rails belong
   in Toolkit; Core keeps thread persistence, agent execution, transport, and
-  page-to-sidebar handoff. Apps inject routing, labels, and domain actions.
+  page-to-sidebar handoff. Use Toolkit's `ChatHistoryRail` for the standard
+  five-item sidebar preview and a footer row with New chat followed by an
+  ellipsis disclosure up to fifteen. Apps inject routing, labels, and domain
+  actions.
 - **Agent page kit**: the full-page `/agent` surface (`AgentTabsPage` from
   `@agent-native/core/client`) with Context, Files, Connections, Jobs, and
   Access tabs plus a Personal/Organization scope toggle. The canonical home

package/corpus/templates/analytics/.agents/skills/real-time-sync/SKILL.md

@@ -72,7 +72,7 @@ The agent modifies data in SQL, but the UI runs in the browser. SSE bridges same
   });
   ```
 
-  `useDbSync` and every `subscribeSyncEvents` subscriber share one `EventSource` and one fallback poll loop per tab — this is how collaborative documents receive doc updates and cursor/awareness events.
+  `useDbSync` and every `subscribeSyncEvents` subscriber share one `EventSource` and one fallback poll loop per tab — this is how collaborative documents receive doc updates and cursor/awareness events. Hidden tabs keep that shared transport alive by default: SSE stays connected and active fallback polling relaxes to a 10-second floor (idle polling remains once per minute). Pass `pauseWhenHidden: true` only for a consumer that explicitly must stop all hidden-tab sync.
 
 ## Which sources to depend on
 

package/corpus/templates/analytics/AGENTS.md

@@ -228,11 +228,16 @@ membership id when its native update status reports `update-available`.
   `dashboard-report-subscriptions` actions. They send daily snapshots scoped to
   the exact user/org context that created the subscription with saved URL
   filters; do not hand-wire custom email routes around that action surface.
+- Table panels can be exported with `export-dashboard-panel-to-google-sheet`.
+  The action re-runs the accessible panel query with the dashboard's current
+  filter variables, creates a new Sheet through the connected Google Drive
+  workspace connection, and returns its URL plus bounded export metadata.
   Report PNGs are Playwright captures of the real dashboard route in
   `reportScreenshot=1` mode, authenticated by a short-lived embed-session token
   and embedded inline in email as ordered CID images. Complete dashboards are
-  captured sequentially in bounded panel windows; every window must match the
-  panel ids snapshotted at the start, and a failed or mismatched window
+  captured sequentially in four-panel windows matching the browser's four-query
+  concurrency limit; every window must match the panel ids snapshotted at the
+  start, and a failed or mismatched window
   invalidates the entire image set so the scheduler can retry instead of
   sending a partial report. Capture is capped at 10 windows and 14 MiB of raw
   PNG data, and subscriptions are capped at five distinct recipients; use a