@agent-native/core 0.120.2 → 0.120.4

package/corpus/templates/clips/app/routes/share.$shareId.tsx

@@ -579,13 +579,13 @@ export default function ShareRoute() {
 
   usePlayerShortcuts({ playerRef });
 
+  const [trackedVideoEl, setTrackedVideoEl] = useState<HTMLVideoElement | null>(
+    null,
+  );
+
   const tracking = useViewTracking({
     recordingId: shareId ?? "",
-    videoRef: {
-      get current() {
-        return playerRef.current?.video ?? null;
-      },
-    } as any,
+    videoEl: trackedVideoEl,
     durationMs: recording?.durationMs ?? 0,
     trackOpenWithoutVideo: isLoomEmbedBacked,
   });
@@ -961,6 +961,7 @@ export default function ShareRoute() {
           <div className="aspect-video w-full lg:min-h-0 lg:flex-1 lg:aspect-auto">
             <VideoPlayer
               ref={playerRef}
+              onVideoElementChange={setTrackedVideoEl}
               recordingId={recording.id}
               videoUrl={recording.videoUrl}
               videoFormat={recording.videoFormat}

package/corpus/templates/clips/changelog/2026-07-24-borderless-secondary-surfaces.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-24
+---
+
+Secondary controls and dashboard surfaces now use quieter borderless styling.

package/corpus/templates/clips/changelog/2026-07-24-sidebar-footer-controls-follow-a-consistent-order.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-24
+---
+
+Sidebar utility controls now follow a consistent footer order.

package/corpus/templates/clips/server/plugins/db.ts

@@ -1261,16 +1261,6 @@ async function sweepOrphanedRecordingChunks(): Promise<void> {
   }
 }
 
-function rowNumber(value: unknown): number {
-  if (typeof value === "number" && Number.isFinite(value)) return value;
-  if (typeof value === "bigint") return Number(value);
-  if (typeof value === "string") {
-    const parsed = Number(value);
-    return Number.isFinite(parsed) ? parsed : 0;
-  }
-  return 0;
-}
-
 /**
  * Sweep orphaned resumable upload sessions out of `application_state`.
  *
@@ -1287,6 +1277,8 @@ function rowNumber(value: unknown): number {
 async function sweepOrphanedResumableSessions(): Promise<void> {
   const exec = getDbExec();
   const pg = isPostgres();
+  const SWEEP_BATCH = 500;
+  const IN_CHUNK = 200;
 
   let sessionRows: Array<{
     session_id?: unknown;
@@ -1295,7 +1287,7 @@ async function sweepOrphanedResumableSessions(): Promise<void> {
   }> = [];
   try {
     const probe = await exec.execute({
-      sql: `SELECT session_id, key, updated_at FROM application_state WHERE key LIKE 'resumable-session-%'`,
+      sql: `SELECT session_id, key, updated_at FROM application_state WHERE key LIKE 'resumable-session-%' ORDER BY updated_at ASC LIMIT ${SWEEP_BATCH}`,
       args: [],
     });
     sessionRows =
@@ -1326,8 +1318,15 @@ async function sweepOrphanedResumableSessions(): Promise<void> {
   const staleInProgressIso = new Date(
     Date.now() - 24 * 60 * 60 * 1000,
   ).toISOString();
-  let totalDeleted = 0;
 
+  // Parse candidate rows and collect the referenced recording ids so they can
+  // be resolved in a few batched lookups instead of one query per session.
+  const candidates: Array<{
+    key: string;
+    recordingId: string;
+    sessionUpdatedAt: string;
+  }> = [];
+  const recordingIds = new Set<string>();
   for (const row of sessionRows) {
     const key = typeof row.key === "string" ? row.key : "";
     if (!key.startsWith(prefix)) continue;
@@ -1343,78 +1342,124 @@ async function sweepOrphanedResumableSessions(): Promise<void> {
       Number.isFinite(sessionUpdatedAtMs) && sessionUpdatedAtMs > 0
         ? new Date(sessionUpdatedAtMs).toISOString()
         : "";
+    candidates.push({ key, recordingId, sessionUpdatedAt });
+    recordingIds.add(recordingId);
+  }
+  if (candidates.length === 0) return;
 
