@agent-native/core 0.92.0 → 0.92.1

package/corpus/templates/analytics/server/lib/error-capture.ts

@@ -1,3 +1,7 @@
+import { stat, readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
 /**
  * Server-side error capture — OWNED BY THE ERROR CAPTURE FEATURE.
  *
@@ -58,6 +62,10 @@ const DEFAULT_ISSUE_LIMIT = 50;
 const MAX_ISSUE_LIMIT = 100;
 const DEFAULT_EVENTS_PER_ISSUE_READ = 50;
 const SPARKLINE_DAYS = 14;
+const SOURCE_CONTEXT_BEFORE = 4;
+const SOURCE_CONTEXT_AFTER = 4;
+const MAX_SOURCE_CONTEXT_FILE_BYTES = 2_000_000;
+const MAX_SOURCE_CONTEXT_LINE_CHARS = 500;
 
 // ---------------------------------------------------------------------------
 // Pure helpers (unit tested)
@@ -70,6 +78,13 @@ export interface ParsedStackFrame {
   colno: number | null;
   inApp: boolean;
   raw: string;
+  sourceContext?: SourceContextLine[];
+}
+
+export interface SourceContextLine {
+  line: number;
+  text: string;
+  highlight: boolean;
 }
 
 const VENDOR_FILE_RE =
@@ -179,6 +194,172 @@ export function parseStack(
   return frames;
 }
 
