@agent-native/core 0.98.5 → 0.98.6

package/corpus/templates/analytics/app/pages/sessions/SessionsPage.tsx

@@ -21,7 +21,7 @@ import {
   IconSettings,
 } from "@tabler/icons-react";
 import { useQuery } from "@tanstack/react-query";
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { Link, useNavigate, useSearchParams } from "react-router";
 import { toast } from "sonner";
 
@@ -169,6 +169,40 @@ type SessionRecordingDevice = Pick<SessionRecordingSummary, "metadata">;
 const RANGE_OPTIONS: ReplayRange[] = ["24h", "7d", "30d", "90d", "all"];
 const SESSION_QUERY_DEBOUNCE_MS = 250;
 
+/**
+ * Local input state for a URL-backed filter, debounced into the URL.
+ *
+ * `urlValue` only resyncs local state when it changes for a reason other
+ * than this hook's own debounced write (back/forward navigation, an agent
+ * driven URL change, etc). React Router commits `setSearchParams` inside a
+ * transition, so without this guard the echo of our own write can land
+ * after a newer keystroke and clobber it.
+ */
+export function useDebouncedUrlFilter(
+  urlValue: string,
+  onCommit: (value: string) => void,
+): [string, (value: string) => void] {
+  const [input, setInput] = useState(urlValue);
+  const lastPushedRef = useRef(urlValue);
+
+  useEffect(() => {
+    if (urlValue === lastPushedRef.current) return;
+    lastPushedRef.current = urlValue;
+    setInput(urlValue);
+  }, [urlValue]);
+
+  useEffect(() => {
+    if (input === urlValue) return;
+    const timeout = window.setTimeout(() => {
+      lastPushedRef.current = input;
+      onCommit(input);
+    }, SESSION_QUERY_DEBOUNCE_MS);
+    return () => window.clearTimeout(timeout);
+  }, [input, urlValue, onCommit]);
+
+  return [input, setInput];
+}
+
 export default function SessionsPage() {
   const t = useT();
   const navigate = useNavigate();
@@ -176,13 +210,8 @@ export default function SessionsPage() {
   const range = readRange(searchParams.get("range"));
   const app = searchParams.get("app") ?? "";
   const query = searchParams.get("q") ?? "";
-  const [queryInput, setQueryInput] = useState(query);
   const from = useMemo(() => rangeToFrom(range), [range]);
 
-  useEffect(() => {
-    setQueryInput(query);
-  }, [query]);
-
   const updateFilter = useCallback(
     (key: string, value: string) => {
       setSearchParams(
@@ -200,13 +229,17 @@ export default function SessionsPage() {
     [setSearchParams],
   );
 
-  useEffect(() => {
-    if (queryInput === query) return;
-    const timeout = window.setTimeout(() => {
-      updateFilter("q", queryInput);
-    }, SESSION_QUERY_DEBOUNCE_MS);
-    return () => window.clearTimeout(timeout);
-  }, [query, queryInput, updateFilter]);
+  const commitQuery = useCallback(
+    (value: string) => updateFilter("q", value),
+    [updateFilter],
+  );
+  const [queryInput, setQueryInput] = useDebouncedUrlFilter(query, commitQuery);
+
+  const commitApp = useCallback(
+    (value: string) => updateFilter("app", value),
+    [updateFilter],
+  );
+  const [appInput, setAppInput] = useDebouncedUrlFilter(app, commitApp);
 
   const { data, isLoading, isFetching, refetch, error } = useActionQuery<
     SessionRecordingSummary[]
@@ -291,10 +324,8 @@ export default function SessionsPage() {
                       {t("sessions.userFilters")}
                     </div>
                     <Input
-                      value={app}
-                      onChange={(event) =>
-                        updateFilter("app", event.target.value)
-                      }
+                      value={appInput}
+                      onChange={(event) => setAppInput(event.target.value)}
                       placeholder={t("sessions.appPlaceholder")}
                       className="h-9"
                     />

package/corpus/templates/analytics/changelog/2026-07-12-connected-external-agents-can-now-look-up-sessions-error-iss.md

