@agent-native/core 0.153.2 → 0.153.5

package/corpus/README.md

@@ -31,4 +31,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 
 ## Generated Counts
 
-- template files: 8185
+- template files: 8189

package/corpus/templates/analytics/AGENTS.md

@@ -48,6 +48,10 @@ Read the relevant skill before deeper work:
   sibling-invocable because this app owns schema, source selection, and tools.
   Prefer natural-language delegation; shaped reads are stable contracts, not
   delegation workarounds.
+- Analytics owns first-party product usage, app/template events, agent-native
+  signups, conversions, and other curated product metrics. Answer sibling-app
+  delegations with the built-in source and query catalog; sibling agents should
+  send a natural-language question, never SQL.
 - For open-ended delegated requests, choose a safe default and label partial.
 - Data integrity first. Never invent numbers, dimensions, filters, or source
   semantics; only present values you actually retrieved, and state uncertainty.

package/corpus/templates/analytics/actions/account-deep-dive.ts

@@ -414,6 +414,7 @@ export default defineAction({
   http: { method: "GET" },
   readOnly: true,
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  grounding: true,
   run: async (args) => {
     const trimmedQuery = args.query.trim();
     const gaps: string[] = [];

package/corpus/templates/analytics/actions/bigquery-query.ts

@@ -17,5 +17,6 @@ export default defineAction({
   http: { method: "POST" },
   readOnly: true,
   toolCallable: true,
+  grounding: true,
   run: bigquery.run,
 });

package/corpus/templates/analytics/actions/bigquery.ts

@@ -75,6 +75,7 @@ export default defineAction({
   }),
   readOnly: true,
   toolCallable: true,
+  grounding: true,
   run: async (args, context?: ActionRunContext) => {
     try {
       return await runQuery(args.sql, { signal: context?.signal });

package/corpus/templates/analytics/actions/content-calendar-schema.ts

@@ -11,6 +11,7 @@ export default defineAction({
   }),
   http: { method: "GET" },
   readOnly: true,
+  grounding: true,
   run: async ({ databaseId }) => {
     return await getContentCalendarSchema(databaseId);
   },

package/corpus/templates/analytics/actions/content-calendar.ts

@@ -18,6 +18,7 @@ export default defineAction({
       ),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async ({ databaseId }) => {
     const entries = await getContentCalendar(databaseId);
     return { entries, total: Array.isArray(entries) ? entries.length : 0 };

package/corpus/templates/analytics/actions/gcloud.ts

@@ -56,6 +56,7 @@ export default defineAction({
       .describe("Additional Cloud Monitoring filter expression"),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async (args) => {
     const credentials = await requireActionCredentials(
       ["BIGQUERY_PROJECT_ID", "GOOGLE_APPLICATION_CREDENTIALS_JSON"],

package/corpus/templates/analytics/actions/get-data-program.ts

@@ -22,6 +22,7 @@ export default defineAction({
   }),
   http: { method: "GET" },
   readOnly: true,
+  grounding: true,
   run: async (args) => {
     const ctx = getCredentialContext();
     if (!ctx) throw new Error("No authenticated context for get-data-program.");

package/corpus/templates/analytics/actions/get-error-issue.ts

@@ -29,6 +29,7 @@ export default defineAction({
   http: { method: "GET" },
   readOnly: true,
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  grounding: true,
   run: async (args) => {
     return getErrorIssue(resolveScope(), args.id, {
       eventsLimit: args.eventsLimit,

package/corpus/templates/analytics/actions/get-monitor-stats.ts

@@ -37,6 +37,7 @@ export default defineAction({
       ),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async ({ monitorIds, timelineDays, responseWindowHours }) => {
     const email = getRequestUserEmail();
     if (!email) throw new Error("no authenticated user");

package/corpus/templates/analytics/actions/get-monitor.ts

@@ -14,6 +14,7 @@ export default defineAction({
     id: z.string().describe("Monitor id."),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async ({ id }) => {
     const email = getRequestUserEmail();
     if (!email) throw new Error("no authenticated user");

