@agent-native/core 0.99.0 → 0.99.2

package/corpus/templates/analytics/server/lib/dashboard-time-scope.ts

@@ -0,0 +1,170 @@
+import type { DashboardTimeScope } from "../../app/pages/adhoc/sql-dashboard/types";
+
+export const DASHBOARD_TIME_SCOPES: readonly DashboardTimeScope[] = [
+  "dashboard",
+  "fixed-window",
+  "cohort-history",
+  "all-time",
+];
+
+type DashboardFilterLike = {
+  id?: unknown;
+  key?: unknown;
+  type?: unknown;
+  default?: unknown;
+};
+
+type DashboardPanelLike = {
+  id?: unknown;
+  title?: unknown;
+  chartType?: unknown;
+  source?: unknown;
+  sql?: unknown;
+  config?: unknown;
+};
+
+type DashboardConfigLike = {
+  filters?: unknown;
+};
+
+const TEMPORAL_VARIABLE_RE = /\{\{(timeRange|[A-Za-z_]\w*(?:Start|End))\}\}/g;
+
+/** Return the time variables a panel actually references. */
+export function extractDashboardTimeVariables(sql: string): string[] {
+  const variables = new Set<string>();
+  for (const match of sql.matchAll(TEMPORAL_VARIABLE_RE)) {
+    variables.add(match[1]);
+  }
+  return [...variables];
+}
+
+function filterId(filter: DashboardFilterLike): string {
+  const value = filter.id ?? filter.key;
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function filtersFrom(config: DashboardConfigLike): DashboardFilterLike[] {
+  return Array.isArray(config.filters)
+    ? (config.filters as DashboardFilterLike[])
+    : [];
+}
+
+function panelConfig(panel: DashboardPanelLike): Record<string, unknown> {
+  return panel.config && typeof panel.config === "object"
+    ? (panel.config as Record<string, unknown>)
+    : {};
+}
+
+function hasExplicitLowerBound(sql: string): boolean {
+  // This intentionally recognizes the bounded shapes used by the shipped
+  // first-party catalog. It is a compatibility escape hatch for fixed-window
+  // catalog metrics; new ad-hoc panels should use a dashboard placeholder.
+  return /\b(?:event_date|timestamp|started_at|ended_at|cohort_date|created_at|date)\b[\s\S]{0,100}?(?:>=|>)\s*[\s\S]{0,160}?(?:CURRENT_DATE|CURRENT_TIMESTAMP|NOW\s*\(|INTERVAL\s*['"]|DATE\s*['"]|TIMESTAMP\s*['"]|\b20\d{2}-\d{2}-\d{2}\b)/i.test(
+    sql,
+  );
+}
+
+function hasIntentionalHistoryDescription(
+  panel: DashboardPanelLike,
+  config: Record<string, unknown>,
+): boolean {
+  const values = [panel.title, config.description].filter(
+    (value): value is string => typeof value === "string",
+  );
+  return /all[- ]?time|lifetime|histor(?:y|ical)/i.test(values.join(" "));
+}
+
+function scopeValue(panel: DashboardPanelLike): DashboardTimeScope | undefined {
+  const value = panelConfig(panel).timeScope;
+  return typeof value === "string" &&
+    (DASHBOARD_TIME_SCOPES as readonly string[]).includes(value)
+    ? (value as DashboardTimeScope)
+    : undefined;
+}
+
+/**
+ * Validate the temporal contract for a first-party dashboard panel.
+ *
+ * Ordinary panels must bind to a dashboard filter. Intentional exceptions are
+ * explicit in `config.timeScope`, while legacy fixed-window catalog SQL is
+ * accepted when its lower bound is visible in the SQL itself.
+ */
+export function validateFirstPartyDashboardTimeScope(
+  panel: DashboardPanelLike,
+  dashboard: DashboardConfigLike,
+  index: number,
+): string | null {
+  if (panel.source !== "first-party") return null;
+  if (panel.chartType === "section" || panel.chartType === "extension") {
