@agent-native/dispatch 0.23.3 → 0.24.0

package/src/routes/pages/settings.tsx

@@ -10,6 +10,7 @@ import {
   SettingsTabsPage,
   useAgentSettingsTabs,
 } from "@agent-native/core/client/settings";
+import { IconShield } from "@tabler/icons-react";
 import { useState } from "react";
 import { Link } from "react-router";
 
@@ -33,6 +34,17 @@ export function meta() {
 export default function SettingsRoute() {
   const t = useT();
   const agentSettingsTabs = useAgentSettingsTabs();
+  const settingsTabs = [
+    ...agentSettingsTabs.filter((tab) => tab.id !== "integrations"),
+    {
+      id: "admin",
+      label: t("dispatch.nav.admin", { defaultValue: "Admin" }),
+      icon: IconShield,
+      group: "Admin",
+      href: "/admin",
+      content: null,
+    },
+  ];
   const [chatFirstModeState] = useState(() => readChatFirstModeState());
   const [chatFirstMode, setChatFirstMode] = useState(
     () => chatFirstModeState.enabled,
@@ -68,7 +80,7 @@ export default function SettingsRoute() {
       description={t("settings.description")}
     >
       <SettingsTabsPage
-        extraTabs={agentSettingsTabs.filter((tab) => tab.id !== "integrations")}
+        extraTabs={settingsTabs}
         general={
           <div className="mx-auto w-full max-w-3xl space-y-6">
             <Card>

package/src/server/lib/usage-metrics-store.spec.ts

@@ -120,4 +120,121 @@ describe("listDispatchUsageMetrics", () => {
     expect(metrics.recent).toEqual([]);
     expect(metrics.appAccess).toHaveLength(1);
   });
+
+  it("allows personal scope and hydrates a linked thread prompt", async () => {
+    mocks.currentOrgId.mockReturnValue("org-a");
+    mocks.currentOwnerEmail.mockReturnValue("owner@example.test");
+    mocks.getUsageSummary.mockResolvedValue(null);
+    mocks.listWorkspaceApps.mockResolvedValue([]);
+    mocks.execute.mockImplementation(async ({ sql }: { sql: string }) => {
+      if (sql.includes("SELECT id, created_at")) {
+        return {
+          rows: [
+            {
+              id: 7,
+              created_at: Date.now(),
+              owner_email: "owner@example.test",
+              app: "dispatch",
+              label: "chat",
+              model: "test-model",
+              input_tokens: 10,
+              output_tokens: 20,
+              cache_read_tokens: 0,
+              cache_write_tokens: 0,
+              cost_cents_x100: 250,
+              thread_id: "thread-1",
+              run_id: "run-1",
+              task_id: null,
+              source_platform: "dispatch",
+              source_id: "dispatch",
+            },
+          ],
+        };
+      }
+      if (sql.includes("FROM chat_threads WHERE id IN")) {
+        return {
+          rows: [
+            {
+              id: "thread-1",
+              preview: "Fallback preview",
+              thread_data: JSON.stringify({
+                messages: [
+                  {
+                    message: {
+                      role: "user",
+                      content: "Find the repeated background work.",
+                    },
+                  },
+                ],
+              }),
+            },
+          ],
+        };
+      }
+      return { rows: [] };
+    });
+
+    const metrics = await listDispatchUsageMetrics({
+      sinceDays: 7,
+      scope: "me",
+    });
+
+    expect(metrics.viewScope).toBe("me");
+    expect(metrics.recent[0]).toMatchObject({
+      prompt: "Find the repeated background work.",
+      promptSource: "thread",
+      threadId: "thread-1",
+      runId: "run-1",
+    });
+    expect(
+      mocks.execute.mock.calls.some(([query]) =>
+        String((query as { sql?: string }).sql).includes(
+          "LOWER(owner_email) = ?",
+        ),
+      ),
+    ).toBe(true);
+  });
+
+  it("filters workspace usage and prompts to a selected member", async () => {
+    mocks.currentOrgId.mockReturnValue("org-a");
+    mocks.currentOwnerEmail.mockReturnValue("owner@example.test");
+    mocks.getUsageSummary.mockResolvedValue(null);
+    mocks.listWorkspaceApps.mockResolvedValue([]);
+    mocks.execute.mockImplementation(async ({ sql }: { sql: string }) => {
+      if (sql.includes("SELECT role FROM org_members")) {
+        return { rows: [{ role: "owner" }] };
+      }
+      if (sql.includes("SELECT email, role, joined_at")) {
+        return {
+          rows: [
+            { email: "owner@example.test", role: "owner", joined_at: null },
+            { email: "member@example.test", role: "member", joined_at: null },
+          ],
+        };
+      }
+      return { rows: [] };
+    });
+
+    const metrics = await listDispatchUsageMetrics({
+      sinceDays: 30,
+      scope: "workspace",
+      userEmail: "member@example.test",
+    });
+
+    expect(metrics.selectedUserEmail).toBe("member@example.test");
+    expect(metrics.availableUsers).toEqual([
+      { email: "member@example.test", role: "member" },
+      { email: "owner@example.test", role: "owner" },
+    ]);
+    expect(
+      mocks.execute.mock.calls.some(([query]) => {
+        const sql = String((query as { sql?: string }).sql);
+        const args = (query as { args?: unknown[] }).args ?? [];
+        return (
+          sql.includes("LOWER(owner_email) = ?") &&
+          args.includes("member@example.test")
+        );
+      }),
+    ).toBe(true);
+  });
 });

