Exclude columns also at the SQL Level. Columns hidden in config can't be queried by agent

[ad4mou]

Summary

• Make exclude_columns actually apply when the agent runs SQL, not only when syncing context.
• Explicit use of an excluded column is blocked with a clear error.
• SELECT * still runs, but excluded columns are removed first and a yellow warning explains what was stripped.
• If we can’t safely tell whether a query touches excluded columns, we block it.

Closes #1015

[github-actions]

🚀 Preview Deployment

URL	https://pr-1373-7db991a.preview.getnao.io
Commit	7db991a

⚠️ No LLM API keys configured - you'll see the API key setup flow when trying to chat.

---

_{Preview will be automatically removed when this PR is closed.}

[cubic-dev-ai]

All reported issues were addressed across 6 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 8 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 3 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[Bl3f]

Need more work I think ; esp. on the column guard, which is not really the best name I'd say.

We should have a parser and from this parser raise usage errors on columns/tables

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 13 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[ad4mou]

I tested extensively with a DuckDB and a BigQuery DB, the feature works great.
Although the agent can kind of go crazy is the choices of columns to exclude are not judicious

[ClaireGz]

@ad4mou we will put this under the enterprise license - can you implement the change?

[ad4mou]

Yes absolutely, this is what it looks like for now.
I'll wait until the new settings are merged to add the little Entreprise lock and to add the feature to the list in the new Entreprise page.

CleanShot.2026-08-26.at.11.29.16.mp4

[cubic-dev-ai]

All reported issues were addressed across 15 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[ad4mou]

LGTM