@agent-native/core 0.98.1 → 0.98.3

package/corpus/templates/analytics/server/lib/dashboard-report.ts

@@ -42,9 +42,8 @@ const DASHBOARD_REPORT_SCREENSHOT_PARAM = "reportScreenshot";
 const DASHBOARD_REPORT_SETTINGS_PARAM = "reportSettings";
 const DASHBOARD_REPORT_CID = "dashboard-report-snapshot";
 const LOCAL_SCREENSHOT_TIMEOUT_MS = 90_000;
-const SERVERLESS_SCREENSHOT_TIMEOUT_MS = 60_000;
-const SERVERLESS_SECOND_READY_TIMEOUT_MS = 30_000;
-const MAX_SCREENSHOT_VIEWPORT_HEIGHT = 30_000;
+const SERVERLESS_SCREENSHOT_TIMEOUT_MS = 90_000;
+const SERVERLESS_SECOND_READY_TIMEOUT_MS = 45_000;
 const SCREENSHOT_VIEWPORT_PADDING = 64;
 
 type DashboardScreenshotAttempt = {
@@ -328,42 +327,27 @@ async function scrollDashboardForLazyRendering(page: any): Promise<void> {
   })()`);
 }
 
-async function fitViewportToDashboardCapture(
+async function fitViewportWidthToDashboardCapture(
   page: any,
   capture: any,
-  minViewport: { width: number; height: number },
+  viewport: { width: number; height: number },
 ): Promise<void> {
   const box = await capture.boundingBox();
   if (!box) return;
 
-  const size = {
-    width: Math.max(
-      minViewport.width,
-      Math.min(1800, Math.ceil(box.width + SCREENSHOT_VIEWPORT_PADDING)),
-    ),
-    height: Math.max(
-      minViewport.height,
-      Math.min(
-        MAX_SCREENSHOT_VIEWPORT_HEIGHT,
-        Math.ceil(box.height + SCREENSHOT_VIEWPORT_PADDING),
-      ),
-    ),
-  };
-  await page.setViewportSize(size);
-  await page.waitForTimeout(250);
-
-  const resizedBox = await capture.boundingBox();
-  if (!resizedBox) return;
-  const resizedHeight = Math.ceil(
-    resizedBox.height + SCREENSHOT_VIEWPORT_PADDING,
+  const width = Math.max(
+    viewport.width,
+    Math.min(1800, Math.ceil(box.width + SCREENSHOT_VIEWPORT_PADDING)),
   );
-  if (resizedHeight > size.height) {
-    await page.setViewportSize({
-      width: size.width,
-      height: Math.min(MAX_SCREENSHOT_VIEWPORT_HEIGHT, resizedHeight),
-    });
-    await page.waitForTimeout(250);
-  }
+  if (width === viewport.width) return;
+
+  // Keep the render surface bounded. Playwright's locator screenshot captures
+  // the full element beyond the viewport, while growing Chromium to the full
+  // dashboard height can exhaust memory and close the browser on serverless
+  // workers. Width-only fitting preserves the full dashboard without that
+  // oversized render surface.
+  await page.setViewportSize({ width, height: viewport.height });
+  await page.waitForTimeout(250);
 }
 
 async function captureDashboardPng(
@@ -412,7 +396,7 @@ async function captureDashboardPng(
     await scrollDashboardForLazyRendering(page);
     await waitForDashboardReportReady(page, secondReadyTimeoutMs());
 
-    await fitViewportToDashboardCapture(page, capture, attempt.viewport);
+    await fitViewportWidthToDashboardCapture(page, capture, attempt.viewport);
     await capture.scrollIntoViewIfNeeded();
     const image = await capture.screenshot({
       type: "png",

package/corpus/templates/clips/app/components/player/video-player.tsx

@@ -1083,13 +1083,17 @@ export const VideoPlayer = forwardRef<VideoPlayerHandle, VideoPlayerProps>(
     const fullscreenMenuContainer = isFullscreen ? containerRef.current : null;
 
