@agent-native/core 0.136.0 → 0.136.3

package/corpus/templates/analytics/server/lib/error-capture.ts

@@ -20,6 +20,7 @@ import { fileURLToPath } from "node:url";
  */
 import { notifyWithDelivery } from "@agent-native/core/notifications";
 import { recordChange } from "@agent-native/core/server";
+import { getUserSetting } from "@agent-native/core/settings";
 import { accessFilter } from "@agent-native/core/sharing";
 import {
   and,
@@ -33,6 +34,7 @@ import {
   sql,
 } from "drizzle-orm";
 
+import { ANALYTICS_USER_PREFS_KEY } from "../../shared/analytics-user-prefs";
 import { getDb, schema } from "../db/index.js";
 
 export type ExceptionLevel = "fatal" | "error" | "warning" | "info" | "debug";
@@ -952,11 +954,14 @@ export async function ingestException(
   });
 
   if (isNewIssue) {
-    await notifyNewIssue(scope, { issueId, title, level: raw.level }).catch(
-      () => {
-        // New-issue alerts are best-effort; never fail ingest on delivery.
-      },
-    );
+    const emailEnabled = await errorEmailNotificationsEnabled(scope);
+    await notifyNewIssue(
+      scope,
+      { issueId, title, level: raw.level },
+      emailEnabled,
+    ).catch(() => {
+      // New-issue alerts are best-effort; never fail ingest on delivery.
+    });
   }
 
   return { issueId, eventId, isNewIssue, sessionRecordingId };
@@ -990,22 +995,25 @@ export async function ingestAnalyticsExceptionEvents(
 async function notifyNewIssue(
   scope: IngestScope,
   issue: { issueId: string; title: string; level: ExceptionLevel },
+  emailEnabled: boolean,
 ): Promise<void> {
   await notifyWithDelivery(
     {
       severity: issue.level === "fatal" ? "critical" : "warning",
       title: `New error: ${issue.title}`,
       body: "A new JavaScript error was captured in your app.",
-      channels: ["inbox", "email"],
+      channels: emailEnabled ? ["inbox", "email"] : ["inbox"],
       metadata: {
         kind: "error_issue",
         issueId: issue.issueId,
         level: issue.level,
         path: `/monitoring?view=errors&issue=${issue.issueId}`,
-        // The email channel is a no-op without explicit recipients, so a
-        // captured issue would otherwise never leave the in-app inbox.
-        emailRecipients: [scope.ownerEmail],
-        emailSubject: `New error in your app: ${issue.title}`,
+        ...(emailEnabled
+          ? {
+              emailRecipients: [scope.ownerEmail],
+              emailSubject: `New error in your app: ${issue.title}`,
+            }
+          : {}),
       },
     },
     // The notification inbox is owner-scoped; the issue's owner is the analytics
@@ -1015,6 +1023,26 @@ async function notifyNewIssue(
   );
 }
 
+async function errorEmailNotificationsEnabled(
+  scope: IngestScope,
+): Promise<boolean> {
+  try {
+    const prefs = await getUserSetting(
+      scope.ownerEmail,
+      ANALYTICS_USER_PREFS_KEY,
+    );
+    return prefs?.errorEmailNotifications === true;
+  } catch (error) {
+    // Error email delivery must fail closed when the owner preference cannot be
+    // read; the in-app issue notification still remains available.
+    console.warn(
+      "[error-capture] Could not read error email preference; skipping email delivery:",
+      error,
+    );
+    return false;
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Reads + triage
 // ---------------------------------------------------------------------------

package/corpus/templates/analytics/server/lib/gong.ts

@@ -14,6 +14,8 @@ import {
 import { resolveAnalyticsGongCredentials } from "./provider-credentials";
 
 const DEFAULT_API_BASE = "https://api.gong.io/v2";
+const MAX_GONG_SEARCH_PAGES = 50;
+const MAX_GONG_EXHAUSTIVE_RECORDS = 500;
 
