@agent-native/core 0.88.0 → 0.90.1

package/corpus/templates/clips/server/lib/calendar-event-meetings.ts

@@ -2,12 +2,13 @@ import { Buffer } from "node:buffer";
 
 import { readAppSecret, writeAppSecret } from "@agent-native/core/secrets";
 import { resolveAccess } from "@agent-native/core/sharing";
-import { and, eq } from "drizzle-orm";
+import { and, eq, isNull } from "drizzle-orm";
 
 import { getDb, schema } from "../db/index.js";
 import {
   detectPlatform,
   getEvent,
+  isPermanentRefreshFailure,
   pickJoinUrl,
   resolveGoogleOAuthCredentialCandidates,
   refreshAccessTokenWithFallback,
@@ -118,17 +119,13 @@ export async function resolveCalendarAccessToken(
       refreshToken: refreshSecret.value,
       credentials: credentialCandidates,
     });
-  } catch {
-    // TODO(needs-reauth classification): a transient refresh failure (network
-    // error / 5xx / timeout) is indistinguishable here from a permanent one
-    // (invalid_grant / invalid_token / unauthorized): both surface to the
-    // caller as a bare `null`, which the caller translates to
-    // `new Error("Token refresh failed")` -> shouldMarkNeedsReauth -> the
-    // account is flagged "needs-reauth" even on a blip. Distinguishing the two
-    // safely would require either changing this function's return contract or
-    // moving error recording out of the callers (a caller-contract change),
-    // both of which are out of scope, so we leave the existing behavior intact.
-    return null;
+  } catch (err) {
+    // Only a permanent failure (dead refresh token / bad OAuth client) means
+    // "needs-reauth" — collapse those to `null` as before. A transient
+    // failure (network error, 429, 5xx, timeout) is rethrown so callers can
+    // record it as a soft sync error without flipping account status.
+    if (isPermanentRefreshFailure(err)) return null;
+    throw err;
   }
   if (!refreshed.access_token) return null;
   if (account.accessTokenSecretRef) {
@@ -291,7 +288,15 @@ export async function fetchLiveCalendarEventFromId(virtualId: string) {
     .limit(1);
   if (!account || account.provider !== "google") return null;
 
-  const accessToken = await resolveCalendarAccessToken(account);
+  let accessToken: string | null;
+  try {
+    accessToken = await resolveCalendarAccessToken(account);
+  } catch (err) {
+    // Transient refresh failure — record the real error (won't match
+    // shouldMarkNeedsReauth) instead of a permanent needs-reauth marker.
+    await recordCalendarFetchError(account, err);
+    return null;
+  }
   if (!accessToken) {
     await recordCalendarFetchError(account, new Error("Token refresh failed"));
     return null;
@@ -408,52 +413,98 @@ export async function materializeCalendarMeetingFromVirtualId(
   const joinUrl = pickJoinUrl(live.event);
   const meetingId = nanoid();
   const nowIso = new Date().toISOString();
-  await db.insert(schema.meetings).values({
-    id: meetingId,
-    organizationId: orgId ?? live.account.orgId ?? null,
-    title: live.event.summary || "Untitled meeting",
-    scheduledStart: eventStartIso(live.event),
-    scheduledEnd: eventEndIso(live.event),
-    actualStart: null,
-    actualEnd: null,
-    platform: detectPlatform(joinUrl),
-    joinUrl: joinUrl ?? null,
-    calendarEventId: snapshot.id,
-    recordingId: null,
-    transcriptStatus: "idle",
-    summaryMd: "",
-    bulletsJson: "[]",
-    actionItemsJson: "[]",
-    source: "calendar",
-    reminderFiredAt: null,
-    createdAt: nowIso,
-    updatedAt: nowIso,
-    ownerEmail,
-    orgId,
-    visibility: "private",
-  } as any);
-
-  const participants = calendarEventParticipants(live.event).filter(
-    (p) => p.email,
-  );
-  if (participants.length) {
-    await db.insert(schema.meetingParticipants).values(
-      participants.map((p) => ({
-        id: nanoid(),
-        meetingId,
-        email: p.email,
-        name: p.name ?? null,
-        isOrganizer: !!p.isOrganizer,
-        attendedAt: null,
-        createdAt: nowIso,
-      })) as any,
-    );
-  }
 