     const showThroughoutCta = cta && cta.placement === "throughout";
+    // Mobile Safari may defer loadeddata/canplay until playback starts. Keep
+    // the paused state actionable even when those readiness events have not
+    // fired yet; once the user asks to play, the pending/buffering states give
+    // them accurate loading feedback.
     const centerOverlayMode =
       activeVideoSrc &&
       !isLoomEmbed &&
       !unsupportedFormat &&
       !showEndCta &&
       (!isPlaying || isPlayPending || isBuffering)
-        ? isPreparing || isPlayPending || isBuffering || !canPlay
+        ? isPlayPending || isBuffering
           ? "loading"
           : "ready"
         : null;

package/corpus/templates/clips/changelog/2026-07-11-clips-no-longer-stay-stuck-on-preparing-clip-when-they-are-r.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-11
+---
+
+Clips no longer stay stuck on Preparing clip when they are ready to play on mobile.

package/corpus/templates/content/app/components/sidebar/DocumentSidebar.tsx

@@ -1188,8 +1188,8 @@ export function DocumentSidebar({
         </div>
       )}
 
-      <ScrollArea className="min-h-0 flex-1">
-        <div className="min-w-full w-max py-2 pe-2">
+      <ScrollArea className="min-h-0 flex-1 [&_[data-radix-scroll-area-viewport]]:!overflow-x-hidden">
+        <div className="w-full min-w-0 py-2 pe-2">
           {/* Search results */}
           {filteredDocuments ? (
             <>

package/corpus/templates/content/changelog/2026-07-12-the-left-sidebar-stays-fixed-horizontally-while-scrolling-on.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-12
+---
+
+The left sidebar stays fixed horizontally while scrolling on desktop and mobile.

package/corpus/templates/plan/.agents/skills/visual-plan/references/local-files.md

@@ -36,9 +36,9 @@ The local-files contract:
   — encode multiline code as JSON string attributes such as `code={"const x =\n  y"}`
   (a static template literal is accepted only when it has no `${...}`
   interpolation). `plan local check` is a quick OFFLINE lint (a subset of the
-  renderer schema), so a green `check` does not guarantee the plan renders;
-  `plan local verify` is the authoritative validation against the real renderer
-  schema.
+  renderer schema), so a green `check` does not guarantee the plan renders.
+  `plan local verify` also stays on-device: it uses the offline lint unless it
+  can reach a Plan renderer on an explicit loopback `--app-url`.
 - **Write a local MDX folder.** Use `plans/<slug>/` to check the artifact into the
   repo, or a repo-ignored/temporary folder such as `.agent-native/plans/<slug>/`
   or `/tmp/agent-native-plans/<slug>/` when it should not be checked in. The
@@ -53,7 +53,10 @@ The local-files contract:
   (use `--kind plan` for plans, `--kind recap` for recaps). Report the local
   bridge URL from stdout or `<plan-dir>/.plan-url`; treat `.plan-url` as a local
   token file and do not commit it. The URL opens the hosted Plan UI but reads from
-  the localhost bridge on this machine, so it is not shareable across machines. On
+  the localhost bridge on this machine, so it is not shareable across machines.
+  The token is carried in the URL fragment (which is not sent to the hosted
+  origin), and the local-plan route disables DOM autocapture and session replay
+  while retaining sanitized pageviews and error monitoring. On
   macOS `--open` prefers Chromium browsers; if Safari opens, switch to
   Chrome/Chromium because Safari can block the hosted HTTPS page from fetching the
   HTTP localhost bridge. If the Plan app itself is running locally with the same
@@ -63,14 +66,16 @@ The local-files contract:
   running local Plan app.
 - **Headless verify.** Run
   `npx @agent-native/core@latest plan local verify --dir <plan-dir> --kind <plan|recap>`.
-  It starts the bridge, checks the private-network preflight and JSON payload, AND
-  validates the content against the real renderer schema via the Plan app's
-  `validate-local-plan-source` action. A non-`ok` result with
+  It starts the bridge and checks the private-network preflight and JSON payload
+  entirely on loopback. It never sends MDX or assets to a remote validation
+  action. When `--app-url` points to a loopback Plan app, verify also validates
+  against that local app's real renderer schema via `validate-local-plan-source`.
+  A non-`ok` result with
   `validation.valid: false` lists the renderer's exact schema-path issues (e.g.
   `blocks[1].data.tabs[0]...`); fix those before handing off. If `validation.ran`
-  is `false`, the Plan app did not expose the validate endpoint (older/unreachable
-  deploy) — point `--app-url` at a current Plan app (e.g. a local
-  `http://localhost:8096`) for the authoritative check. If the browser hangs on
+  is `false`, verify used the offline lint because the app URL was remote or the
+  local Plan app was unavailable. Run a local Plan app and pass
+  `--app-url http://localhost:8096` for the authoritative check. If the browser hangs on
   "Loading plan", fetch the `bridgeUrl` from the verify/serve JSON to read the
   concrete validation error.
 - **Never call hosted tools for that plan/recap.** Do not call
@@ -86,8 +91,8 @@ The local-files contract:
   attachment, and publish/export receipts are unavailable until the user
   explicitly opts into publishing.
 