package/corpus/templates/analytics/actions/get-session-replay-events.ts

@@ -40,6 +40,7 @@ export default defineAction({
   }),
   http: { method: "GET" },
   readOnly: true,
+  grounding: true,
   run: async (args) => {
     return getSessionReplayEvents(args.recordingId, resolveScope(), {
       startSeq: args.startSeq,

package/corpus/templates/analytics/actions/get-session-replay-summary.ts

@@ -22,6 +22,7 @@ export default defineAction({
   http: { method: "GET" },
   readOnly: true,
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  grounding: true,
   run: async (args) => {
     return getSessionReplaySummary(args.recordingId, resolveScope());
   },

package/corpus/templates/analytics/actions/get-session-replay-timeline.ts

@@ -32,6 +32,7 @@ export default defineAction({
   http: { method: "GET" },
   readOnly: true,
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  grounding: true,
   run: async (args) => {
     return getSessionReplayTimeline(args.recordingId, resolveScope(), {
       eventLimit: args.eventLimit,

package/corpus/templates/analytics/actions/gong-calls.ts

@@ -583,6 +583,7 @@ export default defineAction({
       ),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async (args, ctx) => {
     const requestOptions = ctx?.signal ? { signal: ctx.signal } : undefined;
     if (args.users) {

package/corpus/templates/analytics/actions/gong-native-insights.ts

@@ -66,6 +66,7 @@ export default defineAction({
     Boolean(operation && allowCreditRequest),
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
   http: false,
+  grounding: true,
   run: async ({ operation, allowCreditRequest, arguments: args }) => {
     const tools = gongNativeTools(await listVisibleMcpTools());
     if (!operation) {

package/corpus/templates/analytics/actions/grafana.ts

@@ -36,6 +36,7 @@ export default defineAction({
     to: z.string().optional().describe("Query end time in epoch ms"),
   }),
   readOnly: true,
+  grounding: true,
   run: async (args) => {
     const credentials = await requireActionCredentials(
       ["GRAFANA_URL", "GRAFANA_API_TOKEN"],

package/corpus/templates/analytics/actions/hubspot-deals.ts

@@ -494,6 +494,7 @@ export default defineAction({
   }),
   http: { method: "GET" },
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  grounding: true,
   run: async ({
     properties,
     owner,

package/corpus/templates/analytics/actions/hubspot-metrics.ts

@@ -15,6 +15,7 @@ export default defineAction({
     "Get computed HubSpot sales metrics: win rate, ACV, pipeline value, etc.",
   schema: z.object({}),
   http: { method: "GET" },
+  grounding: true,
   run: async () => {
     const [deals, pipelines] = await Promise.all([
       getAllDeals(),

package/corpus/templates/analytics/actions/hubspot-pipelines.ts

@@ -10,6 +10,7 @@ export default defineAction({
   description: "Get HubSpot deal pipelines and their stages.",
   schema: z.object({}),
   http: { method: "GET" },
+  grounding: true,
   run: async () => {
     const allPipelines = await getDealPipelines();
     const pipelines = getVisiblePipelines(allPipelines);

package/corpus/templates/analytics/actions/hubspot-records.ts

@@ -49,6 +49,7 @@ export default defineAction({
   }),
   http: { method: "GET" },
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  grounding: true,
   run: async ({ objectType, query, properties, limit, after }) => {
     const result = await searchHubSpotObjects({
       objectType,

package/corpus/templates/analytics/actions/jira-search.ts

@@ -25,6 +25,7 @@ export default defineAction({
       .describe("Comma-separated field names to include"),
   }),
   http: false,
+  grounding: true,
   run: async (args) => {
     const credentials = await requireActionCredentials(
       ["JIRA_BASE_URL", "JIRA_USER_EMAIL", "JIRA_API_TOKEN"],

