@agent-native/core 0.68.0 → 0.68.2

package/corpus/core/src/server/auth.ts

@@ -72,6 +72,7 @@ import {
 } from "../db/client.js";
 import { getBetterAuth, getBetterAuthSync } from "./better-auth-instance.js";
 import type { BetterAuthConfig } from "./better-auth-instance.js";
+import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import {
   getAllowedCorsOrigin,
   readCorsAllowedOrigins,
@@ -2462,11 +2463,8 @@ async function mountBetterAuthRoutes(
   // Auto-add Google OAuth routes when credentials are configured. Templates
   // that need broader product scopes (mail/calendar) opt out and provide
   // their own Nitro routes at these paths.
-  if (
-    process.env.GOOGLE_CLIENT_ID &&
-    process.env.GOOGLE_CLIENT_SECRET &&
-    options.mountGoogleOAuthRoutes !== false
-  ) {
+  const googleSignInCredentials = resolveGoogleSignInCredentials();
+  if (googleSignInCredentials && options.mountGoogleOAuthRoutes !== false) {
     setGenericGoogleOAuthRoutesEnabled(app, true);
     for (const gp of [
       "/_agent-native/google/callback",
@@ -2535,7 +2533,7 @@ async function mountBetterAuthRoutes(
             process.env.VITE_AGENT_NATIVE_WORKSPACE === "1",
         });
         const params = new URLSearchParams({
-          client_id: process.env.GOOGLE_CLIENT_ID!,
+          client_id: googleSignInCredentials.clientId,
           redirect_uri: redirectUri,
           response_type: "code",
           scope: googleScopes,
@@ -2647,8 +2645,8 @@ async function mountBetterAuthRoutes(
             },
             body: new URLSearchParams({
               code,
-              client_id: process.env.GOOGLE_CLIENT_ID!,
-              client_secret: process.env.GOOGLE_CLIENT_SECRET!,
+              client_id: googleSignInCredentials.clientId,
+              client_secret: googleSignInCredentials.clientSecret,
               redirect_uri: redirectUri,
               grant_type: "authorization_code",
             }),

package/corpus/core/src/server/better-auth-instance.ts

@@ -26,6 +26,7 @@ import { flushTracking, identify, track } from "../tracking/index.js";
 import { TEMPLATES } from "../cli/templates-meta.js";
 import { resolveAuthCookieNamespace } from "./cookie-namespace.js";
 import { getWorkspaceA2ADerivedSecret } from "./derived-secret.js";
+import { resolveGoogleSignInCredentials } from "./google-oauth-credentials.js";
 import {
   getDialect,
   getDatabaseUrl,
@@ -802,7 +803,17 @@ async function createBetterAuthInstance(
     ...config?.socialProviders,
   };
 
-  if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET) {
+  const extraScopes = config?.googleScopes ?? [];
+  const googleCredentials =
+    extraScopes.length > 0
+      ? process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET
+        ? {
+            clientId: process.env.GOOGLE_CLIENT_ID,
+            clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+          }
+        : null
+      : resolveGoogleSignInCredentials();
+  if (googleCredentials) {
     // When the template requests broader scopes (Gmail, Calendar, etc.)
     // ask for them on the primary sign-in flow so a separate "Connect
     // Google" round-trip isn't needed. `accessType: "offline"` plus
@@ -810,12 +821,11 @@ async function createBetterAuthInstance(
     // Google only re-issues a refresh token on consent, so re-signing in
     // (e.g. after switching machines) would otherwise leave us with an
     // access token that can't be refreshed.
-    const extraScopes = config?.googleScopes ?? [];
     const baseScopes = ["openid", "email", "profile"];
     const mergedScopes = Array.from(new Set([...baseScopes, ...extraScopes]));
     socialProviders.google = {
-      clientId: process.env.GOOGLE_CLIENT_ID,
-      clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+      clientId: googleCredentials.clientId,
+      clientSecret: googleCredentials.clientSecret,
       ...(extraScopes.length > 0
         ? {
             scope: mergedScopes,
@@ -843,6 +853,9 @@ async function createBetterAuthInstance(
   const requireEmailVerification =
     isEmailConfigured() && !shouldSkipEmailVerification();
 
