@agent-native/core 0.98.4 → 0.98.6

package/corpus/core/src/scripts/agent-engines/list-agent-engines.ts

@@ -15,8 +15,6 @@ import {
   normalizeModelForEngine,
 } from "../../agent/engine/index.js";
 import type { ActionTool } from "../../agent/types.js";
-import { resolveHostedDefaultModelExperiment } from "../../observability/hosted-model-experiment.js";
-import { getRequestUserEmail } from "../../server/request-context.js";
 import { getSetting } from "../../settings/index.js";
 
 export const tool: ActionTool = {
@@ -84,24 +82,13 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
         ? current?.model
         : undefined;
   const currentEngineName = currentEntry?.name ?? "anthropic";
-  let currentModel =
+  const currentModel =
     currentEntry && !envUnavailable
       ? normalizeModelForEngine(
           currentEntry,
           currentModelCandidate ?? currentEntry.defaultModel,
         )
       : (currentModelCandidate ?? DEFAULT_MODEL);
-  const hostedExperiment =
-    currentEntry && !currentModelCandidate
-      ? resolveHostedDefaultModelExperiment({
-          userId: getRequestUserEmail(),
-          engineName: currentEntry.name,
-          isDefaultModelSelection: true,
-          supportedModels: currentEntry.supportedModels,
-        })
-      : null;
-  if (hostedExperiment) currentModel = hostedExperiment.model;
-
   const result = {
     engines: engines.map((e) => ({
       name: e.name,
@@ -119,12 +106,6 @@ export async function run(args: Record<string, string> = {}): Promise<string> {
       : {
           engine: currentEngineName,
           model: currentModel,
-          ...(hostedExperiment
-            ? {
-                modelSelectionSource: "experiment",
-                experimentAssignment: hostedExperiment.assignment,
-              }
-            : {}),
         },
   };
 

package/corpus/core/src/server/agent-chat/plugin-options.ts

@@ -5,6 +5,7 @@ import type {
   AgentChatReference,
   MentionProvider,
 } from "../../agent/types.js";
+import type { ExternalAgentPolicy } from "../../mcp/external-agent-policy.js";
 import type { DatabaseToolsOption } from "../../scripts/db/tool-mode.js";
 import type { PromptExamples } from "../prompts/index.js";
 
@@ -293,7 +294,9 @@ export interface AgentChatPluginOptions {
    * browser-session tools) from connectors. It is no longer gated behind an
    * environment variable, and the catalog is never inferred from the client.
    *
-   * `tool-search` stays available so any trimmed tool is reachable on demand.
+   * `tool-search` stays available for discovery; a trimmed action still needs
+   * the connector catalog, authenticated-read policy, or full-catalog opt-in
+   * before an external caller can execute it.
    * Callers who need the full surface up front opt in explicitly with
    * `agent-native connect --full-catalog` (embeds a `catalog_scope: "full"`
    * claim in their connect-minted JWT) or the deployment-wide
@@ -303,6 +306,14 @@ export interface AgentChatPluginOptions {
    */
   connectorCatalog?: string[];
 
+  /**
+   * Default authenticated external-agent policy. In `auto` read mode, every
+   * action explicitly marked as GET + readOnly + publicAgent.requiresAuth is
+   * added to the connector surface automatically. Writes remain ask_app-only
+   * unless `writes: "allowlisted"` is explicitly selected.
+   */
+  externalAgents?: ExternalAgentPolicy;
+
   /**
    * Skip mounting the remote MCP protocol route.
    *