package/corpus/templates/analytics/actions/jira.ts

@@ -66,6 +66,7 @@ export default defineAction({
       .describe("Lookback days for mode=analytics"),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async (args) => {
     const credentials = await requireActionCredentials(
       ["JIRA_BASE_URL", "JIRA_USER_EMAIL", "JIRA_API_TOKEN"],

package/corpus/templates/analytics/actions/list-error-issues.ts

@@ -47,6 +47,7 @@ export default defineAction({
   http: { method: "GET" },
   readOnly: true,
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  grounding: true,
   run: async (args) => {
     return listErrorIssues(resolveScope(), args);
   },

package/corpus/templates/analytics/actions/list-monitors.ts

@@ -12,6 +12,7 @@ export default defineAction({
     "List the current user's uptime monitors with their latest status, latency, and 24h/7d uptime percentage.",
   schema: z.object({}),
   http: { method: "GET" },
+  grounding: true,
   run: async () => {
     const email = getRequestUserEmail();
     if (!email) throw new Error("no authenticated user");

package/corpus/templates/analytics/actions/list-session-recordings.ts

@@ -59,6 +59,7 @@ export default defineAction({
   http: { method: "GET" },
   readOnly: true,
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  grounding: true,
   run: async (args) => {
     return listSessionRecordings(resolveScope(), args);
   },

package/corpus/templates/analytics/actions/match-error-issues.ts

@@ -45,6 +45,7 @@ export default defineAction({
   }),
   http: { method: "POST" },
   readOnly: true,
+  grounding: true,
   run: async (args) => {
     return matchErrorIssuesBySignatures(resolveScope(), args.signatures);
   },

package/corpus/templates/analytics/actions/prometheus.ts

@@ -52,6 +52,7 @@ export default defineAction({
     metric: z.string().optional().describe("Metric name for mode=metadata"),
   }),
   readOnly: true,
+  grounding: true,
   run: async (args) => {
     const creds = await requireActionCredentials(
       ["PROMETHEUS_URL"],

package/corpus/templates/analytics/actions/pylon-issues.ts

@@ -27,6 +27,7 @@ export default defineAction({
   agentTool: false,
   toolCallable: true,
   http: { method: "POST" },
+  grounding: true,
   run: async ({ account, accounts, query, days, pageSize, maxPages }) => {
     if (accounts) {
       const response = (await executeProviderApiRequest({

package/corpus/templates/analytics/actions/query-agent-native-analytics.ts

@@ -69,6 +69,7 @@ export default defineAction({
   // natural-language question and Analytics forms the query.
   http: false,
   publicAgent: { expose: true, readOnly: true, requiresAuth: true },
+  grounding: true,
   run: async (args) => {
     const result = await queryFirstPartyAnalytics(args.sql, resolveScope(), {
       cache: true,

package/corpus/templates/analytics/actions/query-dashboard-panel.ts

@@ -18,6 +18,7 @@ export default defineAction({
   http: { method: "POST" },
   readOnly: true,
   agentTool: false,
+  grounding: true,
   run: async (args) => {
     const context = getCredentialContext();
     if (!context) {

package/corpus/templates/analytics/actions/query-inbound-forms.ts

@@ -8,6 +8,7 @@ export default defineAction({
     "Query inbound sales/demo form submissions from a configured warehouse form-submissions table.",
   schema: z.object({}),
   http: false,
+  grounding: true,
   run: async () => {
     const sql = `
 SELECT

package/corpus/templates/analytics/actions/run-monitor-check.ts

@@ -14,6 +14,7 @@ export default defineAction({
     id: z.string().describe("Monitor id to check now."),
   }),
   http: { method: "POST" },
+  grounding: true,
   run: async ({ id }) => {
     const email = getRequestUserEmail();
     if (!email) throw new Error("no authenticated user");

