@agent-native/core 0.79.27 → 0.80.1

package/corpus/templates/analytics/server/lib/s3-upload-provider.ts

@@ -0,0 +1,255 @@
+/**
+ * S3-compatible file upload provider.
+ *
+ * Works with AWS S3, Cloudflare R2, DigitalOcean Spaces, MinIO, Backblaze B2,
+ * and any other S3-compatible object storage. Uses SigV4 signing via Web Crypto
+ * — no SDK dependency.
+ *
+ * Env vars (S3_* or R2_* prefix, first found wins):
+ *   S3_BUCKET | R2_BUCKET                — required
+ *   S3_ACCESS_KEY_ID | R2_ACCESS_KEY_ID  — required
+ *   S3_SECRET_ACCESS_KEY | R2_SECRET_ACCESS_KEY — required
+ *   S3_ENDPOINT | R2_ENDPOINT            — required (e.g. https://s3.us-east-1.amazonaws.com
+ *                                           or https://<acct>.r2.cloudflarestorage.com)
+ *   S3_REGION | R2_REGION                — optional, default "auto"
+ *   S3_PUBLIC_BASE_URL | R2_PUBLIC_BASE_URL — optional (for public read URLs)
+ */
+
+import type { FileUploadProvider } from "@agent-native/core/file-upload";
+import { resolveSecret } from "@agent-native/core/server";
+
+interface S3Config {
+  region: string;
+  bucket: string;
+  accessKeyId: string;
+  secretAccessKey: string;
+  endpoint: string;
+  publicBaseUrl: string | null;
+}
+
+function cleanValue(value: string | null | undefined): string | undefined {
+  const cleaned = value?.trim();
+  return cleaned ? cleaned : undefined;
+}
+
+function buildS3Config(values: {
+  bucket?: string;
+  accessKeyId?: string;
+  secretAccessKey?: string;
+  endpoint?: string;
+  region?: string;
+  publicBaseUrl?: string;
+}): S3Config | null {
+  const bucket = cleanValue(values.bucket);
+  const accessKeyId = cleanValue(values.accessKeyId);
+  const secretAccessKey = cleanValue(values.secretAccessKey);
+  const endpoint = cleanValue(values.endpoint);
+  if (!bucket || !accessKeyId || !secretAccessKey || !endpoint) return null;
+  return {
+    region: cleanValue(values.region) ?? "auto",
+    bucket,
+    accessKeyId,
+    secretAccessKey,
+    endpoint: endpoint.replace(/\/+$/, ""),
+    publicBaseUrl:
+      cleanValue(values.publicBaseUrl)?.replace(/\/+$/, "") ?? null,
+  };
+}
+
+function readS3EnvConfig(): S3Config | null {
+  const env = process.env;
+  return buildS3Config({
+    bucket: env.S3_BUCKET || env.R2_BUCKET,
+    accessKeyId: env.S3_ACCESS_KEY_ID || env.R2_ACCESS_KEY_ID,
+    secretAccessKey: env.S3_SECRET_ACCESS_KEY || env.R2_SECRET_ACCESS_KEY,
+    endpoint: env.S3_ENDPOINT || env.R2_ENDPOINT,
+    region: env.S3_REGION || env.R2_REGION,
+    publicBaseUrl: env.S3_PUBLIC_BASE_URL || env.R2_PUBLIC_BASE_URL,
+  });
+}
+
+async function resolveS3Secret(primary: string, fallback: string) {
+  return (
+    cleanValue(await resolveSecret(primary).catch(() => null)) ??
+    cleanValue(await resolveSecret(fallback).catch(() => null))
+  );
+}
+
+async function readS3Config(): Promise<S3Config | null> {
+  return buildS3Config({
+    bucket: await resolveS3Secret("S3_BUCKET", "R2_BUCKET"),
+    accessKeyId: await resolveS3Secret("S3_ACCESS_KEY_ID", "R2_ACCESS_KEY_ID"),
+    secretAccessKey: await resolveS3Secret(
+      "S3_SECRET_ACCESS_KEY",
+      "R2_SECRET_ACCESS_KEY",
+    ),
+    endpoint: await resolveS3Secret("S3_ENDPOINT", "R2_ENDPOINT"),
+    region: await resolveS3Secret("S3_REGION", "R2_REGION"),
+    publicBaseUrl: await resolveS3Secret(
+      "S3_PUBLIC_BASE_URL",
+      "R2_PUBLIC_BASE_URL",
+    ),
+  });
+}
+
+// ── SigV4 helpers (Web Crypto, no SDK) ────────────────────────────────
+
+async function hmac(key: ArrayBuffer, msg: string): Promise<ArrayBuffer> {
+  const k = await crypto.subtle.importKey(
+    "raw",
+    key,
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"],
+  );
+  return crypto.subtle.sign("HMAC", k, new TextEncoder().encode(msg));
+}
+
+async function sha256(data: Uint8Array): Promise<string> {
+  const ab = new ArrayBuffer(data.byteLength);
+  new Uint8Array(ab).set(data);
+  const buf = await crypto.subtle.digest("SHA-256", ab);
+  return toHex(buf);
+}
+
+function toHex(buf: ArrayBuffer): string {
