@agent-native/core 0.68.1 → 0.68.3

package/docs/content/authentication.md

@@ -104,6 +104,11 @@ Set environment variables to enable social login. Better Auth auto-detects them:
 
 ```bash
 # Google OAuth
+GOOGLE_SIGN_IN_CLIENT_ID=your-low-scope-sign-in-client-id
+GOOGLE_SIGN_IN_CLIENT_SECRET=your-low-scope-sign-in-client-secret
+
+# Backwards-compatible fallback, and provider OAuth credentials for templates
+# that connect to Google APIs such as Gmail or Calendar.
 GOOGLE_CLIENT_ID=your-client-id
 GOOGLE_CLIENT_SECRET=your-client-secret
 
@@ -114,6 +119,13 @@ GITHUB_CLIENT_SECRET=your-client-secret
 
 Templates that use `createGoogleAuthPlugin()` show a "Sign in with Google" page. The Google OAuth callback handles mobile deep linking for native apps automatically.
 
+Prefer `GOOGLE_SIGN_IN_CLIENT_ID` / `GOOGLE_SIGN_IN_CLIENT_SECRET` for normal
+app login. That client should request only identity scopes. Keep
+`GOOGLE_CLIENT_ID` / `GOOGLE_CLIENT_SECRET` for product integrations that need
+Google API scopes, or as the legacy fallback when a deploy has not been split
+yet. Mail and Calendar-style apps should use their own provider OAuth clients so
+high-scope consent screens do not affect generic app sign-in.
+
 ### OAuth State Signing {#oauth-state-secret}
 
 Set `OAUTH_STATE_SECRET` to a random 32+ char value in production so OAuth state envelopes (Google, Atlassian, Zoom) are HMAC-signed with a dedicated key independent of any third-party secret. See [Security — OAuth State Signing](/docs/security#oauth-state) for the full requirements and threat model.
@@ -309,8 +321,10 @@ The default `/_agent-native/google/auth-url` route does this automatically — o
 | `AGENT_NATIVE_WORKSPACE`                | `1` runs in workspace mode — one shared session realm across workspace apps                                                                  |
 | `AGENT_NATIVE_SHARE_COOKIE_DOMAIN`      | Set with `COOKIE_DOMAIN` to share one auth database across first-party subdomains                                                            |
 | `OAUTH_STATE_SECRET`                    | Dedicated HMAC key for OAuth state envelopes (see [Security — OAuth State Signing](/docs/security#oauth-state))                              |
-| `GOOGLE_CLIENT_ID`                      | Enable Google OAuth                                                                                                                          |
-| `GOOGLE_CLIENT_SECRET`                  | Google OAuth secret                                                                                                                          |
+| `GOOGLE_SIGN_IN_CLIENT_ID`              | Preferred low-scope Google OAuth client ID for app login                                                                                     |
+| `GOOGLE_SIGN_IN_CLIENT_SECRET`          | Preferred low-scope Google OAuth secret for app login                                                                                        |
+| `GOOGLE_CLIENT_ID`                      | Legacy Google login fallback, and provider OAuth client ID for Google API integrations                                                       |
+| `GOOGLE_CLIENT_SECRET`                  | Legacy Google login fallback, and provider OAuth secret for Google API integrations                                                          |
 | `GITHUB_CLIENT_ID`                      | Enable GitHub OAuth                                                                                                                          |
 | `GITHUB_CLIENT_SECRET`                  | GitHub OAuth secret                                                                                                                          |
 | `ACCESS_TOKEN`                          | Static bearer fallback for MCP/connect clients; not browser auth                                                                             |

package/docs/content/template-analytics.md

@@ -140,18 +140,23 @@ truth choices, metric definitions, dashboards, and analyses.