package/corpus/core/src/server/agent-chat/script-entries.ts

@@ -31,7 +31,10 @@ import {
 function wrapCliScript(
   tool: ActionTool,
   cliDefault: (args: string[]) => Promise<void>,
-  opts?: { readOnly?: boolean },
+  opts?: {
+    allowedArgs?: readonly string[];
+    readOnly?: boolean;
+  },
 ): ActionEntry {
   return {
     tool,
@@ -39,6 +42,14 @@ function wrapCliScript(
     run: async (args: Record<string, string>): Promise<string> => {
       const cliArgs: string[] = [];
       for (const [k, v] of Object.entries(args)) {
+        // MCP input schemas are descriptive and some hosts can still send
+        // undeclared keys. The externally exposed DB readers must never accept
+        // the CLI-only `--db` escape hatch, which could point at another local
+        // SQLite file. Keep their runtime surface identical to the advertised
+        // schema instead of trusting the client to validate it.
+        if (opts?.allowedArgs && !opts.allowedArgs.includes(k)) {
+          throw new Error(`Unknown argument: ${k}`);
+        }
         const raw = v as unknown;
         const value =
           raw != null && typeof raw === "object"
@@ -101,7 +112,10 @@ export async function createDbScriptEntries(
           },
         },
         schemaMod.default,
-        { readOnly: true },
+        {
+          allowedArgs: ["format"],
+          readOnly: true,
+        },
       ),
       "db-query": wrapCliScript(
         {
@@ -134,7 +148,10 @@ export async function createDbScriptEntries(
           },
         },
         queryMod.default,
-        { readOnly: true },
+        {
+          allowedArgs: ["sql", "args", "format", "limit"],
+          readOnly: true,
+        },
       ),
     };
 

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -1512,6 +1512,9 @@ export function createAgentChatPlugin(
           ...(options?.connectorCatalog
             ? { connectorCatalog: options.connectorCatalog }
             : {}),
+          ...(options?.externalAgents
+            ? { externalAgents: options.externalAgents }
+            : {}),
           askAgent: async (message: string) => {
             const mcpEngine = await resolveEngine({
               engineOption: options?.engine,

package/corpus/core/src/session-replay-iframe-protocol.ts

@@ -0,0 +1,58 @@
+export const SESSION_REPLAY_IFRAME_ATTRIBUTE =
+  "data-agent-native-session-replay";
+export const SESSION_REPLAY_IFRAME_PROBE = "agent-native-session-replay:probe";
+export const SESSION_REPLAY_IFRAME_START = "agent-native-session-replay:start";
+export const SESSION_REPLAY_IFRAME_STOP = "agent-native-session-replay:stop";
+
+export interface SessionReplayIframePrivacyOptions {
+  blockSelector: string;
+  ignoreSelector: string;
+  maskTextClass?: string | RegExp;
+  maskTextSelector: string;
+  maskAllInputs: boolean;
+  maskInputOptions?: Record<string, boolean>;
+  recordCanvas: boolean;
+  collectFonts: boolean;
+  inlineImages: boolean;
+  sampling: Record<string, unknown>;
+}
+
+export interface SessionReplayIframeProbeMessage {
+  type: typeof SESSION_REPLAY_IFRAME_PROBE;
+}
+
+export interface SessionReplayIframeStartMessage {
+  type: typeof SESSION_REPLAY_IFRAME_START;
+  options: SessionReplayIframePrivacyOptions;
+}
+
+export interface SessionReplayIframeStopMessage {
+  type: typeof SESSION_REPLAY_IFRAME_STOP;
+}
+
+export type SessionReplayIframeMessage =
+  | SessionReplayIframeProbeMessage
+  | SessionReplayIframeStartMessage
+  | SessionReplayIframeStopMessage;
+
+/**
+ * `srcdoc` HTML came from the immediate parent, so that parent already owns the
+ * document being rendered. Server-rendered extension URLs are stricter: only a
+ * parent on the render URL's origin may activate recording. That supports
+ * custom app domains without allowing an external embed host to make an opaque
+ * extension frame disclose its DOM through rrweb's postMessage transport.
+ */
+export function isTrustedSessionReplayIframeParentOrigin(
+  parentOrigin: string,
+  frameHref: string,
+): boolean {
+  if (frameHref === "about:srcdoc") {
+    return parentOrigin !== "null" && parentOrigin !== "";
+  }
+  try {
+    const frameOrigin = new URL(frameHref).origin;
+    return frameOrigin !== "null" && parentOrigin === frameOrigin;
+  } catch {
+    return false;
+  }
+}

package/corpus/core/src/shared/reasoning-effort.ts

@@ -170,6 +170,41 @@ function isClaudeReasoningModel(model: string) {
   return opusMatch ? parseInt(opusMatch[1], 10) >= 6 : false;
 }
 
