@agent-native/core 0.84.57 → 0.84.58

package/corpus/README.md

@@ -28,4 +28,4 @@ rg -n "defineAction|useActionQuery" node_modules/@agent-native/core/corpus
 ## Generated Counts
 
 - core files: 2044
-- template files: 5012
+- template files: 5018

package/corpus/core/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @agent-native/core
 
+## 0.84.58
+
+### Patch Changes
+
+- cdc9033: Recover durable background chat runs when action input preparation stops making byte progress, and avoid duplicate tool cards when reconnects replay completed tool events.
+- cdc9033: Remove the shadow from agent chat context scope pills.
+- cdc9033: Prevent agent chat sidebars from jittering around nested scroll areas and suppress replayed reconnect tool cards that are already rendered in the saved thread.
+
 ## 0.84.57
 
 ### Patch Changes

package/corpus/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.84.57",
+  "version": "0.84.58",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {

package/corpus/core/src/action.ts

@@ -345,6 +345,10 @@ interface DefineActionWithSchema<
    *  Only set this manually when you need to override the inference — e.g. a
    *  POST action that only reads data but can't use GET for a protocol reason. */
   readOnly?: boolean;
+  /** Set false for read-only tools that should stay available in Act mode but
+   *  must not run during Plan mode because they perform substantive work
+   *  rather than lightweight inspection. Defaults to allowed when read-only. */
+  allowInPlanMode?: boolean;
   /** If true, the agent may execute this action concurrently with other
    *  read-only or parallel-safe tool calls emitted in the same model turn.
    *  Only set this for mutating actions that are internally concurrency-safe
@@ -460,6 +464,9 @@ interface DefineActionWithParams<
   /** If true, the framework will NOT emit a screen-refresh change event after a
    *  successful call. Auto-inferred as `true` when `http.method === "GET"`. */
   readOnly?: boolean;
+  /** Set false for read-only tools that should stay available in Act mode but
+   *  must not run during Plan mode. See the schema overload above. */
+  allowInPlanMode?: boolean;
   /** If true, the agent may execute this action concurrently with other
    *  read-only or parallel-safe tool calls emitted in the same model turn. */
   parallelSafe?: boolean;
@@ -525,6 +532,7 @@ export interface ActionDefinition<TInput, TReturn> {
   readonly maxBodyBytes?: number;
   readonly agentTool?: boolean;
   readonly readOnly?: boolean;
+  readonly allowInPlanMode?: boolean;
   readonly parallelSafe?: boolean;
   readonly toolCallable?: boolean;
   readonly publicAgent?: PublicAgentActionConfig;
@@ -752,6 +760,9 @@ export function defineAction(options: any) {
       : {}),
     ...(typeof agentTool === "boolean" ? { agentTool } : {}),
     ...(typeof readOnly === "boolean" ? { readOnly } : {}),
+    ...(typeof options.allowInPlanMode === "boolean"
+      ? { allowInPlanMode: options.allowInPlanMode }
+      : {}),
     ...(typeof parallelSafe === "boolean" ? { parallelSafe } : {}),
     ...(typeof toolCallable === "boolean" ? { toolCallable } : {}),
     ...(publicAgent ? { publicAgent } : {}),

package/corpus/core/src/agent/production-agent.ts

@@ -26,7 +26,7 @@ import {
   parseFrontmatter,
 } from "../resources/metadata.js";
 import {
-  isDeployCredentialFallbackAllowed,
+  canUseDeployCredentialFallbackForRequest,
   readDeployCredentialEnv,
 } from "../server/credential-provider.js";
 import { readBody } from "../server/h3-helpers.js";
@@ -457,32 +457,16 @@ export function engineToProvider(engineName: string): string {
   return engineName.startsWith("ai-sdk:") ? engineName.slice(7) : engineName;
 }
 