-    let shouldSweep = false;
+  // Resolve every referenced recording in chunked `IN (...)` lookups.
+  const recordingById = new Map<
+    string,
+    { status?: string; updatedAt?: string }
+  >();
+  const idList = [...recordingIds];
+  for (let i = 0; i < idList.length; i += IN_CHUNK) {
+    const chunk = idList.slice(i, i + IN_CHUNK);
+    const placeholders = chunk
+      .map((_, j) => (pg ? `$${j + 1}` : "?"))
+      .join(", ");
     try {
       const probe = await exec.execute({
-        sql: pg
-          ? `SELECT status, updated_at FROM recordings WHERE id = $1 LIMIT 1`
-          : `SELECT status, updated_at FROM recordings WHERE id = ? LIMIT 1`,
-        args: [recordingId],
+        sql: `SELECT id, status, updated_at FROM recordings WHERE id IN (${placeholders})`,
+        args: chunk,
       });
-      const recording = (
-        probe.rows as Array<{ status?: string; updated_at?: string }>
-      )[0];
-      if (!recording) {
-        shouldSweep = true;
-      } else if (
-        (recording.status === "ready" || recording.status === "failed") &&
-        (recording.updated_at ?? "") < oneHourAgoIso
-      ) {
-        shouldSweep = true;
-      } else if (
-        (recording.status === "uploading" ||
-          recording.status === "processing") &&
-        (sessionUpdatedAt || recording.updated_at || "") < staleInProgressIso
-      ) {
-        try {
-          await exec.execute({
-            sql: pg
-              ? `UPDATE recordings SET status = 'failed', failure_reason = $1, updated_at = $2 WHERE id = $3 AND status = $4`
-              : `UPDATE recordings SET status = 'failed', failure_reason = ?, updated_at = ? WHERE id = ? AND status = ?`,
-            args: [
-              "Upload did not finish before the resumable upload cleanup window.",
-              new Date().toISOString(),
-              recordingId,
-              recording.status,
-            ],
+      for (const rec of probe.rows as Array<{
+        id?: string;
+        status?: string;
+        updated_at?: string;
+      }>) {
+        if (typeof rec.id === "string") {
+          recordingById.set(rec.id, {
+            status: rec.status,
+            updatedAt: rec.updated_at,
           });
-        } catch (err) {
-          console.warn(
-            "[db] resumable-session sweep: stale upload mark-failed failed",
-            {
-              recordingId,
-              status: recording.status,
-              err: (err as Error)?.message ?? err,
-            },
-          );
         }
-        shouldSweep = true;
       }
     } catch (err) {
-      console.warn("[db] resumable-session sweep: recording probe failed", {
-        recordingId,
-        err: (err as Error)?.message ?? err,
-      });
+      console.warn(
+        "[db] resumable-session sweep: recordings batch probe failed",
+        (err as Error)?.message ?? err,
+      );
+      return;
+    }
+  }
+
+  // Decide sweeps in memory, then mark stale uploads failed and batch-delete.
+  const keysToDelete = new Set<string>();
+  const staleIdsByStatus = new Map<string, Set<string>>();
+  for (const candidate of candidates) {
+    const recording = recordingById.get(candidate.recordingId);
+    if (!recording) {
+      keysToDelete.add(candidate.key);
       continue;
     }
+    const status = recording.status;
+    if (
+      (status === "ready" || status === "failed") &&
+      (recording.updatedAt ?? "") < oneHourAgoIso
+    ) {
+      keysToDelete.add(candidate.key);
+    } else if (
+      (status === "uploading" || status === "processing") &&
+      (candidate.sessionUpdatedAt || recording.updatedAt || "") <
+        staleInProgressIso
+    ) {
+      const bucket = staleIdsByStatus.get(status) ?? new Set<string>();
+      bucket.add(candidate.recordingId);
+      staleIdsByStatus.set(status, bucket);
+      keysToDelete.add(candidate.key);
+    }
+  }
 