package/src/server/lib/usage-metrics-store.ts

@@ -85,10 +85,27 @@ export interface RecentUsageMetric {
   cacheReadTokens: number;
   cacheWriteTokens: number;
   costCents: number;
+  prompt: string | null;
+  promptSource: "thread" | "thread-preview" | "not-captured" | "unavailable";
+  threadId: string | null;
+  runId: string | null;
+  taskId: string | null;
+  sourcePlatform: string | null;
+  sourceId: string | null;
+}
+
+export type UsageMetricsScope = "me" | "workspace";
+
+export interface UsageUserOption {
+  email: string;
+  role: string | null;
 }
 
 export interface DispatchUsageMetrics {
   billing: UsageBillingMode;
+  viewScope: UsageMetricsScope;
+  selectedUserEmail: string | null;
+  availableUsers: UsageUserOption[];
   sinceMs: number;
   sinceDays: number;
   generatedAt: number;
@@ -151,6 +168,148 @@ function nullableNumberField(
   return Number.isFinite(numberValue) ? numberValue : null;
 }
 
+function nullableStringField(
+  row: Record<string, unknown>,
+  key: string,
+): string | null {
+  const value = row[key];
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed || null;
+}
+
+type ParsedThreadData =
+  | { status: "absent"; value: null }
+  | { status: "invalid"; value: null }
+  | { status: "parsed"; value: Record<string, unknown> };
+
+function parseJson(value: unknown): ParsedThreadData {
+  if (typeof value !== "string" || !value.trim()) {
+    return { status: "absent", value: null };
+  }
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object"
+      ? { status: "parsed", value: parsed as Record<string, unknown> }
+      : { status: "invalid", value: null };
+  } catch {
+    return { status: "invalid", value: null };
+  }
+}
+
+function textFromPromptContent(value: unknown): string {
+  if (typeof value === "string") return value.trim();
+  if (!Array.isArray(value)) return "";
+  return value
+    .map((part) => {
+      if (!part || typeof part !== "object") return "";
+      const item = part as Record<string, unknown>;
+      return item.type === "text" && typeof item.text === "string"
+        ? item.text.trim()
+        : "";
+    })
+    .filter(Boolean)
+    .join("\n")
+    .trim();
+}
+
+function truncatePrompt(value: string, maxLength = 360): string {
+  if (value.length <= maxLength) return value;
+  return `${value.slice(0, maxLength - 1).trimEnd()}…`;
+}
+
+function firstUserPrompt(threadData: unknown): string | null {
+  const parsed = parseJson(threadData);
+  if (parsed.status !== "parsed") return null;
+  const messages = parsed.value.messages;
+  if (!Array.isArray(messages)) return null;
+
+  for (const entry of messages) {
+    if (!entry || typeof entry !== "object") continue;
+    const record = entry as Record<string, unknown>;
+    const message =
+      record.message && typeof record.message === "object"
+        ? (record.message as Record<string, unknown>)
+        : record;
+    const role = typeof message.role === "string" ? message.role : "";
+    if (role !== "user" && role !== "human") continue;
+    const text = textFromPromptContent(message.content);
