@agent-native/core 0.84.17 → 0.84.20

package/corpus/core/src/client/extensions/ExtensionViewer.tsx

@@ -2,6 +2,7 @@ import {
   IconArrowLeft,
   IconArrowBackUp,
   IconChevronRight,
+  IconCode,
   IconDotsVertical,
   IconHistory,
   IconLoader2,
@@ -20,6 +21,7 @@ import { getThemeVars } from "../../extensions/theme.js";
 import { sendToAgentChat } from "../agent-chat.js";
 import { AgentToggleButton } from "../AgentPanel.js";
 import { agentNativePath, appPath } from "../api-path.js";
+import { Dialog, DialogContent, DialogTitle } from "../components/ui/dialog.js";
 import {
   Popover,
   PopoverContent,
@@ -324,6 +326,131 @@ function applyCanonicalLink(path: string): () => void {
   };
 }
 
+function SourceCodeDialog({
+  extension,
+  onSaved,
+}: {
+  extension: Extension;
+  onSaved?: () => void;
+}) {
+  const queryClient = useQueryClient();
+  const [open, setOpen] = useState(false);
+  const [code, setCode] = useState(extension.content ?? "");
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  // Sync in when the dialog opens, or when the viewed extension changes
+  // while the dialog stays mounted (e.g. re-parented to a different id).
+  useEffect(() => {
+    if (open) setCode(extension.content ?? "");
+  }, [open, extension.id]);
+
+  const isDirty = code !== (extension.content ?? "");
+
+  // Block Escape / outside-click from closing while there are unsaved edits.
+  const handleOpenChange = (next: boolean) => {
+    if (!next && isDirty) return;
+    setOpen(next);
+    if (!next) setError(null);
+  };
+
+  const handleCancel = () => {
+    setCode(extension.content ?? "");
+    setOpen(false);
+    setError(null);
+  };
+
+  const handleSave = async () => {
+    setSaving(true);
+    setError(null);
+    try {
+      const res = await fetch(
+        agentNativePath(`/_agent-native/extensions/${extension.id}`),
+        {
+          method: "PUT",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ content: code }),
+        },
+      );
+      if (!res.ok) {
+        const body = await res.json().catch(() => ({}));
+        throw new Error(body?.error ?? `Save failed (${res.status})`);
+      }
+      setOpen(false);
+      queryClient.setQueryData<Extension>(["extension", extension.id], (old) =>
+        old ? { ...old, content: code } : old,
+      );
+      queryClient.invalidateQueries({
+        queryKey: ["extension", extension.id],
+      });
+      queryClient.invalidateQueries({ queryKey: ["extensions"] });
+      onSaved?.();
+    } catch (err: any) {
+      setError(err?.message ?? "Save failed");
+    } finally {
+      setSaving(false);
+    }
+  };
+
+  return (
+    <>
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <button
+            type="button"
+            onClick={() => setOpen(true)}
+            className="inline-flex items-center justify-center rounded-md h-8 w-8 text-muted-foreground hover:bg-accent hover:text-accent-foreground cursor-pointer"
+          >
+            <IconCode className="h-4 w-4" />
+          </button>
+        </TooltipTrigger>
+        <TooltipContent>View / edit source</TooltipContent>
+      </Tooltip>
+      <Dialog open={open} onOpenChange={handleOpenChange}>
+        <DialogContent className="flex h-[85vh] w-[90vw] max-w-[900px] flex-col gap-0 overflow-hidden p-0">
+          <div className="flex shrink-0 items-center border-b border-border px-5 py-3 pr-12">
+            <DialogTitle className="truncate text-sm font-medium">
+              {extension.name} — source
+            </DialogTitle>
+          </div>
+          <textarea
+            className="flex-1 resize-none bg-muted/40 px-5 py-4 font-mono text-xs leading-relaxed text-foreground focus:outline-none"
+            value={code}
+            onChange={(e) => setCode(e.target.value)}
+            spellCheck={false}
+          />
+          <div className="flex shrink-0 items-center justify-between border-t border-border px-5 py-3">
+            {error ? (
+              <p className="text-xs text-destructive">{error}</p>
+            ) : (
+              <span className="text-xs text-muted-foreground">
+                Alpine.js / HTML &middot; {code.length.toLocaleString()} chars
+              </span>
+            )}
+            <div className="flex items-center gap-2">
+              <button
+                type="button"
+                onClick={handleCancel}
+                className="inline-flex h-8 cursor-pointer items-center rounded-md border border-input px-3 text-xs hover:bg-accent"
+              >
+                Cancel
+              </button>
+              <button
+                type="button"
+                onClick={handleSave}
+                disabled={saving}
+                className="inline-flex h-8 cursor-pointer items-center rounded-md bg-primary px-4 text-xs font-medium text-primary-foreground hover:opacity-90 disabled:opacity-50"
+              >
+                {saving ? "Saving…" : "Save"}
+              </button>
+            </div>
+          </div>
+        </DialogContent>
+      </Dialog>
+    </>
+  );
+}
+
 function EditToolPopover({
   extension,
   onOpenChange,
@@ -1157,6 +1284,12 @@ export function ExtensionViewer({ extensionId }: ExtensionViewerProps) {
                   onRestored={() => setRefreshKey((k) => k + 1)}
                   onOpenChange={onPopoverOpenChange}
                 />
+                {extension.canEdit && (
+                  <SourceCodeDialog
+                    extension={extension}
+                    onSaved={() => setRefreshKey((k) => k + 1)}
+                  />
+                )}
                 <EditToolPopover
                   extension={extension}
                   onOpenChange={onPopoverOpenChange}