+  const bytes = new Uint8Array(buf);
+  let out = "";
+  for (let i = 0; i < bytes.length; i++) {
+    out += bytes[i].toString(16).padStart(2, "0");
+  }
+  return out;
+}
+
+async function deriveSigningKey(
+  secret: string,
+  dateStamp: string,
+  region: string,
+): Promise<ArrayBuffer> {
+  const kSecret = new TextEncoder().encode(`AWS4${secret}`);
+  const kDate = await hmac(kSecret.buffer as ArrayBuffer, dateStamp);
+  const kRegion = await hmac(kDate, region);
+  const kService = await hmac(kRegion, "s3");
+  return hmac(kService, "aws4_request");
+}
+
+function rfc3986(str: string): string {
+  return encodeURIComponent(str).replace(
+    /[!'()*]/g,
+    (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase(),
+  );
+}
+
+async function putObject(
+  cfg: S3Config,
+  key: string,
+  body: Uint8Array,
+  contentType: string,
+): Promise<string> {
+  const now = new Date();
+  const amzDate =
+    now
+      .toISOString()
+      .replace(/[:-]|\.\d{3}/g, "")
+      .slice(0, 15) + "Z";
+  const dateStamp = amzDate.slice(0, 8);
+  const credentialScope = `${dateStamp}/${cfg.region}/s3/aws4_request`;
+
+  const hostUrl = new URL(cfg.endpoint);
+  const host = hostUrl.host;
+  const canonicalUri = `/${cfg.bucket}/${key.split("/").map(rfc3986).join("/")}`;
+
+  const payloadHash = await sha256(body);
+
+  const headers: Record<string, string> = {
+    host,
+    "content-type": contentType,
+    "x-amz-content-sha256": payloadHash,
+    "x-amz-date": amzDate,
+  };
+
+  const signedHeaderKeys = Object.keys(headers).sort();
+  const signedHeaders = signedHeaderKeys.join(";");
+  const canonicalHeaders =
+    signedHeaderKeys.map((k) => `${k}:${headers[k]}`).join("\n") + "\n";
+
+  const canonicalRequest = [
+    "PUT",
+    canonicalUri,
+    "", // no query string
+    canonicalHeaders,
+    signedHeaders,
+    payloadHash,
+  ].join("\n");
+
+  const crHash = await sha256(new TextEncoder().encode(canonicalRequest));
+  const stringToSign = [
+    "AWS4-HMAC-SHA256",
+    amzDate,
+    credentialScope,
+    crHash,
+  ].join("\n");
+
+  const signingKey = await deriveSigningKey(
+    cfg.secretAccessKey,
+    dateStamp,
+    cfg.region,
+  );
+  const signature = toHex(await hmac(signingKey, stringToSign));
+
+  const authorization =
+    `AWS4-HMAC-SHA256 Credential=${cfg.accessKeyId}/${credentialScope}, ` +
+    `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+
+  const url = `${cfg.endpoint}${canonicalUri}`;
+  const res = await fetch(url, {
+    method: "PUT",
+    headers: {
+      ...headers,
+      Authorization: authorization,
+      "Content-Length": String(body.byteLength),
+    },
+    body: body.buffer.slice(
+      body.byteOffset,
+      body.byteOffset + body.byteLength,
+    ) as BodyInit,
+  });
+
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(
+      `S3 PutObject failed (${res.status}): ${text || res.statusText}`,
+    );
+  }
+
+  return cfg.publicBaseUrl
+    ? `${cfg.publicBaseUrl}/${key}`
+    : `${cfg.endpoint}/${cfg.bucket}/${key}`;
+}
+
+// ── Provider ──────────────────────────────────────────────────────────
+
+export const s3FileUploadProvider: FileUploadProvider = {
+  id: "s3",
+  name: "S3-compatible storage",
+  isConfigured: () => readS3EnvConfig() !== null,
+  isConfiguredForRequest: async () => (await readS3Config()) !== null,
+  upload: async ({ data, filename, mimeType }) => {
+    const cfg = await readS3Config();
+    if (!cfg) throw new Error("S3 credentials are not configured");
+
+    const ext = filename?.split(".").pop() ?? "bin";
+    const stamp = Date.now();
+    const rand = Math.random().toString(36).slice(2, 10);
+    const objectKey = `replays/${stamp}-${rand}.${ext}`;
+    const contentType = mimeType || "application/octet-stream";
+
+    const bytes =
+      data instanceof Uint8Array
+        ? data
+        : new Uint8Array(data as unknown as ArrayBuffer);
+
+    const publicUrl = await putObject(cfg, objectKey, bytes, contentType);
+    return { url: publicUrl, provider: "s3" };
+  },
+};