-Local-files mode only prevents plan/recap content from reaching the Agent-Native
-Plan database. It does not by itself make the coding agent's language model local;
+Local-files mode prevents plan/recap content from being uploaded to the
+Agent-Native Plan server or database. It does not by itself make the coding agent's language model local;
 for that stronger boundary the host agent/model must also be local or otherwise
 approved by the user.
 

package/corpus/templates/plan/.agents/skills/visual-recap/references/local-files.md

@@ -36,9 +36,9 @@ The local-files contract:
   — encode multiline code as JSON string attributes such as `code={"const x =\n  y"}`
   (a static template literal is accepted only when it has no `${...}`
   interpolation). `plan local check` is a quick OFFLINE lint (a subset of the
-  renderer schema), so a green `check` does not guarantee the plan renders;
-  `plan local verify` is the authoritative validation against the real renderer
-  schema.
+  renderer schema), so a green `check` does not guarantee the plan renders.
+  `plan local verify` also stays on-device: it uses the offline lint unless it
+  can reach a Plan renderer on an explicit loopback `--app-url`.
 - **Write a local MDX folder.** Use `plans/<slug>/` to check the artifact into the
   repo, or a repo-ignored/temporary folder such as `.agent-native/plans/<slug>/`
   or `/tmp/agent-native-plans/<slug>/` when it should not be checked in. The
@@ -53,7 +53,10 @@ The local-files contract:
   (use `--kind plan` for plans, `--kind recap` for recaps). Report the local
   bridge URL from stdout or `<plan-dir>/.plan-url`; treat `.plan-url` as a local
   token file and do not commit it. The URL opens the hosted Plan UI but reads from
-  the localhost bridge on this machine, so it is not shareable across machines. On
+  the localhost bridge on this machine, so it is not shareable across machines.
+  The token is carried in the URL fragment (which is not sent to the hosted
+  origin), and the local-plan route disables DOM autocapture and session replay
+  while retaining sanitized pageviews and error monitoring. On
   macOS `--open` prefers Chromium browsers; if Safari opens, switch to
   Chrome/Chromium because Safari can block the hosted HTTPS page from fetching the
   HTTP localhost bridge. If the Plan app itself is running locally with the same
@@ -63,14 +66,16 @@ The local-files contract:
   running local Plan app.
 - **Headless verify.** Run
   `npx @agent-native/core@latest plan local verify --dir <plan-dir> --kind <plan|recap>`.
-  It starts the bridge, checks the private-network preflight and JSON payload, AND
-  validates the content against the real renderer schema via the Plan app's
-  `validate-local-plan-source` action. A non-`ok` result with
+  It starts the bridge and checks the private-network preflight and JSON payload
+  entirely on loopback. It never sends MDX or assets to a remote validation
+  action. When `--app-url` points to a loopback Plan app, verify also validates
+  against that local app's real renderer schema via `validate-local-plan-source`.
+  A non-`ok` result with
   `validation.valid: false` lists the renderer's exact schema-path issues (e.g.
   `blocks[1].data.tabs[0]...`); fix those before handing off. If `validation.ran`
-  is `false`, the Plan app did not expose the validate endpoint (older/unreachable
-  deploy) — point `--app-url` at a current Plan app (e.g. a local
-  `http://localhost:8096`) for the authoritative check. If the browser hangs on
+  is `false`, verify used the offline lint because the app URL was remote or the
+  local Plan app was unavailable. Run a local Plan app and pass
+  `--app-url http://localhost:8096` for the authoritative check. If the browser hangs on
   "Loading plan", fetch the `bridgeUrl` from the verify/serve JSON to read the
   concrete validation error.
 - **Never call hosted tools for that plan/recap.** Do not call
@@ -86,8 +91,8 @@ The local-files contract:
   attachment, and publish/export receipts are unavailable until the user
   explicitly opts into publishing.
 