package/corpus/core/src/client/extensions/ExtensionsSidebarSection.tsx

@@ -1,7 +1,7 @@
 import {
   IconChevronDown,
   IconPlus,
-  IconSettings,
+  IconFilter,
   IconStar,
   IconStarFilled,
   IconTrash,
@@ -570,7 +570,7 @@ function ExtensionSortMenu({
               className="inline-flex h-6 w-6 shrink-0 items-center justify-center rounded-md text-muted-foreground/45 opacity-0 transition-all hover:bg-accent hover:text-foreground focus:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring group-hover/extensions-section:opacity-100"
               aria-label={copy.sortOptions}
             >
-              <IconSettings className="h-3.5 w-3.5" />
+              <IconFilter className="h-3.5 w-3.5" />
             </button>
           </DropdownMenuTrigger>
         </TooltipTrigger>

package/corpus/core/src/client/session-replay.ts

@@ -761,7 +761,7 @@ async function gzipReplayBody(body: string): Promise<Blob | null> {
       .stream()
       .pipeThrough(new CompressionStream("gzip"));
     const compressed = await new Response(stream).arrayBuffer();
-    return new Blob([compressed], { type: "application/json" });
+    return new Blob([compressed], { type: "application/octet-stream" });
   } catch {
     return null;
   }
@@ -774,7 +774,7 @@ async function buildReplayUploadBody(body: string): Promise<ReplayUploadBody> {
       body: compressed,
       compressed: true,
       headers: {
-        "Content-Type": "application/json",
+        "Content-Type": "application/octet-stream",
         "Content-Encoding": "gzip",
       },
     };

package/corpus/core/src/extensions/html-shell.ts

@@ -226,11 +226,19 @@ export function buildExtensionHtml(
   </style>
 	  <style>
 	    *, *::before, *::after { border-color: hsl(var(--border)); }
+	    html, body {
+	      /* Transparent so the iframe inherits the host surface (dashboard panel,
+	         sidebar, chat) instead of painting the browser's default white canvas.
+	         The dark class still flips the theme vars; content paints its own
+	         bg-background / bg-card surfaces. */
+	      background: transparent;
+	    }
 	    body {
 	      --agent-native-extension-padding: clamp(16px, 2vw, 24px);
 	      /* Legacy alias for pre-rename extension content (do not remove). */
 	      --agent-native-tool-padding: var(--agent-native-extension-padding);
 	      box-sizing: border-box;
+	      color: hsl(var(--foreground));
 	      font-family: 'Inter', sans-serif;
 	      margin: 0;
 	      min-height: 100vh;
@@ -403,8 +411,14 @@ export function buildExtensionHtml(
 	      }
 