+    if (text) return truncatePrompt(text);
+  }
+  return null;
+}
+
+interface ThreadPromptRow {
+  id?: unknown;
+  preview?: unknown;
+  thread_data?: unknown;
+}
+
+async function hydrateRecentPrompts(
+  rows: Array<Record<string, unknown>>,
+): Promise<RecentUsageMetric[]> {
+  const threadIds = [
+    ...new Set(
+      rows
+        .map((row) => nullableStringField(row, "thread_id"))
+        .filter((value): value is string => Boolean(value)),
+    ),
+  ];
+  const threads = new Map<string, ThreadPromptRow>();
+  let threadQueryUnavailable = false;
+
+  if (threadIds.length > 0) {
+    try {
+      const result = await getDbExec().execute({
+        sql: `SELECT id, preview, thread_data FROM chat_threads WHERE id IN (${threadIds.map(() => "?").join(", ")})`,
+        args: threadIds,
+      });
+      for (const row of result.rows as ThreadPromptRow[]) {
+        const id = typeof row.id === "string" ? row.id : "";
+        if (id) threads.set(id, row);
+      }
+    } catch {
+      threadQueryUnavailable = true;
+    }
+  }
+
+  return rows.map((row) => {
+    const threadId = nullableStringField(row, "thread_id");
+    const thread = threadId ? threads.get(threadId) : undefined;
+    const prompt = thread ? firstUserPrompt(thread.thread_data) : null;
+    const preview =
+      typeof thread?.preview === "string" ? thread.preview.trim() : "";
+    const promptSource = prompt
+      ? "thread"
+      : preview
+        ? "thread-preview"
+        : threadQueryUnavailable && threadId
+          ? "unavailable"
+          : "not-captured";
+
+    return {
+      id: numberField(row, "id"),
+      createdAt: numberField(row, "created_at"),
+      ownerEmail: stringField(row, "owner_email"),
+      app: stringField(row, "app") || "unattributed",
+      label: stringField(row, "label") || "chat",
+      model: stringField(row, "model") || "unknown",
+      inputTokens: numberField(row, "input_tokens"),
+      outputTokens: numberField(row, "output_tokens"),
+      cacheReadTokens: numberField(row, "cache_read_tokens"),
+      cacheWriteTokens: numberField(row, "cache_write_tokens"),
+      costCents: numberField(row, "cost_cents_x100") / 100,
+      prompt: prompt ?? (preview ? truncatePrompt(preview) : null),
+      promptSource,
+      threadId,
+      runId: nullableStringField(row, "run_id"),
+      taskId: nullableStringField(row, "task_id"),
+      sourcePlatform: nullableStringField(row, "source_platform"),
+      sourceId: nullableStringField(row, "source_id"),
+    } satisfies RecentUsageMetric;
+  });
+}
+
 function labelForKey(value: string): string {
   const trimmed = value.trim();
   return trimmed || "Unattributed";
@@ -293,8 +452,8 @@ function usageScope(
   }
   const placeholders = memberEmails.map(() => "?").join(", ");
   return {
-    where: `created_at >= ? AND owner_email IN (${placeholders})`,
-    args: [sinceMs, ...memberEmails],
+    where: `created_at >= ? AND LOWER(owner_email) IN (${placeholders})`,
+    args: [sinceMs, ...memberEmails.map((email) => email.toLowerCase())],
   };
 }
 