package/corpus/templates/analytics/server/lib/session-replay.ts

@@ -8,7 +8,7 @@ import {
   readPrivateBlob,
   type PrivateBlobHandle,
 } from "@agent-native/core/private-blob";
-import { recordChange } from "@agent-native/core/server";
+import { recordChange, runWithRequestContext } from "@agent-native/core/server";
 import {
   accessFilter,
   resolveAccess,
@@ -988,11 +988,21 @@ function rowToSessionRecordingSummary(
 }
 
 function hasVisibleSessionRecordingIdentity(row: any): boolean {
-  return Boolean(replayEmail(row.userId) || replayString(row.anonymousId));
+  // /sessions intentionally lists signed-in, email-backed recordings only (see
+  // analytics CLAUDE.md + the "rejects anonymous recordings" spec). Keep this in
+  // sync with replayVisibleIdentityCondition().
+  return Boolean(replayEmail(row.userId) || replayEmail(row.userKey));
+}
+
+function hasPlayableSessionRecordingEvents(row: any): boolean {
+  return Number(row.chunkCount ?? 0) > 0 && Number(row.eventCount ?? 0) > 0;
 }
 
 function isVisibleSessionRecording(row: any): boolean {
-  return hasVisibleSessionRecordingIdentity(row);
+  return (
+    hasVisibleSessionRecordingIdentity(row) &&
+    hasPlayableSessionRecordingEvents(row)
+  );
 }
 
 function mergeReplayMetadata(
@@ -1043,9 +1053,18 @@ function replayTextContains(column: unknown, query: string) {
 }
 
 function replayVisibleIdentityCondition() {
+  // Email-backed identity only — /sessions lists signed-in recordings (see
+  // analytics CLAUDE.md). Mirror of hasVisibleSessionRecordingIdentity().
   return or(
     replayTextContains(schema.sessionRecordings.userId, "@"),
-    sql`nullif(trim(coalesce(${schema.sessionRecordings.anonymousId}, '')), '') is not null`,
+    replayTextContains(schema.sessionRecordings.userKey, "@"),
+  );
+}
+
+function replayPlayableEventsCondition() {
+  return and(
+    gte(schema.sessionRecordings.chunkCount, 1),
+    gte(schema.sessionRecordings.eventCount, 1),
   );
 }
 