-  await db
+  // Claim the calendar_events row atomically before inserting the meeting
+  // row, so two concurrent materialize calls for the same event can't both
+  // insert a `meetings` row (check-then-act TOCTOU). Only the caller whose
+  // UPDATE actually matched a row (meetingId still NULL) proceeds to insert;
+  // the loser re-reads and returns the winner's meeting instead.
+  const claimed = await db
     .update(schema.calendarEvents)
     .set({ meetingId, updatedAt: nowIso })
-    .where(eq(schema.calendarEvents.id, snapshot.id));
+    .where(
+      and(
+        eq(schema.calendarEvents.id, snapshot.id),
+        isNull(schema.calendarEvents.meetingId),
+      ),
+    )
+    .returning({ id: schema.calendarEvents.id });
+
+  if (!claimed.length) {
+    // Someone else claimed it first — re-read and return their meeting.
+    const [winnerEvent] = await db
+      .select({ meetingId: schema.calendarEvents.meetingId })
+      .from(schema.calendarEvents)
+      .where(eq(schema.calendarEvents.id, snapshot.id))
+      .limit(1);
+    if (winnerEvent?.meetingId) {
+      const [winnerMeeting] = await db
+        .select()
+        .from(schema.meetings)
+        .where(eq(schema.meetings.id, winnerEvent.meetingId))
+        .limit(1);
+      if (winnerMeeting) return { meeting: winnerMeeting, created: false };
+    }
+    return null;
+  }
+
+  try {
+    await db.insert(schema.meetings).values({
+      id: meetingId,
+      organizationId: orgId ?? live.account.orgId ?? null,
+      title: live.event.summary || "Untitled meeting",
+      scheduledStart: eventStartIso(live.event),
+      scheduledEnd: eventEndIso(live.event),
+      actualStart: null,
+      actualEnd: null,
+      platform: detectPlatform(joinUrl),
+      joinUrl: joinUrl ?? null,
+      calendarEventId: snapshot.id,
+      recordingId: null,
+      transcriptStatus: "idle",
+      summaryMd: "",
+      bulletsJson: "[]",
+      actionItemsJson: "[]",
+      source: "calendar",
+      reminderFiredAt: null,
+      createdAt: nowIso,
+      updatedAt: nowIso,
+      ownerEmail,
+      orgId,
+      visibility: "private",
+    } as any);
+
+    const participants = calendarEventParticipants(live.event).filter(
+      (p) => p.email,
+    );
+    if (participants.length) {
+      await db.insert(schema.meetingParticipants).values(
+        participants.map((p) => ({
+          id: nanoid(),
+          meetingId,
+          email: p.email,
+          name: p.name ?? null,
+          isOrganizer: !!p.isOrganizer,
+          attendedAt: null,
+          createdAt: nowIso,
+        })) as any,
+      );
+    }
+  } catch (err) {
+    // Roll back the claim so a future call can retry — but only if it still
+    // points at our own meetingId (don't clobber a legitimate later claim).
+    await db
+      .update(schema.calendarEvents)
+      .set({ meetingId: null, updatedAt: new Date().toISOString() })
+      .where(
+        and(
+          eq(schema.calendarEvents.id, snapshot.id),
+          eq(schema.calendarEvents.meetingId, meetingId),
+        ),
+      )
+      .catch(() => {});
+    throw err;
+  }
 
   const [meeting] = await db
     .select()

package/corpus/templates/clips/server/lib/env-flags.ts

@@ -0,0 +1,4 @@
+export function enabledFlag(value: string | null | undefined): boolean {
+  const flag = (value ?? "").trim().toLowerCase();
+  return flag === "true" || flag === "1" || flag === "yes" || flag === "on";
+}

package/corpus/templates/clips/server/lib/google-calendar-client.ts

@@ -158,7 +158,14 @@ export async function refreshAccessToken(args: {
   return (await res.json()) as GoogleTokenResponse;
 }
 
