@agent-native/core 0.144.3 → 0.145.0

package/dist/server/agent-chat-plugin.js

@@ -24,6 +24,7 @@ import { adoptThreadScopeIfUnscoped, createThread, forkThread, getThread, regist
 import { isCheckpointRestorePath } from "../checkpoints/route-match.js";
 import { createDbAdminAgentTools } from "../db-admin/agent-tools.js";
 import { isTransientDatabaseError } from "../db/client.js";
+import { filterFrameworkToolGroups, resolveFrameworkTools, } from "../framework-tools.js";
 import { verifyInternalToken, extractBearerToken, } from "../integrations/internal-token.js";
 import { RECURRING_JOBS_SWEEP_PATH, RECURRING_JOBS_SWEEP_TOKEN_SUBJECT, } from "../jobs/scheduler-dispatch.js";
 import { McpClientManager, loadMcpConfig, autoDetectMcpConfig, mcpToolsToActionEntries, syncMcpActionEntries, mountMcpServersRoutes, mountMcpHubRoutes, buildMergedConfig, startMcpConfigRefresh, getHubStatus, isHubServeEnabled, } from "../mcp-client/index.js";
@@ -277,12 +278,19 @@ export function createAgentChatPlugin(options) {
             // `canToggle` means "this environment allows toggling" (static); this
             // function means "the user currently has dev mode ON" (live).
             const isDevMode = () => currentDevMode;
+            // Resolve the framework's own tool surface once, folding the deprecated
+            // `databaseTools` / `extensionTools` into `frameworkTools` so every
+            // consumer below reads a single shape. Conflicting old/new values throw
+            // here rather than booting with a surface nobody chose.
+            const frameworkTools = resolveFrameworkTools(options);
+            const disabledFrameworkGroups = frameworkTools.disabledGroups;
             // Build the four assembled system prompt strings. These are static for the
             // lifetime of this plugin instance — examples come from options once at
             // startup, not per-request.
             const { PROD_FRAMEWORK_PROMPT, DEV_FRAMEWORK_PROMPT, PROD_FRAMEWORK_PROMPT_COMPACT, DEV_FRAMEWORK_PROMPT_COMPACT, } = buildFrameworkPrompts(options?.promptExamples, {
-                databaseTools: options?.databaseTools,
-                extensionTools: options?.extensionTools,
+                databaseTools: frameworkTools.database,
+                extensionTools: frameworkTools.extensions,
+                disabledFrameworkGroups,
             });
             // Route readiness must not wait on settings scans, remote hub fetches, or
             // third-party MCP handshakes. Build the action surface against an empty
@@ -397,13 +405,23 @@ export function createAgentChatPlugin(options) {
             catch {
                 // Package action registration is optional.
             }
-            // Resource, chat, docs, db, and cross-agent scripts are available in both prod and dev modes
-            const resourceScripts = await createResourceScriptEntries();
-            const docsScripts = await createDocsScriptEntries();
-            const databaseToolsMode = normalizeDatabaseToolsMode(options?.databaseTools);
+            // Resource, chat, docs, db, and cross-agent scripts are available in both
+            // prod and dev modes, unless the app switched the group off through
+            // `frameworkTools`. Gating at construction is deliberate: an empty map
+            // flows through all thirteen registry composition sites below, whereas a
+            // condition at each spread site is the same omission waiting to happen
+            // thirteen times. Matching HTTP routes are mounted from `httpActions`,
+            // which is built from the ungated sets so the UI keeps working.
+            const resourceScripts = frameworkTools.isEnabled("resources")
+                ? await createResourceScriptEntries()
+                : {};
+            const docsScripts = frameworkTools.isEnabled("docs")
+                ? await createDocsScriptEntries()
+                : {};
+            const databaseToolsMode = normalizeDatabaseToolsMode(frameworkTools.database);
             const databaseToolsEnabled = databaseToolsMode !== "off";
             const databaseWriteToolsEnabled = databaseToolsMode === "write";
-            const extensionToolsEnabled = options?.extensionTools === true;
+            const extensionToolsEnabled = frameworkTools.extensions;
             const dbScripts = databaseToolsEnabled
                 ? await createDbScriptEntries(databaseToolsMode, {
                     extensionTools: extensionToolsEnabled,
@@ -417,12 +435,20 @@ export function createAgentChatPlugin(options) {
             const urlTools = createUrlTools();
             const engineScripts = await createAgentEngineScriptEntries(options?.appId);
             const loopSettingsScripts = await createAgentLoopSettingsScriptEntries();
-            const chatScripts = {
-                ...(await createChatScriptEntries()),
-                ...engineScripts,
-                ...loopSettingsScripts,
-            };
-            const callAgentScript = await createCallAgentScriptEntry(options?.appId);
+            // `httpActions` spreads engineScripts/loopSettingsScripts directly, so
+            // gating here removes them from the agent's tools without unmounting the
+            // routes the settings UI calls.
+            const chatScripts = frameworkTools.isEnabled("chat")
+                ? {
+                    ...(await createChatScriptEntries()),
+                    ...engineScripts,
+                    ...loopSettingsScripts,
+                }
+                : {};
+            // Both `call-agent` and `describe-workspace-apps` come from this factory.