+  const shouldMirrorGoogleAccountTokens =
+    (config?.googleScopes?.length ?? 0) > 0;
+
   const auth = betterAuth({
     basePath,
     baseURL: appUrl,
@@ -969,6 +982,7 @@ async function createBetterAuthInstance(
         // mirroring work; failures never block sign-in.
         create: {
           after: async (account: any) => {
+            if (!shouldMirrorGoogleAccountTokens) return;
             await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {
               console.error(
                 "[auth] failed to mirror Google account tokens to oauth_tokens (create)",
@@ -979,6 +993,7 @@ async function createBetterAuthInstance(
         },
         update: {
           after: async (account: any) => {
+            if (!shouldMirrorGoogleAccountTokens) return;
             await mirrorGoogleAccountToOAuthTokens(account).catch((err) => {
               console.error(
                 "[auth] failed to mirror Google account tokens to oauth_tokens (update)",

package/corpus/core/src/server/core-routes-plugin.ts

@@ -158,6 +158,24 @@ import {
 export const FRAMEWORK_ROUTE_PREFIX = "/_agent-native";
 export const FRAMEWORK_EVENTS_ROUTE = `${FRAMEWORK_ROUTE_PREFIX}/events`;
 export const LEGACY_FRAMEWORK_EVENTS_ROUTE = `${FRAMEWORK_ROUTE_PREFIX}/poll-events`;
+const DEFAULT_BUILDER_WAITLIST_FORM_ID = "DYTHuM0jlV";
+const DEFAULT_BUILDER_WAITLIST_FORMS_ORIGIN = "https://forms.agent-native.com";
+const BUILDER_WAITLIST_FORM_SOURCE = "connect_builder_card";
+const BUILDER_WAITLIST_FORM_TIMEOUT_MS = 8000;
+const BUILDER_WAITLIST_TEXT_LIMIT = 4000;
+
+interface BuilderWaitlistFormTarget {
+  formId: string;
+  formsOrigin: string;
+}
+
+interface BuilderWaitlistBody {
+  prompt?: unknown;
+  orgName?: unknown;
+  appUrl?: unknown;
+  pageUrl?: unknown;
+  source?: unknown;
+}
 
 export function resolveFrameworkSseRoutes(sseRoute?: string): string[] {
   return Array.from(
@@ -171,6 +189,112 @@ export function resolveFrameworkSseRoutes(sseRoute?: string): string[] {
 
 registerBuiltinEngines();
 
+function cleanBuilderWaitlistText(
+  value: unknown,
+  maxLength = BUILDER_WAITLIST_TEXT_LIMIT,
+): string | undefined {
+  if (typeof value !== "string") return undefined;
+  const trimmed = value.trim();
+  if (!trimmed) return undefined;
+  return trimmed.slice(0, maxLength);
+}
+
+function normalizeHttpOrigin(value: string): string | null {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    return url.origin;
+  } catch {
+    return null;
+  }
+}
+
+function isAgentNativeHostedRequest(event: H3Event): boolean {
+  const hostname = getRequestURL(event).hostname.toLowerCase();
+  return (
+    hostname === "agent-native.com" || hostname.endsWith(".agent-native.com")
+  );
+}
+
+export function resolveBuilderWaitlistFormTargetForRequest(
+  event: H3Event,
+): BuilderWaitlistFormTarget | null {
+  if (process.env.AGENT_NATIVE_DISABLE_BUILDER_WAITLIST_FORM === "1") {
+    return null;
+  }
+
+  const envFormId = process.env.AGENT_NATIVE_BUILDER_WAITLIST_FORM_ID?.trim();
+  const envFormsOrigin =
+    process.env.AGENT_NATIVE_BUILDER_WAITLIST_FORMS_ORIGIN?.trim();
+  const hasExplicitTarget = Boolean(envFormId || envFormsOrigin);
+  if (!hasExplicitTarget && !isAgentNativeHostedRequest(event)) {
+    return null;
+  }
+
+  const formId = envFormId || DEFAULT_BUILDER_WAITLIST_FORM_ID;
+  const formsOrigin = normalizeHttpOrigin(
+    envFormsOrigin || DEFAULT_BUILDER_WAITLIST_FORMS_ORIGIN,
+  );
+  if (!formsOrigin) {
+    throw new Error("Invalid Builder waitlist Forms origin");
+  }
+
+  return { formId, formsOrigin };
+}
+
+async function submitBuilderWaitlistForm(
+  event: H3Event,
+  sessionEmail: string,
+  body: BuilderWaitlistBody,
+): Promise<{ submitted: boolean; formId?: string }> {
+  const target = resolveBuilderWaitlistFormTargetForRequest(event);
+  if (!target) return { submitted: false };
+
+  const appUrl =
+    cleanBuilderWaitlistText(body.pageUrl ?? body.appUrl, 2000) ??
+    cleanBuilderWaitlistText(getHeader(event, "referer"), 2000) ??
+    getOrigin(event);
+  const source =
+    cleanBuilderWaitlistText(body.source, 100) ?? BUILDER_WAITLIST_FORM_SOURCE;
+
+  const controller = new AbortController();
+  const timeout = setTimeout(
+    () => controller.abort(),
+    BUILDER_WAITLIST_FORM_TIMEOUT_MS,
+  );
+
+  try {
+    const res = await fetch(
+      `${target.formsOrigin}/api/submit/${encodeURIComponent(target.formId)}`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          data: {
+            email: sessionEmail,
+            orgName: cleanBuilderWaitlistText(body.orgName, 500),
+            appUrl,
+            prompt: cleanBuilderWaitlistText(body.prompt),
+            source,
+          },
+          _hp: "",
+          _meta: {
+            submitterEmail: sessionEmail,
+            pageUrl: appUrl,
+          },
+        }),
+        signal: controller.signal,
+      },
+    );
+    if (!res.ok) {
+      throw new Error(`Forms waitlist submission failed (${res.status})`);
+    }
+    return { submitted: true, formId: target.formId };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
 function parseBuilderCallbackBoolean(
   value: string | null | undefined,
 ): boolean | null {
@@ -1405,10 +1529,10 @@ export function createCoreRoutesPlugin(
       );
 