+/**
+ * Anthropic's adaptive-thinking API is only available on the newer Claude
+ * model families. Claude Haiku 4.5 is reasoning-capable, but it still
+ * requires the legacy manual `budget_tokens` configuration.
+ */
+export function supportsClaudeAdaptiveThinking(model: string | undefined) {
+  if (!model) return false;
+  const id = model.toLowerCase().replace(/^anthropic\//, "");
+  if (id.includes("fable-5") || id.includes("mythos-5")) return true;
+  if (id.includes("sonnet-5") || id.includes("sonnet-4-6")) return true;
+  const opusMatch = id.match(/opus-4[-.](\d+)/);
+  return opusMatch ? parseInt(opusMatch[1], 10) >= 6 : false;
+}
+
+/**
+ * Map the shared reasoning ladder to Anthropic's manual thinking budgets for
+ * models that do not support adaptive thinking (currently Claude Haiku 4.5).
+ */
+export function anthropicManualThinkingBudget(effort: ReasoningEffort) {
+  switch (effort) {
+    case "low":
+      return 1_024;
+    case "medium":
+      return 4_096;
+    case "high":
+      return 8_000;
+    case "xhigh":
+      return 16_000;
+    case "max":
+      return 32_000;
+    default:
+      return 4_096;
+  }
+}
+
 function supportsClaudeXHigh(model: string) {
   const id = model.toLowerCase().replace(/^anthropic\//, "");
   // Models that support the xhigh effort tier (built-in extended thinking via

package/corpus/core/src/styles/agent-conversation.css

@@ -493,6 +493,32 @@
   -webkit-mask-image: linear-gradient(to bottom, transparent, black 1.5rem);
 }
 
+.agent-chat-collapse {
+  display: grid;
+  grid-template-rows: 1fr;
+  opacity: 1;
+  transition:
+    grid-template-rows 200ms var(--ease-collapse),
+    opacity 150ms ease-out;
+}
+
+.agent-chat-collapse[data-state="closed"] {
+  grid-template-rows: 0fr;
+  opacity: 0;
+  pointer-events: none;
+}
+
+.agent-chat-collapse__content {
+  min-height: 0;
+  overflow: hidden;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .agent-chat-collapse {
+    transition-duration: 0.01ms;
+  }
+}
+
 /* ─── Agent-Markdown (AssistantChat react-markdown render surface) ─────────── */
 /* These classes are applied by the SmoothMarkdownText/MarkdownText components  */
 /* in the AssistantChat/AssistantChatInner tree. The shiki dual-theme rules      */

package/corpus/core/src/templates/workspace-core/.agents/skills/external-agents/SKILL.md