-Local-files mode only prevents plan/recap content from reaching the Agent-Native
-Plan database. It does not by itself make the coding agent's language model local;
+Local-files mode prevents plan/recap content from being uploaded to the
+Agent-Native Plan server or database. It does not by itself make the coding agent's language model local;
 for that stronger boundary the host agent/model must also be local or otherwise
 approved by the user.
 

package/corpus/templates/plan/actions/validate-local-plan-source.ts

@@ -13,8 +13,8 @@ import { parsePlanMdxFolder, planMdxFileSchema } from "../server/plan-mdx.js";
  *
  * It is intentionally a pure parse: it accepts the posted MDX folder, never
  * reads `schema.plans`, never touches the filesystem, and never writes to the
- * database. That keeps it safe to expose without auth so the offline-friendly
- * `plan local verify` CLI can call it against a local or hosted Plan app.
+ * database. The local-files CLI calls it only on an explicit loopback Plan app;
+ * it never posts private source to this action on a hosted deployment.
  */
 
 // Covers the CLI's 10 MiB raw asset cap (~13.3 MiB base64) plus MDX text, so
@@ -63,7 +63,7 @@ function toValidationIssues(error: unknown): ValidationIssue[] {
 
 export default defineAction({
   description:
-    "Validate a local plan MDX folder against the live Plan renderer schema (parsePlanMdxFolder + planContentSchema). Returns { valid, issues } where issues carry the renderer's exact schema path (e.g. blocks[1].data.items[0].id). Use this to confirm a plan will render before handing it off — it is the authoritative check behind `plan local verify`. Pure parse: no database, filesystem, or schema.plans access.",
+    "Validate a plan MDX folder against this Plan app's renderer schema (parsePlanMdxFolder + planContentSchema). Returns { valid, issues } where issues carry the renderer's exact schema path (e.g. blocks[1].data.items[0].id). The local-files CLI calls this only on loopback Plan apps so private source stays on-device. Pure parse: no database, filesystem, or schema.plans access.",
   schema: z.object({
     mdx: planMdxFileSchema.describe(
       "The plan MDX folder: plan.mdx plus optional canvas.mdx, prototype.mdx, .plan-state.json, and assets/.",
@@ -81,7 +81,7 @@ export default defineAction({
     requiresAuth: false,
     title: "Validate Local Plan Source",
     description:
-      "Validate a local plan MDX folder against the real renderer schema without touching the database.",
+      "Validate a plan MDX folder against this app's renderer schema without touching the database.",
   },
   run: async (args) => {
     let totalBytes = 0;

package/corpus/templates/plan/app/components/layout/Sidebar.tsx

@@ -62,6 +62,7 @@ import {
 } from "@/components/ui/tooltip";
 import { usePlans } from "@/hooks/use-plans";
 import { APP_TITLE } from "@/lib/app-config";
+import { planReturnPathFromLocation } from "@/lib/plan-local-bridge";
 import { cn } from "@/lib/utils";
 
 const PLAN_CHAT_STORAGE_KEY = "plans";
@@ -651,7 +652,7 @@ export function Sidebar({
   const location = useLocation();
   const { session, isLoading: sessionLoading } = useSession();
   const t = useT();
-  const returnPath = `${location.pathname}${location.search}${location.hash}`;
+  const returnPath = planReturnPathFromLocation(location);
   const ToggleIcon = collapsed
     ? IconLayoutSidebarLeftExpand
     : IconLayoutSidebarLeftCollapse;

package/corpus/templates/plan/app/lib/plan-local-bridge.ts

@@ -67,6 +67,47 @@ export class LocalPlanBridgePermissionError extends Error {
   }
 }
 