       // Branch-creation waitlist signup. Used by ConnectBuilderCard when the
-      // current request has no Builder branch project configured — instead of
-      // the raw 403 from /builder/run, the card surfaces a waitlist CTA that
-      // POSTs here. Recorded as a tracking event so PostHog/Mixpanel/etc.
-      // capture demand without us standing up new storage.
+      // current request has no Builder branch project configured. Hosted
+      // Agent Native deployments submit into the Builder-org Forms waitlist;
+      // local/self-hosted deployments keep the analytics signal without
+      // sending private workspace data to Agent Native.
       getH3App(nitroApp).use(
         `${P}/builder/branch-waitlist`,
         defineEventHandler(async (event: H3Event) => {
@@ -1421,15 +1545,43 @@ export function createCoreRoutesPlugin(
             setResponseStatus(event, 401);
             return { error: "Authentication required" };
           }
+          const body = ((await readBody(event).catch(() => ({}))) ??
+            {}) as BuilderWaitlistBody;
+          let formSubmission: { submitted: boolean; formId?: string };
+          try {
+            formSubmission = await submitBuilderWaitlistForm(
+              event,
+              session.email,
+              body,
+            );
+          } catch (err) {
+            await trackBuilderLifecycle(
+              event,
+              "builder branch waitlist form failed",
+              session.email,
+              {
+                reason:
+                  err instanceof Error ? err.message : "unknown_waitlist_error",
+                stage: "waitlist",
+              },
+            );
+            setResponseStatus(event, 502);
+            return {
+              error:
+                "Couldn't join the waitlist. Please try again in a moment.",
+            };
+          }
           await trackBuilderLifecycle(
             event,
             "builder branch waitlist joined",
             session.email,
             {
+              formId: formSubmission.formId ?? null,
+              formSubmitted: formSubmission.submitted,
               stage: "waitlist",
             },
           );
-          return { ok: true };
+          return { ok: true, formSubmitted: formSubmission.submitted };
         }),
       );
 