 	      if (!res.ok) {
-	        var err = res.body || { error: res.statusText };
-	        throw new Error(err.error || 'Action failed: ' + res.status);
+	        var err = res.body || {};
+	        var rawError = typeof err === 'string' ? err : err.error;
+	        var message = (typeof rawError === 'string' && rawError.trim())
+	          ? rawError
+	          : (res.status === 404
+	            ? "Action '" + name + "' is not available over HTTP (404). It may be agent-only (http: false); expose it with an HTTP-mounted action to call it from an extension."
+	            : "Action '" + name + "' failed (" + (res.status || 'network error') + ")");
+	        throw new Error(message);
 	      }
 	      return res.body;
 	    }
@@ -730,7 +744,7 @@ export function buildExtensionHtml(
 	    });
 	  </script>
 	</head>
-	<body${extensionId ? ` data-extension-id="${extensionIdAttr}" data-tool-id="${extensionIdAttr}"` : ""} class="bg-background text-foreground">
+	<body${extensionId ? ` data-extension-id="${extensionIdAttr}" data-tool-id="${extensionIdAttr}"` : ""} class="text-foreground">
 	${content}
 	<div id="__extension-error-toast">
 	  <div style="display:flex;align-items:flex-start;gap:8px;">

package/corpus/core/src/extensions/theme.ts

@@ -1,3 +1,42 @@
+/**
+ * Canonical set of semantic theme token names shared by the app and extension
+ * iframes. This is the single source of truth: `getThemeVars` bakes default
+ * values for these into every iframe, and the host reads the *actual* computed
+ * values for the same names to sync its live palette into embedded extensions
+ * (see EmbeddedExtension). Custom properties can't be enumerated portably from
+ * a computed style, so the names must be listed explicitly.
+ */
+export const THEME_VAR_NAMES = [
+  "--background",
+  "--foreground",
+  "--card",
+  "--card-foreground",
+  "--popover",
+  "--popover-foreground",
+  "--primary",
+  "--primary-foreground",
+  "--secondary",
+  "--secondary-foreground",
+  "--muted",
+  "--muted-foreground",
+  "--accent",
+  "--accent-foreground",
+  "--destructive",
+  "--destructive-foreground",
+  "--border",
+  "--input",
+  "--ring",
+  "--radius",
+  "--sidebar-background",
+  "--sidebar-foreground",
+  "--sidebar-primary",
+  "--sidebar-primary-foreground",
+  "--sidebar-accent",
+  "--sidebar-accent-foreground",
+  "--sidebar-border",
+  "--sidebar-ring",
+] as const;
+
 /**
  * CSS variables baked into every extension iframe. Both light and dark are
  * always emitted — the `.dark` class on the iframe's `<html>` toggles between

package/corpus/templates/analytics/actions/provider-api-request.ts

@@ -213,7 +213,14 @@ export default defineAction({
         "Enable cursor-based pagination. After each response, reads cursorPath from the JSON body and re-issues the request with cursorParam or cursorBodyPath set, accumulating items from itemsPath (or whole bodies) until cursor is empty or maxPages is reached. Combine with saveToFile to write the full dataset to a workspace file; use scratch/... for temporary staging.",
       ),
   }),
-  http: false,
+  // Mounted over HTTP (POST) so the agent and frontend (`useActionMutation`)
+  // can reach it, consistent with provider-api-catalog / provider-api-docs.
+  // toolCallable: false blocks the extension iframe bridge — this action
+  // accepts arbitrary methods (PUT/DELETE/etc.) against provider APIs, so
+  // allowing shared extensions to call it would let malicious extension authors
+  // mutate provider data under the opener's credentials.
+  http: { method: "POST" },
+  toolCallable: false,
   run: async (args) => {
     if (args.stageAs) {
       const ctx = requireRequestCredentialContext("provider-api staging");

package/corpus/templates/analytics/app/components/layout/Sidebar.tsx

@@ -7,6 +7,7 @@ import {
   IconStar,
   IconPencil,
   IconSettings,
+  IconFilter,
   IconGripVertical,
   IconBook2,
   IconDatabase,
@@ -251,7 +252,7 @@ function SidebarSectionSettingsPopover({
               className="flex h-7 w-7 shrink-0 items-center justify-center rounded-md text-muted-foreground/65 opacity-0 transition-all hover:bg-sidebar-accent hover:text-foreground focus:opacity-100 focus:outline-none focus:ring-2 focus:ring-ring group-hover/section:opacity-100 data-[state=open]:opacity-100"
               aria-label={settingsLabel}
             >
-              <IconSettings className="h-3.5 w-3.5" />
+              <IconFilter className="h-3.5 w-3.5" />
             </button>
           </PopoverTrigger>
         </TooltipTrigger>

package/corpus/templates/analytics/app/pages/adhoc/sql-dashboard/SqlChartCard.tsx

