@agent-native/core 0.101.10 → 0.101.12

package/corpus/core/src/extensions/actions.ts

@@ -3,8 +3,17 @@ import type { ActionRunContext } from "../action.js";
 import type { ActionEntry } from "../agent/production-agent.js";
 import type { AgentChatAttachment } from "../agent/types.js";
 import { writeAppState } from "../application-state/script-helpers.js";
-import { getRequestRunContext } from "../server/request-context.js";
+import { readResource } from "../resources/script-helpers.js";
+import {
+  getRequestOrgId,
+  getRequestRunContext,
+  getRequestUserEmail,
+} from "../server/request-context.js";
 import { resolveAccess } from "../sharing/access.js";
+import {
+  readWorkspaceFile,
+  type WorkspaceFilesScope,
+} from "../workspace-files/store.js";
 import type {
   ExtensionContentEdit,
   ExtensionLegacyPatch,
@@ -483,7 +492,7 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
     "create-extension": {
       tool: {
         description:
-          'Create a persisted sandboxed Alpine.js mini-app extension and render it inline in the chat. Use this when the user wants generated UI that should be saved, reusable, or visible in the Extensions view: extensions, widgets, dashboards, calculators, mini-apps, and reusable interactive utilities. For one-time chat-only UI, use render-inline-extension instead. The content must be a self-contained Alpine.js HTML body snippet that can use appAction(), appFetch(), dbQuery(), extensionFetch(), extensionData, agentNative.ui.output(value, opts?), and agentNative.chat.send()/sendToAgentChat(). Use appAction() for app data writes and extensionData for extension-owned persisted UI state; dbQuery() is for read-only inspection of known app SQL tables. Use agentNative.ui.output for passive current values from knobs, sliders, and selections; it writes application state at inline-ui:<extension id>:output, which the agent can read later with readAppState when the user says to use that value. Use agentNative.chat.send for visible submit/apply actions. Persist reusable user-edited state with extensionData: if the extension has checkboxes, todos, notes, filters, preferences, or any control whose value should survive reload/reopen, load that state on init and save changes with extensionData, usually at user scope, instead of keeping it only in Alpine state. IMPORTANT — hosting a pasted file: if the user pasted a large HTML/Alpine file (it appears in your context as an <attachment name="pasted-text-…"> block) and asked you to host it as-is, do NOT copy that file into `content`. Instead leave `content` empty and pass `contentFromAttachment` set to that attachment\'s name (or the literal "latest" for the most recent pasted block) — the server reads the file verbatim. Re-emitting a large pasted file as `content` regularly gets cut off mid-stream and stalls the turn. Prefer appAction(name, params) for app data and actions, including read actions mounted as GET; do not call template /api/* routes from appFetch because the extension bridge only allows framework /_agent-native/* paths. Parse JSON string action results before aggregating; use dbQuery() only for known existing SQL tables and never for writes. Keep the initial create-extension payload compact and working; for complex extensions, create a useful v1 first, then use focused update-extension edits for refinements rather than assembling one enormous initial tool input. For any non-trivial component (more than a couple of state fields, any methods, any string formatting, any branching) put the component in a <script> block via Alpine.data(\'name\', () => ({...})) and reference it with x-data="name" — do NOT cram methods, template literals, or branching logic into an inline x-data="{...}" attribute (HTML parser pitfalls cause ReferenceError failures). Define every variable referenced from x-text/x-show/x-if/x-for on the data object\'s initial state. If the extension\'s value depends on an LLM call, require a real key via \\${keys.OPENAI_API_KEY}/\\${keys.ANTHROPIC_API_KEY} (and tell the user to add it in the Dispatch Vault, or in app Settings → API Keys & Connections for standalone apps, if missing) or route the AI work to the agent chat — never ship a stubbed analysis step that renders a placeholder/boolean as the result.',
+          'Create a persisted sandboxed Alpine.js mini-app extension and render it inline in the chat. Use this when the user wants generated UI that should be saved, reusable, or visible in the Extensions view: extensions, widgets, dashboards, calculators, mini-apps, and reusable interactive utilities. For one-time chat-only UI, use render-inline-extension instead. The content must be a self-contained Alpine.js HTML body snippet that can use appAction(), appFetch(), dbQuery(), extensionFetch(), extensionData, agentNative.ui.output(value, opts?), and agentNative.chat.send()/sendToAgentChat(). Use appAction() for app data writes and extensionData for extension-owned persisted UI state; dbQuery() is for read-only inspection of known app SQL tables. Use agentNative.ui.output for passive current values from knobs, sliders, and selections; it writes application state at inline-ui:<extension id>:output, which the agent can read later with readAppState when the user says to use that value. Use agentNative.chat.send for visible submit/apply actions. Persist reusable user-edited state with