-/**
- * Returns true when this process should block generic deploy-level provider
- * credentials for signed-in chat requests.
- *
- * Self-hosted single-tenant deployments keep the env-var fallback so the
- * original BYO-server UX continues to work without a per-user key.
- */
-function shouldBlockDeployCredentialFallback(): boolean {
-  return !isDeployCredentialFallbackAllowed();
-}
-
 /**
  * Resolve the active engine's provider and look up the user's API key for it.
  *
- * In shared hosted deploys we deliberately refuse the deploy-level fallback
- * for authenticated users. Without that gate any
- * signed-in user who hasn't configured their own provider key would silently
- * inherit the deployment's key (uncapped billing on the owner's account,
- * prompt logging tied to the deployment owner) — exactly the prior-incident
- * pattern we hit on 2026-04-29.
- *
- * Single-tenant (local-dev, self-hosted SQLite) keeps the env fallback.
+ * If the owner has no scoped key, fall back to provider keys supplied by the
+ * hosting environment only when the current request can safely use deploy-level
+ * credentials. This is a read from process-level config, not a request-scoped
+ * write to `process.env`.
  *
- * Callers in `agent-chat-plugin.ts`, `triggers/dispatcher.ts`,
- * `jobs/scheduler.ts`, and `integrations/plugin.ts` historically layer
- * another deployment-key fallback after this must keep the same gate.
+ * Callers that layer another deployment-key fallback after this should keep the
+ * same precedence: scoped key first, host-provided env key second.
  */
 export async function getOwnerActiveApiKey(
   ownerEmail: string | null | undefined,
@@ -495,14 +479,7 @@ export async function getOwnerActiveApiKey(
     const provider = engineToProvider(activeEngine);
     const userKey = await getOwnerApiKey(provider, ownerEmail);
     if (userKey) return userKey;
-    if (shouldBlockDeployCredentialFallback()) {
-      // Shared hosted default: refuse the env fallback. A null user
-      // (unauthenticated / background context with no owner) gets undefined
-      // here too — there's no user to bill, and the call site must surface a
-      // "configure a key" error to the requester rather than silently using
-      // the deploy key.
-      return undefined;
-    }
+    if (!canUseDeployCredentialFallbackForRequest()) return undefined;
     const envVar = PROVIDER_TO_ENV[provider];
     return envVar ? readDeployCredentialEnv(envVar) : undefined;
   } catch {
@@ -552,6 +529,10 @@ export interface ActionEntry {
   /** If true, completion does NOT trigger a screen-refresh change event.
    *  Set automatically by `defineAction` when `http.method === "GET"`. */
   readOnly?: boolean;
+  /** False keeps a read-only tool available in Act mode but hides/blocks it in
+   *  Plan mode. Use for tools that perform substantive work even without
+   *  mutating state. */
+  allowInPlanMode?: boolean;
   /** If true, this action can run concurrently with other same-turn
    *  read-only/parallel-safe tool calls. Only use for actions that handle
    *  their own write ordering and idempotency. */
@@ -705,6 +686,7 @@ export function isPlanModeToolCallAllowed(
   input: unknown,
   entry: ActionEntry,
 ): boolean {
+  if (entry.allowInPlanMode === false) return false;
   if (PLAN_MODE_BLOCKED_READONLY_TOOLS.has(name)) return false;
 
   if (name === "web-request") {
@@ -802,6 +784,7 @@ export function createPlanModeActionRegistry(
 
   for (const [name, entry] of Object.entries(actions)) {
     if (name === TOOL_SEARCH_ACTION_NAME) continue;
+    if (entry.allowInPlanMode === false) continue;
     if (PLAN_MODE_BLOCKED_READONLY_TOOLS.has(name)) continue;
 