package/corpus/templates/analytics/actions/sentry.ts

@@ -44,6 +44,7 @@ export default defineAction({
       .describe("Sentry stats category for mode=stats; defaults to error"),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async (args) => {
     const credentials = await requireActionCredentials(
       ["SENTRY_SERVER_TOKEN", "SENTRY_AUTH_TOKEN"],

package/corpus/templates/analytics/actions/seo-blog-pages.ts

@@ -10,6 +10,7 @@ export default defineAction({
   description: "Get SEO metrics for all blog pages.",
   schema: z.object({}),
   http: { method: "GET" },
+  grounding: true,
   run: async () => {
     const pages = await getAllBlogPagesSeo();
     return { pages, total: Object.keys(pages).length };

package/corpus/templates/analytics/actions/seo-page-keywords.ts

@@ -15,6 +15,7 @@ export default defineAction({
       .describe("Blog page slug (e.g. micro-frontends)"),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async (args) => {
     if (!args.slug) return { error: "slug is required" };
     const keywords = await getRankedKeywordsForPage(args.slug, 20);

package/corpus/templates/analytics/actions/seo-top-keywords.ts

@@ -16,6 +16,7 @@ export default defineAction({
       .describe("Max keywords to return (default 500)"),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async (args) => {
     const limit = Math.min(args.limit ?? 500, 1000);
     const keywords = await getAllTopBlogKeywords(limit);

package/corpus/templates/analytics/actions/slack-messages.ts

@@ -77,6 +77,7 @@ export default defineAction({
       .describe("Per-channel cursors for mode=multi-history"),
   }),
   readOnly: true,
+  grounding: true,
   run: async (args) => {
     const workspace = parseWorkspace(args.workspace);
     const key =

package/corpus/templates/analytics/actions/stripe.ts

@@ -74,6 +74,7 @@ export default defineAction({
       .describe("Months of billing history"),
   }),
   http: { method: "GET" },
+  grounding: true,
   run: async (args) => {
     const credentials = await requireActionCredentials(
       ["STRIPE_SECRET_KEY"],

package/corpus/templates/analytics/actions/test-custom-api-connection.ts

@@ -30,6 +30,7 @@ export default defineAction({
   agentTool: false,
   http: { method: "POST" },
   readOnly: true,
+  grounding: true,
   run: async ({ provider, path, query, itemsPath }) => {
     try {
       const result = (await getAnalyticsProviderApiRuntime().executeRequest({

package/corpus/templates/analytics/server/lib/real-data-actions.ts

@@ -13,45 +13,6 @@ const INJECTED_CONTEXT_BLOCKS = [
   "response-guard",
 ];
 
-export const DATA_QUERY_ACTIONS = new Set([
-  "account-deep-dive",
-  "bigquery",
-  "content-calendar",
-  "content-calendar-schema",
-  // First-party observability reads are grounded data for incident triage,
-  // even though they are not provider queries. Keep the final-response guard
-  // from replacing valid session/error/replay evidence with the generic
-  // "connect a source" fallback.
-  "get-error-issue",
-  "get-session-replay-events",
-  "get-session-replay-summary",
-  "get-session-replay-timeline",
-  "list-error-issues",
-  "list-session-recordings",
-  "match-error-issues",
-  "gcloud",
-  "gong-calls",
-  "gong-native-insights",
-  "grafana",
-  "hubspot-deals",
-  "hubspot-metrics",
-  "hubspot-pipelines",
-  "hubspot-records",
-  "jira",
-  "jira-search",
-  "provider-api-request",
-  "provider-corpus-job",
-  "query-staged-dataset",
-  "query-agent-native-analytics",
-  "query-inbound-forms",
-  "sentry",
-  "seo-blog-pages",
-  "seo-page-keywords",
-  "seo-top-keywords",
-  "slack-messages",
-  "stripe",
-]);
-
 export const CORPUS_SOURCE_ACTIONS = new Set([
   "provider-api-request",
   "provider-corpus-job",
@@ -127,8 +88,39 @@ function isToolName(name: string, expected: string): boolean {
   return normalizeActionToolName(name) === expected;
 }
 
