@agent-native/core 0.130.2 → 0.131.2

package/corpus/core/src/triggers/routes.ts

@@ -5,10 +5,18 @@ import {
   type H3Event,
 } from "h3";
 
+import { canUpdateAutomationResource } from "../automations/service.js";
 import { getDbExec } from "../db/client.js";
 import { nextOccurrence, describeCron, isValidCron } from "../jobs/cron.js";
+import {
+  buildJobResourceContent,
+  parseJobResource,
+  type JobFrontmatter,
+} from "../jobs/frontmatter.js";
 import { getOrgContext } from "../org/context.js";
 import {
+  organizationIdFromResourceOwner,
+  organizationResourceOwner,
   resourceGetByPath,
   resourceListAllOwners,
   resourcePut,
@@ -17,11 +25,7 @@ import {
 } from "../resources/store.js";
 import { getSession } from "../server/auth.js";
 import { readBody } from "../server/h3-helpers.js";
-import {
-  buildTriggerContent,
-  parseTriggerFrontmatter,
-  refreshEventSubscriptions,
-} from "./dispatcher.js";
+import { refreshEventSubscriptions } from "./dispatcher.js";
 import type { TriggerFrontmatter } from "./types.js";
 
 export interface AutomationRouteItem {
@@ -57,6 +61,14 @@ function automationName(path: string): string {
   return path.replace(/^jobs\//, "").replace(/\.md$/, "");
 }
 
+function asTriggerFrontmatter(meta: JobFrontmatter): TriggerFrontmatter {
+  return {
+    ...meta,
+    triggerType: meta.triggerType ?? "schedule",
+    mode: meta.mode ?? "agentic",
+  };
+}
+
 function normalizeAutomationPath(input: SetAutomationEnabledInput): string {
   const rawPath = input.path ?? (input.name ? `jobs/${input.name}.md` : "");
   const path = rawPath.replace(/^\/+/, "");
@@ -105,12 +117,33 @@ function nextRunForMeta(meta: TriggerFrontmatter): string | undefined {
 async function currentUserCanUpdateAutomation(
   event: H3Event,
   userEmail: string,
-  resourceOwner: string,
+  resource: Resource,
   meta: TriggerFrontmatter,
 ): Promise<boolean> {
+  const resourceOwner = resource.owner;
   if (resourceOwner === userEmail) return true;
+  const resourceOrgId = organizationIdFromResourceOwner(resourceOwner);
+  if (resourceOrgId) {
+    try {
+      const org = await getOrgContext(event);
+      if (org.orgId !== resourceOrgId) return false;
+      return await canUpdateAutomationResource(
+        { userEmail, orgId: resourceOrgId },
+        resource,
+      );
+    } catch {
+      return false;
+    }
+  }
   if (resourceOwner !== SHARED_OWNER) return false;
 
+  if (meta.orgId) {
+    const activeOrgId = await getOrgContext(event)
+      .then((context) => context.orgId)
+      .catch(() => null);
+    if (activeOrgId !== meta.orgId) return false;
+  }
+
   if (
     meta.createdBy &&
     meta.createdBy.toLowerCase() === userEmail.toLowerCase()
@@ -145,7 +178,8 @@ async function resourceToAutomationItem(
   userEmail: string,
   resource: Resource,
 ): Promise<AutomationRouteItem> {
-  const { meta, body } = parseTriggerFrontmatter(resource.content);
+  const parsed = parseJobResource(resource.content);
+  const meta = asTriggerFrontmatter(parsed.meta);
   return {
     id: resource.id,
     name: automationName(resource.path),
@@ -154,7 +188,7 @@ async function resourceToAutomationItem(
     canUpdate: await currentUserCanUpdateAutomation(
       event,
       userEmail,
-      resource.owner,
+      resource,
       meta,
     ),
     triggerType: meta.triggerType,
@@ -170,7 +204,7 @@ async function resourceToAutomationItem(
     lastError: meta.lastError,
     nextRun: nextRunForMeta(meta),
     createdBy: meta.createdBy,
-    body,
+    body: parsed.body,
   };
 }
 