+            const callAgentScript = frameworkTools.isEnabled("workspaceApps")
+                ? await createCallAgentScriptEntry(options?.appId)
+                : {};
             let runNowSchedulerDeps = null;
             const browserTools = createBuilderBrowserTool({
                 getOrigin: () => getRequestRunContext()?.requestOrigin ?? "http://localhost:3000",
@@ -582,7 +608,13 @@ export function createAgentChatPlugin(options) {
             // surface, prompt, MCP/A2A list, and job/trigger runner below. The full
             // `*All` sets are reserved for `httpActions`, which keeps agent-hidden
             // actions reachable from the frontend / HTTP.
-            const templateScripts = filterAgentTools(templateScriptsAll);
+            //
+            // The framework's own action kits (sharing, review, history, flags, …)
+            // arrive in this same registry through `autoDiscoverActions`, tagged with
+            // `frameworkGroup`. Subtracting disabled groups HERE is what removes them
+            // from every downstream agent surface at once; `httpActions` re-merges
+            // them ungated, so the share dialog and review threads keep their routes.
+            const templateScripts = filterFrameworkToolGroups(filterAgentTools(templateScriptsAll), disabledFrameworkGroups);
             // Compact is the safe default for every app, including generated and
             // third-party apps that have not curated a starter list yet. Keep the
             // app's own action surface immediately callable; framework, provider,
@@ -592,7 +624,7 @@ export function createAgentChatPlugin(options) {
             // (below, after the run-code tools are built) additionally folds in
             // whatever `generateCorpusToolsPrompt` teaches by name for this request.
             const templateInitialToolNames = resolveInitialToolNames(templateScripts, options?.initialToolNames);
-            const discoveredActions = filterAgentTools(discoveredActionsAll);
+            const discoveredActions = filterFrameworkToolGroups(filterAgentTools(discoveredActionsAll), disabledFrameworkGroups);
             // Per-request owner is read from the AsyncLocalStorage run context
             // (populated by prepareRun). Module-scope `let` would race across
             // concurrent requests on a long-lived Node process — overlapping
@@ -628,22 +660,29 @@ export function createAgentChatPlugin(options) {
             // Automation tools + fetch tool — depend on owner via callback.
             // Each callback short-circuits with a clear error when the run context
             // has no authenticated owner (see SECURITY note on getCurrentRunOwner).
+            const automationGroupEnabled = frameworkTools.isEnabled("automation");
             let automationTools = {};
             try {
-                const { createAutomationToolEntries } = await import("../triggers/actions.js");
-                automationTools = createAutomationToolEntries(() => requireCurrentRunOwner("manage automations"));
+                if (automationGroupEnabled) {
+                    const { createAutomationToolEntries } = await import("../triggers/actions.js");
+                    automationTools = createAutomationToolEntries(() => requireCurrentRunOwner("manage automations"));
+                }
             }
             catch { }
             let notificationTools = {};
             try {
-                const { createNotificationToolEntries } = await import("../notifications/actions.js");
-                notificationTools = createNotificationToolEntries(() => requireCurrentRunOwner("manage notifications"));
+                if (automationGroupEnabled) {
+                    const { createNotificationToolEntries } = await import("../notifications/actions.js");
+                    notificationTools = createNotificationToolEntries(() => requireCurrentRunOwner("manage notifications"));
+                }
             }
             catch { }
             let progressTools = {};
             try {
-                const { createProgressToolEntries } = await import("../progress/actions.js");
-                progressTools = createProgressToolEntries(() => requireCurrentRunOwner("manage progress"));
+                if (automationGroupEnabled) {
+                    const { createProgressToolEntries } = await import("../progress/actions.js");
+                    progressTools = createProgressToolEntries(() => requireCurrentRunOwner("manage progress"));
+                }
             }
             catch { }
             let githubRepoTools = {};
@@ -661,48 +700,53 @@ export function createAgentChatPlugin(options) {
                 });
             }
             catch { }
+            const webGroupEnabled = frameworkTools.isEnabled("web");
             let fetchTool = {};
             try {
-                const { createFetchToolEntry } = await import("../extensions/fetch-tool.js");
-                // Resolve `${keys.NAME}` through the same request-scope cascade
-                // already used by extension fetches (extensions/routes.ts) and
-                // automation connector headers (automation/index.ts): user scope
-                // first (personal overrides win), then the active org scope (the
-                // Dispatch vault syncs workspace secrets here), then workspace
-                // scope. Org/workspace vault rows are write-gated (org-admin +
-                // Dispatch vault UI), so this is safe to read by default — unlike
-                // the opt-in-only user→workspace fallback in resolveKeyReferences
