@agent-native/core 0.94.3 → 0.95.1

package/corpus/core/src/client/sse-event-processor.ts

@@ -231,12 +231,6 @@ export type PreparingActionState = {
   toolEntries?: Map<string, PreparingActionEntry>;
 };
 
-function formatProgressBytes(bytes: number): string {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
-}
-
 function activityProgressBytes(ev: SSEEvent): number | undefined {
   return typeof ev.progressBytes === "number" &&
     Number.isFinite(ev.progressBytes) &&
@@ -281,7 +275,7 @@ function preparationActivityLabel(
   if (progressBytes <= 0) {
     return `Preparing ${action}...`;
   }
-  return `Writing ${action}... (${formatProgressBytes(progressBytes)} prepared)`;
+  return `Writing ${action}...`;
 }
 
 function visibleActivityLabel(ev: SSEEvent, tool?: string): string {
@@ -301,16 +295,8 @@ function findPendingToolCallIndex(
   // calls can be in flight simultaneously, and name-only matching would
   // attach a result to the wrong call.
   if (toolCallId) {
-    for (let i = content.length - 1; i >= 0; i--) {
-      const part = content[i];
-      if (
-        part.type === "tool-call" &&
-        part.toolCallId === toolCallId &&
-        part.result === undefined
-      ) {
-        return i;
-      }
-    }
+    const exactIndex = findPendingToolCallIndexById(content, toolCallId);
+    if (exactIndex >= 0) return exactIndex;
     // Fall through to name-matching: the start event may have arrived before
     // the server started emitting ids (e.g. older server build), so the
     // stored toolCallId is the locally-generated "tc_N" value rather than the
@@ -329,6 +315,76 @@ function findPendingToolCallIndex(
   return -1;
 }
 
+function findPendingToolCallIndexById(
+  content: ContentPart[],
+  toolCallId: string,
+): number {
+  for (let i = content.length - 1; i >= 0; i--) {
+    const part = content[i];
+    if (
+      part.type === "tool-call" &&
+      part.toolCallId === toolCallId &&
+      part.result === undefined
+    ) {
+      return i;
+    }
+  }
+  return -1;
+}
+
+function findOldestPendingActivityToolCallIndex(
+  content: ContentPart[],
+  toolName: string,
+): number {
+  for (let i = 0; i < content.length; i += 1) {
+    const part = content[i];
+    if (
+      part.type === "tool-call" &&
+      part.toolName === toolName &&
+      part.activity === true &&
+      part.result === undefined
+    ) {
+      return i;
+    }
+  }
+  return -1;
+}
+
+function findPendingActivityToolCallIndex(
+  content: ContentPart[],
+  toolName: string,
+  toolCallId?: string,
+): number {
+  if (!toolCallId) {
+    return findPendingToolCallIndex(content, toolName);
+  }
+
+  // Activity events emitted while the model is assembling tool input already
+  // carry the engine's stable call id. Match that id exactly so repeated
+  // progress for one call updates one placeholder while parallel same-name
+  // calls retain separate cards.
+  const exactIndex = findPendingToolCallIndexById(content, toolCallId);
+  if (exactIndex >= 0) return exactIndex;
+
+  // Older activity events may omit the id before a later progress event adds
+  // it. Upgrade one unambiguous reader-local placeholder instead of painting a
+  // second card for the same logical call.
+  const readerLocalCandidates: number[] = [];
+  for (let i = 0; i < content.length; i += 1) {
+    const part = content[i];
+    if (
+      part.type === "tool-call" &&
+      part.toolName === toolName &&
+      part.activity === true &&
+      part.result === undefined &&
+      /^tc_\d+$/.test(part.toolCallId)
+    ) {
+      readerLocalCandidates.push(i);
+    }
+  }
+  return readerLocalCandidates.length === 1 ? readerLocalCandidates[0] : -1;
+}
+
 function findCompletedToolCallIndex(
   content: ContentPart[],
   toolCallId?: string,
@@ -1000,7 +1056,17 @@ export function processEvent(
     }
     if (!tool) return { action: "continue" };
 