@@ -179,12 +213,27 @@ export async function listAutomationsForOwner(
   userEmail: string,
 ): Promise<AutomationRouteItem[]> {
   const allResources = await resourceListAllOwners("jobs/");
-  const resources = allResources.filter(
-    (resource) =>
-      (resource.owner === userEmail || resource.owner === SHARED_OWNER) &&
-      resource.path.endsWith(".md") &&
-      !resource.path.endsWith(".keep"),
-  );
+  const activeOrgId = await getOrgContext(event)
+    .then((context) => context.orgId)
+    .catch(() => null);
+  const activeOrgOwner = activeOrgId
+    ? organizationResourceOwner(activeOrgId)
+    : null;
+  const resources = allResources.filter((resource) => {
+    if (!resource.path.endsWith(".md") || resource.path.endsWith(".keep")) {
+      return false;
+    }
+    if (
+      resource.owner !== userEmail &&
+      resource.owner !== SHARED_OWNER &&
+      resource.owner !== activeOrgOwner
+    ) {
+      return false;
+    }
+    if (resource.owner !== SHARED_OWNER) return true;
+    const { meta } = parseJobResource(resource.content);
+    return !meta.orgId || meta.orgId === activeOrgId;
+  });
   return Promise.all(
     resources.map((resource) =>
       resourceToAutomationItem(event, userEmail, resource),
@@ -204,18 +253,29 @@ export async function setAutomationEnabledForOwner(
   }
 
   const path = normalizeAutomationPath(input);
+  const activeOrgId = await getOrgContext(event)
+    .then((context) => context.orgId)
+    .catch(() => null);
+  const activeOrgOwner = activeOrgId
+    ? organizationResourceOwner(activeOrgId)
+    : null;
   const requestedOwner =
-    input.owner === SHARED_OWNER ? SHARED_OWNER : userEmail;
+    input.owner === SHARED_OWNER
+      ? SHARED_OWNER
+      : input.owner === activeOrgOwner
+        ? activeOrgOwner
+        : userEmail;
   const resource = await resourceGetByPath(requestedOwner, path);
   if (!resource) {
     throw Object.assign(new Error("Automation not found"), { statusCode: 404 });
   }
 
-  const { meta, body } = parseTriggerFrontmatter(resource.content);
+  const parsed = parseJobResource(resource.content);
+  const meta = asTriggerFrontmatter(parsed.meta);
   const allowed = await currentUserCanUpdateAutomation(
     event,
     userEmail,
-    resource.owner,
+    resource,
     meta,
   );
   if (!allowed) {
@@ -225,26 +285,23 @@ export async function setAutomationEnabledForOwner(
     );
   }
 
-  meta.enabled = input.enabled;
+  parsed.meta.enabled = input.enabled;
   if (
-    meta.enabled &&
+    parsed.meta.enabled &&
     meta.triggerType !== "event" &&
     meta.schedule &&
     isValidCron(meta.schedule)
   ) {
-    meta.nextRun = nextOccurrence(meta.schedule).toISOString();
+    parsed.meta.nextRun = nextOccurrence(meta.schedule).toISOString();
   }
 
-  await resourcePut(
-    resource.owner,
-    resource.path,
-    buildTriggerContent(meta, body),
-  );
+  const updatedContent = buildJobResourceContent(parsed.meta, parsed.body);
+  await resourcePut(resource.owner, resource.path, updatedContent);
   await refreshEventSubscriptions();
 
   return resourceToAutomationItem(event, userEmail, {
     ...resource,
-    content: buildTriggerContent(meta, body),
+    content: updatedContent,
   });
 }
 

package/corpus/core/src/triggers/types.ts

@@ -6,15 +6,15 @@
  * cron scheduler and dispatched by the event bus instead.
  */
 