@@ -1126,7 +1145,12 @@ export async function recordSessionReplayChunks(
         lastIngestedAt: ingestedAt,
         ownerEmail: key.ownerEmail,
         orgId: key.orgId,
-        visibility: "private",
+        // Session replay is an org-analytics surface: a recording captured under
+        // an org-scoped analytics key must be visible to everyone in that org
+        // (via accessFilter's "org" branch), not only the key owner. Without an
+        // org we fall back to owner-private. This is what makes /sessions show
+        // recordings to teammates instead of only the single key owner.
+        visibility: key.orgId ? "org" : "private",
       })
       .onConflictDoNothing();
 
@@ -1190,12 +1214,23 @@ export async function recordSessionReplayChunks(
           413,
         );
       }
-      const chunk = await storeReplayChunkBlob(rawChunk, {
-        publicKeyId: key.id,
-        recordingId: recording.id,
-        ownerEmail: key.ownerEmail,
-        orgId: key.orgId,
-      });
+      // Replay ingest is anonymous + cross-origin (no session), so blob storage
+      // would otherwise have no request context and `resolveBuilderPrivateKey()`
+      // (and any S3 provider's scoped-secret lookup) would resolve nothing —
+      // every chunk upload then 503s and recordings persist as empty shells.
+      // Run the upload in the public key owner's user/org scope so the org's
+      // connected Builder (or S3) credential in `app_secrets` resolves. Mirrors
+      // the resources upload precedent (core resources/handlers.ts).
+      const chunk = await runWithRequestContext(
+        { userEmail: key.ownerEmail, orgId: key.orgId ?? undefined },
+        () =>
+          storeReplayChunkBlob(rawChunk, {
+            publicKeyId: key.id,
+            recordingId: recording.id,
+            ownerEmail: key.ownerEmail,
+            orgId: key.orgId,
+          }),
+      );
       if (rawChunk.storageKind !== "blob" && chunk.storageKind === "blob") {
         const ref = decodeReplayBlobRef(chunk.storageRef);
         if (ref) uploadedBlobHandles.push(ref.handle);
@@ -1353,6 +1388,7 @@ export async function listSessionRecordings(
       orgId: scope.orgId ?? undefined,
     }),
     replayVisibleIdentityCondition(),
+    replayPlayableEventsCondition(),
   ];
   if (filters.app)
     conditions.push(eq(schema.sessionRecordings.app, filters.app));
@@ -1363,7 +1399,12 @@ export async function listSessionRecordings(
     conditions.push(eq(schema.sessionRecordings.sessionId, filters.sessionId));
   }
   if (filters.userId) {
-    conditions.push(eq(schema.sessionRecordings.userId, filters.userId));
+    conditions.push(
+      or(
+        eq(schema.sessionRecordings.userId, filters.userId),
+        eq(schema.sessionRecordings.userKey, filters.userId),
+      ),
+    );
   }
   if (filters.anonymousId) {
     conditions.push(

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -9,6 +9,7 @@ import {
 import actionsRegistry from "../../.generated/actions-registry.js";
 import { renderDataDictionary } from "../lib/data-dictionary-context";
 import {
+  failedDataQueryAttemptMessage,
   hasExplicitPartialDisclosure,
   hasFailedCorpusWorkflowEvidence,
   hasDataQueryAttempt,
@@ -39,6 +40,7 @@ const INITIAL_TOOL_NAMES = [
   "get-sql-dashboard",
   "mutate-dashboard",
   "generate-chart",
+  "query-agent-native-analytics",
   "bigquery",
   "search-bigquery-schema",
   "bigquery-table-info",
@@ -139,6 +141,13 @@ function realDataFinalGuard(context: AgentLoopFinalResponseGuardContext) {
   }
   if (hasDataQueryAttempt(context.toolResults)) return null;
   if (isSafeNoDataAnalyticsResponse(context.text)) return null;
+  const failedQueryMessage = failedDataQueryAttemptMessage(context.toolResults);
+  if (failedQueryMessage) {
+    return {
+      retryMessage: failedQueryMessage,
+      fallbackMessage: failedQueryMessage,
+    };
+  }
 