+export function sourceContextFromText(
+  source: string,
+  lineNumber: number | null | undefined,
+  options: { before?: number; after?: number } = {},
+): SourceContextLine[] | null {
+  if (!lineNumber || lineNumber < 1) return null;
+  const lines = source.split(/\r?\n/);
+  if (lineNumber > lines.length) return null;
+  const before = options.before ?? SOURCE_CONTEXT_BEFORE;
+  const after = options.after ?? SOURCE_CONTEXT_AFTER;
+  const start = Math.max(1, lineNumber - before);
+  const end = Math.min(lines.length, lineNumber + after);
+  const context: SourceContextLine[] = [];
+  for (let line = start; line <= end; line += 1) {
+    const text = lines[line - 1] ?? "";
+    context.push({
+      line,
+      text:
+        text.length > MAX_SOURCE_CONTEXT_LINE_CHARS
+          ? `${text.slice(0, MAX_SOURCE_CONTEXT_LINE_CHARS)}…`
+          : text,
+      highlight: line === lineNumber,
+    });
+  }
+  return context;
+}
+
+const SOURCE_EXT_RE = /\.(?:[cm]?[jt]sx?|vue|svelte|css|scss|json)$/i;
+const SOURCE_CONTEXT_ALLOWED_PREFIXES = ["app/"] as const;
+
+function templateRootFrom(value: string): string | null {
+  const marker = `${path.sep}templates${path.sep}analytics`;
+  const index = value.indexOf(marker);
+  if (index < 0) return null;
+  return value.slice(0, index + marker.length);
+}
+
+function sourceRoots(): string[] {
+  const roots = new Set<string>();
+  const cwdTemplateRoot = templateRootFrom(process.cwd());
+  roots.add(cwdTemplateRoot ?? process.cwd());
+  try {
+    const modulePath = fileURLToPath(import.meta.url);
+    const moduleTemplateRoot = templateRootFrom(modulePath);
+    if (moduleTemplateRoot) roots.add(moduleTemplateRoot);
+  } catch {
+    // import.meta.url is always file: in Node, but source context is best-effort.
+  }
+  return Array.from(roots).map((root) => path.resolve(root));
+}
+
+function isWithinRoot(candidate: string, root: string): boolean {
+  const relative = path.relative(root, candidate);
+  return (
+    relative === "" ||
+    (!relative.startsWith("..") && !path.isAbsolute(relative))
+  );
+}
+
+function cleanFrameFile(file: string | null): string | null {
+  if (!file) return null;
+  let cleaned = file.trim();
+  if (!cleaned || cleaned === "<anonymous>" || cleaned === "[native code]") {
+    return null;
+  }
+  if (/^https?:\/\//i.test(cleaned)) {
+    try {
+      cleaned = new URL(cleaned).pathname;
+    } catch {
+      return null;
+    }
+  } else if (cleaned.startsWith("file://")) {
+    try {
+      cleaned = fileURLToPath(cleaned);
+    } catch {
+      return null;
+    }
+  }
+  cleaned = cleaned.replace(/[?#].*$/, "");
+  try {
+    cleaned = decodeURIComponent(cleaned);
+  } catch {
+    // Keep the original path when a browser stack includes malformed escapes.
+  }
+  return cleaned;
+}
+
+export function trustedSourceRelativePath(cleaned: string): string | null {
+  const normalized = cleaned.replace(/\\/g, "/").replace(/^\/+/, "");
+  if (
+    !normalized ||
+    normalized.startsWith("../") ||
+    normalized.includes("/../")
+  ) {
+    return null;
+  }
+  if (
+    !SOURCE_CONTEXT_ALLOWED_PREFIXES.some((prefix) =>
+      normalized.startsWith(prefix),
+    )
+  ) {
+    return null;
+  }
+  return normalized;
+}
+
+async function resolveSourcePath(
+  frame: ParsedStackFrame,
+): Promise<string | null> {
+  if (!frame.inApp) return null;
+  const cleaned = cleanFrameFile(frame.file);
+  if (!cleaned || !SOURCE_EXT_RE.test(cleaned)) return null;
+  const relativePath = trustedSourceRelativePath(cleaned);
+  if (!relativePath) return null;
+  const roots = sourceRoots();
+  const candidates = new Set<string>();
+  for (const root of roots) candidates.add(path.resolve(root, relativePath));
+
+  for (const candidate of candidates) {
+    if (!roots.some((root) => isWithinRoot(candidate, root))) continue;
+    try {
+      const fileStat = await stat(candidate);
+      if (
+        fileStat.isFile() &&
+        fileStat.size > 0 &&
+        fileStat.size <= MAX_SOURCE_CONTEXT_FILE_BYTES
+      ) {
+        return candidate;
+      }
+    } catch {
+      // Try the next candidate.
+    }
+  }
+  return null;
+}
+
+async function sourceContextForFrame(
+  frame: ParsedStackFrame,
+): Promise<SourceContextLine[] | undefined> {
+  if (!frame.lineno) return undefined;
+  const sourcePath = await resolveSourcePath(frame);
+  if (!sourcePath) return undefined;
+  try {
+    const source = await readFile(sourcePath, "utf8");
+    return (
+      sourceContextFromText(source, frame.lineno, {
+        before: SOURCE_CONTEXT_BEFORE,
+        after: SOURCE_CONTEXT_AFTER,
+      }) ?? undefined
+    );
+  } catch {
+    return undefined;
+  }
+}
+
+async function addSourceContexts(
+  frames: ParsedStackFrame[],
+): Promise<ParsedStackFrame[]> {
+  return Promise.all(
+    frames.map(async (frame) => {
+      const sourceContext = await sourceContextForFrame(frame);
+      return sourceContext?.length ? { ...frame, sourceContext } : frame;
+    }),
+  );
+}
+
 /** Strip content hashes + query/hash from a filename for stable grouping. */
 export function normalizeFrameFile(file: string | null): string {
   if (!file) return "";
@@ -1031,6 +1212,7 @@ export interface ErrorEventDetail {
   culprit: string | null;
   level: ExceptionLevel;
   stack: ParsedStackFrame[];
+  rawStack: string | null;
   handled: boolean;
   url: string | null;
   userId: string | null;
@@ -1164,42 +1346,55 @@ export async function getErrorIssue(
   );
 