 const cache = new Map<string, { data: unknown; ts: number }>();
 const CACHE_TTL_MS = 10 * 60 * 1000;
@@ -541,6 +543,7 @@ export async function searchCallsForQueries(
   const matches = new Map<string, GongCall & { matchedQueries?: string[] }>();
   let searchedCallCount = 0;
   let cursor: string | undefined;
+  let pages = 0;
   do {
     const data = await apiPost<{
       calls?: unknown[];
@@ -553,12 +556,23 @@ export async function searchCallsForQueries(
       contentSelector: { exposedFields: { parties: true } },
       ...(cursor ? { cursor } : {}),
     });
+    pages += 1;
+    if (
+      options.exhaustive &&
+      typeof data.records?.totalRecords === "number" &&
+      data.records.totalRecords > MAX_GONG_EXHAUSTIVE_RECORDS
+    ) {
+      throw new Error(
+        `Gong exhaustive search found ${data.records.totalRecords.toLocaleString()} records in the requested window. ` +
+          "Use provider-corpus-job with staged call IDs for searches larger than 500 records so progress is checkpointed between batches.",
+      );
+    }
     const calls = (data.calls ?? [])
       .map(normalizeExtensiveCall)
       .filter((call): call is GongCall => Boolean(call))
       .filter(isExternalCall);
     searchedCallCount += calls.length;
-    cursor = data.records?.cursor;
+    const nextCursor = data.records?.cursor;
 
     for (const call of calls) {
       const parties = call.parties ?? [];
@@ -573,7 +587,16 @@ export async function searchCallsForQueries(
       }
       if (!options.exhaustive && matches.size >= normalizedLimit) break;
     }
-  } while (cursor && (options.exhaustive || matches.size < normalizedLimit));
+    if (!nextCursor || nextCursor === cursor) {
+      cursor = nextCursor;
+      break;
+    }
+    cursor = nextCursor;
+  } while (
+    cursor &&
+    pages < MAX_GONG_SEARCH_PAGES &&
+    (options.exhaustive || matches.size < normalizedLimit)
+  );
 
   const matchedCalls = Array.from(matches.values());
   return buildGongSearchResult(matchedCalls, normalizedLimit, {
@@ -611,11 +634,11 @@ export function buildGongSearchResult(
     return {
       calls: sorted,
       limit: sorted.length,
-      truncated: false,
+      truncated: Boolean(meta.cursor),
       searchedCallCount: meta.searchedCallCount,
       matchedCallCount: matchedCalls.length,
       queryCount: meta.queryCount,
-      coverageTruncated: false,
+      coverageTruncated: Boolean(meta.cursor),
     };
   }
   const limited = limitGongCalls(matchedCalls, normalizedLimit);

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -43,6 +43,45 @@ const ANALYTICS_DATA_SOURCES_LINK = buildDeepLink({
   to: "/data-sources",
 });
 
+const DASHBOARD_BUILD_PAUSE_PATTERN =
+  /\b(?:want me to|would you like me to|shall i|should i|can i|may i|do you want me to)\b[\s\S]{0,160}\b(?:proceed|continue|seed|populate|save|embed|finish|run|apply|create|build)\b/i;
+
+function hasSuccessfulDashboardSave(
+  toolResults: AgentLoopFinalResponseGuardContext["toolResults"],
+): boolean {
+  const saveActions = new Set([
+    "update-dashboard",
+    "mutate-dashboard",
+    "compose-dashboard",
+    "install-dashboard-template",
+  ]);
+  return (toolResults ?? []).some((result) => {
+    if (result.isError) return false;
+    const name = String(result.name ?? "")
+      .trim()
+      .toLowerCase()
+      .replace(/[\s_]+/g, "-");
+    return saveActions.has(name);
+  });
+}
+
+function hasPartialDashboardBuild(
+  toolResults: AgentLoopFinalResponseGuardContext["toolResults"],
+): boolean {
+  const partialBuildActions = new Set([
+    "create-extension",
+    "extension-data-set",
+  ]);
+  return (toolResults ?? []).some((result) => {
+    if (result.isError) return false;
+    const name = String(result.name ?? "")
+      .trim()
+      .toLowerCase()
+      .replace(/[\s_]+/g, "-");
+    return partialBuildActions.has(name);
+  });
+}
+
 export const BOUNDED_STRUCTURED_LOOKUP_GUIDANCE =
   "BOUNDED STRUCTURED LOOKUP FAST PATH — Treat existing analytics work like an engineer treats existing code: grep before writing. For an ordinary count, aggregate, grouped metric, trend, or record lookup, first call `search-analytics-query-catalog` once with focused metric/entity terms. It searches accessible dashboard names, chart titles/descriptions/saved queries, shipped dashboard patterns, and data-dictionary definitions together. Prefer the strongest approved dictionary or saved-chart match, preserve its source and business logic, adapt only the requested filters and explicit time window, then run one bounded query against that source. A user-named source wins, but still use a matching saved definition when it supplies the source's proven query shape. If there is no useful match, inspect only the most likely source schema or ask one clarification; do not fan out across providers. Do not separately list every dashboard, call data-source status, browse the whole dictionary, load provider catalogs/corpus tools, or query a second source after a strong match. Once the query succeeds, answer immediately with its source, time window, filters, row count, and only necessary caveats. Do not enrich, cross-check, retry, or add breakdowns unless the user requested them, the first query failed, or its result conflicts with the known definition. The words `all`, `total`, or `exact` in a structured aggregate do not by themselves make it a corpus investigation. Never repeat an identical invalid or failed tool call; correct its arguments once or surface the error. This does not waive the real-data requirement: never answer from a guess, stale value, or unverified result. ";
 