+    return null;
+  }
+
+  const sql = typeof panel.sql === "string" ? panel.sql : "";
+  const variables = extractDashboardTimeVariables(sql);
+  const filters = filtersFrom(dashboard);
+  const label =
+    typeof panel.title === "string" && panel.title.trim()
+      ? `"${panel.title}"`
+      : `at index ${index}`;
+
+  for (const variable of variables) {
+    const expectedFilterId =
+      variable === "timeRange"
+        ? "timeRange"
+        : variable.replace(/(?:Start|End)$/, "");
+    const filter = filters.find(
+      (candidate) => filterId(candidate) === expectedFilterId,
+    );
+    if (!filter) {
+      return `panel[${index}] ${label} uses {{${variable}}} but config.filters has no matching "${expectedFilterId}" filter; bind first-party SQL to a declared dashboard time filter`;
+    }
+    if (variable === "timeRange") {
+      if (filter.type !== "select") {
+        return `panel[${index}] ${label} uses {{timeRange}}, but filter "timeRange" must have type "select"`;
+      }
+    } else if (filter.type !== "date-range") {
+      return `panel[${index}] ${label} uses {{${variable}}}, but filter "${expectedFilterId}" must have type "date-range"`;
+    }
+    if (typeof filter.default !== "string" || !filter.default.trim()) {
+      return `panel[${index}] ${label} uses a time filter without a non-empty default; choose a bounded default such as "90d" so missing filter state cannot become all-time`;
+    }
+  }
+
+  const configuredScope = panelConfig(panel).timeScope;
+  if (
+    configuredScope !== undefined &&
+    (typeof configuredScope !== "string" ||
+      !(DASHBOARD_TIME_SCOPES as readonly string[]).includes(configuredScope))
+  ) {
+    return `panel[${index}] ${label} config.timeScope must be one of ${DASHBOARD_TIME_SCOPES.join(", ")}`;
+  }
+
+  const scope = scopeValue(panel);
+  const hasDashboardBinding = variables.length > 0;
+  const hasLowerBound = hasExplicitLowerBound(sql);
+
+  if (scope === "dashboard" && !hasDashboardBinding) {
+    return `panel[${index}] ${label} declares timeScope "dashboard" but does not reference {{timeRange}} or a date-range variable`;
+  }
+  if (scope === "fixed-window" && hasDashboardBinding) {
+    return `panel[${index}] ${label} declares timeScope "fixed-window" but uses dashboard time variables; use timeScope "dashboard" or remove the placeholders`;
+  }
+  if (scope === "fixed-window" && !hasLowerBound) {
+    return `panel[${index}] ${label} declares timeScope "fixed-window" without a recognizable lower date bound`;
+  }
+  if (scope === "all-time" && hasDashboardBinding) {
+    return `panel[${index}] ${label} declares timeScope "all-time" but uses dashboard time variables; use timeScope "dashboard" for filter-bound output`;
+  }
+  if (
+    scope === "all-time" &&
+    !hasIntentionalHistoryDescription(panel, panelConfig(panel))
+  ) {
+    return `panel[${index}] ${label} declares timeScope "all-time"; add a description or title that says lifetime, historical, or all-time so the exception is explicit`;
+  }
+
+  if (!scope && !hasDashboardBinding && !hasLowerBound) {
+    return `panel[${index}] ${label} reads first-party analytics without a time bound; use {{timeRange}} with a non-empty default filter, or explicitly set config.timeScope to "cohort-history" or "all-time" for intentional history scans`;
+  }
+
+  return null;
+}