@@ -307,8 +466,34 @@ function threadScope(
   }
   const placeholders = memberEmails.map(() => "?").join(", ");
   return {
-    where: `updated_at >= ? AND owner_email IN (${placeholders})`,
-    args: [sinceMs, ...memberEmails],
+    where: `updated_at >= ? AND LOWER(owner_email) IN (${placeholders})`,
+    args: [sinceMs, ...memberEmails.map((email) => email.toLowerCase())],
+  };
+}
+
+function ownerScope(
+  sinceMs: number,
+  ownerEmail: string,
+): {
+  where: string;
+  args: unknown[];
+} {
+  return {
+    where: "created_at >= ? AND LOWER(owner_email) = ?",
+    args: [sinceMs, ownerEmail.toLowerCase()],
+  };
+}
+
+function ownerThreadScope(
+  sinceMs: number,
+  ownerEmail: string,
+): {
+  where: string;
+  args: unknown[];
+} {
+  return {
+    where: "updated_at >= ? AND LOWER(owner_email) = ?",
+    args: [sinceMs, ownerEmail.toLowerCase()],
   };
 }
 
@@ -382,7 +567,7 @@ async function loadChatStats(
   );
 }
 
-async function assertCanViewMetrics(): Promise<{
+async function assertCanViewMetrics(viewScope: UsageMetricsScope): Promise<{
   viewerEmail: string;
   orgId: string | null;
   role: string | null;
@@ -390,7 +575,12 @@ async function assertCanViewMetrics(): Promise<{
   const viewerEmail = currentOwnerEmail();
   const orgId = currentOrgId();
   const role = await getViewerOrgRole(orgId, viewerEmail);
-  if (isEnvAdmin(viewerEmail) || role === "owner" || role === "admin") {
+  if (
+    viewScope === "me" ||
+    isEnvAdmin(viewerEmail) ||
+    role === "owner" ||
+    role === "admin"
+  ) {
     return { viewerEmail, orgId, role };
   }
   if (!orgId) {
@@ -403,27 +593,57 @@ async function assertCanViewMetrics(): Promise<{
 
 export async function listDispatchUsageMetrics(input: {
   sinceDays?: number;
+  scope?: UsageMetricsScope;
+  userEmail?: string | null;
 }): Promise<DispatchUsageMetrics> {
-  const { viewerEmail, orgId, role } = await assertCanViewMetrics();
+  const viewScope: UsageMetricsScope =
+    input.scope === "me" ? "me" : "workspace";
+  const { viewerEmail, orgId, role } = await assertCanViewMetrics(viewScope);
   const sinceDays = Math.max(1, Math.min(365, input.sinceDays ?? 30));
   const sinceMs = Date.now() - sinceDays * DAY_MS;
   const billing = usageBillingForEngine(await detectUsageEngineName());
 
   await initializeUsageMetricsTable(sinceMs);
 
-  const rawMembers = orgId
-    ? await listOrgMembers(orgId)
-    : await listSignedInUsers();
+  const rawMembers =
+    viewScope === "me"
+      ? [{ email: viewerEmail, role, joinedAt: null }]
+      : orgId
+        ? await listOrgMembers(orgId)
+        : await listSignedInUsers();
   const members =
-    orgId && rawMembers.length === 0
+    viewScope === "workspace" && orgId && rawMembers.length === 0
       ? [{ email: viewerEmail, role, joinedAt: null }]
       : rawMembers;
-  const memberEmails = orgId ? members.map((member) => member.email) : [];
+  const requestedUserEmail = input.userEmail?.trim() || null;
+  const selectedUserEmail =
+    viewScope === "me"
+      ? viewerEmail
+      : requestedUserEmail
+        ? (members.find(
+            (member) =>
+              member.email.toLowerCase() === requestedUserEmail.toLowerCase(),
+          )?.email ?? null)
+        : null;
+  if (viewScope === "workspace" && requestedUserEmail && !selectedUserEmail) {
+    throw new ForbiddenError(
+      "The selected user is not available in this workspace.",
+    );
+  }
+  const memberEmails = selectedUserEmail
+    ? [selectedUserEmail]
+    : orgId
+      ? members.map((member) => member.email)
+      : [];
   const memberByEmail = new Map(
     members.map((member) => [member.email.toLowerCase(), member]),
   );
-  const usage = usageScope(sinceMs, memberEmails);
-  const threads = threadScope(sinceMs, memberEmails);
+  const usage = selectedUserEmail
+    ? ownerScope(sinceMs, selectedUserEmail)
+    : usageScope(sinceMs, memberEmails);
+  const threads = selectedUserEmail
+    ? ownerThreadScope(sinceMs, selectedUserEmail)
+    : threadScope(sinceMs, memberEmails);
 