-    if (!shouldSweep) continue;
+  // Mark stale in-progress uploads failed, one chunked `IN (...)` update per
+  // status. The `status = ?` guard keeps a recording that concurrently
+  // advanced out of that status from being clobbered back to failed.
+  const staleReason =
+    "Upload did not finish before the resumable upload cleanup window.";
+  for (const [status, idSet] of staleIdsByStatus) {
+    const ids = [...idSet];
+    for (let i = 0; i < ids.length; i += IN_CHUNK) {
+      const chunk = ids.slice(i, i + IN_CHUNK);
+      const idPlaceholders = chunk
+        .map((_, j) => (pg ? `$${j + 3}` : "?"))
+        .join(", ");
+      const statusPlaceholder = pg ? `$${chunk.length + 3}` : "?";
+      try {
+        await exec.execute({
+          sql: `UPDATE recordings SET status = 'failed', failure_reason = ${pg ? "$1" : "?"}, updated_at = ${pg ? "$2" : "?"} WHERE id IN (${idPlaceholders}) AND status = ${statusPlaceholder}`,
+          args: [staleReason, new Date().toISOString(), ...chunk, status],
+        });
+      } catch (err) {
+        console.warn(
+          "[db] resumable-session sweep: stale upload mark-failed failed",
+          {
+            status,
+            recordingIds: chunk,
+            err: (err as Error)?.message ?? err,
+          },
+        );
+      }
+    }
+  }
 
+  let totalDeleted = 0;
+  const deleteKeys = [...keysToDelete];
+  for (let i = 0; i < deleteKeys.length; i += IN_CHUNK) {
+    const chunk = deleteKeys.slice(i, i + IN_CHUNK);
+    const placeholders = chunk
+      .map((_, j) => (pg ? `$${j + 1}` : "?"))
+      .join(", ");
     try {
       await exec.execute({
-        sql: pg
-          ? `DELETE FROM application_state WHERE session_id = $1 AND key = $2`
-          : `DELETE FROM application_state WHERE session_id = ? AND key = ?`,
-        args: [String(row.session_id ?? ""), key],
+        sql: `DELETE FROM application_state WHERE key IN (${placeholders})`,
+        args: chunk,
       });
-      totalDeleted += 1;
+      totalDeleted += chunk.length;
     } catch (err) {
-      console.warn("[db] resumable-session sweep: delete failed", {
-        key,
-        updatedAt: rowNumber(row.updated_at),
-        err: (err as Error)?.message ?? err,
-      });
+      console.warn(
+        "[db] resumable-session sweep: batch delete failed",
+        (err as Error)?.message ?? err,
+      );
     }
   }
 

package/corpus/templates/content/actions/update-document.ts

@@ -40,6 +40,33 @@ export interface DocumentUpdateConflictResponse {
   document: DocumentUpdateResponse;
 }
 
+const documentAuditOwner = Symbol("documentAuditOwner");
+
+type DocumentAuditScopedResult = {
+  [documentAuditOwner]?: string;
+};
+
+function scopeDocumentAudit<T extends object>(result: T, ownerEmail: string) {
+  Object.defineProperty(result, documentAuditOwner, { value: ownerEmail });
+  return result;
+}
+
+function isFavoriteOnlyUpdate(args: {
+  isFavorite?: boolean;
+  title?: string;
+  content?: string;
+  description?: string;
+  icon?: string | null;
+}) {
+  return (
+    args.isFavorite !== undefined &&
+    args.title === undefined &&
+    args.content === undefined &&
+    args.description === undefined &&
+    args.icon === undefined
+  );
+}
+
 function nanoid(size = 12): string {
   const chars =
     "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
@@ -301,6 +328,29 @@ export default defineAction({
       .default([])
       .describe("Exact item versions that influenced this agent update."),
   }),
+  audit: {
+    // Document bodies and personal favorite preferences are both sensitive.
+    // Keep actor/target/outcome attribution without copying mutation payloads
+    // into an owner-visible audit row.
+    recordInputs: false,
+    target: (args, result) => {
+      const favoriteOnly = isFavoriteOnlyUpdate(args);
+      return {
+        type: "document",
+        id: args.id,
+        // Favorites are a private preference owned by the actor, even when
+        // the underlying document belongs to somebody else.
+        ownerEmail: favoriteOnly
+          ? undefined
+          : (result as DocumentAuditScopedResult | null)?.[documentAuditOwner],
+        visibility: "private",
+      };
+    },
+    summary: (args, result) =>
+      (result as DocumentUpdateConflictResponse | null)?.conflict
+        ? `Document update conflicted for ${args.id}`
+        : `Updated document ${args.id}`,
+  },
   run: async (
     args,
     ctx,
@@ -315,12 +365,7 @@ export default defineAction({
     const isAgentCaller =
       ctx?.caller === "tool" || ctx?.caller === "mcp" || ctx?.caller === "a2a";
 
