@agent-native/core 0.115.4 → 0.117.0

package/corpus/templates/brain/app/routes/sources.tsx

@@ -3,6 +3,14 @@ import {
   useActionQuery,
 } from "@agent-native/core/client/hooks";
 import { useT } from "@agent-native/core/client/i18n";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from "@agent-native/toolkit/ui/dialog";
 import {
   IconAlertTriangle,
   IconArchive,
@@ -12,6 +20,7 @@ import {
   IconCircleCheck,
   IconCircleDashed,
   IconClock,
+  IconCopy,
   IconDatabaseImport,
   IconDotsVertical,
   IconExternalLink,
@@ -73,6 +82,7 @@ import {
   type BrainCaptureReviewItem,
   type EnqueueCapturesDistillationResponse,
   type CapturesResponse,
+  type CreateSourceResponse,
   type BrainSource,
   type BrainWorkspaceConnectionGrantState,
   type BrainWorkspaceConnectionStatus,
@@ -90,6 +100,10 @@ import {
   sourceReviewRequired,
   sourceType,
 } from "@/lib/brain";
+import {
+  createOneTimeIngestHandoff,
+  type OneTimeIngestHandoff,
+} from "@/lib/ingest-handoff";
 
 type Provider = "manual" | "generic" | "clips" | "slack" | "granola" | "github";
 type CaptureStatusFilter = BrainCaptureReviewStatus | "all";
@@ -1499,16 +1513,25 @@ function SourceFact({ label, value }: { label: string; value: ReactNode }) {
   );
 }
 
+function ingestSourceKey(source: BrainSource) {
+  const sourceKey = source.config?.sourceKey;
+  return typeof sourceKey === "string" && sourceKey.trim()
+    ? sourceKey.trim()
+    : null;
+}
+
 function SourceListItem({
   source,
   syncPending,
   onReview,
+  onRotateIngestToken,
   onSync,
   onTune,
 }: {
   source: BrainSource;
   syncPending: boolean;
   onReview: () => void;
+  onRotateIngestToken?: () => void;
   onSync: () => void;
   onTune: () => void;
 }) {
@@ -1602,6 +1625,12 @@ function SourceListItem({
                   <IconSettings2 className="size-4" />
                   {t("sources.tuneSource")}
                 </DropdownMenuItem>
+                {onRotateIngestToken ? (
+                  <DropdownMenuItem onSelect={onRotateIngestToken}>
+                    <IconRefresh className="size-4" />
+                    {t("sources.rotateIngestToken")}
+                  </DropdownMenuItem>
+                ) : null}
               </DropdownMenuContent>
             </DropdownMenu>
           </div>
@@ -1633,6 +1662,11 @@ export default function SourcesRoute() {
   const type = params.get("type") ?? "all";
   const [advancedOpen, setAdvancedOpen] = useState(false);
   const [setupOpen, setSetupOpen] = useState(false);
+  const [ingestHandoff, setIngestHandoff] =
+    useState<OneTimeIngestHandoff | null>(null);
+  const [copiedHandoffField, setCopiedHandoffField] = useState<string | null>(
+    null,
+  );
   const [editingSource, setEditingSource] = useState<BrainSource | null>(null);
   const [reviewSource, setReviewSource] = useState<BrainSource | null>(null);
   const [captureStatus, setCaptureStatus] =
@@ -1672,7 +1706,7 @@ export default function SourcesRoute() {
     }
   >("update-source" as any);
   const createSource = useActionMutation<
-    unknown,
+    CreateSourceResponse,
     {
       title: string;
       provider: Provider;
@@ -1681,6 +1715,10 @@ export default function SourcesRoute() {
       sourceKey?: string;
     }
   >("create-source" as any);
+  const rotateSourceIngestToken = useActionMutation<
+    CreateSourceResponse,
+    { sourceId: string }
+  >("rotate-source-ingest-token" as any);
   const syncSource = useActionMutation<unknown, { sourceId: string }>(
     "sync-source" as any,
   );
@@ -1818,10 +1856,20 @@ export default function SourcesRoute() {
     setForm((current) => ({ ...current, ...patch }));
   }
 