package/corpus/templates/analytics/server/lib/dashboards-store.ts

@@ -1846,12 +1846,38 @@ export async function saveDashboardView(
     orgId: ctx.orgId ?? undefined,
   });
   const db = getDb() as any;
-  const id = view.id ?? nanoidFallback();
+  let id = view.id ?? nanoidFallback();
+  let existing = false;
   if (view.id) {
+    const [existingRow] = await db
+      .select({
+        id: schema.dashboardViews.id,
+        dashboardId: schema.dashboardViews.dashboardId,
+      })
+      .from(schema.dashboardViews)
+      .where(eq(schema.dashboardViews.id, view.id))
+      .limit(1);
+    if (existingRow?.dashboardId === dashboardId) {
+      existing = true;
+    } else if (existingRow) {
+      // View ids are generated from names in the browser but remain globally
+      // primary-keyed for backwards compatibility. Avoid colliding with a
+      // same-named view on another dashboard instead of updating that row or
+      // returning a raw unique-constraint 500.
+      id = nanoidFallback();
+    }
+  }
+
+  if (existing) {
     await db
       .update(schema.dashboardViews)
       .set({ name: view.name, filters: JSON.stringify(view.filters) })
-      .where(eq(schema.dashboardViews.id, id));
+      .where(
+        and(
+          eq(schema.dashboardViews.id, id),
+          eq(schema.dashboardViews.dashboardId, dashboardId),
+        ),
+      );
   } else {
     await db.insert(schema.dashboardViews).values({
       id,
@@ -1864,7 +1890,15 @@ export async function saveDashboardView(
   const [row] = await db
     .select()
     .from(schema.dashboardViews)
-    .where(eq(schema.dashboardViews.id, id));
+    .where(
+      and(
+        eq(schema.dashboardViews.id, id),
+        eq(schema.dashboardViews.dashboardId, dashboardId),
+      ),
+    );
+  if (!row) {
+    throw new Error("Dashboard view was not persisted");
+  }
   const dash = await getDashboard(dashboardId, ctx);
   if (dash) {
     recordScopedChange(
@@ -1891,7 +1925,12 @@ export async function deleteDashboardView(
   const db = getDb() as any;
   await db
     .delete(schema.dashboardViews)
-    .where(eq(schema.dashboardViews.id, viewId));
+    .where(
+      and(
+        eq(schema.dashboardViews.id, viewId),
+        eq(schema.dashboardViews.dashboardId, dashboardId),
+      ),
+    );
   const dash = await getDashboard(dashboardId, ctx);
   if (dash) {
     recordScopedChange(

package/corpus/templates/analytics/server/lib/error-capture.ts

@@ -18,7 +18,6 @@ import { fileURLToPath } from "node:url";
  * reads go through `accessFilter` so an org-scoped key surfaces its issues to
  * the whole org exactly like session recordings.
  */
-import { appStateGet } from "@agent-native/core/application-state";
 import { notifyWithDelivery } from "@agent-native/core/notifications";
 import { recordChange } from "@agent-native/core/server";
 import { accessFilter } from "@agent-native/core/sharing";
@@ -547,6 +546,27 @@ export interface RawExceptionInput {
   breadcrumbs: unknown[];
 }
 
+/**
+ * Browser request cancellation is expected during navigation and query
+ * invalidation. Keep the first-party issue store aligned with the client
+ * Sentry filter, while preserving other AbortError failures for triage.
+ */
+export function isBenignBrowserAbortException(
+  input: Pick<RawExceptionInput, "type" | "message">,
+): boolean {
+  const exceptionType = input.type.trim().toLowerCase();
+  const exceptionValue = input.message.trim().toLowerCase();
+  return (
+    exceptionValue === "the user aborted a request." ||
+    exceptionValue === "signal is aborted without reason" ||
+    exceptionValue === "aborterror: the user aborted a request." ||
+    exceptionValue === "aborterror: signal is aborted without reason" ||
+    (exceptionType === "aborterror" &&
+      (exceptionValue.includes("the user aborted a request") ||
+        exceptionValue.includes("signal is aborted without reason")))
+  );
+}
+
 function nowIso(): string {
   return new Date().toISOString();
 }
@@ -930,11 +950,9 @@ export async function ingestAnalyticsExceptionEvents(
   let ingested = 0;
   for (const item of events) {
     try {
-      await ingestException(
-        scope,
-        extractExceptionInput(item.properties),
-        item.derived,
-      );
+      const raw = extractExceptionInput(item.properties);
+      if (isBenignBrowserAbortException(raw)) continue;
+      await ingestException(scope, raw, item.derived);
       ingested += 1;
     } catch (error) {
       console.warn("[error-capture] Failed to ingest exception event:", error);
@@ -1080,56 +1098,6 @@ export interface ListErrorIssuesFilters {
   limit?: number;
 }
 