@@ -541,7 +580,12 @@ export function realDataFinalGuard(
     context as AgentLoopFinalResponseGuardContext & { requestText?: string }
   ).requestText;
   const userText = stableRequestText ?? latestUserText(context.messages ?? []);
-  if (!looksLikeAnalyticsDataRequest(userText)) {
+  const dashboardConstructionRequest =
+    looksLikeDashboardConstructionRequest(userText);
+  if (
+    !looksLikeAnalyticsDataRequest(userText) &&
+    !dashboardConstructionRequest
+  ) {
     // Deterministic backstop: the soft NON_ANALYTICS_REQUEST_GUIDANCE prompt
     // sentence is not always enough, and a model occasionally parrots the
     // canned no-grounded-data fallback even for ordinary conversation. Catch
@@ -612,7 +656,7 @@ export function realDataFinalGuard(
   ) {
     return {
       retryMessage:
-        "The user asked a coverage-sensitive provider question, but the draft only used bounded convenience data actions. Do not finalize an exhaustive, all-records, or absence-sensitive answer from shortcut actions alone. Use the broad provider API/MCP surface and a corpus workflow now: provider-api-catalog/provider-api-docs when needed, provider-corpus-job for durable paginated or batched corpus scans, provider-api-request with fetchAllPages/stageAs/saveToFile for the exact provider endpoint/filter/body/pagination, then run-code or query-staged-dataset to join, grep, classify, and aggregate. If full coverage is not possible in this turn, finalize with explicit partial-coverage wording, inspected counts, filters, and remaining gaps.",
+        "The user asked a coverage-sensitive provider question, but the draft only used bounded convenience data actions. Do not finalize an exhaustive, all-records, or absence-sensitive answer from shortcut actions alone. Use the broad provider API/MCP surface and a staged analysis workflow now: provider-api-catalog/provider-api-docs when needed; for Gong, use configured tracker results from /calls/extensive when they cover the term, otherwise use provider-api-request as raw ingestion with stageAs/saveToFile followed by query-staged-dataset or a Data Program; use provider-corpus-job for durable batched raw-transcript scans. Never loop per call from run-code or a delegated agent. For more than 500 Gong records, gong-calls is not the broad-search path. If full coverage is not possible in this turn, finalize with explicit partial-coverage wording, inspected counts, filters, and remaining gaps.",
       fallbackMessage:
         "I can't make a confident coverage-sensitive provider claim from bounded shortcut actions alone. I need a provider API/corpus workflow, or I need to label the answer as partial with exact inspected counts and gaps.",
     };
@@ -626,7 +670,7 @@ export function realDataFinalGuard(
   ) {
     return {
       retryMessage:
-        "The user asked to search source-record body text such as transcripts, messages, tickets, issues, notes, documents, or conversation logs, but the draft's corpus evidence does not show that the requested body records were actually searched. A parent/container metadata scan, title search, summary search, or call/ticket/message list is not enough for an absence-sensitive body-text claim. Retry with the provider's raw body endpoint or native search for the requested record type, using provider-corpus-job batch-search/paginated-search, provider-api-request with staging, or run-code over staged raw records. Then report source path/body field, inspected record count, hit count, and gaps.",
+        "The user asked to search source-record body text such as transcripts, messages, tickets, issues, notes, documents, or conversation logs, but the draft's corpus evidence does not show that the requested body records were actually searched. A parent/container metadata scan, title search, summary search, or call/ticket/message list is not enough for an absence-sensitive body-text claim. Retry with the provider's native search, indexed tracker result, or raw body endpoint for the requested record type, using provider-corpus-job batch-search/paginated-search, provider-api-request with staging, or a Data Program/query over staged raw records. Then report source path/body field, inspected record count, hit count, and gaps.",
       fallbackMessage:
         "I can't make a confident source-record body-text claim because the corpus evidence does not show that the requested raw records were searched.",
     };
@@ -652,6 +696,21 @@ export function realDataFinalGuard(
   // on tool evidence, not user wording, and still block any draft that states
   // invented numbers via draftClaimsAnalyticsMetrics. A saved SQL panel the
   // user runs themselves is not a fabricated metric.
+  if (
+    dashboardConstructionRequest &&
+    hasPartialDashboardBuild(context.toolResults) &&
+    !hasSuccessfulDashboardSave(context.toolResults) &&
+    DASHBOARD_BUILD_PAUSE_PATTERN.test(context.text)
+  ) {
+    return {
+      retryMessage:
+        "The user explicitly requested this dashboard or Custom Block. Continue the non-destructive build in this same turn: seed or refresh extension data when needed, save and embed the dashboard, and navigate to the result. Do not ask whether to proceed. Ask only about an ambiguous metric scope, a destructive change, or an external side effect such as sending email or outreach.",
+      fallbackMessage:
+        "I couldn't finish the requested dashboard build in this turn. Please retry and I'll continue from the saved artifact.",
+      maxRetries: 2,
+      expandToolSurface: true,
+    };
+  }
   if (
     hasDashboardMutationAttempt(context.toolResults) &&
     !draftClaimsAnalyticsMetrics(context.text)
@@ -664,7 +723,7 @@ export function realDataFinalGuard(
   // "no data query ran" fallback so a template-based extension clone is not
   // treated the same as an unanswerable analytics-result question.
   if (
-    looksLikeDashboardConstructionRequest(userText) &&
+    dashboardConstructionRequest &&
     !draftClaimsAnalyticsMetrics(context.text)
   ) {
     if (
@@ -865,6 +924,7 @@ export default createAgentChatPlugin({
     const sourceGuidance =
       analyticsSourceGuidanceOpening() +
       "DASHBOARD CREATION RULE — You may create dashboard artifacts, SQL panels, or other resources only when the user explicitly asks you to (e.g. 'build me a dashboard for...', 'save this analysis', 'add a chart for...'). Treat a requested saved analysis or deep-dive report as a dashboard request. Never create any resource proactively during research, trend analysis, or answering questions. If you think a dashboard would be useful, suggest it and wait for explicit confirmation before creating anything. Never add new items to the sidebar or modify existing dashboards without an explicit user directive. " +
+      "EXECUTION CONTINUITY — An explicit request to build, create, save, or adapt a dashboard or one-off Custom Block authorizes all non-destructive in-app steps required to finish it in the same turn. After querying or scaffolding, continue through extension-data seeding/refresh, dashboard save/embed, and navigation. Do not ask 'want me to proceed?' or stop at an empty shell. Ask one clarification only when metric scope or grain materially changes the result, and pause for destructive changes or external side effects such as sending email or outreach. " +
       "DASHBOARD MUTATION RULE — For dashboard edits, default to `mutate-dashboard` with the typed `dashboard.*` script API so the main payload is a string and avoids native-array serialization traps. It can move panels by id, edit titles/SQL/config, insert, duplicate, remove, and patch dashboard fields in one atomic save. The script API is constrained: no variables/imports/loops/functions, only JSON-compatible arguments on documented dashboard methods. Do not count shifting `/panels/<index>` positions for ordinary dashboard edits unless the user specifically asks for low-level JSON-pointer operations. " +
       'CUSTOM BLOCK RULE — Analytics can embed sandboxed extensions as dashboard-scoped Custom Blocks, but native panels and Data Programs come first. Do not create one for an ordinary "put X in this dashboard" request. Use `config.extensionId` only for an explicitly requested one-off or bespoke visualization that the native dashboard model cannot represent faithfully. For each new block, set `config.customBlock` with `authoredBy: "agent"`, `intent: "one-off"`, `scope: "dashboard"`, and a categorical `nativeGapReason` of `custom-visualization`, `custom-interaction`, `custom-layout`, or `other`; never store prompt or customer text there. The embed is shared with the dashboard, appears in scheduled reports, and receives dashboard/panel/current-filter context. Use `config.extensionSlotId` only when the user explicitly asks for a personal/per-viewer slot. Slot ids use `analytics.dashboard.<dashboard-id>.panel.<panel-id>` and require `add-extension-slot-target` plus `install-extension`; installs are per-user, so viewers can see different content and report identities may see an empty slot. Use `get-sql-dashboard` panel summaries to inspect an existing Custom Block. ' +
       'EXTENSION DATA-REPAIR RULE — When fixing data in an existing extension-backed dashboard or migrated surface such as Risk Meeting, inspect the current dashboard and extension first, then call `update-extension` with exactly `id`, `operation="edit"`, and a `payloadJson` string containing focused patches/edits that change only the data-loading seam. Never send empty placeholder fields. Preserve the existing layout, CSS, copy, and interactions; never reconstruct the full HTML body for a data-only fix. A request that combines a visual rewrite such as compacting, removing sections, renaming, or changing padding with a data repair is a broad rewrite; after inspecting the current extension, use `operation="replace"` with the complete replacement in `payloadJson`. If a focused edit fails, change the target instead of retrying identical arguments. ' +