@@ -0,0 +1,6 @@
+---
+type: added
+date: 2026-07-12
+---
+
+Connected external agents can now look up sessions, error issues, and sanitized replay timelines directly, with the app agent remaining the default path.

package/corpus/templates/analytics/changelog/2026-07-12-session-identities-stay-visible-when-demo-mode-is-off.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-12
+---
+
+Session identities stay visible when Demo mode is off

package/corpus/templates/analytics/server/lib/analytics-connector-catalog.ts

@@ -2,12 +2,12 @@
  * The deliberately small authenticated MCP surface for Analytics.
  *
  * Keep this list read-only and incident-focused. In particular, do not add
- * replay-event/blob actions or dashboard/data mutation actions here.
+ * raw replay-event/blob actions or dashboard/data mutation actions here.
  */
 export const ANALYTICS_CONNECTOR_CATALOG = [
   "list-session-recordings",
   "get-session-replay-summary",
-  "get-session-replay-events",
+  "get-session-replay-timeline",
   "query-agent-native-analytics",
   "list-error-issues",
   "get-error-issue",

package/corpus/templates/analytics/server/lib/error-capture.ts

@@ -18,7 +18,7 @@ import { fileURLToPath } from "node:url";
  * reads go through `accessFilter` so an org-scoped key surfaces its issues to
  * the whole org exactly like session recordings.
  */
-import { readAppState } from "@agent-native/core/application-state";
+import { appStateGet } from "@agent-native/core/application-state";
 import { notifyWithDelivery } from "@agent-native/core/notifications";
 import { recordChange } from "@agent-native/core/server";
 import { accessFilter } from "@agent-native/core/sharing";
@@ -26,6 +26,7 @@ import {
   and,
   desc,
   eq,
+  exists,
   inArray,
   isNull,
   notInArray,
@@ -1073,6 +1074,8 @@ export interface ListErrorIssuesFilters {
   status?: IssueStatus | "all";
   query?: string;
   app?: string;
+  sessionRecordingId?: string;
+  userId?: string;
   sort?: "lastSeen" | "eventCount" | "firstSeen";
   limit?: number;
 }
@@ -1106,10 +1109,14 @@ export function anonymizeErrorReportingEmails<T>(value: T): T {
   return value;
 }
 
-async function isErrorDemoModeEnabled(): Promise<boolean> {
+async function isErrorDemoModeEnabled(
+  userEmail?: string | null,
+): Promise<boolean> {
   if (process.env.DEMO_MODE === "true") return true;
+  if (!userEmail) return false;
   try {
-    const state = await readAppState("demo-mode");
+    // Keep demo state tied to the caller whose issues are being read.
+    const state = await appStateGet(userEmail, "demo-mode");
     return state?.enabled === true;
   } catch {
     return false;
@@ -1195,7 +1202,7 @@ export async function listErrorIssues(
   scope: ErrorReadScope,
   filters: ListErrorIssuesFilters = {},
 ): Promise<ErrorIssueSummary[]> {
-  const demoModeEnabled = isErrorDemoModeEnabled();
+  const demoModeEnabled = isErrorDemoModeEnabled(scope.userEmail);
   const db = getDb() as any;
   const limit = Math.min(
     MAX_ISSUE_LIMIT,
@@ -1206,6 +1213,41 @@ export async function listErrorIssues(
     conditions.push(eq(schema.errorIssues.status, filters.status));
   }
   if (filters.app) conditions.push(eq(schema.errorIssues.app, filters.app));
+  const sessionRecordingId = filters.sessionRecordingId?.trim();
+  const userId = filters.userId?.trim();
+  if (sessionRecordingId || userId) {
+    const occurrenceConditions: any[] = [
+      eq(schema.errorEvents.issueId, schema.errorIssues.id),
+      // Keep the child occurrence in the same tenant as its parent issue even
+      // when the issue is visible through an org share.
+      eq(schema.errorEvents.ownerEmail, schema.errorIssues.ownerEmail),
+      or(
+        eq(schema.errorEvents.orgId, schema.errorIssues.orgId),
+        and(isNull(schema.errorEvents.orgId), isNull(schema.errorIssues.orgId)),
+      ),
+    ];
+    if (sessionRecordingId) {
+      occurrenceConditions.push(
+        eq(schema.errorEvents.sessionRecordingId, sessionRecordingId),
+      );
+    }
+    if (userId) {
+      occurrenceConditions.push(
+        or(
+          eq(schema.errorEvents.userId, userId),
+          eq(schema.errorEvents.userKey, userId),
+        ),
+      );
+    }
+    conditions.push(
+      exists(
+        db
+          .select({ id: schema.errorEvents.id })
+          .from(schema.errorEvents)
+          .where(and(...occurrenceConditions)),
+      ),
+    );
+  }
   const query = filters.query?.trim();
   if (query) {
     conditions.push(
@@ -1343,7 +1385,7 @@ export async function getErrorIssue(
   issueId: string,
   options: { eventsLimit?: number } = {},
 ): Promise<ErrorIssueDetail> {
-  const demoModeEnabled = isErrorDemoModeEnabled();
+  const demoModeEnabled = isErrorDemoModeEnabled(scope.userEmail);
   const db = getDb() as any;
   const [issueRow] = await db
     .select()