extensionData: if the extension has checkboxes, todos, notes, filters, preferences, or any control whose value should survive reload/reopen, load that state on init and save changes with extensionData, usually at user scope, instead of keeping it only in Alpine state. IMPORTANT — hosting a pasted file: if the user pasted a large HTML/Alpine file (it appears in your context as an <attachment name="pasted-text-…"> block) and asked you to host it as-is, do NOT copy that file into `content`. Instead leave `content` empty and pass `contentFromAttachment` set to that attachment\'s name (or the literal "latest" for the most recent pasted block) — the server reads the file verbatim. Re-emitting a large pasted file as `content` regularly gets cut off mid-stream and stalls the turn. IMPORTANT — cloning a large extension that lives as a workspace resource (not a chat attachment): leave `content` empty and pass `contentFromWorkspaceFile` set to the resource path (e.g. "intuit-analytics-extension.html"); the server reads the full file. Do NOT try to reconstruct the body with run-code or route create-extension through run-code (mutating actions are not callable there). Prefer appAction(name, params) for app data and actions, including read actions mounted as GET; do not call template /api/* routes from appFetch because the extension bridge only allows framework /_agent-native/* paths. Parse JSON string action results before aggregating; use dbQuery() only for known existing SQL tables and never for writes. Keep the initial create-extension payload compact and working; for complex extensions, create a useful v1 first, then use focused update-extension edits for refinements rather than assembling one enormous initial tool input. For any non-trivial component (more than a couple of state fields, any methods, any string formatting, any branching) put the component in a <script> block via Alpine.data(\'name\', () => ({...})) and reference it with x-data="name" — do NOT cram methods, template literals, or branching logic into an inline x-data="{...}" attribute (HTML parser pitfalls cause ReferenceError failures). Define every variable referenced from x-text/x-show/x-if/x-for on the data object\'s initial state. If the extension\'s value depends on an LLM call, require a real key via \\${keys.OPENAI_API_KEY}/\\${keys.ANTHROPIC_API_KEY} (and tell the user to add it in the Dispatch Vault, or in app Settings → API Keys & Connections for standalone apps, if missing) or route the AI work to the agent chat — never ship a stubbed analysis step that renders a placeholder/boolean as the result.',
         parameters: {
           type: "object",
           properties: {
@@ -506,6 +515,11 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
               description:
                 'Host a pasted/attached file verbatim WITHOUT re-typing it. Set this to the name of an attachment on the current turn (e.g. "pasted-text-1718000000000-ab12cd.txt") or the literal "latest" for the most recent pasted block; the server resolves it into the extension content. Use this instead of `content` whenever the user pasted a large file to host — it avoids re-emitting thousands of tokens. When set, leave `content` empty.',
             },
+            contentFromWorkspaceFile: {
+              type: "string",
+              description:
+                'Host a workspace/shared resource file verbatim WITHOUT re-typing it. Set this to the resource path (e.g. "intuit-analytics-extension.html"); the server reads the full file and uses it as the extension content. Use this — NOT run-code or contentFromAttachment — when cloning a large extension body that already exists as a workspace resource. When set, leave `content` empty.',
+            },
             icon: {
               type: "string",
               description: "Optional icon name or short label.",
@@ -521,7 +535,7 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
       run: async (args, ctx) => {
         const name = String(args?.name ?? "").trim();
         if (!name) return "Error: name is required.";
-        const resolved = resolveExtensionContent(args, ctx);
+        const resolved = await resolveExtensionContentAsync(args, ctx);
         if ("error" in resolved) return resolved.error;
         const content = resolved.content.trim();
         if (!content) return "Error: content is required.";
@@ -553,9 +567,12 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
           } catch {
             // Non-fatal — agent can still mention the path in its reply.
           }
+          const hiddenIds = await getHiddenExtensionIdsForCurrentUser();
           return {
             ok: true,
-            extension: { ...existing, path: existingPath },
+            // Compact summary (contentLength + contentHash, no full body). Echoing
+            // the whole HTML back is pure token waste — the agent just supplied it.
+            extension: await summarizeExtension(existing, hiddenIds, false),
             path: existingPath,
             next: `Extension was already created in this session (recovered from a connection retry). The user is being navigated to it — no further navigation tool calls needed.`,
           };
@@ -585,9 +602,12 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
           // Non-fatal — agent can still mention the path in its reply.
         }
 