-    const pendingToolCallIndex = findPendingToolCallIndex(content, tool);
+    const pendingToolCallIndex = findPendingActivityToolCallIndex(
+      content,
+      tool,
+      ev.id,
+    );
+    if (pendingToolCallIndex >= 0 && ev.id) {
+      const pending = content[pendingToolCallIndex];
+      if (pending?.type === "tool-call" && pending.toolCallId !== ev.id) {
+        content[pendingToolCallIndex] = { ...pending, toolCallId: ev.id };
+      }
+    }
     if (pendingToolCallIndex === -1) {
       // Only surface a placeholder spinner when this tool has no card yet. A
       // trailing activity heartbeat that arrives after the matching tool_done
@@ -1011,12 +1077,13 @@ export function processEvent(
         (part) =>
           part.type === "tool-call" &&
           part.toolName === tool &&
-          part.result !== undefined,
+          part.result !== undefined &&
+          (!ev.id || part.toolCallId === ev.id),
       );
       if (!hasCompletedSameTool) {
         content.push({
           type: "tool-call",
-          toolCallId: `tc_${++toolCallCounter.value}`,
+          toolCallId: ev.id ?? `tc_${++toolCallCounter.value}`,
           toolName: tool,
           argsText: "",
           args: {},
@@ -1054,7 +1121,9 @@ export function processEvent(
     }
     // Pass the server-assigned id so we upgrade the pending activity card
     // using id-match when available (parallel same-name calls stay separate).
-    const pendingToolCallIndex = findPendingToolCallIndex(content, tool, ev.id);
+    const pendingToolCallIndex = ev.id
+      ? findPendingActivityToolCallIndex(content, tool, ev.id)
+      : findOldestPendingActivityToolCallIndex(content, tool);
     const pendingToolCall =
       pendingToolCallIndex >= 0 ? content[pendingToolCallIndex] : undefined;
     const pendingIsActivityPlaceholder =

package/corpus/core/src/connections/catalog.ts

@@ -66,9 +66,9 @@ export const WORKSPACE_CONNECTION_PROVIDERS = [
     credentialKeys: [
       {
         key: "SLACK_BOT_TOKEN",
-        label: "Slack bot token",
+        label: "Slack bot token (legacy)",
         description:
-          "Bot token with the smallest channel and history scopes needed by the template.",
+          "Legacy single-workspace fallback. For new messaging automations, connect Slack from Settings → Messaging instead.",
         required: true,
       },
     ],

package/corpus/core/src/deploy/build.ts

@@ -32,6 +32,7 @@ import { normalizeAppBasePath } from "../server/app-base-path.js";
 import {
   DEFAULT_SSR_CDN_CACHE_CONTROL,
   DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL,
+  DEFAULT_SSR_NETLIFY_VARY,
   DEFAULT_SPECULATION_RULES_PATH,
   DEFAULT_SSR_CACHE_CONTROL,
 } from "../shared/cache-control.js";
@@ -908,6 +909,7 @@ function injectHeadScript(html, script) {
 const DEFAULT_SSR_CACHE_CONTROL = ${JSON.stringify(DEFAULT_SSR_CACHE_CONTROL)};
 const DEFAULT_SSR_CDN_CACHE_CONTROL = ${JSON.stringify(DEFAULT_SSR_CDN_CACHE_CONTROL)};
 const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL = ${JSON.stringify(DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL)};
+const DEFAULT_SSR_NETLIFY_VARY = ${JSON.stringify(DEFAULT_SSR_NETLIFY_VARY)};
 const DEFAULT_SPECULATION_RULES_PATH = ${JSON.stringify(DEFAULT_SPECULATION_RULES_PATH)};
 const IMMUTABLE_ASSET_CACHE_CONTROL = ${JSON.stringify(IMMUTABLE_ASSET_CACHE_CONTROL)};
 const IMMUTABLE_ASSET_PATHS = new Set(${JSON.stringify(
@@ -1003,6 +1005,7 @@ function applyDefaultSsrCacheHeader(headers, status, pathname) {
   // Netlify-specific header so SSR HTML/.data are served from the shared
   // durable CDN cache instead of stampeding origin — for every visitor.
   headers.set("netlify-cdn-cache-control", DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL);
+  headers.set("netlify-vary", DEFAULT_SSR_NETLIFY_VARY);
 }
 