-                // (see audit 05 H2 in secrets/substitution.ts), which stays off.
-                // Previously this tool only looked at scope "user", so a
-                // ${keys.NAME} reference to a key synced into the org/workspace
-                // vault could never resolve here even though the same key already
-                // worked for extension fetches and automations.
-                const { resolveKeyReferencesWithRequestScopes, validateUrlAllowlist, getKeyAllowlist, getResolvedKeyAllowlist, } = await import("../secrets/substitution.js");
-                fetchTool = createFetchToolEntry({
-                    resolveKeys: async (text) => resolveKeyReferencesWithRequestScopes(text, requireCurrentRunOwner("resolve key references")),
-                    validateUrl: async (url, usedKeys, resolvedKeys) => {
-                        for (const keyName of usedKeys) {
-                            const allowlist = await resolveFetchToolKeyAllowlist(keyName, resolvedKeys, requireCurrentRunOwner("validate URL allowlist"), { getKeyAllowlist, getResolvedKeyAllowlist });
-                            if (allowlist && !validateUrlAllowlist(url, allowlist)) {
-                                return false;
+                if (webGroupEnabled) {
+                    const { createFetchToolEntry } = await import("../extensions/fetch-tool.js");
+                    // Resolve `${keys.NAME}` through the same request-scope cascade
+                    // already used by extension fetches (extensions/routes.ts) and
+                    // automation connector headers (automation/index.ts): user scope
+                    // first (personal overrides win), then the active org scope (the
+                    // Dispatch vault syncs workspace secrets here), then workspace
+                    // scope. Org/workspace vault rows are write-gated (org-admin +
+                    // Dispatch vault UI), so this is safe to read by default — unlike
+                    // the opt-in-only user→workspace fallback in resolveKeyReferences
+                    // (see audit 05 H2 in secrets/substitution.ts), which stays off.
+                    // Previously this tool only looked at scope "user", so a
+                    // ${keys.NAME} reference to a key synced into the org/workspace
+                    // vault could never resolve here even though the same key already
+                    // worked for extension fetches and automations.
+                    const { resolveKeyReferencesWithRequestScopes, validateUrlAllowlist, getKeyAllowlist, getResolvedKeyAllowlist, } = await import("../secrets/substitution.js");
+                    fetchTool = createFetchToolEntry({
+                        resolveKeys: async (text) => resolveKeyReferencesWithRequestScopes(text, requireCurrentRunOwner("resolve key references")),
+                        validateUrl: async (url, usedKeys, resolvedKeys) => {
+                            for (const keyName of usedKeys) {
+                                const allowlist = await resolveFetchToolKeyAllowlist(keyName, resolvedKeys, requireCurrentRunOwner("validate URL allowlist"), { getKeyAllowlist, getResolvedKeyAllowlist });
+                                if (allowlist && !validateUrlAllowlist(url, allowlist)) {
+                                    return false;
+                                }
                             }
-                        }
-                        return true;
-                    },
-                });
+                            return true;
+                        },
+                    });
+                }
             }
             catch { }
             let webSearchTool = {};
             try {
-                const { createWebSearchToolEntry } = await import("../extensions/web-search-tool.js");
-                const { getBuilderWebSearchBaseUrl, resolveBuilderCredentials, resolveSecret, } = await import("./credential-provider.js");
-                const { getBuilderGatewayRequestHeaders } = await import("../agent/engine/builder-gateway-headers.js");
-                webSearchTool = createWebSearchToolEntry({
-                    resolveSecret,
-                    resolveBuilderCredentials,
-                    getBuilderWebSearchBaseUrl,
-                    getBuilderRequestHeaders: getBuilderGatewayRequestHeaders,
-                });
+                if (webGroupEnabled) {
+                    const { createWebSearchToolEntry } = await import("../extensions/web-search-tool.js");
+                    const { getBuilderWebSearchBaseUrl, resolveBuilderCredentials, resolveSecret, } = await import("./credential-provider.js");
+                    const { getBuilderGatewayRequestHeaders } = await import("../agent/engine/builder-gateway-headers.js");
+                    webSearchTool = createWebSearchToolEntry({
+                        resolveSecret,
+                        resolveBuilderCredentials,
+                        getBuilderWebSearchBaseUrl,
+                        getBuilderRequestHeaders: getBuilderGatewayRequestHeaders,
+                    });
+                }
             }
             catch { }
             let workspaceFilesTool = {};
@@ -752,11 +796,13 @@ export function createAgentChatPlugin(options) {
             let coreEmailTools = {};
             let backgroundCoreEmailTools = {};
             try {
-                const { createCoreEmailActionEntries } = await import("./email-actions.js");
-                coreEmailTools = createCoreEmailActionEntries();
-                backgroundCoreEmailTools = createCoreEmailActionEntries({