+        const hiddenIds = await getHiddenExtensionIdsForCurrentUser();
         return {
           ok: true,
-          extension: { ...extension, path },
+          // Compact summary (contentLength + contentHash, no full body). Echoing
+          // the whole HTML back is pure token waste — the agent just supplied it.
+          extension: await summarizeExtension(extension, hiddenIds, false),
           path,
           next: `Created. The user is being navigated to the new extension automatically — no further navigation tool calls needed.`,
         };
@@ -624,6 +644,11 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
               description:
                 'Optional full replacement sourced from a pasted/attached file on the current turn, by attachment name (or the literal "latest" for the most recent pasted block). Use instead of `content` when replacing the whole body with a large pasted file so you do not have to re-type it. Ignored when `content` is provided.',
             },
+            contentFromWorkspaceFile: {
+              type: "string",
+              description:
+                'Optional full replacement sourced from a workspace/shared resource file, by resource path (e.g. "intuit-analytics-extension.html"). The server reads the full file and uses it as the replacement body. Use instead of `content` when replacing the whole body with a large file that exists as a workspace resource. Ignored when `content` is provided.',
+            },
             patches: {
               type: "string",
               description:
@@ -670,9 +695,10 @@ export function createExtensionActionEntries(): Record<string, ActionEntry> {
             : undefined;
         if (
           replacementContent === undefined &&
-          args?.contentFromAttachment !== undefined
+          (args?.contentFromAttachment !== undefined ||
+            args?.contentFromWorkspaceFile !== undefined)
         ) {
-          const resolved = resolveExtensionContent(args, ctx);
+          const resolved = await resolveExtensionContentAsync(args, ctx);
           if ("error" in resolved) return resolved.error;
           replacementContent = resolved.content;
         }
@@ -1320,6 +1346,114 @@ function resolveExtensionContent(
   return { content: resolved };
 }
 