 function applyDefaultSpeculationRulesHeader(headers, status, basePath) {

package/corpus/core/src/index.ts

@@ -236,6 +236,8 @@ export {
   BUILDER_CREDIT_USAGE_BILLING,
   USD_USAGE_BILLING,
   type UsageRecord,
+  type UsageCostSource,
+  type UsageCostAggregate,
   type UsageSummary,
   type UsageBillingMode,
   type UsageBillingUnit,

package/corpus/core/src/integrations/catalog.ts

@@ -137,10 +137,10 @@ const BUILT_IN_CHANNEL_CATALOG = [
     credentialRequirements: [
       {
         key: "SLACK_BOT_TOKEN",
-        label: "Slack Bot Token",
+        label: "Slack Bot Token (legacy)",
         required: false,
         helpText:
-          "OAuth & Permissions → Bot User OAuth Token (starts with `xoxb-`).",
+          "Legacy single-workspace fallback only. For new setups, install Slack from Settings → Messaging; managed OAuth stores each workspace token automatically.",
       },
       {
         key: "SLACK_CLIENT_ID",

package/corpus/core/src/server/auth.ts

@@ -1627,7 +1627,7 @@ function loginHtmlResponse(loginHtml: string, event: H3Event): Response {
     headers: {
       "Content-Type": "text/html; charset=utf-8",
       // The sign-in document is part of the public server shell. Keep it on the
-      // same short-fresh/long-SWR CDN policy as React Router SSR so hosted
+      // same long-fresh/long-SWR CDN policy as React Router SSR so hosted
       // template roots do not invoke origin just to render anonymous login UI.
       // The login HTML is env-INDEPENDENT (a Google-only app always renders a
       // working button), so a cached copy is never "wrong" — never downgrade

package/corpus/core/src/server/credential-provider.ts

@@ -78,6 +78,8 @@ const APP_PROVIDED_DEPLOY_CREDENTIAL_KEYS = new Set([
   "OPENAI_API_KEY",
   "OPENAI_BASE_URL",
   "OPENROUTER_API_KEY",
+  "GOOGLE_CLIENT_ID",
+  "GOOGLE_CLIENT_SECRET",
   "GOOGLE_GENERATIVE_AI_API_KEY",
   "GROQ_API_KEY",
   "MISTRAL_API_KEY",
@@ -93,9 +95,11 @@ function isAppProvidedDeployCredentialKey(key: string | undefined): boolean {
  * single-tenant contexts. In hosted production with a shared database, every
  * signed-in user needs their own user/org/workspace credential for
  * identity-bearing provider keys so one deploy key does not silently
- * impersonate another tenant. App-provided LLM provider keys are different:
- * they intentionally let the app developer pay for model usage for users of
- * that deployed app, so key-aware callers may use those env vars.
+ * impersonate another tenant. App-provided service credentials are different:
+ * they configure the deployed app itself rather than identifying a user. This
+ * includes LLM keys that let the app developer pay for model usage and OAuth
+ * client credentials whose per-user identity remains in scoped OAuth tokens.
+ * Key-aware callers may use those env vars.
  *
  * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic
  * provider secrets. This stricter helper remains for legacy call sites with

package/corpus/core/src/shared/cache-control.ts

@@ -1,15 +1,21 @@
-export const DEFAULT_SSR_CACHE_CONTROL =
-  "public, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+export const DEFAULT_SSR_CACHE_CONTROL = "public, max-age=0, must-revalidate";
 