 
 Credentials are stored via the framework's settings/env layer — no secrets in git. Production requires:
 
-| Variable                                 | Purpose                       |
-| ---------------------------------------- | ----------------------------- |
-| `DATABASE_URL`                           | Persistent SQL connection URL |
-| `BETTER_AUTH_SECRET` / `BETTER_AUTH_URL` | Auth                          |
-| `GOOGLE_CLIENT_ID` / `_SECRET`           | Google sign-in (OAuth 2.0)    |
-| `BIGQUERY_PROJECT_ID`                    | BigQuery project              |
-| `GOOGLE_APPLICATION_CREDENTIALS_JSON`    | BigQuery service-account JSON |
-| `ANTHROPIC_API_KEY`                      | Agent chat                    |
+| Variable                                 | Purpose                                                 |
+| ---------------------------------------- | ------------------------------------------------------- |
+| `DATABASE_URL`                           | Persistent SQL connection URL                           |
+| `BETTER_AUTH_SECRET` / `BETTER_AUTH_URL` | Auth                                                    |
+| `GOOGLE_SIGN_IN_CLIENT_ID` / `_SECRET`   | Preferred Google sign-in client (OAuth 2.0)             |
+| `GOOGLE_CLIENT_ID` / `_SECRET`           | Legacy sign-in fallback / Google API integration client |
+| `BIGQUERY_PROJECT_ID`                    | BigQuery project                                        |
+| `GOOGLE_APPLICATION_CREDENTIALS_JSON`    | BigQuery service-account JSON                           |
+| `ANTHROPIC_API_KEY`                      | Agent chat                                              |
 
 Provider-specific keys (HubSpot, Jira, Gong, Pylon, etc.) are documented in each source's walkthrough on the Data Sources page. If you add a new action that needs an API key, it appears as a new source on that page via the template's onboarding registration.
 
-Note: the BigQuery OAuth credential for Google sign-in is a **separate** credential from the BigQuery service account JSON. Create the sign-in client at GCP Console → APIs & Services → Credentials → OAuth client ID.
+Note: the BigQuery OAuth credential for Google sign-in is a **separate**
+credential from the BigQuery service account JSON. Create the sign-in client at
+GCP Console → APIs & Services → Credentials → OAuth client ID, and prefer the
+`GOOGLE_SIGN_IN_CLIENT_ID` / `GOOGLE_SIGN_IN_CLIENT_SECRET` env names so this
+low-scope login client stays separate from Google API integration clients.
 
 ### Data model
 

package/docs/content/template-clips.md

@@ -1,6 +1,7 @@
 ---
 title: "Clips"
 description: "Async screen recording, calendar-synced meeting notes, and push-to-talk voice dictation — paste Clips links into agents and they can read transcripts, visuals, and summaries."
+search: "Clips browser logs developer logs console logs network logs fetch XHR Chrome extension diagnostics recorder desktop app"
 ---
 
 # Clips
@@ -33,10 +34,34 @@ Think along the lines of Loom + Granola + Wispr Flow rolled into one app — but
 - **Share clips** with per-clip permissions (public, team, private). Link tracking and threaded comments work too.
 - **Preview public clips in Slack** with a Loom-style playable unfurl after the
   workspace installs your Clips Slack app.
+- **Capture browser logs with the Chrome extension.** Browser recordings can
+  attach redacted console logs and fetch/XHR metadata, which is helpful for
+  product bugs and browser-only repros.
 - **Paste Clips links into agents** so they can discover the agent-readable context: metadata, transcript segments, recommended frames, and timestamped frame images without receiving the raw video file.
 - **Smart library views.** Group by project, filter by speaker, auto-tag based on content.
 - **Edit the transcript through chat.** "Fix the mis-transcribed word at 1:42." "Pull three quotes for a blog post." The agent edits the transcript and the UI updates live.
 
+## Browser logs and developer diagnostics
+
+Use the Clips Chrome extension when you need a recording plus browser logs from
+the tab you are debugging. The extension starts an active-tab recording and can
+save redacted console logs, JavaScript exceptions, and fetch/XHR network
+metadata such as method, redacted URL, status, duration, and failure text. It
+does not save request bodies, response bodies, or headers.
+
+The regular browser recorder page can save diagnostics from the recorder page
+itself. The Chrome extension is the path for active-tab developer logs and
+browser-only repros. In the Clips UI, use the Chrome option for browser logs and
+the desktop app for the most seamless everyday capture path.
