@agent-native/core 0.98.6 → 0.98.8

package/corpus/core/src/integrations/plugin.ts

@@ -53,7 +53,10 @@ import {
   startGoogleDocsPoller,
   handlePushNotification,
 } from "./google-docs-poller.js";
-import { resolveDefaultIntegrationExecutionContext } from "./identity.js";
+import {
+  IntegrationIdentityDeclinedError,
+  resolveDefaultIntegrationExecutionContext,
+} from "./identity.js";
 import {
   disconnectIntegrationInstallation,
   listIntegrationInstallations,
@@ -77,6 +80,7 @@ import {
   claimPendingTask,
   getNextPendingTaskIdForThread,
   insertPendingTask,
+  isDuplicateEventError,
   MAX_PENDING_TASK_ATTEMPTS,
   markTaskCompleted,
   markTaskFailed,
@@ -137,6 +141,7 @@ import type {
   IntegrationsPluginOptions,
   IntegrationStatus,
   IntegrationExecutionContext,
+  IncomingMessage,
 } from "./types.js";
 import {
   listIntegrationUsageBudgets,
@@ -252,6 +257,28 @@ type IntegrationCredentialContext = {
 
 const REMOTE_DEVICE_ONLINE_MS = 90_000;
 
+// One decline reply per sender + decline reason per window: during a Slack
+// API outage every message would otherwise get another identical "try again"
+// reply. Short enough that a persistent condition still reminds the sender.
+const DECLINE_NOTICE_DEDUPE_TTL_MS = 5 * 60 * 1_000;
+const SYSTEM_NOTICE_DEDUPE_TTL_MS = 24 * 60 * 60 * 1_000;
+
+type IntegrationSystemNoticeTaskPayload = {
+  kind: "system-notice";
+  incoming: IncomingMessage;
+  text: string;
+  dedupeKey?: string;
+  dedupeTtlMs?: number;
+};
+
+function systemNoticeEventKey(
+  dedupeKey: string,
+  ttlMs: number,
+  now = Date.now(),
+): string {
+  return `system-notice:${dedupeKey}:${Math.floor(now / ttlMs)}`;
+}
+
 export async function enqueueRemoteCommand(
   envelope: RemoteCodeCommandEnvelope,
 ): Promise<Record<string, unknown>> {
@@ -629,6 +656,66 @@ export function createIntegrationsPlugin(
     const h3 = getH3App(nitroApp);
     const P = `${FRAMEWORK_ROUTE_PREFIX}/integrations`;
 
