@agent-native/core 0.98.4 → 0.98.6

package/corpus/core/src/demo/config.ts

@@ -1,12 +1,12 @@
 /**
  * Demo mode gate.
  *
- * Demo mode replaces email addresses and numbers in every action result with
- * deterministic fake data — for both the UI and what the agent sees — while
- * preserving names, free text, labels, IDs, dates, URLs, and structure so the
- * app keeps working. The redaction WALK (see ./redact.ts) is expensive on
- * large payloads, so callers MUST gate it behind this function and only walk
- * when it returns true.
+ * Demo mode replaces every email address with `anonymous@builder.io` and
+ * anonymizes numbers in every action result — for both the UI and what the
+ * agent sees — while preserving names, free text, labels, IDs, dates, URLs,
+ * and structure so the app keeps working. The redaction WALK (see ./redact.ts)
+ * is expensive on large payloads, so callers MUST gate it behind this function
+ * and only walk when it returns true.
  *
  * This gate itself is intentionally cheap:
  *   - An env-forced deployment (a hosted demo site) short-circuits with zero

package/corpus/core/src/demo/fetch-interceptor.ts

@@ -46,10 +46,19 @@ const SKIP_SUBSTRINGS = [
   "/_agent-native/runs",
 ];
 
-// Raw rrweb payloads are playback data, not ordinary app UI records. Walking
-// and cloning their huge DOM/event trees on the main thread stalls playback
-// and can corrupt replay fidelity. Small list/summary/manifest responses stay
-// eligible so rendered visitor identities are still anonymized.
+// Raw rrweb payloads are playback data, not ordinary app UI records. Skipping
+// these is not just a perf optimization that avoids walking/cloning huge
+// DOM/event trees on the main thread: demo number
+// redaction previously ran over this exact raw replay JSON and faked any
+// integer >= 1000 it found — Meta/ViewportResize widths, pointer x/y
+// coordinates, and numeric values inside `_cssText` and SVG attributes. That
+// was the root cause of the 2026-07 "ultra-wide replay" bugs (stages
+// rendered thousands of pixels wide, frozen/teleporting cursors, giant
+// icons) even though every stored recording was always geometrically sane —
+// the corruption happened at *view* time, not at capture/storage time. Small
+// list/summary/manifest responses stay eligible so rendered visitor identities
+// are still anonymized. NEVER remove the raw payload skips or broaden them to
+// metadata endpoints that the UI renders directly.
 const RAW_REPLAY_PAYLOAD_RE =
   /\/api\/session-replay\/recordings\/[^/?#]+\/(?:chunks(?:\/[^/?#]+)?|events)(?:[/?#]|$)/;
 const RAW_AGENT_REPLAY_EVENTS_RE =

package/corpus/core/src/demo/redact.ts

@@ -1,13 +1,12 @@
 /**
  * Pure, dependency-free, deterministic demo-mode redactor.
  *
- * Replaces sensitive values (emails and free numbers) with stable fake
- * substitutes so a demo looks coherent — the same input always maps to the
- * same fake. Crucially, it NEVER rewrites identifiers, structural tokens, or
- * timestamps. Names and other free text are deliberately left alone because
- * guessing whether arbitrary text is a person's name is too inaccurate. The
- * string redactor uses a protect-first strategy (mask IDs with opaque
- * placeholders before any transform runs, restore them byte-identical
+ * Replaces every email with one canonical anonymous address and free numbers
+ * with stable fake substitutes. Crucially, it NEVER rewrites identifiers,
+ * structural tokens, or timestamps. Names and other free text are deliberately
+ * left alone because guessing whether arbitrary text is a person's name is too
+ * inaccurate. The string redactor uses a protect-first strategy (mask IDs with
+ * opaque placeholders before any transform runs, restore them byte-identical
  * afterwards), and the structure-aware walker additionally protects leaf
  * values by key name.
  */
@@ -58,10 +57,6 @@ function seededRng(value: string, salt: string): () => number {
   return mulberry32(seedFn());
 }
 
-function pick<T>(rng: () => number, pool: readonly T[]): T {
-  return pool[Math.floor(rng() * pool.length) % pool.length];
-}
-
 /* ------------------------------------------------------------------ *
  * Stable mapping cache (bounded, TTL, leak-free)
  *
@@ -157,150 +152,19 @@ function memoFake(
   return value;
 }
 
