v6.2.0-edge.4: Conversation forks, live agent avatars, and meeting video

TL;DR

Conversation forks, a working Stop for agent runs, template users, live agent avatars, agents that watch LiveKit meetings, Gemini Live on Gemini Enterprise, and four new decision models. Plus security hardening of action, template and realtime requests, and fixes to duplicate detection and call recordings.

Upgrade Notes apply: six migrations apply on mj migrate, RunAction and template runs are now authorized per caller, some aggregate expressions are refused, out-of-repo realtime drivers must change SendInput, and the conversation thread-panel API is removed.

Edge builds are prereleases.

MemberJunction 6.x is released under the Business Source License 1.1; 5.x and earlier stay ISC. What the licence grants, and what needs certification, is in the licence section of the v6 upgrade guide.

New Features

• Conversation forks (@memberjunction/ng-conversations, @memberjunction/core-entities, @memberjunction/ai-agents, @memberjunction/server, @memberjunction/realtime-runtime): A conversation is Main plus forks (MJ: Conversation Branches). “Fork from here”, Edit (“Save as fork”) and Regenerate each start a fork from a message without losing the original; a fork shows as a chip under its message and opens as a full view, and a Forks button lists them with All and Mine filters. Agents, artifacts, search, export and voice read only the open fork’s path. Forking is controlled by the new Conversations: Fork authorization (granted to the UI role) and a per-person setting in My Profile; with forking off, Edit and Regenerate change the latest turn in place and keep the replaced row hidden.
• Stop for in-progress agent runs (@memberjunction/ng-conversations, @memberjunction/ng-composer, @memberjunction/ai-agents, @memberjunction/ai-core-plus, @memberjunction/server): A Stop control on an in-progress reply now stops the run on whichever MJAPI replica owns it. The stopped run keeps its completed steps and payload, the reply reads “Stopped by user” rather than as an error, and the next turn continues from where it stopped.
• Template users (@memberjunction/core, @memberjunction/core-entities, @memberjunction/server, @memberjunction/cli, @memberjunction/open-app-engine, @memberjunction/record-cloning): A user flagged IsTemplate can be copied whole, with views, settings, dashboards, conversations and artifacts, through the template clone preset. New users can be created from a template at first sign-in (userHandling.newUserTemplate), mj user clone copies a user from the command line, and Open Apps can ship a template user. Explorer shows a banner while a template user is signed in.
• Live agent avatars (@memberjunction/ai, @memberjunction/ai-gemini, @memberjunction/ai-vertex, @memberjunction/ai-agents, @memberjunction/ai-realtime-client, @memberjunction/ng-conversations, @memberjunction/ng-realtime-media): A voiced agent whose persona has a face can appear as a live Gemini avatar in browser calls and LiveKit meetings, with the face kept in step with the voice. Avatar video is counted in realtime usage and priced per minute or per token. When an avatar can’t be shown (a phone call, an app with no video, a model or endpoint that renders none), the call says why once instead of failing.
• Agents that watch LiveKit meetings (@memberjunction/ai-bridge-livekit, @memberjunction/ai-bridge-livekit-native, @memberjunction/ai-bridge-server, @memberjunction/livekit-room-server, @memberjunction/ng-livekit-room): With realtime.video.watchMeetings on and a video-capable model, the agent’s bot sees the meeting’s cameras and shared screens, choosing the most recent share or the active speaker, and is told when what it sees changes. Each person decides in the room whether agents may see their camera and screen.
• Gemini Live on Gemini Enterprise (Vertex AI) (@memberjunction/ai-vertex, @memberjunction/ai-gemini, @memberjunction/server): Server and browser drivers for Gemini Live on Vertex AI. Browser sessions go through a new MJAPI realtime relay that adds Google credentials on each upstream connection, so no credential reaches the browser. Gemini Live sessions on both endpoints now continue past Google’s ~10-minute connection limit, survive dropped connections without cutting an answer, and use context-window compression so video sessions are not ended when the context fills.
• Camera, screen share and video in realtime calls (@memberjunction/realtime-runtime, @memberjunction/ai-realtime-client, @memberjunction/ng-realtime-media, @memberjunction/ng-conversations): Calls can share the user’s camera, the screen or one panel of the page with the agent, with a camera check before anything is shared, a device menu to switch microphone and camera mid-call, and a pick of which source the agent sees. The new @memberjunction/ng-realtime-media package holds the shared call UI (tiles, controls, self-view, move-to and picture-in-picture), which the call overlay and the meeting room both use.
• Realtime Channels v2 (@memberjunction/realtime-runtime, @memberjunction/ai-core-plus, @memberjunction/ai-agents, @memberjunction/ng-realtime-channels, @memberjunction/ng-realtime-channel-examples): A self-describing channel contract with per-agent, per-app and per-host scoping, an Interactive Component channel, Camera, Screen Share and Avatar channels, verb-level exposure policy, an Angular adapter that wraps an existing component as a channel, and a channels guide. Existing channels, tool names and hosts are unchanged.
• Embeddable realtime widget and identity verification (@memberjunction/ng-realtime-widget, @memberjunction/realtime-runtime, @memberjunction/server): <mj-realtime-widget> embeds a voice session in any page, and an IdentityVerification channel with session events lets a session verify the caller mid-call.
• New decision models (@memberjunction/ai-cloudflare, @memberjunction/ai-systemone, @memberjunction/ai-openai): Cloudflare Clef and Clef-flash on Workers AI (CloudflareDecision), Kev and any server with a /v1/systemone route (SystemOneDecision), Perplexity Decider v1 27B (PerplexityDecision), and OpenAI’s Decisions API with GPT-6 Luna Decisions (OpenAIDecision).
• Other new models (@memberjunction/aiengine): Claude Haiku 5.5, Mistral Large 4 and the Nano Banana 2.1 image model, with vendor prices.
• DBAutoDoc plugins and Index Advisor (@memberjunction/db-auto-doc): A plugin system for DBAutoDoc and a first built-in plugin that proposes missing indexes and exports them as a SQL migration.
• People Data Labs integration (@memberjunction/actions-peopledatalabs): A People Data Labs client for bulk person enrichment with education and employment history, person search and school autocomplete, a credentials resolver, and the People Data Labs - Enrich People action.
• Scoped notification configs (@memberjunction/notifications, @memberjunction/core-entities, @memberjunction/server): MJ: Scoped Notification Configs sets a notification type’s channels per application, role, user or origin, between the type’s defaults and a recipient’s preference, with locked denies that cap every level below.
• Dashboards as an application, with an AI assistant (@memberjunction/ng-dashboards, @memberjunction/ng-explorer-core, @memberjunction/ng-dashboard-viewer, @memberjunction/ai-agents): Dashboards move out of Data Explorer into their own Explorer application, reachable from Home, the command palette and recents. Config dashboards gain a side-pane assistant that works with the new Dashboards Expert agent by text or voice.
• Math in markdown (@memberjunction/markdown-core, @memberjunction/ng-markdown, @memberjunction/ng-chat): TeX ($…$, $$…$$, \(…\), \[…\]) and MathML, including JATS <mml:math>, render in chat and markdown views.
• Inline Word and Excel previews (@memberjunction/ng-artifacts, @memberjunction/ng-core-entity-forms): .docx, .xlsx and .xls files preview in the Files form through the renderers the Artifacts viewer already used.
• Installer sets up the database, on SQL Server or PostgreSQL (@memberjunction/installer, @memberjunction/cli): mj install creates the database and logins itself when given an administrator login, which is never saved, and now installs on PostgreSQL as well as SQL Server.
• New UI building blocks (@memberjunction/ng-charts, @memberjunction/ng-ui-components): Token-themed bar, donut and area chart widgets; an mj-menu action menu; and a circle shape for mjButton.