+    async function enqueueSystemNotice(
+      event: any,
+      incoming: IncomingMessage,
+      text: string,
+      opts?: { dedupeKey?: string; dedupeTtlMs?: number },
+    ): Promise<void> {
+      if (!text.trim()) return;
+      const taskId = `notice-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+      const dedupeTtlMs = Math.max(
+        1,
+        opts?.dedupeTtlMs ?? SYSTEM_NOTICE_DEDUPE_TTL_MS,
+      );
+      const noticeThreadId = `system-notice:${taskId}`;
+      const payload: IntegrationSystemNoticeTaskPayload = {
+        kind: "system-notice",
+        incoming,
+        text,
+        ...(opts?.dedupeKey ? { dedupeKey: opts.dedupeKey } : {}),
+        ...(opts?.dedupeTtlMs ? { dedupeTtlMs: opts.dedupeTtlMs } : {}),
+      };
+      try {
+        await insertPendingTask({
+          id: taskId,
+          platform: incoming.platform,
+          // System notices are auxiliary delivery work, not the user's agent
+          // run. Give each notice its own queue lane so a retrying notice cannot
+          // block the real message task for this Slack/Telegram thread.
+          externalThreadId: noticeThreadId,
+          payload: JSON.stringify(payload),
+          ownerEmail: `integration@${incoming.platform}`,
+          externalEventKey: opts?.dedupeKey
+            ? systemNoticeEventKey(opts.dedupeKey, dedupeTtlMs)
+            : undefined,
+        });
+      } catch (err) {
+        if (isDuplicateEventError(err)) return;
+        throw err;
+      }
+
+      // The SQL row is the durable source of truth. This best-effort self-call
+      // only reduces latency; the recurring pending-task sweep retries a row
+      // if the serverless host freezes this webhook execution immediately.
+      let token: string | undefined;
+      try {
+        token = signInternalToken(taskId);
+      } catch (err) {
+        if (process.env.NODE_ENV === "production") throw err;
+      }
+      void fetch(`${getBaseUrl(event)}${P}/process-task`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          ...(token ? { Authorization: `Bearer ${token}` } : {}),
+        },
+        body: JSON.stringify({ taskId }),
+      }).catch((err) => {
+        console.warn("[integrations] System notice dispatch failed:", err);
+      });
+    }
+
     async function requireSession(event: any): Promise<boolean> {
       const session = await getSession(event).catch(() => null);
       if (session?.email) return true;
@@ -1542,6 +1629,34 @@ export function createIntegrationsPlugin(
               isIntegrationCaller: true,
             },
             async () => {
+              const taskPayload = JSON.parse(task.payload) as
+                | IntegrationSystemNoticeTaskPayload
+                | { kind?: undefined };
+              if (taskPayload.kind === "system-notice") {
+                if (!adapter.sendSystemNotice) {
+                  throw new Error(
+                    `Platform ${task.platform} cannot deliver system notices`,
+                  );
+                }
+                const config = await getIntegrationConfig(task.platform);
+                const credentialContext =
+                  await credentialContextForIntegrationConfig(config);
+                await withCredentialContext(credentialContext, () =>
+                  adapter.sendSystemNotice!(
+                    taskPayload.incoming,
+                    taskPayload.text,
+                    {
+                      ...(taskPayload.dedupeKey
+                        ? { dedupeKey: taskPayload.dedupeKey }
+                        : {}),
+                      ...(taskPayload.dedupeTtlMs
+                        ? { dedupeTtlMs: taskPayload.dedupeTtlMs }
+                        : {}),
+                    },
+                  ),
+                );
+                return;
+              }
               const resources = await loadResourcesForPrompt(
                 task.ownerEmail,
                 true,
@@ -2370,7 +2485,8 @@ export function createIntegrationsPlugin(
             null;
           if (
             incoming.platform === "slack" &&
-            incoming.conversationType === "dm"
+            incoming.conversationType === "dm" &&
+            !options?.resolveExecutionContext
           ) {
             try {
               defaultExecutionContext = await withCredentialContext(
@@ -2378,17 +2494,48 @@ export function createIntegrationsPlugin(
                 () => resolveDefaultIntegrationExecutionContext(incoming!),
               );
             } catch (err) {
-              // An app-specific resolver may intentionally support a legacy
-              // Slack setup. When no override exists, the branch below fails
-              // closed instead of falling back to a service principal.
-              if (!options?.resolveExecutionContext && !options?.resolveOwner) {
+              // The legacy owner-only resolver predates org-bound identities
+              // and must not turn a rejected Slack DM into an authenticated
+              // owner run. Custom resolveExecutionContext is checked above and
+              // skips this default ladder entirely so apps can fully own auth
+              // without framework membership checks or identity side effects.
+              const declined =
+                err instanceof IntegrationIdentityDeclinedError ? err : null;
+              if (declined) {
+                console.warn(
+                  `[integrations] default Slack DM identity declined message:`,
+                  declined.message,
+                );