     const allowedActions = PLAN_MODE_ALLOWED_ACTIONS[name];
@@ -4760,15 +4743,14 @@ export function createProductionAgentHandler(
     // for that provider instead of the global active engine's provider.
     // DIAGNOSTIC-ONLY: bracket per-owner API-key resolution (settings/app_secrets reads).
     workerStep("apikey_start");
+    const allowDeployCredentialFallback =
+      canUseDeployCredentialFallbackForRequest();
     let userApiKey: string | undefined;
     if (requestEngine) {
       const provider = engineToProvider(requestEngine);
       userApiKey = await getOwnerApiKey(provider, ownerEmail);
-      if (!userApiKey && !shouldBlockDeployCredentialFallback()) {
-        // Single-tenant only: env fallback for the requested provider. Shared
-        // hosted deploys never silently substitute the deploy-level key for
-        // an authenticated user (see getOwnerActiveApiKey for the full
-        // rationale).
+      if (!userApiKey && allowDeployCredentialFallback) {
+        // Read-only env fallback for the requested provider.
         const envVar = PROVIDER_TO_ENV[provider];
         userApiKey = envVar ? readDeployCredentialEnv(envVar) : undefined;
       }
@@ -4779,16 +4761,12 @@ export function createProductionAgentHandler(
     workerStep("apikey_done");
 
     // `options.apiKey` is the value the template constructed the plugin with
-    // (e.g. wired from a deployment env var). On a shared hosted deploy this
-    // is the same cross-tenant hazard as any deploy-level provider key:
-    // accepting it as the final fallback would silently bill every key-less
-    // user to the deployment's account. Honour it only when the generic
-    // deploy fallback policy allows it.
-    const effectiveApiKey = shouldBlockDeployCredentialFallback()
-      ? userApiKey
-      : (userApiKey ??
-        options.apiKey ??
-        readDeployCredentialEnv("ANTHROPIC_API_KEY"));
+    // (often wired from a deployment env var). Honor it as host-provided
+    // read-only configuration after scoped keys when deploy fallback is safe.
+    const hostApiKey = allowDeployCredentialFallback
+      ? (options.apiKey ?? readDeployCredentialEnv("ANTHROPIC_API_KEY"))
+      : undefined;
+    const effectiveApiKey = userApiKey ?? hostApiKey;
 
     // Resolve engine — per-request engine override takes priority
     // DIAGNOSTIC-ONLY: bracket engine resolution (Builder credential / app-default

package/corpus/core/src/client/AssistantChat.tsx

@@ -588,6 +588,61 @@ export function reconnectActivityFallbackContent(
   ];
 }
 
+function toolCallIdFromContentPart(part: unknown): string | null {
+  if (!part || typeof part !== "object") return null;
+  const candidate = part as { type?: unknown; toolCallId?: unknown };
+  if (candidate.type !== "tool-call") return null;
+  return typeof candidate.toolCallId === "string" && candidate.toolCallId
+    ? candidate.toolCallId
+    : null;
+}
+
+function toolCallPartHasResult(part: unknown): boolean {
+  if (!part || typeof part !== "object") return false;
+  const candidate = part as { type?: unknown; result?: unknown };
+  return candidate.type === "tool-call" && "result" in candidate;
+}
+
+function collectRenderedToolCallStates(
+  messages: readonly unknown[],
+): Map<string, { hasResult: boolean }> {
+  const states = new Map<string, { hasResult: boolean }>();
+  for (const message of messages) {
+    const msg = (message as { message?: unknown })?.message ?? message;
+    const content = (msg as { content?: unknown })?.content;
+    if (!Array.isArray(content)) continue;
+    for (const part of content) {
+      const id = toolCallIdFromContentPart(part);
+      if (!id) continue;
+      const existing = states.get(id);
+      states.set(id, {
+        hasResult: Boolean(existing?.hasResult || toolCallPartHasResult(part)),
+      });
+    }
+  }
+  return states;
+}
+
+export function dedupeReconnectContentAgainstMessages(
+  content: ContentPart[],
+  messages: readonly unknown[],
+): ContentPart[] {
+  if (content.length === 0 || messages.length === 0) return content;
+  const renderedToolCallStates = collectRenderedToolCallStates(messages);
+  if (renderedToolCallStates.size === 0) return content;
+
+  let changed = false;
+  const filtered = content.filter((part) => {
+    const id = toolCallIdFromContentPart(part);
+    const existing = id ? renderedToolCallStates.get(id) : undefined;
+    if (!id || !existing) return true;
+    if (toolCallPartHasResult(part) && !existing.hasResult) return true;
+    changed = true;
+    return false;
+  });
+  return changed ? filtered : content;
+}
+
 const RECOVERY_USER_MESSAGE_PREFIXES = [
   "Continue from where you left off",
   "Continue from where you stopped",
@@ -1540,15 +1595,10 @@ const AssistantChatInner = forwardRef<
   });
   const reconnectActivityContent = useMemo(
     () =>
-      (isReconnecting || reconnectFrozen) && reconnectContent.length === 0
+      isReconnecting || reconnectFrozen
         ? reconnectActivityFallbackContent(runningActivityTool)
         : [],
-    [
-      isReconnecting,
-      reconnectFrozen,
-      reconnectContent.length,
-      runningActivityTool,
-    ],
+    [isReconnecting, reconnectFrozen, runningActivityTool],
   );
   const lastBroadcastRunningRef = useRef(isRunning);
   const tiptapRef = useRef<TiptapComposerHandle>(null);
@@ -3287,14 +3337,19 @@ const AssistantChatInner = forwardRef<
     ],
   );
 
