feat: PDP session-context API + default-on session persistence - #3
Open
chintandesai-cimulate wants to merge 1 commit into
Open
chintandesai-cimulate wants to merge 1 commit into
chintandesai-cimulate wants to merge 1 commit into
Conversation
Send PDP product context through SCRT2's v2 per-turn session-context API instead of prepending a hidden line to the message body: - sendMessage(text, contextVariables?) wraps external Agentforce variables (page_context_type / page_context_message / page_context_data) in a SessionContextSet envelope; the shopper's text is sent unchanged. - buildPdpInlineContext() replaces withProductContext(); the product id is JSON-encoded (no unsafe interpolation) and resolved fresh on each send, since the agent clears external context after every turn. - Log SendMessageResponse warnings when SCRT2 accepts a message but drops one or more variables. - Default capabilitiesVersion "1" -> "66" (SCRT2 internal v260), the minimum that carries custom session context. New SessionContext* SDK types exported. Enable session persistence by default with a 30-minute sliding idle TTL: - The custom-element persist-session attribute is now tri-state: default ON, opt out with persist-session="false". WidgetProvider builds the persistence adapter unless persistSession === false. - saveSession stamps persistedAt; loadSession refuses and clears a session idle past 30 min (reason "idle-expired") or past the token's JWT exp. Net reuse bound = min(JWT exp, persistedAt + 30 min); the window resets on each send, so an active conversation keeps working while an abandoned one becomes unrestorable after 30 min of inactivity. Demo: revert to placeholder credentials, drop the org-specific capabilities-version (defaults to 66), and use a YOUR_PRODUCT_ID placeholder for the PDP product id. Docs: README + architecture.md updated for both features. Tests cover the session-context envelope (and its omission), the sliding TTL, and idle-expired rejection. typecheck + 72 tests + ESM/UMD build all green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two related improvements to the SCRT2 (Agentforce MIAW) connection, plus a demo cleanup.
1. PDP product context via the SCRT2 v2 session-context API
Previously the widget prepended a hidden
Viewing product details for: <id>line to the outgoing message text. It now passes product context as external Agentforce variables through SCRT2's per-turn session-context API, leaving the shopper's message text untouched.AgentforceClient.sendMessage(text, contextVariables?)wrapspage_context_type/page_context_message/page_context_datain aSessionContextSetenvelope.buildPdpInlineContext()replaceswithProductContext(); the product id is JSON-encoded (no unsafe interpolation) and resolved fresh on every send, since the agent clears external context after each turn.warningresponses (message accepted but variables dropped) are logged.capabilitiesVersion"1"→"66"(SCRT2 internal v260) — the minimum that carries custom session context. NewSessionContext*SDK types are exported.2. Session persistence on by default + 30-min sliding idle TTL
persist-sessionattribute is now tri-state: on by default; opt out withpersist-session="false". (WidgetProviderbuilds the persistence adapter unlesspersistSession === false.)saveSessionstampspersistedAt;loadSessionrefuses and clears a session that is idle past 30 minutes (reason: "idle-expired") or past the token's JWTexp. Net reuse bound =min(JWT exp, persistedAt + 30 min); the window resets on each send, so an active conversation keeps working while an abandoned one becomes unrestorable 30 min after the last activity.3. Demo cleanup
demo/index.htmlto placeholder credentials, dropped the org-specificcapabilities-version(now defaults to 66), and replaced the hardcoded PDP product id with aYOUR_PRODUCT_IDplaceholder.Security note
The persisted token is the anonymous, unauthenticated SCRT2 JWT (blast radius = the messaging conversation only). Because persistence is now on by default, the README / architecture security notes document the residual shared/kiosk-device risk and the
persist-session="false"opt-out; the 30-min idle TTL narrows the walk-up reuse window.Test plan
npm run typecheck— cleannpm test— 72 passed (session-context envelope + its omission, sliding TTL, idle-expired rejection, JWT-exp bound)npm run build— ESM + UMD both succeedDocs (README +
docs/architecture.md) updated for both features.🤖 Generated with Claude Code