   return {
     retryMessage:
@@ -175,8 +184,8 @@ export default createAgentChatPlugin({
       "SURFACE DIFFERENTIATION — You are the analytics assistant for definitions, deep-dive analysis, and action. For questions about what a metric, model, or table means, use the Data Dictionary and configured schema tools first. For trends, comparisons, anomalies, current data, or anything that requires querying live data, answer directly in chat with the relevant provider query, dashboard analysis, and inline charts when useful. " +
       "DASHBOARD CREATION RULE — You may create dashboards, analyses, SQL panels, or other resources only when the user explicitly asks you to (e.g. 'build me a dashboard for...', 'create a new analysis', 'add a chart for...'). Never create any resource proactively during research, trend analysis, or answering questions. If you think a dashboard would be useful, suggest it and wait for explicit confirmation before creating anything. Never add new items to the sidebar or modify existing dashboards without an explicit user directive. " +
       "DASHBOARD MUTATION RULE — For dashboard edits, default to `mutate-dashboard` with the typed `dashboard.*` script API so the main payload is a string and avoids native-array serialization traps. It can move panels by id, edit titles/SQL/config, insert, duplicate, remove, and patch dashboard fields in one atomic save. The script API is constrained: no variables/imports/loops/functions, only JSON-compatible arguments on documented dashboard methods. Do not count shifting `/panels/<index>` positions for ordinary dashboard edits unless the user specifically asks for low-level JSON-pointer operations. " +
-      "DASHBOARD READ RULE — `get-sql-dashboard` is compact by default: use its `panels` summaries plus `layout.panelOrder` and `layout.firstPanelIds` for orientation and verification. Pass `includeConfig: true` only when you truly need full panel SQL/config. " +
-      'DASHBOARD REORDER RULE — For simple chart/section moves, use `mutate-dashboard` code such as `dashboard.panels(["panel-a","panel-b"]).moveToTop();`. Never count shifting `/panels/<index>` positions for ordinary \'move this chart\' requests. Use `get-sql-dashboard.layout.firstPanelIds` or `mutate-dashboard.panelOrder` as proof of placement. ' +
+      "DASHBOARD READ RULE — `get-sql-dashboard` is compact by default: use its `panels` summaries plus `layout.panelOrder`, `layout.firstPanelIds`, and `layout.groups[].rows[].rowNumber/panelIds` for orientation and verification. Pass `includeConfig: true` only when you truly need full panel SQL/config. " +
+      'DASHBOARD REORDER RULE — For simple chart/section moves, use `mutate-dashboard` code such as `dashboard.panels(["panel-a","panel-b"]).moveToTop();`. For visible placement requests like "second row" or "next to return rates", use row-aware placement such as `dashboard.insertPanel({...}).nextTo("retention-over-time")`, `.atRow(2)`, or `dashboard.panel("panel-a").moveNextTo("panel-b")`; these keep panels in the intended rendered row and expand/rebalance that row when needed. Never count shifting `/panels/<index>` positions for ordinary \'move this chart\' requests. Use `get-sql-dashboard.layout.groups[].rows` as proof of visible row placement, not only flat `panelOrder`. ' +
       "Use configured data sources and actions only. Call `data-source-status` when you need to know which providers are connected, and treat provider actions as unavailable for analysis if they return missing credentials, permission, syntax, quota, or network errors. " +
       "The built-in `demo` dashboard source is a demo-environment Prometheus source reserved for the Node Exporter demo. It must never satisfy REAL_DATA_REQUIRED or be cited as user analytics evidence unless the user explicitly asks to inspect the demo dashboard. " +
       "When the user names a provider or tool such as Jira, Pylon, HubSpot, Gong, Slack, Sentry, GA4, or BigQuery, that named source is authoritative for the turn: use that provider's real tool/API surface, not a warehouse or different-provider substitute, unless the user explicitly asks for the copy/fallback. For bounded lookups where a first-class action fully models the requested source, object, filter, and pagination need, that shortcut is fine. For broad provider searches, cross-source joins, corpus-wide counts, exact cohort coverage, or any answer where absence matters, do not start and stop with shortcuts; use the broad provider API/MCP and corpus/code workflow as the primary path. " +