+  const visibleReconnectContent = useMemo(
+    () => dedupeReconnectContentAgainstMessages(reconnectContent, messages),
+    [messages, reconnectContent],
+  );
+
   const autoscrollFollowKey = useMemo(
     () =>
       [
         messages.map(messageFollowKey).join(";"),
         `q:${queuedMessages.map(queuedMessageFollowKey).join("|")}`,
-        `r:${reconnectContentFollowKey(reconnectContent)}`,
+        `r:${reconnectContentFollowKey(visibleReconnectContent)}`,
       ].join(";;"),
-    [messages, queuedMessages, reconnectContent],
+    [messages, queuedMessages, visibleReconnectContent],
   );
 
   const {
@@ -3802,11 +3857,13 @@ const AssistantChatInner = forwardRef<
                         />
                       )}
                       {(isReconnecting || reconnectFrozen) &&
-                        reconnectContent.length > 0 && (
-                          <ReconnectStreamMessage content={reconnectContent} />
+                        visibleReconnectContent.length > 0 && (
+                          <ReconnectStreamMessage
+                            content={visibleReconnectContent}
+                          />
                         )}
                       {(isReconnecting || reconnectFrozen) &&
-                        reconnectContent.length === 0 &&
+                        visibleReconnectContent.length === 0 &&
                         reconnectActivityContent.length > 0 && (
                           <ReconnectStreamMessage
                             content={reconnectActivityContent}

package/corpus/core/src/client/MultiTabAssistantChat.tsx

@@ -283,7 +283,7 @@ function ScopeBadge({
         <PopoverTrigger asChild>
           <button
             type="button"
-            className="inline-flex h-7 min-w-0 max-w-full cursor-pointer items-center gap-1.5 rounded-t-lg border border-b-0 border-input bg-background px-3 text-muted-foreground shadow-[0_-8px_24px_hsl(var(--background)/0.72)] transition-colors hover:bg-accent hover:text-foreground sm:max-w-72"
+            className="inline-flex h-7 min-w-0 max-w-full cursor-pointer items-center gap-1.5 rounded-t-lg border border-b-0 border-input bg-background px-3 text-muted-foreground transition-colors hover:bg-accent hover:text-foreground sm:max-w-72"
             aria-label={heading}
           >
             <IconLink size={11} className="shrink-0 opacity-70" />

package/corpus/core/src/client/conversation/use-near-bottom-autoscroll.ts

@@ -7,6 +7,41 @@ export interface UseNearBottomAutoscrollOptions {
   enabled?: boolean;
 }
 