   const sessions = new Map<string, { recordingId: string; path: string }>();
-  const events: ErrorEventDetail[] = eventRows.map((row: any) => {
-    let recordingId: string | null = null;
-    if (row.sessionRecordingId && byId.has(row.sessionRecordingId)) {
-      recordingId = row.sessionRecordingId;
-    } else if (row.clientRecordingId && byClientId.has(row.clientRecordingId)) {
-      recordingId = byClientId.get(row.clientRecordingId) ?? null;
-    }
-    if (recordingId && !sessions.has(recordingId)) {
-      sessions.set(recordingId, {
-        recordingId,
-        path: `/sessions/${recordingId}`,
-      });
-    }
-    return {
-      id: row.id,
-      type: row.type,
-      message: row.message ?? "",
-      culprit: row.culprit ?? null,
-      level: coerceLevel(row.level),
-      stack: parseJson<ParsedStackFrame[]>(row.stack, []),
-      handled: Boolean(row.handled),
-      url: row.url ?? null,
-      userId: row.userId ?? null,
-      anonymousId: row.anonymousId ?? null,
-      userKey: row.userKey ?? null,
-      sessionId: row.sessionId ?? null,
-      sessionRecordingId: recordingId,
-      sessionRecordingPath: recordingPath(recordingId),
-      release: row.release ?? null,
-      environment: row.environment ?? null,
-      tags: parseJson<Record<string, unknown>>(row.tags, {}),
-      extra: parseJson<Record<string, unknown>>(row.extra, {}),
-      breadcrumbs: parseJson<unknown[]>(row.breadcrumbs, []),
-      occurredAt: row.occurredAt,
-    };
-  });
+  const events = await Promise.all(
+    eventRows.map(
+      async (row: any, index: number): Promise<ErrorEventDetail> => {
+        let recordingId: string | null = null;
+        if (row.sessionRecordingId && byId.has(row.sessionRecordingId)) {
+          recordingId = row.sessionRecordingId;
+        } else if (
+          row.clientRecordingId &&
+          byClientId.has(row.clientRecordingId)
+        ) {
+          recordingId = byClientId.get(row.clientRecordingId) ?? null;
+        }
+        if (recordingId && !sessions.has(recordingId)) {
+          sessions.set(recordingId, {
+            recordingId,
+            path: `/sessions/${recordingId}`,
+          });
+        }
+        return {
+          id: row.id,
+          type: row.type,
+          message: row.message ?? "",
+          culprit: row.culprit ?? null,
+          level: coerceLevel(row.level),
+          stack:
+            index === 0
+              ? await addSourceContexts(
+                  parseJson<ParsedStackFrame[]>(row.stack, []),
+                )
+              : parseJson<ParsedStackFrame[]>(row.stack, []),
+          rawStack: row.rawStack ?? null,
+          handled: Boolean(row.handled),
+          url: row.url ?? null,
+          userId: row.userId ?? null,
+          anonymousId: row.anonymousId ?? null,
+          userKey: row.userKey ?? null,
+          sessionId: row.sessionId ?? null,
+          sessionRecordingId: recordingId,
+          sessionRecordingPath: recordingPath(recordingId),
+          release: row.release ?? null,
+          environment: row.environment ?? null,
+          tags: parseJson<Record<string, unknown>>(row.tags, {}),
+          extra: parseJson<Record<string, unknown>>(row.extra, {}),
+          breadcrumbs: parseJson<unknown[]>(row.breadcrumbs, []),
+          occurredAt: row.occurredAt,
+        };
+      },
+    ),
+  );
 
   const sparklines = await sparklinesForIssues([issueId]);
   const issue: ErrorIssueSummary = {

package/corpus/templates/analytics/server/lib/session-replay.ts

@@ -2,6 +2,7 @@ import { Buffer } from "node:buffer";
 import { createHash, randomUUID } from "node:crypto";
 import { gzipSync, gunzipSync } from "node:zlib";
 
+import { readAppState } from "@agent-native/core/application-state";
 import {
   deletePrivateBlob,
   putPrivateBlob,
@@ -237,6 +238,7 @@ const DEFAULT_REPLAY_MAX_REQUESTS_PER_MINUTE = 120;
 const RETENTION_DELETE_BATCH_SIZE = 500;
 const REPLAY_PRIVATE_BLOB_REF_KIND = "agent-native.session-replay.private-blob";
 const REPLAY_PRIVATE_BLOB_REF_VERSION = 1;
+const SESSION_DEMO_EMAIL_PATTERN = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
 let inlineReplayFallbackWarned = false;
 
 function replayError(message: string, statusCode: number): Error {
@@ -274,6 +276,92 @@ function replayEmail(value: unknown): string | null {
   return raw && raw.includes("@") ? raw : null;
 }
 
