@agent-native/core 0.84.56 → 0.84.58

package/corpus/core/src/client/AssistantChat.tsx

@@ -588,6 +588,61 @@ export function reconnectActivityFallbackContent(
   ];
 }
 
+function toolCallIdFromContentPart(part: unknown): string | null {
+  if (!part || typeof part !== "object") return null;
+  const candidate = part as { type?: unknown; toolCallId?: unknown };
+  if (candidate.type !== "tool-call") return null;
+  return typeof candidate.toolCallId === "string" && candidate.toolCallId
+    ? candidate.toolCallId
+    : null;
+}
+
+function toolCallPartHasResult(part: unknown): boolean {
+  if (!part || typeof part !== "object") return false;
+  const candidate = part as { type?: unknown; result?: unknown };
+  return candidate.type === "tool-call" && "result" in candidate;
+}
+
+function collectRenderedToolCallStates(
+  messages: readonly unknown[],
+): Map<string, { hasResult: boolean }> {
+  const states = new Map<string, { hasResult: boolean }>();
+  for (const message of messages) {
+    const msg = (message as { message?: unknown })?.message ?? message;
+    const content = (msg as { content?: unknown })?.content;
+    if (!Array.isArray(content)) continue;
+    for (const part of content) {
+      const id = toolCallIdFromContentPart(part);
+      if (!id) continue;
+      const existing = states.get(id);
+      states.set(id, {
+        hasResult: Boolean(existing?.hasResult || toolCallPartHasResult(part)),
+      });
+    }
+  }
+  return states;
+}
+
+export function dedupeReconnectContentAgainstMessages(
+  content: ContentPart[],
+  messages: readonly unknown[],
+): ContentPart[] {
+  if (content.length === 0 || messages.length === 0) return content;
+  const renderedToolCallStates = collectRenderedToolCallStates(messages);
+  if (renderedToolCallStates.size === 0) return content;
+
+  let changed = false;
+  const filtered = content.filter((part) => {
+    const id = toolCallIdFromContentPart(part);
+    const existing = id ? renderedToolCallStates.get(id) : undefined;
+    if (!id || !existing) return true;
+    if (toolCallPartHasResult(part) && !existing.hasResult) return true;
+    changed = true;
+    return false;
+  });
+  return changed ? filtered : content;
+}
+
 const RECOVERY_USER_MESSAGE_PREFIXES = [
   "Continue from where you left off",
   "Continue from where you stopped",
@@ -1540,15 +1595,10 @@ const AssistantChatInner = forwardRef<
   });
   const reconnectActivityContent = useMemo(
     () =>
-      (isReconnecting || reconnectFrozen) && reconnectContent.length === 0
+      isReconnecting || reconnectFrozen
         ? reconnectActivityFallbackContent(runningActivityTool)
         : [],
-    [
-      isReconnecting,
-      reconnectFrozen,
-      reconnectContent.length,
-      runningActivityTool,
-    ],
+    [isReconnecting, reconnectFrozen, runningActivityTool],
   );
   const lastBroadcastRunningRef = useRef(isRunning);
   const tiptapRef = useRef<TiptapComposerHandle>(null);
@@ -3287,14 +3337,19 @@ const AssistantChatInner = forwardRef<
     ],
   );
 
+  const visibleReconnectContent = useMemo(
+    () => dedupeReconnectContentAgainstMessages(reconnectContent, messages),
+    [messages, reconnectContent],
+  );
+
   const autoscrollFollowKey = useMemo(
     () =>
       [
         messages.map(messageFollowKey).join(";"),
         `q:${queuedMessages.map(queuedMessageFollowKey).join("|")}`,
-        `r:${reconnectContentFollowKey(reconnectContent)}`,
+        `r:${reconnectContentFollowKey(visibleReconnectContent)}`,
       ].join(";;"),
-    [messages, queuedMessages, reconnectContent],
+    [messages, queuedMessages, visibleReconnectContent],
   );
 
   const {
@@ -3802,11 +3857,13 @@ const AssistantChatInner = forwardRef<
                         />
                       )}
                       {(isReconnecting || reconnectFrozen) &&
-                        reconnectContent.length > 0 && (
-                          <ReconnectStreamMessage content={reconnectContent} />
+                        visibleReconnectContent.length > 0 && (
+                          <ReconnectStreamMessage
+                            content={visibleReconnectContent}
+                          />
                         )}
                       {(isReconnecting || reconnectFrozen) &&
-                        reconnectContent.length === 0 &&
+                        visibleReconnectContent.length === 0 &&
                         reconnectActivityContent.length > 0 && (
                           <ReconnectStreamMessage
                             content={reconnectActivityContent}

