Menu
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/BuilderIO/agent-native --skill session-replayThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Based on SOC occupation classification
Showing SKILL.md
| name | session-replay |
| description | Inspect, troubleshoot, and extend Analytics session replay recordings. |
| scope | dev |
Use this skill when working on /sessions, replay ingest, replay storage, or
agent answers about browser recordings in the Analytics template.
session_recordings and session_replay_chunks.list-session-recordings,
get-session-replay-summary, and get-session-replay-events./sessions/:recordingId is keyed by session_recordings.id, not
analytics_events.session_id.analytics_events.
Events can be linked beside a recording through session_id, but they are not
playable replay rows by themselves.session_replay_chunks rows to the
browser or agent.session-recording access before reading private blob refs.ANALYTICS_SECRETS_ENCRYPTION_KEY in
an untracked local env file; do not replace the workspace-wide
just to read production replay storage.BETTER_AUTH_SECRETcreate-session-replay-agent-link. It mints a two-hour agent_access URL
scoped to the recording, embeds a small SSR discovery payload on
/sessions/:recordingId, and advertises
/api/session-replay/agent-context.json plus bounded
/api/session-replay/agent-events.json and
/api/session-replay/agent-diagnostics.json reads.session-replay.ts in
@agent-native/core) patches console (log/info/warn/error/debug),
window error / unhandledrejection, fetch, and XHR, and emits rrweb
custom events tagged agent-native.console and agent-native.network.console / network options on the session replay config; each
accepts a boolean or an options object ({ maxEvents?: number }); network
also accepts captureErrorBodies (default true) and maxErrorBodyLength
(default 2048) to control the bounded 5xx response-body snippet.maxErrorBodyLength chars; non-5xx and
network-failure (status 0) responses never carry a body. URLs are scrubbed,
messages are truncated, and recorder self-traffic (the replay ingest and
tracking endpoints) is excluded.deriveReplaySignals computes the real errorCount from tagged
console events plus the additive networkErrorCount column on
session_recordings. Keep new columns additive.buildSessionReplayAgentContext includes a diagnostics section: up to 50
console entries and 50 network entries, errors/failures first, with totals
and truncated flags. Agent-context instructions steer agents to diagnostics
as the primary debugging signal.console-error / network-error markers; error
markers are kept preferentially under the 200-marker cap.apis.diagnostics advertises the fuller bounded list:
GET /api/session-replay/agent-diagnostics.json?id=<recordingId>&agent_access=<token>&kind=console|network|all&level=<level>&limit=<n>&offset=<n>&fromMs=<n>&toMs=<n>
(limit defaults to 200, max 500). It uses the same recording-scoped
agent_access token as the other agent JSON APIs.offset and fromMs/toMs (inclusive offsetMs window) enable full
enumeration of a session's captured entries: page with offset, or window
with fromMs/toMs around a timeline marker's offsetMs. Providing any of
these switches ordering to strictly chronological (no errors-first
reshuffle) so pages are stable and disjoint. total/errorCount/
warnCount/failedCount reflect the filtered (windowed/level/kind)
population, not just the returned page, and each kind's response includes
hasMore alongside truncated so an agent can tell whether more entries
remain. Route validation rejects negative/non-numeric offset/fromMs/
toMs and fromMs > toMs with 400./sessions/:recordingId replay player has a Dev Tools toggle that opens
a panel with Console and Network tabs: filter chips, search, an error-count
badge, and playback-time highlighting.isComplete) before constructing the rrweb
Replayer. Progressive chunk publishes should only update the loading bar;
rebuilding the player mid-load desyncs the scrubber and playhead.Replayer untouched. rrweb rebuilds them in a sandboxed
iframe; pre-processing DOM, stylesheet, resource, or mutation payloads makes
playback diverge from the captured page. In particular, never rewrite href, src,
_cssText, CSS url(), or Meta URLs to about:blank; that exact remediation