-export interface TriggerFrontmatter {
-  schedule: string;
-  enabled: boolean;
+import type {
+  JobExecutionMode,
+  JobFrontmatter,
+  JobTriggerType,
+} from "../jobs/frontmatter.js";
+
+export interface TriggerFrontmatter extends JobFrontmatter {
   /** "schedule" = cron-based (legacy jobs). "event" = fires on bus event. */
-  triggerType: "schedule" | "event";
-  /** For event triggers: the event name to subscribe to. */
-  event?: string;
-  /** Natural-language condition evaluated by Haiku before dispatch. */
-  condition?: string;
+  triggerType: JobTriggerType;
   /**
    * "agentic" = full runAgentLoop; the only mode `manage-automations` will
    * define/update going forward. "deterministic" was removed from the
@@ -22,21 +22,7 @@ export interface TriggerFrontmatter {
    * before the removal may still carry it, and the dispatcher's
    * warn-and-skip branch keeps them inert by design — do not make them fire.
    */
-  mode: "agentic" | "deterministic";
-  /** Domain tag for filtering in per-template UIs. */
-  domain?: string;
-  /**
-   * Optional application-owned policy id carried into actions by the trusted
-   * trigger dispatcher. It is not model-supplied action input.
-   */
-  delegatedPolicyId?: string;
-  createdBy?: string;
-  orgId?: string;
-  runAs?: "creator" | "shared";
-  lastRun?: string;
-  lastStatus?: "success" | "error" | "running" | "skipped";
-  lastError?: string;
-  nextRun?: string;
+  mode: JobExecutionMode;
 }
 
 export interface TriggerDispatchContext {

package/corpus/templates/analytics/.agents/skills/agent-native-toolkit/SKILL.md

@@ -117,6 +117,11 @@ in the moment of agent use.
   missing-secret states, OAuth grants, and provider connection health.
 - **Agent UX kit**: sidebar, composer, staged context, mentions, voice, human
   approval, generative UI, progress, and screen-state exposure.
+- **Custom block kit**: optional extension creation, viewer chrome, slots, and
+  promotion affordances. Apps must opt in; Core keeps the sandbox, SQL storage,
+  access checks, and compatibility routes, while Toolkit owns reusable adoption
+  UI. Analytics may expose this as one-off **Custom Blocks**; durable behavior
+  should be promoted to app code.
 - **Chat history kit**: presentational chat lists and recent-chat rails belong
   in Toolkit; Core keeps thread persistence, agent execution, transport, and
   page-to-sidebar handoff. Use Toolkit's `ChatHistoryRail` for the standard

package/corpus/templates/analytics/actions/install-dashboard-template.ts

@@ -28,12 +28,13 @@ import {
 async function syncToCollab(
   dashboardId: string,
   config: Record<string, unknown>,
+  requestSource?: string,
 ): Promise<void> {
   const docId = `dash-${dashboardId}`;
   const configStr = JSON.stringify(config);
   try {
     if (await hasCollabState(docId)) {
-      await applyText(docId, configStr, "content", "agent");
+      await applyText(docId, configStr, "content", requestSource);
     } else {
       await seedFromText(docId, configStr);
     }
@@ -137,7 +138,7 @@ export default defineAction({
       height: 760,
     }),
   },
-  run: async (args) => {
+  run: async (args, actionContext) => {
     const email = getRequestUserEmail();
     if (!email) throw new Error("no authenticated user");
     const ctx = { email, orgId: getRequestOrgId() || null };
@@ -242,7 +243,11 @@ export default defineAction({
             return { kind: existing.kind, body: computed.mergedConfig };
           },
         );
-        await syncToCollab(targetId, saved.config as Record<string, unknown>);
+        await syncToCollab(
+          targetId,
+          saved.config as Record<string, unknown>,
+          actionContext?.caller === "frontend" ? undefined : "agent",
+        );
         savedTitle = saved.title;
       }
 