+                if (adapter.sendSystemNotice) {
+                  try {
+                    await enqueueSystemNotice(
+                      event,
+                      incoming!,
+                      declined.userFacingMessage,
+                      {
+                        dedupeKey: `decline:${incoming!.tenantId ?? "unknown"}:${incoming!.senderId ?? "unknown"}:${declined.reason}`,
+                        dedupeTtlMs: DECLINE_NOTICE_DEDUPE_TTL_MS,
+                      },
+                    );
+                  } catch (noticeErr) {
+                    console.warn(
+                      `[integrations] could not persist decline notice:`,
+                      noticeErr instanceof Error
+                        ? noticeErr.message
+                        : noticeErr,
+                    );
+                    setResponseStatus(event, 500);
+                    return { error: "notice enqueue failed" };
+                  }
+                }
+              } else {
                 console.error(
                   `[integrations] default Slack DM identity denied message:`,
                   err,
                 );
-                setResponseStatus(event, 200);
-                return "ok";
               }
+              setResponseStatus(event, 200);
+              return "ok";
             }
           }
           let executionContext: IntegrationExecutionContext = {
@@ -2413,6 +2560,66 @@ export function createIntegrationsPlugin(
             }
           } else if (defaultExecutionContext) {
             executionContext = defaultExecutionContext;
+            if (defaultExecutionContext.anonymousMember) {
+              if (!options?.allowAnonymousOrgScopedSlackDm) {
+                const senderEmail =
+                  typeof incoming.senderEmail === "string" &&
+                  incoming.senderEmail.trim()
+                    ? incoming.senderEmail.trim()
+                    : null;
+                const noticeText = senderEmail
+                  ? `I couldn't match your Slack account to an organization member, so I can't run this request. Ask an organization admin to add ${senderEmail}, then try again.`
+                  : "I couldn't verify your Slack account email, so I can't run this request. Ask an organization admin to reconnect Slack with the users:read.email scope, then try again.";
+                if (adapter.sendSystemNotice) {
+                  try {
+                    await enqueueSystemNotice(event, incoming, noticeText, {
+                      dedupeKey: `anonymous-tier-disabled:${incoming.tenantId ?? "unknown"}:${incoming.senderId ?? "unknown"}`,
+                    });
+                  } catch (noticeErr) {
+                    console.warn(
+                      `[integrations] could not persist unlinked-member notice:`,
+                      noticeErr instanceof Error
+                        ? noticeErr.message
+                        : noticeErr,
+                    );
+                    setResponseStatus(event, 500);
+                    return { error: "notice enqueue failed" };
+                  }
+                }
+                setResponseStatus(event, 200);
+                return "ok";
+              }
+              // The anonymous tier must never be silent. (1) The agent run
+              // can tell: the note rides the serialized `incoming` into the
+              // queued task and surfaces via <integration-context>.
+              incoming.identityNote =
+                "Caller is an unlinked Slack workspace member running with organization-wide visibility only; personal or privately-shared data is not accessible. They can get personal access by having an admin add their Slack email to the organization (or by reconnecting Slack with the users:read.email scope).";
+              // (2) The sender gets a one-time heads-up through the same
+              // durable SQL queue as agent work. The self-dispatch is only a
+              // latency optimization; the retry sweep guarantees delivery.
+              if (adapter.sendSystemNotice) {
+                const senderEmail =
+                  typeof incoming.senderEmail === "string" &&
+                  incoming.senderEmail.trim()
+                    ? incoming.senderEmail.trim()
+                    : null;
+                const noticeText = senderEmail
+                  ? `Heads up: I couldn't match your Slack account to an organization member, so I can only use org-wide data. Ask an admin to add ${senderEmail} to the organization for personal access.`
+                  : "Heads up: I couldn't verify your Slack account's email, so I can only use org-wide data. Ask an admin to update the Slack connection with the users:read.email scope for personal access.";
+                try {
+                  await enqueueSystemNotice(event, incoming, noticeText, {
+                    dedupeKey: `anonymous-tier:${incoming.tenantId ?? "unknown"}:${incoming.senderId ?? "unknown"}`,
+                  });
+                } catch (noticeErr) {
+                  console.warn(
+                    `[integrations] could not persist anonymous-tier notice:`,
+                    noticeErr instanceof Error ? noticeErr.message : noticeErr,
+                  );
+                  setResponseStatus(event, 500);
+                  return { error: "notice enqueue failed" };
+                }
+              }
+            }
           } else if (options?.resolveOwner) {
             try {
               executionContext.ownerEmail = await withCredentialContext(