-function isPermanentRefreshFailure(error: unknown): boolean {
+/**
+ * True when a refresh-token-endpoint failure is permanent (the refresh token
+ * itself is dead — revoked, expired, or the OAuth client is wrong) rather
+ * than transient (network error, 429, 5xx, timeout). Only permanent
+ * failures should ever flip a calendar account to "needs-reauth"; transient
+ * ones should be recorded as a sync error and retried on the next poll.
+ */
+export function isPermanentRefreshFailure(error: unknown): boolean {
   const message = error instanceof Error ? error.message : String(error || "");
   const lower = message.toLowerCase();
   return (

package/corpus/templates/clips/server/lib/media-worker.ts

@@ -0,0 +1,153 @@
+import { resolveSecret } from "@agent-native/core/server";
+
+import {
+  MEDIA_WORKER_SIGNATURE_HEADER,
+  MEDIA_WORKER_TIMESTAMP_HEADER,
+  type MediaWorkerJob,
+  signMediaWorkerPayload,
+} from "../../shared/media-worker-contract.js";
+import { enabledFlag } from "./env-flags.js";
+
+export const CLIPS_MEDIA_WORKER_ENABLED = "CLIPS_MEDIA_WORKER_ENABLED";
+export const CLIPS_MEDIA_WORKER_URL = "CLIPS_MEDIA_WORKER_URL";
+export const CLIPS_MEDIA_WORKER_SECRET = "CLIPS_MEDIA_WORKER_SECRET";
+
+const ENQUEUE_TIMEOUT_MS = 15_000;
+
+export type MediaWorkerConfig =
+  | { enabled: false }
+  | {
+      enabled: true;
+      ready: false;
+      reason: string;
+    }
+  | {
+      enabled: true;
+      ready: true;
+      url: string;
+      secret: string;
+      callbackUrl: string;
+    };
+
+async function resolveWorkerValue(key: string): Promise<string | null> {
+  return (await resolveSecret(key).catch(() => null)) ?? null;
+}
+
+function appBaseUrl(): string | null {
+  const raw =
+    process.env.APP_URL ||
+    process.env.BETTER_AUTH_URL ||
+    process.env.URL ||
+    process.env.DEPLOY_URL ||
+    "";
+  const trimmed = raw.trim().replace(/\/+$/, "");
+  if (!trimmed) return null;
+  try {
+    return new URL(trimmed).origin;
+  } catch {
+    return null;
+  }
+}
+
+function appPath(path: string): string {
+  const raw = process.env.VITE_APP_BASE_PATH || process.env.APP_BASE_PATH || "";
+  const base = raw.trim().replace(/^\/+/, "").replace(/\/+$/, "");
+  return base ? `/${base}${path}` : path;
+}
+
+function callbackUrl(): string | null {
+  const base = appBaseUrl();
+  if (!base) return null;
+  return `${base}${appPath("/api/media-worker/callback")}`;
+}
+
+export async function resolveMediaWorkerConfig(): Promise<MediaWorkerConfig> {
+  const enabledRaw = await resolveWorkerValue(CLIPS_MEDIA_WORKER_ENABLED);
+  if (!enabledFlag(enabledRaw)) return { enabled: false };
+
+  const [urlRaw, secretRaw] = await Promise.all([
+    resolveWorkerValue(CLIPS_MEDIA_WORKER_URL),
+    resolveWorkerValue(CLIPS_MEDIA_WORKER_SECRET),
+  ]);
+  const url = urlRaw?.trim() ?? "";
+  const secret = secretRaw?.trim() ?? "";
+  if (!url || !secret) {
+    return {
+      enabled: true,
+      ready: false,
+      reason:
+        "CLIPS_MEDIA_WORKER_URL and CLIPS_MEDIA_WORKER_SECRET are required",
+    };
+  }
+  try {
+    new URL(url);
+  } catch {
+    return {
+      enabled: true,
+      ready: false,
+      reason: "CLIPS_MEDIA_WORKER_URL must be an absolute URL",
+    };
+  }
+
+  const cb = callbackUrl();
+  if (!cb) {
+    return {
+      enabled: true,
+      ready: false,
+      reason:
+        "APP_URL or BETTER_AUTH_URL is required to build the media worker callback URL",
+    };
+  }
+
+  return { enabled: true, ready: true, url, secret, callbackUrl: cb };
+}
+
+export function mediaWorkerCompressionJobId(recordingId: string): string {
+  return `${recordingId}:compress`;
+}
+
+export function mediaWorkerJobRecordingId(
+  jobId: string,
+  kind: MediaWorkerJob["kind"] = "compress",
+): string | null {
+  const suffix = `:${kind}`;
+  if (!jobId.endsWith(suffix)) return null;
+  const recordingId = jobId.slice(0, -suffix.length);
+  return recordingId || null;
+}
+
+function fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), ENQUEUE_TIMEOUT_MS);
+  return fetch(url, { ...init, signal: controller.signal }).finally(() =>
+    clearTimeout(timer),
+  );
+}
+
+export async function enqueueMediaWorkerJob(
+  config: Extract<MediaWorkerConfig, { ready: true }>,
+  job: MediaWorkerJob,
+): Promise<void> {
+  const rawBody = JSON.stringify(job);
+  const signatureHeaders = signMediaWorkerPayload({
+    rawBody,
+    secret: config.secret,
+  });
+  const res = await fetchWithTimeout(config.url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      [MEDIA_WORKER_TIMESTAMP_HEADER]:
+        signatureHeaders[MEDIA_WORKER_TIMESTAMP_HEADER],
+      [MEDIA_WORKER_SIGNATURE_HEADER]:
+        signatureHeaders[MEDIA_WORKER_SIGNATURE_HEADER],
+    },
+    body: rawBody,
+  });
+  if (!res.ok) {
+    const body = await res.text().catch(() => "");
+    throw new Error(
+      `Media worker enqueue failed (${res.status}): ${body.slice(0, 500) || res.statusText}`,
+    );
+  }
+}