@@ -160,15 +160,44 @@ tiny by default for ChatGPT/Claude-style app hosts, including OAuth MCP Apps
 callers and generic authenticated remote HTTP/static-token callers. The model
 sees the generic app-facing verbs (`list_apps`, `open_app`, `ask_app`, and
 app-only `create_embed_session`) and routes UI through
-`open_app({ embed: true })`. Stdio/code clients that explicitly identify as
-developer clients keep the full connected action surface, and
-`publicAgent.expose` remains the opt-in for safe read/ingest tools outside the
-compact MCP Apps catalog. Do not rely on action-specific `mcpApp` resources
-appearing in ChatGPT/Claude discovery by default; use `open_app` for the
+`open_app({ embed: true })`. Stdio/code clients use the same compact surface
+unless they explicitly opt into the full catalog, and
+`publicAgent.expose` remains the action-level opt-in for safe read/ingest tools
+outside the compact MCP Apps catalog. Apps can set
+`externalAgents.authenticatedReads: "auto"` to automatically advertise every
+action that is GET + `readOnly` + `publicAgent.requiresAuth`, instead of
+maintaining a long connector allow-list. This policy never includes writes by
+default; use `writes: "ask_app_only"` to keep mutations behind `ask_app`, and
+use `denyActions` for defense-in-depth vetoes. `tool-search` remains available
+for discovery, but a searched action still needs to be in the connector
+catalog, included by the authenticated-read policy, or enabled by the explicit
+full-catalog opt-in before `tools/call` can execute it. Do not rely on
+action-specific `mcpApp` resources appearing in ChatGPT/Claude discovery by
+default; use `open_app` for the
 first-class app embed path. If a specific
 action truly must remain visible in that compact app-host catalog, set
 `mcpApp.compactCatalog: true` as a rare escape hatch.
 
+Generic core `db-schema` and `db-query` are intentionally not automatic
+external reads. They remain available to the in-app agent through the normal
+scoped SQL path, but broad schema/SQL access is too powerful to infer from
+read-only metadata alone. If an app needs direct external querying, expose an
+app-owned bounded GET action or add an explicit table/column allow-list with
+row, byte, timeout, and audit limits. Keep `db-exec` and `db-patch` outside
+automatic external-agent exposure.
+
+Authentication and authorization are separate gates. A verified MCP OAuth or
+connect token identifies the caller and organization; `publicAgent` only opts
+an action into the external protocol surface and does not grant record access.
+Actions still need `accessFilter`, `resolveAccess`, or `assertAccess` so private
+documents/dashboards, shares, organization boundaries, and roles are enforced.
+For Slack, verified DMs are linked to an existing Agent Native org member
+before execution and run with that user's context; shared channels use a
+service principal, and guests/external members cannot borrow personal access.
+Managed Slack OAuth and the generated app manifest both request
+`users:read.email`; existing installs must reconnect/reinstall after a scope
+change, while legacy bot-token installs must add the scope in Slack manually.
+
 ### 1b. Fast-path expectations for MCP Apps hosts
 
 Keep ChatGPT/Claude paths short. For a known app-facing intent, the external

package/corpus/core/src/templates/workspace-core/.agents/skills/observability/SKILL.md

@@ -158,21 +158,6 @@ The agent loop reads active experiments via `resolveActiveExperimentConfig()` an
 
 Compute results with `POST /_agent-native/observability/experiments/:id/results`.
 
-#### First-party hosted default-model rollout
-
-First-party apps on `agent-native.com` automatically run the July 2026
-default-model experiment for authenticated users on the Builder engine:
-
-- 80% `claude-sonnet-5`
-- 20% `gpt-5-6-luna`
-- Assignment is sticky by normalized user email and shared across templates.
-- The rollout applies only when the user, app, and deployment have not selected
-  a model. Explicit model choices and BYO provider engines always win.
-- Set `AGENT_NATIVE_HOSTED_MODEL_EXPERIMENT=off` for an emergency rollback, or
-  `true` to exercise the rollout on a non-first-party preview.
-- `$ai_generation` tracking includes `experiment_id`,
-  `experiment_variant`, and `model_selection_source` for central analysis.
-
 In production, experiment management routes require the caller's email in the
 comma-separated `AGENT_NATIVE_EXPERIMENT_ADMIN_EMAILS` allowlist. This gate is
 separate from normal app/org admin roles because an experiment affects every