+type LocalPlanBridgeSessionStorage = Pick<Storage, "getItem" | "setItem">;
+
+function browserSessionStorage(): LocalPlanBridgeSessionStorage | null {
+  if (typeof window === "undefined") return null;
+  try {
+    return window.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+
+export function localPlanBridgeUrlFromLocation(
+  hash: string,
+  slug: string,
+  storage: LocalPlanBridgeSessionStorage | null = browserSessionStorage(),
+): string | null {
+  const hashParams = hash.startsWith("#bridge=")
+    ? new URLSearchParams(hash.slice(1))
+    : null;
+  const bridgeUrl = hashParams?.get("bridge") ?? null;
+  const storageKey = `agent-native.local-plan-bridge.${slug}`;
+  try {
+    if (bridgeUrl) {
+      storage?.setItem(storageKey, bridgeUrl);
+      return bridgeUrl;
+    }
+    return storage?.getItem(storageKey) ?? null;
+  } catch {
+    return bridgeUrl;
+  }
+}
+
+export function planReturnPathFromLocation(location: {
+  pathname: string;
+  search: string;
+  hash: string;
+}): string {
+  const safeHash = location.hash.startsWith("#bridge=") ? "" : location.hash;
+  return `${location.pathname}${location.search}${safeHash}`;
+}
+
 export async function localNetworkAccessPermissionState(): Promise<
   Exclude<LocalNetworkAccessPermissionState, "checking">
 > {

package/corpus/templates/plan/app/lib/plan-tracking.ts

@@ -0,0 +1,3 @@
+export function shouldCapturePlanContent(pathname: string): boolean {
+  return !(pathname === "/local-plans" || pathname.startsWith("/local-plans/"));
+}

package/corpus/templates/plan/app/pages/PlansPage.tsx

@@ -273,11 +273,13 @@ import { planDocumentTitle } from "@/lib/plan-document-title";
 import {
   fetchLocalPlanBridgeBundle,
   localNetworkAccessPermissionState,
+  localPlanBridgeUrlFromLocation,
   localPlanBridgeQueryKey,
   localPlanBridgeRetryDelay,
   localPlanRoutePath,
   localPlanRouteUrl,
   mergeLocalBridgeComments,
+  planReturnPathFromLocation,
   shouldRetryLocalPlanBridgeBundle,
   shouldShowLocalPlanLoadError,
   shouldShowPlanLoadError,
@@ -2024,9 +2026,10 @@ export function PlansPage({ localPlanSlug }: { localPlanSlug?: string } = {}) {
     () => new URLSearchParams(location.search),
     [location.search],
   );
-  const localPlanBridgeUrl = localPlanMode
-    ? routeSearchParams.get("bridge")
-    : null;
+  const localPlanBridgeUrl =
+    localPlanMode && localPlanSlug
+      ? localPlanBridgeUrlFromLocation(location.hash, localPlanSlug)
+      : null;
   const localPlanRepoPath = localPlanMode
     ? routeSearchParams.get("path")
     : null;
@@ -2137,8 +2140,7 @@ export function PlansPage({ localPlanSlug }: { localPlanSlug?: string } = {}) {
   // Redirect to sign-in, returning to wherever the guest currently is.
   const openSignIn = useCallback((returnOverride?: string) => {
     const returnPath =
-      returnOverride ??
-      window.location.pathname + window.location.search + window.location.hash;
+      returnOverride ?? planReturnPathFromLocation(window.location);
     window.location.href = `${agentNativePath(
       "/_agent-native/sign-in",
     )}?return=${encodeURIComponent(returnPath)}`;
@@ -2292,8 +2294,7 @@ export function PlansPage({ localPlanSlug }: { localPlanSlug?: string } = {}) {
     }
   }, [accessRequestSentPlanId, selectedId]);
   const startGoogleSignIn = useCallback(async () => {
-    const returnPath =
-      window.location.pathname + window.location.search + window.location.hash;
+    const returnPath = planReturnPathFromLocation(window.location);
     try {
       const res = await fetch(
         `${agentNativePath("/_agent-native/google/auth-url")}?return=${encodeURIComponent(returnPath)}`,
@@ -6826,8 +6827,7 @@ function PlanLoadError({
       ? t("plansPage.loadError.orgTitle", { orgName })
       : null;
 