package/corpus/core/src/integrations/types.ts

@@ -104,6 +104,13 @@ export interface IncomingMessage {
     targetAgent?: string;
     instruction: string;
   };
+  /**
+   * Trusted app-side note about the caller's identity/visibility tier, set
+   * after execution-context resolution (e.g. an anonymous org-scoped Slack
+   * member). Surfaced to the agent as integration context. Adapters must not
+   * copy this from user-controlled webhook payload fields.
+   */
+  identityNote?: string;
   /** Provider-native message/activity reference for contextual replies. */
   replyRef?: string;
   /** Message timestamp (epoch ms) */
@@ -311,6 +318,23 @@ export interface PlatformAdapter {
     opts?: { placeholderRef?: string },
   ): Promise<void>;
 
+  /**
+   * Send a short best-effort system notice to the conversation the incoming
+   * message arrived on (polite identity declines, one-time access guidance).
+   * Bypasses agent formatting. When `dedupeKey` is provided, the adapter may
+   * drop the notice if the same key was sent recently. Callers must treat
+   * failures as non-fatal.
+   */
+  sendSystemNotice?(
+    incoming: IncomingMessage,
+    text: string,
+    opts?: {
+      dedupeKey?: string;
+      /** Dedupe window for `dedupeKey`. Adapters pick a default when omitted. */
+      dedupeTtlMs?: number;
+    },
+  ): Promise<void>;
+
   /**
    * Optionally post a "working on it…" placeholder message immediately when a
    * webhook arrives, before the agent loop runs. Adapters that support
@@ -414,6 +438,13 @@ export interface IntegrationsPluginOptions {
   resolveExecutionContext?: (
     incoming: IncomingMessage,
   ) => IntegrationExecutionContext | Promise<IntegrationExecutionContext>;
+  /**
+   * Explicitly allow an unlinked, verified Slack workspace member to run a DM
+   * with the installation organization's shared/service visibility. Disabled
+   * by default: DM identity resolution fails closed unless an app deliberately
+   * accepts this wider access tier.
+   */
+  allowAnonymousOrgScopedSlackDm?: boolean;
   /**
    * Optional preprocessor for inbound platform messages. Can intercept special
    * commands (such as `/link`) before the agent loop runs.
@@ -436,4 +467,10 @@ export interface IntegrationExecutionContext {
   principalType: "user" | "service";
   installationId?: string;
   scopeId?: string;
+  /**
+   * True when a hydrated full workspace member could not be matched to an
+   * organization member and runs with the anonymous org-scoped service
+   * principal (org-wide visibility only, nothing user-private).
+   */
+  anonymousMember?: boolean;
 }

package/corpus/core/src/integrations/webhook-handler.ts

@@ -745,6 +745,7 @@ async function processIncomingMessage(
     incoming.senderName ? `Sender name: ${incoming.senderName}` : null,
     incoming.senderEmail ? `Sender email: ${incoming.senderEmail}` : null,
     incoming.senderId ? `Sender ID: ${incoming.senderId}` : null,
+    incoming.identityNote ? `Caller identity: ${incoming.identityNote}` : null,
     incoming.sourceUrl ? `Source thread: ${incoming.sourceUrl}` : null,
     incoming.routingHint?.targetAgent
       ? `Required target agent: ${incoming.routingHint.targetAgent}`

package/corpus/core/src/mcp/builtin-tools.ts

@@ -858,8 +858,11 @@ function askAppTool(
   return {
     tool: tool(
       "Send a natural-language message to an app's AI agent and get its " +
-        "response. Use for complex, multi-step tasks needing the agent's " +
-        "reasoning and full app context. In a single-app project the 'app' " +
+        "response. Use this first for natural-language investigation, " +
+        "diagnosis, multi-step work, and changes; it runs with the app's " +
+        "full skills, instructions, tools, and context. Use direct action " +
+        "tools only for a known, bounded read or simple UI handoff. In a " +
+        "single-app project the 'app' " +
         "param is optional (defaults to this app). When 'app' names a " +
         "different workspace app it is routed there over A2A; the result's " +
         "'routedVia' field reports whether it ran cross-app or locally. " +

package/corpus/templates/analytics/.agents/skills/session-replay/SKILL.md

@@ -164,7 +164,10 @@ agent answers about browser recordings in the Analytics template.
   reintroducing a clamp) — as regression guards against reintroducing any
   viewport "recovery" or pointer-projection heuristic. Do not change their
   expectations merely to bless a new sanitizer or clamp; validate the affected
-  replay in a browser first.
+  replay in a browser first. An interim clamp for the exact 3,189x885 pair was
+  also deleted once the view-time redaction root cause was proven; the earlier
+  3,000-3,999px band was rejected because it also catches real 3440px-wide
+  displays. Neither the exact exception nor the band belongs in the player.
 - The event timeline soft-highlights the active marker, auto-scrolls it into
   view (pausing briefly after manual scroll), and supports search. It appears
   beside the player from ~880px content width upward.