package/corpus/templates/analytics/.agents/skills/session-replay/SKILL.md

@@ -125,23 +125,29 @@ agent answers about browser recordings in the Analytics template.
   historical replays and resolve external imports/fonts at capture before
   blocking the recorded resource origins. Do not diagnose current font loss as
   CSP without checking the deployed response headers first.
-- Let rrweb own normal iframe sizing via Meta / ViewportResize, and keep the
-  outer wrapper in that same coordinate system for fit-to-stage scaling. Some
-  legacy recordings contain demonstrably corrupt 4,000–7,500px-wide viewport
-  values from ordinary desktop sessions. Only widths of at least 4,000px with
-  aspect ratios above 4:1 are recovered to a 16:10 viewport; real 32:9 and
-  mobile portrait captures remain untouched. The resize handler applies the
-  recovery to **both** rrweb's iframe and the outer stage. This includes the
-  historical 3,000–3,999px-wide, sub-1,000px-high malformed shape; do not
-  narrow the guard back to only 4,000px+ recordings.
-  Never remove this recovery, clamp only one layer, or broadly rewrite event
-  geometry: those changes repeatedly recreated the ribbon/clipping regression.
-- The malformed-viewport recovery's sole event-data exception is pointer
-  geometry: project MouseMove, TouchMove, Drag, and MouseInteraction x/y into
-  the corrected camera and clamp impossible coordinates. Correcting the iframe
-  without its paired pointer projection makes rrweb cast valid target ids
-  thousands of pixels off-stage. Normal-viewport pointer events must retain
-  their original object references and exact coordinates.
+- Let rrweb own iframe sizing entirely via Meta / ViewportResize, and keep the
+  outer wrapper on the exact same raw dimensions for fit-to-stage scaling.
+  Player geometry and pointer coordinates are fully stock and untouched — do
+  not add width/aspect-ratio "recovery" heuristics or pointer-coordinate
+  projection. There is no such thing as a stored recording with corrupt
+  viewport geometry: a census of all production recordings found zero stored
+  widths >= 3,000px. The 2026-07 "ultra-wide replay" bugs (stages rendered
+  3,000–9,500px wide, frozen/teleporting cursors, giant icons) were caused
+  entirely by demo mode's fetch interceptor: its number redactor faked any
+  integer >= 1000 inside raw replay JSON at *view* time, corrupting Meta /
+  ViewportResize widths, pointer x/y coordinates, and numeric values inside
+  `_cssText` and SVG attributes before rrweb ever saw the payload (heights
+  below 1000 stayed real, which is why the symptom looked like a viewport
+  problem rather than a redaction bug — two different sessions that both
+  stored a 1,152px width read back as the same 4,491px, a deterministic
+  salted-hash fingerprint of the redactor, not two coincidentally identical
+  malformed recordings). This is fixed in
+  `packages/core/src/demo/fetch-interceptor.ts`: raw replay payload and
+  manifest URLs are skipped from demo number redaction entirely, and must
+  never be routed through it again. Do not reintroduce viewport clamping or
+  pointer-coordinate projection in the player — they can now only corrupt
+  genuine future recordings (for example, a real 3440x900 ultrawide browser
+  window, or a short vertical window under 1,000px tall).
 - Keep rrweb's stock cursor stylesheet and its hotspot transform. During
   playback, hide the viewer's native pointer over Analytics' transparent
   click-to-pause overlay so it cannot masquerade as a frozen recorded cursor.
@@ -152,10 +158,13 @@ agent answers about browser recordings in the Analytics template.
   hide generic framework primitives such as
   `[data-radix-popper-content-wrapper]`: Radix dropdowns, selects, tooltips,
   and other real recorded product UI all share that wrapper.
-- Keep the realistic fidelity and malformed-viewport tests in
-  `SessionDetailPage.spec.ts`. Do not change their expectations merely to bless
-  a new sanitizer or raw ultra-wide sizing; validate the affected replay in a
-  browser first.
+- Keep the realistic-fidelity purity/pass-through tests in
+  `SessionDetailPage.spec.ts` — raw event identity, raw viewport dimensions,
+  and raw resize-state derivation (including the 3,189x885 tripwire against
+  reintroducing a clamp) — as regression guards against reintroducing any
+  viewport "recovery" or pointer-projection heuristic. Do not change their
+  expectations merely to bless a new sanitizer or clamp; validate the affected
+  replay in a browser first.
 - The event timeline soft-highlights the active marker, auto-scrolls it into
   view (pausing briefly after manual scroll), and supports search. It appears
   beside the player from ~880px content width upward.