-export const DEFAULT_SSR_CDN_CACHE_CONTROL = DEFAULT_SSR_CACHE_CONTROL;
+export const DEFAULT_SSR_CDN_CACHE_CONTROL =
+  "public, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
 
 export const DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL =
-  "public, durable, max-age=5, stale-while-revalidate=604800, stale-if-error=3600";
+  "public, durable, s-maxage=3600, stale-while-revalidate=604800, stale-if-error=3600";
+
+// React Router data requests can select a subset of route loaders with
+// `?_routes=...`. Ignore every other query parameter (UTM tags, click ids,
+// and similar tracking noise) so they cannot fragment Netlify's SSR cache.
+export const DEFAULT_SSR_NETLIFY_VARY = "query=_routes";
 
 export const DEFAULT_SSR_CACHE_HEADERS = {
   "cache-control": DEFAULT_SSR_CACHE_CONTROL,
   "cdn-cache-control": DEFAULT_SSR_CDN_CACHE_CONTROL,
   "netlify-cdn-cache-control": DEFAULT_SSR_NETLIFY_CDN_CACHE_CONTROL,
+  "netlify-vary": DEFAULT_SSR_NETLIFY_VARY,
 } as const;
 
 export const DEFAULT_SPECULATION_RULES_PATH =

package/corpus/core/src/usage/store.ts

@@ -197,6 +197,8 @@ export interface UsageRecord {
    * provider-reported dollar cost so two surfaces agree exactly.
    */
   costCentsX100?: number;
+  /** Whether cost is provider-reported, estimated, or unavailable. */
+  costSource?: UsageCostSource;
   orgId?: string;
   runId?: string;
   threadId?: string;
@@ -206,6 +208,8 @@ export interface UsageRecord {
   sourceId?: string;
 }
 
+export type UsageCostSource = "reported" | "estimated" | "unavailable";
+
 let _initPromise: Promise<void> | undefined;
 
 async function ensureUsageTable(): Promise<void> {
@@ -221,6 +225,7 @@ async function ensureUsageTable(): Promise<void> {
           cache_read_tokens ${intType()} NOT NULL DEFAULT 0,
           cache_write_tokens ${intType()} NOT NULL DEFAULT 0,
           cost_cents_x100 ${intType()} NOT NULL DEFAULT 0,
+          cost_source TEXT NOT NULL DEFAULT 'estimated',
           model TEXT NOT NULL DEFAULT '',
           label TEXT NOT NULL DEFAULT 'chat',
           app TEXT NOT NULL DEFAULT '',
@@ -240,6 +245,7 @@ async function ensureUsageTable(): Promise<void> {
       const additions: Array<[string, string]> = [
         ["cache_read_tokens", `${intType()} NOT NULL DEFAULT 0`],
         ["cache_write_tokens", `${intType()} NOT NULL DEFAULT 0`],
+        ["cost_source", `TEXT NOT NULL DEFAULT 'estimated'`],
         ["label", `TEXT NOT NULL DEFAULT 'chat'`],
         ["app", `TEXT NOT NULL DEFAULT ''`],
         ["ref_id", `TEXT NOT NULL DEFAULT ''`],
@@ -379,6 +385,7 @@ export async function recordUsage(
     app,
     refId,
     costCentsX100,
+    costSource,
     orgId,
     runId,
     threadId,
@@ -410,14 +417,24 @@ export async function recordUsage(
 
   // Prefer an explicit precomputed cost (e.g. a provider-reported dollar cost);
   // otherwise derive it from tokens via the pricing table.
+  const resolvedCostSource =
+    costSource ?? (costCentsX100 == null ? "estimated" : "reported");
   const costX100 =
-    costCentsX100 ??
-    calculateCost(inTok, outTok, modelName, cacheReadTokens, cacheWriteTokens);
+    resolvedCostSource === "unavailable"
+      ? 0
+      : (costCentsX100 ??
+        calculateCost(
+          inTok,
+          outTok,
+          modelName,
+          cacheReadTokens,
+          cacheWriteTokens,
+        ));
   const id = Date.now() * 1000 + Math.floor(Math.random() * 1000);
   await client.execute({
     sql: `INSERT INTO token_usage
-      (id, owner_email, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, cost_cents_x100, model, label, app, ref_id, org_id, run_id, thread_id, task_id, integration_scope_id, source_platform, source_id, created_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      (id, owner_email, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, cost_cents_x100, cost_source, model, label, app, ref_id, org_id, run_id, thread_id, task_id, integration_scope_id, source_platform, source_id, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
     args: [
       id,
       ownerEmail,
@@ -426,6 +443,7 @@ export async function recordUsage(
       cacheReadTokens,
       cacheWriteTokens,
       costX100,
+      resolvedCostSource,
       modelName,
       resolvedLabel,
       resolvedApp,
@@ -469,6 +487,7 @@ export interface UsageBucket {
   cacheReadTokens: number;
   cacheWriteTokens: number;
   cents: number;
+  cost: UsageCostAggregate;
   calls: number;
 }
 