package/corpus/templates/clips/server/lib/s3-upload-provider.ts

@@ -32,6 +32,39 @@ function cleanValue(value: string | null | undefined): string | undefined {
   return cleaned ? cleaned : undefined;
 }
 
+// A hung S3-compatible endpoint (flaky VPN, misconfigured security group that
+// accepts the TCP connection but never responds, etc.) would otherwise leave
+// finalize-recording — and the request that triggered it — waiting forever.
+// PUT gets a generous budget since it uploads the full recording; DELETE is a
+// small best-effort cleanup call and can fail fast.
+const S3_PUT_TIMEOUT_MS = 120_000;
+const S3_DELETE_TIMEOUT_MS = 30_000;
+
+async function fetchWithTimeout(
+  url: string,
+  init: RequestInit,
+  timeoutMs: number,
+): Promise<Response> {
+  try {
+    return await fetch(url, {
+      ...init,
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (err) {
+    if (err instanceof Error && err.name === "TimeoutError") {
+      throw new Error(
+        `S3 request timed out after ${timeoutMs}ms: ${init.method ?? "GET"} ${url}`,
+      );
+    }
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(
+        `S3 request aborted (timeout ${timeoutMs}ms): ${init.method ?? "GET"} ${url}`,
+      );
+    }
+    throw err;
+  }
+}
+
 function buildS3Config(values: {
   bucket?: string;
   accessKeyId?: string;
@@ -202,18 +235,22 @@ async function putObject(
     `SignedHeaders=${signedHeaders}, Signature=${signature}`;
 