@@ -315,7 +320,11 @@ export default defineAction({
         dashboardConfig,
         ctx,
       );
-      await syncToCollab(dashboardId, dashboardConfig);
+      await syncToCollab(
+        dashboardId,
+        dashboardConfig,
+        actionContext?.caller === "frontend" ? undefined : "agent",
+      );
 
       return {
         templateId: entry.id,

package/corpus/templates/analytics/actions/rename-dashboard.ts

@@ -22,12 +22,13 @@ function resolveScope() {
 async function syncToCollab(
   dashboardId: string,
   config: Record<string, unknown>,
+  requestSource?: string,
 ): Promise<void> {
   const docId = `dash-${dashboardId}`;
   const configStr = JSON.stringify(config);
   try {
     if (await hasCollabState(docId)) {
-      await applyText(docId, configStr, "content", "agent");
+      await applyText(docId, configStr, "content", requestSource);
     } else {
       await seedFromText(docId, configStr);
     }
@@ -42,7 +43,7 @@ export default defineAction({
     id: z.string().describe("The dashboard ID to rename"),
     name: z.string().describe("The new dashboard name"),
   }),
-  run: async (args) => {
+  run: async (args, actionContext) => {
     const name = args.name.trim();
     if (!name) throw new Error("name is required");
 
@@ -53,7 +54,11 @@ export default defineAction({
     const updated = await upsertDashboardWithRetry(args.id, ctx, (existing) => {
       return { kind: existing.kind, body: { ...existing.config, name } };
     });
-    await syncToCollab(args.id, updated.config);
+    await syncToCollab(
+      args.id,
+      updated.config,
+      actionContext?.caller === "frontend" ? undefined : "agent",
+    );
     return { id: updated.id, name: updated.title };
   },
 });

package/corpus/templates/analytics/actions/restore-dashboard-revision.ts

@@ -22,13 +22,14 @@ function resolveScope() {
 async function syncToCollab(
   dashboardId: string,
   config: Record<string, unknown>,
+  requestSource?: string,
 ): Promise<void> {
   const docId = `dash-${dashboardId}`;
   const configStr = JSON.stringify(config);
   try {
     const exists = await hasCollabState(docId);
     if (exists) {
-      await applyText(docId, configStr, "content", "agent");
+      await applyText(docId, configStr, "content", requestSource);
     } else {
       await seedFromText(docId, configStr);
     }
@@ -49,7 +50,7 @@ export default defineAction({
       .describe("The dashboard updatedAt value observed before this restore"),
   }),
   http: { method: "POST" },
-  run: async (args) => {
+  run: async (args, actionContext) => {
     const restored = await restoreDashboardRevision(
       args.dashboardId,
       args.revisionId,
@@ -62,7 +63,11 @@ export default defineAction({
       );
     }
     const { dashboard, snapshotRevisionId } = restored;
-    await syncToCollab(dashboard.id, dashboard.config);
+    await syncToCollab(
+      dashboard.id,
+      dashboard.config,
+      actionContext?.caller === "frontend" ? undefined : "agent",
+    );
     return {
       id: dashboard.id,
       kind: dashboard.kind,

package/corpus/templates/analytics/actions/update-dashboard.ts

@@ -544,13 +544,14 @@ function opCanChangePanelSql(op: JsonOp): boolean {
 async function syncToCollab(
   dashboardId: string,
   config: Record<string, unknown>,
+  requestSource?: string,
 ): Promise<void> {
   const docId = `dash-${dashboardId}`;
   const configStr = JSON.stringify(config);
   try {
     const exists = await hasCollabState(docId);
     if (exists) {
-      await applyText(docId, configStr, "content", "agent");
+      await applyText(docId, configStr, "content", requestSource);
     } else {
       await seedFromText(docId, configStr);
     }
@@ -559,6 +560,10 @@ async function syncToCollab(
   }
 }
 