-function isDataQueryActionName(name: string): boolean {
-  return DATA_QUERY_ACTIONS.has(normalizeActionToolName(name));
+let groundingActionNames: ReadonlySet<string> | null = null;
+
+/**
+ * Publish the action names whose definitions declare `grounding: true`.
+ *
+ * The set is pushed in rather than read from `.generated/actions-registry`
+ * because that registry imports every action, and `save-analysis` imports this
+ * module — importing it back here would close an evaluation cycle. The
+ * agent-chat plugin derives the set once at module load; nothing else may.
+ */
+export function registerGroundingActions(names: Iterable<string>): void {
+  const normalized = new Set(
+    [...names].map((name) => normalizeActionToolName(name)),
+  );
+  // An empty set is never a real deployment: it means the installed core build
+  // predates `grounding` and dropped it from every definition. Left unchecked,
+  // the guard would replace every correct grounded answer with "connect data
+  // sources" — the exact silent failure this flag replaced.
+  if (normalized.size === 0) {
+    throw new Error(
+      "no action declares grounding: true; the installed @agent-native/core cannot carry the flag",
+    );
+  }
+  groundingActionNames = normalized;
+}
+
+function isGroundingActionName(name: string): boolean {
+  if (!groundingActionNames) {
+    throw new Error(
+      "grounding actions were never registered: the analytics response guard cannot tell a grounded turn from an ungrounded one",
+    );
+  }
+  return groundingActionNames.has(normalizeActionToolName(name));
 }
 
 function isDashboardConstructionActionName(name: string): boolean {
@@ -214,7 +206,7 @@ function getRunCodeBridgeToolNames(content: string | undefined): string[] {
 
 function hasRunCodeDataQueryAttempt(content: string | undefined): boolean {
   return getRunCodeBridgeToolNames(content).some(
-    (name) => isDataQueryActionName(name) || isMcpDataSourceTool(name),
+    (name) => isGroundingActionName(name) || isMcpDataSourceTool(name),
   );
 }
 
@@ -530,10 +522,9 @@ export function hasIncompleteDataEvidence(
     const name = String(result.name ?? "");
     if (
       name &&
-      !isDataQueryActionName(name) &&
+      !isGroundingActionName(name) &&
       !isMcpDataSourceTool(name) &&
-      !isToolName(name, "run-code") &&
-      !isToolName(name, "provider-api-request")
+      !isToolName(name, "run-code")
     ) {
       return false;
     }
@@ -594,7 +585,7 @@ export function hasDataQueryAttempt(
     if (isToolName(name, "run-code")) {
       return hasRunCodeDataQueryAttempt(result.content);
     }
-    return isDataQueryActionName(name) || isMcpDataSourceTool(name);
+    return isGroundingActionName(name) || isMcpDataSourceTool(name);
   });
 }
 
@@ -605,7 +596,7 @@ function isFailedDataQueryAttempt(result: {
 }): boolean {
   const name = String(result.name ?? "");
   const isDataQuery =
-    isDataQueryActionName(name) ||
+    isGroundingActionName(name) ||
     isMcpDataSourceTool(name) ||
     (isToolName(name, "run-code") &&
       hasRunCodeDataQueryAttempt(result.content));

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -29,8 +29,28 @@ import {
   looksLikeAnalyticsDataRequest,
   needsCorpusWorkflowForCoverageSensitiveRequest,
   needsSourceRecordBodyWorkflowForCoverageSensitiveRequest,
+  registerGroundingActions,
 } from "../lib/real-data-actions";
 