+function normalizedEmail(value: unknown): string | null {
+  return replayEmail(value)?.toLowerCase() ?? null;
+}
+
+function isBuilderEmail(value: unknown): boolean {
+  return normalizedEmail(value)?.endsWith("@builder.io") === true;
+}
+
+async function isSessionDemoModeEnabled(): Promise<boolean> {
+  if (process.env.DEMO_MODE === "true") return true;
+  try {
+    const state = await readAppState("demo-mode");
+    return state?.enabled === true;
+  } catch {
+    return false;
+  }
+}
+
+function demoBuilderSessionCondition() {
+  return or(
+    sql`lower(${schema.sessionRecordings.userId}) like ${"%@builder.io"}`,
+    sql`lower(${schema.sessionRecordings.userKey}) like ${"%@builder.io"}`,
+  );
+}
+
+class SessionDemoAnonymizer {
+  private readonly aliases = new Map<string, string>();
+
+  aliasFor(value: unknown): string | null {
+    const raw = replayString(value);
+    if (!raw || raw.match(SESSION_DEMO_EMAIL_PATTERN)?.[0] !== raw) {
+      return null;
+    }
+    const email = raw.toLowerCase();
+    let alias = this.aliases.get(email);
+    if (!alias) {
+      alias = `anonymized-${this.aliases.size + 1}@builder.io`;
+      this.aliases.set(email, alias);
+    }
+    return alias;
+  }
+
+  summarize(row: any, role?: SessionReplayAccessRole): SessionRecordingSummary {
+    const summary = rowToSessionRecordingSummary(row, role);
+    return {
+      ...summary,
+      userId: this.aliasFor(row.userId) ?? summary.userId,
+      userKey: this.aliasFor(row.userKey) ?? summary.userKey,
+      ownerEmail: this.aliasFor(summary.ownerEmail) ?? summary.ownerEmail,
+      metadata: anonymizeEmailValue(summary.metadata, this) as Record<
+        string,
+        unknown
+      >,
+    };
+  }
+}
+
+function anonymizeEmailValue(
+  value: unknown,
+  anonymizer: SessionDemoAnonymizer,
+): unknown {
+  const alias = anonymizer.aliasFor(value);
+  if (alias) return alias;
+  if (Array.isArray(value)) {
+    return value.map((item) => anonymizeEmailValue(item, anonymizer));
+  }
+  if (typeof value === "string") {
+    return value.replace(SESSION_DEMO_EMAIL_PATTERN, (email) => {
+      return anonymizer.aliasFor(email) ?? email;
+    });
+  }
+  if (value && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [key, item] of Object.entries(value)) {
+      out[key] = anonymizeEmailValue(item, anonymizer);
+    }
+    return out;
+  }
+  return value;
+}
+
+function assertDemoVisibleSession(row: any): void {
+  if (isBuilderEmail(row.userId) || isBuilderEmail(row.userKey)) return;
+  throw replayError("Session recording not found", 404);
+}
+
 function replayInteger(value: unknown): number | null {
   if (typeof value === "number" && Number.isInteger(value)) return value;
   if (typeof value === "string" && /^-?\d+$/.test(value.trim())) {
@@ -580,16 +668,16 @@ function abandonedReplayMinutes(): number {
   );
 }
 
-function productionInlineFallbackAllowed(): boolean {
+function inlineReplayFallbackAllowed(): boolean {
   if (process.env.NODE_ENV !== "production") return true;
-  return process.env.ANALYTICS_SESSION_REPLAY_SQL_FALLBACK === "1";
+  return false;
 }
 
 function warnInlineReplayFallback(): void {
   if (inlineReplayFallbackWarned) return;
   inlineReplayFallbackWarned = true;
   console.warn(
-    "[session-replay] Private blob storage is not configured; storing capped replay chunks inline in SQL. This is intended only for local/dev use.",
+    "[session-replay] Private blob storage is not configured; storing capped replay chunks inline in SQL. This is for local/dev use only.",
   );
 }
 
@@ -619,9 +707,9 @@ async function storeReplayChunkBlob(
     },
   });
   if (!handle) {
-    if (!productionInlineFallbackAllowed()) {
+    if (!inlineReplayFallbackAllowed()) {
       throw replayError(
-        "Session replay blob storage is required in production. Configure a private blob provider or set ANALYTICS_SESSION_REPLAY_SQL_FALLBACK=1 for a capped temporary fallback.",
+        "Session replay blob storage is required in production. Configure a private blob provider before enabling full snapshot playback.",
         503,
       );
     }
@@ -1580,6 +1668,7 @@ export async function listSessionRecordings(
   filters: SessionReplayListFilters = {},
 ): Promise<SessionRecordingSummary[]> {
   const db = getDb() as any;
+  const demoMode = await isSessionDemoModeEnabled();
   const limit = Math.min(
     MAX_SESSION_RECORDINGS_LIMIT,
     Math.max(1, filters.limit ?? DEFAULT_SESSION_RECORDINGS_LIMIT),
@@ -1592,6 +1681,7 @@ export async function listSessionRecordings(
     replayVisibleIdentityCondition(),
     replayPlayableEventsCondition(),
   ];
+  if (demoMode) conditions.push(demoBuilderSessionCondition());
   if (filters.app)
     conditions.push(eq(schema.sessionRecordings.app, filters.app));
   if (filters.template) {
@@ -1645,13 +1735,22 @@ export async function listSessionRecordings(
     .where(and(...conditions))
     .orderBy(desc(schema.sessionRecordings.startedAt))
     .limit(limit);
-  return rows.map((row: any) => rowToSessionRecordingSummary(row));
+  if (!demoMode) {
+    return rows.map((row: any) => rowToSessionRecordingSummary(row));
+  }
+  const anonymizer = new SessionDemoAnonymizer();
+  return rows
+    .filter(
+      (row: any) => isBuilderEmail(row.userId) || isBuilderEmail(row.userKey),
+    )
+    .map((row: any) => anonymizer.summarize(row));
 }
 