+function isAgentCaller(caller: string | undefined): boolean {
+  return caller === "tool" || caller === "mcp" || caller === "a2a";
+}
+
 // Reads + writes now go through the SQL-backed dashboards store, which
 // lazy-migrates legacy settings keys on first access. See
 // `server/lib/dashboards-store.ts`.
@@ -614,7 +619,7 @@ export default defineAction({
       height: 680,
     }),
   },
-  run: async (args) => {
+  run: async (args, actionContext) => {
     const dashboardId = resolveDashboardId(args);
     const modeCount = [args.ops, args.panelOrder, args.config].filter(
       (value) => value !== undefined,
@@ -638,7 +643,11 @@ export default defineAction({
       const sqlError = await validatePanelSql(args.config);
       if (sqlError) throw new Error(sqlError);
       await upsertDashboard(dashboardId, "sql", args.config, ctx);
-      await syncToCollab(dashboardId, args.config);
+      await syncToCollab(
+        dashboardId,
+        args.config,
+        isAgentCaller(actionContext?.caller) ? "agent" : undefined,
+      );
       const panelCount = countPanels(args.config);
       return dashboardResult(
         dashboardId,
@@ -667,7 +676,11 @@ export default defineAction({
         },
       );
       const root = saved.config as Record<string, unknown>;
-      await syncToCollab(dashboardId, root);
+      await syncToCollab(
+        dashboardId,
+        root,
+        isAgentCaller(actionContext?.caller) ? "agent" : undefined,
+      );
       return dashboardResult(
         dashboardId,
         root,
@@ -709,7 +722,11 @@ export default defineAction({
       },
     );
     const root = saved.config as Record<string, unknown>;
-    await syncToCollab(dashboardId, root);
+    await syncToCollab(
+      dashboardId,
+      root,
+      isAgentCaller(actionContext?.caller) ? "agent" : undefined,
+    );
 
     const panelCount = countPanels(root);
     return dashboardResult(

package/corpus/templates/analytics/app/components/dashboard/DashboardPanelSkeleton.tsx

@@ -1,10 +1,16 @@
 import type { ComponentProps } from "react";
 
 import { Skeleton } from "@/components/ui/skeleton";
+import { cn } from "@/lib/utils";
 
 export function DashboardPanelSkeleton({
   className,
   ...props
 }: ComponentProps<typeof Skeleton>) {
-  return <Skeleton {...props} className={className} />;
+  return (
+    <Skeleton
+      {...props}
+      className={cn("analytics-dashboard-panel-skeleton", className)}
+    />
+  );
 }

package/corpus/templates/analytics/app/components/layout/CommandPalette.tsx

@@ -1,6 +1,4 @@
-import { agentNativePath } from "@agent-native/core/client/api-path";
 import { ChangelogDialog } from "@agent-native/core/client/changelog";
-import { extensionPath } from "@agent-native/core/client/extensions";
 import { callAction, useChangeVersions } from "@agent-native/core/client/hooks";
 import { LanguagePicker, useT } from "@agent-native/core/client/i18n";
 import { useOrgRole } from "@agent-native/core/client/org";
@@ -75,12 +73,6 @@ interface ExplorerDashboard {
   hiddenAt?: string | null;
 }
 
-interface ExtensionSearchItem {
-  id: string;
-  name: string;
-  description?: string;
-}
-
 const defaultTools = [
   {
     id: "agents",
@@ -258,32 +250,6 @@ async function fetchSqlDashboards(
   );
 }
 
-async function fetchExtensions(): Promise<ExtensionSearchItem[]> {
-  const res = await fetch(agentNativePath("/_agent-native/extensions"));
-  if (!res.ok) throw new Error(`Failed to load extensions (${res.status})`);
-  const data = await res.json();
-  return uniqueCommandItems(
-    (Array.isArray(data) ? data : [])
-      .filter((extension: any) => {
-        return (
-          extension &&
-          typeof extension.id === "string" &&
-          extension.id.length > 0 &&
-          typeof extension.name === "string" &&
-          extension.name.trim().length > 0
-        );
-      })
-      .map((extension: any) => ({
-        id: extension.id,
-        name: extension.name,
-        description:
-          typeof extension.description === "string"
-            ? extension.description
-            : undefined,
-      })),
-  );
-}
-
 function persistThemePreference(theme: "light" | "dark") {
   callAction("set-theme", { theme }).catch(() => {});
 }
@@ -334,33 +300,21 @@ export function CommandPalette() {
     placeholderData: (prev) => prev,
   });
 