package/corpus/templates/analytics/shared/analytics-user-prefs.ts

@@ -0,0 +1,7 @@
+/** Per-user Analytics preferences shared by Settings and notification senders. */
+export const ANALYTICS_USER_PREFS_KEY = "analytics-user-prefs";
+
+export type AnalyticsUserPrefs = {
+  /** New JavaScript error emails are opt-in. */
+  errorEmailNotifications?: boolean;
+};

package/corpus/templates/clips/.agents/skills/video-sharing/SKILL.md

@@ -289,9 +289,15 @@ clip never hits them), so a request on one is the signal.
 
 - **Table:** `recording_agent_views` — one row per `(recordingId, agentKey, viewSessionId)`.
   `agentKey` is a sha256 of user-agent + request IP, so an agent is countable
-  across polls without ever storing its IP. `agentLabel` is the product name
-  parsed from the user-agent (Claude, ChatGPT, Perplexity, …), falling back to
-  `"Agent"` — never the raw user-agent string.
+  across polls without ever storing its IP. `agentLabel` resolves in that order:
+  the label the agent link was minted with (a signed `agentLabel` claim on the
+  `agent_access` token, set via `create-recording-agent-link --agentLabel`), then
+  the product name parsed from the user-agent (Claude, ChatGPT, Perplexity, …),
+  then NULL. NULL means unnamed, not a name — render it as "Unknown agent" and
+  never write a placeholder string, or an agent we could not identify becomes
+  indistinguishable from one that identified itself. `userAgent` keeps the raw
+  (truncated) string so unnamed agents stay identifiable and new `AGENT_LABELS`
+  patterns come from real traffic.
 - **Where it's written:** `recordAgentView` in `server/lib/agent-views.ts`,
   called from `loadPublicAgentAccess` — the one choke point all three agent
   routes share. Owner requests are skipped (they're previews, not views), and the
@@ -300,9 +306,12 @@ clip never hits them), so a request on one is the signal.
   into a single view via a 30-minute window (`AGENT_VIEW_SESSION_MS`), with
   `requestCount` recording how many polls that view covered.
 - **Reads:** `countRecordingAgentViews` and `listRecordingAgentViewers`. Surfaced
-  as `agentViews` / `agentViewers` on `get-recording-insights` and
-  `agentViewCount` on `get-recording-player-data`, and rendered in the views pill
-  popover (`RecordingViewsBadge`) next to human views.
+  as `agentViews` / `agentViewers` on `get-recording-insights`, `agentViewCount`
+  on `get-recording-player-data`, `list-recordings`, and the public
+  `/api/public-recording` payload. The count renders inline — on the views pill
+  itself (`RecordingViewsBadge`, watch and share headers) and on library cards —
+  so agent reads are visible without opening the popover. It is always a
+  separate icon-prefixed number, never summed into the human view total.
 
 Keeping this in its own table is deliberate: no human-view query can pick agents
 up by forgetting a filter. Do not add agent rows to `recording_viewers` or

package/corpus/templates/clips/actions/apply-rewind-extension.ts

@@ -13,6 +13,7 @@ import {
   getCurrentOwnerEmail,
   ownerEmailMatches,
 } from "../server/lib/recordings.js";
+import { isS3ObjectUrlBoundToRecording } from "../server/lib/s3-upload-provider.js";
 import { parseTranscriptSegments } from "../shared/transcript-segments.js";
 import { assertNoDirectRecordingShares } from "./make-recording-private-for-rewind.js";
 import {
@@ -112,6 +113,13 @@ export default defineAction({
     if (Math.abs(args.durationMs - expectedDuration) > 2_000) {
       throw new Error("The combined Clip duration does not match its sources.");
     }
+    const rewindMediaIsBound = await isS3ObjectUrlBoundToRecording(
+      args.videoUrl,
+      args.recordingId,
+    );
+    if (rewindMediaIsBound === false) {
+      throw new Error("The Rewind upload is not bound to its recording.");
+    }
 
     const edits = parseEdits(recording.editsJson);
     edits.trims = edits.trims.map((trim) => ({
@@ -125,6 +133,7 @@ export default defineAction({
       endMs: blur.endMs + args.addedMs,
     }));
     edits.rewindOriginalStartMs = args.addedMs;
+    edits.mediaStorageLayout = "external";
 
     const [transcript] = await db
       .select()

package/corpus/templates/clips/actions/cleanup-dictation.ts

@@ -1,5 +1,5 @@
 /**
- * Run the Gemini cleanup pass on a dictation's raw transcript text.
+ * Run the text-model cleanup pass on a dictation's raw transcript text.
  * Persists `cleanedText` on the dictation row.
  */
 