   const [apps, totalsRows, byApp, byUserBase, byLabel, byModel, chatStats] =
     await Promise.all([
@@ -565,33 +785,27 @@ export async function listDispatchUsageMetrics(input: {
   const recentRows = await queryRows<Record<string, unknown>>(
     `SELECT id, created_at, owner_email, app, label, model,
         input_tokens, output_tokens, cache_read_tokens, cache_write_tokens,
-        cost_cents_x100
+        cost_cents_x100, thread_id, run_id, task_id, source_platform, source_id
       FROM token_usage
       WHERE ${usage.where}
       ORDER BY created_at DESC
       LIMIT 50`,
     usage.args,
   );
-  const recent = recentRows.map((row) => ({
-    id: numberField(row, "id"),
-    createdAt: numberField(row, "created_at"),
-    ownerEmail: stringField(row, "owner_email"),
-    app: stringField(row, "app") || "unattributed",
-    label: stringField(row, "label") || "chat",
-    model: stringField(row, "model") || "unknown",
-    inputTokens: numberField(row, "input_tokens"),
-    outputTokens: numberField(row, "output_tokens"),
-    cacheReadTokens: numberField(row, "cache_read_tokens"),
-    cacheWriteTokens: numberField(row, "cache_write_tokens"),
-    costCents: numberField(row, "cost_cents_x100") / 100,
-  }));
+  const recent = await hydrateRecentPrompts(recentRows);
 
   const appUsageByKey = new Map(
     byApp.map((bucket) => [normalizeAppKey(bucket.key), bucket]),
   );
   const accessUsers = members.length || byUserMap.size;
-  const accessModel = orgId ? "workspace" : "solo";
-  const accessLabel = orgId ? "Workspace members" : "Signed-in users";
+  const accessModel =
+    viewScope === "me" ? "solo" : orgId ? "workspace" : "solo";
+  const accessLabel =
+    viewScope === "me"
+      ? "Your account"
+      : orgId
+        ? "Workspace members"
+        : "Signed-in users";
   const appAccess = apps.map((app) => {
     const usageBucket = appUsageByKey.get(normalizeAppKey(app.id));
     return {
@@ -623,6 +837,11 @@ export async function listDispatchUsageMetrics(input: {
 
   return {
     billing,
+    viewScope,
+    selectedUserEmail,
+    availableUsers: members
+      .map(({ email, role }) => ({ email, role }))
+      .sort((a, b) => a.email.localeCompare(b.email)),
     sinceMs,
     sinceDays,
     generatedAt: Date.now(),

package/src/server/plugins/agent-chat.spec.ts

@@ -24,6 +24,10 @@ describe("Dispatch agent chat plugin", () => {
       expect.objectContaining({
         appId: "dispatch",
         durableBackgroundRuns: true,
+        initialToolNames: expect.arrayContaining([
+          "list-workspace-apps",
+          "update-workspace-app-metadata",
+        ]),
         mcp: {
           connectorCatalog: expect.arrayContaining([
             "start-workspace-app-creation",