-  function submitSource() {
+  function closeIngestHandoff() {
+    setIngestHandoff(null);
+    setCopiedHandoffField(null);
+  }
+
+  async function copyIngestHandoffValue(value: string, field: string) {
+    await navigator.clipboard.writeText(value);
+    setCopiedHandoffField(field);
+  }
+
+  async function submitSource() {
     const config = buildConfig(form);
     if (editingSource) {
-      updateSource.mutate({
+      await updateSource.mutateAsync({
         id: editingSource.id,
         title: form.title.trim() || defaultTitle(form.provider, t),
         status:
@@ -1829,17 +1877,39 @@ export default function SourcesRoute() {
         config,
       });
     } else {
-      createSource.mutate({
+      const result = await createSource.mutateAsync({
         title: form.title.trim() || defaultTitle(form.provider, t),
         provider: form.provider,
         visibility: "org",
         config,
         sourceKey: form.sourceKey.trim() || undefined,
       });
+      const handoff = createOneTimeIngestHandoff({
+        origin: window.location.origin,
+        provider: form.provider,
+        result,
+        sourceKey: form.sourceKey,
+      });
+      if (handoff) setIngestHandoff(handoff);
     }
     setSetupOpen(false);
   }
 
+  async function rotateIngestToken(source: BrainSource) {
+    const sourceKey = ingestSourceKey(source);
+    if (!sourceKey) return;
+    const result = await rotateSourceIngestToken.mutateAsync({
+      sourceId: source.id,
+    });
+    const handoff = createOneTimeIngestHandoff({
+      origin: window.location.origin,
+      provider: source.provider ?? "",
+      result,
+      sourceKey,
+    });
+    if (handoff) setIngestHandoff(handoff);
+  }
+
   function toggleCaptureSelection(captureId: string, checked: boolean) {
     setSelectedCaptureIds((current) => {
       const next = new Set(current);
@@ -1909,8 +1979,17 @@ export default function SourcesRoute() {
             <SourceListItem
               key={source.id}
               source={source}
-              syncPending={syncSource.isPending}
+              syncPending={
+                syncSource.isPending || rotateSourceIngestToken.isPending
+              }
               onReview={() => openCaptureReview(source)}
+              onRotateIngestToken={
+                (source.provider === "clips" ||
+                  source.provider === "generic") &&
+                ingestSourceKey(source)
+                  ? () => void rotateIngestToken(source)
+                  : undefined
+              }
               onSync={() => syncSource.mutate({ sourceId: source.id })}
               onTune={() => openEdit(source)}
             />
@@ -1928,6 +2007,7 @@ export default function SourcesRoute() {
         connectionProvidersQuery.isError ||
         updateSource.isError ||
         createSource.isError ||
+        rotateSourceIngestToken.isError ||
         syncSource.isError ||
         syncDueSources.isError ||
         enqueueCapturesDistillation.isError ? (
@@ -2302,6 +2382,77 @@ export default function SourcesRoute() {
         </SheetContent>
       </Sheet>
 