package/corpus/core/src/client/MultiTabAssistantChat.tsx

@@ -283,7 +283,7 @@ function ScopeBadge({
         <PopoverTrigger asChild>
           <button
             type="button"
-            className="inline-flex h-7 min-w-0 max-w-full cursor-pointer items-center gap-1.5 rounded-t-lg border border-b-0 border-input bg-background px-3 text-muted-foreground shadow-[0_-8px_24px_hsl(var(--background)/0.72)] transition-colors hover:bg-accent hover:text-foreground sm:max-w-72"
+            className="inline-flex h-7 min-w-0 max-w-full cursor-pointer items-center gap-1.5 rounded-t-lg border border-b-0 border-input bg-background px-3 text-muted-foreground transition-colors hover:bg-accent hover:text-foreground sm:max-w-72"
             aria-label={heading}
           >
             <IconLink size={11} className="shrink-0 opacity-70" />

package/corpus/core/src/client/conversation/use-near-bottom-autoscroll.ts

@@ -7,6 +7,41 @@ export interface UseNearBottomAutoscrollOptions {
   enabled?: boolean;
 }
 
+function eventElementTarget(event: Event): HTMLElement | null {
+  const target = event.target;
+  if (!(target instanceof Node)) return null;
+  if (target instanceof HTMLElement) return target;
+  return target.parentElement;
+}
+
+function canScrollElementVertically(
+  element: HTMLElement,
+  deltaY: number,
+): boolean {
+  if (element.scrollHeight <= element.clientHeight) return false;
+  const style = window.getComputedStyle(element);
+  const overflowY = style.overflowY || style.overflow;
+  if (!/(auto|scroll|overlay)/.test(overflowY)) return false;
+  if (deltaY < 0) return element.scrollTop > 0;
+  if (deltaY > 0) {
+    return element.scrollTop + element.clientHeight < element.scrollHeight - 1;
+  }
+  return false;
+}
+
+function nestedScrollableConsumesVerticalIntent(
+  event: Event,
+  root: HTMLElement,
+  deltaY: number,
+): boolean {
+  let element = eventElementTarget(event);
+  while (element && element !== root) {
+    if (canScrollElementVertically(element, deltaY)) return true;
+    element = element.parentElement;
+  }
+  return false;
+}
+
 export function useNearBottomAutoscroll<TElement extends HTMLElement>({
   followKey,
   streaming = false,
@@ -83,6 +118,9 @@ export function useNearBottomAutoscroll<TElement extends HTMLElement>({
     let lastScrollHeight = el.scrollHeight;
 
     const onWheel = (event: WheelEvent) => {
+      if (nestedScrollableConsumesVerticalIntent(event, el, event.deltaY)) {
+        return;
+      }
       if (event.deltaY < 0) detachFromBottom();
     };
 
@@ -95,7 +133,10 @@ export function useNearBottomAutoscroll<TElement extends HTMLElement>({
       if (nextTouchY == null) return;
       const lastTouchY = lastTouchYRef.current;
       if (lastTouchY != null && nextTouchY > lastTouchY) {
-        detachFromBottom();
+        const deltaY = lastTouchY - nextTouchY;
+        if (!nestedScrollableConsumesVerticalIntent(event, el, deltaY)) {
+          detachFromBottom();
+        }
       }
       lastTouchYRef.current = nextTouchY;
     };
@@ -104,7 +145,8 @@ export function useNearBottomAutoscroll<TElement extends HTMLElement>({
       lastTouchYRef.current = null;
     };
 
-    const onScroll = () => {
+    const onScroll = (event: Event) => {
+      if (event.target !== el) return;
       const previousScrollTop = lastScrollTopRef.current;
       const nextScrollTop = el.scrollTop;
       const nextScrollHeight = el.scrollHeight;
@@ -133,6 +175,7 @@ export function useNearBottomAutoscroll<TElement extends HTMLElement>({
         event.key === "Home" ||
         (event.key === " " && event.shiftKey)
       ) {
+        if (nestedScrollableConsumesVerticalIntent(event, el, -1)) return;
         detachFromBottom();
       }
     };