package/corpus/templates/analytics/server/plugins/onboarding.ts

@@ -0,0 +1,97 @@
+/**
+ * Custom onboarding plugin for Analytics.
+ *
+ * Overrides the framework's default onboarding plugin to add an optional
+ * "Session replay storage" step and register the S3 file upload provider. Must
+ * live in server/plugins/ so the framework skips its default onboarding plugin,
+ * and all registrations share the same module context as the onboarding route
+ * handlers (which read from the same in-memory Map).
+ *
+ * The step is `required: false` because session replay is opt-in: capturing
+ * replays only matters once a site embeds the tracking SDK with replay enabled,
+ * so we surface storage setup without forcing it into the onboarding checklist.
+ */
+
+import { registerFileUploadProvider } from "@agent-native/core/file-upload";
+import {
+  createOnboardingPlugin,
+  registerOnboardingStep,
+} from "@agent-native/core/onboarding";
+
+import { hasRequestReplayStorage } from "../lib/replay-storage.js";
+import { s3FileUploadProvider } from "../lib/s3-upload-provider.js";
+
+const basePlugin = createOnboardingPlugin();
+
+export default async (nitroApp: any): Promise<void> => {
+  // Mount the framework's default onboarding plugin (routes + default steps).
+  await basePlugin(nitroApp);
+
+  // Register S3-compatible file upload provider for session-replay chunks.
+  registerFileUploadProvider(s3FileUploadProvider);
+
+  // Add the optional "Session replay storage" onboarding step.
+  registerOnboardingStep({
+    id: "replay-storage",
+    order: 15,
+    required: false,
+    title: "Session replay storage",
+    description:
+      "Store session replay recordings with Builder.io or S3-compatible storage.",
+    methods: [
+      {
+        id: "builder",
+        kind: "builder-cli-auth",
+        label: "Connect Builder.io",
+        description:
+          "Builder.io's free tier includes object storage for replay chunks.",
+        primary: true,
+        badge: "free",
+        payload: { scope: "browser" },
+      },
+      {
+        id: "s3",
+        kind: "form",
+        label: "Use S3-compatible storage",
+        description:
+          "AWS S3, Cloudflare R2, DigitalOcean Spaces, MinIO, or any S3-compatible service.",
+        payload: {
+          writeScope: "workspace",
+          fields: [
+            {
+              key: "S3_ENDPOINT",
+              label: "Endpoint URL",
+              placeholder: "https://s3.us-east-1.amazonaws.com",
+            },
+            {
+              key: "S3_BUCKET",
+              label: "Bucket name",
+              placeholder: "my-replays-bucket",
+            },
+            {
+              key: "S3_ACCESS_KEY_ID",
+              label: "Access key ID",
+              placeholder: "AKIA...",
+            },
+            {
+              key: "S3_SECRET_ACCESS_KEY",
+              label: "Secret access key",
+              secret: true,
+            },
+            {
+              key: "S3_REGION",
+              label: "Region (optional)",
+              placeholder: "us-east-1",
+            },
+            {
+              key: "S3_PUBLIC_BASE_URL",
+              label: "Public base URL (optional)",
+              placeholder: "https://cdn.example.com",
+            },
+          ],
+        },
+      },
+    ],
+    isComplete: hasRequestReplayStorage,
+  });
+};