+/**
+ * Resolve the workspace-files bridge scope exactly the way run-code's
+ * workspaceRead/workspaceWrite do: org-preferred (org → shared owner) with the
+ * requesting user's email as the solo fallback. Kept in lockstep with
+ * `resolveScope` in `workspace-files/tool.ts`.
+ */
+function workspaceFilesBridgeScope(): WorkspaceFilesScope | null {
+  const orgId = getRequestOrgId();
+  if (orgId) return { scope: "org", scopeId: orgId };
+  const email = getRequestUserEmail();
+  if (email) return { scope: "user", scopeId: email };
+  return null;
+}
+
+/**
+ * Read a workspace/shared/personal resource file's FULL content by path.
+ *
+ * Precedence (single, documented rule so this never silently resolves a
+ * different file than the agent inspected):
+ *   1. The run-code `workspace-files` bridge scope (org → shared owner, else the
+ *      user's email). This is the SAME owner/scope `workspaceRead` /
+ *      `workspaceWrite` use, so a body the agent staged via `workspaceWrite` is
+ *      resolved here verbatim — the two paths cannot diverge.
+ *   2. User-managed Resources (personal override → org/shared → workspace
+ *      default) as a fallback, for pre-built resources that were created in the
+ *      Resources panel rather than staged through the bridge.
+ *
+ * Unlike attachments, resource content is not capped/truncated on the way in, so
+ * this is the correct path for cloning a large extension body that already
+ * exists as a workspace resource (e.g. a per-customer dashboard).
+ */
+async function readWorkspaceFileContent(path: string): Promise<string | null> {
+  const trimmed = path.trim();
+  if (!trimmed) return null;
+  // 1) Bridge parity — resolve exactly the file workspaceRead/workspaceWrite see.
+  const bridgeScope = workspaceFilesBridgeScope();
+  if (bridgeScope) {
+    let bridgeFile: Awaited<ReturnType<typeof readWorkspaceFile>>;
+    try {
+      bridgeFile = await readWorkspaceFile(bridgeScope, trimmed);
+    } catch {
+      // A THROW here is a transient store error or invalid path — NOT a
+      // definitive "not found". Fail closed rather than silently hosting a
+      // possibly-different same-path Resources body than workspaceRead
+      // inspected. A retry re-runs this read cleanly.
+      return null;
+    }
+    // A null result means the file genuinely does not exist in the bridge scope;
+    // fall through to user-managed Resources for pre-built resource-panel files.
+    if (bridgeFile && typeof bridgeFile.content === "string") {
+      return bridgeFile.content;
+    }
+  }
+  // 2) Fallback — user-managed Resources by scope precedence.
+  for (const scope of ["personal", "shared", "workspace"] as const) {
+    try {
+      const content = await readResource(trimmed, { scope });
+      if (typeof content === "string") return content;
+    } catch {
+      // A given scope can throw (e.g. `personal` when no user identity is
+      // resolvable in this context). Don't let one scope abort the lookup —
+      // fall through and try the next one.
+    }
+  }
+  return null;
+}
+
+/**
+ * Resolve the extension HTML body from (in priority order) inline `content`, a
+ * `contentFromWorkspaceFile` resource path, or a `contentFromAttachment` handle.
+ *
+ * The workspace-file path exists because a large extension body frequently lives
+ * as a workspace resource (not a chat attachment). Without it the model has no
+ * viable route — inline is too large to shuttle reliably, contentFromAttachment
+ * only sees chat attachments, and mutating actions cannot run from run-code — so
+ * it loops and the run aborts with no_progress.
+ */
+async function resolveExtensionContentAsync(
+  args: Record<string, string> | undefined,
+  ctx: ActionRunContext | undefined,
+): Promise<{ content: string } | { error: string }> {
+  const inline = args?.content !== undefined ? String(args.content) : undefined;
+  if (inline !== undefined && inline.trim().length > 0) {
+    return { content: inline };
+  }
+
+  const wsRef =
+    args?.contentFromWorkspaceFile !== undefined
+      ? String(args.contentFromWorkspaceFile).trim()
+      : "";
+  if (wsRef) {
+    const content = await readWorkspaceFileContent(wsRef);
+    if (content === null) {
+      return {
+        error: `Error: contentFromWorkspaceFile="${wsRef}" did not match any readable workspace/shared/personal resource file. Check the exact path (e.g. "intuit-analytics-extension.html"), or pass the HTML inline via content.`,
+      };
+    }
+    if (content.trim().length === 0) {
+      return {
+        error: `Error: workspace file "${wsRef}" is empty. Pass non-empty HTML inline via content, or point contentFromWorkspaceFile at a file with content.`,
+      };
+    }
+    return { content };
+  }
+
+  return resolveExtensionContent(args, ctx);
+}
+
 function coerceBoolean(value: unknown): boolean {
   return value === true || value === "true";
 }

package/corpus/core/src/mcp/builtin-tools.ts

@@ -31,7 +31,7 @@
  * `mountMCP` — the Node bits are dynamically imported inside `run()`.
  */
 