@@ -476,9 +495,15 @@ export interface DailyBucket {
   /** YYYY-MM-DD (UTC) */
   date: string;
   cents: number;
+  cost: UsageCostAggregate;
   calls: number;
 }
 
+export type UsageCostAggregate =
+  | { status: "known"; knownCents: number; unavailableCalls: 0 }
+  | { status: "partial"; knownCents: number; unavailableCalls: number }
+  | { status: "unavailable"; knownCents: 0; unavailableCalls: number };
+
 export interface UsageRecentEntry {
   id: number;
   createdAt: number;
@@ -490,11 +515,14 @@ export interface UsageRecentEntry {
   cacheReadTokens: number;
   cacheWriteTokens: number;
   cents: number;
+  costSource: UsageCostSource;
 }
 
 export interface UsageSummary {
   billing?: UsageBillingMode;
+  /** Legacy known-cost subtotal. Use totalCost to preserve unavailable spend. */
   totalCents: number;
+  totalCost: UsageCostAggregate;
   totalCalls: number;
   totalInputTokens: number;
   totalOutputTokens: number;
@@ -523,7 +551,8 @@ export async function getUsageSummary(
 
   const totalRow = await client.execute({
     sql: `SELECT
-      COALESCE(SUM(cost_cents_x100), 0) AS cents,
+      COALESCE(SUM(CASE WHEN cost_source = 'unavailable' THEN 0 ELSE cost_cents_x100 END), 0) AS known_cents,
+      COALESCE(SUM(CASE WHEN cost_source = 'unavailable' THEN 1 ELSE 0 END), 0) AS unavailable_calls,
       COUNT(*) AS calls,
       COALESCE(SUM(input_tokens), 0) AS in_tok,
       COALESCE(SUM(output_tokens), 0) AS out_tok,
@@ -536,7 +565,8 @@ export async function getUsageSummary(
 
   const bucketSql = (col: string) => ({
     sql: `SELECT ${col} AS k,
-        COALESCE(SUM(cost_cents_x100), 0) AS cents,
+        COALESCE(SUM(CASE WHEN cost_source = 'unavailable' THEN 0 ELSE cost_cents_x100 END), 0) AS known_cents,
+        COALESCE(SUM(CASE WHEN cost_source = 'unavailable' THEN 1 ELSE 0 END), 0) AS unavailable_calls,
         COUNT(*) AS calls,
         COALESCE(SUM(input_tokens), 0) AS in_tok,
         COALESCE(SUM(output_tokens), 0) AS out_tok,
@@ -545,16 +575,19 @@ export async function getUsageSummary(
       FROM token_usage
       WHERE owner_email = ? AND created_at >= ?
       GROUP BY ${col}
-      ORDER BY cents DESC`,
+      ORDER BY known_cents DESC`,
     args: [options.ownerEmail, sinceMs],
   });
 