-                    unattended: true,
-                });
+                if (frameworkTools.isEnabled("email")) {
+                    const { createCoreEmailActionEntries } = await import("./email-actions.js");
+                    coreEmailTools = createCoreEmailActionEntries();
+                    backgroundCoreEmailTools = createCoreEmailActionEntries({
+                        unattended: true,
+                    });
+                }
             }
             catch { }
             // Core read-attachment tool — always registered so the agent can page
@@ -1233,7 +1279,7 @@ export function createAgentChatPlugin(options) {
                     const devActive = isDevMode();
                     // Build the same system prompt the interactive agent uses
                     const owner = userEmail;
-                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                     const schemaBlock = lazyContext
                         ? ""
                         : await buildSchemaBlock(owner, databaseToolsMode);
@@ -1701,7 +1747,7 @@ export function createAgentChatPlugin(options) {
                         // catalog on its very first request, undermining the compact MCP
                         // catalog this surface is supposed to keep external callers on.
                         const mcpToolSurface = createA2AEngineToolSurface(actionsToEngineTools(mcpActions), effectiveInitialToolNames);
-                        const resources = await loadResourcesForPrompt(SHARED_OWNER, lazyContext, options?.appId);
+                        const resources = await loadResourcesForPrompt(SHARED_OWNER, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                         const schemaBlock = lazyContext
                             ? ""
                             : await buildSchemaBlock(SHARED_OWNER, databaseToolsMode);
@@ -2156,8 +2202,10 @@ export function createAgentChatPlugin(options) {
             // Job management tool (manage-jobs)
             let jobTools = {};
             try {
-                const { createJobTools } = await import("../jobs/tools.js");
-                jobTools = createJobTools();
+                if (automationGroupEnabled) {
+                    const { createJobTools } = await import("../jobs/tools.js");
+                    jobTools = createJobTools();
+                }
             }
             catch { }
             // Lean mode: only template actions + essential framework tools. Drop
@@ -2487,7 +2535,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             modelOverlay +
                             runtimeContext);
                     }
-                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                    const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                     // In lazy context mode, skip embedding the full schema. When database
                     // tools are enabled the agent can call `db-schema` on demand.
                     const schemaBlock = lazyContext
@@ -2720,7 +2768,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                             });
                             return setSystemPromptOnContext(leanBasePrompt + extra + modelOverlay + runtimeContext);
                         }
-                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                         const schemaBlock = lazyContext || !databaseToolsEnabled
                             ? ""
                             : await buildSchemaBlock(owner, databaseToolsMode);
@@ -4696,7 +4744,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                 const schedulerDeps = {
                     getActions: getBackgroundActionEntries,
                     getSystemPrompt: async (owner) => {
-                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                        const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                         const schemaBlock = lazyContext
                             ? ""
                             : await buildSchemaBlock(owner, databaseToolsMode);
@@ -4712,8 +4760,11 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     // fetchTool/webSearchTool/toolActions catalog every tick.
                     getInitialToolNames: (job) => [
                         ...effectiveInitialToolNames,
-                        "manage-jobs",
-                        "manage-progress",
+                        // Only promotable while the group that supplies them is on; with
+                        // `automation` off the prompt no longer names them either.
+                        ...(automationGroupEnabled
+                            ? ["manage-jobs", "manage-progress"]
+                            : []),
                         ...(job?.meta.mcpTools ?? []),
                     ],
                     apiKey: options?.apiKey,
@@ -5073,7 +5124,7 @@ Non-code requests are still fine on this surface: read data, navigate the UI, su
                     await initTriggerDispatcher({
                         getActions: getBackgroundActionEntries,
                         getSystemPrompt: async (owner) => {
-                            const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId);
+                            const resources = await loadResourcesForPrompt(owner, lazyContext, options?.appId, undefined, { disabledFrameworkGroups });
                             const schemaBlock = lazyContext
                                 ? ""
                                 : await buildSchemaBlock(owner, databaseToolsMode);