package/corpus/templates/analytics/AGENTS.md

@@ -124,15 +124,15 @@ details live in `.agents/skills/`.
   `userId`/email parameter (e.g. `userId: "user@example.com"`) or recording/
   issue id — never by matching emails read back from previously displayed
   output.
-- Analytics opts into the framework's authenticated-read connector policy, so
-  every Analytics action explicitly marked GET + read-only +
-  `publicAgent.requiresAuth` is directly callable by a signed-in external
-  agent. This includes the incident reads above plus safe dashboard/analysis
-  reads. Generic core `db-schema` / `db-query` remain in-app agent tools and
-  are not automatically exposed because broad SQL/schema access is too
-  powerful to infer from read-only metadata. Writes remain `ask_app`-only.
-  Use the explicit catalog and `denyActions` policy for any unusually
-  sensitive read instead of exposing an unannotated action.
+- Analytics keeps its direct MCP surface explicitly curated, so external
+  agents should use `ask_app` for multi-step investigation and changes. The
+  six incident reads above are bounded, user/org-scoped fallback tools for
+  callers that already know which lookup they need. Generic core
+  `db-schema` / `db-query` remain in-app agent tools and are not exposed
+  directly because broad SQL/schema access is too powerful to infer from
+  read-only metadata. Writes remain `ask_app`-only. Use the explicit catalog
+  and `denyActions` policy for any unusually sensitive read instead of
+  exposing an unannotated action.
 - `/agents` is the Analytics home for admin surfaces. The default Monitoring
   view embeds the shared observability dashboard for traces, conversations,
   evals, experiments, and feedback. `/agents?view=dashboards` shows the

package/corpus/templates/analytics/changelog/2026-07-12-analytics-uses-the-full-in-app-agent-for-multi-step-incident.md

@@ -0,0 +1,6 @@
+---
+type: improved
+date: 2026-07-12
+---
+
+Analytics uses the full in-app agent for multi-step incident investigations, with direct read tools available for focused lookups.

package/corpus/templates/analytics/server/handlers/session-replay.ts

@@ -12,8 +12,8 @@ import {
 
 import { runApiHandlerWithContext } from "../lib/credentials";
 import {
+  resolveSessionReplayAgentAccess,
   SESSION_REPLAY_AGENT_ACCESS_PARAM,
-  verifySessionReplayAgentAccess,
 } from "../lib/session-replay-agent-context.js";
 import {
   getSessionReplayManifest,
@@ -236,12 +236,13 @@ function replayChunkSeqsFromQuery(query: Record<string, unknown>): number[] {
 function verifyAgentReplayAccessToken(
   event: any,
   recordingId: string,
-): string | null {
+): { token: string; viewerEmail: string } | null | false {
   const token = readAgentReplayAccessToken(event);
   if (!token) return null;
-  if (verifySessionReplayAgentAccess(recordingId, token)) return token;
+  const access = resolveSessionReplayAgentAccess(recordingId, token);
+  if (access) return { token, viewerEmail: access.viewerEmail };
   setResponseStatus(event, 401);
-  return "";
+  return false;
 }
 
 function listFiltersFromQuery(
@@ -371,13 +372,16 @@ export const handleSessionReplayManifest = defineEventHandler(async (event) => {
   }
 
   const agentAccessToken = verifyAgentReplayAccessToken(event, recordingId);
-  if (agentAccessToken === "") {
+  if (agentAccessToken === false) {
     return { error: "Invalid or expired agent access" };
   }
   if (agentAccessToken) {
     try {
       applyAgentReplayReadHeaders(event);
-      const manifest = await getSessionReplayTokenizedManifest(recordingId);
+      const manifest = await getSessionReplayTokenizedManifest(
+        recordingId,
+        agentAccessToken.viewerEmail,
+      );
       return {
         ...manifest,
         chunks: manifest.chunks.map((chunk) => ({
@@ -385,7 +389,7 @@ export const handleSessionReplayManifest = defineEventHandler(async (event) => {
           bytesPath: appendQueryParam(
             chunk.bytesPath,
             SESSION_REPLAY_AGENT_ACCESS_PARAM,
-            agentAccessToken,
+            agentAccessToken.token,
           ),
         })),
       };
@@ -419,7 +423,7 @@ export const handleSessionReplayChunkBytes = defineEventHandler(
     }
 