-  const extensionsQuery = useQuery<ExtensionSearchItem[]>({
-    queryKey: ["extensions"],
-    queryFn: fetchExtensions,
-    staleTime: 30_000,
-    enabled: open,
-    placeholderData: (prev) => prev,
-  });
-
   const savedCharts = savedChartsQuery.data ?? [];
   const explorerDashboards = explorerDashboardsQuery.data ?? [];
   const sqlDashboards = sqlDashboardsQuery.data ?? [];
-  const extensions = extensionsQuery.data ?? [];
   const savedChartsLoading = savedChartsQuery.isLoading;
   const explorerDashboardsLoading = explorerDashboardsQuery.isLoading;
   const sqlDashboardsLoading = sqlDashboardsQuery.isLoading;
-  const extensionsLoading = extensionsQuery.isLoading;
   const asyncGroupsErrored =
     savedChartsQuery.isError ||
     explorerDashboardsQuery.isError ||
-    sqlDashboardsQuery.isError ||
-    extensionsQuery.isError;
+    sqlDashboardsQuery.isError;
   const retryAsyncGroups = () => {
     void Promise.all([
       savedChartsQuery.refetch(),
       explorerDashboardsQuery.refetch(),
       sqlDashboardsQuery.refetch(),
-      extensionsQuery.refetch(),
     ]);
   };
 
@@ -400,7 +354,6 @@ export function CommandPalette() {
   const asyncGroupsLoading =
     (explorerDashboardsLoading && explorerDashboards.length === 0) ||
     (sqlDashboardsLoading && sqlDashboards.length === 0) ||
-    (extensionsLoading && extensions.length === 0) ||
     (savedChartsLoading && savedCharts.length === 0);
   const showHiddenResults = searchQuery.trim().length > 0;
   const visibleExplorerDashboards = showHiddenResults
@@ -517,32 +470,6 @@ export function CommandPalette() {
               </CommandGroup>
             )}
 
-            {extensions.length > 0 && (
-              <CommandGroup
-                key="extensions"
-                heading={t("commandPalette.groupExtensions")}
-              >
-                {extensions.map((extension) => (
-                  <CommandItem
-                    key={`extension-${extension.id}`}
-                    value={`extension:${extension.id}:${extension.name}`}
-                    onSelect={() =>
-                      go(extensionPath(extension.id, extension.name))
-                    }
-                    keywords={commandPaletteKeywords(
-                      extension.name,
-                      extension.description,
-                      "extension",
-                      "tool",
-                    )}
-                  >
-                    <IconTool className="me-2 h-4 w-4 text-muted-foreground" />
-                    {extension.name}
-                  </CommandItem>
-                ))}
-              </CommandGroup>
-            )}
-
             <CommandGroup
               key="dashboards"
               heading={t("commandPalette.groupDashboards")}
@@ -735,14 +662,6 @@ export function CommandPalette() {
             />
           )}
 
-          {extensionsLoading && extensions.length === 0 && (
-            <CommandLoadingGroup
-              key="extensions-loading"
-              heading={t("commandPalette.groupExtensions")}
-              rows={3}
-            />
-          )}
-
           {savedChartsLoading && savedCharts.length === 0 && (
             <CommandLoadingGroup
               key="saved-charts-loading"