   const mapBuckets = (rows: unknown[]): UsageBucket[] =>
     rows.map((r) => {
       const row = r as Record<string, number | string | null>;
+      const knownCents = Number(row.known_cents ?? 0) / 100;
+      const unavailableCalls = Number(row.unavailable_calls ?? 0);
       return {
         key: String(row.k ?? ""),
-        cents: Number(row.cents ?? 0) / 100,
+        cents: knownCents,
+        cost: buildUsageCostAggregate(knownCents, unavailableCalls),
         calls: Number(row.calls ?? 0),
         inputTokens: Number(row.in_tok ?? 0),
         outputTokens: Number(row.out_tok ?? 0),
@@ -573,30 +606,42 @@ export async function getUsageSummary(
   // date functions (SQLite `strftime`, Postgres `to_char`). Cheap enough
   // for a 30-day window; if this grows, swap for a dialect-aware query.
   const dayRows = await client.execute({
-    sql: `SELECT created_at, cost_cents_x100 FROM token_usage
+    sql: `SELECT created_at, cost_cents_x100, cost_source FROM token_usage
       WHERE owner_email = ? AND created_at >= ?`,
     args: [options.ownerEmail, sinceMs],
   });
-  const dayMap = new Map<string, { cents: number; calls: number }>();
-  for (const row of dayRows.rows as Array<Record<string, number>>) {
+  const dayMap = new Map<
+    string,
+    { knownCentsX100: number; unavailableCalls: number; calls: number }
+  >();
+  for (const row of dayRows.rows as Array<Record<string, number | string>>) {
     const date = new Date(Number(row.created_at)).toISOString().slice(0, 10);
-    const prev = dayMap.get(date) ?? { cents: 0, calls: 0 };
-    prev.cents += Number(row.cost_cents_x100 ?? 0);
+    const prev = dayMap.get(date) ?? {
+      knownCentsX100: 0,
+      unavailableCalls: 0,
+      calls: 0,
+    };
+    if (row.cost_source === "unavailable") prev.unavailableCalls += 1;
+    else prev.knownCentsX100 += Number(row.cost_cents_x100 ?? 0);
     prev.calls += 1;
     dayMap.set(date, prev);
   }
   const byDay: DailyBucket[] = [...dayMap.entries()]
-    .map(([date, v]) => ({
-      date,
-      cents: v.cents / 100,
-      calls: v.calls,
-    }))
+    .map(([date, v]) => {
+      const knownCents = v.knownCentsX100 / 100;
+      return {
+        date,
+        cents: knownCents,
+        cost: buildUsageCostAggregate(knownCents, v.unavailableCalls),
+        calls: v.calls,
+      };
+    })
     .sort((a, b) => a.date.localeCompare(b.date));
 
   const recentRows = await client.execute({
     sql: `SELECT id, created_at, label, app, model,
         input_tokens, output_tokens, cache_read_tokens, cache_write_tokens,
-        cost_cents_x100
+        cost_cents_x100, cost_source
       FROM token_usage
       WHERE owner_email = ?
       ORDER BY created_at DESC
@@ -616,11 +661,15 @@ export async function getUsageSummary(
     cacheReadTokens: Number(row.cache_read_tokens ?? 0),
     cacheWriteTokens: Number(row.cache_write_tokens ?? 0),
     cents: Number(row.cost_cents_x100 ?? 0) / 100,
+    costSource: String(row.cost_source ?? "estimated") as UsageCostSource,
   }));
 
+  const knownCents = Number(t.known_cents ?? 0) / 100;
+  const unavailableCalls = Number(t.unavailable_calls ?? 0);
   return {
     billing: USD_USAGE_BILLING,
-    totalCents: Number(t.cents ?? 0) / 100,
+    totalCents: knownCents,
+    totalCost: buildUsageCostAggregate(knownCents, unavailableCalls),
     totalCalls: Number(t.calls ?? 0),
     totalInputTokens: Number(t.in_tok ?? 0),
     totalOutputTokens: Number(t.out_tok ?? 0),
@@ -634,3 +683,16 @@ export async function getUsageSummary(
     recent,
   };
 }
+
+function buildUsageCostAggregate(
+  knownCents: number,
+  unavailableCalls: number,
+): UsageCostAggregate {
+  if (unavailableCalls === 0) {
+    return { status: "known", knownCents, unavailableCalls: 0 };
+  }
+  if (knownCents === 0) {
+    return { status: "unavailable", knownCents: 0, unavailableCalls };
+  }
+  return { status: "partial", knownCents, unavailableCalls };
+}