-import type { Task } from "../a2a/types.js";
+import type { A2AApprovedAction, Task } from "../a2a/types.js";
 import type { ActionEntry } from "../agent/production-agent.js";
 import type { ActionTool } from "../agent/types.js";
 import { getConfiguredAppBasePath } from "../server/app-base-path.js";
@@ -404,6 +404,7 @@ async function submitAskAppA2ATask(
   route: AskAppRoute,
   message: string,
   maxWaitMs: number,
+  approvedActions?: A2AApprovedAction[],
 ): Promise<AskAppTaskResult> {
   const deadline = maxWaitMs > 0 ? Date.now() + maxWaitMs : undefined;
   const { client, metadata } = await createA2AClientForAskApp(
@@ -419,6 +420,7 @@ async function submitAskAppA2ATask(
     {
       async: true,
       metadata,
+      ...(approvedActions?.length ? { approvedActions } : {}),
     },
   );
   const finalOrRunning = await waitForA2ATask(client, task, deadline);
@@ -890,6 +892,7 @@ async function routeAskOverA2A(
     durable?: boolean;
     maxWaitMs?: number;
     requestOrigin?: string;
+    approvedActions?: A2AApprovedAction[];
   },
 ): Promise<
   { app: string; routedVia: "a2a"; response: string } | AskAppTaskResult
@@ -904,6 +907,7 @@ async function routeAskOverA2A(
       },
       message,
       options.maxWaitMs ?? ASK_APP_DEFAULT_INLINE_WAIT_MS,
+      options.approvedActions,
     );
   }
   const { callAgent } = await import("../a2a/client.js");
@@ -919,6 +923,7 @@ async function routeAskOverA2A(
     orgDomain: auth.orgDomain,
     orgSecret: auth.orgSecret,
     requestOrigin: options?.requestOrigin,
+    approvedActions: options?.approvedActions,
     // Bound the wait — cross-app A2A polls async by default.
     timeoutMs: 5 * 60_000,
   });
@@ -1012,6 +1017,19 @@ function askAppTool(
           description:
             "Maximum time to wait inline before returning a taskId. Hosted MCP clamps this to 25000ms.",
         },
+        approvedActions: {
+          type: "array",
+          description:
+            "Exact downstream tool calls the user explicitly authorized in this chat. Never infer authorization or include a different action.",
+          items: {
+            type: "object",
+            properties: {
+              tool: { type: "string" },
+              input: { type: "object", additionalProperties: true },
+            },
+            required: ["tool", "input"],
+          },
+        } as any,
       },
       ["message"],
     ),
@@ -1024,6 +1042,9 @@ function askAppTool(
       const maxWaitMs = isExplicitAsyncAsk(args.async)
         ? 0
         : boundedAskAppWaitMs(args.maxWaitMs);
+      const approvedActions = Array.isArray(args.approvedActions)
+        ? (args.approvedActions as A2AApprovedAction[])
+        : undefined;
 
       // Cross-app: the caller named a *different* workspace app. Route the
       // message to THAT app's agent over A2A (its `/_agent-native/a2a`
@@ -1040,6 +1061,7 @@ function askAppTool(
               durable: useDurableA2A,
               maxWaitMs,
               requestOrigin: targetApp.origin,
+              approvedActions,
             },
           );
         } catch (err: any) {
@@ -1074,6 +1096,7 @@ function askAppTool(
                 durable: useDurableA2A,
                 maxWaitMs,
                 requestOrigin: dirMatch.url,
+                approvedActions,
               },
             );
           } catch (err: any) {
@@ -1120,6 +1143,7 @@ function askAppTool(
           },
           message,
           maxWaitMs,
+          approvedActions,
         );
       }
 

package/corpus/core/src/scripts/call-agent.ts

@@ -6,7 +6,7 @@ import {
   shouldPreferGlobalA2ASecret,
   signA2AToken,
 } from "../a2a/client.js";
-import type { Task } from "../a2a/types.js";
+import type { A2AApprovedAction, Task } from "../a2a/types.js";
 import {
   formatLlmCredentialErrorMessage,
   isLlmCredentialError,
@@ -112,17 +112,34 @@ export const tool: ActionTool = {
         type: "string",
         description: "The message/question to send to the other agent",
       },
+      approvedActions: {
+        type: "array",
+        description:
+          "Exact downstream tool calls the current user explicitly authorized in this chat. Never infer authorization or include a broader/different action.",
+        items: {
+          type: "object",
+          properties: {
+            tool: { type: "string" },
+            input: { type: "object", additionalProperties: true },
+          },
+          required: ["tool", "input"],
+        },
+      },
     },
     required: ["agent", "message"],
   },
 };
 
 export async function run(
-  args: Record<string, string>,
+  args: Record<string, unknown>,
   context?: ActionRunContext,
   selfAppId?: string,
 ): Promise<string> {
-  const { agent: agentIdOrName, message } = args;
+  const agentIdOrName = String(args.agent ?? "");
+  const message = String(args.message ?? "");
+  const approvedActions = Array.isArray(args.approvedActions)
+    ? (args.approvedActions as A2AApprovedAction[])
+    : undefined;
 
   if (!agentIdOrName) return "Error: --agent is required";
   if (!message) return "Error: --message is required";
@@ -320,6 +337,7 @@ export async function run(
           userEmail: callerEmail,
           orgDomain: callerOrgDomain,
           orgSecret: callerOrgSecret,
+          approvedActions,
           onUpdate: onRemotePollUpdate,
           ...(callTimeoutMs
             ? {
@@ -408,6 +426,7 @@ export async function run(
       userEmail: email,
       orgDomain: domain,
       orgSecret,
+      approvedActions,
     });
     const sanitized =
       formatDownstreamLlmCredentialFailure(agent.name, response) ?? response;