package/corpus/core/src/coding-tools/run-code.ts

@@ -75,6 +75,7 @@ export function createRunCodeEntry(
 
   return {
     readOnly: true,
+    allowInPlanMode: false,
     // Allow a generous per-call timeout so large data-processing jobs don't hit
     // the agent-loop's default 60 s cap.
     timeoutMs: MAX_TIMEOUT_MS,

package/corpus/core/src/integrations/webhook-handler.ts

@@ -36,7 +36,10 @@ import { isLocalDatabase } from "../db/client.js";
 import { resolveOrgIdForEmail } from "../org/context.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { FRAMEWORK_ROUTE_PREFIX } from "../server/core-routes-plugin.js";
-import { readDeployCredentialEnv } from "../server/credential-provider.js";
+import {
+  canUseDeployCredentialFallbackForRequest,
+  readDeployCredentialEnv,
+} from "../server/credential-provider.js";
 import { runWithRequestContext } from "../server/request-context.js";
 import { A2A_CONTINUATION_QUEUED_MARKER } from "./a2a-continuation-marker.js";
 import { signInternalToken } from "./internal-token.js";
@@ -128,11 +131,6 @@ function explicitEngineName(
   return undefined;
 }
 
-function isMultiTenantDeploy(): boolean {
-  if (process.env.NODE_ENV !== "production") return false;
-  return !isLocalDatabase();
-}
-
 function collectToolResultSummaries(
   completedRun: ActiveRun,
 ): A2AToolResultSummary[] {
@@ -142,23 +140,26 @@ function collectToolResultSummaries(
     .map((event) => ({ tool: event.tool, result: event.result }));
 }
 
-async function resolveIntegrationApiKey(
+export async function resolveIntegrationApiKey(
   engineOption: WebhookHandlerOptions["engine"],
   ownerEmail: string,
   fallbackApiKey: string,
 ): Promise<string | undefined> {
+  const canUseDeployFallback = canUseDeployCredentialFallbackForRequest();
   const engineName = explicitEngineName(engineOption);
   if (engineName) {
     const provider = engineToProvider(engineName);
     const userApiKey = await getOwnerApiKey(provider, ownerEmail);
-    if (userApiKey || isMultiTenantDeploy()) return userApiKey;
+    if (userApiKey) return userApiKey;
+    if (!canUseDeployFallback) return undefined;
     const envVar = PROVIDER_TO_ENV[provider];
     const providerEnvKey = envVar ? readDeployCredentialEnv(envVar) : undefined;
     return providerEnvKey || fallbackApiKey.trim() || undefined;
   }
 
   const userApiKey = await getOwnerActiveApiKey(ownerEmail);
-  if (userApiKey || isMultiTenantDeploy()) return userApiKey;
+  if (userApiKey) return userApiKey;
+  if (!canUseDeployFallback) return undefined;
   return fallbackApiKey.trim() || undefined;
 }
 

package/corpus/core/src/server/action-discovery.ts

@@ -186,6 +186,9 @@ function preserveActionFlags(entry: Record<string, any>): Partial<ActionEntry> {
     out.requiresAuth = entry.requiresAuth;
   }
   if (typeof entry.readOnly === "boolean") out.readOnly = entry.readOnly;
+  if (typeof entry.allowInPlanMode === "boolean") {
+    out.allowInPlanMode = entry.allowInPlanMode;
+  }
   if (typeof entry.parallelSafe === "boolean") {
     out.parallelSafe = entry.parallelSafe;
   }

package/corpus/core/src/server/credential-provider.ts

@@ -78,6 +78,10 @@ export function readDeployCredentialEnv(key: string): string | undefined {
  * single-tenant contexts. In hosted production with a shared database, every
  * signed-in user needs their own user/org/workspace credential so one deploy
  * key does not silently power another tenant's chat.
+ *
+ * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic
+ * provider secrets. This stricter helper remains for legacy call sites with
+ * identity-bearing deploy credentials.
  */
 export function isDeployCredentialFallbackAllowed(): boolean {
   if (!isProductionLikeRuntime()) return true;
@@ -86,9 +90,10 @@ export function isDeployCredentialFallbackAllowed(): boolean {
 
 export function canUseDeployCredentialFallbackForRequest(): boolean {
   const email = getRequestUserEmail();
-  if (email && isHostedWorkspaceRuntime()) return false;
   if (!email) return true;
-  return isDeployCredentialFallbackAllowed();
+  if (isHostedWorkspaceRuntime()) return false;
+  if (!isProductionLikeRuntime()) return true;
+  return isLocalDatabase();
 }
 