   const url = `${cfg.endpoint}${canonicalUri}`;
-  const res = await fetch(url, {
-    method: "PUT",
-    headers: {
-      ...headers,
-      Authorization: authorization,
-      "Content-Length": String(body.byteLength),
+  const res = await fetchWithTimeout(
+    url,
+    {
+      method: "PUT",
+      headers: {
+        ...headers,
+        Authorization: authorization,
+        "Content-Length": String(body.byteLength),
+      },
+      body: body.buffer.slice(
+        body.byteOffset,
+        body.byteOffset + body.byteLength,
+      ) as BodyInit,
     },
-    body: body.buffer.slice(
-      body.byteOffset,
-      body.byteOffset + body.byteLength,
-    ) as BodyInit,
-  });
+    S3_PUT_TIMEOUT_MS,
+  );
 
   if (!res.ok) {
     const text = await res.text().catch(() => "");
@@ -328,13 +365,17 @@ async function deleteObject(cfg: S3Config, key: string): Promise<void> {
     `SignedHeaders=${signedHeaders}, Signature=${signature}`;
 
   const url = `${cfg.endpoint}${canonicalUri}`;
-  const res = await fetch(url, {
-    method: "DELETE",
-    headers: {
-      ...headers,
-      Authorization: authorization,
+  const res = await fetchWithTimeout(
+    url,
+    {
+      method: "DELETE",
+      headers: {
+        ...headers,
+        Authorization: authorization,
+      },
     },
-  });
+    S3_DELETE_TIMEOUT_MS,
+  );
 
   if (!res.ok && res.status !== 404) {
     const text = await res.text().catch(() => "");

package/corpus/templates/clips/server/lib/streaming-upload-mode.ts

@@ -1,7 +1,19 @@
-// Temporary kill switch: streaming resumable uploads caused a spike of
-// recording issues. Set CLIPS_DISABLE_STREAMING_UPLOAD=false to re-enable
-// once the root cause is fixed. Defaults to disabled (streaming off).
+import { enabledFlag } from "./env-flags.js";
+
+// Streaming resumable uploads are deployment opt-in while the provider/finalize
+// path hardens. Set CLIPS_ENABLE_STREAMING_UPLOAD=1 to allow recorder requests;
+// CLIPS_DISABLE_STREAMING_UPLOAD=1 still forces the buffered fallback.
 export function isStreamingUploadDisabled(): boolean {
-  const flag = process.env.CLIPS_DISABLE_STREAMING_UPLOAD ?? "";
-  return flag.toLowerCase() !== "false";
+  return enabledFlag(process.env.CLIPS_DISABLE_STREAMING_UPLOAD);
+}
+
+export function shouldEnableStreamingUpload(args: {
+  client?: string | null;
+  mimeType?: string | null;
+}): boolean {
+  if (isStreamingUploadDisabled()) return false;
+  if (!enabledFlag(process.env.CLIPS_ENABLE_STREAMING_UPLOAD)) return false;
+
+  const mimeType = (args.mimeType ?? "").split(";")[0]?.trim().toLowerCase();
+  return !mimeType || mimeType.startsWith("video/");
 }

package/corpus/templates/clips/server/lib/video-remux.ts

@@ -107,6 +107,96 @@ async function runFfmpeg(args: string[]): Promise<void> {
   });
 }
 