package/dist/server/prompts/framework-core-compact.d.ts

@@ -8,11 +8,16 @@
  *   - Detailed "Parallel Tool Calls" prose (replaced with one-liner)
  *   - Detailed "Resources" section (agent uses resources tool)
  */
+import { type FrameworkToolGroup } from "../../framework-tools.js";
 import { type DatabaseToolsOption } from "../../scripts/db/tool-mode.js";
 import { type PromptExamples } from "./shared-rules.js";
 export interface FrameworkCoreCompactPromptOptions {
     databaseTools?: DatabaseToolsOption;
     extensionTools?: boolean;
+    /** Framework tool groups this app switched off. Every block below that names
+     *  a group's tool by name is gated on this — a prompt naming an absent tool
+     *  makes the model call it, fail, and often report the capability as missing. */
+    disabledFrameworkGroups?: ReadonlySet<FrameworkToolGroup>;
 }
 /**
  * Build the compact FRAMEWORK_CORE prompt string.

package/dist/server/prompts/framework-core-compact.js

@@ -8,14 +8,37 @@
  *   - Detailed "Parallel Tool Calls" prose (replaced with one-liner)
  *   - Detailed "Resources" section (agent uses resources tool)
  */
+import { frameworkGroupEnabled, } from "../../framework-tools.js";
 import { hasDatabaseReadTools, hasDatabaseWriteTools, } from "../../scripts/db/tool-mode.js";
-import { sharedRule8, SHARED_RULE_9, SHARED_RULE_14, SHARED_RULE_15, SHARED_RULE_AGENT_WARNINGS, } from "./shared-rules.js";
+import { sharedRule8, SHARED_RULE_9, sharedRule14, SHARED_RULE_15, SHARED_RULE_AGENT_WARNINGS, } from "./shared-rules.js";
 /**
  * Build the compact FRAMEWORK_CORE prompt string.
  *
  * @param examples Optional injectable provider/action examples for rule 8.
  */
 export function buildFrameworkCoreCompact(examples, options) {
+    const groupOn = (group) => frameworkGroupEnabled(options?.disabledFrameworkGroups, group);
+    const resourcesSection = groupOn("resources")
+        ? `### Resources
+
+Use the \`resources\` tool for persistent notes and context files: \`action: "list"\`, \`"read"\`, \`"effective"\`, \`"write"\`, \`"promote"\`, or \`"delete"\`.
+Resources have three levels: workspace defaults inherited from Dispatch, shared organization/app overrides, and personal overrides. Use \`resources\` with \`action: "effective"\` before editing when you need to explain or inspect which level is active for a path.
+Workspace resources are user-facing by default. If you need temporary working files, write them as agent scratch (\`visibility: "agent_scratch"\`); scratch is hidden from the Workspace view by default and expires. Use \`visibility: "workspace"\` only when the user explicitly asked to save/manage that file, or for durable AGENTS.md, LEARNINGS.md, memory, skills, jobs, or custom agents.
+`
+        : "";
+    const extendedCapabilityClauses = [
+        "inline embeds",
+        groupOn("chat") ? "chat history search (`chat-history`)" : "",
+        groupOn("automation") ? "recurring jobs (`manage-jobs`)" : "",
+        "structured memory (`save-memory`/`delete-memory`)",
+        "browser automation (`activate-browser` in production, `set-browser-control` locally)",
+    ].filter(Boolean);
+    const extendedCapabilitiesList = `${extendedCapabilityClauses.slice(0, -1).join(", ")}, and ${extendedCapabilityClauses.at(-1)}`;
+    const callAgentSection = groupOn("workspaceApps")
+        ? `
+For generated media, prefer this app's native generation action; otherwise use \`call-agent\` with agent "assets".
+`
+        : "";
     const hasDatabaseTools = hasDatabaseReadTools(options?.databaseTools);
     const hasDatabaseWrites = hasDatabaseWriteTools(options?.databaseTools);
     const dataRule = hasDatabaseWrites
@@ -56,22 +79,15 @@ ${SHARED_RULE_9}
 **Native widgets** — For table/chart/graph/report requests, prefer actions labeled \`Native chat widget\`; use \`render-data-widget\` for already-summarized data (≤50 rows) instead of markdown tables. Above that, give the total plus the top rows — never retype a full result set as widget arguments. Deliver files in chat, never just a path.
 10. **Your tool list is not the whole surface** — Most app actions and connected MCP tools load on demand, so search the live registry with \`tool-search\` before concluding a capability doesn't exist.
 11. **Relative dates use runtime context** — The \`<runtime-context>\` block gives the authoritative current date/time. Resolve "today", "yesterday", "last week", and similar phrases to explicit calendar dates before querying data or creating artifacts.
-${SHARED_RULE_14}
+${sharedRule14(options)}
 ${SHARED_RULE_15}
 ${SHARED_RULE_AGENT_WARNINGS}
 
-### Resources
-
-Use the \`resources\` tool for persistent notes and context files: \`action: "list"\`, \`"read"\`, \`"effective"\`, \`"write"\`, \`"promote"\`, or \`"delete"\`.
-Resources have three levels: workspace defaults inherited from Dispatch, shared organization/app overrides, and personal overrides. Use \`resources\` with \`action: "effective"\` before editing when you need to explain or inspect which level is active for a path.
-Workspace resources are user-facing by default. If you need temporary working files, write them as agent scratch (\`visibility: "agent_scratch"\`); scratch is hidden from the Workspace view by default and expires. Use \`visibility: "workspace"\` only when the user explicitly asked to save/manage that file, or for durable AGENTS.md, LEARNINGS.md, memory, skills, jobs, or custom agents.
-
+${resourcesSection}
 ### Extended Capabilities
 
-You also have tools for inline embeds, chat history search (\`chat-history\`), recurring jobs (\`manage-jobs\`), structured memory (\`save-memory\`/\`delete-memory\`), and browser automation (\`activate-browser\` in production, \`set-browser-control\` locally). Call \`get-framework-context\` with the matching key — it lists its own topics — for full instructions when needed.
+You also have tools for ${extendedCapabilitiesList}. Call \`get-framework-context\` with the matching key — it lists its own topics — for full instructions when needed.
 