+      <Dialog
+        open={Boolean(ingestHandoff)}
+        onOpenChange={(open) => {
+          if (!open) closeIngestHandoff();
+        }}
+      >
+        {ingestHandoff ? (
+          <DialogContent className="max-w-xl gap-5">
+            <DialogHeader>
+              <DialogTitle>
+                {t("sources.connectIngestSource", {
+                  source: ingestHandoff.source.title,
+                })}
+              </DialogTitle>
+              <DialogDescription>
+                {t("sources.ingestHandoffDescription")}
+              </DialogDescription>
+            </DialogHeader>
+
+            <div className="grid gap-4">
+              {[
+                [t("sources.endpoint"), ingestHandoff.endpoint, "endpoint"],
+                [t("sources.sourceKey"), ingestHandoff.sourceKey, "source-key"],
+                [
+                  t("sources.ingestToken"),
+                  ingestHandoff.ingestToken,
+                  "ingest-token",
+                ],
+              ].map(([label, value, field]) => (
+                <div key={field} className="grid gap-2">
+                  <Label htmlFor={`ingest-handoff-${field}`}>{label}</Label>
+                  <div className="flex gap-2">
+                    <Input
+                      id={`ingest-handoff-${field}`}
+                      value={value}
+                      readOnly
+                      className="min-w-0 font-mono text-xs"
+                    />
+                    <Button
+                      type="button"
+                      variant="outline"
+                      className="shrink-0"
+                      onClick={() => void copyIngestHandoffValue(value, field)}
+                    >
+                      {copiedHandoffField === field ? (
+                        <IconChecks className="size-4" />
+                      ) : (
+                        <IconCopy className="size-4" />
+                      )}
+                      {copiedHandoffField === field
+                        ? t("sources.copied")
+                        : t("sources.copy")}
+                    </Button>
+                  </div>
+                </div>
+              ))}
+            </div>
+
+            <div className="rounded-md border border-border bg-muted/25 p-3 text-sm leading-6 text-muted-foreground">
+              {t("sources.ingestTokenSecurity")}
+            </div>
+
+            <DialogFooter>
+              <Button type="button" onClick={closeIngestHandoff}>
+                {t("sources.ingestHandoffSaved")}
+              </Button>
+            </DialogFooter>
+          </DialogContent>
+        ) : null}
+      </Dialog>
+
       <Sheet open={setupOpen} onOpenChange={setSetupOpen}>
         <SheetContent className="w-full overflow-y-auto sm:max-w-xl">
           <SheetHeader>

package/corpus/templates/brain/changelog/2026-07-22-chat-runs-always-end-with-an-answer.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-22
+---
+
+Chat runs now keep working through long source syncs and always end with a visible answer.

package/corpus/templates/brain/changelog/2026-07-22-clear-background-chat-progress.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-22
+---
+
+Chat stays current in background tabs and keeps its latest tool visibly active without covering the first message.

package/corpus/templates/brain/changelog/2026-07-22-compact-sidebar-footer.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-22
+---
+
+The sidebar footer now keeps Feedback and the collapse control on one compact row.

package/corpus/templates/brain/changelog/2026-07-22-full-page-chat-keeps-the-active-conversation-when-moving-to-.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-22
+---
+
+Full-page chat keeps the active conversation when moving to and from the sidebar.

package/corpus/templates/brain/changelog/2026-07-22-long-chat-titles-stay-inside-the-sidebar.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-22
+---
+
+Long chat titles now stay inside the sidebar, and recent chats expand from a compact five-item list.

package/corpus/templates/brain/changelog/2026-07-22-new-clips-and-webhook-sources-now-show-their-secure-connecti.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-07-22
+---
+
+New Clips and webhook sources now show their secure connection details once, with copy controls and token rotation.