package/src/server/plugins/agent-chat.ts

@@ -6,6 +6,7 @@ import { dispatchActions } from "../../actions/index.js";
 const INITIAL_TOOL_NAMES = [
   "view-screen",
   "list-workspace-apps",
+  "update-workspace-app-metadata",
   "list-connected-agents",
   "ask_app",
   "open_app",
@@ -65,6 +66,7 @@ Use the standard workspace primitives:
 - Hosted/connected A2A neighbors such as Analytics and Content come from the available-apps context or list-connected-agents. list-workspace-apps only inventories apps mounted inside this workspace deployment; never use a missing row there to conclude that a connected agent is unavailable.
 - When answering whether a mounted workspace app exposes an agent card or A2A endpoint, call list-workspace-apps with includeAgentCards=true. If you have not requested that probe, absence of agent-card fields means unchecked, not unavailable.
 - When creating a new workspace app, create a separate app under apps/<app-id> with apps/<app-id>/package.json including a concise generated description, mount it at /<app-id>, use relative /<app-id> links, never hardcode localhost or dev ports, use shadcn/ui with @tabler/icons-react rather than lucide-react, and ensure the React Router client entry preserves APP_BASE_PATH/VITE_APP_BASE_PATH via appBasePath(). There is no separate workspace app registry to edit.
+- When a user asks to rename an existing workspace app or change its Dispatch title/description, call update-workspace-app-metadata with the existing appId from list-workspace-apps. This is a metadata-only edit — never call start-workspace-app-creation, which creates a new app and Builder branch.
 - When an explicit app-creation request already includes a source brief or a concrete repeatable workflow, call start-workspace-app-creation without asking non-blocking product or UX questions. Choose recommended defaults, let the Builder handoff record assumptions, and ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow.
 - If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible "Chat", "Starter", "Blank app", or "New app" UI behind.
 - Treat first-party apps such as Mail, Calendar, Analytics, Brain, Assets, and Dispatch as existing hosted/connected neighbors available through links and A2A/default connected agents. Do not create wrapper apps, child apps, nested routes, or cloned template copies just to give a new app access to them; build only the genuinely new workflow and delegate cross-app work to those existing apps.

package/src/server/plugins/auth.spec.ts

@@ -0,0 +1,45 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  authPlugin: vi.fn(),
+  createAuthPlugin: vi.fn(),
+  getDispatchConfig: vi.fn(),
+}));
+
+vi.mock("@agent-native/core/server", () => ({
+  createAuthPlugin: mocks.createAuthPlugin,
+}));
+
+vi.mock("../index.js", () => ({
+  getDispatchConfig: mocks.getDispatchConfig,
+}));
+
+describe("dispatchAuthPlugin", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    mocks.authPlugin.mockReset();
+    mocks.createAuthPlugin.mockReset();
+    mocks.createAuthPlugin.mockReturnValue(mocks.authPlugin);
+    mocks.getDispatchConfig.mockReset();
+  });
+
+  it("installs template public routes on the primary auth guard", async () => {
+    const { default: dispatchAuthPlugin } = await import("./auth.js");
+    const nitroApp = {};
+    const publicPaths = [
+      "/_agent-native/identity/authorize",
+      "/_agent-native/org/apps",
+    ];
+
+    mocks.getDispatchConfig.mockReturnValue({
+      auth: { googleOnly: true, publicPaths },
+    });
+    await dispatchAuthPlugin(nitroApp);
+
+    expect(mocks.createAuthPlugin).toHaveBeenCalledOnce();
+    expect(mocks.createAuthPlugin).toHaveBeenCalledWith(
+      expect.objectContaining({ googleOnly: true, publicPaths }),
+    );
+    expect(mocks.authPlugin).toHaveBeenCalledWith(nitroApp);
+  });
+});

package/src/server/plugins/auth.ts

@@ -28,6 +28,7 @@ const dispatchAuthPlugin = async (nitroApp: any) => {
   const plugin = createAuthPlugin({
     googleOnly,
     marketing: marketing as any,
+    publicPaths: authConfig.publicPaths,
   });
   return plugin(nitroApp);
 };