package/corpus/core/src/server/google-oauth-credentials.ts

@@ -0,0 +1,51 @@
+export interface GoogleOAuthCredentials {
+  clientId: string;
+  clientSecret: string;
+}
+
+function readCredentialPair(
+  clientIdKey: string,
+  clientSecretKey: string,
+): GoogleOAuthCredentials | null {
+  const clientId = process.env[clientIdKey];
+  const clientSecret = process.env[clientSecretKey];
+  if (!clientId || !clientSecret) return null;
+  return { clientId, clientSecret };
+}
+
+/**
+ * Credentials for identity-only Google sign-in. Deploys that also use Google
+ * product APIs can set these separately from GOOGLE_CLIENT_ID/SECRET, which
+ * remain the backwards-compatible provider OAuth credentials.
+ */
+export function resolveGoogleSignInCredentials(): GoogleOAuthCredentials | null {
+  return (
+    readCredentialPair(
+      "GOOGLE_SIGN_IN_CLIENT_ID",
+      "GOOGLE_SIGN_IN_CLIENT_SECRET",
+    ) ?? readCredentialPair("GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET")
+  );
+}
+
+export function hasGoogleSignInCredentials(): boolean {
+  return resolveGoogleSignInCredentials() !== null;
+}
+
+export function resolveGoogleProviderCredentials(): GoogleOAuthCredentials | null {
+  return readCredentialPair("GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET");
+}
+
+export function resolveGoogleLegacyProviderCredentials(): GoogleOAuthCredentials | null {
+  return readCredentialPair(
+    "GOOGLE_LEGACY_CLIENT_ID",
+    "GOOGLE_LEGACY_CLIENT_SECRET",
+  );
+}
+
+export function resolveGoogleProviderCredentialCandidates(): GoogleOAuthCredentials[] {
+  const primary = resolveGoogleProviderCredentials();
+  const legacy = resolveGoogleLegacyProviderCredentials();
+  if (!primary) return legacy ? [legacy] : [];
+  if (!legacy || legacy.clientId === primary.clientId) return [primary];
+  return [primary, legacy];
+}

package/corpus/core/src/server/index.ts

@@ -264,6 +264,14 @@ export {
   type SpawnTaskOptions,
 } from "./agent-teams.js";
 export { isOAuthConnected, getOAuthAccounts } from "./oauth-helpers.js";
+export {
+  hasGoogleSignInCredentials,
+  resolveGoogleLegacyProviderCredentials,
+  resolveGoogleProviderCredentialCandidates,
+  resolveGoogleProviderCredentials,
+  resolveGoogleSignInCredentials,
+  type GoogleOAuthCredentials,
+} from "./google-oauth-credentials.js";
 export { wrapWithAnalytics } from "./analytics.js";
 export {
   getH3App,

package/corpus/core/src/server/onboarding-html.ts

@@ -28,9 +28,10 @@ import {
   withAgentNativeSocialImageCacheBuster,
 } from "../shared/social-meta.js";
 import { normalizeAppBasePath } from "./app-base-path.js";
+import { hasGoogleSignInCredentials } from "./google-oauth-credentials.js";
 
 function hasGoogleOAuth(): boolean {
-  return !!(process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET);
+  return hasGoogleSignInCredentials();
 }
 
 function getConnectionLabel(): string {

package/corpus/core/src/templates/workspace-root/.env.example

@@ -36,6 +36,10 @@ BUILDER_PRIVATE_KEY=
 BUILDER_PUBLIC_KEY=
 BUILDER_USER_ID=
 
+# Local ai-services LLM gateway. Leave unset to use the hosted Builder gateway.
+# ai-services listens on API_PORT (default 8080): /agent-native/gateway/v1/messages
+BUILDER_GATEWAY_BASE_URL=
+
 # Builder app creation / branching. In local dev these can live in .env.
 # In production, configure deploy env vars instead; production app creation
 # never writes credentials or project IDs to the filesystem.

package/corpus/templates/analytics/app/routes/$.tsx

@@ -0,0 +1,9 @@
+import NotFound from "@/pages/NotFound";
+
+export function meta() {
+  return [{ title: "Not Found - Analytics" }];
+}
+
+export default function CatchAllRoute() {
+  return <NotFound />;
+}