-    const favoriteOnly =
-      args.isFavorite !== undefined &&
-      args.title === undefined &&
-      args.content === undefined &&
-      args.description === undefined &&
-      args.icon === undefined;
+    const favoriteOnly = isFavoriteOnlyUpdate(args);
     const access = favoriteOnly
       ? await resolveContentDocumentAccess(id)
       : await assertAccess("document", id, "editor");
@@ -411,6 +456,11 @@ export default defineAction({
       args.title !== undefined && args.title !== existing.title;
     const contentChanged =
       content !== undefined && content !== existing.content;
+    const clearsNonEmptyContent =
+      contentChanged &&
+      content !== undefined &&
+      isEffectivelyEmptyDocumentContent(content) &&
+      !isEffectivelyEmptyDocumentContent(existing.content);
     const iconChanged = args.icon !== undefined && args.icon !== existing.icon;
     const favoriteChanged =
       args.isFavorite !== undefined && args.isFavorite !== currentFavorite;
@@ -426,40 +476,6 @@ export default defineAction({
       favoriteChanged ||
       descriptionChanged;
 
-    // Snapshot the current state before applying content/title changes.
-    // Versions are scoped to the document owner, not the caller — an editor
-    // share collaborator shouldn't create a phantom version row under their
-    // own email.
-    if (titleChanged || contentChanged) {
-      const [latestVersion] = await db
-        .select({ createdAt: schema.documentVersions.createdAt })
-        .from(schema.documentVersions)
-        .where(
-          and(
-            eq(schema.documentVersions.documentId, id),
-            eq(schema.documentVersions.ownerEmail, ownerEmail),
-          ),
-        )
-        .orderBy(desc(schema.documentVersions.createdAt))
-        .limit(1);
-
-      const shouldSnapshot =
-        !latestVersion ||
-        Date.now() - new Date(latestVersion.createdAt).getTime() >
-          SNAPSHOT_INTERVAL_MS;
-
-      if (shouldSnapshot) {
-        await db.insert(schema.documentVersions).values({
-          id: nanoid(),
-          ownerEmail,
-          documentId: id,
-          title: existing.title,
-          content: existing.content,
-          createdAt: new Date().toISOString(),
-        });
-      }
-    }
-
     let softDeletedDatabaseIds: string[] = [];
     let creativeContext:
       | Awaited<ReturnType<typeof documentMutationCreativeContext>>
@@ -507,6 +523,36 @@ export default defineAction({
             .where(eq(schema.documents.id, id));
         }
 
+        if (titleChanged || contentChanged) {
+          const [latestVersion] = await tx
+            .select({ createdAt: schema.documentVersions.createdAt })
+            .from(schema.documentVersions)
+            .where(
+              and(
+                eq(schema.documentVersions.documentId, id),
+                eq(schema.documentVersions.ownerEmail, ownerEmail),
+              ),
+            )
+            .orderBy(desc(schema.documentVersions.createdAt))
+            .limit(1);
+          const shouldSnapshot =
+            clearsNonEmptyContent ||
+            !latestVersion ||
+            Date.now() - new Date(latestVersion.createdAt).getTime() >
+              SNAPSHOT_INTERVAL_MS;
+
+          if (shouldSnapshot) {
+            await tx.insert(schema.documentVersions).values({
+              id: nanoid(),
+              ownerEmail,
+              documentId: id,
+              title: existing.title,
+              content: existing.content,
+              createdAt: new Date().toISOString(),
+            });
+          }
+        }
+
         if (favoriteChanged) {
           await setFavoriteMembership({
             db: tx,
@@ -580,30 +626,35 @@ export default defineAction({
           .select()
           .from(schema.documents)
           .where(eq(schema.documents.id, id));
-        return {
-          conflict: true,
-          id,
-          document: {
-            id: current.id,
-            urlPath: `/page/${current.id}`,
-            parentId: current.parentId,
-            title: current.title,
-            content: current.content,
-            description: current.description,
-            icon: current.icon,
-            position: current.position,
-            isFavorite: currentFavorite,
-            hideFromSearch: parseDocumentHideFromSearch(current.hideFromSearch),
-            visibility: current.visibility,
-            accessRole: access.role,
-            canEdit: canEditRole(access.role),
-            canManage: canManageRole(access.role),
-            createdAt: current.createdAt,
-            updatedAt: current.updatedAt,
-            source: serializeDocumentSource(current),
-            softDeletedDatabaseIds: [],
-          },
-        };
+        return scopeDocumentAudit(
+          {
+            conflict: true,
+            id,
+            document: {
+              id: current.id,
+              urlPath: `/page/${current.id}`,
+              parentId: current.parentId,
+              title: current.title,
+              content: current.content,
+              description: current.description,
+              icon: current.icon,
+              position: current.position,
+              isFavorite: currentFavorite,
+              hideFromSearch: parseDocumentHideFromSearch(
+                current.hideFromSearch,
+              ),
+              visibility: current.visibility,
+              accessRole: access.role,
+              canEdit: canEditRole(access.role),
+              canManage: canManageRole(access.role),
+              createdAt: current.createdAt,
+              updatedAt: current.updatedAt,
+              source: serializeDocumentSource(current),
+              softDeletedDatabaseIds: [],
+            },
+          } satisfies DocumentUpdateConflictResponse,
+          ownerEmail,
+        );
       }
 