-/* ------------------------------------------------------------------ *
- * Curated name pools
- * ------------------------------------------------------------------ */
-
-const FIRST_NAMES: readonly string[] = [
-  "Jane",
-  "John",
-  "Alex",
-  "Maria",
-  "Sam",
-  "Olivia",
-  "Liam",
-  "Emma",
-  "Noah",
-  "Ava",
-  "Lucas",
-  "Mia",
-  "Ethan",
-  "Sofia",
-  "Mason",
-  "Isla",
-  "Leo",
-  "Aria",
-  "Henry",
-  "Zoe",
-  "Owen",
-  "Nora",
-  "Caleb",
-  "Lily",
-  "Ryan",
-  "Ruby",
-  "Adam",
-  "Chloe",
-  "Eli",
-  "Hazel",
-  "Max",
-  "Iris",
-  "Ben",
-  "Clara",
-  "Theo",
-  "Maya",
-  "Felix",
-  "Elena",
-  "Jonah",
-  "Greta",
-];
-
-const LAST_NAMES: readonly string[] = [
-  "Doe",
-  "Smith",
-  "Johnson",
-  "Lee",
-  "Brown",
-  "Garcia",
-  "Miller",
-  "Davis",
-  "Wilson",
-  "Moore",
-  "Taylor",
-  "Anderson",
-  "Thomas",
-  "Jackson",
-  "White",
-  "Harris",
-  "Martin",
-  "Clark",
-  "Lewis",
-  "Walker",
-  "Hall",
-  "Young",
-  "King",
-  "Wright",
-  "Hill",
-  "Green",
-  "Adams",
-  "Baker",
-  "Nelson",
-  "Carter",
-  "Mitchell",
-  "Perez",
-  "Roberts",
-  "Turner",
-  "Phillips",
-  "Campbell",
-  "Parker",
-  "Evans",
-  "Edwards",
-  "Collins",
-];
-
 /* ------------------------------------------------------------------ *
  * Fake value generators (deterministic in value + salt)
  * ------------------------------------------------------------------ */
 
-// Realistic-looking but safe stand-in domains: real consumer providers (the
-// local part is fake, so no real mailbox is implied) plus the canonical
-// reserved fictional-company domains (Contoso/Fabrikam/Northwind), which read
-// as real businesses but are intentional placeholders. No example.com.
-const FAKE_EMAIL_DOMAINS: readonly string[] = [
-  "gmail.com",
-  "outlook.com",
-  "icloud.com",
-  "yahoo.com",
-  "proton.me",
-  "hey.com",
-  "fastmail.com",
-  "contoso.com",
-  "fabrikam.com",
-  "northwind.com",
-  "acme.io",
-  "globex.net",
-];
+export const DEMO_ANONYMOUS_EMAIL = "anonymous@builder.io";
 
 function fakeEmail(original: string, salt: string): string {
-  return memoFake("email", original.toLowerCase(), salt, () => {
-    const rng = seededRng(`email:${original.toLowerCase()}`, salt);
-    const first = pick(rng, FIRST_NAMES).toLowerCase();
-    const last = pick(rng, LAST_NAMES).toLowerCase();
-    const domain = pick(rng, FAKE_EMAIL_DOMAINS);
-    // Vary the local part so addresses don't all look templated.
-    const shape = Math.floor(rng() * 6);
-    let local: string;
-    switch (shape) {
-      case 0:
-        local = `${first}.${last}`;
-        break;
-      case 1:
-        local = `${first}${last}`;
-        break;
-      case 2:
-        local = `${first[0]}${last}`;
-        break;
-      case 3:
-        local = `${first}.${last}${1 + Math.floor(rng() * 89)}`;
-        break;
-      case 4:
-        local = `${first}_${last}`;
-        break;
-      default:
-        local = `${last}.${first}`;
-        break;
-    }
-    return `${local}@${domain}`;
-  });
+  return memoFake(
+    "email",
+    original.toLowerCase(),
+    salt,
+    () => DEMO_ANONYMOUS_EMAIL,
+  );
 }
 
 /**

package/corpus/core/src/extensions/html-shell.ts

@@ -1,3 +1,5 @@
+import { buildSessionReplayIframeBootstrap } from "./session-replay-iframe.js";
+
 const EXTENSION_IFRAME_CSP_BASE =
   "default-src 'none'; script-src 'self' https://cdn.jsdelivr.net 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src https://fonts.gstatic.com; connect-src 'self'; img-src 'self' data: blob:; media-src 'self' data: blob:; frame-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none';";
 