package/corpus/templates/calendar/app/components/calendar/DayView.tsx

@@ -262,7 +262,17 @@ export function DayView({
                   onDraftDiscard={onDraftDiscard}
                 >
                   <button
-                    className="flex w-full items-center gap-1.5 rounded-md px-3 py-1.5 text-left text-sm font-medium text-foreground transition-all hover:brightness-110"
+                    className={cn(
+                      "relative flex w-full items-center gap-1.5 rounded-md px-3 py-1.5 text-left text-sm font-medium text-foreground transition-all hover:brightness-110",
+                      event.ownerColor && "pr-5",
+                    )}
+                    aria-label={
+                      event.ownerName || event.overlayEmail
+                        ? `${event.title}, ${
+                            event.ownerName || event.overlayEmail
+                          }'s calendar`
+                        : event.title
+                    }
                     style={
                       color
                         ? {
@@ -283,6 +293,13 @@ export function DayView({
                     )}
                     <EventStatusIcon event={event} className="shrink-0" />
                     <span className="truncate">{event.title}</span>
+                    {event.ownerColor && (
+                      <span
+                        aria-hidden="true"
+                        className="absolute right-2 top-1/2 size-1.5 -translate-y-1/2 rounded-full ring-1 ring-background/70"
+                        style={{ backgroundColor: event.ownerColor }}
+                      />
+                    )}
                   </button>
                 </EventDetailPopover>
               );
@@ -458,7 +475,15 @@ export function DayView({
                     isBeingDragged && isDragging && "ring-2 ring-primary/40",
                     canDrag && isStart && "cursor-grab",
                     isBeingDragged && isDragging && "cursor-grabbing",
+                    event.ownerColor && "pr-4",
                   )}
+                  aria-label={
+                    event.ownerName || event.overlayEmail
+                      ? `${event.title}, ${
+                          event.ownerName || event.overlayEmail
+                        }'s calendar`
+                      : event.title
+                  }
                   style={{
                     ...posStyle,
                     left: `${li.left}px`,
@@ -483,6 +508,13 @@ export function DayView({
                     opacity: isBeingDragged && isDragging ? 0.9 : undefined,
                   }}
                 >
+                  {event.ownerColor && (
+                    <span
+                      aria-hidden="true"
+                      className="absolute right-1.5 top-1.5 size-1.5 rounded-full ring-1 ring-background/70"
+                      style={{ backgroundColor: event.ownerColor }}
+                    />
+                  )}
                   {durationMin <= 30 ? (
                     <div className="flex items-baseline gap-1.5 truncate">
                       {allOthersOut && (

package/corpus/templates/calendar/app/components/calendar/EventAttendeesSection.tsx

@@ -16,6 +16,7 @@ import { useAttendeePhotos } from "@/hooks/use-attendee-photos";
 import { useRsvpEvent } from "@/hooks/use-events";
 import { cn } from "@/lib/utils";
 import {
+  canInlineRsvp,
   getRsvpStatusLabel,
   RsvpStatusIcon,
   type RsvpStatus,
@@ -406,6 +407,7 @@ export function EventAttendeesSection({
     | "id"
     | "accountEmail"
     | "attendees"
+    | "overlayEmail"
     | "responseStatus"
     | "source"
     | "recurringEventId"
@@ -423,8 +425,14 @@ export function EventAttendeesSection({
   const { data: photos } = useAttendeePhotos(emails);
 
   const sorted = useMemo(() => sortAttendees(attendees), [attendees]);
-  const selfAttendee = sorted.find((attendee) => attendee.self);
-  const others = sorted.filter((attendee) => !attendee.self);
+  const canRsvpInline = canInlineRsvp(event);
+  const selfAttendee = canRsvpInline
+    ? sorted.find((attendee) => attendee.self)
+    : undefined;
+  const others =
+    canRsvpInline && selfAttendee
+      ? sorted.filter((attendee) => !attendee.self)
+      : sorted;
 
   useEffect(() => {
     setSelfStatus(event.responseStatus || "needsAction");
@@ -505,7 +513,7 @@ export function EventAttendeesSection({
                   attendee={selfAttendee}
                   event={event}
                   photoUrl={photos?.[selfAttendee.email.toLowerCase()]}
-                  inlineRsvp={event.source === "google"}
+                  inlineRsvp={canRsvpInline}
                   currentStatus={selfStatus}
                   currentNote={selfNote}
                   onResponseChange={handleSelfResponseChange}

package/corpus/templates/calendar/app/components/calendar/EventCard.tsx

@@ -30,6 +30,7 @@ export function EventCard({
   colorPreferences,
 }: EventCardProps) {
   const accentColor = getEventDisplayColor(event, colorPreferences);
+  const ownerLabel = event.ownerName || event.overlayEmail;
 