+
+The Agent-Native Clips Chrome extension listing is
+`https://chromewebstore.google.com/detail/baoipacpchggcdigagnajakiidcgcffn`.
+If you host your own Clips server, keep the Chrome extension option hidden until
+your Web Store listing is live. Set `VITE_CLIPS_CHROME_EXTENSION_ENABLED=1`
+after approval to show the extension beside desktop-app download prompts. Set
+`VITE_CLIPS_CHROME_EXTENSION_URL` only if you need to override the default
+listing URL.
+
 ## Agent-readable clips
 
 Paste a normal public Clips share link into an agent. The share page advertises
@@ -143,7 +168,7 @@ Clips is a larger template with a native recorder (it ships a desktop companion
 
 1. **Video storage (required).** Connect a storage backend through the onboarding wizard. The easiest path is Builder.io (free during beta, one-click). For self-hosted storage, set `S3_ENDPOINT`, `S3_BUCKET`, `S3_ACCESS_KEY_ID`, `S3_SECRET_ACCESS_KEY`, and optionally `S3_REGION` and `S3_PUBLIC_BASE_URL`. Cloudflare R2 and DigitalOcean Spaces use the same env vars with the `R2_*` prefix.
 2. **Google Calendar (optional).** To sync upcoming meetings, connect a Google Calendar account from Settings. The OAuth callback URL in dev is `http://localhost:8094/_agent-native/google/callback`. Set up a Google OAuth client in [Google Cloud Console](https://console.cloud.google.com/) with the Gmail and Google Calendar APIs enabled.
-3. **Screen-capture permissions.** On macOS, grant Screen Recording permission to the browser (or the desktop companion app) in System Settings → Privacy & Security → Screen Recording.
+3. **Screen-capture permissions.** On macOS, grant Screen Recording permission to the browser (or the desktop companion app) in System Settings → Privacy & Security → Screen Recording. Browser recordings can save redacted console and fetch/XHR diagnostics from the recorder page. Once the Chrome extension listing is available, enable `VITE_CLIPS_CHROME_EXTENSION_ENABLED=1` so users can choose the extension for active-tab browser logs or the desktop app for the smoothest native capture path.
 4. **Slack previews (optional).** Create a Slack app with `links:read`, `links:write`, and `links.embed:write`; subscribe to `link_shared`; add your Clips share domain under **App Unfurl Domains**; set the Request URL to `https://your-clips.example.com/api/slack/unfurl`; and add the OAuth redirect URL `https://your-clips.example.com/api/slack/oauth/callback`. Configure `SLACK_CLIENT_ID`, `SLACK_CLIENT_SECRET`, and `SLACK_SIGNING_SECRET`, then connect workspaces from Clips Settings.
 
 ### Host your own Clips server
@@ -185,7 +210,15 @@ tray app at your deployment.
    include that path, such as `https://example.com/clips`. Click **Connect**,
    then sign in with an account on that Clips server.
 
-5. **Connect optional integrations.** Google Calendar powers the Meetings tab,
+5. **Enable the Chrome extension after publishing.** Keep
+   `VITE_CLIPS_CHROME_EXTENSION_ENABLED` unset until the Chrome Web Store listing
+   is approved. Then set it to `1` to reveal the browser-log option beside the
+   desktop app prompts. The default listing URL is
+   `https://chromewebstore.google.com/detail/baoipacpchggcdigagnajakiidcgcffn`;
+   set `VITE_CLIPS_CHROME_EXTENSION_URL` only if your deployment uses a
+   different extension listing.
+
+6. **Connect optional integrations.** Google Calendar powers the Meetings tab,
    `GEMINI_API_KEY` or Builder.io Connect powers transcript cleanup and titles,
    `GROQ_API_KEY` can provide speech-to-text fallback, and the Slack OAuth
    connection in Settings enables playable Slack unfurls.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.68.1",
+  "version": "0.68.3",
   "type": "module",
   "engines": {
     "node": ">=22"