     const agentAccessToken = verifyAgentReplayAccessToken(event, recordingId);
-    if (agentAccessToken === "") {
+    if (agentAccessToken === false) {
       return { error: "Invalid or expired agent access" };
     }
     if (agentAccessToken) {
@@ -427,6 +431,7 @@ export const handleSessionReplayChunkBytes = defineEventHandler(
         const result = await readSessionReplayTokenizedChunkBytes(
           recordingId,
           seq,
+          agentAccessToken.viewerEmail,
         );
         applyAgentReplayReadHeaders(event);
         setResponseHeader(event, "Content-Type", "application/json");
@@ -472,7 +477,7 @@ export const handleSessionReplayChunkBatch = defineEventHandler(
     const seqs = replayChunkSeqsFromQuery(getQuery(event));
 
     const agentAccessToken = verifyAgentReplayAccessToken(event, recordingId);
-    if (agentAccessToken === "") {
+    if (agentAccessToken === false) {
       return { error: "Invalid or expired agent access" };
     }
     if (agentAccessToken) {
@@ -480,6 +485,7 @@ export const handleSessionReplayChunkBatch = defineEventHandler(
         const result = await readSessionReplayTokenizedChunkBatch(
           recordingId,
           seqs,
+          agentAccessToken.viewerEmail,
         );
         applyAgentReplayReadHeaders(event);
         setResponseHeader(event, "Content-Type", "application/json");

package/corpus/templates/analytics/server/lib/session-replay-agent-context.ts

@@ -651,10 +651,22 @@ export function verifySessionReplayAgentAccess(
   recordingId: string,
   token: string,
 ): boolean {
-  return verifyScopedAgentAccessToken(token, {
+  return resolveSessionReplayAgentAccess(recordingId, token) !== null;
+}
+
+export function resolveSessionReplayAgentAccess(
+  recordingId: string,
+  token: string,
+): { viewerEmail: string } | null {
+  const result = verifyScopedAgentAccessToken(token, {
     resourceKind: SESSION_REPLAY_AGENT_ACCESS_TOKEN_PREFIX,
     resourceId: recordingId,
-  }).ok;
+  });
+  // Replay grants are always minted by an authenticated viewer. Fail closed
+  // for grants without that signed identity: demo-mode policy is viewer-scoped,
+  // so guessing from the ambient request could expose identities to agents.
+  if (!result.ok || !result.viewerEmail) return null;
+  return { viewerEmail: result.viewerEmail };
 }
 
 export async function createSessionReplayAgentLink({
@@ -707,14 +719,18 @@ export async function buildSessionReplayAgentContext({
   origin?: string;
   includeTimeline?: boolean;
 }) {
-  if (!verifySessionReplayAgentAccess(recordingId, token)) {
+  const access = resolveSessionReplayAgentAccess(recordingId, token);
+  if (!access) {
     const error = Object.assign(new Error("Invalid or expired agent access"), {
       statusCode: 401,
     });
     throw error;
   }
 
-  const recording = await getSessionReplayTokenizedSummary(recordingId);
+  const recording = await getSessionReplayTokenizedSummary(
+    recordingId,
+    access.viewerEmail,
+  );
   const resolvedOrigin = appOrigin(origin);
   const basePath = appBasePath();
   const contextUrl = buildAgentAccessApiUrl({
@@ -747,7 +763,9 @@ export async function buildSessionReplayAgentContext({
   });
 
   const eventsResponse = includeTimeline
-    ? await getSessionReplayTokenizedEvents(recording.id, { limit: 10000 })
+    ? await getSessionReplayTokenizedEvents(recording.id, access.viewerEmail, {
+        limit: 10000,
+      })
     : null;
   const events =
     eventsResponse?.chunks.flatMap((chunk) =>