 const BUILDER_CREDENTIAL_KEYS = [
@@ -962,10 +967,10 @@ export async function resolveSecret(key: string): Promise<string | null> {
       }
       // Secrets table not ready — treat as missing.
     }
-    // Authenticated multi-tenant context: never fall back to process.env.
-    // The deploy-level value would silently impersonate the actual key
-    // owner across every tenant. Local/single-tenant deployments keep the
-    // original env fallback for BYO-server workflows.
+    // Read deployment-provided env values as fallbacks; framework code must not
+    // write to `process.env`, but keys supplied by the host remain valid config.
+    // Builder credentials keep a narrower path below because those keys carry a
+    // Builder identity rather than just enabling a provider call.
     const envFallback = (
       isBuilderCredentialKey(key)
         ? canUseBuilderDeployCredentialFallbackForRequest()

package/corpus/templates/analytics/.agents/skills/session-replay/SKILL.md

@@ -28,6 +28,14 @@ agent answers about browser recordings in the Analytics template.
   `session-recording` access before reading private blob refs.
 - SQL inline chunks are a local/dev fallback only; production should use
   private or encrypted blob storage.
+- When sharing a replay with an external agent, use
+  `create-session-replay-agent-link`. It mints a two-hour `agent_access` URL
+  scoped to the recording, embeds a small SSR discovery payload on
+  `/sessions/:recordingId`, and advertises
+  `/api/session-replay/agent-context.json` plus bounded
+  `/api/session-replay/agent-events.json` reads.
+- Do not make session recordings public just so an agent can inspect them.
+  Tokenized agent links are the intended handoff path.
 
 ## Capture Defaults
 

package/corpus/templates/analytics/AGENTS.md

@@ -148,6 +148,11 @@ details live in `.agents/skills/`.
   `get-session-replay-summary` and fetches rrweb payloads only through scoped
   chunk routes. Do not expose storage/provider URLs, raw chunk table access, or
   unscoped replay blobs in UI, actions, dashboards, docs, or prompts.
+- The session detail page can mint a temporary `Copy for agent` link through
+  `create-session-replay-agent-link`. That URL carries an `agent_access` token
+  scoped to one recording for two hours; SSR embeds an agent discovery payload
+  and the JSON APIs expose only summary/timeline metadata plus bounded event
+  reads.
 - Dashboard rows that include `recording_id` should link to
   `/sessions/:recordingId`; rows that only include `session_id` can link to a
   filtered `/sessions` search.

package/corpus/templates/analytics/actions/create-session-replay-agent-link.ts

@@ -0,0 +1,31 @@
+import { defineAction } from "@agent-native/core";
+import {
+  getRequestContext,
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+import { z } from "zod";
+
+import { createSessionReplayAgentLink } from "../server/lib/session-replay-agent-context.js";
+
+function resolveScope() {
+  const userEmail = getRequestUserEmail();
+  if (!userEmail) throw new Error("no authenticated user");
+  return { userEmail, orgId: getRequestOrgId() || null };
+}
+
+export default defineAction({
+  description:
+    "Create a temporary private agent-readable link for one Analytics session replay recording. The URL is scoped to that recording and expires after two hours.",
+  schema: z.object({
+    recordingId: z.string().describe("The session_recordings id"),
+  }),
+  readOnly: true,
+  run: async (args) => {
+    return createSessionReplayAgentLink({
+      recordingId: args.recordingId,
+      scope: resolveScope(),
+      origin: getRequestContext()?.requestOrigin,
+    });
+  },
+});

package/corpus/templates/analytics/app/i18n/zh-TW.ts

@@ -803,6 +803,8 @@ const messages = {
     emptyStepVisit: "存取應用",
     installSnippetTitle: "新增工作階段回放",
     backToSessions: "返回工作階段",
+    copyForAgent: "複製給 Agent",
+    copiedForAgent: "已複製",
     askAgent: "詢問代理此工作階段",
     askSessionTitle: "詢問此工作階段",
     askSessionDescription: "將此回放作為脈絡，向 Analytics 代理傳送聚焦提示。",