Improvements

• Transactions stay with the caller that opened them (@memberjunction/generic-database-provider, @memberjunction/sqlserver-dataprovider, @memberjunction/postgresql-dataprovider, @memberjunction/core): A transaction opened on a shared database provider belongs to the async scope that began it, so concurrent requests and background work no longer run inside someone else’s transaction.
• Metadata_Sync replays change only what changed (@memberjunction/generic-database-provider, @memberjunction/sqlserver-dataprovider): A recorded update now carries only the fields the push changed, so replaying a Metadata_Sync migration no longer resets settings a deployment tuned on MJ-owned rows (one earlier replay had turned TrustServerCacheCompletely back on for a consumer).
• Search ranks multi-source results by Reciprocal Rank Fusion (@memberjunction/search-engine, @memberjunction/ng-search): Fused results keep their fusion order, and MinScore applies before fusion.
• Engine and shared-cache hardening (@memberjunction/core, @memberjunction/redis-provider, @memberjunction/server): Browser cache keys carry the user’s row-filter and field-security segments as server keys do, a transaction group updates each cached result set once, the dataset cache’s warm path works again, and named-channel Redis pub/sub is usable by applications for cross-replica messaging.
• Record opens no longer fill engine caches (@memberjunction/core-entities, @memberjunction/ng-explorer-core): UserInfoEngine stops caching MJ: User Record Logs, which grew without bound in every MJAPI’s memory; recents are queried on demand. Twenty-two log, run and audit entities stop taking part in caching.
• Agent Eval judges see the whole result (@memberjunction/testing-engine): The llm-judge, decision-judge and rubric oracles now receive the agent’s final message and output artifacts, not only its payload.
• Apollo enrichment rework (@memberjunction/actions-apollo): A new Apollo client with bulk matching, typed errors and bounded rate-limit retries; the enrichment actions run on it and fix their key, save and paging bugs.