-export const ERROR_REPORTING_ANONYMOUS_EMAIL = "anonymous@builder.io";
-const ERROR_REPORTING_EMAIL_PATTERN = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
-
-/**
- * Error reports contain emails in identity fields, messages, stacks, URLs,
- * tags, extra context, and breadcrumbs. Redact every string at this owning
- * read seam so demo mode never depends on browser interception timing.
- */
-export function anonymizeErrorReportingEmails<T>(value: T): T {
-  if (typeof value === "string") {
-    return value.replace(
-      ERROR_REPORTING_EMAIL_PATTERN,
-      ERROR_REPORTING_ANONYMOUS_EMAIL,
-    ) as T;
-  }
-  if (Array.isArray(value)) {
-    return value.map((item) => anonymizeErrorReportingEmails(item)) as T;
-  }
-  if (value && typeof value === "object") {
-    if (value instanceof Date) return value;
-    const output: Record<string, unknown> = {};
-    for (const [key, entry] of Object.entries(value)) {
-      output[key] = anonymizeErrorReportingEmails(entry);
-    }
-    return output as T;
-  }
-  return value;
-}
-
-async function isErrorDemoModeEnabled(
-  userEmail?: string | null,
-): Promise<boolean> {
-  if (process.env.DEMO_MODE === "true") return true;
-  if (!userEmail) return false;
-  try {
-    // Keep demo state tied to the caller whose issues are being read.
-    const state = await appStateGet(userEmail, "demo-mode");
-    return state?.enabled === true;
-  } catch {
-    return false;
-  }
-}
-
-function anonymizeErrorReportingEmailsInDemoMode<T>(
-  value: T,
-  enabled: boolean,
-): T {
-  return enabled ? anonymizeErrorReportingEmails(value) : value;
-}
-
 export interface ErrorIssueSummary {
   id: string;
   fingerprint: string;
@@ -1202,7 +1170,6 @@ export async function listErrorIssues(
   scope: ErrorReadScope,
   filters: ListErrorIssuesFilters = {},
 ): Promise<ErrorIssueSummary[]> {
-  const demoModeEnabled = isErrorDemoModeEnabled(scope.userEmail);
   const db = getDb() as any;
   const limit = Math.min(
     MAX_ISSUE_LIMIT,
@@ -1293,7 +1260,7 @@ export async function listErrorIssues(
     template: row.template ?? null,
     sparkline: sparklines.get(row.id) ?? new Array(SPARKLINE_DAYS).fill(0),
   }));
-  return anonymizeErrorReportingEmailsInDemoMode(issues, await demoModeEnabled);
+  return issues;
 }
 
 export interface ErrorEventDetail {
@@ -1385,7 +1352,6 @@ export async function getErrorIssue(
   issueId: string,
   options: { eventsLimit?: number } = {},
 ): Promise<ErrorIssueDetail> {
-  const demoModeEnabled = isErrorDemoModeEnabled(scope.userEmail);
   const db = getDb() as any;
   const [issueRow] = await db
     .select()
@@ -1511,14 +1477,11 @@ export async function getErrorIssue(
     sparkline: sparklines.get(issueId) ?? new Array(SPARKLINE_DAYS).fill(0),
   };
 
-  return anonymizeErrorReportingEmailsInDemoMode(
-    {
-      issue,
-      events,
-      sessions: Array.from(sessions.values()),
-    },
-    await demoModeEnabled,
-  );
+  return {
+    issue,
+    events,
+    sessions: Array.from(sessions.values()),
+  };
 }
 