package/corpus/templates/brain/jobs/emit-netlify-brain-queue-cron.ts

@@ -0,0 +1,125 @@
+#!/usr/bin/env tsx
+
+import { randomBytes } from "node:crypto";
+import { cpSync, existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const FUNCTIONS_DIR = path.join(ROOT, ".netlify", "functions-internal");
+const SERVER_DIR = path.join(FUNCTIONS_DIR, "server");
+export const SCHEDULED_NAME = "brain-queue-cron";
+export const WORKER_NAME = "brain-queue-sweep-background";
+export const ROUTE_PATH = "/api/brain/queue/run";
+export const SCHEDULE = "* * * * *";
+
+function ensureDir(dir: string) {
+  mkdirSync(dir, { recursive: true });
+}
+
+export function scheduledTriggerSource(token: string) {
+  return `const WORKER_PATH = "/.netlify/functions/${WORKER_NAME}";
+const CRON_TOKEN = ${JSON.stringify(token)};
+
+function siteOrigin(request) {
+  return new URL(request.url).origin;
+}
+
+export default async function handler(request) {
+  const response = await fetch(new URL(WORKER_PATH, siteOrigin(request)), {
+    method: "POST",
+    headers: { "content-type": "application/json", "x-agent-native-brain-cron": CRON_TOKEN },
+    body: JSON.stringify({ scheduled: true }),
+  });
+  if (!response.ok && response.status !== 202) {
+    console.error("[brain-queue-cron] Background sweep trigger failed:", response.status);
+  }
+}
+
+export const config = {
+  name: "brain queue cron trigger",
+  generator: "agent-native brain build",
+  schedule: ${JSON.stringify(SCHEDULE)},
+};
+`;
+}
+
+export function backgroundWorkerSource(token: string) {
+  return `globalThis.__AGENT_NATIVE_BRAIN_SCHEDULED_RUNTIME__ = true;
+const CRON_TOKEN = ${JSON.stringify(token)};
+const ROUTE_PATH = ${JSON.stringify(ROUTE_PATH)};
+let cachedHandler;
+
+function timingSafeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i += 1) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+
+export default async function handler(request, context) {
+  const token = request.headers.get("x-agent-native-brain-cron") || "";
+  if (!timingSafeEquals(token, CRON_TOKEN)) return new Response("Unauthorized", { status: 401 });
+  cachedHandler ??= (await import("./main.mjs")).default;
+  const url = new URL(request.url);
+  url.pathname = ROUTE_PATH;
+  url.search = "";
+  return cachedHandler(new Request(url, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ scheduled: true }),
+  }), context);
+}
+
+export const config = {
+  name: "brain queue background sweep",
+  generator: "agent-native brain build",
+  background: true,
+  nodeBundler: "none",
+  includedFiles: ["**"],
+  preferStatic: false,
+};
+`;
+}
+
+export function emitNetlifyBrainQueueCron(
+  options: {
+    functionsDir?: string;
+    serverDir?: string;
+    token?: string;
+  } = {},
+) {
+  const functionsDir = options.functionsDir ?? FUNCTIONS_DIR;
+  const serverDir = options.serverDir ?? SERVER_DIR;
+  if (!existsSync(serverDir)) {
+    throw new Error(
+      "Expected Nitro Netlify server output before emitting Brain cron functions.",
+    );
+  }
+  const token = options.token ?? randomBytes(32).toString("hex");
+  const scheduledDir = path.join(functionsDir, SCHEDULED_NAME);
+  const workerDir = path.join(functionsDir, WORKER_NAME);
+  rmSync(scheduledDir, { recursive: true, force: true });
+  rmSync(workerDir, { recursive: true, force: true });
+  ensureDir(scheduledDir);
+  cpSync(serverDir, workerDir, { recursive: true });
+  rmSync(path.join(workerDir, "server.mjs"), { force: true });
+  writeFileSync(
+    path.join(scheduledDir, `${SCHEDULED_NAME}.mjs`),
+    scheduledTriggerSource(token),
+  );
+  writeFileSync(
+    path.join(workerDir, `${WORKER_NAME}.mjs`),
+    backgroundWorkerSource(token),
+  );
+}
+
+if (
+  process.argv[1] &&
+  path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)
+) {
+  emitNetlifyBrainQueueCron();
+  console.log(
+    "[brain-queue-cron] Emitted scheduled queue sweep and background worker.",
+  );
+}

package/corpus/templates/brain/netlify.toml

@@ -1,6 +1,6 @@
 [build]
 ignore = "node ./scripts/netlify-ignore-build.mjs brain"
-command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter brain build"
+command = "export DATABASE_URL=${NETLIFY_DATABASE_URL:-$DATABASE_URL} && pnpm install && NITRO_PRESET=netlify pnpm --filter brain build && pnpm exec tsx templates/brain/jobs/emit-netlify-brain-queue-cron.ts"
 publish = "templates/brain/dist"
 functions = "templates/brain/.netlify/functions-internal"
 