package/corpus/templates/analytics/server/lib/session-replay-agent-context.ts

@@ -22,6 +22,7 @@ import {
 } from "../../shared/session-replay-diagnostics.js";
 import {
   compactSessionRecordingSummary,
+  getSessionReplayEvents,
   getSessionReplaySummary,
   getSessionReplayTokenizedEvents,
   getSessionReplayTokenizedSummary,
@@ -82,20 +83,16 @@ function replayStartedAt(events: AgentReplayEvent[]): number {
 
 function pathLabel(href: string): string {
   try {
-    const parsed = new URL(href);
-    return parsed.pathname || parsed.hostname;
+    const parsed = new URL(href, "https://placeholder.agent-native.local");
+    return boundedDiagnosticText(
+      parsed.pathname || parsed.hostname,
+      MAX_DIAGNOSTIC_URL_CHARS,
+    );
   } catch {
-    return href;
+    return boundedDiagnosticText(href, MAX_DIAGNOSTIC_URL_CHARS);
   }
 }
 
-function markerDetail(event: AgentReplayEvent): string | null {
-  const payload = event.data?.payload;
-  if (typeof payload?.message === "string") return payload.message;
-  if (typeof event.data?.href === "string") return event.data.href;
-  return null;
-}
-
 const TIMELINE_MARKER_CAP = 200;
 const TIMELINE_ERROR_MARKER_RESERVE = 100;
 const MAX_DIAGNOSTIC_MESSAGE_CHARS = 1_000;
@@ -528,10 +525,9 @@ function buildReplayTimeline(events: AgentReplayEvent[]) {
         if (isFailedSessionReplayNetworkStatus(status)) {
           const method =
             boundedDiagnosticText(tagged.payload.method, 16) || "GET";
-          const url = boundedDiagnosticText(
-            tagged.payload.url,
-            MAX_DIAGNOSTIC_URL_CHARS,
-          );
+          // External-agent timelines intentionally expose only a path label.
+          // Query strings commonly contain emails, tokens, and other secrets.
+          const url = pathLabel(String(tagged.payload.url ?? ""));
           markers.push({
             timestamp,
             offsetMs: Math.max(0, timestamp - startedAt),
@@ -553,7 +549,7 @@ function buildReplayTimeline(events: AgentReplayEvent[]) {
         offsetMs: Math.max(0, timestamp - startedAt),
         kind: "navigation",
         label: pathLabel(event.data.href),
-        detail: event.data.href,
+        detail: pathLabel(event.data.href),
       });
     } else if (
       event.type === RRWEB_EVENT_TYPE.IncrementalSnapshot &&
@@ -606,8 +602,14 @@ function buildReplayTimeline(events: AgentReplayEvent[]) {
         timestamp,
         offsetMs: Math.max(0, timestamp - startedAt),
         kind: "custom",
-        label: String(event.data?.tag ?? "Custom event"),
-        detail: markerDetail(event),
+        label: boundedDiagnosticText(
+          String(event.data?.tag ?? "Custom event"),
+          MAX_DIAGNOSTIC_MESSAGE_CHARS,
+        ),
+        // Custom-event payloads are application-defined and can contain input
+        // values or secrets. The tag and timestamp are sufficient metadata for
+        // this sanitized external-agent timeline.
+        detail: null,
       });
     }
   }
@@ -615,6 +617,36 @@ function buildReplayTimeline(events: AgentReplayEvent[]) {
   return capReplayTimelineMarkers(markers);
 }
 