@@ -3,6 +3,7 @@ import { useDraggable } from "@dnd-kit/core";
 import {
   IconGripVertical,
   IconDotsVertical,
+  IconExternalLink,
   IconMaximize,
   IconPencil,
   IconRefresh,
@@ -12,6 +13,7 @@ import {
 } from "@tabler/icons-react";
 import { useIsFetching, useQueryClient } from "@tanstack/react-query";
 import { memo, useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useNavigate } from "react-router";
 
 import { ChartFillHeight, SqlChart } from "@/components/dashboard/SqlChart";
 import {
@@ -119,6 +121,8 @@ export function SqlChartCard({
 
   const [confirmOpen, setConfirmOpen] = useState(false);
   const [expanded, setExpanded] = useState(false);
+  const [extRefreshKey, setExtRefreshKey] = useState(0);
+  const navigate = useNavigate();
   const [exportCsv, setExportCsv] = useState<(() => void) | null>(null);
   const [shouldLoadData, setShouldLoadData] = useState(
     eagerLoad ||
@@ -291,10 +295,12 @@ export function SqlChartCard({
   }
 
   // Extension panels render their sandboxed iframe full-bleed with no card chrome
-  // or title — the extension owns its own UI. Editable dashboards still get a
-  // hover overlay for delete/drag. Editing routes through the agent (the manual
-  // panel editor has no extension picker), so no inline edit action here.
+  // or title — the extension owns its own UI. All viewers get the read-only
+  // actions (full screen, refresh, open extension); editable dashboards also get
+  // delete and drag.
   if (panel.chartType === "extension") {
+    const extensionId = (panel.config as Record<string, unknown> | undefined)
+      ?.extensionId as string | undefined;
     return (
       <div
         ref={setCardNodeRef}
@@ -302,45 +308,97 @@ export function SqlChartCard({
         data-dragging={isDragSource ? "true" : undefined}
         className="dashboard-extension-card group relative h-full"
       >
-        <SqlChart panel={panel} resolvedSql={resolvedSql} loadData />
-        {editable ? (
-          <div className="absolute right-1 top-1 flex items-center gap-1 opacity-0 group-hover:opacity-100">
-            <DropdownMenu>
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <DropdownMenuTrigger asChild>
-                    <button
-                      className="p-1 rounded bg-background/80 text-muted-foreground hover:text-foreground"
-                      aria-label={t("sqlDashboard.panelOptions")}
-                    >
-                      <IconDotsVertical className="h-3.5 w-3.5" />
-                    </button>
-                  </DropdownMenuTrigger>
-                </TooltipTrigger>
-                <TooltipContent>
-                  {t("sqlDashboard.panelOptions")}
-                </TooltipContent>
-              </Tooltip>
-              <DropdownMenuContent align="end" className="w-40">
+        {!expanded && (
+          <SqlChart
+            key={extRefreshKey}
+            panel={panel}
+            resolvedSql={resolvedSql}
+            loadData
+          />
+        )}
+        <div className="absolute right-1 top-1 flex items-center gap-1 opacity-0 group-hover:opacity-100">
+          <DropdownMenu>
+            <Tooltip>
+              <TooltipTrigger asChild>
+                <DropdownMenuTrigger asChild>
+                  <button
+                    className="p-1 rounded bg-background/80 text-muted-foreground hover:text-foreground"
+                    aria-label={t("sqlDashboard.panelOptions")}
+                  >
+                    <IconDotsVertical className="h-3.5 w-3.5" />
+                  </button>
+                </DropdownMenuTrigger>
+              </TooltipTrigger>
+              <TooltipContent>{t("sqlDashboard.panelOptions")}</TooltipContent>
+            </Tooltip>
+            <DropdownMenuContent align="end" className="w-44">
+              <DropdownMenuItem onSelect={() => setExpanded(true)}>
+                <IconMaximize className="h-4 w-4 mr-2" />
+                {t("sqlDashboard.fullScreen")}
+              </DropdownMenuItem>
+              {extensionId ? (
                 <DropdownMenuItem
-                  onSelect={(e) => {
-                    e.preventDefault();
-                    setConfirmOpen(true);
-                  }}
+                  onSelect={() =>
+                    navigate(
+                      `/extensions/${extensionId}/${encodeURIComponent(
+                        (panel.title ?? "extension")
+                          .toLowerCase()
+                          .replace(/[^a-z0-9]+/g, "-"),
+                      )}`,
+                    )
+                  }
                 >
-                  <IconTrash className="h-4 w-4 mr-2" />
-                  {t("sidebar.delete")}
+                  <IconExternalLink className="h-4 w-4 mr-2" />
+                  Open extension {/* i18n-ignore */}
                 </DropdownMenuItem>
-              </DropdownMenuContent>
-            </DropdownMenu>
+              ) : null}
+              <DropdownMenuSeparator />
+              <DropdownMenuItem onSelect={() => setExtRefreshKey((k) => k + 1)}>
+                <IconRefresh className="h-4 w-4 mr-2" />
+                {t("sqlDashboard.refresh")}
+              </DropdownMenuItem>
+              {editable ? (
+                <>
+                  <DropdownMenuSeparator />
+                  <DropdownMenuItem
+                    onSelect={(e) => {
+                      e.preventDefault();
+                      setConfirmOpen(true);
+                    }}
+                  >
+                    <IconTrash className="h-4 w-4 mr-2" />
+                    {t("sidebar.delete")}
+                  </DropdownMenuItem>
+                </>
+              ) : null}
+            </DropdownMenuContent>
+          </DropdownMenu>
+          {editable ? (
             <PanelDragHandle
               panelId={panel.id}
               label={t("sqlDashboard.dragToReorder")}
               className="p-1 rounded bg-background/80 cursor-grab active:cursor-grabbing text-muted-foreground/50 hover:text-muted-foreground"
               iconClassName="h-3.5 w-3.5"
             />
-          </div>
-        ) : null}
+          ) : null}
+        </div>
+        <Dialog open={expanded} onOpenChange={setExpanded}>
+          <DialogContent className="flex h-[90vh] w-[95vw] max-w-[1400px] flex-col gap-4">
+            <DialogHeader className="shrink-0 pr-8 text-left">
+              <DialogTitle className="truncate">{panel.title}</DialogTitle>
+            </DialogHeader>
+            <div className="flex min-h-0 flex-1 flex-col overflow-auto">
+              <ChartFillHeight>
+                <SqlChart
+                  key={extRefreshKey}
+                  panel={panel}
+                  resolvedSql={resolvedSql}
+                  loadData
+                />
+              </ChartFillHeight>
+            </div>
+          </DialogContent>
+        </Dialog>
         {editable ? (
           <AlertDialog open={confirmOpen} onOpenChange={setConfirmOpen}>
             <AlertDialogContent>