-  const returnPath = () =>
-    window.location.pathname + window.location.search + window.location.hash;
+  const returnPath = () => planReturnPathFromLocation(window.location);
 
   const readAuthError = async (res: Response, fallback: string) => {
     const data = (await res.json().catch(() => null)) as {

package/corpus/templates/plan/app/root.tsx

@@ -20,7 +20,7 @@ import {
 } from "@tabler/icons-react";
 import { useQueryClient } from "@tanstack/react-query";
 import { useTheme } from "next-themes";
-import { useCallback, useState } from "react";
+import { useCallback, useEffect, useState } from "react";
 import {
   Links,
   Meta,
@@ -44,13 +44,17 @@ import { useNavigationState } from "@/hooks/use-navigation-state";
 // their diagram/wireframe/api-spec blocks inline in the agent chat.
 import "@/lib/register-chat-renderers";
 import { APP_TITLE } from "@/lib/app-config";
+import { shouldCapturePlanContent } from "@/lib/plan-tracking";
 import { TAB_ID } from "@/lib/tab-id";
 
 import changelog from "../CHANGELOG.md?raw";
 import { i18nCatalog } from "./i18n";
 
 import stylesheet from "./global.css?url";
+// Keep standard pageviews, explicit analytics, and Sentry on local-plan routes,
+// but disable DOM/session capture so rendered plan contents stay on-device.
 configureTracking({
+  contentCaptureForPath: shouldCapturePlanContent,
   getDefaultProps: (_name, properties) => ({
     ...properties,
     app: "plan",
@@ -221,6 +225,7 @@ export default function Root() {
     location.pathname.startsWith("/recaps/") ||
     location.pathname === "/local-plans" ||
     location.pathname.startsWith("/local-plans/");
+  const localPlanPrivacyRoute = !shouldCapturePlanContent(location.pathname);
   return (
     // Pass the plan-specific styled Toaster via `toaster` so only one sonner
     // instance renders (avoids the duplicate that would appear if AppProviders'
@@ -232,8 +237,13 @@ export default function Root() {
         toaster={<Toaster richColors position="bottom-left" />}
         i18n={{ catalog: i18nCatalog }}
       >
-        <DbSyncSetup />
-        <AppContent />
+        <div
+          data-an-mask={localPlanPrivacyRoute ? "" : undefined}
+          style={{ display: "contents" }}
+        >
+          <DbSyncSetup />
+          <AppContent />
+        </div>
       </AppProviders>
     </AppToolkitProvider>
   );

package/corpus/templates/plan/changelog/2026-07-12-local-plan-source-now-stays-on-device.md

@@ -0,0 +1,6 @@
+---
+type: security
+date: 2026-07-12
+---
+
+Local plan source now stays on your device during verification and is excluded from content autocapture and session replay.

package/dist/agent/production-agent.js

@@ -3247,8 +3247,8 @@ export async function runAgentLoop(opts) {
                 // content parts; first-party actions opt in via the well-known
                 // `_agentImages` result field (stripped from the JSON the model
                 // reads, even in demo mode). Demo mode drops the images themselves —
-                // text redaction can't scrub pixels, and a screenshot would leak the
-                // real contact names/emails/numbers the redaction exists to hide. The images array
+                // text redaction can't scrub pixels, and a screenshot may expose
+                // original visual data. The images array
                 // never touches the ledger — only the compact text notes appended
                 // below are persisted.
                 let imageNotes = [];