@@ -15,7 +15,7 @@ import { loadAgentsMdContext } from "./lib/agents-md-context.js";
 
 export default defineAction({
   description:
-    "Clean up a dictation's raw text via the Gemini 3.1 Flash-Lite cleanup pass. Stores the result on `dictations.cleanedText`. Editor access required.",
+    "Clean up a dictation's raw text via the low-cost text-model cleanup pass. Stores the result on `dictations.cleanedText`. Editor access required.",
   schema: z.object({
     id: z.string().describe("Dictation id"),
   }),

package/corpus/templates/clips/actions/cleanup-transcript.ts

@@ -1,5 +1,5 @@
 /**
- * Shared Gemini cleanup pass for raw native transcripts.
+ * Shared text-model cleanup pass for raw native transcripts.
  *
  * This action is the ONE narrow exception to the "all AI through agent chat"
  * rule (see CLAUDE.md rule 1 + 2). It is a media-pipeline path — input is a
@@ -13,11 +13,9 @@
  *   - Meetings finalize (task='summary' → summary + bullets + action items)
  *
  * Provider routing:
- *   1. Builder.io Connect credentials → Builder engine with model
- *      `gemini-3-1-flash-lite` (matches existing convention in
- *      `transcribe-voice.ts`).
+ *   1. Builder.io Connect credentials → Builder engine with GPT-5.6 Luna.
  *   2. Fallback: user GEMINI_API_KEY direct to Google's generativelanguage
- *      API.
+ *      API with Gemini Flash-Lite.
  *   3. Otherwise → throw FeatureNotConfiguredError.
  *
  * Usage:
@@ -44,11 +42,10 @@ import {
   noteBuilderCreditsExhausted,
 } from "./lib/builder-credits-state.js";
 
-// Builder gateway maps this to Gemini 3.1 Flash-Lite (see transcribe-voice.ts:52).
-const BUILDER_MODEL = "gemini-3-1-flash-lite";
+const BUILDER_MODEL = "gpt-5-6-luna";
 
-// BYOK direct-Google fallback — keep on a stable public model id; Builder's
-// managed provider handles the 3.1 preview.
+// BYOK direct-Google fallback keeps an explicit public model id; Builder's
+// managed path can use its own model catalog.
 const GEMINI_BYOK_MODEL = "gemini-2.0-flash-lite";
 const GEMINI_BYOK_URL = `https://generativelanguage.googleapis.com/v1beta/models/${GEMINI_BYOK_MODEL}:generateContent`;
 
@@ -71,7 +68,7 @@ const CLIPS_TRANSCRIPT_AGENT_INSTRUCTIONS = [
   "Relevant Clips AGENTS.md rules:",
   "- User-facing language calls a recording a Clip.",
   "- Generated titles should be concise, specific, and human-editable.",
-  "- Native Web Speech/macOS Speech text is the source transcript; Gemini only cleans or titles it.",
+  "- Native Web Speech/macOS Speech text is the source transcript; the text model only cleans or titles it.",
   "- Cleanup preserves the speaker's meaning and voice, fixes recognition errors, and must not invent facts.",
 ].join("\n");
 
@@ -95,7 +92,7 @@ export interface CleanupResult {
 
 export default defineAction({
   description:
-    "Run a Gemini 3.1 Flash-Lite cleanup pass on a raw transcript. task='cleanup' returns a cleaned transcript; task='title' returns a short title; task='summary' returns a markdown summary plus structured bullets and action items. This is a server-side media-pipeline path — it does NOT delegate to the agent chat.",
+    "Run a low-cost text-model cleanup pass on a raw transcript, preferring GPT-5.6 Luna through Builder when available and falling back to Gemini BYOK. task='cleanup' returns a cleaned transcript; task='title' returns a short title; task='summary' returns a markdown summary plus structured bullets and action items. This is a server-side media-pipeline path — it does NOT delegate to the agent chat.",
   schema: z.object({
     transcript: z.string().min(1).describe("Raw transcript text to process"),
     task: z

package/corpus/templates/clips/actions/clear-edits.ts

@@ -16,7 +16,11 @@ import { assertAccess } from "@agent-native/core/sharing";
 import { and, eq, isNull } from "drizzle-orm";
 import { z } from "zod";
 