+export async function getSessionReplayTimeline(
+  recordingId: string,
+  scope: ReplayScope,
+  options: { eventLimit?: number } = {},
+) {
+  const eventLimit = Math.min(
+    10_000,
+    Math.max(1, Math.floor(options.eventLimit ?? 10_000)),
+  );
+  const eventsResponse = await getSessionReplayEvents(recordingId, scope, {
+    limit: eventLimit,
+  });
+  const events = eventsResponse.chunks.flatMap((chunk) =>
+    chunk.events.filter(
+      (event): event is AgentReplayEvent =>
+        Boolean(event) && typeof event === "object",
+    ),
+  );
+  const markers = buildReplayTimeline(events);
+
+  return {
+    recording: compactSessionRecordingSummary(eventsResponse.recording),
+    markerCount: markers.length,
+    markers,
+    eventCount: eventsResponse.eventCount,
+    truncated: eventsResponse.truncated,
+    unavailableChunks: eventsResponse.unavailableChunks,
+  };
+}
+
 export function verifySessionReplayAgentAccess(
   recordingId: string,
   token: string,

package/corpus/templates/analytics/server/lib/session-replay.ts

@@ -2,14 +2,18 @@ import { Buffer } from "node:buffer";
 import { createHash, randomUUID } from "node:crypto";
 import { gzipSync, gunzipSync } from "node:zlib";
 
-import { readAppState } from "@agent-native/core/application-state";
+import { appStateGet } from "@agent-native/core/application-state";
 import {
   deletePrivateBlob,
   putPrivateBlob,
   readPrivateBlob,
   type PrivateBlobHandle,
 } from "@agent-native/core/private-blob";
-import { recordChange, runWithRequestContext } from "@agent-native/core/server";
+import {
+  getRequestUserEmail,
+  recordChange,
+  runWithRequestContext,
+} from "@agent-native/core/server";
 import {
   accessFilter,
   resolveAccess,
@@ -301,10 +305,15 @@ function isBuilderEmail(value: unknown): boolean {
   return normalizedEmail(value)?.endsWith("@builder.io") === true;
 }
 