 export interface UpdateErrorIssueInput {

package/corpus/templates/analytics/server/lib/first-party-metric-catalog.ts

@@ -163,6 +163,7 @@ const DASHBOARD_WAU_BASE_RANGE_FILTER = dashboardLookbackTimeRangeFilter(
 );
 const DASHBOARD_EMAIL_FILTER =
   "('{{emailFilter}}' IN ('', 'all') OR ('{{emailFilter}}' = 'exclude_builder' AND lower(coalesce(user_id, '')) NOT LIKE '%@builder.io') OR ('{{emailFilter}}' = 'only_builder' AND lower(coalesce(user_id, '')) LIKE '%@builder.io'))";
+const SESSION_STATUS_FILTER = `event_name = 'session status' AND ${DASHBOARD_TIME_RANGE_FILTER} AND ${DASHBOARD_EMAIL_FILTER}`;
 const SIGNED_IN_ACTIVITY_KEY_SQL = USER_KEY_SQL;
 const SIGNED_IN_ACTIVITY_FILTER = `event_name = 'session status' AND signed_in = 'true' AND ${SIGNED_IN_ACTIVITY_KEY_SQL} IS NOT NULL`;
 const SIGNED_IN_PRODUCT_ACTIVITY_FILTER = `${SIGNED_IN_ACTIVITY_FILTER} AND ${PRODUCT_ACTIVITY_TEMPLATE_FILTER}`;
@@ -292,7 +293,7 @@ const ENTRIES: FirstPartyMetric[] = [
     width: 2,
     windowed: false,
     buildSql: fixed(
-      "SELECT COALESCE(NULLIF(app, ''), 'unknown') AS app, COUNT(*) AS count FROM analytics_events WHERE event_name = 'session status' GROUP BY COALESCE(NULLIF(app, ''), 'unknown') ORDER BY count DESC LIMIT 20",
+      `SELECT COALESCE(NULLIF(app, ''), 'unknown') AS app, COUNT(*) AS count FROM analytics_events WHERE ${SESSION_STATUS_FILTER} GROUP BY COALESCE(NULLIF(app, ''), 'unknown') ORDER BY count DESC LIMIT 20`,
     ),
     config: {
       xKey: "app",
@@ -310,7 +311,7 @@ const ENTRIES: FirstPartyMetric[] = [
     width: 1,
     windowed: false,
     buildSql: fixed(
-      `SELECT ${EVENT_DATE_SQL} AS date, COUNT(*) AS count FROM analytics_events WHERE event_name = 'session status' GROUP BY ${EVENT_DATE_SQL} ORDER BY date`,
+      `SELECT ${EVENT_DATE_SQL} AS date, COUNT(*) AS count FROM analytics_events WHERE ${SESSION_STATUS_FILTER} GROUP BY ${EVENT_DATE_SQL} ORDER BY date`,
     ),
     config: { xKey: "date", yKey: "count", color: "#10b981" },
   },
@@ -380,7 +381,7 @@ const ENTRIES: FirstPartyMetric[] = [
     width: 1,
     windowed: false,
     buildSql: fixed(
-      "SELECT COALESCE(NULLIF(signed_in, ''), 'unknown') AS signed_in, COUNT(*) AS count FROM analytics_events WHERE event_name = 'session status' GROUP BY COALESCE(NULLIF(signed_in, ''), 'unknown') ORDER BY signed_in",
+      `SELECT COALESCE(NULLIF(signed_in, ''), 'unknown') AS signed_in, COUNT(*) AS count FROM analytics_events WHERE ${SESSION_STATUS_FILTER} GROUP BY COALESCE(NULLIF(signed_in, ''), 'unknown') ORDER BY signed_in`,
     ),
     config: {
       xKey: "signed_in",
@@ -1007,14 +1008,28 @@ export function buildPanel(
     overrides.width <= 6
       ? overrides.width
       : metric.width;
+  const title =
+    overrides.title?.trim() ||
+    (window === "all"
+      ? metric.title.replace(/\(\d+d\)$/i, "(all-time)")
+      : metric.title);
+  const config = { ...metric.config };
+  if (metric.windowed) {
+    config.timeScope = window === "all" ? "all-time" : "fixed-window";
+    if (window === "all") {
+      const description =
+        typeof config.description === "string" ? config.description.trim() : "";
+      config.description = `${description ? `${description} ` : ""}This panel is explicitly configured for an all-time window.`;
+    }
+  }
   return {
     id: overrides.id?.trim() || metric.key,
-    title: overrides.title?.trim() || metric.title,
+    title,
     chartType: overrides.chartType?.trim() || metric.chartType,
     source: "first-party",
     width,
     sql: metric.buildSql(window),
     // Clone so callers can't mutate the shared catalog config object.
-    config: { ...metric.config },
+    config,
   };
 }