 export async function getSessionReplaySummary(
   recordingId: string,
   scope: SessionReplayScope,
 ): Promise<SessionRecordingSummary> {
+  const demoMode = await isSessionDemoModeEnabled();
   const access = await resolveAccess("session-recording", recordingId, {
     userEmail: scope.userEmail,
     orgId: scope.orgId ?? undefined,
@@ -1660,12 +1759,17 @@ export async function getSessionReplaySummary(
   if (!isVisibleSessionRecording(access.resource)) {
     throw replayError("Session recording not found", 404);
   }
-  return rowToSessionRecordingSummary(access.resource, access.role);
+  if (!demoMode) {
+    return rowToSessionRecordingSummary(access.resource, access.role);
+  }
+  assertDemoVisibleSession(access.resource);
+  return new SessionDemoAnonymizer().summarize(access.resource, access.role);
 }
 
 export async function getSessionReplayTokenizedSummary(
   recordingId: string,
 ): Promise<SessionRecordingSummary> {
+  const demoMode = await isSessionDemoModeEnabled();
   const db = getDb() as any;
   // guard:allow-unscoped -- called only after verifySessionReplayAgentAccess(recordingId, token) verifies a signed, recording-scoped agent_access token.
   const [row] = await db
@@ -1676,7 +1780,9 @@ export async function getSessionReplayTokenizedSummary(
   if (!row || !isVisibleSessionRecording(row)) {
     throw replayError("Session recording not found", 404);
   }
-  return rowToSessionRecordingSummary(row, "viewer");
+  if (!demoMode) return rowToSessionRecordingSummary(row, "viewer");
+  assertDemoVisibleSession(row);
+  return new SessionDemoAnonymizer().summarize(row, "viewer");
 }
 
 function parseInlineReplayEvents(inlineData: string): unknown[] {

package/corpus/templates/analytics/server/lib/uptime-monitors.ts

@@ -203,6 +203,7 @@ const MAX_REDIRECT_HOPS = 5;
 const MONITOR_RUNNING_STALE_MS = 5 * 60 * 1000;
 const DEFAULT_RESULT_RETENTION_DAYS = 30;
 const DEFAULT_MONITOR_LIMIT_PER_OWNER = 100;
+export const DEFAULT_MONITOR_TIMEOUT_MS = 10_000;
 const MAX_REQUEST_HEADER_COUNT = 20;
 const MAX_REQUEST_HEADER_NAME_LENGTH = 128;
 const MAX_REQUEST_HEADER_VALUE_BYTES = 2048;
@@ -822,7 +823,7 @@ export async function runMonitorCheck(
     monitor.timeoutMs,
     MIN_TIMEOUT_MS,
     MAX_TIMEOUT_MS,
-    15000,
+    DEFAULT_MONITOR_TIMEOUT_MS,
   );
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   const start = Date.now();
@@ -925,7 +926,7 @@ function rowToMonitor(row: any): Monitor {
     ),
     requestBody: row.requestBody ?? null,
     intervalSeconds: Number(row.intervalSeconds ?? 300),
-    timeoutMs: Number(row.timeoutMs ?? 15000),
+    timeoutMs: Number(row.timeoutMs ?? DEFAULT_MONITOR_TIMEOUT_MS),
     expectedStatus: normalizeStatusMatcher(
       safeJsonParse<unknown>(row.expectedStatus, null),
     ),
@@ -1155,10 +1156,10 @@ export async function saveMonitor(
     300,
   );
   const timeoutMs = clampInt(
-    input.timeoutMs ?? 15000,
+    input.timeoutMs ?? DEFAULT_MONITOR_TIMEOUT_MS,
     MIN_TIMEOUT_MS,
     MAX_TIMEOUT_MS,
-    15000,
+    DEFAULT_MONITOR_TIMEOUT_MS,
   );
   const expectedStatus = normalizeStatusMatcher(input.expectedStatus);
   const assertions = normalizeAssertions(input.assertions);