 **Agent teams:** default to doing the work yourself. Delegate ONE sub-agent (\`agent-teams\` action "spawn") for self-contained heavy work; fan out to several only for genuinely independent units; never parallelize tightly-coupled work; cap fan-out around 3. Treat "background agent", "sub-agent", "parallel", "batch", "kick off", "run the rest", and "queued items" as delegation intent when the user is asking you to start or continue independent work items. After \`spawn\`, say the task started/running, not completed; use \`status\`/\`read-result\` before claiming the delegated work is done. Give each sub-agent a self-contained brief (objective, the specific context/IDs it needs, output format, boundaries) — it can't see this thread — then read all results and synthesize one integrated answer. Full details: \`get-framework-context\` key \`agent-teams\`.
-
-For generated media, prefer this app's native generation action; otherwise use \`call-agent\` with agent "assets".
-`;
+${callAgentSection}`;
 }

package/dist/server/prompts/framework-core.d.ts

@@ -5,11 +5,16 @@
  * Shared rules (8-9, 12-13) are imported from shared-rules.ts so the
  * compact variant uses the same text and the two can never drift.
  */
+import { type FrameworkToolGroup } from "../../framework-tools.js";
 import { type DatabaseToolsOption } from "../../scripts/db/tool-mode.js";
 import { type PromptExamples } from "./shared-rules.js";
 export interface FrameworkCorePromptOptions {
     databaseTools?: DatabaseToolsOption;
     extensionTools?: boolean;
+    /** Framework tool groups this app switched off. Every block below that names
+     *  a group's tool by name is gated on this — a prompt naming an absent tool
+     *  makes the model call it, fail, and often report the capability as missing. */
+    disabledFrameworkGroups?: ReadonlySet<FrameworkToolGroup>;
 }
 /**
  * Build the full FRAMEWORK_CORE prompt string.

package/dist/server/prompts/framework-core.js

@@ -5,8 +5,9 @@
  * Shared rules (8-9, 12-13) are imported from shared-rules.ts so the
  * compact variant uses the same text and the two can never drift.
  */
+import { frameworkGroupEnabled, } from "../../framework-tools.js";
 import { hasDatabaseReadTools, hasDatabaseWriteTools, } from "../../scripts/db/tool-mode.js";
-import { sharedRule8, SHARED_RULE_9, SHARED_RULE_14, SHARED_RULE_15, SHARED_RULE_AGENT_WARNINGS, } from "./shared-rules.js";
+import { sharedRule8, SHARED_RULE_9, sharedRule14, SHARED_RULE_15, SHARED_RULE_AGENT_WARNINGS, } from "./shared-rules.js";
 /**
  * Build the full FRAMEWORK_CORE prompt string.
  *
@@ -40,6 +41,33 @@ export function buildFrameworkCore(examples, options) {
     const actionSurface = options?.extensionTools === true
         ? "this app's registered actions, extensions, and connected MCP tools"
         : "this app's registered actions and connected MCP tools";
+    const groupOn = (group) => frameworkGroupEnabled(options?.disabledFrameworkGroups, group);
+    const resourcesSection = groupOn("resources")
+        ? `### Resources
+
+You have access to a Resources system for persistent notes and context files.
+Use the \`resources\` tool to manage resources: \`action: "list"\`, \`"read"\`, \`"effective"\`, \`"write"\`, \`"promote"\`, or \`"delete"\`.
+Resources can be workspace defaults inherited from Dispatch, shared organization/app overrides, or personal overrides. By default, resources are personal. Workspace-scope resources are read-only from app agents; create shared or personal resources to override or narrow them.
+
+When the user gives instructions that should apply to all users/sessions, update the shared "AGENTS.md" resource.
+
+Workspace resources are user-facing by default. If you need temporary working files, use the \`resources\` tool with \`visibility: "agent_scratch"\`; scratch resources are hidden from the Workspace view by default and expire automatically. Use \`visibility: "workspace"\` only when the user explicitly asked to save/create/manage that file, or for durable control files such as \`AGENTS.md\`, \`LEARNINGS.md\`, \`memory/\`, \`skills/\`, \`jobs/\`, or \`agents/\`. If a scratch result becomes useful to the user, call \`resources\` with \`action: "promote"\` or rewrite it with \`visibility: "workspace"\`.
+`
+        : "";
+    const extendedCapabilityClauses = [
+        "inline embeds (`embed` fenced code block)",
+        groupOn("chat") ? "chat history search (`chat-history`)" : "",
+        groupOn("automation") ? "recurring jobs (`manage-jobs`)" : "",
+        "connecting Builder.io (`connect-builder`)",
+        "browser automation (`set-browser-control`/`activate-browser`)",
+        "structured memory (`save-memory`/`delete-memory`)",
+    ].filter(Boolean);
+    const extendedCapabilitiesList = `${extendedCapabilityClauses.slice(0, -1).join(", ")}, and ${extendedCapabilityClauses.at(-1)}`;
+    const callAgentSection = groupOn("workspaceApps")
+        ? `
+**call-agent** messages a DIFFERENT deployed app's agent over A2A — never use it for your own actions or to call yourself. For brand-consistent generated media when this app has no native generation action, call agent "assets".
+`
+        : "";
     return `
 ### How You Work
 