+function eventElementTarget(event: Event): HTMLElement | null {
+  const target = event.target;
+  if (!(target instanceof Node)) return null;
+  if (target instanceof HTMLElement) return target;
+  return target.parentElement;
+}
+
+function canScrollElementVertically(
+  element: HTMLElement,
+  deltaY: number,
+): boolean {
+  if (element.scrollHeight <= element.clientHeight) return false;
+  const style = window.getComputedStyle(element);
+  const overflowY = style.overflowY || style.overflow;
+  if (!/(auto|scroll|overlay)/.test(overflowY)) return false;
+  if (deltaY < 0) return element.scrollTop > 0;
+  if (deltaY > 0) {
+    return element.scrollTop + element.clientHeight < element.scrollHeight - 1;
+  }
+  return false;
+}
+
+function nestedScrollableConsumesVerticalIntent(
+  event: Event,
+  root: HTMLElement,
+  deltaY: number,
+): boolean {
+  let element = eventElementTarget(event);
+  while (element && element !== root) {
+    if (canScrollElementVertically(element, deltaY)) return true;
+    element = element.parentElement;
+  }
+  return false;
+}
+
 export function useNearBottomAutoscroll<TElement extends HTMLElement>({
   followKey,
   streaming = false,
@@ -83,6 +118,9 @@ export function useNearBottomAutoscroll<TElement extends HTMLElement>({
     let lastScrollHeight = el.scrollHeight;
 
     const onWheel = (event: WheelEvent) => {
+      if (nestedScrollableConsumesVerticalIntent(event, el, event.deltaY)) {
+        return;
+      }
       if (event.deltaY < 0) detachFromBottom();
     };
 
@@ -95,7 +133,10 @@ export function useNearBottomAutoscroll<TElement extends HTMLElement>({
       if (nextTouchY == null) return;
       const lastTouchY = lastTouchYRef.current;
       if (lastTouchY != null && nextTouchY > lastTouchY) {
-        detachFromBottom();
+        const deltaY = lastTouchY - nextTouchY;
+        if (!nestedScrollableConsumesVerticalIntent(event, el, deltaY)) {
+          detachFromBottom();
+        }
       }
       lastTouchYRef.current = nextTouchY;
     };
@@ -104,7 +145,8 @@ export function useNearBottomAutoscroll<TElement extends HTMLElement>({
       lastTouchYRef.current = null;
     };
 
-    const onScroll = () => {
+    const onScroll = (event: Event) => {
+      if (event.target !== el) return;
       const previousScrollTop = lastScrollTopRef.current;
       const nextScrollTop = el.scrollTop;
       const nextScrollHeight = el.scrollHeight;
@@ -133,6 +175,7 @@ export function useNearBottomAutoscroll<TElement extends HTMLElement>({
         event.key === "Home" ||
         (event.key === " " && event.shiftKey)
       ) {
+        if (nestedScrollableConsumesVerticalIntent(event, el, -1)) return;
         detachFromBottom();
       }
     };

package/corpus/core/src/coding-tools/run-code.ts

@@ -75,6 +75,7 @@ export function createRunCodeEntry(
 
   return {
     readOnly: true,
+    allowInPlanMode: false,
     // Allow a generous per-call timeout so large data-processing jobs don't hit
     // the agent-loop's default 60 s cap.
     timeoutMs: MAX_TIMEOUT_MS,

package/corpus/core/src/integrations/webhook-handler.ts

@@ -36,7 +36,10 @@ import { isLocalDatabase } from "../db/client.js";
 import { resolveOrgIdForEmail } from "../org/context.js";
 import { withConfiguredAppBasePath } from "../server/app-base-path.js";
 import { FRAMEWORK_ROUTE_PREFIX } from "../server/core-routes-plugin.js";
-import { readDeployCredentialEnv } from "../server/credential-provider.js";
+import {
+  canUseDeployCredentialFallbackForRequest,
+  readDeployCredentialEnv,
+} from "../server/credential-provider.js";
 import { runWithRequestContext } from "../server/request-context.js";
 import { A2A_CONTINUATION_QUEUED_MARKER } from "./a2a-continuation-marker.js";
 import { signInternalToken } from "./internal-token.js";
@@ -128,11 +131,6 @@ function explicitEngineName(
   return undefined;
 }
 