broke historical replay CSS in PR #2040. Handle request privacy at capture or
the sandbox boundary instead of mutating stored rrweb events. Historical
captures without inlined resources require live stylesheet/image/font
requests for accurate rendering; the viewer accepts that fidelity tradeoff,
uses rrweb's script-disabled sandbox plus referrerpolicy="no-referrer", and
must never add credentials or proxy those URLs through a privileged server.src, srcset, poster, data, and href only on resource links such as
stylesheets, preloads, and icons. Signed CDN query parameters are part of the
resource identity; redacting them produces missing CSS, fonts, images, and
oversized fallback icons. Keep scrubbing Meta/navigation URLs, anchor hrefs,
and console/network diagnostics. Captured _cssText and CSS @import/url()
values must remain byte-identical.about:srcdoc iframe, which inherits the Analytics
document's CSP. Analytics currently sends no CSP header; if a future change
adds restrictive style-src, font-src, or img-src directives, verify
historical replays and resolve external imports/fonts at capture before
blocking the recorded resource origins. Do not diagnose current font loss as
CSP without checking the deployed response headers first._cssText and SVG attributes before rrweb ever saw the payload (heights
below 1000 stayed real, which is why the symptom looked like a viewport
problem rather than a redaction bug — two different sessions that both
stored a 1,152px width read back as the same 4,491px, a deterministic
salted-hash fingerprint of the redactor, not two coincidentally identical
malformed recordings). This is fixed in
packages/core/src/demo/fetch-interceptor.ts: raw replay payload and
manifest URLs are skipped from demo number redaction entirely, and must
never be routed through it again. Do not reintroduce viewport clamping or
pointer-coordinate projection in the player — they can now only corrupt
genuine future recordings (for example, a real 3440x900 ultrawide browser
window, or a short vertical window under 1,000px tall).triggerFocus makes a valid
snapshot diverge from the source page.insertStyleRules may suppress known toast/snackbar containers only. Never
hide generic framework primitives such as
[data-radix-popper-content-wrapper]: Radix dropdowns, selects, tooltips,
and other real recorded product UI all share that wrapper.SessionDetailPage.spec.ts — raw event identity, raw viewport dimensions,
and raw resize-state derivation (including the 3,189x885 tripwire against
reintroducing a clamp) — as regression guards against reintroducing any
viewport "recovery" or pointer-projection heuristic. Do not change their
expectations merely to bless a new sanitizer or clamp; validate the affected
replay in a browser first. An interim clamp for the exact 3,189x885 pair was
also deleted once the view-time redaction root cause was proven; the earlier
3,000-3,999px band was rejected because it also catches real 3440px-wide
displays. Neither the exact exception nor the band belongs in the player./sessions to find their recordings./sessions/:recordingId and click
Copy for agent to mint the two-hour tokenized link./api/session-replay/agent-context.json, reads the diagnostics section
and timeline markers first, then drills into apis.diagnostics (filtered
by kind/level) and apis.events for the fuller bounded lists as needed.VITE_AGENT_NATIVE_ANALYTICS_PUBLIC_KEY or configureTracking({ key }) is
present. The default sample rate is 100% of eligible sessions.configureTracking({ key, endpoint, sessionReplay: { enabled: true } }).configureTracking({ sessionReplay: false }).configureTracking() in their roots;
hosted template deployments only need the normal Agent Native Analytics
Vite/Netlify env vars on the recorded site..an-mask or data-an-mask..an-block, .an-ignore, data-an-block, or data-an-ignore for
sensitive zones that should not be captured.409 abandons only the conflicted replay identity and
immediately starts rrweb again under a fresh per-tab id, producing a new
Meta + FullSnapshot for long-lived SPA tabs. Recovery is limited to one
restart until an upload succeeds so a misconfigured endpoint cannot loop;
Analytics tracks the content-free session replay upload rejected lifecycle
event so conflicts and recovery success are measurable.