       if (contentChanged) {
@@ -665,32 +716,35 @@ export default defineAction({
 
     await writeAppState("refresh-signal", { ts: Date.now() });
 
-    return {
-      id: doc.id,
-      urlPath: `/page/${doc.id}`,
-      parentId: doc.parentId,
-      title: doc.title,
-      content: doc.content,
-      description: doc.description,
-      icon: doc.icon,
-      position: doc.position,
-      isFavorite: finalFavorite,
-      hideFromSearch: parseDocumentHideFromSearch(doc.hideFromSearch),
-      visibility: doc.visibility,
-      accessRole: access.role,
-      canEdit: canEditRole(access.role),
-      canManage: canManageRole(access.role),
-      createdAt: doc.createdAt,
-      updatedAt: doc.updatedAt,
-      source: serializeDocumentSource(doc),
-      softDeletedDatabaseIds,
-      ...(creativeContext
-        ? {
-            contextMode: creativeContext.contextMode,
-            contextPackId: creativeContext.contextPackId,
-            reuseLabels: creativeContext.reuseLabels,
-          }
-        : {}),
-    };
+    return scopeDocumentAudit(
+      {
+        id: doc.id,
+        urlPath: `/page/${doc.id}`,
+        parentId: doc.parentId,
+        title: doc.title,
+        content: doc.content,
+        description: doc.description,
+        icon: doc.icon,
+        position: doc.position,
+        isFavorite: finalFavorite,
+        hideFromSearch: parseDocumentHideFromSearch(doc.hideFromSearch),
+        visibility: doc.visibility,
+        accessRole: access.role,
+        canEdit: canEditRole(access.role),
+        canManage: canManageRole(access.role),
+        createdAt: doc.createdAt,
+        updatedAt: doc.updatedAt,
+        source: serializeDocumentSource(doc),
+        softDeletedDatabaseIds,
+        ...(creativeContext
+          ? {
+              contextMode: creativeContext.contextMode,
+              contextPackId: creativeContext.contextPackId,
+              reuseLabels: creativeContext.reuseLabels,
+            }
+          : {}),
+      } satisfies DocumentUpdateResponse,
+      ownerEmail,
+    );
   },
 });

package/corpus/templates/content/app/components/editor/CommentComposer.tsx

@@ -28,6 +28,7 @@ interface CommentComposerProps {
   members: MentionMember[];
   placeholder?: string;
   autoFocus?: boolean;
+  disabled?: boolean;
   rows?: number;
   className?: string;
 }
@@ -52,6 +53,7 @@ export const CommentComposer = forwardRef<
     members,
     placeholder,
     autoFocus,
+    disabled = false,
     rows = 2,
     className,
   },
@@ -158,6 +160,7 @@ export const CommentComposer = forwardRef<
       <textarea
         ref={setRefs}
         value={value}
+        disabled={disabled}
         rows={rows}
         onChange={(e) => {
           onChange(e.target.value);
@@ -177,7 +180,7 @@ export const CommentComposer = forwardRef<
           "w-full resize-none bg-transparent text-sm placeholder:text-muted-foreground focus:outline-none"
         }
       />
-      {menuOpen && (
+      {!disabled && menuOpen && (
         <div className="absolute left-0 right-0 top-full z-20 mt-1 overflow-hidden rounded-md border border-border bg-popover py-1 shadow-md">
           {filtered.map((member, i) => (
             <button