package/corpus/templates/analytics/app/i18n-data.ts

@@ -841,6 +841,8 @@ const enUS = {
     emptyStepVisit: "Visit app",
     installSnippetTitle: "Add session replay",
     backToSessions: "Back to sessions",
+    copyForAgent: "Copy for agent",
+    copiedForAgent: "Copied",
     askAgent: "Ask agent about this session",
     askSessionTitle: "Ask about this session",
     askSessionDescription:
@@ -6839,6 +6841,8 @@ const translatedAnalyticsDebtCorrections = {
       anyActivity: "أي نشاط",
       eventCountCompact: "{{count}} حدث",
       pageCountCompact: "{{count}} صفحة",
+      copyForAgent: "نسخ للوكيل",
+      copiedForAgent: "تم النسخ",
       askSessionTitle: "اسأل عن هذه الجلسة",
       askSessionDescription:
         "أرسل مطالبة مركزة إلى وكيل Analytics مع إرفاق هذا التسجيل كسياق.",
@@ -6869,6 +6873,8 @@ const translatedAnalyticsDebtCorrections = {
       anyActivity: "Beliebige Aktivität",
       eventCountCompact: "{{count}} Ereignisse",
       pageCountCompact: "{{count}} Seiten",
+      copyForAgent: "Für Agent kopieren",
+      copiedForAgent: "Kopiert",
       askSessionTitle: "Zu dieser Sitzung fragen",
       askSessionDescription:
         "Sende dem Analytics-Agenten eine gezielte Eingabe mit dieser Wiedergabe als Kontext.",
@@ -6894,6 +6900,8 @@ const translatedAnalyticsDebtCorrections = {
       anyActivity: "Cualquier actividad",
       eventCountCompact: "{{count}} eventos",
       pageCountCompact: "{{count}} páginas",
+      copyForAgent: "Copiar para agente",
+      copiedForAgent: "Copiado",
       askSessionTitle: "Preguntar sobre esta sesión",
       askSessionDescription:
         "Envía una pregunta enfocada al agente de Analytics con esta reproducción como contexto.",
@@ -6922,6 +6930,8 @@ const translatedAnalyticsDebtCorrections = {
       anyActivity: "Toute activité",
       eventCountCompact: "{{count}} événements",
       pageCountCompact: "{{count}} pages",
+      copyForAgent: "Copier pour l'agent",
+      copiedForAgent: "Copié",
       askSessionTitle: "Poser une question sur cette session",
       askSessionDescription:
         "Envoyez une question ciblée à l'agent Analytics avec cette relecture en contexte.",
@@ -6948,6 +6958,8 @@ const translatedAnalyticsDebtCorrections = {
       anyActivity: "कोई भी गतिविधि",
       eventCountCompact: "{{count}} इवेंट",
       pageCountCompact: "{{count}} पेज",
+      copyForAgent: "एजेंट के लिए कॉपी करें",
+      copiedForAgent: "कॉपी हो गया",
       askSessionTitle: "इस सत्र के बारे में पूछें",
       askSessionDescription:
         "इस रीप्ले को संदर्भ के रूप में जोड़कर Analytics एजेंट को केंद्रित प्रॉम्प्ट भेजें।",
@@ -6973,6 +6985,8 @@ const translatedAnalyticsDebtCorrections = {
       anyActivity: "任意のアクティビティ",
       eventCountCompact: "{{count}} 件のイベント",
       pageCountCompact: "{{count}} ページ",
+      copyForAgent: "エージェント用にコピー",
+      copiedForAgent: "コピーしました",
       askSessionTitle: "このセッションについて質問",
       askSessionDescription:
         "このリプレイをコンテキストとして添えて、Analytics エージェントに絞り込んだプロンプトを送信します。",
@@ -6998,6 +7012,8 @@ const translatedAnalyticsDebtCorrections = {
       anyActivity: "모든 활동",
       eventCountCompact: "{{count}}개 이벤트",
       pageCountCompact: "{{count}}개 페이지",
+      copyForAgent: "에이전트용으로 복사",
+      copiedForAgent: "복사됨",
       askSessionTitle: "이 세션에 대해 질문",
       askSessionDescription:
         "이 리플레이를 컨텍스트로 첨부해 Analytics 에이전트에 집중된 프롬프트를 보냅니다.",
@@ -7023,6 +7039,8 @@ const translatedAnalyticsDebtCorrections = {
       anyActivity: "Qualquer atividade",
       eventCountCompact: "{{count}} eventos",
       pageCountCompact: "{{count}} páginas",
+      copyForAgent: "Copiar para agente",
+      copiedForAgent: "Copiado",
       askSessionTitle: "Perguntar sobre esta sessão",
       askSessionDescription:
         "Envie um prompt focado ao agente de Analytics com este replay como contexto.",
@@ -7048,6 +7066,8 @@ const translatedAnalyticsDebtCorrections = {
       anyActivity: "任意活动",
       eventCountCompact: "{{count}} 个事件",
       pageCountCompact: "{{count}} 个页面",
+      copyForAgent: "复制给代理",
+      copiedForAgent: "已复制",
       askSessionTitle: "询问此会话",
       askSessionDescription:
         "将此回放作为上下文，向 Analytics 代理发送聚焦提示。",