-function isMultiTenantDeploy(): boolean {
-  if (process.env.NODE_ENV !== "production") return false;
-  return !isLocalDatabase();
-}
-
 function collectToolResultSummaries(
   completedRun: ActiveRun,
 ): A2AToolResultSummary[] {
@@ -142,23 +140,26 @@ function collectToolResultSummaries(
     .map((event) => ({ tool: event.tool, result: event.result }));
 }
 
-async function resolveIntegrationApiKey(
+export async function resolveIntegrationApiKey(
   engineOption: WebhookHandlerOptions["engine"],
   ownerEmail: string,
   fallbackApiKey: string,
 ): Promise<string | undefined> {
+  const canUseDeployFallback = canUseDeployCredentialFallbackForRequest();
   const engineName = explicitEngineName(engineOption);
   if (engineName) {
     const provider = engineToProvider(engineName);
     const userApiKey = await getOwnerApiKey(provider, ownerEmail);
-    if (userApiKey || isMultiTenantDeploy()) return userApiKey;
+    if (userApiKey) return userApiKey;
+    if (!canUseDeployFallback) return undefined;
     const envVar = PROVIDER_TO_ENV[provider];
     const providerEnvKey = envVar ? readDeployCredentialEnv(envVar) : undefined;
     return providerEnvKey || fallbackApiKey.trim() || undefined;
   }
 
   const userApiKey = await getOwnerActiveApiKey(ownerEmail);
-  if (userApiKey || isMultiTenantDeploy()) return userApiKey;
+  if (userApiKey) return userApiKey;
+  if (!canUseDeployFallback) return undefined;
   return fallbackApiKey.trim() || undefined;
 }
 

package/corpus/core/src/server/action-discovery.ts

@@ -186,6 +186,9 @@ function preserveActionFlags(entry: Record<string, any>): Partial<ActionEntry> {
     out.requiresAuth = entry.requiresAuth;
   }
   if (typeof entry.readOnly === "boolean") out.readOnly = entry.readOnly;
+  if (typeof entry.allowInPlanMode === "boolean") {
+    out.allowInPlanMode = entry.allowInPlanMode;
+  }
   if (typeof entry.parallelSafe === "boolean") {
     out.parallelSafe = entry.parallelSafe;
   }

package/corpus/core/src/server/credential-provider.ts

@@ -78,6 +78,10 @@ export function readDeployCredentialEnv(key: string): string | undefined {
  * single-tenant contexts. In hosted production with a shared database, every
  * signed-in user needs their own user/org/workspace credential so one deploy
  * key does not silently power another tenant's chat.
+ *
+ * @deprecated Use `canUseDeployCredentialFallbackForRequest()` for generic
+ * provider secrets. This stricter helper remains for legacy call sites with
+ * identity-bearing deploy credentials.
  */
 export function isDeployCredentialFallbackAllowed(): boolean {
   if (!isProductionLikeRuntime()) return true;
@@ -86,9 +90,10 @@ export function isDeployCredentialFallbackAllowed(): boolean {
 
 export function canUseDeployCredentialFallbackForRequest(): boolean {
   const email = getRequestUserEmail();
-  if (email && isHostedWorkspaceRuntime()) return false;
   if (!email) return true;
-  return isDeployCredentialFallbackAllowed();
+  if (isHostedWorkspaceRuntime()) return false;
+  if (!isProductionLikeRuntime()) return true;
+  return isLocalDatabase();
 }
 