package/src/server/plugins/integrations.ts

@@ -40,6 +40,7 @@ When a user asks for something:
 - After call-agent returns an answer, RELAY IT DIRECTLY to the user with at most a one-line preface — do not rephrase, summarize, or add commentary. The downstream agent already crafted the answer; your job is delivery, not editing. This minimizes round-trips and keeps the user-visible reply fast.
 - Exception: if the downstream agent reports a missing model/provider credential, do not name exact env vars, Vault keys, tokens, or secrets. Say the target app needs an LLM connection and recommend connecting Builder/managed LLM for that app; keep bring-your-own provider keys as a secondary option only if the user asks.
 - If the user asks to create, build, make, scaffold, or generate an "agent" from Dispatch chat or by tagging @agent-native in Slack, email, or Telegram, first classify the ask. If it is a simple Dispatch-native behavior like a reminder, digest, monitor, routing rule, saved instruction, or recurring workflow, create or update the recurring job/resource/destination in Dispatch. If it is a robust unique product or teammate that needs its own UI, data model, actions, integrations, or domain workflow, treat it as a new workspace app and call start-workspace-app-creation.
+- If a user asks to rename an existing workspace app or change its Dispatch title/description, call update-workspace-app-metadata with the existing appId from list-workspace-apps. Do not call start-workspace-app-creation for a metadata-only edit because that starts a new app and Builder branch.
 - If a new-app prompt asks for access to Mail, Calendar, Analytics, Brain, Assets, or similar first-party app data/agents, keep using the existing hosted/connected app and A2A path. Do not ask Builder to scaffold those apps as children of the new app unless the user explicitly asks for a customized app from that template.
 - If the chat template is used, treat it as scaffolding only: the finished app must be branded as the requested app with its own home screen/navigation/package metadata/manifest, and must not leave visible "Chat", "Starter", "Blank app", or "New app" UI behind.
 - If the user explicitly asks for a new app or workspace app, call start-workspace-app-creation with their prompt and include a concise generated description by default. Do not satisfy a new-app request by adding a route, page, component, or file inside apps/chat or another existing app unless the user explicitly asks to modify that existing app. When the prompt contains a source brief or concrete repeatable workflow, choose recommended defaults and do not ask non-blocking product or UX questions; ask only for authorization, credentials, a destructive action, an ambiguous target workspace, or a genuinely missing workflow. If the request is too vague to classify, ask one concise follow-up. If the action returns mode "builder", reply with the Builder branch URL; Builder is responsible for creating the separate workspace app under apps/<app-id>, mounting it at /<app-id>, ensuring apps/<app-id>/package.json exists with name/displayName and description so Dispatch discovers it, using relative /<app-id> links instead of hardcoded localhost/dev ports, and preserving APP_BASE_PATH/VITE_APP_BASE_PATH in the React Router client entry. The new app lives at the workspace root /<app-id>, NOT under /dispatch/<app-id>, /apps/<app-id>, or any other Dispatch tab — when telling the user where to find it, link to /<app-id> only. There is no separate workspace app registry to edit. If it returns mode "local-agent", tell the user it is ready for the local code agent and include the returned app path/prompt summary. Dispatch reuses the connected workspace Builder project or provisions it through the Builder Projects API when an organization owner/admin starts the first app; members need an owner/admin to configure the project first. Do not ask the user to use Builder org/beta settings. If it returns mode "builder-unavailable", the action also returns a \`reason\` code plus a user-facing \`message\` and (for some reasons) an operator-facing \`detail\`. Relay the \`message\` to the user as-is; only surface \`detail\` when the user is clearly an operator debugging the deployment (e.g. troubleshooting a broken Builder connection for the workspace), never as routine detail for an end user.

package/src/styles/dispatch.css

@@ -9,6 +9,15 @@
 @source "../routes/**/*.{js,mjs,ts,tsx}";
 @source "../../../core/src/client/chat-first/**/*.{ts,tsx}";
 
+/* Keep Dispatch data visualizations aligned with Analytics' blue chart accent. */
+:root {
+  --dispatch-brand-blue: 200 97% 39%;
+}
+
+.dark {
+  --dispatch-brand-blue: 197 100% 50%;
+}
+
 .dispatch-chat-first-chats .an-chat-history-rail__new-chat {
   display: none;
 }