-import { DEFAULT_EDITS, serializeEdits } from "../app/lib/timestamp-mapping.js";
+import {
+  DEFAULT_EDITS,
+  parseEdits,
+  serializeEdits,
+} from "../app/lib/timestamp-mapping.js";
 import { getDb, schema } from "../server/db/index.js";
 import { assertNativeRecordingMedia } from "./lib/native-media.js";
 
@@ -44,11 +48,20 @@ export default defineAction({
       assertNativeRecordingMedia(existing);
 
       const previousEditsJson = existing.editsJson;
+      const existingEdits = parseEdits(previousEditsJson);
 
       const result = await db
         .update(schema.recordings)
         .set({
-          editsJson: serializeEdits({ ...DEFAULT_EDITS }),
+          editsJson: serializeEdits({
+            ...DEFAULT_EDITS,
+            ...(existingEdits.stitchedFrom
+              ? { stitchedFrom: existingEdits.stitchedFrom }
+              : {}),
+            ...(existingEdits.mediaStorageLayout
+              ? { mediaStorageLayout: existingEdits.mediaStorageLayout }
+              : {}),
+          }),
           updatedAt: new Date().toISOString(),
         })
         .where(

package/corpus/templates/clips/actions/create-recording-agent-link.ts

@@ -36,6 +36,15 @@ export default defineAction({
     "Create a temporary private agent-readable link for one Clips recording. The URL is scoped to that recording and expires after two hours.",
   schema: z.object({
     recordingId: z.string().describe("Recording ID"),
+    agentLabel: z
+      .string()
+      .trim()
+      .min(1)
+      .max(60)
+      .optional()
+      .describe(
+        "Name of the agent that will read this link (e.g. 'Fusion', 'Claude Code'). Recorded against every read the link produces, so the owner sees a name instead of an unidentified agent.",
+      ),
     ttlSeconds: z
       .number()
       .int()
@@ -68,6 +77,7 @@ export default defineAction({
       resourceKind: CLIP_AGENT_ACCESS_TOKEN_PREFIX,
       resourceId: recording.id,
       viewerEmail: getRequestUserEmail() || undefined,
+      agentLabel: args.agentLabel,
       ttlSeconds: args.ttlSeconds ?? CLIPS_AGENT_ACCESS_TTL_SECONDS,
     });
     const origin = appOrigin();

package/corpus/templates/clips/actions/finalize-meeting.ts

@@ -1,5 +1,5 @@
 /**
- * Finalize a meeting — runs the Gemini cleanup pass on its transcript and
+ * Finalize a meeting — runs the text-model cleanup pass on its transcript and
  * persists summary, bullets, and action items.
  *
  * Reads the linked recording's transcript (`recording_transcripts`) and
@@ -24,7 +24,7 @@ import { loadAgentsMdContext } from "./lib/agents-md-context.js";
 
 // A forced claim still needs the same compare-and-set protection as the normal
 // path. It can recover a pending row only after that row has gone stale, which
-// handles crashed processes without stealing an active Gemini run.
+// handles crashed processes without stealing an active text-model run.
 const PENDING_STALE_MS = 2 * 60 * 1000;
 
 function trimContextValue(value: string, maxChars: number): string {
@@ -35,7 +35,7 @@ function trimContextValue(value: string, maxChars: number): string {
 
 export default defineAction({
   description:
-    "Finalize a meeting: run the Gemini 3.1 Flash-Lite cleanup pass on its transcript, persist summary + bullets + action items, and flip transcriptStatus to 'ready'. Editor access required.",
+    "Finalize a meeting: run the low-cost text-model cleanup pass on its transcript, persist summary + bullets + action items, and flip transcriptStatus to 'ready'. Editor access required.",
   schema: z.object({
     meetingId: z.string().describe("Meeting id"),
     overrideTranscript: z
@@ -88,12 +88,12 @@ export default defineAction({
     // Mark pending so the UI shows a spinner during the LLM call. This is
     // also the compare-and-swap that prevents two concurrent finalize calls
     // (e.g. the desktop stop-path and the web route's auto-finalize effect)
-    // from both running Gemini and clobbering meeting_action_items: only a
+    // from both running the text model and clobbering meeting_action_items: only a
     // call that observes 'ready' or 'failed' gets to flip the row to
     // 'pending' and proceed. `force` (the manual "Regenerate notes" flow)
     // additionally allows claiming a 'pending' row only when that claim is
     // stale (see PENDING_STALE_MS). A fresh 'pending' row may still be an
-    // active Gemini run, so it is left alone.
+    // active text-model run, so it is left alone.
     const staleBefore = new Date(Date.now() - PENDING_STALE_MS).toISOString();
     const claimPredicate = args.force
       ? or(
@@ -112,7 +112,7 @@ export default defineAction({
 