package/corpus/templates/analytics/server/lib/session-replay-agent-context.ts

@@ -663,7 +663,7 @@ export function resolveSessionReplayAgentAccess(
     resourceId: recordingId,
   });
   // Replay grants are always minted by an authenticated viewer. Fail closed
-  // for grants without that signed identity: demo-mode policy is viewer-scoped,
+  // for grants without that signed identity: access policy is viewer-scoped,
   // so guessing from the ambient request could expose identities to agents.
   if (!result.ok || !result.viewerEmail) return null;
   return { viewerEmail: result.viewerEmail };

package/corpus/templates/analytics/server/lib/session-replay.ts

@@ -2,7 +2,6 @@ import { Buffer } from "node:buffer";
 import { createHash, randomUUID } from "node:crypto";
 import { gzipSync, gunzipSync } from "node:zlib";
 
-import { appStateGet } from "@agent-native/core/application-state";
 import {
   deletePrivateBlob,
   putPrivateBlob,
@@ -258,8 +257,6 @@ const DEFAULT_REPLAY_MAX_REQUESTS_PER_MINUTE = 120;
 const RETENTION_DELETE_BATCH_SIZE = 500;
 const REPLAY_PRIVATE_BLOB_REF_KIND = "agent-native.session-replay.private-blob";
 const REPLAY_PRIVATE_BLOB_REF_VERSION = 1;
-const SESSION_DEMO_EMAIL_PATTERN = /[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi;
-const SESSION_DEMO_ANONYMOUS_EMAIL = "anonymous@builder.io";
 let inlineReplayFallbackWarned = false;
 
 function replayError(message: string, statusCode: number): Error {
@@ -297,89 +294,6 @@ function replayEmail(value: unknown): string | null {
   return raw && raw.includes("@") ? raw : null;
 }
 