package/corpus/core/src/server/agent-chat-plugin.ts

@@ -1,3 +1,4 @@
+import crypto from "node:crypto";
 import nodePath from "node:path";
 
 import {
@@ -19,7 +20,10 @@ import {
   isTrustedLocalRuntime,
 } from "../a2a/auth-policy.js";
 import { applyAgentTextEventToBuffer } from "../a2a/response-text.js";
-import { updateTaskStatusMessage } from "../a2a/task-store.js";
+import {
+  createA2AApproval,
+  updateTaskStatusMessage,
+} from "../a2a/task-store.js";
 import type { ActionHttpConfig } from "../action.js";
 import {
   canUpdateAgentAppModelDefaultSettings,
@@ -52,6 +56,7 @@ import {
   createProductionAgentHandler,
   actionsToEngineTools,
   executeAgentToolCall,
+  toolCallCacheKey,
   getActiveRunForThreadAsync,
   abortRunDurably,
   subscribeToRun,
@@ -1171,6 +1176,25 @@ export function createAgentChatPlugin(
         publicSkillsOnly: true,
         streaming: true,
         durableBackgroundRuns: options?.durableBackgroundRuns,
+        executeApproval: async (approval) => {
+          const result = await executeAgentToolCall({
+            actions: mcpFullActions ?? allScripts,
+            name: approval.tool,
+            input: approval.input,
+            callId: approval.callId,
+            ownerEmail: approval.ownerEmail,
+            orgId: approval.orgId ?? null,
+            approvedToolCalls: [approval.approvalKey],
+          });
+          if (result.status === "approval_required") {
+            return {
+              status: "failed" as const,
+              output:
+                "The approved action was unexpectedly gated again and did not run.",
+            };
+          }
+          return { status: result.status, output: result.output };
+        },
         handler: async function* (message, context) {
           // Resolve the caller's identity for user-scoped data access.
           // Priority: A2A-JWT verified email (set by the A2A handler in
@@ -1495,6 +1519,9 @@ export function createAgentChatPlugin(
               // scope when a processor hop or alternate runner is involved.
               ownerEmail: userEmail,
               orgId: getRequestOrgId() ?? null,
+              approvedToolCalls: context.approvedActions?.map((approved) =>
+                toolCallCacheKey(approved.tool, approved.input),
+              ),
               executionMode: "act",
               send: (event) => {
                 a2aEvents.push(event);
@@ -1549,6 +1576,62 @@ export function createAgentChatPlugin(
             },
           );
 
+          const approval = [...a2aEvents]
+            .reverse()
+            .find(
+              (
+                event,
+              ): event is Extract<
+                AgentChatEvent,
+                { type: "approval_required" }
+              > => event.type === "approval_required",
+            );
+          if (approval) {
+            const pending = await createA2AApproval({
+              taskId: context.taskId,
+              ownerEmail: userEmail,
+              orgId: getRequestOrgId() ?? null,
+              tool: approval.tool,
+              toolInput: approval.input,
+              approvalKey: approval.approvalKey,
+              callId: approval.toolCallId ?? crypto.randomUUID(),
+            });
+            const baseUrl = resolveArtifactBaseUrl(context.event);
+            const approvalPath = `/_agent-native/a2a/approvals/${encodeURIComponent(pending.id)}`;
+            const approvalUrl = baseUrl
+              ? `${baseUrl}${approvalPath}`
+              : approvalPath;
+            yield {
+              role: "agent" as const,
+              metadata: {
+                agentNativeTaskState: "input-required",
+                agentNativeApproval: {
+                  id: pending.id,
+                  tool: approval.tool,
+                  url: approvalUrl,
+                },
+              },
+              parts: [
+                {
+                  type: "text" as const,
+                  text:
+                    `Human approval is required to run ${approval.tool}. ` +
+                    `Open ${approvalUrl} to review and approve this one-time action.`,
+                },
+                {
+                  type: "data" as const,
+                  data: {
+                    kind: "agent-native/approval-required",
+                    approvalId: pending.id,
+                    tool: approval.tool,
+                    approvalUrl,
+                  },
+                },
+              ],
+            };
+            return;
+          }
+
           const { responseText, finalText } = assembleA2AFinalResponse(
             a2aEvents,
             a2aToolResults,
@@ -5621,6 +5704,8 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
         "/_agent-native/agent-model-defaults",
         "/_agent-native/mcp",
         "/mcp",
+        "/.well-known/agent-card.json",
+        "/_agent-native/a2a",
       ],
     });
   };

package/corpus/core/src/templates/workspace-core/.agents/skills/a2a-protocol/SKILL.md