package/corpus/templates/analytics/changelog/2026-07-01-session-replay-recordings-upload-reliably-in-production.md

@@ -0,0 +1,6 @@
+---
+type: fixed
+date: 2026-07-01
+---
+
+Session replay recordings upload reliably in production.

package/corpus/templates/analytics/server/handlers/session-replay.ts

@@ -82,11 +82,36 @@ function statusError(message: string, statusCode: number): Error {
   return Object.assign(new Error(message), { statusCode });
 }
 
+function looksLikeDecodedJson(bytes: Buffer): boolean {
+  const first = bytes.toString("utf8").trimStart()[0];
+  return first === "{" || first === "[";
+}
+
+function tryGunzip(bytes: Buffer): Buffer | null {
+  try {
+    return gunzipSync(bytes);
+  } catch {
+    return null;
+  }
+}
+
+function decodeTextWrappedGzip(
+  bytes: Buffer,
+): { decoded: Buffer; requestBytes: number } | null {
+  const text = bytes.toString("utf8");
+  const binaryStringBytes = Buffer.from(text, "latin1");
+  if (binaryStringBytes.equals(bytes)) return null;
+  const decoded = tryGunzip(binaryStringBytes);
+  return decoded
+    ? { decoded, requestBytes: binaryStringBytes.byteLength }
+    : null;
+}
+
 export function decodeSessionReplayRequestBody(
   rawBody: Buffer | Uint8Array | string | undefined,
   contentEncoding?: string | null,
 ): { body: unknown; requestBytes: number } {
-  const requestBytes =
+  let requestBytes =
     typeof rawBody === "string"
       ? Buffer.byteLength(rawBody, "utf8")
       : (rawBody?.byteLength ?? 0);
@@ -99,10 +124,26 @@ export function decodeSessionReplayRequestBody(
   let decoded = bytes;
 