@@ -78,7 +106,7 @@ ${SHARED_RULE_9}
 **Downloadable files** — When the user asks you to create or export a file, deliver it in the same chat turn. For compact tabular results, prefer \`render-data-widget\` so the user gets the native Download CSV action without a second stored copy. For a complete or durable file written through \`workspaceWrite\`, use a normal non-\`scratch/\` path and then call \`show-workspace-file\` with that path so chat renders a direct download card. Never finish by giving filesystem paths or telling the user to navigate elsewhere to find the file.
 10. **Your tool list is not the whole surface** — Most app actions and connected MCP tools load on demand, so search the live registry with \`tool-search\` before concluding a capability doesn't exist.
 11. **Relative dates use runtime context** — The \`<runtime-context>\` block gives the authoritative current date/time. Resolve "today", "yesterday", "last week", and similar phrases to explicit calendar dates before querying data or creating artifacts. When answering factual questions, include the exact date or date range you used.
-${SHARED_RULE_14}
+${sharedRule14(options)}
 ${SHARED_RULE_15}
 ${SHARED_RULE_AGENT_WARNINGS}
 
@@ -86,22 +114,11 @@ ${SHARED_RULE_AGENT_WARNINGS}
 
 Gather context efficiently: when you need several independent read-only lookups (reading state, querying different tables, searching, fetching unrelated records), issue those tool calls together in one batch rather than one at a time. Keep mutating actions ordered and sequential — anything that creates, updates, deletes, sends, or publishes runs one at a time so each can be confirmed before the next, and so writes that depend on each other stay consistent.
 
-### Resources
-
-You have access to a Resources system for persistent notes and context files.
-Use the \`resources\` tool to manage resources: \`action: "list"\`, \`"read"\`, \`"effective"\`, \`"write"\`, \`"promote"\`, or \`"delete"\`.
-Resources can be workspace defaults inherited from Dispatch, shared organization/app overrides, or personal overrides. By default, resources are personal. Workspace-scope resources are read-only from app agents; create shared or personal resources to override or narrow them.
-
-When the user gives instructions that should apply to all users/sessions, update the shared "AGENTS.md" resource.
-
-Workspace resources are user-facing by default. If you need temporary working files, use the \`resources\` tool with \`visibility: "agent_scratch"\`; scratch resources are hidden from the Workspace view by default and expire automatically. Use \`visibility: "workspace"\` only when the user explicitly asked to save/create/manage that file, or for durable control files such as \`AGENTS.md\`, \`LEARNINGS.md\`, \`memory/\`, \`skills/\`, \`jobs/\`, or \`agents/\`. If a scratch result becomes useful to the user, call \`resources\` with \`action: "promote"\` or rewrite it with \`visibility: "workspace"\`.
-
+${resourcesSection}
 ### Extended Capabilities
 
-You also have tools for inline embeds (\`embed\` fenced code block), chat history search (\`chat-history\`), recurring jobs (\`manage-jobs\`), connecting Builder.io (\`connect-builder\`), browser automation (\`set-browser-control\`/\`activate-browser\`), and structured memory (\`save-memory\`/\`delete-memory\`). Call \`get-framework-context\` with the matching key — it lists its own topics — for full instructions before non-trivial work in any of these areas.
+You also have tools for ${extendedCapabilitiesList}. Call \`get-framework-context\` with the matching key — it lists its own topics — for full instructions before non-trivial work in any of these areas.
 
 **Agent teams:** default to doing the work yourself in this thread, but treat "background agent", "sub-agent", "parallel", "batch", "kick off", "run the rest", and "queued items" as delegation intent when the user is asking you to start or continue independent work items. Delegate ONE sub-agent for self-contained heavy work (deep research, long multi-step generation, noisy scans); fan out to MULTIPLE only for genuinely independent units; never parallelize tightly-coupled work; cap fan-out around 3. After \`spawn\`, say the task started/running, not completed; use \`status\`/\`read-result\` before claiming delegated work is done. Give every sub-agent a self-contained brief (objective, the specific context/IDs it needs, output format, boundaries), then read all results and synthesize one integrated answer. Full details: \`get-framework-context\` key \`agent-teams\`.
-
-**call-agent** messages a DIFFERENT deployed app's agent over A2A — never use it for your own actions or to call yourself. For brand-consistent generated media when this app has no native generation action, call agent "assets".
-`;
+${callAgentSection}`;
 }

package/dist/server/prompts/index.d.ts

@@ -4,5 +4,5 @@
  */
 export { buildFrameworkCore } from "./framework-core.js";
 export { buildFrameworkCoreCompact } from "./framework-core-compact.js";
-export { sharedRule8, SHARED_RULE_9, SHARED_RULE_14, SHARED_RULE_15, type PromptExamples, } from "./shared-rules.js";
+export { sharedRule8, SHARED_RULE_9, sharedRule14, SHARED_RULE_15, type PromptExamples, type SharedRuleOptions, } from "./shared-rules.js";
 export { getModelFamilyOverlay } from "./model-overlays.js";