@@ -147,6 +147,31 @@ for await (const update of client.stream({
 }
 ```
 
+### Carrying explicit chat authorization
+
+When the authenticated caller has an exact consequential action that the user
+explicitly authorized in the originating chat, pass the tool name and complete
+input as `approvedActions`. The receiver accepts these grants only from a
+JWT-verified user identity, converts each one to the same content-addressed key
+as its local approval gate, and consumes it once:
+
+```ts
+await client.send(message, {
+  async: true,
+  approvedActions: [
+    {
+      tool: "send-email",
+      input: { to, subject, body, attachments },
+    },
+  ],
+});
+```
+
+Never infer authorization from request prose or broaden the input. A changed
+recipient, body, attachment, or tool produces a different key and follows the
+receiver's normal approval-required path. Static API keys and unsigned callers
+cannot carry these grants.
+
 ## JSON-RPC Methods
 
 | Method           | Purpose                          | Auth required |

package/corpus/templates/analytics/.agents/skills/dashboard-management/SKILL.md

@@ -143,6 +143,65 @@ Notes:
   "extension unavailable" message instead of the content. Share the extension to
   the same audience as the dashboard so all viewers can see it.
 
+## Cloning An Extension-Backed Dashboard (e.g. per-customer copies)
+
+When the user asks for a copy of an existing extension-backed dashboard for a
+different customer/org (for example "make an Intuit version of the Roku usage
+dashboard"), follow this playbook. Extension bodies are frequently tens of
+thousands of characters. The reliable path is to read+transform+write the body
+INSIDE `run-code` (where `workspaceRead` returns the full file) and then create
+from that written file — never by pulling the body into chat context first or
+re-typing it as a `content` argument.
+
+1. `get-sql-dashboard` with `includeConfig: true` on the source dashboard and
+   confirm the target panel is `chartType: "extension"`; grab its
+   `config.extensionId`.
+2. `get-extension` for that id with `forceContent: true` **exactly once**. Reuse
+   that body for the rest of the turn — a second same-run read intentionally
+   omits `content` and returns `contentOmitted` instead. That is not the content
+   disappearing; use the copy you already have. Do NOT try to re-fetch the body
+   with `run-code` (`appAction('get-extension')`) to page past a display
+   truncation — the same-run omit makes it return empty `content`, wasting turns.
+   If you need the full body again, read the workspace resource file (step 5) or
+   set `forceContent: true` on a single native `get-extension`.
+3. Change ONLY the small customer-specific static config (e.g. the
+   `ACCOUNT_USAGE_STATIC` block: company name, title, org-discovery filters,
+   messaging). Prefer a focused `update-extension` edit/patch over regenerating
+   the entire HTML.
+4. **Call `create-extension` / `update-extension` as native tools.** They are
+   mutating actions and are NOT callable from `run-code` / `appAction` (the
+   sandbox bridge only exposes read-only actions). Do not try to create or update
+   an extension from inside `run-code`.
+5. **If the source body already exists as a workspace/shared resource file**
+   (e.g. a pre-built `intuit-analytics-extension.html`), do the read AND the
+   customer swap in ONE `run-code` call, then create from the written file:
+   - Inside `run-code`: `const src = await workspaceRead('<source>.html')`
+     returns the WHOLE file (it auto-pages; there is no 50k cap here), do the
+     small string-replace on the static config block, then
+     `await workspaceWrite('<target>.html', modified)`.
+   - Then call `create-extension` (native) with
+     `contentFromWorkspaceFile: '<target>.html'` and leave `content` empty — the
+     server reads the full file verbatim.
+   Do NOT read the source body with the `resources` read tool (or `get-extension`)
+   first just to transform it: that display is capped and wastes a turn. And do
+   NOT re-emit an 80k+ char body as the `content` argument — it gets cut off
+   mid-stream. `contentFromAttachment` only sees files the user pasted into chat,
+   not workspace resources. `create-extension`/`update-extension` are mutating and
+   cannot run from `run-code`, so only the read+write+transform happens there.
+6. Finally `update-dashboard` to save a new dashboard embedding the new
+   extension panel (`chartType: "extension"`, `config.extensionId`), then
+   `navigate` to it.
+
+### Display truncation is cosmetic — do not chase the "missing" tail
+
+A tool result ending in `...[truncated — full result was N chars; only first
+50,000 shown]` (from the `resources` read tool or `get-extension`) means only the
+DISPLAYED text was capped. The file is intact. `run-code`'s `workspaceRead`
+returns the full N chars, and `contentFromWorkspaceFile` hosts the full file.
+Never read the same file twice or try to "page the rest" to recover the tail —
+that is the single biggest source of wasted turns on clone requests. Decide to
+clone, then go straight to the `run-code` read+transform+write path in step 5.
+
 ## Config Shape
 