@@ -744,6 +746,7 @@ export function buildExtensionHtml(
 	      }
 	    });
 	  </script>
+	${buildSessionReplayIframeBootstrap()}
 	</head>
 	<body${extensionId ? ` data-extension-id="${extensionIdAttr}" data-tool-id="${extensionIdAttr}"` : ""} class="text-foreground">
 	${content}

package/corpus/core/src/extensions/session-replay-iframe.ts

@@ -0,0 +1,131 @@
+import {
+  isTrustedSessionReplayIframeParentOrigin,
+  SESSION_REPLAY_IFRAME_PROBE,
+  SESSION_REPLAY_IFRAME_START,
+  SESSION_REPLAY_IFRAME_STOP,
+} from "../session-replay-iframe-protocol.js";
+
+export const RRWEB_RECORD_IFRAME_CDN_URL =
+  "https://cdn.jsdelivr.net/npm/@rrweb/record@2.1.0/umd/record.min.js";
+export const RRWEB_RECORD_IFRAME_SRI =
+  "sha384-MrD66HBNSykaP2N95+6hQCFlF5oH2tvL3TD/zyvHNkP/sAFWZx98DX9MEDy8MdVT";
+
+/**
+ * Installs the cooperative side of rrweb's cross-origin iframe protocol.
+ * Nothing is fetched or recorded until a trusted first-party parent asks the
+ * frame to start. rrweb then forwards its events directly to that parent.
+ */
+export function buildSessionReplayIframeBootstrap(): string {
+  const probeType = JSON.stringify(SESSION_REPLAY_IFRAME_PROBE);
+  const startType = JSON.stringify(SESSION_REPLAY_IFRAME_START);
+  const stopType = JSON.stringify(SESSION_REPLAY_IFRAME_STOP);
+  const scriptUrl = JSON.stringify(RRWEB_RECORD_IFRAME_CDN_URL);
+  const integrity = JSON.stringify(RRWEB_RECORD_IFRAME_SRI);
+
+  return `<script>
+    (function() {
+      var recorderStop = null;
+      var recorderLoad = null;
+      var startGeneration = 0;
+      var isTrustedParentOrigin = ${isTrustedSessionReplayIframeParentOrigin.toString()};
+
+      function stopRecorder() {
+        startGeneration += 1;
+        if (typeof recorderStop === 'function') {
+          try { recorderStop(); } catch (_) {}
+        }
+        recorderStop = null;
+      }
+
+      function getRecord() {
+        return window.rrwebRecord && typeof window.rrwebRecord.record === 'function'
+          ? window.rrwebRecord.record
+          : null;
+      }
+
+      function loadRecorder() {
+        if (recorderLoad) return recorderLoad;
+        recorderLoad = new Promise(function(resolve, reject) {
+          var script = document.createElement('script');
+          script.src = ${scriptUrl};
+          script.integrity = ${integrity};
+          script.crossOrigin = 'anonymous';
+          script.referrerPolicy = 'no-referrer';
+          script.async = true;
+          script.onload = function() {
+            var record = getRecord();
+            if (record) resolve(record);
+            else reject(new Error('rrweb recorder did not initialize'));
+          };
+          script.onerror = function() {
+            recorderLoad = null;
+            reject(new Error('rrweb recorder failed to load'));
+          };
+          document.head.appendChild(script);
+        });
+        return recorderLoad;
+      }
+
+      function validOptions(options) {
+        return !!options &&
+          typeof options === 'object' &&
+          typeof options.blockSelector === 'string' &&
+          typeof options.ignoreSelector === 'string' &&
+          typeof options.maskTextSelector === 'string' &&
+          typeof options.maskAllInputs === 'boolean' &&
+          typeof options.recordCanvas === 'boolean' &&
+          typeof options.collectFonts === 'boolean' &&
+          typeof options.inlineImages === 'boolean' &&
+          !!options.sampling && typeof options.sampling === 'object';
+      }
+
+      function startRecorder(options) {
+        if (!validOptions(options)) return;
+        stopRecorder();
+        var generation = startGeneration;
+        loadRecorder().then(function(record) {
+          if (generation !== startGeneration) return;
+          recorderStop = record({
+            blockSelector: options.blockSelector,
+            ignoreSelector: options.ignoreSelector,
+            maskTextClass: options.maskTextClass,
+            maskTextSelector: options.maskTextSelector,
+            maskAllInputs: options.maskAllInputs,
+            maskInputOptions: options.maskInputOptions,
+            recordCanvas: options.recordCanvas,
+            collectFonts: options.collectFonts,
+            inlineImages: options.inlineImages,
+            sampling: options.sampling,
+            recordCrossOriginIframes: true
+          }) || null;
+        }).catch(function() {});
+      }
+
+      window.addEventListener('message', function(event) {
+        if (event.source !== window.parent || !isTrustedParentOrigin(event.origin, window.location.href)) return;
+        var message = event.data;
+        if (!message || typeof message !== 'object') return;
+        if (message.type === ${startType}) startRecorder(message.options);
+        else if (message.type === ${stopType}) stopRecorder();
+      });
+      window.addEventListener('pagehide', stopRecorder);
+
+      if (window.parent !== window) {
+        window.parent.postMessage({ type: ${probeType} }, '*');
+      }
+    })();
+  </script>`;
+}
+
+export function injectSessionReplayIframeBootstrap(html: string): string {
+  const bootstrap = buildSessionReplayIframeBootstrap();
+  const headClose = html.search(/<\/head\s*>/i);
+  if (headClose >= 0) {
+    return `${html.slice(0, headClose)}${bootstrap}${html.slice(headClose)}`;
+  }
+  const bodyOpen = html.search(/<body(?:\s[^>]*)?>/i);
+  if (bodyOpen >= 0) {
+    return `${html.slice(0, bodyOpen)}${bootstrap}${html.slice(bodyOpen)}`;
+  }
+  return `${bootstrap}${html}`;
+}