-function normalizedEmail(value: unknown): string | null {
-  return replayEmail(value)?.toLowerCase() ?? null;
-}
-
-function isBuilderEmail(value: unknown): boolean {
-  return normalizedEmail(value)?.endsWith("@builder.io") === true;
-}
-
-async function isSessionDemoModeEnabled(
-  userEmail?: string | null,
-): Promise<boolean> {
-  if (process.env.DEMO_MODE === "true") return true;
-  if (!userEmail) return false;
-  try {
-    // These reads also run from custom routes and actions, so use the
-    // authenticated scope explicitly instead of ambient request state.
-    const state = await appStateGet(userEmail, "demo-mode");
-    return state?.enabled === true;
-  } catch {
-    return false;
-  }
-}
-
-function demoBuilderSessionCondition() {
-  return or(
-    sql`lower(${schema.sessionRecordings.userId}) like ${"%@builder.io"}`,
-    sql`lower(${schema.sessionRecordings.userKey}) like ${"%@builder.io"}`,
-  );
-}
-
-class SessionDemoAnonymizer {
-  aliasFor(value: unknown): string | null {
-    const raw = replayString(value);
-    if (!raw || raw.match(SESSION_DEMO_EMAIL_PATTERN)?.[0] !== raw) {
-      return null;
-    }
-    return SESSION_DEMO_ANONYMOUS_EMAIL;
-  }
-
-  summarize(row: any, role?: SessionReplayAccessRole): SessionRecordingSummary {
-    const summary = rowToSessionRecordingSummary(row, role);
-    return {
-      ...summary,
-      userId: this.aliasFor(row.userId) ?? summary.userId,
-      userKey: this.aliasFor(row.userKey) ?? summary.userKey,
-      ownerEmail: this.aliasFor(summary.ownerEmail) ?? summary.ownerEmail,
-      metadata: anonymizeEmailValue(summary.metadata, this) as Record<
-        string,
-        unknown
-      >,
-    };
-  }
-}
-
-function anonymizeEmailValue(
-  value: unknown,
-  anonymizer: SessionDemoAnonymizer,
-): unknown {
-  const alias = anonymizer.aliasFor(value);
-  if (alias) return alias;
-  if (Array.isArray(value)) {
-    return value.map((item) => anonymizeEmailValue(item, anonymizer));
-  }
-  if (typeof value === "string") {
-    return value.replace(SESSION_DEMO_EMAIL_PATTERN, (email) => {
-      return anonymizer.aliasFor(email) ?? email;
-    });
-  }
-  if (value && typeof value === "object") {
-    const out: Record<string, unknown> = {};
-    for (const [key, item] of Object.entries(value)) {
-      out[key] = anonymizeEmailValue(item, anonymizer);
-    }
-    return out;
-  }
-  return value;
-}
-
-function assertDemoVisibleSession(row: any): void {
-  if (isBuilderEmail(row.userId) || isBuilderEmail(row.userKey)) return;
-  throw replayError("Session recording not found", 404);
-}
-
 function replayInteger(value: unknown): number | null {
   if (typeof value === "number" && Number.isInteger(value)) return value;
   if (typeof value === "string" && /^-?\d+$/.test(value.trim())) {
@@ -1686,7 +1600,6 @@ export async function listSessionRecordings(
   filters: SessionReplayListFilters = {},
 ): Promise<SessionRecordingSummary[]> {
   const db = getDb() as any;
-  const demoMode = await isSessionDemoModeEnabled(scope.userEmail);
   const limit = Math.min(
     MAX_SESSION_RECORDINGS_LIMIT,
     Math.max(1, filters.limit ?? DEFAULT_SESSION_RECORDINGS_LIMIT),
@@ -1699,7 +1612,6 @@ export async function listSessionRecordings(
     replayVisibleIdentityCondition(),
     replayPlayableEventsCondition(),
   ];
-  if (demoMode) conditions.push(demoBuilderSessionCondition());
   if (filters.app)
     conditions.push(eq(schema.sessionRecordings.app, filters.app));
   if (filters.template) {
@@ -1753,22 +1665,13 @@ export async function listSessionRecordings(
     .where(and(...conditions))
     .orderBy(desc(schema.sessionRecordings.startedAt))
     .limit(limit);
-  if (!demoMode) {
-    return rows.map((row: any) => rowToSessionRecordingSummary(row));
-  }
-  const anonymizer = new SessionDemoAnonymizer();
-  return rows
-    .filter(
-      (row: any) => isBuilderEmail(row.userId) || isBuilderEmail(row.userKey),
-    )
-    .map((row: any) => anonymizer.summarize(row));
+  return rows.map((row: any) => rowToSessionRecordingSummary(row));
 }
 
 export async function getSessionReplaySummary(
   recordingId: string,
   scope: SessionReplayScope,
 ): Promise<SessionRecordingSummary> {
-  const demoMode = await isSessionDemoModeEnabled(scope.userEmail);
   const access = await resolveAccess("session-recording", recordingId, {
     userEmail: scope.userEmail,
     orgId: scope.orgId ?? undefined,
@@ -1777,22 +1680,15 @@ export async function getSessionReplaySummary(
   if (!isVisibleSessionRecording(access.resource)) {
     throw replayError("Session recording not found", 404);
   }
-  if (!demoMode) {
-    return rowToSessionRecordingSummary(access.resource, access.role);
-  }
-  assertDemoVisibleSession(access.resource);
-  return new SessionDemoAnonymizer().summarize(access.resource, access.role);
+  return rowToSessionRecordingSummary(access.resource, access.role);
 }
 
 export async function getSessionReplayTokenizedSummary(
   recordingId: string,
   viewerEmail: string,
 ): Promise<SessionRecordingSummary> {
-  // Tokenized reads often run without an authenticated request session. Use
-  // the viewer identity embedded in the signed, recording-scoped grant so a
-  // link minted while demo mode is enabled cannot reveal real identities when
-  // it is opened in a signed-out browser or by an external agent.
-  const demoMode = await isSessionDemoModeEnabled(viewerEmail);
+  // Tokenized reads often run without an authenticated request session. The
+  // viewer identity is still required by the signed, recording-scoped grant.
   const db = getDb() as any;
   // guard:allow-unscoped -- called only after verifySessionReplayAgentAccess(recordingId, token) verifies a signed, recording-scoped agent_access token.
   const [row] = await db
@@ -1803,9 +1699,7 @@ export async function getSessionReplayTokenizedSummary(
   if (!row || !isVisibleSessionRecording(row)) {
     throw replayError("Session recording not found", 404);
   }
-  if (!demoMode) return rowToSessionRecordingSummary(row, "viewer");
-  assertDemoVisibleSession(row);
-  return new SessionDemoAnonymizer().summarize(row, "viewer");
+  return rowToSessionRecordingSummary(row, "viewer");
 }
 