package/corpus/templates/analytics/AGENTS.md

@@ -106,6 +106,33 @@ details live in `.agents/skills/`.
   / `$ai_latency`, `status`, `tool_calls`, `successful_tools`, `failed_tools`,
   and `$ai_error` / `error_message`. Do not expect prompts, tool args, or model
   responses in these tracked events by default.
+- External MCP callers should use `ask_app` as the default for multi-step
+  Analytics work. It can resolve a person's known email, correlate sessions
+  with captured errors, mint a temporary replay-context link, and inspect the
+  timeline, page navigation, console diagnostics, failed network requests, and
+  clicks when needed. The authenticated connector catalog is the fast fallback
+  and exposes only bounded, user/org-scoped read actions for incident triage:
+  `list-session-recordings`, `get-session-replay-summary`,
+  `get-session-replay-timeline`, `query-agent-native-analytics`,
+  `list-error-issues`, and `get-error-issue`. Fetch the summary before the
+  sanitized timeline; the timeline contains bounded page/click/error markers
+  without raw replay events or storage references. Do not add replay blob or
+  dashboard mutation actions to this catalog without an explicit security
+  review.
+- While Demo mode is enabled, session and error identities display anonymized
+  (`anonymous@builder.io`), so incident lookups must filter by the stable
+  `userId`/email parameter (e.g. `userId: "user@example.com"`) or recording/
+  issue id — never by matching emails read back from previously displayed
+  output.
+- Analytics opts into the framework's authenticated-read connector policy, so
+  every Analytics action explicitly marked GET + read-only +
+  `publicAgent.requiresAuth` is directly callable by a signed-in external
+  agent. This includes the incident reads above plus safe dashboard/analysis
+  reads. Generic core `db-schema` / `db-query` remain in-app agent tools and
+  are not automatically exposed because broad SQL/schema access is too
+  powerful to infer from read-only metadata. Writes remain `ask_app`-only.
+  Use the explicit catalog and `denyActions` policy for any unusually
+  sensitive read instead of exposing an unannotated action.
 - `/agents` is the Analytics home for admin surfaces. The default Monitoring
   view embeds the shared observability dashboard for traces, conversations,
   evals, experiments, and feedback. `/agents?view=dashboards` shows the

package/corpus/templates/analytics/actions/create-session-replay-agent-link.ts

@@ -20,7 +20,6 @@ export default defineAction({
   schema: z.object({
     recordingId: z.string().describe("The session_recordings id"),
   }),
-  readOnly: true,
   run: async (args) => {
     return createSessionReplayAgentLink({
       recordingId: args.recordingId,

package/corpus/templates/analytics/actions/get-error-issue.ts

@@ -28,6 +28,7 @@ export default defineAction({
   }),
   http: { method: "GET" },
   readOnly: true,
+  publicAgent: { expose: true, readOnly: true, requiresAuth: true },
   run: async (args) => {
     return getErrorIssue(resolveScope(), args.id, {
       eventsLimit: args.eventsLimit,

package/corpus/templates/analytics/actions/get-session-replay-summary.ts

@@ -21,6 +21,7 @@ export default defineAction({
   }),
   http: { method: "GET" },
   readOnly: true,
+  publicAgent: { expose: true, readOnly: true, requiresAuth: true },
   run: async (args) => {
     return getSessionReplaySummary(args.recordingId, resolveScope());
   },