package/corpus/templates/analytics/app/components/layout/NewDashboardDialog.tsx

@@ -12,14 +12,14 @@ import {
 
 const DASHBOARD_CONTEXT =
   "The user wants to create a new analytics dashboard. " +
-  'DASHBOARD ARTIFACT RULE — Dashboards are the only user-facing Analytics artifact. For deep dives, saved reports, custom visualizations, or bespoke workflows, always create or update a dashboard. If bespoke UI is needed, create the extension and immediately add it as one or more `chartType: "extension"` panels in that dashboard; never leave the extension standalone or direct the user to an Extensions page. ' +
+  "DASHBOARD ARTIFACT RULE — Dashboards are the only user-facing Analytics artifact. Build with native dashboard panels and Data Programs first. A sandboxed extension is presented only as a dashboard-scoped Custom Block, never as a separate Analytics result. Create one only when the user explicitly wants a genuinely bespoke, one-off visualization or interaction for this dashboard and native panels cannot represent it faithfully. If the behavior should be reused across dashboards/users or added natively, call `connect-builder` instead. " +
   "TEMPLATE FIRST — If the user names an existing dashboard as a template to clone/base this on, resolve its id first (use `list-sql-dashboards` if you only have a title), then call `get-sql-dashboard` with `includeConfig: true` immediately and inspect `panels[].chartType`. " +
-  'If any panel is `chartType: "extension"`, this is an extension-backed dashboard: call `get-extension` for that panel\'s `config.extensionId`, clone/adapt it with `create-extension` (apply the requested customer/org filters), then save a new dashboard via `update-dashboard` that embeds the new extension panel (`chartType: "extension"`, `config.extensionId`). Do not rebuild an extension template as guessed SQL/BigQuery panels. ' +
+  'If an explicitly named template already contains a `chartType: "extension"` Custom Block, call `get-extension` for that panel\'s `config.extensionId`, clone/adapt it with `create-extension` (apply the requested customer/org filters), then save a new dashboard via `update-dashboard` that embeds the cloned block. Preserve or add `config.customBlock` provenance with `authoredBy: "agent"`, `intent: "one-off"`, `scope: "dashboard"`, and a categorical `nativeGapReason`; never put prompt/customer text in that metadata. Do not rebuild an existing Custom Block as guessed SQL/BigQuery panels. ' +
   "LARGE EXTENSION CLONE — Extension bodies can be very large (tens of thousands of characters). Call `get-extension` with `forceContent: true` exactly ONCE and reuse that body; a second same-run read intentionally omits `content` (you'll see `contentOmitted`), so don't treat that as the content being gone. Call `create-extension` / `update-extension` as NATIVE tools — they are mutating actions and cannot be invoked from `run-code`/`appAction`. For customer-specific clones, change only the small static config block (e.g. `ACCOUNT_USAGE_STATIC`) and prefer a focused `update-extension` edit over regenerating the whole HTML. Never shovel the full body through `run-code` or chat; if you stage it in a workspace scratch file, read it back with `workspaceRead` (which returns the whole file). " +
   "REAL_DATA_REQUIRED: before presenting numbers or authoring new SQL that invents tables/columns/filters, run at least one real data-source query action; `data-source-status`, `list-data-dictionary`, `get-sql-dashboard`, `get-extension`, `update-dashboard`, `mutate-dashboard`, and dry-run validation do not count as data queries. It is OK to inspect a template, clone an extension shell, ask one clarifying question (org id / account filter), or report an exact unavailable/error result without running a data query, as long as you do not invent metrics. " +
   "The `demo` source is reserved for the built-in Node Exporter demo and does not satisfy REAL_DATA_REQUIRED unless the user explicitly asks to work on that demo dashboard. " +
   "If no source can answer, report the exact unavailable/error result instead of saving a dashboard with guessed schema or metrics. " +
-  "SQL PANELS — Only for native SQL dashboards (not template clones of an extension-backed dashboard): create a SQL-driven dashboard by calling the `update-dashboard` action with `dashboardId` and `config`. " +
+  "NATIVE PANELS — Create a SQL-driven dashboard by calling the `update-dashboard` action with `dashboardId` and `config`; use a Data Program first when reusable fetching or transformation is the missing layer. " +
   "The config shape is: { name: string, panels: [{ id, title, sql, source, chartType, width, tab?, config? }] }. " +
   "Each panel needs: id (unique string), title, sql (the query), source ('bigquery' | 'ga4' | 'amplitude' | 'first-party' | 'demo' | 'prometheus'), " +
   "chartType ('line' | 'area' | 'bar' | 'metric' | 'table' | 'pie'), width (1 or 2). " +
@@ -29,7 +29,7 @@ const DASHBOARD_CONTEXT =
   "For the built-in demo dashboard, source is 'demo' and sql uses the same Prometheus JSON descriptor shape as source 'prometheus': { promql, mode, range, step }. " +
   "Call `data-source-status` if you need to see which data sources are connected. " +
   "Refer to AGENTS.md, .agents/skills, the data dictionary, and connected data-source instructions for SQL patterns and table names. " +
-  "NO code files need to be created — only the dashboard config JSON via `update-dashboard`. " +
+  "Do not create code files for an ordinary native dashboard. Use `connect-builder` only for an explicitly reusable/native code request. " +
   "After saving, call the `navigate` action with view='adhoc' and dashboardId so the new dashboard opens immediately.";
 
 export function NewDashboardDialog() {