 function parseInlineReplayEvents(inlineData: string): unknown[] {

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -239,6 +239,11 @@ export function realDataFinalGuard(
     // actual query. One corrective turn was enough for Sonnet but caused Luna
     // to hit the fallback before it reached the query.
     maxRetries: 2,
+    // The first request may use the compact starter catalog. A corrective
+    // retry must be able to reach the real source action directly; otherwise
+    // some model families spend the retry on tool-search narration and hit
+    // the canned fallback without ever running a query.
+    expandToolSurface: true,
   };
 }
 
@@ -281,6 +286,7 @@ export default createAgentChatPlugin({
       analyticsSourceGuidanceOpening() +
       "DASHBOARD CREATION RULE — You may create dashboards, analyses, SQL panels, or other resources only when the user explicitly asks you to (e.g. 'build me a dashboard for...', 'create a new analysis', 'add a chart for...'). Never create any resource proactively during research, trend analysis, or answering questions. If you think a dashboard would be useful, suggest it and wait for explicit confirmation before creating anything. Never add new items to the sidebar or modify existing dashboards without an explicit user directive. " +
       "DASHBOARD MUTATION RULE — For dashboard edits, default to `mutate-dashboard` with the typed `dashboard.*` script API so the main payload is a string and avoids native-array serialization traps. It can move panels by id, edit titles/SQL/config, insert, duplicate, remove, and patch dashboard fields in one atomic save. The script API is constrained: no variables/imports/loops/functions, only JSON-compatible arguments on documented dashboard methods. Do not count shifting `/panels/<index>` positions for ordinary dashboard edits unless the user specifically asks for low-level JSON-pointer operations. " +
+      'FIRST-PARTY DASHBOARD TIME RULE — AI-generated `source: "first-party"` panels are dashboard-time-bound by default: set `config.timeScope` to `dashboard` and include a matching dashboard time predicate. `{{timeRange}}` requires a matching `filters` entry with `id: "timeRange"` and `type: "select"`; `{{<id>Start}}`/`{{<id>End}}` require a matching `type: "date-range"` filter with that id. Allowed `timeScope` values are `dashboard`, `fixed-window`, `cohort-history`, and `all-time`; use `all-time` only when the user requests full available history and put all-time, lifetime, or historical in the title or description. Server validation rejects unbound first-party SQL. ' +
       "DASHBOARD READ RULE — `get-sql-dashboard` is compact by default: use its `panels` summaries plus `layout.panelOrder`, `layout.firstPanelIds`, and `layout.groups[].rows[].rowNumber/panelIds` for orientation and verification. Pass `includeConfig: true` only when you truly need full panel SQL/config. " +
       'DASHBOARD REORDER RULE — For simple chart/section moves, use `mutate-dashboard` code such as `dashboard.panels(["panel-a","panel-b"]).moveToTop();`. For visible placement requests like "second row" or "next to return rates", use row-aware placement such as `dashboard.insertPanel({...}).nextTo("retention-over-time")`, `.atRow(2)`, or `dashboard.panel("panel-a").moveNextTo("panel-b")`; these keep panels in the intended rendered row and expand/rebalance that row when needed. Never count shifting `/panels/<index>` positions for ordinary \'move this chart\' requests. Use `get-sql-dashboard.layout.groups[].rows` as proof of visible row placement, not only flat `panelOrder`. ' +
       "Use configured data sources and actions only. Call `data-source-status` when you need to know which providers are connected, and treat provider actions as unavailable for analysis if they return missing credentials, permission, syntax, quota, or network errors. " +