+// Which actions return real data-source evidence is a fact each action states
+// on itself (`grounding: true`). Reading it off the definitions here is what
+// keeps the response guard from drifting behind a newly shipped source action.
+registerGroundingActions(
+  Object.entries(actionsRegistry)
+    .filter(([, module]) => {
+      // Action modules reach the registry either as the module namespace or as
+      // an already-unwrapped definition, the same two shapes
+      // `loadActionsFromStaticRegistry` normalizes.
+      const candidate = module as
+        | { grounding?: boolean; default?: { grounding?: boolean } }
+        | undefined;
+      return (
+        candidate?.grounding === true || candidate?.default?.grounding === true
+      );
+    })
+    .map(([name]) => name),
+);
+
 const ANALYTICS_BACKGROUND_RUN_SOFT_TIMEOUT_MS = 13 * 60_000;
 // A background job may legitimately spend minutes inside a provider/tool call,
 // which the shared watchdog already excludes. Outside a tool call, however,
@@ -105,6 +125,7 @@ export const ANALYTICS_OBSERVABILITY_INCIDENT_GUIDANCE =
   "OBSERVABILITY INCIDENT WORKFLOW — For a named user's session or error question, resolve the user's email from context, then use list-session-recordings with userId over a bounded recent window to discover the relevant sessions. Do not require hasErrors=true for this initial lookup: replay/network/stuck-run evidence can exist while the recording's JavaScript errorCount is zero. Use hasErrors=true only when the user specifically asks for recordings with captured JavaScript errors or the recording metadata confirms that filter is appropriate. Use list-error-issues with userId or sessionRecordingId to identify a grouped issue, then get-error-issue for stack, breadcrumbs, occurrences, and linked recordings. For console diagnostics or failed network requests, create-session-replay-agent-link first and use its scoped diagnostics endpoint for detailed error text, stacks, request metadata, and bounded 5xx snippets; enumerate with kind/limit and fromMs/toMs or offset when needed. Use get-session-replay-summary and get-session-replay-timeline for the page-navigation and click sequence, and use get-session-replay-events only for additional bounded replay-event details. If no grouped error exists, correlate first-party observability events such as agent_chat_stuck_detected with query-agent-native-analytics. This and other read-only investigation tools remain available in Plan mode; run the query instead of deferring it to execution mode. Prefer these first-party actions over generic SQL. Report the matching evidence and do not claim a root cause without a corroborating error, event, or replay signal. ";
 
 export const ANALYTICS_CROSS_APP_ROUTING_GUIDANCE =
+  "WORKSPACE APP ROUTING — Analytics is the sibling app for first-party product usage, app/template events, agent-native signups, conversions, and other curated product metrics. When another app delegates one of these questions with `call-agent`, answer it here using the built-in first-party source and query catalog; do not send the user back to another app or ask the caller to invent SQL. " +
   "WORKSPACE APP ROUTING — Brain is the sibling app that owns company knowledge and indexed Slack context. Brain is not an Analytics extension and will not appear in `list-extensions`. When the user asks about company knowledge, decisions, meeting context, or Slack messages/context such as a named channel or thread, use `call-agent` with agent `brain` and a narrow natural-language question. Use `describe-workspace-apps` only when you need to confirm the sibling capability. Do not use `list-extensions` to find Brain, and do not use `provider-api-request` to call Brain. If Brain reports an access or source error, preserve that exact error; do not infer that the Slack bot is absent from a channel or tell the user to re-invite it. Stay in Analytics for metrics and aggregates over a named provider. ";
 
 export const NON_ANALYTICS_REQUEST_GUIDANCE =
@@ -763,17 +784,23 @@ export function realDataFinalGuard(
   }
 