 ```jsonc

package/corpus/templates/analytics/app/components/layout/NewDashboardDialog.tsx

@@ -14,10 +14,13 @@ import {
 
 const DASHBOARD_CONTEXT =
   "The user wants to create a new analytics dashboard. " +
-  "REAL_DATA_REQUIRED: before saving or answering, run at least one real data-source query action; `data-source-status`, `list-data-dictionary`, `update-dashboard`, and dry-run validation do not count as data queries. " +
+  "TEMPLATE FIRST — If the user names an existing dashboard as a template to clone/base this on, resolve its id first (use `list-sql-dashboards` if you only have a title), then call `get-sql-dashboard` with `includeConfig: true` immediately and inspect `panels[].chartType`. " +
+  'If any panel is `chartType: "extension"`, this is an extension-backed dashboard: call `get-extension` for that panel\'s `config.extensionId`, clone/adapt it with `create-extension` (apply the requested customer/org filters), then save a new dashboard via `update-dashboard` that embeds the new extension panel (`chartType: "extension"`, `config.extensionId`). Do not rebuild an extension template as guessed SQL/BigQuery panels. ' +
+  "LARGE EXTENSION CLONE — Extension bodies can be very large (tens of thousands of characters). Call `get-extension` with `forceContent: true` exactly ONCE and reuse that body; a second same-run read intentionally omits `content` (you'll see `contentOmitted`), so don't treat that as the content being gone. Call `create-extension` / `update-extension` as NATIVE tools — they are mutating actions and cannot be invoked from `run-code`/`appAction`. For customer-specific clones, change only the small static config block (e.g. `ACCOUNT_USAGE_STATIC`) and prefer a focused `update-extension` edit over regenerating the whole HTML. Never shovel the full body through `run-code` or chat; if you stage it in a workspace scratch file, read it back with `workspaceRead` (which returns the whole file). " +
+  "REAL_DATA_REQUIRED: before presenting numbers or authoring new SQL that invents tables/columns/filters, run at least one real data-source query action; `data-source-status`, `list-data-dictionary`, `get-sql-dashboard`, `get-extension`, `update-dashboard`, `mutate-dashboard`, and dry-run validation do not count as data queries. It is OK to inspect a template, clone an extension shell, ask one clarifying question (org id / account filter), or report an exact unavailable/error result without running a data query, as long as you do not invent metrics. " +
   "The `demo` source is reserved for the built-in Node Exporter demo and does not satisfy REAL_DATA_REQUIRED unless the user explicitly asks to work on that demo dashboard. " +
   "If no source can answer, report the exact unavailable/error result instead of saving a dashboard with guessed schema or metrics. " +
-  "Create a SQL-driven dashboard by calling the `update-dashboard` action with `dashboardId` and `config`. " +
+  "SQL PANELS — Only for native SQL dashboards (not template clones of an extension-backed dashboard): create a SQL-driven dashboard by calling the `update-dashboard` action with `dashboardId` and `config`. " +
   "The config shape is: { name: string, panels: [{ id, title, sql, source, chartType, width, tab?, config? }] }. " +
   "Each panel needs: id (unique string), title, sql (the query), source ('bigquery' | 'ga4' | 'amplitude' | 'first-party' | 'demo' | 'prometheus'), " +
   "chartType ('line' | 'area' | 'bar' | 'metric' | 'table' | 'pie'), width (1 or 2). " +