   if (encoding === "gzip" || encoding === "x-gzip") {
-    try {
-      decoded = gunzipSync(bytes);
-    } catch {
-      throw statusError("Invalid gzip-compressed replay body", 400);
+    const gunzipped = tryGunzip(bytes);
+    if (gunzipped) {
+      decoded = gunzipped;
+    } else {
+      // Netlify may hand Nitro an already-decoded body while preserving the
+      // original browser Content-Encoding header.
+      if (looksLikeDecodedJson(bytes)) {
+        decoded = bytes;
+      } else {
+        // Some Netlify paths wrap binary request bodies in a JS string before
+        // Nitro reads them back as UTF-8. Reinterpret that text as one-byte
+        // binary data so real browser CompressionStream uploads survive.
+        const textWrappedGzip = decodeTextWrappedGzip(bytes);
+        if (textWrappedGzip) {
+          decoded = textWrappedGzip.decoded;
+          requestBytes = textWrappedGzip.requestBytes;
+        } else {
+          throw statusError("Invalid gzip-compressed replay body", 400);
+        }
+      }
     }
   } else if (encoding && encoding !== "identity") {
     throw statusError(

package/corpus/templates/calendar/app/components/booking/TimeSlotPicker.tsx

@@ -9,6 +9,7 @@ interface TimeSlotPickerProps {
   selectedSlot: string | null;
   onSelect: (start: string) => void;
   loading?: boolean;
+  errorMessage?: string;
 }
 
 export function TimeSlotPicker({
@@ -16,6 +17,7 @@ export function TimeSlotPicker({
   selectedSlot,
   onSelect,
   loading,
+  errorMessage,
 }: TimeSlotPickerProps) {
   const t = useT();
 
@@ -29,6 +31,14 @@ export function TimeSlotPicker({
     );
   }
 
+  if (errorMessage) {
+    return (
+      <p className="rounded-lg border border-destructive/30 bg-destructive/[0.06] px-3 py-3 text-sm text-destructive">
+        {errorMessage}
+      </p>
+    );
+  }
+
   if (slots.length === 0) {
     return (
       <p className="text-sm text-muted-foreground text-center py-4">

package/corpus/templates/calendar/app/components/calendar/GoogleConnectBanner.tsx

@@ -33,6 +33,7 @@ import {
   useDisconnectGoogle,
   type DesktopAuthIssue,
 } from "@/hooks/use-google-auth";
+import { shouldOfferGoogleOAuthSetup } from "@/lib/google-oauth-setup";
 
 interface EnvKeyStatus {
   key: string;
@@ -93,6 +94,7 @@ export function GoogleConnectBanner({
 
   const accounts = googleStatus.data?.accounts ?? [];
   const hasAccounts = accounts.length > 0;
+  const canOfferOAuthSetup = useMemo(() => shouldOfferGoogleOAuthSetup(), []);
 
   const isBuilderFrame = useMemo(() => isInBuilderFrame(), []);
   const authPollRef = useRef<ReturnType<typeof setInterval> | null>(null);
@@ -184,10 +186,17 @@ export function GoogleConnectBanner({
   useEffect(() => {
     if (authUrl.error) {
       setWantAuthUrl(false);
-      setShowWizard(true);
-      fetchStatus();
+      if (canOfferOAuthSetup) {
+        setShowWizard(true);
+        fetchStatus();
+      } else {
+        setDesktopAuthIssue({
+          code: "managed_credentials_unavailable",
+          message: t("googleConnect.managedCredentialsUnavailableDescription"),
+        });
+      }
     }
-  }, [authUrl.error, fetchStatus]);
+  }, [authUrl.error, canOfferOAuthSetup, fetchStatus, t]);
 
   useEffect(() => {
     if (
@@ -388,7 +397,7 @@ export function GoogleConnectBanner({
           </div>
         )}
 
-        {showWizard && !allConfigured && (
+        {showWizard && !allConfigured && canOfferOAuthSetup && (
           <div className="mt-8 w-full max-w-lg text-start">
             <SetupWizard
               currentStep={currentStep}
@@ -481,7 +490,7 @@ export function GoogleConnectBanner({
         </div>
 
         <div className="flex items-center gap-1.5 shrink-0">
-          {showWizard && !allConfigured ? (
+          {showWizard && !allConfigured && canOfferOAuthSetup ? (
             <Button
               size="sm"
               variant="outline"
@@ -541,7 +550,7 @@ export function GoogleConnectBanner({
       />
 
       {/* Inline setup wizard */}
-      {showWizard && !allConfigured && (
+      {showWizard && !allConfigured && canOfferOAuthSetup && (
         <div className="px-5 pb-4 pt-1 max-w-2xl">
           <p className="text-xs text-muted-foreground mb-3">
             {t("googleConnect.followSteps")}