-async function isSessionDemoModeEnabled(): Promise<boolean> {
+async function isSessionDemoModeEnabled(
+  userEmail?: string | null,
+): Promise<boolean> {
   if (process.env.DEMO_MODE === "true") return true;
+  if (!userEmail) return false;
   try {
-    const state = await readAppState("demo-mode");
+    // These reads also run from custom routes and actions, so use the
+    // authenticated scope explicitly instead of ambient request state.
+    const state = await appStateGet(userEmail, "demo-mode");
     return state?.enabled === true;
   } catch {
     return false;
@@ -1677,7 +1686,7 @@ export async function listSessionRecordings(
   filters: SessionReplayListFilters = {},
 ): Promise<SessionRecordingSummary[]> {
   const db = getDb() as any;
-  const demoMode = await isSessionDemoModeEnabled();
+  const demoMode = await isSessionDemoModeEnabled(scope.userEmail);
   const limit = Math.min(
     MAX_SESSION_RECORDINGS_LIMIT,
     Math.max(1, filters.limit ?? DEFAULT_SESSION_RECORDINGS_LIMIT),
@@ -1759,7 +1768,7 @@ export async function getSessionReplaySummary(
   recordingId: string,
   scope: SessionReplayScope,
 ): Promise<SessionRecordingSummary> {
-  const demoMode = await isSessionDemoModeEnabled();
+  const demoMode = await isSessionDemoModeEnabled(scope.userEmail);
   const access = await resolveAccess("session-recording", recordingId, {
     userEmail: scope.userEmail,
     orgId: scope.orgId ?? undefined,
@@ -1778,7 +1787,7 @@ export async function getSessionReplaySummary(
 export async function getSessionReplayTokenizedSummary(
   recordingId: string,
 ): Promise<SessionRecordingSummary> {
-  const demoMode = await isSessionDemoModeEnabled();
+  const demoMode = await isSessionDemoModeEnabled(getRequestUserEmail());
   const db = getDb() as any;
   // guard:allow-unscoped -- called only after verifySessionReplayAgentAccess(recordingId, token) verifies a signed, recording-scoped agent_access token.
   const [row] = await db

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -258,6 +258,10 @@ export default createAgentChatPlugin({
   // AGENT_PROD_CODE_EXECUTION=trusted to also enable bash/read/edit/write.
   codeExecution: { production: "sandboxed" },
   connectorCatalog: [...ANALYTICS_CONNECTOR_CATALOG],
+  externalAgents: {
+    authenticatedReads: "auto",
+    writes: "ask_app_only",
+  },
   resolveOrgId: async (event) => {
     const ctx = await getOrgContext(event);
     return ctx.orgId;

package/corpus/templates/analytics/server/plugins/db.ts

@@ -1249,6 +1249,21 @@ const runAnalyticsMigrations = runMigrations(
         sqlite: `ALTER TABLE monitor_incidents ADD COLUMN IF NOT EXISTS notification_delivered INTEGER NOT NULL DEFAULT 0`,
       },
     },
+    {
+      version: 118,
+      name: "error-events-session-recording-filter-idx",
+      sql: `CREATE INDEX IF NOT EXISTS error_events_session_recording_filter_idx ON error_events (session_recording_id, owner_email, org_id, issue_id)`,
+    },
+    {
+      version: 119,
+      name: "error-events-user-id-filter-idx",
+      sql: `CREATE INDEX IF NOT EXISTS error_events_user_id_filter_idx ON error_events (user_id, owner_email, org_id, issue_id)`,
+    },
+    {
+      version: 120,
+      name: "error-events-user-key-filter-idx",
+      sql: `CREATE INDEX IF NOT EXISTS error_events_user_key_filter_idx ON error_events (user_key, owner_email, org_id, issue_id)`,
+    },
   ],
   { table: "analytics_migrations" },
 );

package/corpus/templates/forms/app/global.css

@@ -181,7 +181,7 @@
 
 .forms-ask-chat-panel [data-agent-empty-state="centered"] {
   justify-content: center;
-  padding-bottom: clamp(4rem, 12vh, 8rem);
+  padding-bottom: clamp(2rem, 6vh, 4rem);
 }
 
 .forms-ask-chat-panel [data-agent-empty-state="centered"] .agent-chat-scroll {
@@ -269,12 +269,28 @@
 }
 
 .forms-ask-chat-panel [data-agent-empty-state="centered"] .forms-chat-intro {
-  display: grid;
-  justify-items: center;
-  gap: 0.75rem;
-  margin: 0 auto 1rem;
-  padding-bottom: 1.25rem;
+  display: contents;
+}
+
+.forms-ask-chat-panel [data-agent-empty-state="centered"] .forms-chat-intro h1,
+.forms-ask-chat-panel [data-agent-empty-state="centered"] .forms-chat-intro p {
+  width: 100%;
   text-align: center;
+  order: 1;
+}
+
+.forms-ask-chat-panel [data-agent-empty-state="centered"] .forms-chat-intro h1 {
+  margin: 0 0 0.5rem;
+}
+
+.forms-ask-chat-panel [data-agent-empty-state="centered"] .forms-chat-intro p {
+  margin: 0 auto 1rem;
+}
+
+.forms-ask-chat-panel
+  [data-agent-empty-state="centered"]
+  .agent-composer-stack {
+  order: 2;
 }
 