   if (dataQueryAttempted) return null;
+  const failedQueryMessage = failedDataQueryAttemptMessage(context.toolResults);
+  // Whether the built-in source is worth trying is decided by tool evidence,
+  // not by how the draft is worded, so it is asked once for every draft shape.
+  // A source that already failed this turn is not an untried source: steering
+  // the model back into it is how a permanently failing precondition turns
+  // into a retry loop.
+  if (firstPartySourceShouldBeTried && !failedQueryMessage) {
+    return {
+      retryMessage:
+        "The user asked for live analytics, and the built-in first-party Analytics source is available even though no external provider is connected. Call `query-agent-native-analytics` for first-party product, usage, conversion, or observability data and answer from that result. If the request specifically names an external provider, explain what is missing and include the real Connect data sources link.",
+      fallbackMessage:
+        "I couldn't complete a grounded first-party Analytics query yet. Please retry and I'll use the built-in Analytics source before asking you to connect an external provider.",
+      maxRetries: 2,
+      expandToolSurface: true,
+    };
+  }
   if (isSafeNoDataAnalyticsResponse(context.text)) {
-    if (firstPartySourceShouldBeTried) {
-      return {
-        retryMessage:
-          "The built-in first-party Analytics source is available even though no external provider is connected. Use `query-agent-native-analytics` for the user's first-party product, usage, conversion, or observability question before explaining that data is unavailable. Only guide the user to connect a source if the request specifically needs an external provider.",
-        fallbackMessage:
-          "I couldn't complete a grounded first-party Analytics query yet. Please retry and I'll use the built-in Analytics source before asking you to connect an external provider.",
-        maxRetries: 2,
-        expandToolSurface: true,
-      };
-    }
     if (
       needsDataSourceLink &&
       !includesDataSourcesLink(context.text, setupLink)
@@ -786,7 +813,6 @@ export function realDataFinalGuard(
     }
     return null;
   }
-  const failedQueryMessage = failedDataQueryAttemptMessage(context.toolResults);
   if (failedQueryMessage) {
     if (
       needsDataSourceLink &&
@@ -804,11 +830,10 @@ export function realDataFinalGuard(
     };
   }
 
-  if (
-    needsDataSourceLink &&
-    (missingRequestedExternalSource ||
-      (noConnectedExternalSources && externalSourceRequest))
-  ) {
+  // `needsDataSourceLink` already carries "status was checked, the user named an
+  // external source, and it is missing or nothing is connected". Restating those
+  // clauses here is what made the next branch look reachable.
+  if (needsDataSourceLink) {
     return {
       retryMessage: `The requested external source is not connected. Explain what is missing in the context of the user's question and include this exact markdown link: ${setupMarkdown}. Do not use the generic no-grounded-data fallback.`,
       fallbackMessage: `I can help with that once the relevant source is connected. ${setupMarkdown}`,
@@ -818,24 +843,6 @@ export function realDataFinalGuard(
   }
 
   const configuredSources = configuredDataSourceLabels(context.toolResults);
-  if (firstPartySourceShouldBeTried) {
-    return {
-      retryMessage:
-        "The user asked for live analytics, and the built-in first-party Analytics source is available even though no external provider is connected. Call `query-agent-native-analytics` for first-party product, usage, conversion, or observability data and answer from that result. If the request specifically names an external provider, explain what is missing and include the real Connect data sources link.",
-      fallbackMessage:
-        "I couldn't complete a grounded first-party Analytics query yet. Please retry and I'll use the built-in Analytics source before asking you to connect an external provider.",
-      maxRetries: 2,
-      expandToolSurface: true,
-    };
-  }
-  if (noConnectedExternalSources) {
-    return {
-      retryMessage: `The user asked for live analytics, but data-source-status found no connected external providers. The built-in first-party source is still available for first-party Analytics data. If this request needs an external source, respond naturally in the context of the user's question, explain what is missing, and include ${setupMarkdown}. Do not use a generic canned no-data response.`,
-      fallbackMessage: `I can help with that once the relevant source is connected. ${setupMarkdown}`,
-      maxRetries: 2,
-      expandToolSurface: true,
-    };
-  }
   const configuredSourceGuidance = configuredSources.length
     ? ` \`data-source-status\` already confirmed these connected sources: ${configuredSources.join(", ")}. Do not claim that no sources are connected and do not ask the user to reconnect them. Immediately call the relevant query action for one of those sources.`
     : "";