package/corpus/core/src/integrations/adapters/slack.ts

@@ -38,6 +38,23 @@ const SLACK_PERMALINK_TIMEOUT_MS = 1_000;
 const SLACK_CONTEXT_MESSAGE_LIMIT = 15;
 const SLACK_CONTEXT_TEXT_LIMIT = 2_000;
 const SLACK_CALM_PROGRESS_THRESHOLD_SECONDS = 30;
+const SLACK_IDENTITY_TIMEOUT_MS = 1_000;
+const SLACK_IDENTITY_CACHE_TTL_MS = 10 * 60 * 1_000;
+// Failed users.info lookups only get a short negative TTL: a transient Slack
+// API blip must not fail-close a sender's identity (and DMs) for 10 minutes.
+const SLACK_IDENTITY_NEGATIVE_CACHE_TTL_MS = 30 * 1_000;
+const SLACK_IDENTITY_CACHE_MAX_ENTRIES = 1_000;
+
+interface SlackUserIdentity {
+  email: string | null;
+  name: string | null;
+  memberType: "owner" | "admin" | "member" | "guest" | "external" | "unknown";
+}
+
+const slackIdentityCache = new Map<
+  string,
+  { identity: SlackUserIdentity | null; expiresAt: number }
+>();
 
 export interface SlackAdapterOptions {
   /** Resolve the bot token for the exact Slack installation. */
@@ -356,6 +373,14 @@ export function slackAdapter(
       return hydrateSlackContext(token, incoming);
     },
 
+    async hydrateIncomingIdentity(
+      incoming: IncomingMessage,
+    ): Promise<IncomingMessage> {
+      const token = await resolveBotToken(incoming);
+      if (!token) return incoming;
+      return hydrateSlackIdentity(token, incoming);
+    },
+
     async startRunProgress(
       incoming: IncomingMessage,
     ): Promise<PlatformRunProgress | null> {
@@ -1070,6 +1095,93 @@ async function slackJson(
   }
 }
 