package/corpus/templates/analytics/actions/get-session-replay-timeline.ts

@@ -0,0 +1,40 @@
+import { defineAction } from "@agent-native/core";
+import {
+  getRequestOrgId,
+  getRequestUserEmail,
+} from "@agent-native/core/server";
+import { z } from "zod";
+
+import { getSessionReplayTimeline } from "../server/lib/session-replay-agent-context.js";
+
+function resolveScope() {
+  const userEmail = getRequestUserEmail();
+  if (!userEmail) throw new Error("no authenticated user");
+  return { userEmail, orgId: getRequestOrgId() || null };
+}
+
+export default defineAction({
+  description:
+    "Get a bounded, sanitized timeline for one first-party Analytics session recording: page navigation, clicks, inputs, scrolls, custom events, console errors, and failed network requests. Returns marker metadata only; never returns raw rrweb/DOM/input values, replay chunks, or storage references. Use this after get-session-replay-summary when direct incident triage needs the user's click/page sequence.",
+  schema: z.object({
+    recordingId: z.string().describe("The session_recordings id"),
+    eventLimit: z.coerce
+      .number()
+      .int()
+      .min(1)
+      .max(10000)
+      .optional()
+      .default(10000)
+      .describe(
+        "Maximum replay events to inspect before building the capped timeline",
+      ),
+  }),
+  http: { method: "GET" },
+  readOnly: true,
+  publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  run: async (args) => {
+    return getSessionReplayTimeline(args.recordingId, resolveScope(), {
+      eventLimit: args.eventLimit,
+    });
+  },
+});

package/corpus/templates/analytics/actions/list-error-issues.ts

@@ -26,6 +26,18 @@ export default defineAction({
       .optional()
       .describe("Search across issue title, type, culprit, and fingerprint."),
     app: z.string().optional().describe("Optional app filter."),
+    sessionRecordingId: z
+      .string()
+      .optional()
+      .describe(
+        "Filter to issues with an occurrence in this session recording.",
+      ),
+    userId: z
+      .string()
+      .optional()
+      .describe(
+        "Filter to issues with an occurrence for this user ID or user key.",
+      ),
     sort: z
       .enum(["lastSeen", "eventCount", "firstSeen"])
       .optional()
@@ -34,6 +46,7 @@ export default defineAction({
   }),
   http: { method: "GET" },
   readOnly: true,
+  publicAgent: { expose: true, readOnly: true, requiresAuth: true },
   run: async (args) => {
     return listErrorIssues(resolveScope(), args);
   },

package/corpus/templates/analytics/actions/list-session-recordings.ts

@@ -58,6 +58,7 @@ export default defineAction({
   }),
   http: { method: "GET" },
   readOnly: true,
+  publicAgent: { expose: true, readOnly: true, requiresAuth: true },
   run: async (args) => {
     return listSessionRecordings(resolveScope(), args);
   },

package/corpus/templates/analytics/actions/query-agent-native-analytics.ts

@@ -33,7 +33,11 @@ export default defineAction({
     ),
   }),
   readOnly: true,
+  // No raw HTTP route: a GET endpoint would put caller SQL in query strings
+  // and access logs. External MCP callers reach this through the explicit
+  // ANALYTICS_CONNECTOR_CATALOG entry, which dispatches run() in-process.
   http: false,
+  publicAgent: { expose: true, readOnly: true, requiresAuth: true },
   run: async (args) => {
     return queryFirstPartyAnalytics(args.sql, resolveScope());
   },

package/corpus/templates/analytics/app/global.css

@@ -186,7 +186,7 @@
   .analytics-chat-intro {
   display: grid;
   width: 100%;
-  max-width: min(570px, 90%);
+  max-width: min(684px, 90%);
   gap: 0.5rem;
   margin: 0 auto 1rem;
   text-align: center;
@@ -223,7 +223,7 @@
   [data-agent-empty-state="centered"]
   .agent-plan-mode-callout {
   width: 100%;
-  max-width: min(570px, 90%);
+  max-width: min(684px, 90%);
   padding: 0;
 }