package/corpus/templates/assets/app/components/layout/Sidebar.tsx

@@ -425,7 +425,7 @@ export function Sidebar() {
   return (
     <aside
       className={cn(
-        "flex h-full min-w-0 shrink-0 flex-col overflow-hidden border-e border-border bg-sidebar text-sidebar-foreground",
+        "flex h-full min-w-0 shrink-0 flex-col overflow-hidden border-e border-border bg-sidebar text-sidebar-foreground transition-[width] duration-200 ease-out",
         collapsed ? "w-14" : "w-56",
       )}
     >
@@ -553,15 +553,15 @@ export function Sidebar() {
 
         {!collapsed && (
           <div className="mt-auto shrink-0">
-            <div className="border-t border-border px-2 py-1">
+            <div className="px-2 py-1">
               <ExtensionsSidebarSection />
             </div>
 
-            <div className="border-t border-border px-3 py-2">
+            <div className="px-3 py-2">
               <OrgSwitcher />
             </div>
 
-            <div className="border-t border-border px-3 py-2">
+            <div className="px-3 py-2">
               <DevDatabaseLink />
               <FeedbackButton />
             </div>

package/corpus/templates/assets/changelog/2026-06-28-left-sidebar-collapse-motion-and-footer-chrome-are-quieter.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-06-28
+---
+
+Left sidebar collapse motion and footer controls now feel smoother and use less divider chrome.

package/corpus/templates/brain/app/components/layout/Layout.tsx

@@ -20,11 +20,24 @@ import {
 } from "@/components/ui/sheet";
 import { TAB_ID } from "@/lib/tab-id";
 
+const SIDEBAR_COLLAPSE_KEY = "brain.sidebar.collapsed";
+
+function readSidebarCollapsed() {
+  if (typeof window === "undefined") return false;
+  try {
+    return window.localStorage.getItem(SIDEBAR_COLLAPSE_KEY) === "1";
+  } catch {
+    return false;
+  }
+}
+
 export function Layout({ children }: { children: React.ReactNode }) {
   const location = useLocation();
   const navigate = useNavigate();
   const t = useT();
   const [mobileSidebarOpen, setMobileSidebarOpen] = useState(false);
+  const [sidebarCollapsed, setSidebarCollapsed] =
+    useState(readSidebarCollapsed);
   const isAskRoute = location.pathname === "/";
   const chatHomeHandoffActive = useAgentChatHomeHandoff({
     storageKey: "brain",
@@ -37,10 +50,24 @@ export function Layout({ children }: { children: React.ReactNode }) {
     setMobileSidebarOpen(false);
   }, [location.pathname]);
 
+  useEffect(() => {
+    try {
+      window.localStorage.setItem(
+        SIDEBAR_COLLAPSE_KEY,
+        sidebarCollapsed ? "1" : "0",
+      );
+    } catch {
+      // Ignore storage failures; the in-memory preference still works.
+    }
+  }, [sidebarCollapsed]);
+
   const sidebarFrame = (
     <>
       <div className="agent-layout-left-drawer hidden md:block">
-        <Sidebar />
+        <Sidebar
+          collapsed={sidebarCollapsed}
+          onCollapsedChange={setSidebarCollapsed}
+        />
       </div>
       <Sheet open={mobileSidebarOpen} onOpenChange={setMobileSidebarOpen}>
         <SheetContent side="left" className="w-[min(18rem,88vw)] p-0">
@@ -50,7 +77,7 @@ export function Layout({ children }: { children: React.ReactNode }) {
           <SheetDescription className="sr-only">
             {t("navigation.brainNavigationDescription")}
           </SheetDescription>
-          <Sidebar />
+          <Sidebar collapsed={false} collapsible={false} />
         </SheetContent>
       </Sheet>
     </>