+function slackIdentityCacheKey(incoming: IncomingMessage): string | null {
+  const teamId = incoming.platformContext.teamId;
+  const senderId = incoming.senderId;
+  if (typeof senderId !== "string" || !senderId.trim()) return null;
+  return `${typeof teamId === "string" && teamId ? teamId : "unknown"}:${senderId}`;
+}
+
+async function resolveSlackUserIdentity(
+  token: string,
+  incoming: IncomingMessage,
+): Promise<SlackUserIdentity | null> {
+  const cacheKey = slackIdentityCacheKey(incoming);
+  if (!cacheKey) return null;
+  const cached = slackIdentityCache.get(cacheKey);
+  if (cached && cached.expiresAt > Date.now()) return cached.identity;
+  if (cached) slackIdentityCache.delete(cacheKey);
+
+  const user = await slackJson(
+    token,
+    "users.info",
+    { user: incoming.senderId! },
+    SLACK_IDENTITY_TIMEOUT_MS,
+  );
+  const profile = user?.user?.profile;
+  const identity: SlackUserIdentity | null = user?.user
+    ? {
+        email:
+          typeof profile?.email === "string" && profile.email.trim()
+            ? profile.email.trim().toLowerCase()
+            : null,
+        name:
+          typeof profile?.real_name === "string" && profile.real_name.trim()
+            ? profile.real_name.trim()
+            : typeof profile?.display_name === "string" &&
+                profile.display_name.trim()
+              ? profile.display_name.trim()
+              : typeof user.user.real_name === "string" &&
+                  user.user.real_name.trim()
+                ? user.user.real_name.trim()
+                : typeof user.user.name === "string" && user.user.name.trim()
+                  ? user.user.name.trim()
+                  : null,
+        memberType: user.user.is_ultra_restricted
+          ? "external"
+          : user.user.is_restricted
+            ? "guest"
+            : user.user.is_owner
+              ? "owner"
+              : user.user.is_admin
+                ? "admin"
+                : "member",
+      }
+    : null;
+  if (slackIdentityCache.size >= SLACK_IDENTITY_CACHE_MAX_ENTRIES) {
+    const oldestKey = slackIdentityCache.keys().next().value;
+    if (oldestKey) slackIdentityCache.delete(oldestKey);
+  }
+  slackIdentityCache.set(cacheKey, {
+    identity,
+    expiresAt:
+      Date.now() +
+      (identity
+        ? SLACK_IDENTITY_CACHE_TTL_MS
+        : SLACK_IDENTITY_NEGATIVE_CACHE_TTL_MS),
+  });
+  return identity;
+}
+
+async function hydrateSlackIdentity(
+  token: string,
+  incoming: IncomingMessage,
+): Promise<IncomingMessage> {
+  const identity = await resolveSlackUserIdentity(token, incoming);
+  if (!identity) return incoming;
+  return {
+    ...incoming,
+    ...(identity.name ? { senderName: identity.name } : {}),
+    ...(identity.email
+      ? { senderEmail: identity.email, senderVerified: true }
+      : { senderVerified: false }),
+    actorTrust: {
+      memberType: identity.memberType,
+      verified: true,
+    },
+  };
+}
+
 async function hydrateSlackContext(
   token: string,
   incoming: IncomingMessage,
@@ -1081,7 +1193,7 @@ async function hydrateSlackContext(
     return incoming;
   }
 
-  const [thread, history, pins, conversation, user] = await Promise.all([
+  const [thread, history, pins, conversation, identity] = await Promise.all([
     slackJson(token, "conversations.replies", {
       channel: channelId,
       ts: threadTs,
@@ -1095,7 +1207,7 @@ async function hydrateSlackContext(
     }),
     slackJson(token, "pins.list", { channel: channelId }),
     slackJson(token, "conversations.info", { channel: channelId }),
-    senderId ? slackJson(token, "users.info", { user: senderId }) : null,
+    senderId ? resolveSlackUserIdentity(token, incoming) : null,
   ]);
 
   // Agent View can attach the Slack surface the user is currently viewing to
@@ -1186,9 +1298,9 @@ async function hydrateSlackContext(
       })
     : [];
 
-  const profile = user?.user?.profile;
-  const isGuest = user?.user?.is_restricted === true;
-  const isExternal = user?.user?.is_ultra_restricted === true;
+  const profile = identity;
+  const isGuest = identity?.memberType === "guest";
+  const isExternal = identity?.memberType === "external";
   const isPrivate = conversation?.channel?.is_private === true;
   const isExternalShared = conversation?.channel?.is_ext_shared === true;
   const isMpim = conversation?.channel?.is_mpim === true;
@@ -1231,17 +1343,15 @@ async function hydrateSlackContext(
   );
   return {
     ...incoming,
-    ...(typeof profile?.display_name === "string" && profile.display_name
-      ? { senderName: profile.display_name }
-      : typeof profile?.real_name === "string" && profile.real_name
-        ? { senderName: profile.real_name }
-        : {}),
-    ...(typeof profile?.email === "string"
+    ...(profile?.name ? { senderName: profile.name } : {}),
+    ...(profile?.email
       ? { senderEmail: profile.email, senderVerified: true }
-      : {}),
+      : { senderVerified: false }),
     conversationType,
     actorTrust: {
-      memberType: isExternal ? "external" : isGuest ? "guest" : "member",
+      memberType:
+        identity?.memberType ??
+        (isExternal ? "external" : isGuest ? "guest" : "member"),
       verified: true,
     },
     contextMessages: hydratedMessages,