package/corpus/templates/analytics/app/lib/data-sources.ts

@@ -748,14 +748,15 @@ export const dataSources: DataSource[] = [
   {
     id: "slack",
     name: "Slack",
-    description: "Channel messages and workspace search",
+    description:
+      "Channel history and workspace search. Prefer a Slack workspace integration from Settings > Connections; a local bot token remains available as a legacy fallback.",
     category: "communication",
     icon: IconMessage,
     envKeys: ["SLACK_BOT_TOKEN"],
     docsUrl: "https://api.slack.com/methods",
     walkthroughSteps: [
       {
-        title: "Create a Slack App",
+        title: "Create a Slack App for local fallback access",
         description:
           "Go to api.slack.com/apps, create a new app, and add OAuth scopes: channels:read, channels:history, search:read.",
         url: "https://api.slack.com/apps",
@@ -767,10 +768,10 @@ export const dataSources: DataSource[] = [
           'Under "OAuth & Permissions", install the app and copy the Bot User OAuth Token.',
       },
       {
-        title: "Enter your Bot Token",
+        title: "Enter your local fallback Bot Token",
         description: 'Paste the Bot User OAuth Token (starts with "xoxb-").',
         inputKey: "SLACK_BOT_TOKEN",
-        inputLabel: "Bot Token",
+        inputLabel: "Bot Token (legacy local fallback)",
         inputPlaceholder: "xoxb-...",
         inputType: "password",
       },

package/corpus/templates/analytics/changelog/2026-07-10-slack-token-setup-marked-legacy.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-10
+---
+
+Slack data-source setup now favors workspace connections and identifies raw bot tokens as a legacy local fallback.

package/corpus/templates/analytics/server/lib/credential-keys.ts

@@ -107,10 +107,14 @@ export const credentialKeys: CredentialKeyConfig[] = [
     required: false,
   },
   // Slack
-  { key: "SLACK_BOT_TOKEN", label: "Slack Bot Token", required: false },
+  {
+    key: "SLACK_BOT_TOKEN",
+    label: "Slack Bot Token (legacy local fallback)",
+    required: false,
+  },
   {
     key: "SLACK_BOT_TOKEN_2",
-    label: "Slack Bot Token (secondary)",
+    label: "Slack Bot Token (legacy secondary fallback)",
     required: false,
   },
   // Notion

package/corpus/templates/brain/changelog/2026-07-10-slack-backfill-token-marked-legacy.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-10
+---
+
+Slack backfills now favor workspace connections while clearly marking raw bot tokens as a local fallback.

package/corpus/templates/brain/server/register-secrets.ts

@@ -2,9 +2,9 @@ import { registerRequiredSecret } from "@agent-native/core/secrets";
 
 registerRequiredSecret({
   key: "SLACK_BOT_TOKEN",
-  label: "Slack Bot Token",
+  label: "Slack Bot Token (local fallback)",
   description:
-    "Optional Slack bot token for channel backfills. Brain only scans allow-listed channels and never enumerates DMs.",
+    "Optional local fallback for Brain channel backfills. Prefer a Slack workspace integration in Settings > Connections. Brain only scans allow-listed channels and never enumerates DMs.",
   docsUrl: "https://api.slack.com/authentication/token-types",
   scope: "workspace",
   kind: "api-key",

package/corpus/templates/clips/app/components/library/library-layout.tsx

@@ -154,6 +154,9 @@ export function LibraryLayout({ children }: LibraryLayoutProps) {
   );
   const [headerSlot, setHeaderSlot] = useState<HTMLElement | null>(null);
   const showCollapsedSidebar = sidebarCollapsed && !isMobile;
+  const sidebarHasNewRecordingAction = isMobile
+    ? sidebarOpen
+    : !sidebarCollapsed;
 
   // Routes whose page renders its own h-12 toolbar. Layout still mounts Sidebar
   // + AgentSidebar, but skips its own header so there's no double-header.
@@ -603,7 +606,10 @@ export function LibraryLayout({ children }: LibraryLayoutProps) {
             </div>
           )}
           <main className="agent-native-app-main flex min-h-0 flex-1 flex-col overflow-y-auto">
-            <PageHeaderSlotProvider slot={headerSlot}>
+            <PageHeaderSlotProvider
+              slot={headerSlot}
+              sidebarHasNewRecordingAction={sidebarHasNewRecordingAction}
+            >
               {children}
             </PageHeaderSlotProvider>
           </main>