Bug Fixes

• Duplicate detection reads every record and the same text vector sync stored (@memberjunction/ai-vector-dupe, @memberjunction/ai-vector-sync): Detection no longer stops at the entity’s view row limit, no longer renders templates without their related data, holds one batch in memory instead of the whole run, and honours an entity document’s record filter.
• Realtime calls cost and recording (@memberjunction/ai-agents, @memberjunction/server, @memberjunction/realtime-runtime): A voice session’s co-agent run records its cost and is no longer marked Failed; recordings capture the agent’s audio on Gemini Live and other PCM drivers, store for users with only the UI role, retry a failed upload shard, are recovered from crash shards, and warn before a tab closes mid-upload. Server-side sessions (meetings, phone calls) now record model usage.
• Agents with several storage accounts (@memberjunction/ai-engine-base, @memberjunction/ai-agents): Agents no longer fail when several file storage accounts are active and none is the default.
• Scheduled jobs activated while the server runs (@memberjunction/scheduling-engine): A job switched to Active during polling gets its NextRunAt at once instead of waiting for a restart.
• Encryption keys an install doesn’t have (@memberjunction/encryption): A value encrypted with an unavailable key logs one warning per key instead of an error on every load, and startup no longer fails validation for a key no field uses.
• Box storage token renewal (@memberjunction/storage): Box drivers that authenticate with client credentials renew their token instead of failing every read after about an hour.
• mj sync (@memberjunction/metadata-sync): push finds records created earlier in the same push, pull backs up and restores every file it rewrites, and --dry-run output says it wrote nothing.
• Linear-time parsing (@memberjunction/conversations-runtime, @memberjunction/global): Chat mention parsing and URL trailing-slash trimming no longer backtrack quadratically on crafted input.
• Chat and Explorer fixes (@memberjunction/ng-composer, @memberjunction/ng-explorer-core, @memberjunction/ng-whiteboard, @memberjunction/ng-entity-viewer): Long messages no longer run behind the composer’s buttons, the omnibar’s keyboard selection stays on rendered rows, whiteboard markdown panels resize vertically, and entity grids no longer compute a saved view’s aggregates against another entity.
• TextChunker keeps all text (@memberjunction/ai-vectors): The sentence strategy no longer drops text around decimals, abbreviations and URLs.

Upgrade Notes

• Six migrations apply on mj migrate: Scoped_Notification_Configs, User_IsTemplate, AIModelCost_spCreate_PriceTypeID_Default, Conversation_Branches, Scheduling_spSetScheduledJobNextRunAt and Metadata_Sync.
• RunAction authorizes each action (@memberjunction/server, @memberjunction/actions): Scope-limited sessions (magic-link and widget guests, resource-scoped links) are refused. An Owner may run any action; any other user needs a role holding an authorization linked to the action through MJ: Action Authorizations, unless the action’s class declares BaseAction.AuthorizesCaller. SkipActionLog from the client is ignored. Calculate Expression and Conditional now use restricted evaluators, and Run Ad-hoc Query follows ExecuteAdhocQuery’s rules.
• Template rendering is sandboxed and template runs are authorized (@memberjunction/templates, @memberjunction/server): Templates can no longer reach Function, eval, process or the render internals, and some unusual names are refused at compile time with TemplateSandboxError. RunTemplate and Template.Run refuse scope-limited sessions and callers without read permission on MJ: Templates and MJ: Template Contents.
• Realtime direct actions (@memberjunction/server, @memberjunction/ai-agents): The realtime relay no longer takes authority from a session’s editable Config JSON, and scope-limited callers (including public web-widget guests) get no direct actions; their co-agent delegates through invoke-target-agent.
• Restricted RunView aggregate expressions (@memberjunction/sql-parser, @memberjunction/generic-database-provider): Each aggregate must be a single aggregate function call over the entity’s columns. Expressions such as SUM(x) + 1, ROUND(AVG(x), 2), CONVERT, window clauses and PostgreSQL FILTER (WHERE …) now return a per-aggregate error; the rows and other aggregates still load.
• Out-of-repo realtime drivers must change SendInput (@memberjunction/ai): IRealtimeSession.SendInput takes one RealtimeInputFrame ({ Data, Kind, MimeType?, TimestampMs? }) instead of (chunk, kind?).
• Conversation thread-panel API removed (@memberjunction/ng-conversations, @memberjunction/ng-explorer-core): The ParentID-based thread panel is replaced by forks. ThreadPanelComponent, the chat area’s ThreadId input and ThreadOpened/ThreadClosed outputs, the workspace’s OpenThread/CloseThread/SelectedThreadId, and MessageListComponent’s ReplyInThread/ViewThread outputs are removed with their camelCase aliases; host apps that bind them must drop the bindings.
• UserInfoEngine.UserRecordLogs removed (@memberjunction/core-entities): Use await UserInfoEngine.LoadRecentRecordLogs(n). GetRecentRecordsForEntity() is removed.
• Consumers that tune MJ-owned rows: From this release, Metadata_Sync migrations re-impose only values MJ changed, but migrations published earlier still contain full-row updates, so keep re-applying those settings after migrating.
• On PostgreSQL, two known gaps remain: duplicate shared form contributions are still not refused (the unique indexes need NULLS NOT DISTINCT), and vwEntities and vwEntityFields still lack the EnableFieldLevelSecurity, RelatedEntityFilter and RelatedEntityOrderBy columns added in earlier releases, so those fields’ metadata is removed on PostgreSQL installs. Both are tracked for a later release.