     if (!claimed.length) {
       // Another finalize is already in flight (status is 'pending') — no-op
-      // quietly instead of re-running Gemini and re-writing action items.
+      // quietly instead of re-running the text model and re-writing action items.
       const [current] = await db
         .select()
         .from(schema.meetings)

package/corpus/templates/clips/actions/finalize-recording.ts

@@ -30,6 +30,7 @@ import {
   applyFaststart,
   hasPlayableMp4Metadata,
 } from "../server/lib/faststart.js";
+import { allowsLegacyS3ObjectForPersistedMedia } from "../server/lib/media-storage-provenance.js";
 import {
   mediaVerificationStateKey,
   parseMediaVerificationMarker,
@@ -48,6 +49,7 @@ import {
   getResumableSession,
 } from "../server/lib/resumable-session.js";
 import { resolveResumableUploadProvider } from "../server/lib/resumable-upload-provider.js";
+import { fetchS3ObjectByUrl } from "../server/lib/s3-upload-provider.js";
 import { isStreamingUploadDisabled } from "../server/lib/streaming-upload-mode.js";
 import {
   probeHasAudioStream,
@@ -181,7 +183,11 @@ function servedMediaSizeBytes(response: Response): number | null {
   return null;
 }
 
-async function verifyServedMediaUrl(videoUrl: string): Promise<number | null> {
+async function verifyServedMediaUrl(
+  recordingId: string,
+  videoUrl: string,
+  allowLegacyObjectKey = false,
+): Promise<number | null> {
   if (!shouldVerifyServedMediaUrl(videoUrl)) return null;
 
   let lastFailure = "media URL did not serve readable bytes";
@@ -196,11 +202,21 @@ async function verifyServedMediaUrl(videoUrl: string): Promise<number | null> {
       MEDIA_SERVE_VERIFICATION_TIMEOUT_MS,
     );
     try {
-      const response = await fetch(videoUrl, {
-        method: "GET",
-        headers: { Range: "bytes=0-1023" },
-        signal: controller.signal,
+      const signedS3Response = await fetchS3ObjectByUrl(videoUrl, {
+        range: "bytes=0-1023",
+        timeoutMs: MEDIA_SERVE_VERIFICATION_TIMEOUT_MS,
+        recordingId,
+        ...(allowLegacyObjectKey ? { allowLegacyObjectKey } : {}),
       });
+      let response = signedS3Response;
+      if (response?.status !== 200 && response?.status !== 206) {
+        await response?.body?.cancel().catch(() => undefined);
+        response = await fetch(videoUrl, {
+          method: "GET",
+          headers: { Range: "bytes=0-1023" },
+          signal: controller.signal,
+        });
+      }
       const statusOk = response.status === 200 || response.status === 206;
       if (statusOk) {
         const servedBytes = servedMediaSizeBytes(response);
@@ -727,6 +743,7 @@ async function retryPendingMediaVerification(params: {
     .select({
       status: schema.recordings.status,
       videoUrl: schema.recordings.videoUrl,
+      editsJson: schema.recordings.editsJson,
     })
     .from(schema.recordings)
     .where(
@@ -754,7 +771,15 @@ async function retryPendingMediaVerification(params: {
     videoUrl: recording.videoUrl || media.videoUrl,
   };
   try {
-    const servedBytes = await verifyServedMediaUrl(candidate.videoUrl);
+    const servedBytes = await verifyServedMediaUrl(
+      id,
+      candidate.videoUrl,
+      allowsLegacyS3ObjectForPersistedMedia({
+        requestedUrl: candidate.videoUrl,
+        persistedUrl: recording.videoUrl,
+        editsJson: recording.editsJson,
+      }),
+    );
     const result = await markRecordingReady({
       id,
       ownerEmail,
@@ -1155,7 +1180,7 @@ export default defineAction({
           debugLog("[finalize] resumable upload completed", { id, videoUrl });
           let servedBytes: number | null;
           try {
-            servedBytes = await verifyServedMediaUrl(videoUrl);
+            servedBytes = await verifyServedMediaUrl(id, videoUrl, true);
           } catch (err) {
             const failureReason =
               err instanceof Error ? err.message : String(err);
@@ -1703,7 +1728,7 @@ export default defineAction({
       });
       let servedBytes: number | null;
       try {
-        servedBytes = await verifyServedMediaUrl(upload.url);
+        servedBytes = await verifyServedMediaUrl(id, upload.url, true);
       } catch (err) {
         const failureReason = err instanceof Error ? err.message : String(err);
         return await leaveRecordingProcessingForMediaVerification({