package/corpus/templates/analytics/server/lib/session-replay.ts

@@ -1786,8 +1786,13 @@ export async function getSessionReplaySummary(
 
 export async function getSessionReplayTokenizedSummary(
   recordingId: string,
+  viewerEmail: string,
 ): Promise<SessionRecordingSummary> {
-  const demoMode = await isSessionDemoModeEnabled(getRequestUserEmail());
+  // Tokenized reads often run without an authenticated request session. Use
+  // the viewer identity embedded in the signed, recording-scoped grant so a
+  // link minted while demo mode is enabled cannot reveal real identities when
+  // it is opened in a signed-out browser or by an external agent.
+  const demoMode = await isSessionDemoModeEnabled(viewerEmail);
   const db = getDb() as any;
   // guard:allow-unscoped -- called only after verifySessionReplayAgentAccess(recordingId, token) verifies a signed, recording-scoped agent_access token.
   const [row] = await db
@@ -1847,6 +1852,7 @@ export async function getSessionReplayManifest(
 
 export async function getSessionReplayTokenizedManifest(
   recordingId: string,
+  viewerEmail: string,
 ): Promise<{
   recording: AgentSessionRecordingSummary;
   chunks: Array<{
@@ -1859,7 +1865,10 @@ export async function getSessionReplayTokenizedManifest(
     bytesPath: string;
   }>;
 }> {
-  const recording = await getSessionReplayTokenizedSummary(recordingId);
+  const recording = await getSessionReplayTokenizedSummary(
+    recordingId,
+    viewerEmail,
+  );
   const manifest = await getSessionReplayManifestForRecording(recording);
   return {
     ...manifest,
@@ -1923,6 +1932,7 @@ export async function readSessionReplayChunkBytes(
 export async function readSessionReplayTokenizedChunkBytes(
   recordingId: string,
   seq: number,
+  viewerEmail: string,
 ): Promise<{
   recording: AgentSessionRecordingSummary;
   seq: number;
@@ -1930,7 +1940,10 @@ export async function readSessionReplayTokenizedChunkBytes(
   /** Decompressed replay-chunk JSON text (a serialized rrweb events array). */
   json: string;
 }> {
-  const recording = await getSessionReplayTokenizedSummary(recordingId);
+  const recording = await getSessionReplayTokenizedSummary(
+    recordingId,
+    viewerEmail,
+  );
   const chunk = await readSessionReplayChunkBytesForRecording(recording, seq);
   return {
     ...chunk,
@@ -2175,8 +2188,12 @@ export async function readSessionReplayChunkBatch(
 export async function readSessionReplayTokenizedChunkBatch(
   recordingId: string,
   seqs: number[],
+  viewerEmail: string,
 ): Promise<SessionReplayChunkBatchResult> {
-  const recording = await getSessionReplayTokenizedSummary(recordingId);
+  const recording = await getSessionReplayTokenizedSummary(
+    recordingId,
+    viewerEmail,
+  );
   return readSessionReplayChunkBatchForRecording(recording, seqs);
 }
 
@@ -2204,6 +2221,7 @@ export async function getSessionReplayEvents(
 
 export async function getSessionReplayTokenizedEvents(
   recordingId: string,
+  viewerEmail: string,
   options: SessionReplayEventReadOptions = {},
 ): Promise<{
   recording: AgentSessionRecordingSummary;
@@ -2219,7 +2237,10 @@ export async function getSessionReplayTokenizedEvents(
   truncated: boolean;
   unavailableChunks: number;
 }> {
-  const recording = await getSessionReplayTokenizedSummary(recordingId);
+  const recording = await getSessionReplayTokenizedSummary(
+    recordingId,
+    viewerEmail,
+  );
   const result = await getSessionReplayEventsForRecording(recording, options);
   return {
     ...result,

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -259,7 +259,10 @@ export default createAgentChatPlugin({
   codeExecution: { production: "sandboxed" },
   connectorCatalog: [...ANALYTICS_CONNECTOR_CATALOG],
   externalAgents: {
-    authenticatedReads: "auto",
+    // Keep the direct MCP surface deliberately curated. External agents
+    // should use ask_app for multi-step investigation; these six actions are
+    // bounded fallback reads for callers that already know what they need.
+    authenticatedReads: "off",
     writes: "ask_app_only",
   },
   resolveOrgId: async (event) => {