@@ -15,3 +15,7 @@ NPM_CONFIG_PRODUCTION = "false"
 # auto-continuation path can hand off before Netlify kills the function.
 [functions."*"]
 timeout = 75
+
+[functions.brain-queue-sweep-background]
+timeout = 900
+memory = "2gb"

package/corpus/templates/brain/scripts/configure-prod-clips-source.ts

@@ -0,0 +1,50 @@
+import { createHash, randomBytes } from "node:crypto";
+import { writeFile } from "node:fs/promises";
+
+import { getDbExec } from "@agent-native/core/db";
+
+const tokenFile = process.env.BRAIN_CLIPS_TOKEN_FILE;
+if (!tokenFile) throw new Error("BRAIN_CLIPS_TOKEN_FILE is required");
+
+const db = getDbExec();
+const { rows } = await db.execute({
+  sql: "SELECT id, source_key, config_json FROM brain_sources WHERE provider = ? AND title = ?",
+  args: ["clips", "Clips exports"],
+});
+if (rows.length !== 1) {
+  throw new Error(`Expected one Clips exports source, found ${rows.length}`);
+}
+
+const source = rows[0] as {
+  id: string;
+  source_key?: string | null;
+  config_json?: string | null;
+};
+const sourceKey = source.source_key?.trim() || "clips";
+const token = `brain_${randomBytes(32).toString("base64url")}`;
+const tokenHash = createHash("sha256").update(token).digest("hex");
+const config = JSON.parse(source.config_json || "{}") as Record<
+  string,
+  unknown
+>;
+config.sourceKey = sourceKey;
+config.ingestTokenHash = tokenHash;
+
+await db.execute({
+  sql: "UPDATE brain_sources SET source_key = ?, ingest_token_hash = ?, config_json = ?, updated_at = ? WHERE id = ?",
+  args: [
+    sourceKey,
+    tokenHash,
+    JSON.stringify(config),
+    new Date().toISOString(),
+    source.id,
+  ],
+});
+await writeFile(tokenFile, token, {
+  encoding: "utf8",
+  flag: "wx",
+  mode: 0o600,
+});
+console.log(
+  JSON.stringify({ configured: true, sourceId: source.id, sourceKey }),
+);

package/corpus/templates/brain/server/lib/capture-sanitization.ts

@@ -168,6 +168,10 @@ function preferredDeterministicSection(content: string): string {
   return content;
 }
 
+function hasSummarySection(content: string): boolean {
+  return /(?:^|\n)\s*Summary\s*\n/i.test(content);
+}
+
 function looksLikeRawTranscriptLine(line: string): boolean {
   return (
     /^\[[^\]\n]{1,80}\]\s*/.test(line) ||
@@ -208,6 +212,35 @@ function deterministicSanitizeContent(
   return retained.join("\n").slice(0, 80_000).trim();
 }
 