package/dist/server/prompts/index.js

@@ -4,5 +4,5 @@
  */
 export { buildFrameworkCore } from "./framework-core.js";
 export { buildFrameworkCoreCompact } from "./framework-core-compact.js";
-export { sharedRule8, SHARED_RULE_9, SHARED_RULE_14, SHARED_RULE_15, } from "./shared-rules.js";
+export { sharedRule8, SHARED_RULE_9, sharedRule14, SHARED_RULE_15, } from "./shared-rules.js";
 export { getModelFamilyOverlay } from "./model-overlays.js";

package/dist/server/prompts/shared-rules.d.ts

@@ -7,6 +7,7 @@
  * rule) and 12–13 (planning discipline; collaborate through uncertainty) are
  * reproduced verbatim in both prompts — keep them here.
  */
+import { type FrameworkToolGroup } from "../../framework-tools.js";
 import { type DatabaseToolsOption } from "../../scripts/db/tool-mode.js";
 /**
  * Injectable provider/action examples. Defaults are generic; templates that
@@ -21,6 +22,9 @@ export interface PromptExamples {
 export interface SharedRuleOptions {
     databaseTools?: DatabaseToolsOption;
     extensionTools?: boolean;
+    /** Framework tool groups this app switched off. Any rule naming a group's
+     *  tool must drop that reference — see `frameworkGroupEnabled`. */
+    disabledFrameworkGroups?: ReadonlySet<FrameworkToolGroup>;
 }
 /** Rule 8 — db-* tools are internal only (shared between full and compact). */
 export declare function sharedRule8(examples?: PromptExamples, options?: SharedRuleOptions): string;
@@ -34,14 +38,18 @@ export declare function sharedRule8(examples?: PromptExamples, options?: SharedR
  */
 export declare const SHARED_RULE_9 = "9. **Never fabricate \u2014 verify results, report failures honestly, and recover instead of giving up.**\n   - **Never fabricate factual claims or records** \u2014 do not invent numbers, metrics, records, query results, URLs, citations, source attributions, customer names, dates, or success rates. This applies inside generated artifacts too: decks, documents, reports, dashboards, Slack/email replies, and charts. Only state factual numbers/claims the user provided or you retrieved with an action/tool. If a data source is unavailable, returns no rows, is missing credentials, or has a connection error, say so clearly; do not create placeholder rows or fetch unrelated providers to look complete unless the user explicitly asked you to import/sync/backfill. Prefer qualitative wording, placeholders like `[metric TBD]`, or clearly labeled draft assumptions over plausible-looking facts \u2014 presenting made-up data as real is worse than admitting the limitation.\n   - **Never fabricate success from tool errors** \u2014 when a tool call returns an error (marked `isError: true`, contains \"Command failed\", \"Error:\", or non-zero exit output), the operation FAILED; do not synthesize a success narrative or describe what it \"would have\" produced. Report the failure verbatim (this applies especially to `bash(command=\"pnpm action ...\")` calls). Before telling the user a mutating action (create/update/delete/send/publish) is done, confirm it actually landed \u2014 check the tool result, or read the refreshed `<current-screen>` / re-query the data; having *called* an action is not proof it worked. If a result is ambiguous, check rather than assume.\n   - **Recover instead of giving up** \u2014 treat a failure or ambiguous result as a signal to retry the obvious fix, try an alternate tool or approach, or clearly hand the blocker back with what you tried; never silently give up, and never paper over a failure by claiming success.";
 /**
- * Rule 12 (const name retained as SHARED_RULE_14 for import stability) —
- * Planning and progress. Deliberately states only when to open a progress run;
- * the start/update/complete discipline lives in `manage-progress`'s own tool
+ * Rule 12 (name retained as `sharedRule14` for import stability) — Planning and
+ * progress. Deliberately states only when to open a progress run; the
+ * start/update/complete discipline lives in `manage-progress`'s own tool
  * description (packages/core/src/progress/actions.ts). Re-adding the mechanics
  * here means every turn pays for guidance the model only needs once it has the
  * tool loaded.
+ *
+ * Drops the `manage-progress` reference when the `automation` group is off, so
+ * the rule never names a tool the request does not carry. The planning
+ * discipline itself still applies — only the tool call goes away.
  */
-export declare const SHARED_RULE_14 = "12. **Plan and track multi-step work** \u2014 When a task spans several real steps the user would want to watch, open a `manage-progress` run so the work is visible while it's still in flight, and keep it updated as you go rather than after the fact; the tool's own description carries the full discipline. Skip it for single-action lookups, simple reads, and anything that finishes in one tool call \u2014 never create single-step plans.";
+export declare function sharedRule14(options?: SharedRuleOptions): string;
 /**
  * Rule 14 — Relay agent warnings. Named for what it is rather than its number,
  * since the `SHARED_RULE_14`/`15` names above no longer match theirs.