 .forms-chat-intro h1 {
@@ -297,10 +313,11 @@
   flex-wrap: wrap;
   justify-content: center;
   gap: 0.5rem;
-  padding-top: 0.125rem;
+  order: 3;
+  margin: 0.75rem auto 0;
 }
 
-.forms-chat-pill-row span {
+.forms-chat-pill-row button {
   display: inline-flex;
   align-items: center;
   gap: 0.375rem;
@@ -310,8 +327,37 @@
   box-shadow: var(--forms-shadow-control);
   padding: 0.375rem 0.625rem;
   color: hsl(var(--muted-foreground));
+  cursor: pointer;
   font-size: 0.75rem;
   font-weight: 600;
+  transition-property: background-color, border-color, color, scale;
+  transition-duration: 150ms;
+  transition-timing-function: ease-out;
+}
+
+.forms-chat-pill-row button:hover {
+  border-color: hsl(var(--foreground) / 0.2);
+  background: hsl(var(--background));
+  color: hsl(var(--foreground));
+}
+
+.forms-chat-pill-row button:focus-visible {
+  outline: none;
+  box-shadow: var(--forms-shadow-focus);
+}
+
+.forms-chat-pill-row button:active {
+  scale: 0.96;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .forms-chat-pill-row button {
+    transition: none;
+  }
+
+  .forms-chat-pill-row button:active {
+    scale: 1;
+  }
 }
 
 @media (min-width: 640px) {

package/corpus/templates/forms/app/pages/AskPage.tsx

@@ -1,6 +1,7 @@
 import {
   AgentChatSurface,
   markAgentChatHomeHandoff,
+  sendToAgentChat,
   useT,
 } from "@agent-native/core/client";
 import { IconChartBar, IconDatabase, IconSettings } from "@tabler/icons-react";
@@ -26,6 +27,28 @@ export function AskPage() {
     };
   }, []);
 
+  function prefillSuggestion(message: string) {
+    sendToAgentChat({ message, submit: false, chatTarget: "local" });
+  }
+
+  const suggestions = [
+    {
+      label: t("home.pillForms"),
+      prompt: "@forms",
+      icon: IconDatabase,
+    },
+    {
+      label: t("home.pillAnalytics"),
+      prompt: "analytics",
+      icon: IconChartBar,
+    },
+    {
+      label: t("home.pillConfiguration"),
+      prompt: "configuration",
+      icon: IconSettings,
+    },
+  ];
+
   return (
     <div className="flex h-full min-h-0 flex-col bg-background">
       <AgentChatSurface
@@ -48,19 +71,18 @@ export function AskPage() {
           <div className="forms-chat-intro">
             <h1>{t("home.heading")}</h1>
             <p>{t("home.description")}</p>
-            <div className="forms-chat-pill-row" aria-hidden="true">
-              <span className="forms-chat-pill">
-                <IconDatabase className="size-3.5" />
-                {t("home.pillForms")}
-              </span>
-              <span className="forms-chat-pill">
-                <IconChartBar className="size-3.5" />
-                {t("home.pillAnalytics")}
-              </span>
-              <span className="forms-chat-pill">
-                <IconSettings className="size-3.5" />
-                {t("home.pillConfiguration")}
-              </span>
+            <div className="forms-chat-pill-row">
+              {suggestions.map(({ icon: Icon, label, prompt }) => (
+                <button
+                  key={prompt}
+                  type="button"
+                  className="forms-chat-pill"
+                  onClick={() => prefillSuggestion(prompt)}
+                >
+                  <Icon className="size-3.5" />
+                  {label}
+                </button>
+              ))}
             </div>
           </div>
         }