+function deterministicMeetingOutageFallback(
+  input: CaptureSanitizationInput,
+  decision: BrainSensitivityDecision,
+  capturedAt: string,
+): string | null {
+  if (
+    decision.disposition !== "allowed" ||
+    input.kind !== "transcript" ||
+    !["granola", "clips"].includes(input.source.provider) ||
+    !shouldSanitizeCaptureBeforeStorage(input) ||
+    !hasSummarySection(decision.safeContent) ||
+    PERSONAL_SIGNAL.test(decision.safeContent) ||
+    RECRUITING_SIGNAL.test(decision.safeContent)
+  ) {
+    return null;
+  }
+
+  const content = deterministicSanitizeContent(
+    sanitizeSensitiveText(decision.safeContent),
+    { dropTranscriptLines: true },
+  );
+  if (content === DEFAULT_SANITIZATION_OUTPUT) return null;
+
+  return fallbackSensitivityDecision(content, capturedAt).disposition ===
+    "allowed"
+    ? content
+    : null;
+}
+
 function safeTranscriptTitle(input: CaptureSanitizationInput): string {
   const date = input.capturedAt?.slice(0, 10);
   const providerLabel =
@@ -506,7 +539,9 @@ export async function sanitizeCaptureForStorage(
     deterministicQuarantineDecision(input.title, capturedAt) ??
     (titleDecision.disposition === "allowed" ? null : titleDecision) ??
     deterministicQuarantineDecision(input.content, capturedAt);
+  const sanitizationRequested = shouldSanitizeCaptureBeforeStorage(input);
   let fallbackReason: string | undefined;
+  let classifierOutageFallback = false;
   const classifierConfigured = Boolean(
     stringSetting(input.settings.privacyClassifierModel) &&
     stringSetting(input.settings.privacyClassifierEngine),
@@ -526,13 +561,35 @@ export async function sanitizeCaptureForStorage(
   }
   decision ??= fallbackSensitivityDecision(input.content, capturedAt);
   if (classifierFailed) {
-    decision = {
-      ...decision,
-      disposition: "quarantined",
-      confidenceBand: "uncertain",
-    };
+    const deterministicMeetingContent = deterministicMeetingOutageFallback(
+      input,
+      decision,
+      capturedAt,
+    );
+    if (deterministicMeetingContent) {
+      classifierOutageFallback = true;
+      decision = {
+        ...decision,
+        safeContent: deterministicMeetingContent,
+        safeSegments: [
+          {
+            id: "deterministic-meeting-summary",
+            capturedAt,
+            text: deterministicMeetingContent,
+            reactionCount: 0,
+          },
+        ],
+        confidenceBand: "deterministic",
+        classifier: "deterministic",
+      };
+    } else {
+      decision = {
+        ...decision,
+        disposition: "quarantined",
+        confidenceBand: "uncertain",
+      };
+    }
   }
-  const sanitizationRequested = shouldSanitizeCaptureBeforeStorage(input);
 
   const sanitizedContent =
     decision.disposition === "allowed"
@@ -575,6 +632,7 @@ export async function sanitizeCaptureForStorage(
             ? input.settings.privacyClassifierModel
             : undefined,
         fallbackReason,
+        classifierOutageFallback: classifierOutageFallback || undefined,
         disposition: decision.disposition,
         categories: decision.categories,
         confidenceBand: decision.confidenceBand,

package/corpus/templates/brain/server/plugins/agent-chat.ts

@@ -10,6 +10,8 @@ import { and, desc, like, or } from "drizzle-orm";
 import actionsRegistry from "../../.generated/actions-registry.js";
 import { tryAnswerBrainA2AQuestion } from "../lib/a2a-fallback.js";
 
+const BRAIN_BACKGROUND_RUN_SOFT_TIMEOUT_MS = 13 * 60_000;
+
 const INITIAL_TOOL_NAMES = [
   "get-brain-settings",
   "ask-brain",
@@ -39,6 +41,8 @@ export default createAgentChatPlugin({
   appId: "brain",
   actions: loadActionsFromStaticRegistry(actionsRegistry),
   initialToolNames: INITIAL_TOOL_NAMES,
+  durableBackgroundRuns: true,
+  runSoftTimeoutMs: BRAIN_BACKGROUND_RUN_SOFT_TIMEOUT_MS,
   resolveOrgId: async (event) => (await getOrgContext(event)).orgId,
   codeExecution: { production: "sandboxed" },
   systemPrompt: `You are the Brain institutional-knowledge agent.

package/corpus/templates/brain/server/plugins/brain-jobs.ts

@@ -2,6 +2,7 @@ import registerBrainDistillationQueueJob from "../jobs/distillation-queue.js";
 import registerBrainSourceSyncJob from "../jobs/sync-sources.js";
 
 export default () => {
+  if (process.env.NETLIFY === "true") return;
   registerBrainSourceSyncJob();
   registerBrainDistillationQueueJob();
 };