   const handleDragStart = (e: React.DragEvent) => {
     e.dataTransfer.setData("text/plain", event.id);
@@ -47,10 +48,14 @@ export function EventCard({
         onDragStart={canDrag ? handleDragStart : undefined}
         onDragEnd={canDrag ? onDragEnd : undefined}
         className={cn(
-          "flex w-full items-center gap-1.5 rounded px-1.5 py-0.5 text-left text-xs text-foreground transition-all hover:brightness-110",
+          "relative flex w-full items-center gap-1.5 rounded px-1.5 py-0.5 text-left text-xs text-foreground transition-all hover:brightness-110",
           canDrag && "cursor-grab active:cursor-grabbing",
           dimmed && "opacity-40",
+          event.ownerColor && "pr-3.5",
         )}
+        aria-label={
+          ownerLabel ? `${event.title}, ${ownerLabel}'s calendar` : event.title
+        }
         style={{
           backgroundColor: `${accentColor}25`,
         }}
@@ -68,6 +73,13 @@ export function EventCard({
         )}
         <EventStatusIcon event={event} />
         <span className="truncate font-medium">{event.title}</span>
+        {event.ownerColor && (
+          <span
+            aria-hidden="true"
+            className="absolute right-1 top-1/2 size-1.5 -translate-y-1/2 rounded-full ring-1 ring-background/70"
+            style={{ backgroundColor: event.ownerColor }}
+          />
+        )}
       </button>
     );
   }
@@ -79,10 +91,14 @@ export function EventCard({
       onDragStart={canDrag ? handleDragStart : undefined}
       onDragEnd={canDrag ? onDragEnd : undefined}
       className={cn(
-        "flex w-full flex-col gap-0.5 rounded-md px-2 py-1.5 text-left text-xs text-foreground transition-all hover:brightness-110",
+        "relative flex w-full flex-col gap-0.5 rounded-md px-2 py-1.5 text-left text-xs text-foreground transition-all hover:brightness-110",
         canDrag && "cursor-grab active:cursor-grabbing",
         dimmed && "opacity-40",
+        event.ownerColor && "pr-4",
       )}
+      aria-label={
+        ownerLabel ? `${event.title}, ${ownerLabel}'s calendar` : event.title
+      }
       style={{
         backgroundColor: `${accentColor}25`,
         borderLeft: `2px solid ${accentColor}`,
@@ -106,6 +122,13 @@ export function EventCard({
           })}
         </span>
       )}
+      {event.ownerColor && (
+        <span
+          aria-hidden="true"
+          className="absolute right-1.5 top-1.5 size-1.5 rounded-full ring-1 ring-background/70"
+          style={{ backgroundColor: event.ownerColor }}
+        />
+      )}
     </button>
   );
 }

package/corpus/templates/calendar/app/components/calendar/EventDetailPanel.tsx

@@ -101,6 +101,7 @@ export function EventDetailPanel({
   const isOverlay = !!event?.overlayEmail;
   const lastSavedDescriptionRef = useRef(event?.description || "");
   const meetingLink = event ? extractMeetingLink(event) : null;
+  const ownerLabel = event?.ownerName || event?.overlayEmail;
 
   // Reset editing state when event changes
   useEffect(() => {
@@ -310,6 +311,17 @@ export function EventDetailPanel({
                   </div>
                 )}
 
+                {event.overlayEmail && ownerLabel && (
+                  <div className="flex items-center gap-2.5 text-sm text-muted-foreground">
+                    <span
+                      aria-hidden="true"
+                      className="ml-0.5 size-2 shrink-0 rounded-full ring-1 ring-border"
+                      style={{ backgroundColor: event.ownerColor }}
+                    />
+                    <span>Viewing {ownerLabel}'s calendar</span>
+                  </div>
+                )}
+
                 {meetingLink ? (
                   <a
                     href={safeUrl(meetingLink)}

package/corpus/templates/calendar/app/components/calendar/EventDetailPopover.tsx

@@ -395,6 +395,7 @@ export function EventDetailPopover({
     "meet" | "zoom" | null
   >(null);
   const isOverlay = !!event.overlayEmail;
+  const ownerLabel = event.ownerName || event.overlayEmail;
 
   const updateEvent = useUpdateEvent();
   const masterEventId =
@@ -2086,9 +2087,13 @@ Write a short, useful meeting description. If I ask you to apply it, update this
               <>
                 <div className="mx-4 my-2 border-t border-border/50" />
                 <div className="flex items-center gap-3 px-4 py-1.5">
-                  <IconUser className="h-4 w-4 shrink-0 text-muted-foreground" />
+                  <span
+                    aria-hidden="true"
+                    className="ml-1 size-2 shrink-0 rounded-full ring-1 ring-border"
+                    style={{ backgroundColor: event.ownerColor }}
+                  />
                   <span className="text-sm text-muted-foreground">
-                    {event.overlayEmail}
+                    Viewing {ownerLabel}'s calendar
                   </span>
                 </div>
               </>