+const PROBE_TIMEOUT_MS = 20_000;
+// Demuxer stream listing happens at container-open time regardless of how
+// much we ask ffmpeg to process, so bounding the probe to a fraction of a
+// second of stream-copy keeps this cheap even for multi-gigabyte recordings.
+const PROBE_DURATION_SECONDS = "0.1";
+
+/**
+ * Best-effort probe for whether a media file has at least one audio stream.
+ * Returns `null` (unknown) when ffmpeg is unavailable or the probe itself
+ * fails — callers should treat `null` as "couldn't verify" and skip any
+ * check that depends on the answer, never as "no audio".
+ */
+export async function probeHasAudioStream(
+  mediaBytes: Uint8Array,
+  extension: "webm" | "mp4",
+): Promise<boolean | null> {
+  if (mediaBytes.byteLength === 0) return null;
+  if (!isFfmpegAvailable()) return null;
+
+  const dir = await mkdtemp(join(tmpdir(), "clips-audio-probe-"));
+  const inputPath = join(dir, `input.${extension}`);
+
+  try {
+    await writeFile(inputPath, mediaBytes);
+    const stderr = await new Promise<string>((resolve, reject) => {
+      const child = spawn(
+        ffmpegCommand(),
+        [
+          "-hide_banner",
+          "-nostdin",
+          "-i",
+          inputPath,
+          "-t",
+          PROBE_DURATION_SECONDS,
+          "-map",
+          "0",
+          "-c",
+          "copy",
+          "-f",
+          "null",
+          "-",
+        ],
+        { stdio: ["ignore", "ignore", "pipe"] },
+      );
+      let buf = "";
+      const timeout = setTimeout(() => {
+        child.kill("SIGKILL");
+        reject(new Error(`ffmpeg audio probe timed out\n${buf}`));
+      }, PROBE_TIMEOUT_MS);
+      child.stderr?.on("data", (chunk: Buffer) => {
+        // Keep the HEAD of stderr, not the tail: ffmpeg prints the input
+        // stream listing (what we grep for below) at container-open time,
+        // before any per-frame warnings. Unlike `runFfmpeg`'s error-diagnostic
+        // tail-window, truncating from the end here risks scrolling the
+        // `Stream #...: Audio:` line out of the buffer on a warning-heavy input.
+        if (buf.length < STDERR_LIMIT) {
+          buf += chunk.toString("utf8");
+        }
+      });
+      child.on("error", (err) => {
+        clearTimeout(timeout);
+        reject(new Error(`${err.message}\n${buf}`));
+      });
+      child.on("close", () => {
+        // A non-zero exit is expected here for some malformed/edge inputs
+        // even when the stream listing itself printed fine — this is a
+        // probe, not a correctness check, so we still inspect stderr for
+        // the stream listing rather than rejecting on exit code.
+        clearTimeout(timeout);
+        resolve(buf);
+      });
+    });
+    // Require positive proof the demuxer actually opened the container
+    // (found at least one stream of any kind) before trusting a "no audio"
+    // reading — an unreadable/corrupt file (bad data, unknown format) also
+    // prints no `Stream #...: Audio:` line, but that means "couldn't verify",
+    // not "confirmed no audio". Only a file ffmpeg could actually demux earns
+    // a definite `false`.
+    if (!/Stream #\d+:\d+/i.test(stderr)) return null;
+    return /Stream #\d+:\d+.*: ?Audio:/i.test(stderr);
+  } catch (err) {
+    console.warn("[video-remux] audio-stream probe failed, skipping check", {
+      err: err instanceof Error ? err.message : String(err),
+    });
+    return null;
+  } finally {
+    await rm(dir, { recursive: true, force: true }).catch(() => {});
+  }
+}
+
 async function withRemuxSlot<T>(fn: () => Promise<T>): Promise<T> {
   if (activeRemuxes >= MAX_CONCURRENT_REMUXES) {
     await new Promise<void>((resolve) => remuxWaiters.push(resolve));

package/corpus/templates/clips/server/plugins/calendar-jobs.ts

@@ -5,13 +5,17 @@
  * pattern).
  */
 
+import registerBuilderMediaCompressionJob from "../jobs/builder-media-compression.js";
 import registerMeetingRemindersJob from "../jobs/meeting-reminders.js";
 import registerPollCalendarsJob from "../jobs/poll-calendars.js";
+import registerStaleMeetingSweeperJob from "../jobs/stale-meeting-sweeper.js";
 
 export default () => {
   // The reminder job registers the `meeting-reminder` event on every
   // boot (idempotent), so other consumers can subscribe even when the
   // background loop is off.
   registerMeetingRemindersJob();
+  registerBuilderMediaCompressionJob();
   registerPollCalendarsJob();
+  registerStaleMeetingSweeperJob();
 };