 const BUILDER_CREDENTIAL_KEYS = [
@@ -962,10 +967,10 @@ export async function resolveSecret(key: string): Promise<string | null> {
       }
       // Secrets table not ready — treat as missing.
     }
-    // Authenticated multi-tenant context: never fall back to process.env.
-    // The deploy-level value would silently impersonate the actual key
-    // owner across every tenant. Local/single-tenant deployments keep the
-    // original env fallback for BYO-server workflows.
+    // Read deployment-provided env values as fallbacks; framework code must not
+    // write to `process.env`, but keys supplied by the host remain valid config.
+    // Builder credentials keep a narrower path below because those keys carry a
+    // Builder identity rather than just enabling a provider call.
     const envFallback = (
       isBuilderCredentialKey(key)
         ? canUseBuilderDeployCredentialFallbackForRequest()

package/corpus/templates/analytics/server/lib/agent-chat-plan-mode.ts

@@ -0,0 +1,29 @@
+import type { ActionEntry } from "@agent-native/core/server";
+
+export const PLAN_MODE_ACT_ONLY_TOOLS = new Set([
+  "query-agent-native-analytics",
+  "bigquery",
+  "provider-api-request",
+  "provider-corpus-job",
+  "query-staged-dataset",
+  "account-deep-dive",
+  "hubspot-deals",
+  "hubspot-records",
+  "gong-calls",
+  "jira-search",
+  "slack-messages",
+  "sentry",
+]);
+
+export function applyAnalyticsPlanModePolicy(
+  actions: Record<string, ActionEntry>,
+): Record<string, ActionEntry> {
+  return Object.fromEntries(
+    Object.entries(actions).map(([name, entry]) => [
+      name,
+      PLAN_MODE_ACT_ONLY_TOOLS.has(name)
+        ? { ...entry, allowInPlanMode: false }
+        : entry,
+    ]),
+  );
+}

package/corpus/templates/analytics/server/plugins/agent-chat.ts

@@ -7,6 +7,7 @@ import {
 } from "@agent-native/core/server";
 
 import actionsRegistry from "../../.generated/actions-registry.js";
+import { applyAnalyticsPlanModePolicy } from "../lib/agent-chat-plan-mode";
 import { renderDataDictionary } from "../lib/data-dictionary-context";
 import {
   failedDataQueryAttemptMessage,
@@ -65,6 +66,11 @@ const INITIAL_TOOL_NAMES = [
   "navigate",
 ];
 
+export {
+  applyAnalyticsPlanModePolicy,
+  PLAN_MODE_ACT_ONLY_TOOLS,
+} from "../lib/agent-chat-plan-mode";
+
 function latestUserText(
   messages: AgentLoopFinalResponseGuardContext["messages"],
 ): string {
@@ -160,7 +166,9 @@ function realDataFinalGuard(context: AgentLoopFinalResponseGuardContext) {
 
 export default createAgentChatPlugin({
   appId: "analytics",
-  actions: loadActionsFromStaticRegistry(actionsRegistry),
+  actions: applyAnalyticsPlanModePolicy(
+    loadActionsFromStaticRegistry(actionsRegistry),
+  ),
   initialToolNames: INITIAL_TOOL_NAMES,
   finalResponseGuard: realDataFinalGuard,
   // Enable sandboxed JavaScript execution for analytics data processing.

package/corpus/templates/design/actions/list-design-extensions.ts

@@ -68,7 +68,7 @@ const FIRST_PARTY_EXTENSIONS: FirstPartyDesignExtension[] = [
     id: "design.asset-library",
     name: "Asset Library",
     description:
-      "Browse and insert Design-native primitives, generated or uploaded media, and rendered Figma library components into the active design screen. " +
+      "Browse and insert Design primitives, generated or uploaded media, and rendered Figma library components into the active design screen. " +
       "Selection-aware: inserts near the selected element when one is active.",
     icon: "Photo",
     availability: "available",
@@ -77,7 +77,7 @@ const FIRST_PARTY_EXTENSIONS: FirstPartyDesignExtension[] = [
     capabilities: [
       {
         id: "native",
-        label: "Browse Design-native assets",
+        label: "Browse Design assets",
         status: "available",
         reason:
           "Uses list-design-native-assets and insert-design-native-asset for editable HTML primitives/components.",