package/corpus/templates/analytics/app/pages/sessions/SessionDetailPage.tsx

@@ -1,11 +1,16 @@
 import {
   appApiPath,
   PromptComposer,
+  useActionMutation,
+  useActionQuery,
   useSendToAgentChat,
   useT,
 } from "@agent-native/core/client";
+import { SESSION_REPLAY_AGENT_ACCESS_PARAM } from "@shared/session-replay-agent-access";
 import {
   IconArrowLeft,
+  IconCheck,
+  IconCopy,
   IconExclamationCircle,
   IconKeyboard,
   IconMessageCircle,
@@ -201,7 +206,12 @@ export default function SessionDetailPage() {
             </div>
           ) : null}
         </div>
-        {recording ? <AskSessionPopover recording={recording} /> : null}
+        {recording ? (
+          <div className="flex shrink-0 items-center gap-2">
+            <CopySessionForAgentButton recordingId={recording.id} />
+            <AskSessionPopover recording={recording} />
+          </div>
+        ) : null}
       </div>
 
       {error ? (
@@ -224,6 +234,41 @@ export default function SessionDetailPage() {
   );
 }
 
+function CopySessionForAgentButton({ recordingId }: { recordingId: string }) {
+  const t = useT();
+  const [copied, setCopied] = useState(false);
+  const createLink = useActionMutation(
+    "create-session-replay-agent-link" as any,
+  );
+
+  async function handleCopy() {
+    if (createLink.isPending) return;
+    const result = (await createLink.mutateAsync({
+      recordingId,
+    })) as { url?: string };
+    if (!result?.url) return;
+    await navigator.clipboard.writeText(result.url).catch(() => {});
+    setCopied(true);
+    setTimeout(() => setCopied(false), 1400);
+  }
+
+  return (
+    <Button
+      type="button"
+      variant="outline"
+      onClick={() => void handleCopy()}
+      disabled={createLink.isPending}
+    >
+      {copied ? (
+        <IconCheck className="h-4 w-4" />
+      ) : (
+        <IconCopy className="h-4 w-4" />
+      )}
+      {copied ? t("sessions.copiedForAgent") : t("sessions.copyForAgent")}
+    </Button>
+  );
+}
+
 function AskSessionPopover({
   recording,
 }: {
@@ -976,8 +1021,9 @@ function DetailSkeleton() {
 }
 
 function useSessionReplayPlayback(recordingId: string) {
+  const agentAccessToken = currentSessionReplayAgentAccessToken();
   return useQuery({
-    queryKey: ["session-replay-playback", recordingId],
+    queryKey: ["session-replay-playback", recordingId, agentAccessToken],
     enabled: Boolean(recordingId),
     staleTime: 30_000,
     gcTime: 60_000,
@@ -1080,9 +1126,25 @@ function replayUnavailableChunk(
   };
 }
 
+function currentSessionReplayAgentAccessToken(): string {
+  const browserSearch =
+    typeof window === "undefined" ? "" : window.location.search;
+  return (
+    new URLSearchParams(browserSearch).get(SESSION_REPLAY_AGENT_ACCESS_PARAM) ??
+    ""
+  );
+}
+
 async function fetchReplayApi(path: string): Promise<Response> {
   const token = await getIdToken();
-  return fetch(appApiPath(path), {
+  const browserOrigin =
+    typeof window === "undefined" ? "http://localhost" : window.location.origin;
+  const url = new URL(appApiPath(path), browserOrigin);
+  const agentAccessToken = currentSessionReplayAgentAccessToken();
+  if (agentAccessToken) {
+    url.searchParams.set(SESSION_REPLAY_AGENT_ACCESS_PARAM, agentAccessToken);
+  }
+  return fetch(`${url.pathname}${url.search}${url.hash}`, {
     headers: {
       Accept: "application/json",
       ...(token ? { Authorization: `Bearer ${token}` } : {}),

package/corpus/templates/analytics/changelog/2026-07-02-session-replays-can-be-copied-as-temporary-private-links-for-agents.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-07-02
+---
+
+Session replays can be copied as temporary private links for agents.